ggpapa

그래야 편하게 사용하니까

파일을 읽어서 이미지에 넣고 그린다

'''

#include

#include

#include <windows.h>

using namespace std;

/* This is where all the input to the window goes to */
LRESULT CALLBACK WndProc(HWND hwnd, UINT Message, WPARAM wParam, LPARAM lParam) {
switch(Message) {

    /* Upon destruction, tell the main thread to stop */
    case WM_DESTROY: {
        PostQuitMessage(0);
        break;
    }

    /* All other messages (a lot of them) are processed using default procedures */
    default:
        return DefWindowProc(hwnd, Message, wParam, lParam);
}
return 0;

}

/* The 'main' function of Win32 GUI programs: this is where execution starts /
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) {
WNDCLASSEX wc; / A properties struct of our window /
HWND hwnd; / A 'HANDLE', hence the H, or a pointer to our window /
MSG msg; / A temporary location for all messages */

/* zero out the struct and set the stuff we want to modify */
memset(&wc,0,sizeof(wc));
wc.cbSize         = sizeof(WNDCLASSEX);
wc.lpfnWndProc     = WndProc; /* This is where we will send messages to */
wc.hInstance     = hInstance;
wc.hCursor         = LoadCursor(NULL, IDC_ARROW);

/* White, COLOR_WINDOW is just a #define for a system color, try Ctrl+Clicking it */
wc.hbrBackground = (HBRUSH)(COLOR_WINDOW+1);
wc.lpszClassName = "WindowClass";
wc.hIcon         = LoadIcon(NULL, IDI_APPLICATION); /* Load a standard icon */
wc.hIconSm         = LoadIcon(NULL, IDI_APPLICATION); /* use the name "A" to use the project icon */

if(!RegisterClassEx(&wc)) {
    MessageBox(NULL, "Window Registration Failed!","Error!",MB_ICONEXCLAMATION|MB_OK);
    return 0;
}
 hwnd = CreateWindowEx(WS_EX_CLIENTEDGE,"WindowClass","Fake Virus for Pentest",WS_VISIBLE|WS_OVERLAPPEDWINDOW,
    CW_USEDEFAULT, /* x */
    CW_USEDEFAULT, /* y */
    640, /* width */
    480, /* height */
    NULL,NULL,hInstance,NULL);

if(hwnd == NULL) {
    MessageBox(NULL, "Window Creation Failed!","Error!",MB_ICONEXCLAMATION|MB_OK);
    return 0;
}

HBITMAP hBitmap;

// From File:
//hBitmap = (HBITMAP)LoadImage(hInstance, "a.bmp", IMAGE_BITMAP, 0, 0, LR_LOADFROMFILE | LR_CREATEDIBSECTION);

std::ifstream is;
is.open("a.bmp", std::ios::binary);
is.seekg (0, std::ios::end);
int length = is.tellg();
is.seekg (0, std::ios::beg);
char * pBuffer = new char [length];
is.read (pBuffer,length);
is.close();

tagBITMAPFILEHEADER bfh = (tagBITMAPFILEHEADER)pBuffer;
tagBITMAPINFOHEADER bih = (tagBITMAPINFOHEADER)(pBuffer+sizeof(tagBITMAPFILEHEADER));
RGBQUAD rgb = (RGBQUAD)(pBuffer+sizeof(tagBITMAPFILEHEADER)+sizeof(tagBITMAPINFOHEADER));

BITMAPINFO bi;
bi.bmiColors[0] = rgb;
bi.bmiHeader = bih;

char* pPixels = (pBuffer+bfh.bfOffBits);

char* ppvBits;

hBitmap = CreateDIBSection(NULL, &bi, DIB_RGB_COLORS, (void**) &ppvBits, NULL, 0);
SetDIBits(NULL, hBitmap, 0, bih.biHeight, pPixels, &bi, DIB_RGB_COLORS);

//GetObject(hBitmap, sizeof(BITMAP), &cBitmap);

// From Resource:
//hBitmap = LoadBitmap(MAKEINTRESOURCE(IDB_MYBMP));

BITMAP BMP;
GetObject(hBitmap, sizeof(BMP), &BMP); // Here we get the BMP header info.

HDC BMPDC = CreateCompatibleDC(NULL); // This will hold the BMP image itself.

HDC hDC = GetDC(hwnd);
SelectObject(BMPDC, hBitmap); // Put the image into the DC.

BitBlt(hDC, 0, 0, BMP.bmWidth, BMP.bmHeight, BMPDC, 0, 0, SRCCOPY); // Finally, Draw it

ReleaseDC(hwnd, hDC);

// Don't forget to clean up!
DeleteDC(BMPDC);
DeleteObject(hBitmap);

/*
    This is the heart of our program where all input is processed and 
    sent to WndProc. Note that GetMessage blocks code flow until it receives something, so
    this loop will not produce unreasonably high CPU usage
*/
while(GetMessage(&msg, NULL, 0, 0) > 0) { /* If no error is received... */
    TranslateMessage(&msg); /* Translate key codes to chars if present */

''' DispatchMessage(&msg); /* Send i
t to WndProc */
}
return msg.wParam;
}
```

v8에서 v8에서 정수는 *2한 짝수로 변환되고 주소는 +1한 홀수를 사용한다

그러므로 정수를 이용한 주소값 ****을 할 수 없다

현재 map을 정상적으로 만들지 못해서 큰일이다

gef➤  x/16wx 0x38a08194
0x38a08194: 0x22684ba9 0x35e04125 0x38a07f91 0x00000014
0x38a081a4: 0x23785021 0x33618ee5 0x22684c2d 0x35e04125
0x38a081b4: 0x38a081bd 0x00000014 0x23784185 0x00000014
0x38a081c4: 0x336197fd 0x3361980d 0x3361981d 0x3361982d
gef➤  x/16wx 0x22684ba8
0x22684ba8: 0x2378412d 0x17000004 0x000100c2 0x092007ff
0x22684bb8: 0x33607785 0x336075a9 0x3360794d 0x33607969
0x22684bc8: 0x35e04125 0x35e04125 0x33607985 0x2378412d
0x22684bd8: 0x17000004 0x000500c2 0x082083ff 0x33605171

gef➤  x/16wx 0x38a07f90
0x38a07f90: 0x2378433d 0x00000014 0x00000002 0x00000004
0x38a07fa0: 0x00000006 0x00000008 0x0000000a 0x0000000c
0x38a07fb0: 0x0000000e 0x00000010 0x00000012 0x00000014
0x38a07fc0: 0x237843c1 0x00000003 0x000000cc 0x5f415343

gef➤  x/32wx 0x2378433c
0x2378433c: 0x2378412d 0x06000000 0x001900a9 0x082003ff
0x2378434c: 0x35e04101 0x35e04101 0x00000000 0x35e0411d

gef➤  x/16w 0x35e04100
0x35e04100: 0x23784159 0x00000000 0x00000000 0x35e0412d
0x35e04110: 0x00000000 0x35e0413d 0x00000006 0x23784185
0x35e04120: 0x00000000 0x23784185 0x00000000 0x237841b1
0x35e04130: 0x3043247e 0x00000008 0x6c6c756e 0x237841b1
gef➤  x/16wx 0x23784158
0x23784158: 0x2378412d 0x33000007 0x00001083 0x002003ff
0x23784168: 0x35e04101 0x35e04101 0x00000000 0x35e0411d
0x23784178: 0x35e04125 0x35e04125 0x00000000 0x2378412d
0x23784188: 0x06000000 0x001800a9 0x002003ff 0x35e04101