129 lines
3.7 KiB
C
129 lines
3.7 KiB
C
/*
|
|
Inject code into the target process to load our DLL. The target thread
|
|
should be suspended on entry; it remains suspended on exit.
|
|
|
|
Initially I used the "stack" method of injection. However, this fails
|
|
when DEP is active, since that doesn't allow code to execute in the stack.
|
|
To overcome this I used the "CreateRemoteThread" method. However, this
|
|
would fail with Wselect, a program to assist batch files. Wselect runs,
|
|
but it has no output. As it turns out, removing the suspended flag would
|
|
make Wselect work, but it caused problems with everything else. So now I
|
|
allocate a section of memory and change the context to run from there. At
|
|
first I had an event to signal when the library was loaded, then the memory
|
|
was released. However, that wouldn't work with -p and CMD.EXE (4NT v8
|
|
worked fine). Since it's possible the DLL might start a process suspended,
|
|
I've decided to simply keep the memory.
|
|
*/
|
|
|
|
#include "ansicon.h"
|
|
|
|
#ifdef _WIN64
|
|
#ifndef WOW64_CONTEXT_ALL
|
|
#include "wow64.h"
|
|
|
|
TWow64GetThreadContext Wow64GetThreadContext;
|
|
TWow64SetThreadContext Wow64SetThreadContext;
|
|
#define IMPORT_WOW64
|
|
#endif
|
|
|
|
#define CONTEXT WOW64_CONTEXT
|
|
#undef CONTEXT_CONTROL
|
|
#define CONTEXT_CONTROL WOW64_CONTEXT_CONTROL
|
|
#define GetThreadContext Wow64GetThreadContext
|
|
#define SetThreadContext Wow64SetThreadContext
|
|
|
|
extern
|
|
#endif
|
|
DWORD LLW32;
|
|
|
|
|
|
void InjectDLL32( LPPROCESS_INFORMATION ppi, LPCTSTR dll )
|
|
{
|
|
CONTEXT context;
|
|
DWORD len;
|
|
LPVOID mem;
|
|
DWORD mem32;
|
|
#define CODESIZE 20
|
|
BYTE code[CODESIZE+TSIZE(MAX_PATH)];
|
|
union
|
|
{
|
|
PBYTE pB;
|
|
PDWORD pL;
|
|
} ip;
|
|
|
|
#ifdef IMPORT_WOW64
|
|
if (Wow64GetThreadContext == 0)
|
|
{
|
|
#define GETPROC( proc ) proc = (T##proc)GetProcAddress( hKernel, #proc )
|
|
HMODULE hKernel = GetModuleHandle( L"kernel32.dll" );
|
|
GETPROC( Wow64GetThreadContext );
|
|
GETPROC( Wow64SetThreadContext );
|
|
// Assume if one is defined, so is the other.
|
|
if (Wow64GetThreadContext == 0)
|
|
{
|
|
DEBUGSTR( 1, L"Failed to get pointer to Wow64GetThreadContext." );
|
|
return;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
len = TSIZE(lstrlen( dll ) + 1);
|
|
if (len > TSIZE(MAX_PATH))
|
|
return;
|
|
|
|
if (LLW32 == 0)
|
|
{
|
|
#ifdef _WIN64
|
|
STARTUPINFO si;
|
|
PROCESS_INFORMATION pi;
|
|
ZeroMemory( &si, sizeof(si) );
|
|
si.cb = sizeof(si);
|
|
// ...ANSI32.dll\0
|
|
CopyMemory( code, dll, len - TSIZE(7) );
|
|
// ...ANSI-LLW.exe\0
|
|
CopyMemory( code + len - TSIZE(7), L"-LLW.exe", TSIZE(9) );
|
|
if (!CreateProcess( (LPCTSTR)code, NULL, NULL, NULL, FALSE, 0, NULL, NULL,
|
|
&si, &pi ))
|
|
{
|
|
DEBUGSTR( 1, L"Failed to execute \"%s\".", (LPCTSTR)code );
|
|
return;
|
|
}
|
|
WaitForSingleObject( pi.hProcess, INFINITE );
|
|
GetExitCodeProcess( pi.hProcess, &LLW32 );
|
|
CloseHandle( pi.hProcess );
|
|
CloseHandle( pi.hThread );
|
|
#else
|
|
LLW32 = (DWORD)GetProcAddress( GetModuleHandle( L"kernel32.dll" ),
|
|
"LoadLibraryW" );
|
|
#endif
|
|
}
|
|
|
|
CopyMemory( code + CODESIZE, dll, len );
|
|
len += CODESIZE;
|
|
|
|
context.ContextFlags = CONTEXT_CONTROL;
|
|
GetThreadContext( ppi->hThread, &context );
|
|
mem = VirtualAllocEx( ppi->hProcess, NULL, len, MEM_COMMIT,
|
|
PAGE_EXECUTE_READWRITE );
|
|
mem32 = (DWORD)(DWORD_PTR)mem;
|
|
|
|
ip.pB = code;
|
|
|
|
*ip.pB++ = 0x68; // push eip
|
|
*ip.pL++ = context.Eip;
|
|
*ip.pB++ = 0x9c; // pushf
|
|
*ip.pB++ = 0x60; // pusha
|
|
*ip.pB++ = 0x68; // push L"path\to\ANSI32.dll"
|
|
*ip.pL++ = mem32 + CODESIZE;
|
|
*ip.pB++ = 0xe8; // call LoadLibraryW
|
|
*ip.pL++ = LLW32 - (mem32 + (DWORD)(ip.pB+4 - code));
|
|
*ip.pB++ = 0x61; // popa
|
|
*ip.pB++ = 0x9d; // popf
|
|
*ip.pB++ = 0xc3; // ret
|
|
|
|
WriteProcessMemory( ppi->hProcess, mem, code, len, NULL );
|
|
FlushInstructionCache( ppi->hProcess, mem, len );
|
|
context.Eip = mem32;
|
|
SetThreadContext( ppi->hThread, &context );
|
|
}
|