HRESULT encode_jpeg(UINT8 *data, UINT width, UINT height, UINT8 **jpeg_data, DWORD *sz)
{
CComPtr<IStream> pStream(SHCreateMemStream(NULL, 0));
{
CComPtr<IWICBitmapEncoder> pEncoder;
CHECK(g_pImagingFactory->CreateEncoder(GUID_ContainerFormatJpeg, NULL, &pEncoder));
CHECK(pEncoder->Initialize(pStream, WICBitmapEncoderCacheOption::WICBitmapEncoderNoCache));
CComPtr<IWICBitmapFrameEncode> pFrame;
CHECK(pEncoder->CreateNewFrame(&pFrame, NULL));
CHECK(pFrame->Initialize(NULL));
CComPtr<IWICBitmap> pBitmap;
CHECK(g_pImagingFactory->CreateBitmapFromMemory(width, height, GUID_WICPixelFormat32bppBGRA, width * 4, width * height * 4, data, &pBitmap));
CHECK(pFrame->WriteSource(pBitmap, NULL));
CHECK(pFrame->Commit());
CHECK(pEncoder->Commit());
}
STATSTG statstg;
CHECK(pStream->Stat(&statstg, STATFLAG_NONAME));
LARGE_INTEGER l;
l.QuadPart = 0;
CHECK(pStream->Seek(l, STREAM_SEEK_SET, NULL));
*sz = statstg.cbSize.LowPart;
*jpeg_data = new UINT8[*sz];
ULONG dummy;
CHECK(pStream->Read(*jpeg_data, statstg.cbSize.LowPart, &dummy));
return S_OK;
}
HRESULT send_email(UINT8 *jpeg_data, DWORD sz)
{
CURL *curl = curl_easy_init();
if (!curl) {
aslog::error(L"curl_easy_init failed");
return MAKE_HRESULT(SEVERITY_ERROR, FACILITY_ITF, 0xFF00);
}
curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
CComPtr<IStream> stream = SHCreateMemStream(NULL, 0);
build_msg(stream, jpeg_data, sz);
curl_easy_setopt(curl, CURLOPT_READFUNCTION, payload_source);
curl_easy_setopt(curl, CURLOPT_READDATA, stream.p);
curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
curl_easy_setopt(curl, CURLOPT_URL, g_smtpURL);
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
curl_easy_setopt(curl, CURLOPT_USERNAME, g_smtpUser);
curl_easy_setopt(curl, CURLOPT_PASSWORD, g_smtpPass);
curl_easy_setopt(curl, CURLOPT_MAIL_FROM, g_smtpFrom);
struct curl_slist *recipients = NULL;
recipients = curl_slist_append(recipients, g_smtpTo);
curl_easy_setopt(curl, CURLOPT_MAIL_RCPT, recipients);
char errbufA[CURL_ERROR_SIZE];
errbufA[0] = 0;
curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, errbufA);
CURLcode res = curl_easy_perform(curl);
if (res != CURLE_OK) {
wchar_t errbufW[CURL_ERROR_SIZE];
MultiByteToWideChar(CP_UTF8, 0, errbufA, CURL_ERROR_SIZE, errbufW, CURL_ERROR_SIZE);
aslog::error(L"Mail sending failed: %s", errbufW);
}
curl_slist_free_all(recipients);
curl_easy_cleanup(curl);
return S_OK;
}
//-----------------------------------------------------------------------------
IPlatformBitmap* IPlatformBitmap::createFromMemory (const void* ptr, uint32_t memSize)
{
#ifdef __GNUC__
typedef IStream* (*SHCreateMemStreamProc) (const BYTE* pInit, UINT cbInit);
HMODULE shlwDll = LoadLibraryA ("shlwapi.dll");
SHCreateMemStreamProc proc = reinterpret_cast<SHCreateMemStreamProc> (GetProcAddress (shlwDll, MAKEINTRESOURCEA (12)));
IStream* stream = proc (static_cast<const BYTE*> (ptr), memSize);
#else
IStream* stream = SHCreateMemStream ((const BYTE*)ptr, memSize);
#endif
if (stream)
{
#if VSTGUI_DIRECT2D_SUPPORT
if (getD2DFactory ())
{
D2DBitmap* result = new D2DBitmap ();
if (result->loadFromStream (stream))
{
stream->Release ();
return result;
}
stream->Release ();
result->forget ();
return 0;
}
#endif
GdiplusBitmap* bitmap = new GdiplusBitmap ();
if (bitmap->loadFromStream (stream))
{
stream->Release ();
return bitmap;
}
bitmap->forget ();
stream->Release ();
}
#ifdef __GNUC__
FreeLibrary (shlwDll);
#endif
return 0;
}
void GL::Image::load(const unsigned char *buf, size_t bufSize)
{
if (CoInitializeEx(NULL, COINIT_MULTITHREADED) != S_OK) {
// bad!
return;
}
IStream *stream = SHCreateMemStream((const BYTE*)buf, (UINT)bufSize);
if (stream != NULL) {
IWICImagingFactory *pFactory;
if (CoCreateInstance(CLSID_WICImagingFactory, NULL, CLSCTX_INPROC_SERVER, IID_IWICImagingFactory, (LPVOID*)&pFactory) == S_OK) {
IWICBitmapDecoder *pDecoder;
if (pFactory->CreateDecoderFromStream(stream, &CLSID_WICPngDecoder, WICDecodeMetadataCacheOnDemand, &pDecoder) == S_OK) {
IWICBitmapFrameDecode *frame;
if (pDecoder->GetFrame(0, &frame) == S_OK) {
UINT w, h;
if (frame->GetSize(&w, &h) == S_OK) {
width_ = w;
height_ = h;
}
IWICFormatConverter *formatConverter;
if (pFactory->CreateFormatConverter(&formatConverter) == S_OK) {
if (formatConverter->Initialize(frame, GUID_WICPixelFormat32bppPBGRA, WICBitmapDitherTypeNone, nullptr, 0.0, WICBitmapPaletteTypeCustom) == S_OK) {
unsigned char *pixels = new unsigned char[w * h * 4];
if (formatConverter->CopyPixels(0, w * 4, w * h * 4, pixels) == S_OK) {
loadTextureData_(pixels);
}
delete[] pixels;
}
formatConverter->Release();
}
}
pDecoder->Release();
}
pFactory->Release();
}
stream->Release();
}
CoUninitialize();
}
/*
* SfExtractDropper
*
* Purpose:
*
* Extract Sirefef/ZeroAccess from image resource.
*
* CNG variant
*
*/
UINT SfExtractDropper(
LPWSTR lpCommandLine
)
{
BOOL cond = FALSE, bSuccess = FALSE;
ULONG c, uKey = 0, imagesz;
WCHAR szInputFile[MAX_PATH + 1];
WCHAR szOutputFile[MAX_PATH + 1];
WCHAR szKey[MAX_PATH];
PVOID ImageBase = NULL, EncryptedData = NULL, DecryptedData = NULL;
IStream *pImageStream = NULL;
ULONG_PTR gdiplusToken = 0;
GdiplusStartupInput input;
GdiplusStartupOutput output;
PVOID BitmapPtr = NULL;
GdiPlusBitmapData BitmapData;
GdiPlusRect rect;
SIZE_T sz;
PULONG ptr, i_ptr;
//input file
c = 0;
RtlSecureZeroMemory(szInputFile, sizeof(szInputFile));
GetCommandLineParam(lpCommandLine, 1, (LPWSTR)&szInputFile, MAX_PATH, &c);
if (c == 0) {
SfcuiPrintText(g_ConOut,
T_SFEXTRACTUSAGE,
g_ConsoleOutput, FALSE);
return (UINT)-1;
}
//output file
c = 0;
RtlSecureZeroMemory(&szOutputFile, sizeof(szOutputFile));
GetCommandLineParam(lpCommandLine, 2, (LPWSTR)&szOutputFile, MAX_PATH, &c);
if (c == 0) {
_strcpy(szOutputFile, TEXT("extracted.bin"));
}
//key
c = 0;
RtlSecureZeroMemory(&szKey, sizeof(szKey));
GetCommandLineParam(lpCommandLine, 3, (LPWSTR)&szKey, MAX_PATH, &c);
if ((c == 0) || (c > 10)) {
SfcuiPrintText(g_ConOut,
T_SFEXTRACTUSAGE,
g_ConsoleOutput, FALSE);
return (UINT)-1;
}
c = 0;
if (locase_w(szKey[1]) == 'x') {
c = 2;
}
uKey = hextoul(&szKey[c]);
do {
ImageBase = SfuCreateFileMappingNoExec(szInputFile);
if (ImageBase == NULL)
break;
c = 0;
EncryptedData = SfLdrQueryResourceData(1, ImageBase, &c);
if ((EncryptedData == NULL) || (c == 0))
break;
pImageStream = SHCreateMemStream((BYTE *)EncryptedData, (UINT)c);
if (pImageStream == NULL)
break;
RtlSecureZeroMemory(&input, sizeof(input));
RtlSecureZeroMemory(&output, sizeof(output));
input.GdiplusVersion = 1;
if (GdiplusStartup(&gdiplusToken, &input, &output) != GdiplusOk)
break;
BitmapPtr = NULL;
if (GdipCreateBitmapFromStream(pImageStream, &BitmapPtr) != GdiplusOk)
break;
RtlSecureZeroMemory(&rect, sizeof(rect));
if (
(GdipGetImageWidth(BitmapPtr, (UINT *)&rect.Width) == GdiplusOk) &&
(GdipGetImageHeight(BitmapPtr, (UINT *)&rect.Height) == GdiplusOk)
)
{
RtlSecureZeroMemory(&BitmapData, sizeof(BitmapData));
if (GdipBitmapLockBits(BitmapPtr, &rect, ImageLockModeRead, PixelFormat32bppARGB, &BitmapData) == GdiplusOk) {
c = (rect.Width * rect.Height);
imagesz = sizeof(ULONG) * c;
sz = imagesz;
DecryptedData = NULL;
NtAllocateVirtualMemory(NtCurrentProcess(), &DecryptedData, 0, &sz, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
if (DecryptedData) {
i_ptr = (PULONG)BitmapData.Scan0;
ptr = DecryptedData;
while (c > 0) {
*ptr = *i_ptr ^ uKey;
ptr++;
i_ptr++;
c--;
}
bSuccess = (SfuWriteBufferToFile(szOutputFile, DecryptedData, imagesz, FALSE, FALSE) == imagesz);
sz = 0;
NtFreeVirtualMemory(NtCurrentProcess(), &DecryptedData, &sz, MEM_RELEASE);
}
GdipBitmapUnlockBits(BitmapPtr, &BitmapData);
}
}
} while (cond);
if (bSuccess == FALSE) {
SfcuiPrintText(g_ConOut,
T_SFEXTRACTFAIL,
g_ConsoleOutput, FALSE);
}
else
{
SfcuiPrintText(g_ConOut,
szOutputFile,
g_ConsoleOutput, TRUE);
SfcuiPrintText(g_ConOut,
T_SFEXTRACTED,
g_ConsoleOutput, TRUE);
}
if (BitmapPtr != NULL) {
GdipDisposeImage(&BitmapPtr);
}
if (gdiplusToken != 0) {
GdiplusShutdown(gdiplusToken);
}
if (pImageStream != NULL) {
pImageStream->lpVtbl->Release(pImageStream);
}
if (ImageBase != NULL) {
NtUnmapViewOfSection(NtCurrentProcess(), ImageBase);
}
return 0;
}
