diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..bd49e9a --- /dev/null +++ b/.gitignore @@ -0,0 +1,402 @@ +## Ignore Visual Studio temporary files, build results, and +## files generated by popular Visual Studio add-ons. +## +## Get latest from https://github.com/github/gitignore/blob/main/VisualStudio.gitignore + +# User-specific files +*.rsuser +*.suo +*.user +*.userosscache +*.sln.docstates + +# User-specific files (MonoDevelop/Xamarin Studio) +*.userprefs + +# Mono auto generated files +mono_crash.* + +# Build results +intermed/ +build/ +[Dd]ebug/ +[Dd]ebugPublic/ +[Rr]elease/ +[Rr]eleases/ +x64/ +x86/ +[Ww][Ii][Nn]32/ +[Aa][Rr][Mm]/ +[Aa][Rr][Mm]64/ +bld/ +[Bb]in/ +[Oo]bj/ +[Ll]og/ +[Ll]ogs/ + +# Visual Studio 2015/2017 cache/options directory +.vs/ +# Uncomment if you have tasks that create the project's static files in wwwroot +#wwwroot/ + +# Visual Studio 2017 auto generated files +Generated\ Files/ + +# MSTest test Results +[Tt]est[Rr]esult*/ +[Bb]uild[Ll]og.* + +# NUnit +*.VisualState.xml +TestResult.xml +nunit-*.xml + +# Build Results of an ATL Project +[Dd]ebugPS/ +[Rr]eleasePS/ +dlldata.c + +# Benchmark Results +BenchmarkDotNet.Artifacts/ + +# .NET Core +project.lock.json +project.fragment.lock.json +artifacts/ + +# ASP.NET Scaffolding +ScaffoldingReadMe.txt + +# StyleCop +StyleCopReport.xml + +# Files built by Visual Studio +*_i.c +*_p.c +*_h.h +*.ilk +*.meta +*.obj +*.iobj +*.pch +*.pdb +*.ipdb +*.pgc +*.pgd +*.rsp +# but not Directory.Build.rsp, as it configures directory-level build defaults +!Directory.Build.rsp +*.sbr +*.tlb +*.tli +*.tlh +*.tmp +*.tmp_proj +*_wpftmp.csproj +*.log +*.tlog +*.vspscc +*.vssscc +.builds +*.pidb +*.svclog +*.scc + +# Chutzpah Test files +_Chutzpah* + +# Visual C++ cache files +ipch/ +*.aps +*.ncb +*.opendb +*.opensdf +*.sdf +*.cachefile +*.VC.db +*.VC.VC.opendb + +# Visual Studio profiler +*.psess +*.vsp +*.vspx +*.sap + +# Visual Studio Trace Files +*.e2e + +# TFS 2012 Local Workspace +$tf/ + +# Guidance Automation Toolkit +*.gpState + +# ReSharper is a .NET coding add-in +_ReSharper*/ +*.[Rr]e[Ss]harper +*.DotSettings.user + +# TeamCity is a build add-in +_TeamCity* + +# DotCover is a Code Coverage Tool +*.dotCover + +# AxoCover is a Code Coverage Tool +.axoCover/* +!.axoCover/settings.json + +# Coverlet is a free, cross platform Code Coverage Tool +coverage*.json +coverage*.xml +coverage*.info + +# Visual Studio code coverage results +*.coverage +*.coveragexml + +# NCrunch +_NCrunch_* +.*crunch*.local.xml +nCrunchTemp_* + +# MightyMoose +*.mm.* +AutoTest.Net/ + +# Web workbench (sass) +.sass-cache/ + +# Installshield output folder +[Ee]xpress/ + +# DocProject is a documentation generator add-in +DocProject/buildhelp/ +DocProject/Help/*.HxT +DocProject/Help/*.HxC +DocProject/Help/*.hhc +DocProject/Help/*.hhk +DocProject/Help/*.hhp +DocProject/Help/Html2 +DocProject/Help/html + +# Click-Once directory +publish/ + +# Publish Web Output +*.[Pp]ublish.xml +*.azurePubxml +# Note: Comment the next line if you want to checkin your web deploy settings, +# but database connection strings (with potential passwords) will be unencrypted +*.pubxml +*.publishproj + +# Microsoft Azure Web App publish settings. Comment the next line if you want to +# checkin your Azure Web App publish settings, but sensitive information contained +# in these scripts will be unencrypted +PublishScripts/ + +# NuGet Packages +*.nupkg +# NuGet Symbol Packages +*.snupkg +# The packages folder can be ignored because of Package Restore +**/[Pp]ackages/* +# except build/, which is used as an MSBuild target. +!**/[Pp]ackages/build/ +# Uncomment if necessary however generally it will be regenerated when needed +#!**/[Pp]ackages/repositories.config +# NuGet v3's project.json files produces more ignorable files +*.nuget.props +*.nuget.targets + +# Microsoft Azure Build Output +csx/ +*.build.csdef + +# Microsoft Azure Emulator +ecf/ +rcf/ + +# Windows Store app package directories and files +AppPackages/ +BundleArtifacts/ +Package.StoreAssociation.xml +_pkginfo.txt +*.appx +*.appxbundle +*.appxupload + +# Visual Studio cache files +# files ending in .cache can be ignored +*.[Cc]ache +# but keep track of directories ending in .cache +!?*.[Cc]ache/ + +# Others +ClientBin/ +~$* +*~ +*.dbmdl +*.dbproj.schemaview +*.jfm +*.pfx +*.publishsettings +orleans.codegen.cs + +# Including strong name files can present a security risk +# (https://github.com/github/gitignore/pull/2483#issue-259490424) +#*.snk + +# Since there are multiple workflows, uncomment next line to ignore bower_components +# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622) +#bower_components/ + +# RIA/Silverlight projects +Generated_Code/ + +# Backup & report files from converting an old project file +# to a newer Visual Studio version. Backup files are not needed, +# because we have git ;-) +_UpgradeReport_Files/ +Backup*/ +UpgradeLog*.XML +UpgradeLog*.htm +ServiceFabricBackup/ +*.rptproj.bak + +# SQL Server files +*.mdf +*.ldf +*.ndf + +# Business Intelligence projects +*.rdl.data +*.bim.layout +*.bim_*.settings +*.rptproj.rsuser +*- [Bb]ackup.rdl +*- [Bb]ackup ([0-9]).rdl +*- [Bb]ackup ([0-9][0-9]).rdl + +# Microsoft Fakes +FakesAssemblies/ + +# GhostDoc plugin setting file +*.GhostDoc.xml + +# Node.js Tools for Visual Studio +.ntvs_analysis.dat +node_modules/ + +# Visual Studio 6 build log +*.plg + +# Visual Studio 6 workspace options file +*.opt + +# Visual Studio 6 auto-generated workspace file (contains which files were open etc.) +*.vbw + +# Visual Studio 6 auto-generated project file (contains which files were open etc.) +*.vbp + +# Visual Studio 6 workspace and project file (working project files containing files to include in project) +*.dsw +*.dsp + +# Visual Studio 6 technical files +*.ncb +*.aps + +# Visual Studio LightSwitch build output +**/*.HTMLClient/GeneratedArtifacts +**/*.DesktopClient/GeneratedArtifacts +**/*.DesktopClient/ModelManifest.xml +**/*.Server/GeneratedArtifacts +**/*.Server/ModelManifest.xml +_Pvt_Extensions + +# Paket dependency manager +.paket/paket.exe +paket-files/ + +# FAKE - F# Make +.fake/ + +# CodeRush personal settings +.cr/personal + +# Python Tools for Visual Studio (PTVS) +__pycache__/ +*.pyc + +# Cake - Uncomment if you are using it +# tools/** +# !tools/packages.config + +# Tabs Studio +*.tss + +# Telerik's JustMock configuration file +*.jmconfig + +# BizTalk build output +*.btp.cs +*.btm.cs +*.odx.cs +*.xsd.cs + +# OpenCover UI analysis results +OpenCover/ + +# Azure Stream Analytics local run output +ASALocalRun/ + +# MSBuild Binary and Structured Log +*.binlog + +# NVidia Nsight GPU debugger configuration file +*.nvuser + +# MFractors (Xamarin productivity tool) working folder +.mfractor/ + +# Local History for Visual Studio +.localhistory/ + +# Visual Studio History (VSHistory) files +.vshistory/ + +# BeatPulse healthcheck temp database +healthchecksdb + +# Backup folder for Package Reference Convert tool in Visual Studio 2017 +MigrationBackup/ + +# Ionide (cross platform F# VS Code tools) working folder +.ionide/ + +# Fody - auto-generated XML schema +FodyWeavers.xsd + +# VS Code files for those working on multiple tools +.vscode/* +!.vscode/settings.json +!.vscode/tasks.json +!.vscode/launch.json +!.vscode/extensions.json +*.code-workspace + +# Local History for Visual Studio Code +.history/ + +# Windows Installer files from build outputs +*.cab +*.msi +*.msix +*.msm +*.msp + +# JetBrains Rider +*.sln.iml diff --git a/README.md b/README.md index a54d27b..bdf338b 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,33 @@ -# StealingSignatures -Stealing signatures from pe files - - - This project copies the certificate from a pe file onto another pe file. This will create a invalid signature. Perhaps good to trick a bad anti-cheat or anti-virus program. - - code is horrible, might rewrite it soon. + +# Build +## 1. Clone + + +```bash +git clone https://github.com/flaxyaw/Better-SignatureStealer.git +cd Better-SignatureStealer +``` + +## 2. Build +### Build using Visual Studio (GUI) + +1. CD SignatureStealer-Recode +2. Open the provided .sln file. +3. Change build type to Debug | Release x64 +4. Build Project + +### Build using msbuild (CLI) +```bash +cd SignatureStealer-Recode +msbuild SignatureStealer-Recode.sln /p:Configuration=Release /p:Platform=x64 +cd build +SignatureStealer.exe +``` + +## 3. Usage + +1. Open SignatureStealer.exe +2. Provide the path to an signed PE file +3. Provide the path to an unsigned PE file +4. Check logs for confirmation +5. Confirm by checking the digital signature on unsignedfilename.exe.signed diff --git a/SignatureStealer-Recode/SignatureStealer-Recode.sln b/SignatureStealer-Recode/SignatureStealer-Recode.sln new file mode 100644 index 0000000..7921b9a --- /dev/null +++ b/SignatureStealer-Recode/SignatureStealer-Recode.sln @@ -0,0 +1,28 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.12.35506.116 d17.12 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "SignatureStealer-Recode", "SignatureStealer-Recode\SignatureStealer-Recode.vcxproj", "{70894DA2-F5A2-4BEE-A971-D8BD6861FE1B}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {70894DA2-F5A2-4BEE-A971-D8BD6861FE1B}.Debug|x64.ActiveCfg = Debug|x64 + {70894DA2-F5A2-4BEE-A971-D8BD6861FE1B}.Debug|x64.Build.0 = Debug|x64 + {70894DA2-F5A2-4BEE-A971-D8BD6861FE1B}.Debug|x86.ActiveCfg = Debug|Win32 + {70894DA2-F5A2-4BEE-A971-D8BD6861FE1B}.Debug|x86.Build.0 = Debug|Win32 + {70894DA2-F5A2-4BEE-A971-D8BD6861FE1B}.Release|x64.ActiveCfg = Release|x64 + {70894DA2-F5A2-4BEE-A971-D8BD6861FE1B}.Release|x64.Build.0 = Release|x64 + {70894DA2-F5A2-4BEE-A971-D8BD6861FE1B}.Release|x86.ActiveCfg = Release|Win32 + {70894DA2-F5A2-4BEE-A971-D8BD6861FE1B}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/SignatureStealer-Recode/SignatureStealer-Recode/SignatureStealer-Recode.vcxproj b/SignatureStealer-Recode/SignatureStealer-Recode/SignatureStealer-Recode.vcxproj new file mode 100644 index 0000000..dc2e23c --- /dev/null +++ b/SignatureStealer-Recode/SignatureStealer-Recode/SignatureStealer-Recode.vcxproj @@ -0,0 +1,156 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 17.0 + Win32Proj + {70894da2-f5a2-4bee-a971-d8bd6861fe1b} + SignatureStealerRecode + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + ..\build + ..\intermed + SignatureStealer + + + ..\build + ..\intermed + SignatureStealer + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpp20 + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpp20 + + + Console + true + true + true + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/SignatureStealer-Recode/SignatureStealer-Recode/SignatureStealer-Recode.vcxproj.filters b/SignatureStealer-Recode/SignatureStealer-Recode/SignatureStealer-Recode.vcxproj.filters new file mode 100644 index 0000000..f7f08ad --- /dev/null +++ b/SignatureStealer-Recode/SignatureStealer-Recode/SignatureStealer-Recode.vcxproj.filters @@ -0,0 +1,45 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Header Files + + + Header Files + + + Header Files + + + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + Source Files + + + \ No newline at end of file diff --git a/SignatureStealer-Recode/SignatureStealer-Recode/ext/logger/logger.h b/SignatureStealer-Recode/SignatureStealer-Recode/ext/logger/logger.h new file mode 100644 index 0000000..dc7ab91 --- /dev/null +++ b/SignatureStealer-Recode/SignatureStealer-Recode/ext/logger/logger.h @@ -0,0 +1,49 @@ +#pragma once +#include +#include + +namespace logger { + + enum e_logtype : int { + success = 0, + info = 1, + error = 2 + }; + + + inline void log(e_logtype type, std::string msg, ...) { + + HANDLE hConsole = GetStdHandle(STD_OUTPUT_HANDLE); + const char* prefix = ""; + + switch (type) { + case e_logtype::success: + SetConsoleTextAttribute(hConsole, FOREGROUND_GREEN | FOREGROUND_INTENSITY); + prefix = "[#]"; + break; + case e_logtype::info: + SetConsoleTextAttribute(hConsole, FOREGROUND_WHITE | FOREGROUND_WHITE | FOREGROUND_INTENSITY); + prefix = "[+]"; + break; + case e_logtype::error: + SetConsoleTextAttribute(hConsole, FOREGROUND_RED | FOREGROUND_INTENSITY); + prefix = "[!]"; + break; + } + std::string final_string = prefix + msg + "\n"; + va_list args; + va_start(args, msg); + std::vprintf(final_string.c_str(), args); + va_end(args); + SetConsoleTextAttribute(hConsole, FOREGROUND_RED | FOREGROUND_GREEN | FOREGROUND_BLUE); + + } + +} + +/* +SetConsoleTextAttribute(hConsole, FOREGROUND_GREEN | FOREGROUND_INTENSITY); +SetConsoleTextAttribute(hConsole, FOREGROUND_RED | FOREGROUND_INTENSITY); +SetConsoleTextAttribute(hConsole, FOREGROUND_RED | FOREGROUND_GREEN | FOREGROUND_INTENSITY); +SetConsoleTextAttribute(hConsole, FOREGROUND_RED | FOREGROUND_GREEN | FOREGROUND_BLUE); +*/ \ No newline at end of file diff --git a/SignatureStealer-Recode/SignatureStealer-Recode/src/certificate_handler.cpp b/SignatureStealer-Recode/SignatureStealer-Recode/src/certificate_handler.cpp new file mode 100644 index 0000000..79a2d5b --- /dev/null +++ b/SignatureStealer-Recode/SignatureStealer-Recode/src/certificate_handler.cpp @@ -0,0 +1,75 @@ +#include "certificate_handler/certificate_handler.h" +#include "file_utils/file_utils.h" +#include "header_parser/header_parser.h" +#include "../ext/logger/logger.h" +#include +#include +#include + +bool steal_certificate_from_file(std::string& signed_path, std::string& unsigned_path) +{ + // Get location and size of certificate from target program + DWORD certificate_size; + DWORD certificate_location = get_position(&certificate_size, signed_path); + + // Error check + if (certificate_size == 0x0 || certificate_location == 0x0) + { + logger::log(logger::error, "Target file is not signed."); + return false; + } + + logger::log(logger::info, "Found certificate at position: 0x%p", certificate_location); + logger::log(logger::info, "Certificate size : %d bytes", certificate_size); + + // Copy certificate into buffer + std::vector cert(certificate_size); + std::ifstream target_file_input(signed_path, std::ios::binary); + target_file_input.seekg(certificate_location); + target_file_input.read(cert.data(), certificate_size); + target_file_input.close(); + + logger::log(logger::info, "Copied certificate"); + + // Create copy of program to add certificate to + std::string new_file_path = create_copy(unsigned_path); + logger::log(logger::info, "Created copy of file to add certificate"); + + // Get positions to write cert position and size to + int index_size; + int index_position = get_position_of_position(&index_size, unsigned_path); + + // Load whole file into buffer and edit there + std::ifstream new_file_in(new_file_path, std::ios::binary); + new_file_in.seekg(0, std::ios::end); + int file_size = new_file_in.tellg(); + new_file_in.seekg(0, std::ios::beg); + std::vector file_content(file_size); + new_file_in.read(file_content.data(), file_size); + new_file_in.close(); + + // Overwrite position and size + std::ofstream new_file_off(new_file_path, std::ios::binary); + DWORD created_cert_location = file_size; + DWORD created_cert_size = certificate_size; + + logger::log(logger::info, "Overwriting values in add file"); + *(DWORD*)&file_content[index_position] = created_cert_location; + *(DWORD*)&file_content[index_size] = created_cert_size; + + // Write buffer back to file + new_file_off.write(file_content.data(), file_size); + new_file_off.close(); + + // Append the certificate to the new file + logger::log(logger::info, "Done overwriting location and size"); + std::ofstream coutfile(new_file_path, std::ios::binary | std::ios::app); + coutfile.write(cert.data(), certificate_size); + coutfile.close(); + + logger::log(logger::info, "Added certificate in new file at : 0x%p with size : %d", created_cert_location, certificate_size); + logger::log(logger::success, "SUCCESS"); + + Sleep(5000); + return true; +} diff --git a/SignatureStealer-Recode/SignatureStealer-Recode/src/certificate_handler/certificate_handler.h b/SignatureStealer-Recode/SignatureStealer-Recode/src/certificate_handler/certificate_handler.h new file mode 100644 index 0000000..1733a59 --- /dev/null +++ b/SignatureStealer-Recode/SignatureStealer-Recode/src/certificate_handler/certificate_handler.h @@ -0,0 +1,4 @@ +#pragma once +#include + +bool steal_certificate_from_file(std::string& signed_path, std::string& unsigned_path); diff --git a/SignatureStealer-Recode/SignatureStealer-Recode/src/file_utils.cpp b/SignatureStealer-Recode/SignatureStealer-Recode/src/file_utils.cpp new file mode 100644 index 0000000..2d78c9c --- /dev/null +++ b/SignatureStealer-Recode/SignatureStealer-Recode/src/file_utils.cpp @@ -0,0 +1,41 @@ +#include "file_utils/file_utils.h" +#include "../ext/logger/logger.h" +#include +#include + +std::string create_copy(std::string& path) +{ + // New file name + std::string new_path = path + ".signed"; + + // Open input and output streams + std::ofstream new_file(new_path, std::ios::binary); + std::ifstream base_file(path, std::ios::binary); + + // Error checks + if (!new_file.is_open()) + { + logger::log(logger::error, "Could not open new_file stream"); + return ""; + } + + if (!base_file.is_open()) + { + logger::log(logger::error, "Could not open base_file stream"); + return ""; + } + + // Get file size + base_file.seekg(0, std::ios::end); + int file_size = base_file.tellg(); + base_file.seekg(0, std::ios::beg); + + // Create buffer for file size and copy into it + std::vector content(file_size); + base_file.read(content.data(), file_size); + + // Copy buffer to new file + new_file.write(content.data(), file_size); + + return new_path; +} diff --git a/SignatureStealer-Recode/SignatureStealer-Recode/src/file_utils/file_utils.h b/SignatureStealer-Recode/SignatureStealer-Recode/src/file_utils/file_utils.h new file mode 100644 index 0000000..608cd4f --- /dev/null +++ b/SignatureStealer-Recode/SignatureStealer-Recode/src/file_utils/file_utils.h @@ -0,0 +1,4 @@ +#pragma once +#include + +std::string create_copy(std::string& path); diff --git a/SignatureStealer-Recode/SignatureStealer-Recode/src/header_parser.cpp b/SignatureStealer-Recode/SignatureStealer-Recode/src/header_parser.cpp new file mode 100644 index 0000000..e114515 --- /dev/null +++ b/SignatureStealer-Recode/SignatureStealer-Recode/src/header_parser.cpp @@ -0,0 +1,53 @@ +#include "header_parser/header_parser.h" +#include +#include + +int get_position_of_position(int* size, std::string& path) +{ + // Create buffer for header + uint8_t headers[0xFFF]; // Size for headers + + // Read header data into buffer + std::ifstream stream(path, std::ios::binary); + stream.read(reinterpret_cast(&headers), sizeof(headers)); + stream.close(); + + // Get DOS and NT header + PIMAGE_DOS_HEADER dos_headers = reinterpret_cast(&headers); + PIMAGE_NT_HEADERS64 nt_header = reinterpret_cast(reinterpret_cast(&headers) + dos_headers->e_lfanew); + + // Get end of optional header + int location = (reinterpret_cast(&nt_header->OptionalHeader.DataDirectory) + sizeof(IMAGE_DATA_DIRECTORY)) - reinterpret_cast(&headers); + + // Add offset depending on platform + if (nt_header->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) + location += 24; + else + location += 8; + + // Both values are DWORDs, so add 4 bytes to skip location and get size + *size = location + 4; + return location; +} + +DWORD get_position(DWORD* size, std::string& path) +{ + // Create buffer for header + uint8_t headers[0xFFF]; + + // Read header data into buffer + std::ifstream stream(path, std::ios::binary); + stream.read(reinterpret_cast(&headers), sizeof(headers)); + stream.close(); + + // Get positions in buffer + int location_size; + int location = get_position_of_position(&location_size, path); + + // Interpret the location as DWORD pointer and get the value + DWORD location_in_file = *(DWORD*)(&headers[location]); + DWORD size_value = *(DWORD*)(&headers[location_size]); + + *size = size_value; + return location_in_file; +} diff --git a/SignatureStealer-Recode/SignatureStealer-Recode/src/header_parser/header_parser.h b/SignatureStealer-Recode/SignatureStealer-Recode/src/header_parser/header_parser.h new file mode 100644 index 0000000..ad7ac2d --- /dev/null +++ b/SignatureStealer-Recode/SignatureStealer-Recode/src/header_parser/header_parser.h @@ -0,0 +1,6 @@ +#pragma once +#include +#include + +DWORD get_position(DWORD* size, std::string& path); +int get_position_of_position(int* size, std::string& path); diff --git a/SignatureStealer-Recode/SignatureStealer-Recode/src/main.cpp b/SignatureStealer-Recode/SignatureStealer-Recode/src/main.cpp new file mode 100644 index 0000000..c8af199 --- /dev/null +++ b/SignatureStealer-Recode/SignatureStealer-Recode/src/main.cpp @@ -0,0 +1,39 @@ +// Forced includes +#include +#include + +// Custom includes +#include "certificate_handler/certificate_handler.h" +#include "file_utils/file_utils.h" +#include "header_parser/header_parser.h" +#include "../ext/logger/logger.h" + +int main() +{ + // Get file paths + std::string signed_path; + std::string unsigned_path; + + // Prompt the user for the signed file path + logger::log(logger::info, "Please enter the path to the signed file."); + std::cout << ": "; + std::getline(std::cin, signed_path); // Use getline to handle spaces in paths + + // Prompt the user for the unsigned file path + logger::log(logger::info, "Please enter the path to the unsigned file."); + std::cout << "[+]: "; + std::getline(std::cin, unsigned_path); // Use getline to handle spaces in paths + + // Call the function to steal the certificate + bool success = steal_certificate_from_file(signed_path, unsigned_path); + if (success) + { + logger::log(logger::success, "Certificate stolen and added successfully!"); + } + else + { + logger::log(logger::error, "Failed to steal or add the certificate."); + } + + return 0; +} diff --git a/SignatureStealer.h b/SignatureStealer.h deleted file mode 100644 index 478d236..0000000 --- a/SignatureStealer.h +++ /dev/null @@ -1,175 +0,0 @@ -#pragma once -#include -#include -#include -#include -#include - - -std::string CreateCopy(std::string& path) -{ - //new file name - std::string newPath = path + ".signed"; - - //open input and output steam - std::ofstream newFile(newPath, std::ios::binary); - std::ifstream baseFile(path, std::ios::binary); - - //error checks - if (!newFile.is_open()) - { - std::cout << "Could not open newFile stream"; - return ""; - } - - if (!baseFile.is_open()) - { - std::cout << "Could not open basefile stream"; - return ""; - } - - //get filesize - baseFile.seekg(0, std::ios::end); - int fileSize = baseFile.tellg(); - baseFile.seekg(0, std::ios::beg); - - //create buffer for filesize and copy into it - char* content = new char[fileSize]; - baseFile.read(content, fileSize); - //copy buffer to new file - newFile.write(content, fileSize); - - //clean up - baseFile.close(); - newFile.close(); - delete[] content; - return newPath; -} - -int GetPositionOfPosition(int* size, std::string& path) -{ - //create buffer for header - uint8_t headers[0xFFF]; //perhaps this a little big but eh - - //read header data in buffer - std::ifstream stream(path, std::ios::binary); - stream.read(reinterpret_cast(&headers), sizeof(headers)); - stream.close(); - - //get dos and nt header - PIMAGE_DOS_HEADER dosHeaders = reinterpret_cast(&headers); - PIMAGE_NT_HEADERS64 ntHeader = reinterpret_cast(reinterpret_cast(&headers) + dosHeaders->e_lfanew); - - //get end of optional header - int location = (reinterpret_cast(&ntHeader->OptionalHeader.DataDirectory) + sizeof(IMAGE_DATA_DIRECTORY)) - reinterpret_cast(&headers); - - //add offset depending on platform - if (ntHeader->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) - location += 24; - else - location += 8; - - //clean up - delete[] headers; - - //both values are DWORDS so add 4 bytes to skip location and get size - *size = location + 4; - return location; -} - -DWORD GetPosition(DWORD* size, std::string& path) -{ - //create buffer for header - uint8_t headers[0xFFF]; - //read header data in buffer - std::ifstream stream(path, std::ios::binary); - stream.read(reinterpret_cast(&headers), sizeof(headers)); - stream.close(); - - //get positions in buffer - int locationSize; - int location = GetPositionOfPosition(&locationSize, path); - - //interprete the location as dword pointer and get the value - DWORD locationInFile = *(DWORD*)(&headers[location]); - DWORD sizeValue = *(DWORD*)(&headers[locationSize]); - - *size = sizeValue; - return locationInFile; -} - - -bool StealCertificateFromFile(std::string& targetPath, std::string& addPath) -{ - //Get location and size of certificate from target program - DWORD certificateSize; - DWORD certificateLocation = GetPosition(&certificateSize, targetPath); - - //error check - if (certificateSize == 0x0 || certificateLocation == 0x0) - { - std::cout << "[x] Targetfile is not signed." << std::endl; - system("pause"); - return false; - } - - std::cout << "[<] Found certificate at position -> 0x" << std::hex << certificateLocation << std::endl; - std::cout << "[<] Certificate size -> " << std::dec << certificateSize << " bytes" << std::endl; - - //Copy certificate into buffer - char* cert = new char[certificateSize]; - std::ifstream targetFileInput(targetPath, std::ios::binary); - targetFileInput.seekg(certificateLocation); - targetFileInput.read(cert, certificateSize); - targetFileInput.close(); - - std::cout << "[<] Copied certificate" << std::endl; - - - //create copy of program to add certificate too to not mess stuff up - std::string newFilePath = CreateCopy(addPath); - std::cout << "[<] Created copy of file to add certificate" << std::endl; - - //get positions to write cert position and size to - int indexSize; - int indexPosition = GetPositionOfPosition(&indexSize, addPath); - - - //load whole file into buffer and edit there because I have no clue how to do it with streams - //open steam to new file - std::ifstream newFileIn(newFilePath, std::ios::binary); - //get filesize - newFileIn.seekg(0, std::ios::end); - int fileSize = newFileIn.tellg(); - newFileIn.seekg(0, std::ios::beg); - //read file to buffer - char* fileContent = new char[fileSize]; - newFileIn.read(fileContent, fileSize); - newFileIn.close(); - - //overwrite position and size - std::ofstream newFileOff(newFilePath, std::ios::binary); - DWORD createdCertLocation = fileSize; - DWORD createdCertSize = certificateSize; - - std::cout << "[<] Overwriting values in add file" << std::endl; - *(DWORD*)&fileContent[indexPosition] = createdCertLocation; - *(DWORD*)&fileContent[indexSize] = createdCertSize; - //write buffer back to file - newFileOff.write(fileContent, fileSize); - newFileOff.close(); - delete[] fileContent; - - //close stream and open appended stream to add certificate to the end - std::cout << "[<] Done overwriting location and size" << std::endl; - - std::ofstream coutfile(newFilePath, std::ios::binary | std::ios::app); - coutfile.write(cert, certificateSize); - //clean up - coutfile.close(); - delete[] cert; - - std::cout << "[<] Added certificate in new file at -> 0x" << std::hex << createdCertLocation << " with size -> " << std::dec << certificateSize << std::endl;; - std::cout << "SUCCESS" << std::endl; - return true; -} diff --git a/test.cpp b/test.cpp deleted file mode 100644 index df33555..0000000 --- a/test.cpp +++ /dev/null @@ -1,22 +0,0 @@ -#include "SignatureDublication.h" - - -int main() -{ - //get file paths - std::string targetPath; - std::string addPath; - - std::cout << "Please enter path to Executable to steal the certificate from: "; - std::cin >> targetPath; - - std::cout << "Please enter path to Executable to add certificate to: "; - std::cin >> addPath; - - - StealCertificateFromFile(targetPath, addPath); - - - system("pause"); - return 0; -}