Skip to content

Instantly share code, notes, and snippets.

@jackson5sec
Last active January 29, 2018 10:16
Show Gist options
  • Save jackson5sec/23907f84b5ae1aa9eccad221e3a626eb to your computer and use it in GitHub Desktop.
Save jackson5sec/23907f84b5ae1aa9eccad221e3a626eb to your computer and use it in GitHub Desktop.
#include "stdafx.h"
#include <Windows.h>
#include <iostream>
void WipePEHeader(HANDLE GetModuleBase)
{
PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)GetModuleBase;
PIMAGE_NT_HEADERS pNTHeader = (PIMAGE_NT_HEADERS)((PBYTE)pDosHeader + (DWORD)pDosHeader->e_lfanew);
printf("NT Header at : %p\n", pNTHeader);
printf("DOS Header at : %p\n", pDosHeader);
printf("Offset : %p\n", (DWORD)pNTHeader - (DWORD)pDosHeader);
if (pNTHeader->Signature != IMAGE_NT_SIGNATURE)
{
puts("NT Signature mismatch\n");
return;
}
if (pNTHeader->OptionalHeader.SizeOfHeaders)
{
DWORD Protect;
DWORD Size = pNTHeader->OptionalHeader.SizeOfHeaders;
printf("Header Size : %d\n", Size);
VirtualProtect((void*)GetModuleBase, Size, PAGE_READWRITE, &Protect);
SecureZeroMemory((void*)GetModuleBase, Size);
VirtualProtect((void*)GetModuleBase, Size, Protect, &Protect);
}
}
void Loop() {
while (true) {
std::cout << "Still looping" << std::endl;
Sleep(2000);
}
}
int main()
{
HANDLE hImgAddress = GetModuleHandle(NULL);
WipePEHeader(hImgAddress);
Loop();
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment