654 lines
23 KiB
C++
654 lines
23 KiB
C++
|
#ifndef _CRT_SECURE_NO_WARNINGS
|
||
|
|
#define _CRT_SECURE_NO_WARNINGS
|
||
|
|
#endif
|
||
|
|
|
||
|
|
#include "injector.h"
|
||
|
|
#include <malloc.h>
|
||
|
|
#include <stdarg.h>
|
||
|
|
#include <stdint.h>
|
||
|
|
#include <stdio.h>
|
||
|
|
|
||
|
|
typedef BOOL(WINAPI *IsWow64Process2_t)(HANDLE hProcess, USHORT *pProcessMachine, USHORT *pNativeMachine);
|
||
|
|
|
||
|
|
static DWORD page_size = 0;
|
||
|
|
static size_t func_LoadLibraryW;
|
||
|
|
static size_t func_FreeLibrary;
|
||
|
|
static size_t func_GetLastError;
|
||
|
|
static char errmsg[512];
|
||
|
|
static injector_t *g_injector;
|
||
|
|
|
||
|
|
#ifdef _M_AMD64
|
||
|
|
static const char x64_code_template[] =
|
||
|
|
// ---------- call LoadLibraryW ----------
|
||
|
|
/* 0000: */ "\x48\x83\xEC\x28" // sub rsp,28h
|
||
|
|
/* 0004: */ "\xFF\x15\x3E\x00\x00\x00" // call LoadLibraryW
|
||
|
|
// 0x0000003e = X64_ADDR_LoadLibraryW - (0x0004 + 6)
|
||
|
|
/* 000A: */ "\x48\x85\xC0" // test rax,rax
|
||
|
|
/* 000D: */ "\x74\x0B" // je L1
|
||
|
|
/* 000F: */ "\x48\x89\x05\xEA\x0F\x00\x00" // mov [load_address], rax
|
||
|
|
// 0x00000fea = 0x1000 - (0x000F + 7)
|
||
|
|
/* 0016: */ "\x33\xC0" // xor eax,eax
|
||
|
|
/* 0018: */ "\xEB\x06" // jmp L2
|
||
|
|
/* 001A: L1: */ "\xFF\x15\x38\x00\x00\x00" // call GetLastError
|
||
|
|
// 0x00000038 = X64_ADDR_GetLastError - (0x001A + 6)
|
||
|
|
/* 0020: L2: */ "\x48\x83\xC4\x28" // add rsp,28h
|
||
|
|
/* 0024: */ "\xC3" // ret
|
||
|
|
|
||
|
|
// ---------- call FreeLibrary ----------
|
||
|
|
#define X64_UNINJECTION_CODE_OFFSET 0x25
|
||
|
|
/* 0025: */ "\x48\x83\xEC\x28" // sub rsp,28h
|
||
|
|
/* 0029: */ "\xFF\x15\x21\x00\x00\x00" // call FreeLibrary
|
||
|
|
// 0x00000021 = X64_ADDR_FreeLibrary - (0x0029 + 6)
|
||
|
|
/* 002F: */ "\x85\xC0" // test eax,eax
|
||
|
|
/* 0031: */ "\x74\x04" // je L1
|
||
|
|
/* 0033: */ "\x33\xC0" // xor eax,eax
|
||
|
|
/* 0035: */ "\xEB\x06" // jmp L2
|
||
|
|
/* 0037: L1: */ "\xFF\x15\x1B\x00\x00\x00" // call GetLastError
|
||
|
|
// 0x0000001B = X64_ADDR_GetLastError - (0x0037 + 6)
|
||
|
|
/* 003D: L2: */ "\x48\x83\xC4\x28" // add rsp,28h
|
||
|
|
/* 0041: */ "\xC3" // ret
|
||
|
|
|
||
|
|
// padding
|
||
|
|
/* 0042: */ "\x90\x90\x90\x90\x90\x90"
|
||
|
|
|
||
|
|
// ---------- literal pool ----------
|
||
|
|
#define X64_ADDR_LoadLibraryW 0x0048
|
||
|
|
/* 0048: */ "\x90\x90\x90\x90\x90\x90\x90\x90"
|
||
|
|
#define X64_ADDR_FreeLibrary 0x0050
|
||
|
|
/* 0050: */ "\x90\x90\x90\x90\x90\x90\x90\x90"
|
||
|
|
#define X64_ADDR_GetLastError 0x0058
|
||
|
|
/* 0058: */ "\x90\x90\x90\x90\x90\x90\x90\x90";
|
||
|
|
|
||
|
|
#define X64_CODE_SIZE 0x0060
|
||
|
|
#endif
|
||
|
|
|
||
|
|
#if defined(_M_AMD64) || defined(_M_IX86)
|
||
|
|
static const char x86_code_template[] =
|
||
|
|
// ---------- call LoadLibraryW ----------
|
||
|
|
/* 0000: */ "\xFF\x74\x24\x04" // push dword ptr [esp+4]
|
||
|
|
#define X86_CALL_LoadLibraryW 0x0004
|
||
|
|
/* 0004: */ "\xE8\x00\x00\x00\x00" // call LoadLibraryW@4
|
||
|
|
/* 0009: */ "\x85\xC0" // test eax,eax
|
||
|
|
/* 000B: */ "\x74\x09" // je L1
|
||
|
|
#define X86_MOV_EAX 0x000D
|
||
|
|
/* 000D: */ "\xA3\x00\x00\x00\x00" // mov dword ptr [load_address], eax
|
||
|
|
/* 0012: */ "\x33\xC0" // xor eax,eax
|
||
|
|
/* 0014: */ "\xEB\x05" // jmp L2
|
||
|
|
#define X86_CALL_GetLastError1 0x0016
|
||
|
|
/* 0016: L1: */ "\xE8\x00\x00\x00\x00" // call GetLastError@0
|
||
|
|
/* 001B: L2: */ "\xC2\x04\x00" // ret 4
|
||
|
|
|
||
|
|
// ---------- call FreeLibrary ----------
|
||
|
|
#define X86_UNINJECTION_CODE_OFFSET 0x001E
|
||
|
|
/* 001E: */ "\xFF\x74\x24\x04" // push dword ptr [esp+4]
|
||
|
|
#define X86_CALL_FreeLibrary 0x0022
|
||
|
|
/* 0022: */ "\xE8\x00\x00\x00\x00" // call FreeLibrary@4
|
||
|
|
/* 0027: */ "\x85\xC0" // test eax,eax
|
||
|
|
/* 0029: */ "\x74\x04" // je L1
|
||
|
|
/* 002B: */ "\x33\xC0" // xor eax,eax
|
||
|
|
/* 002D: */ "\xEB\x05" // jmp L2
|
||
|
|
#define X86_CALL_GetLastError2 0x002F
|
||
|
|
/* 002F: L1: */ "\xE8\x00\x00\x00\x00" // call GetLastError@0
|
||
|
|
/* 0034: L2: */ "\xC2\x04\x00" // ret 4
|
||
|
|
;
|
||
|
|
|
||
|
|
#define X86_CODE_SIZE 0x0037
|
||
|
|
#endif
|
||
|
|
|
||
|
|
#ifdef _M_AMD64
|
||
|
|
#define CURRENT_ARCH "x64"
|
||
|
|
#define CODE_SIZE X64_CODE_SIZE
|
||
|
|
#endif
|
||
|
|
|
||
|
|
#ifdef _M_IX86
|
||
|
|
#define CURRENT_ARCH "x86"
|
||
|
|
#define CODE_SIZE X86_CODE_SIZE
|
||
|
|
#endif
|
||
|
|
|
||
|
|
static void set_errmsg(const char *format, ...);
|
||
|
|
static const char *w32strerr(DWORD err);
|
||
|
|
static USHORT process_arch(HANDLE hProcess);
|
||
|
|
static const char *arch_name(USHORT arch);
|
||
|
|
|
||
|
|
struct injector {
|
||
|
|
HANDLE hProcess;
|
||
|
|
char *remote_mem;
|
||
|
|
char *injection_code;
|
||
|
|
char *uninjection_code;
|
||
|
|
};
|
||
|
|
|
||
|
|
static BOOL init(void)
|
||
|
|
{
|
||
|
|
SYSTEM_INFO si;
|
||
|
|
HANDLE hToken;
|
||
|
|
LUID luid;
|
||
|
|
TOKEN_PRIVILEGES tp;
|
||
|
|
HMODULE kernel32 = GetModuleHandleA("kernel32");
|
||
|
|
if (kernel32 == 0) {
|
||
|
|
return FALSE;
|
||
|
|
}
|
||
|
|
GetSystemInfo(&si);
|
||
|
|
page_size = si.dwPageSize;
|
||
|
|
func_LoadLibraryW = (size_t)GetProcAddress(kernel32, "LoadLibraryW");
|
||
|
|
func_FreeLibrary = (size_t)GetProcAddress(kernel32, "FreeLibrary");
|
||
|
|
func_GetLastError = (size_t)GetProcAddress(kernel32, "GetLastError");
|
||
|
|
|
||
|
|
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken)) {
|
||
|
|
return FALSE;
|
||
|
|
}
|
||
|
|
if (!LookupPrivilegeValue(0, SE_DEBUG_NAME, &luid)) {
|
||
|
|
CloseHandle(hToken);
|
||
|
|
return FALSE;
|
||
|
|
}
|
||
|
|
tp.PrivilegeCount = 1;
|
||
|
|
tp.Privileges[0].Luid = luid;
|
||
|
|
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
|
||
|
|
if (!AdjustTokenPrivileges(hToken, FALSE, &tp, 0, NULL, NULL)) {
|
||
|
|
CloseHandle(hToken);
|
||
|
|
return FALSE;
|
||
|
|
}
|
||
|
|
CloseHandle(hToken);
|
||
|
|
return TRUE;
|
||
|
|
}
|
||
|
|
|
||
|
|
#if defined(_M_AMD64)
|
||
|
|
static int cmp_func(const void *context, const void *key, const void *datum)
|
||
|
|
{
|
||
|
|
ptrdiff_t rva_to_va = (ptrdiff_t)context;
|
||
|
|
const char *k = (const char *)key;
|
||
|
|
const char *d = (const char *)(rva_to_va + *(const DWORD *)datum);
|
||
|
|
return strcmp(k, d);
|
||
|
|
}
|
||
|
|
|
||
|
|
static int funcaddr(DWORD pid, size_t *load_library, size_t *free_library, size_t *get_last_error)
|
||
|
|
{
|
||
|
|
HANDLE hSnapshot;
|
||
|
|
MODULEENTRY32W me;
|
||
|
|
BOOL ok;
|
||
|
|
HANDLE hFile = INVALID_HANDLE_VALUE;
|
||
|
|
HANDLE hFileMapping = NULL;
|
||
|
|
void *base = NULL;
|
||
|
|
IMAGE_NT_HEADERS *nt_hdrs;
|
||
|
|
ULONG exp_size;
|
||
|
|
const IMAGE_EXPORT_DIRECTORY *exp;
|
||
|
|
const DWORD *names, *name, *funcs;
|
||
|
|
const WORD *ordinals;
|
||
|
|
ptrdiff_t rva_to_va;
|
||
|
|
int rv = INJERR_OTHER;
|
||
|
|
|
||
|
|
/* Get the full path of kernel32.dll. */
|
||
|
|
retry:
|
||
|
|
hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, pid);
|
||
|
|
if (hSnapshot == INVALID_HANDLE_VALUE) {
|
||
|
|
DWORD err = GetLastError();
|
||
|
|
switch (err) {
|
||
|
|
case ERROR_BAD_LENGTH:
|
||
|
|
goto retry;
|
||
|
|
case ERROR_ACCESS_DENIED:
|
||
|
|
rv = INJERR_PERMISSION;
|
||
|
|
break;
|
||
|
|
case ERROR_INVALID_PARAMETER:
|
||
|
|
rv = INJERR_NO_PROCESS;
|
||
|
|
break;
|
||
|
|
default:
|
||
|
|
rv = INJERR_OTHER;
|
||
|
|
}
|
||
|
|
set_errmsg("CreateToolhelp32Snapshot error: %s", w32strerr(err));
|
||
|
|
return rv;
|
||
|
|
}
|
||
|
|
me.dwSize = sizeof(me);
|
||
|
|
for (ok = Module32FirstW(hSnapshot, &me); ok; ok = Module32NextW(hSnapshot, &me)) {
|
||
|
|
if (wcsicmp(me.szModule, L"kernel32.dll") == 0) {
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
CloseHandle(hSnapshot);
|
||
|
|
if (!ok) {
|
||
|
|
set_errmsg("kernel32.dll could not be found.");
|
||
|
|
return INJERR_OTHER;
|
||
|
|
}
|
||
|
|
|
||
|
|
/* Get the export directory in the kernel32.dll. */
|
||
|
|
hFile = CreateFileW(me.szExePath, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
|
||
|
|
if (hFile == INVALID_HANDLE_VALUE) {
|
||
|
|
set_errmsg("failed to open file %s: %s", me.szExePath, w32strerr(GetLastError()));
|
||
|
|
goto exit;
|
||
|
|
}
|
||
|
|
hFileMapping = CreateFileMappingA(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
|
||
|
|
if (hFileMapping == NULL) {
|
||
|
|
set_errmsg("failed to create file mapping of %s: %s", me.szExePath, w32strerr(GetLastError()));
|
||
|
|
goto exit;
|
||
|
|
}
|
||
|
|
base = MapViewOfFile(hFileMapping, FILE_MAP_READ, 0, 0, 0);
|
||
|
|
if (base == NULL) {
|
||
|
|
set_errmsg("failed to map file %s to memory: %s", me.szExePath, w32strerr(GetLastError()));
|
||
|
|
goto exit;
|
||
|
|
}
|
||
|
|
nt_hdrs = ImageNtHeader(base);
|
||
|
|
if (nt_hdrs == NULL) {
|
||
|
|
set_errmsg("ImageNtHeader error: %s", w32strerr(GetLastError()));
|
||
|
|
goto exit;
|
||
|
|
}
|
||
|
|
exp = (const IMAGE_EXPORT_DIRECTORY *)ImageDirectoryEntryToDataEx(base, FALSE, IMAGE_DIRECTORY_ENTRY_EXPORT,
|
||
|
|
&exp_size, NULL);
|
||
|
|
if (exp == NULL) {
|
||
|
|
set_errmsg("ImageDirectoryEntryToDataEx error: %s", w32strerr(GetLastError()));
|
||
|
|
goto exit;
|
||
|
|
}
|
||
|
|
if (exp->NumberOfNames == 0) {
|
||
|
|
set_errmsg("No export entires are not found.");
|
||
|
|
goto exit;
|
||
|
|
}
|
||
|
|
names = (const DWORD *)ImageRvaToVa(nt_hdrs, base, exp->AddressOfNames, NULL);
|
||
|
|
if (names == NULL) {
|
||
|
|
set_errmsg("ImageRvaToVa error: %s", w32strerr(GetLastError()));
|
||
|
|
goto exit;
|
||
|
|
}
|
||
|
|
ordinals = (const WORD *)ImageRvaToVa(nt_hdrs, base, exp->AddressOfNameOrdinals, NULL);
|
||
|
|
if (ordinals == NULL) {
|
||
|
|
set_errmsg("ImageRvaToVa error: %s", w32strerr(GetLastError()));
|
||
|
|
goto exit;
|
||
|
|
}
|
||
|
|
funcs = (const DWORD *)ImageRvaToVa(nt_hdrs, base, exp->AddressOfFunctions, NULL);
|
||
|
|
if (funcs == NULL) {
|
||
|
|
set_errmsg("ImageRvaToVa error: %s", w32strerr(GetLastError()));
|
||
|
|
goto exit;
|
||
|
|
}
|
||
|
|
rva_to_va = (size_t)ImageRvaToVa(nt_hdrs, base, names[0], NULL) - (size_t)names[0];
|
||
|
|
|
||
|
|
/* Find the address of LoadLibraryW */
|
||
|
|
name = bsearch_s((void *)"LoadLibraryW", names, exp->NumberOfNames, sizeof(DWORD), cmp_func, (void *)rva_to_va);
|
||
|
|
if (name == NULL) {
|
||
|
|
set_errmsg("Could not find the address of LoadLibraryW");
|
||
|
|
goto exit;
|
||
|
|
}
|
||
|
|
*load_library = (size_t)me.modBaseAddr + funcs[ordinals[name - names]];
|
||
|
|
|
||
|
|
/* Find the address of FreeLibrary */
|
||
|
|
name = bsearch_s((void *)"FreeLibrary", names, exp->NumberOfNames, sizeof(DWORD), cmp_func, (void *)rva_to_va);
|
||
|
|
if (name == NULL) {
|
||
|
|
set_errmsg("Could not find the address of FreeLibrary");
|
||
|
|
goto exit;
|
||
|
|
}
|
||
|
|
*free_library = (size_t)me.modBaseAddr + funcs[ordinals[name - names]];
|
||
|
|
|
||
|
|
/* Find the address of GetLastError */
|
||
|
|
name = bsearch_s((void *)"GetLastError", names, exp->NumberOfNames, sizeof(DWORD), cmp_func, (void *)rva_to_va);
|
||
|
|
if (name == NULL) {
|
||
|
|
set_errmsg("Could not find the address of GetLastError");
|
||
|
|
goto exit;
|
||
|
|
}
|
||
|
|
*get_last_error = (size_t)me.modBaseAddr + funcs[ordinals[name - names]];
|
||
|
|
rv = 0;
|
||
|
|
exit:
|
||
|
|
if (base != NULL) {
|
||
|
|
UnmapViewOfFile(base);
|
||
|
|
}
|
||
|
|
if (hFileMapping != NULL) {
|
||
|
|
CloseHandle(hFileMapping);
|
||
|
|
}
|
||
|
|
if (hFile != INVALID_HANDLE_VALUE) {
|
||
|
|
CloseHandle(hFile);
|
||
|
|
}
|
||
|
|
return rv;
|
||
|
|
}
|
||
|
|
#endif
|
||
|
|
|
||
|
|
int cki_attach(injector_t **injector_out, DWORD pid)
|
||
|
|
{
|
||
|
|
injector_t *injector;
|
||
|
|
DWORD dwDesiredAccess = PROCESS_QUERY_LIMITED_INFORMATION | /* for IsWow64Process() */
|
||
|
|
PROCESS_CREATE_THREAD | /* for CreateRemoteThread() */
|
||
|
|
PROCESS_VM_OPERATION | /* for VirtualAllocEx() */
|
||
|
|
PROCESS_VM_READ | /* for ReadProcessMemory() */
|
||
|
|
PROCESS_VM_WRITE; /* for WriteProcessMemory() */
|
||
|
|
USHORT arch;
|
||
|
|
DWORD old_protect;
|
||
|
|
SIZE_T written;
|
||
|
|
int rv;
|
||
|
|
char code[CODE_SIZE];
|
||
|
|
size_t code_size;
|
||
|
|
size_t load_library, free_library, get_last_error;
|
||
|
|
|
||
|
|
if (page_size == 0) {
|
||
|
|
init();
|
||
|
|
}
|
||
|
|
|
||
|
|
load_library = func_LoadLibraryW;
|
||
|
|
free_library = func_FreeLibrary;
|
||
|
|
get_last_error = func_GetLastError;
|
||
|
|
|
||
|
|
injector = (injector_t *)calloc(1, sizeof(injector_t));
|
||
|
|
if (injector == NULL) {
|
||
|
|
set_errmsg("malloc error: %s", strerror(errno));
|
||
|
|
return INJERR_NO_MEMORY;
|
||
|
|
}
|
||
|
|
injector->hProcess = OpenProcess(dwDesiredAccess, FALSE, pid);
|
||
|
|
if (injector->hProcess == NULL) {
|
||
|
|
DWORD err = GetLastError();
|
||
|
|
set_errmsg("OpenProcess error: %s", w32strerr(err));
|
||
|
|
switch (err) {
|
||
|
|
case ERROR_ACCESS_DENIED:
|
||
|
|
rv = INJERR_PERMISSION;
|
||
|
|
break;
|
||
|
|
case ERROR_INVALID_PARAMETER:
|
||
|
|
rv = INJERR_NO_PROCESS;
|
||
|
|
break;
|
||
|
|
default:
|
||
|
|
rv = INJERR_OTHER;
|
||
|
|
}
|
||
|
|
goto error_exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
arch = process_arch(injector->hProcess);
|
||
|
|
switch (arch) {
|
||
|
|
#ifdef _M_AMD64
|
||
|
|
case IMAGE_FILE_MACHINE_AMD64:
|
||
|
|
break;
|
||
|
|
case IMAGE_FILE_MACHINE_I386:
|
||
|
|
rv = funcaddr(pid, &load_library, &free_library, &get_last_error);
|
||
|
|
if (rv != 0) {
|
||
|
|
goto error_exit;
|
||
|
|
}
|
||
|
|
break;
|
||
|
|
#endif
|
||
|
|
|
||
|
|
#ifdef _M_IX86
|
||
|
|
case IMAGE_FILE_MACHINE_I386:
|
||
|
|
break;
|
||
|
|
#endif
|
||
|
|
default:
|
||
|
|
set_errmsg("%s target process isn't supported by %s process.", arch_name(arch), CURRENT_ARCH);
|
||
|
|
rv = INJERR_UNSUPPORTED_TARGET;
|
||
|
|
goto error_exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
injector->remote_mem
|
||
|
|
= (char *)VirtualAllocEx(injector->hProcess, NULL, 2 * page_size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
|
||
|
|
if (injector->remote_mem == NULL) {
|
||
|
|
set_errmsg("VirtualAllocEx error: %s", w32strerr(GetLastError()));
|
||
|
|
rv = INJERR_OTHER;
|
||
|
|
goto error_exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
injector->injection_code = injector->remote_mem;
|
||
|
|
switch (arch) {
|
||
|
|
#ifdef _M_AMD64
|
||
|
|
case IMAGE_FILE_MACHINE_AMD64: /* x64 */
|
||
|
|
memcpy(code, x64_code_template, X64_CODE_SIZE);
|
||
|
|
code_size = X64_CODE_SIZE;
|
||
|
|
*(size_t *)(code + X64_ADDR_LoadLibraryW) = load_library;
|
||
|
|
*(size_t *)(code + X64_ADDR_FreeLibrary) = free_library;
|
||
|
|
*(size_t *)(code + X64_ADDR_GetLastError) = get_last_error;
|
||
|
|
injector->uninjection_code = injector->remote_mem + X64_UNINJECTION_CODE_OFFSET;
|
||
|
|
break;
|
||
|
|
#endif
|
||
|
|
|
||
|
|
#if defined(_M_AMD64) || defined(_M_IX86)
|
||
|
|
case IMAGE_FILE_MACHINE_I386: /* x86 */
|
||
|
|
memcpy(code, x86_code_template, X86_CODE_SIZE);
|
||
|
|
code_size = X86_CODE_SIZE;
|
||
|
|
#define FIX_CALL_RELATIVE(addr, offset) \
|
||
|
|
*(uint32_t *)(code + offset + 1) = addr - ((uint32_t)(size_t)injector->remote_mem + offset + 5)
|
||
|
|
FIX_CALL_RELATIVE(load_library, X86_CALL_LoadLibraryW);
|
||
|
|
FIX_CALL_RELATIVE(free_library, X86_CALL_FreeLibrary);
|
||
|
|
FIX_CALL_RELATIVE(get_last_error, X86_CALL_GetLastError1);
|
||
|
|
FIX_CALL_RELATIVE(get_last_error, X86_CALL_GetLastError2);
|
||
|
|
*(uint32_t *)(code + X86_MOV_EAX + 1) = (uint32_t)(size_t)injector->remote_mem + page_size;
|
||
|
|
injector->uninjection_code = injector->remote_mem + X86_UNINJECTION_CODE_OFFSET;
|
||
|
|
break;
|
||
|
|
#endif
|
||
|
|
default:
|
||
|
|
set_errmsg("Never reach here: arch=0x%x", arch);
|
||
|
|
rv = INJERR_OTHER;
|
||
|
|
goto error_exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (!WriteProcessMemory(injector->hProcess, injector->remote_mem, code, code_size, &written)) {
|
||
|
|
set_errmsg("WriteProcessMemory error: %s", w32strerr(GetLastError()));
|
||
|
|
rv = INJERR_OTHER;
|
||
|
|
goto error_exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (!VirtualProtectEx(injector->hProcess, injector->remote_mem, page_size, PAGE_EXECUTE_READ, &old_protect)) {
|
||
|
|
set_errmsg("VirtualProtectEx error: %s", w32strerr(GetLastError()));
|
||
|
|
rv = INJERR_OTHER;
|
||
|
|
goto error_exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
*injector_out = injector;
|
||
|
|
return 0;
|
||
|
|
|
||
|
|
error_exit:
|
||
|
|
cki_detach(injector);
|
||
|
|
return rv;
|
||
|
|
}
|
||
|
|
|
||
|
|
int cki_inject(injector_t *injector, const char *path, void **handle)
|
||
|
|
{
|
||
|
|
DWORD pathlen = (DWORD)strlen(path);
|
||
|
|
wchar_t *wpath;
|
||
|
|
DWORD wpathlen;
|
||
|
|
|
||
|
|
if (pathlen == 0) {
|
||
|
|
set_errmsg("The specified path is empty.");
|
||
|
|
return INJERR_FILE_NOT_FOUND;
|
||
|
|
}
|
||
|
|
if (pathlen > MAX_PATH) {
|
||
|
|
set_errmsg("too long file path: %s", path);
|
||
|
|
return INJERR_FILE_NOT_FOUND;
|
||
|
|
}
|
||
|
|
|
||
|
|
wpath = (wchar_t *)_alloca((pathlen + 1) * sizeof(wchar_t));
|
||
|
|
wpathlen = MultiByteToWideChar(CP_ACP, MB_PRECOMPOSED, path, pathlen, wpath, pathlen + 1);
|
||
|
|
wpath[wpathlen] = L'\0';
|
||
|
|
return cki_inject_w(injector, wpath, handle);
|
||
|
|
}
|
||
|
|
|
||
|
|
int cki_inject_w(injector_t *injector, const wchar_t *path, void **handle)
|
||
|
|
{
|
||
|
|
struct {
|
||
|
|
void *load_address;
|
||
|
|
wchar_t fullpath[MAX_PATH];
|
||
|
|
} data = {
|
||
|
|
NULL,
|
||
|
|
};
|
||
|
|
DWORD pathlen;
|
||
|
|
SIZE_T written;
|
||
|
|
HANDLE hThread;
|
||
|
|
DWORD err;
|
||
|
|
|
||
|
|
pathlen = GetFullPathNameW(path, MAX_PATH, data.fullpath, NULL);
|
||
|
|
if (pathlen > MAX_PATH) {
|
||
|
|
set_errmsg("too long file path: %S", path);
|
||
|
|
return INJERR_FILE_NOT_FOUND;
|
||
|
|
}
|
||
|
|
if (pathlen == 0) {
|
||
|
|
set_errmsg("failed to get the full path: %S", path);
|
||
|
|
return INJERR_FILE_NOT_FOUND;
|
||
|
|
}
|
||
|
|
if (!WriteProcessMemory(injector->hProcess, injector->remote_mem + page_size, &data, sizeof(data), &written)) {
|
||
|
|
set_errmsg("WriteProcessMemory error: %s", w32strerr(GetLastError()));
|
||
|
|
return INJERR_OTHER;
|
||
|
|
}
|
||
|
|
hThread = CreateRemoteThread(injector->hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)injector->injection_code,
|
||
|
|
injector->remote_mem + page_size + sizeof(void *), 0, NULL);
|
||
|
|
if (hThread == NULL) {
|
||
|
|
set_errmsg("CreateRemoteThread error: %s", w32strerr(GetLastError()));
|
||
|
|
return INJERR_OTHER;
|
||
|
|
}
|
||
|
|
WaitForSingleObject(hThread, INFINITE);
|
||
|
|
GetExitCodeThread(hThread, &err);
|
||
|
|
CloseHandle(hThread);
|
||
|
|
if (err != 0) {
|
||
|
|
set_errmsg("LoadLibrary in the target process failed: %s", w32strerr(err));
|
||
|
|
return INJERR_ERROR_IN_TARGET;
|
||
|
|
}
|
||
|
|
if (!ReadProcessMemory(injector->hProcess, injector->remote_mem + page_size, &data, sizeof(void *), &written)) {
|
||
|
|
set_errmsg("ReadProcessMemory error: %s", w32strerr(GetLastError()));
|
||
|
|
return INJERR_OTHER;
|
||
|
|
}
|
||
|
|
if (handle != NULL) {
|
||
|
|
*handle = data.load_address;
|
||
|
|
}
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
int cki_uninject(injector_t *injector, void *handle)
|
||
|
|
{
|
||
|
|
HANDLE hThread;
|
||
|
|
DWORD err;
|
||
|
|
|
||
|
|
hThread = CreateRemoteThread(injector->hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)injector->uninjection_code,
|
||
|
|
handle, 0, NULL);
|
||
|
|
if (hThread == NULL) {
|
||
|
|
set_errmsg("CreateRemoteThread error: %s", w32strerr(GetLastError()));
|
||
|
|
return INJERR_OTHER;
|
||
|
|
}
|
||
|
|
WaitForSingleObject(hThread, INFINITE);
|
||
|
|
GetExitCodeThread(hThread, &err);
|
||
|
|
CloseHandle(hThread);
|
||
|
|
if (err != 0) {
|
||
|
|
set_errmsg("FreeLibrary in the target process failed: %s", w32strerr(err));
|
||
|
|
return INJERR_ERROR_IN_TARGET;
|
||
|
|
}
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
int cki_detach(injector_t *injector)
|
||
|
|
{
|
||
|
|
if (injector->remote_mem != NULL) {
|
||
|
|
VirtualFreeEx(injector->hProcess, injector->remote_mem, 0, MEM_RELEASE);
|
||
|
|
}
|
||
|
|
if (injector->hProcess != NULL) {
|
||
|
|
CloseHandle(injector->hProcess);
|
||
|
|
}
|
||
|
|
free(injector);
|
||
|
|
return 0;
|
||
|
|
}
|
||
|
|
|
||
|
|
const char *cki_error(void) { return errmsg; }
|
||
|
|
|
||
|
|
static void set_errmsg(const char *format, ...)
|
||
|
|
{
|
||
|
|
va_list ap;
|
||
|
|
int rv;
|
||
|
|
|
||
|
|
va_start(ap, format);
|
||
|
|
rv = vsnprintf(errmsg, sizeof(errmsg), format, ap);
|
||
|
|
va_end(ap);
|
||
|
|
if (rv == -1 || rv >= sizeof(errmsg)) {
|
||
|
|
errmsg[sizeof(errmsg) - 1] = '\0';
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
static const char *w32strerr(DWORD err)
|
||
|
|
{
|
||
|
|
static char errmsg[512];
|
||
|
|
DWORD len;
|
||
|
|
|
||
|
|
len = FormatMessageA(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS, NULL, err,
|
||
|
|
MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_US), errmsg, sizeof(errmsg), NULL);
|
||
|
|
if (len > 0) {
|
||
|
|
while (len > 0) {
|
||
|
|
char c = errmsg[len - 1];
|
||
|
|
if (c == ' ' || c == '\n' || c == '\r') {
|
||
|
|
len--;
|
||
|
|
} else {
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
errmsg[len] = '\0';
|
||
|
|
} else if ((int)err >= 0) {
|
||
|
|
sprintf(errmsg, "win32 error code %d", err);
|
||
|
|
} else {
|
||
|
|
sprintf(errmsg, "win32 error code 0x%x", err);
|
||
|
|
}
|
||
|
|
return errmsg;
|
||
|
|
}
|
||
|
|
|
||
|
|
static USHORT process_arch(HANDLE hProcess)
|
||
|
|
{
|
||
|
|
static IsWow64Process2_t IsWow64Process2_func = (IsWow64Process2_t)-1;
|
||
|
|
if (IsWow64Process2_func == (IsWow64Process2_t)-1) {
|
||
|
|
IsWow64Process2_func = (IsWow64Process2_t)GetProcAddress(GetModuleHandleA("kernel32"), "IsWow64Process2");
|
||
|
|
}
|
||
|
|
if (IsWow64Process2_func != NULL) {
|
||
|
|
/* Windows 10 */
|
||
|
|
USHORT process_machine;
|
||
|
|
USHORT native_machine;
|
||
|
|
if (IsWow64Process2_func(hProcess, &process_machine, &native_machine)) {
|
||
|
|
if (process_machine != IMAGE_FILE_MACHINE_UNKNOWN) {
|
||
|
|
return process_machine;
|
||
|
|
} else {
|
||
|
|
return native_machine;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
/* Windows 8.1 or earlier */
|
||
|
|
/* arch will be either x86 or x64. */
|
||
|
|
#ifdef _M_AMD64
|
||
|
|
BOOL is_wow64_proc;
|
||
|
|
if (IsWow64Process(hProcess, &is_wow64_proc)) {
|
||
|
|
if (is_wow64_proc) {
|
||
|
|
return IMAGE_FILE_MACHINE_I386;
|
||
|
|
} else {
|
||
|
|
return IMAGE_FILE_MACHINE_AMD64;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
#endif
|
||
|
|
#ifdef _M_IX86
|
||
|
|
BOOL is_wow64_proc;
|
||
|
|
if (IsWow64Process(GetCurrentProcess(), &is_wow64_proc)) {
|
||
|
|
if (!is_wow64_proc) {
|
||
|
|
/* Run on 32-bit Windows */
|
||
|
|
return IMAGE_FILE_MACHINE_I386;
|
||
|
|
}
|
||
|
|
/* Run on Windows x64 */
|
||
|
|
if (IsWow64Process(hProcess, &is_wow64_proc)) {
|
||
|
|
if (is_wow64_proc) {
|
||
|
|
return IMAGE_FILE_MACHINE_I386;
|
||
|
|
} else {
|
||
|
|
return IMAGE_FILE_MACHINE_AMD64;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
#endif
|
||
|
|
}
|
||
|
|
return IMAGE_FILE_MACHINE_UNKNOWN;
|
||
|
|
}
|
||
|
|
|
||
|
|
static const char *arch_name(USHORT arch)
|
||
|
|
{
|
||
|
|
switch (arch) {
|
||
|
|
case IMAGE_FILE_MACHINE_AMD64:
|
||
|
|
return "x64";
|
||
|
|
case IMAGE_FILE_MACHINE_I386:
|
||
|
|
return "x86";
|
||
|
|
default:
|
||
|
|
return "unknown";
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
BOOL InjectDll(DWORD pid, const WCHAR *dllpath)
|
||
|
|
{
|
||
|
|
if (cki_attach(&g_injector, pid) != 0) {
|
||
|
|
printf("%s\n", cki_error());
|
||
|
|
return FALSE;
|
||
|
|
}
|
||
|
|
if (cki_inject_w(g_injector, dllpath, NULL) == 0) {
|
||
|
|
return TRUE;
|
||
|
|
} else {
|
||
|
|
fprintf(stderr, " %s\n", cki_error());
|
||
|
|
return FALSE;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
BOOL EnjectDll(DWORD pid, const WCHAR *dllname)
|
||
|
|
{
|
||
|
|
if (cki_detach(g_injector) == 0) {
|
||
|
|
return TRUE;
|
||
|
|
}
|
||
|
|
return FALSE;
|
||
|
|
}
|