790de57763
Added environment variable ANSICON_EXC to specify modules that should not be hooked. This should work around the nvd3d9wrap.dll issue. Since it helps to know what the modules are, logging is now always available, controlled by -l or ANSICON_LOG. A side-effect caused debugstr.c to move to util.c. GUI programs are once again not hooked, unless run by "ansicon" directly or in the ANSICON_GUI environment variable. Since not hooking still leaves ANSICON in the environment, created ANSICON_VER as a dynamic-only variable, which can also serve as a version check. Due to an email requesting a reverse video option, realised I always take the current attributes as default. This means if you turned on reverse and ran a program, it would take the reverse as its default. Created ANSICON_DEF variable to explicitly set the default attribute, using the current if it doesn't exist. The reverse video option is done via a "negative" attribute (e.g. "-m-f0" is reversed black on white, meaning you'll get white on black, with foreground sequences changing the background). (The difference from "\e[7m" is that it won't be reset on "\e[m".) A child program will inherit the parent's modes (but not shift); the parent will read the child's modes on exit (but not unload). The exception is "ansicon", which will always start with the default modes and leave the parent unchanged. Improved the AutoRun entry, only running "ansicon" if ANSICON_VER doesn't exist. The "ansicon" command is always first. Stopped -u implying -p; return the program's exit code; don't restore the original color when just using -p; output error messages to stderr.
97 lines
3.0 KiB
C
97 lines
3.0 KiB
C
/*
|
|
Inject code into the target process to load our DLL. The target thread
|
|
should be suspended on entry; it remains suspended on exit.
|
|
|
|
Initially I used the "stack" method of injection. However, this fails
|
|
when DEP is active, since that doesn't allow code to execute in the stack.
|
|
To overcome this I used the "CreateRemoteThread" method. However, this
|
|
would fail with Wselect, a program to assist batch files. Wselect runs,
|
|
but it has no output. As it turns out, removing the suspended flag would
|
|
make Wselect work, but it caused problems with everything else. So now I
|
|
allocate a section of memory and change the context to run from there. At
|
|
first I had an event to signal when the library was loaded, then the memory
|
|
was released. However, that wouldn't work with -p and CMD.EXE (4NT v8
|
|
worked fine). Since it's possible the DLL might start a process suspended,
|
|
I've decided to simply keep the memory.
|
|
*/
|
|
|
|
#include "ansicon.h"
|
|
|
|
void InjectDLL64( LPPROCESS_INFORMATION ppi, LPCTSTR dll )
|
|
{
|
|
CONTEXT context;
|
|
DWORD len;
|
|
LPVOID mem;
|
|
DWORD64 LLW;
|
|
union
|
|
{
|
|
PBYTE pB;
|
|
PDWORD64 pL;
|
|
} ip;
|
|
#define CODESIZE 92
|
|
static BYTE code[CODESIZE+TSIZE(MAX_PATH)] = {
|
|
0,0,0,0,0,0,0,0, // original rip
|
|
0,0,0,0,0,0,0,0, // LoadLibraryW
|
|
0x9C, // pushfq
|
|
0x50, // push rax
|
|
0x51, // push rcx
|
|
0x52, // push rdx
|
|
0x53, // push rbx
|
|
0x55, // push rbp
|
|
0x56, // push rsi
|
|
0x57, // push rdi
|
|
0x41,0x50, // push r8
|
|
0x41,0x51, // push r9
|
|
0x41,0x52, // push r10
|
|
0x41,0x53, // push r11
|
|
0x41,0x54, // push r12
|
|
0x41,0x55, // push r13
|
|
0x41,0x56, // push r14
|
|
0x41,0x57, // push r15
|
|
0x48,0x83,0xEC,0x28, // sub rsp, 40
|
|
0x48,0x8D,0x0D,41,0,0,0, // lea ecx, L"path\to\ANSI64.dll"
|
|
0xFF,0x15,-49,-1,-1,-1, // call LoadLibraryW
|
|
0x48,0x83,0xC4,0x28, // add rsp, 40
|
|
0x41,0x5F, // pop r15
|
|
0x41,0x5E, // pop r14
|
|
0x41,0x5D, // pop r13
|
|
0x41,0x5C, // pop r12
|
|
0x41,0x5B, // pop r11
|
|
0x41,0x5A, // pop r10
|
|
0x41,0x59, // pop r9
|
|
0x41,0x58, // pop r8
|
|
0x5F, // pop rdi
|
|
0x5E, // pop rsi
|
|
0x5D, // pop rbp
|
|
0x5B, // pop rbx
|
|
0x5A, // pop rdx
|
|
0x59, // pop rcx
|
|
0x58, // pop rax
|
|
0x9D, // popfq
|
|
0xFF,0x25,-91,-1,-1,-1, // jmp original Rip
|
|
0, // dword alignment for LLW, fwiw
|
|
};
|
|
|
|
len = TSIZE(lstrlen( dll ) + 1);
|
|
if (len > TSIZE(MAX_PATH))
|
|
return;
|
|
CopyMemory( code + CODESIZE, dll, len );
|
|
len += CODESIZE;
|
|
|
|
context.ContextFlags = CONTEXT_CONTROL;
|
|
GetThreadContext( ppi->hThread, &context );
|
|
mem = VirtualAllocEx( ppi->hProcess, NULL, len, MEM_COMMIT,
|
|
PAGE_EXECUTE_READWRITE );
|
|
LLW = (DWORD64)LoadLibraryW;
|
|
|
|
ip.pB = code;
|
|
|
|
*ip.pL++ = context.Rip;
|
|
*ip.pL++ = LLW;
|
|
|
|
WriteProcessMemory( ppi->hProcess, mem, code, len, NULL );
|
|
FlushInstructionCache( ppi->hProcess, mem, len );
|
|
context.Rip = (DWORD64)mem + 16;
|
|
SetThreadContext( ppi->hThread, &context );
|
|
}
|