DWORD proc::GetProcId(const wchar_t* procName){
    // Assign to 0 for error handling
    DWORD procId = 0;
    // Takes snapshot of the processes
    HANDLE hSnap = (CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0));
    // Check if snapshot exists and didn't error out
    if (hSnap != INVALID_HANDLE_VALUE) {
        PROCESSENTRY32 procEntry;
        // Set entry size
        procEntry.dwSize = sizeof(procEntry);
        // Grabs first process in the snapshot and stores in procEntry
        if (Process32First(hSnap, &procEntry)) {
            // Loops through all processes
            do
            {
                // Checks if the process name is our process name
                if (!_wcsicmp(procEntry.szExeFile, procName)) {
                    // When found it saves the id and breaks out of the loop
                    procId = procEntry.th32ProcessID;
                    break;
                }
            } while (Process32Next(hSnap, &procEntry));
        }
    }
    // Closes Handle
    CloseHandle(hSnap);
    // Returns process id
    return procId;}

复制

void injector::LocAInject(const char* dllPath, HANDLE hProc){
    // Gets address to LoadLibraryA function
LPVOID libAAddr = (LPVOID)GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryA");

    // Allocate space for our dll path in the process we want to inject into
void* loc = VirtualAllocEx(hProc, 0, MAX_PATH, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

    // Patch the memory we allocated and write our dll path to it
mem::PatchEx((BYTE *)loc, (BYTE*)dllPath, (unsigned int)(strlen(dllPath) + 1), hProc);

    // Create the remote thread with LoadLibraryA and the dll path
HANDLE hThread = CreateRemoteThread(hProc, 0, 0, (LPTHREAD_START_ROUTINE)libAAddr, loc, 0, 0);

    // If the thread isn't null then close the handle 
if (hThread != NULL) {
CloseHandle(hThread);
}
    // Otherwise exit gracefully
else {
        ErrorHandling::ErrorExit((LPTSTR)(L"CreateRemoteThread"));
}}

复制

LPVOID libAAddr = (LPVOID)GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryA");

复制

void* loc = VirtualAllocEx(hProc, 0, MAX_PATH, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

复制

mem::PatchEx((BYTE *)loc, (BYTE*)dllPath, (unsigned int)(strlen(dllPath) + 1), hProc);

复制

HANDLE hThread = CreateRemoteThread(hProc, 0, 0, (LPTHREAD_START_ROUTINE)libAAddr, loc, 0, 0);

复制

if (hThread != NULL) {
CloseHandle(hThread);}else {
    ErrorHandling::ErrorExit((LPTSTR)(L"CreateRemoteThread"));}

复制

1. 阅读和解析

• 将文件读入内存

• 获取标题

2. 分配内存

• 获取和更新图像大小

• 将标题复制到内存中

• 用新的基础更新新的标头

3. 复制部分

• 遍历节标题

• 分配或复制部分数据

• 使用新地址更新节标题

• 设置每个部分的内存保护

4. 搬迁项目基地（如适用）

• 检查我们是否需要执行搬迁

• 抵消需要更新的重定位

5. 解决导入

// Open file in binary modestd::ifstream File(dllPath, std::ios::binary | std::ios::ate);// Get the size of the programsize_t fileSize = File.tellg();// Allocate space for the dataBYTE* data = new BYTE[fileSize];// Reset position to the start of the fileFile.seekg(0, std::ios::beg);// Read all of the file into our dataFile.read((char*)data, fileSize);// Close the handle to the fileFile.close();

复制

typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header
    WORD   e_magic;                     // Magic number
    WORD   e_cblp;                      // Bytes on last page of file
    WORD   e_cp;                        // Pages in file
    WORD   e_crlc;                      // Relocations
    WORD   e_cparhdr;                   // Size of header in paragraphs
    WORD   e_minalloc;                  // Minimum extra paragraphs needed
    WORD   e_maxalloc;                  // Maximum extra paragraphs needed
    WORD   e_ss;                        // Initial (relative) SS value
    WORD   e_sp;                        // Initial SP value
    WORD   e_csum;                      // Checksum
    WORD   e_ip;                        // Initial IP value
    WORD   e_cs;                        // Initial (relative) CS value
    WORD   e_lfarlc;                    // File address of relocation table
    WORD   e_ovno;                      // Overlay number
    WORD   e_res[4];                    // Reserved words
    WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
    WORD   e_oeminfo;                   // OEM information; e_oemid specific
    WORD   e_res2[10];                  // Reserved words
    LONG   e_lfanew;                    // File address of new exe header
  } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;

复制

// Get dos headerPIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)(data);

复制

// Get nt headersPIMAGE_NT_HEADERS ntHeaders = (PIMAGE_NT_HEADERS)(data + dosHeader->e_lfanew);

复制

// Declare the variable where we will store the system informationSYSTEM_INFO sysInfo;// Get the native system informationGetNativeSystemInfo(&sysInfo);// Get the image size aligned to the next largest multiple of the page sizesize_t imageSize = (ntHeaders->OptionalHeader.SizeOfImage + sysInfo.dwPageSize - 1) & ~(sysInfo.dwPageSize - 1);

复制

// Attempt to allocate memory at the image baseunsigned char* code = (unsigned char*)VirtualAlloc((LPVOID)(ntHeaders->OptionalHeader.ImageBase), imageSize, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);// If the result was null then let the system decide where to allocateif (code == NULL) 
code = (unsigned char*)VirtualAlloc(NULL, imageSize, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);

复制

// Copy the headers from the data into the allocated memorymemcpy(code, data, ntHeaders->OptionalHeader.SizeOfHeaders);// Get the pointer to the allocated headersPIMAGE_NT_HEADERS allocatedHeaders = (PIMAGE_NT_HEADERS)(code + dosHeader->e_lfanew);// Update the image base to where we allocated our memoryallocatedHeaders->OptionalHeader.ImageBase = (uintptr_t)code;

复制

// Get first section headerPIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(allocatedHeaders);// Loop through all sectionsfor (int i = 0; i < allocatedHeaders->FileHeader.NumberOfSections; i++, section++){
// Get the physical address of the section in memory
unsigned char* segmentAddress = code + section->VirtualAddress;

// If the size of the data is 0 then we are "allocating" memory for a data section
if (!(section->SizeOfRawData))
{
// Check if the SectionAlignment is greater than 0, semi redundent check but better safe than sorry
if (ntHeaders->OptionalHeader.SectionAlignment > 0)
// Set the SectionAlignment number of bytes to 0
memset(segmentAddress, 0, ntHeaders->OptionalHeader.SectionAlignment);
}
// If not a data section then we need to copy all of the data over to it
else
// Copy the raw data into memory
memcpy(segmentAddress, data + section->PointerToRawData, section->SizeOfRawData);

// Update the address in the section header to point to our loaded section
section->Misc.PhysicalAddress = (DWORD)((uintptr_t)segmentAddress & 0xffffffff);}

复制

// Get the first sectionsection = IMAGE_FIRST_SECTION(allocatedHeaders);// Get the physical address of the first sectionLPVOID gAddress = (LPVOID)section->Misc.PhysicalAddress;// Get the address of the first section aligned with the page sizeLPVOID gAlignedAddress = (LPVOID)((uintptr_t)gAddress & ~(sysInfo.dwPageSize - 1));// Get the section sizesize_t gSize = GetSectionSize(allocatedHeaders, section);// Get the section characteristics DWORD gCharacteristics = section->Characteristics;// Set isLast to falsebool isLast = false;

复制

// Gets the size of the sectionsize_t GetSectionSize(PIMAGE_NT_HEADERS headers, PIMAGE_SECTION_HEADER section) {
// Set the size to the size of the raw data
DWORD size = section->SizeOfRawData;

// If the section has no raw data then set the size to the size of the data
if (size == 0) {
if (section->Characteristics & IMAGE_SCN_CNT_INITIALIZED_DATA) {
size = headers->OptionalHeader.SizeOfInitializedData;
}
else if (section->Characteristics & IMAGE_SCN_CNT_UNINITIALIZED_DATA) {
size = headers->OptionalHeader.SizeOfUninitializedData;
}
}

// Return the size
return (size_t)size;}

复制

// Loop through all sectionsfor (int i = 0; i < allocatedHeaders->FileHeader.NumberOfSections; i++, section++) {

// Get all of the information for the current section
LPVOID sectionAddress = (LPVOID)((uintptr_t)section->Misc.PhysicalAddress);
LPVOID alignedAddress = (LPVOID)((uintptr_t)sectionAddress & ~(sysInfo.dwPageSize - 1));
SIZE_T sectionSize = GetSectionSize(allocatedHeaders, section);

// Check if the current section is on the same page as the previous section
if (gAlignedAddress == alignedAddress || (uintptr_t)gAddress + gSize > (uintptr_t) alignedAddress) {
// If it is then update the characteristics with those of the current section
if ((section->Characteristics & IMAGE_SCN_MEM_DISCARDABLE) == 0 || (gCharacteristics & IMAGE_SCN_MEM_DISCARDABLE) == 0) {
gCharacteristics = (gCharacteristics | section->Characteristics) & ~IMAGE_SCN_MEM_DISCARDABLE;
}
else {
gCharacteristics |= section->Characteristics;
}

// Get the size from the start of the first section on the page up till the end of the most recent section
gSize = (((uintptr_t)sectionAddress) + ((uintptr_t)sectionSize)) - (uintptr_t)gAddress;

// Skip the rest of the loop
continue;
}

// If the section can be discarded then free the memory
if (gCharacteristics & IMAGE_SCN_MEM_DISCARDABLE) {
// Check that a whole page is getting freed
if (gAddress == gAlignedAddress &&
(isLast ||
allocatedHeaders->OptionalHeader.SectionAlignment == sysInfo.dwPageSize ||
(gSize % sysInfo.dwPageSize) == 0)
) {
VirtualFree(gAddress, gSize, MEM_DECOMMIT);
}
}

// Check if the section is executable and or readable, we ignore writeable since we are going to need
// the sections to be writable when we do the imports once the dll is injected. The imports need to be 
// done in the injected process while we want to do this in our injector so we need to make some exceptions.
bool executable = (gCharacteristics & IMAGE_SCN_MEM_EXECUTE) != 0;
bool readable = (gCharacteristics & IMAGE_SCN_MEM_READ) != 0;

// Array of allowed protections
int ProtectionFlags[2][2] = {{PAGE_WRITECOPY, PAGE_READWRITE, }, {PAGE_EXECUTE_WRITECOPY, PAGE_EXECUTE_READWRITE,}};

// Get the protection flag to use
DWORD protection = ProtectionFlags[executable][readable];

// check if we need to add the no cache flag to the protection
if (gCharacteristics & IMAGE_SCN_MEM_NOT_CACHED) {
protection |= PAGE_NOCACHE;
}

// Declare old protection
DWORD oldProtection;

// Change the protection of the section
VirtualProtect(gAddress, gSize, protection, &oldProtection);

// Set the new values
gAddress = sectionAddress;
gAlignedAddress = alignedAddress;
gSize = sectionSize;
gCharacteristics = section->Characteristics;

// If this is the last section then set isLast to true
if (i == allocatedHeaders->FileHeader.NumberOfSections - 1)
isLast = true;}

复制

// Get the difference between the two ImageBasesptrdiff_t ptrDiff = (ptrdiff_t)(allocatedHeaders->OptionalHeader.ImageBase - ntHeaders->OptionalHeader.ImageBase);

复制

// Check if we need to perform any relocationsif (ptrDiff){
// Get data directory
PIMAGE_DATA_DIRECTORY directory = &(allocatedHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC]);

// Get first base relocation
PIMAGE_BASE_RELOCATION relocation = (PIMAGE_BASE_RELOCATION)(code + directory->VirtualAddress);

    // Loop through all relocations, check virtual address to see when to quit
    while (relocation->VirtualAddress > 0)
    {
        // Get the physical address of the relocation
        unsigned char* physicalAddress = code + relocation->VirtualAddress;

        // Get the first relocation information for the relocation
        unsigned short* relInfo = (unsigned short*)GetPointerOffset(relocation, sizeof(IMAGE_BASE_RELOCATION));

        // Loop through all relocation info
        for (int i = 0; i < ((relocation->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / 2); i++, relInfo++)
        {
            // Get the type of relocation
            int type = *relInfo >> 12;

            // Get the relocation offset
            int offset = *relInfo & 0xfff;

            // If the type is IMAGE_REL_BASED_HIGHLOW then perform our patch
            if (type == IMAGE_REL_BASED_HIGHLOW)
            {
                // Get the reference
                DWORD*  patch = (DWORD*)(physicalAddress + offset);

                // Adjust the reference based on the difference between the ImageBases
                *patch += (DWORD)ptrDiff;
            }
        }

        // Get the next relocation
        relocation = (PIMAGE_BASE_RELOCATION)GetPointerOffset(relocation, relocation->SizeOfBlock);
    }}

复制

#define GetPointerOffset(data, offset) (void*)((uintptr_t)data + offset)

复制

// Get the entry import directoryPIMAGE_DATA_DIRECTORY directory = &(allocatedHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]);// Get the first import descriptorPIMAGE_IMPORT_DESCRIPTOR importDesc = (PIMAGE_IMPORT_DESCRIPTOR)(code + directory->VirtualAddress);// While the descriptor has a name keep looping through them allwhile (importDesc->Name){
// Declare our two reference pointers
uintptr_t* thunkRef;
FARPROC* funcRef;

// Get the handle to the import (using LoadLibrary since we don't want to have to resolve all of the relative paths)
HMODULE handle = LoadLibraryA((LPCSTR)(code + importDesc->Name));

// If original first think then use that virtual address, otherwise use first thunk address
if (importDesc->OriginalFirstThunk)
thunkRef = (uintptr_t*)(code + importDesc->OriginalFirstThunk);
else
thunkRef = (uintptr_t*)(code + importDesc->FirstThunk);

// Get function reference
funcRef = (FARPROC*)(code + importDesc->FirstThunk);

// Loop through all thunks and set the value of the function reference
for (; *thunkRef; thunkRef++, funcRef++)
{
if (IMAGE_SNAP_BY_ORDINAL(*thunkRef))
{
*funcRef = GetProcAddress(handle, (LPCSTR)IMAGE_ORDINAL(*thunkRef));
}
else
{
PIMAGE_IMPORT_BY_NAME thunkData = (PIMAGE_IMPORT_BY_NAME)(code + (*thunkRef));
*funcRef = GetProcAddress(handle, (LPCSTR)&thunkData->Name);
}
}

// increment the descriptor
importDesc++;}

复制

// If we have a TLS directoryif (allocatedHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].Size){
// Get the directory
IMAGE_TLS_DIRECTORY* tlsDirectory = (IMAGE_TLS_DIRECTORY*)(code + allocatedHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].VirtualAddress);

// Get the first callback
PIMAGE_TLS_CALLBACK* pCallback = (PIMAGE_TLS_CALLBACK*)(tlsDirectory->AddressOfCallBacks);

// Loop through all callbacks
for (; pCallback && (*pCallback); ++pCallback)
{
// Attach the dll
PIMAGE_TLS_CALLBACK Callback = *pCallback;
Callback(code, DLL_PROCESS_ATTACH, nullptr);
}}

复制

// typedef the DLL entry functiontypedef bool(WINAPI* DllEntryProc)(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved);// Get the address for the entry DllEntryProc DllEntry = (DllEntryProc)(LPVOID)(code + allocatedHeaders->OptionalHeader.AddressOfEntryPoint);// Call the entrypoint(*DllEntry)((HINSTANCE)code, DLL_PROCESS_ATTACH, 0);

复制

• 将所有内存修改函数转换为其外部版本并将进程句柄传递给它们

• 在内部为数据的本地版本分配空间

• 更改我们的部分加载和基本重定位以处理本地副本

• 将导入分辨率移至另一个函数并剥离函数调用

• 将我们数据的本地版本复制到其他进程

• 用它需要的任何数据调用我们的 shellcode

unsigned char* code = (unsigned char*)VirtualAlloc((LPVOID)(ntHeaders->OptionalHeader.ImageBase), imageSize, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);

复制

unsigned char* code = (unsigned char*)VirtualAllocEx(hProc, (LPVOID)(ntHeaders->OptionalHeader.ImageBase), imageSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);

复制

// Attempt to allocate memory at the image baseunsigned char* code = (unsigned char*)VirtualAllocEx(hProc, (LPVOID)(ntHeaders->OptionalHeader.ImageBase), imageSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);// If the result was null then let the system decide where to allocateif (code == NULL)
code = (unsigned char*)VirtualAllocEx(hProc, NULL, imageSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);// Allocate space in the process for the dataunsigned char* localCode = (unsigned char*)VirtualAlloc(NULL, imageSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);// Copy the headers from the data into the allocated memorymemcpy(localCode, data, ntHeaders->OptionalHeader.SizeOfHeaders);// Get the pointer to the allocated headersPIMAGE_NT_HEADERS allocatedHeaders = (PIMAGE_NT_HEADERS)(localCode + dosHeader->e_lfanew);

复制

// LoadLibrary function typedef HMODULE(WINAPI tLoadLibrary)(LPCSTR);// GetProcAddress function typedef FARPROC(WINAPI tGetProcAddress)(HMODULE, LPCSTR);// Manually mapped data structtypedef struct {
unsigned char* code;
tLoadLibrary* loadLibrary;
tGetProcAddress* getProcAddress;} MAN_MAP_DATA;

复制

// Shellcode we inject into the functionHINSTANCE __stdcall ManMap(MAN_MAP_DATA * data){

// Get dos header
PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)(data->code);

// Get the pointer to the allocated headers
PIMAGE_NT_HEADERS allocatedHeaders = (PIMAGE_NT_HEADERS)(data->code + dosHeader->e_lfanew);

// Get the entry import directory
PIMAGE_DATA_DIRECTORY directory = &(allocatedHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]);

// Get the first import descriptor
PIMAGE_IMPORT_DESCRIPTOR importDesc = (PIMAGE_IMPORT_DESCRIPTOR)(data->code + directory->VirtualAddress);

auto loadLibrary = data->loadLibrary;
auto getProcAddress = data->getProcAddress;

// While the descriptor has a name keep looping through them all
while (importDesc->Name)
{
// Declare our two reference pointers
uintptr_t* thunkRef;
FARPROC* funcRef;

// Get the handle to the import (using LoadLibrary since we don't want to have to resolve all of the relative paths)
HMODULE handle = loadLibrary((LPCSTR)(data->code + importDesc->Name));


// If original first think then use that virtual address, otherwise use first thunk address
if (importDesc->OriginalFirstThunk)
thunkRef = (uintptr_t*)(data->code + importDesc->OriginalFirstThunk);
else
thunkRef = (uintptr_t*)(data->code + importDesc->FirstThunk);

// Get function reference
funcRef = (FARPROC*)(data->code + importDesc->FirstThunk);

// Loop through all thunks and set the value of the function reference
for (; *thunkRef; thunkRef++, funcRef++)
{
if (IMAGE_SNAP_BY_ORDINAL(*thunkRef))
{
*funcRef = getProcAddress(handle, (LPCSTR)IMAGE_ORDINAL(*thunkRef));
}
else
{
PIMAGE_IMPORT_BY_NAME thunkData = (PIMAGE_IMPORT_BY_NAME)(data->code + (*thunkRef));
*funcRef = getProcAddress(handle, (LPCSTR)&thunkData->Name);
}
}

// increment the descriptor
importDesc++;
}

 //If we have a TLS directory
if (allocatedHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].Size)
{
// Get the directory
IMAGE_TLS_DIRECTORY* tlsDirectory = (IMAGE_TLS_DIRECTORY*)(data->code + allocatedHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].VirtualAddress);

// Get the first callback
PIMAGE_TLS_CALLBACK* pCallback = (PIMAGE_TLS_CALLBACK*)(tlsDirectory->AddressOfCallBacks);

// Loop through all callbacks
for (; pCallback && (*pCallback); ++pCallback)
{
// Attach the dll
PIMAGE_TLS_CALLBACK Callback = *pCallback;
Callback(data->code, DLL_PROCESS_ATTACH, nullptr);
}
}

// ****************************************************************************************************************************************************

// typedef the DLL entry function
typedef bool(WINAPI* DllEntryProc)(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved);

// Get the address for the entry 
DllEntryProc DllEntry = (DllEntryProc)(LPVOID)(data->code + allocatedHeaders->OptionalHeader.AddressOfEntryPoint);

// Call the entrypoint
(*DllEntry)((HINSTANCE)data->code, DLL_PROCESS_ATTACH, 0);

// ****************************************************************************************************************************************************

// Return the base address of our loaded DLL
return (HINSTANCE)data->code;}// End position of shellcode, used to dynamically determine size of the functionDWORD ManMapEnd() { return 1; }

复制

// Copy the local code to the other processWriteProcessMemory(hProc, code, localCode, imageSize, NULL);

复制

// Initialize manually mapped data structMAN_MAP_DATA* manMapData = new MAN_MAP_DATA;// Set the pointer of the codemanMapData->code = code;// Get the pointer to load librarymanMapData->loadLibrary = (tLoadLibrary*)GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryA");// Get the pointer to get proc addressmanMapData->getProcAddress = (tGetProcAddress*)GetProcAddress(GetModuleHandle(L"kernel32.dll"), "GetProcAddress");// Allocate space for the manually mapped dataLPVOID man_map_data = VirtualAllocEx(hProc, NULL, sizeof(MAN_MAP_DATA), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);// Allocate space for the shellcodeBYTE* man_map = (BYTE*)VirtualAllocEx(hProc, NULL, (DWORD)((ULONG_PTR)ManMapEnd - (ULONG_PTR)ManMap), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);// Copy the data to the other functionWriteProcessMemory(hProc, man_map_data, manMapData, sizeof(MAN_MAP_DATA), NULL);// Copy the shellcode to the other functionWriteProcessMemory(hProc, man_map, ManMap, (DWORD)((ULONG_PTR)ManMapEnd - (ULONG_PTR)ManMap), NULL);// Create the thread in the other processHANDLE hThread = CreateRemoteThread(hProc, 0, 0, (LPTHREAD_START_ROUTINE)man_map, man_map_data, 0, 0);

复制