Originally Posted by freedompeace
You did it here, you can do it here
Originally Posted by freedompeace
You did it here, you can do it here
Memory Library and GetProcAddress
Originally Posted by freedompeace
You did it here, you can do it here
Originally Posted by Jason
[C++] Darawk's Manual Mapping code - Pastebin.com
That is how to manually map a dll without using LoadLibrary in C++. You can find some PEHeader structures online to add to your project to make up for the lack of having them by default in VB/C#. The direct ASM can be circumvented by finding the calling bytes of the dllMain function (props to @Hell_Demon
) and simply changing the address it calls by editing some bytes.Good luck and have fun. On a day when I have like 6 hours to spend coding and suiciding, I may try write this in .NET. Until then, enjoy yourself.
I might have a crack at converting it to VB.NET. Originally Posted by master131
Brainfuck C++ code ftw. I might have a crack at converting it to VB.NET.
I might have a crack at converting it to VB.NET.meh, cbf'ed doing eet. You can haz what I have so far, note that CreateFile doesn't seem to be working (at least for me).
[highlight=vb.net]#Region "Structures"
Public Structure IMAGE_DOS_HEADER
Public e_magic As UInt16
Public e_cblp As UInt16
Public e_cp As UInt16
Public e_crlc As UInt16
Public e_cparhdr As UInt16
Public e_minalloc As UInt16
Public e_maxalloc As UInt16
Public e_ss As UInt16
Public e_sp As UInt16
Public e_csum As UInt16
Public e_ip As UInt16
Public e_cs As UInt16
Public e_lfarlc As UInt16
Public e_ovno As UInt16
Public e_res_0 As UInt16
Public e_res_1 As UInt16
Public e_res_2 As UInt16
Public e_res_3 As UInt16
Public e_oemid As UInt16
Public e_oeminfo As UInt16
Public e_res2_0 As UInt16
Public e_res2_1 As UInt16
Public e_res2_2 As UInt16
Public e_res2_3 As UInt16
Public e_res2_4 As UInt16
Public e_res2_5 As UInt16
Public e_res2_6 As UInt16
Public e_res2_7 As UInt16
Public e_res2_8 As UInt16
Public e_res2_9 As UInt16
Public e_lfanew As UInt32
End Structure
<StructLayout(LayoutKind.Sequential, Pack:=1)> _
Public Structure IMAGE_OPTIONAL_HEADER32
Public Magic As UInt16
Public MajorLinkerVersion As [Byte]
Public MinorLinkerVersion As [Byte]
Public SizeOfCode As UInt32
Public SizeOfInitializedData As UInt32
Public SizeOfUninitializedData As UInt32
Public AddressOfEntryPoint As UInt32
Public BaseOfCode As UInt32
Public BaseOfData As UInt32
Public ImageBase As UInt32
Public SectionAlignment As UInt32
Public FileAlignment As UInt32
Public MajorOperatin****temVersion As UInt16
Public MinorOperatin****temVersion As UInt16
Public MajorImageVersion As UInt16
Public MinorImageVersion As UInt16
Public MajorSubsystemVersion As UInt16
Public MinorSubsystemVersion As UInt16
Public Win32VersionValue As UInt32
Public SizeOfImage As UInt32
Public SizeOfHeaders As UInt32
Public CheckSum As UInt32
Public Subsystem As UInt16
Public DllCharacteristics As UInt16
Public SizeOfStackReserve As UInt32
Public SizeOfStackCommit As UInt32
Public SizeOfHeapReserve As UInt32
Public SizeOfHeapCommit As UInt32
Public LoaderFlags As UInt32
Public NumberOfRvaAndSizes As UInt32
End Structure
<StructLayout(LayoutKind.Sequential, Pack:=1)> _
Public Structure IMAGE_FILE_HEADER
Public Machine As UInt16
Public NumberOfSections As UInt16
Public TimeDateStamp As UInt32
Public PointerToSymbolTable As UInt32
Public NumberOfSymbols As UInt32
Public SizeOfOptionalHeader As UInt16
Public Characteristics As UInt16
End Structure
<StructLayout(LayoutKind.Sequential)> _
Public Structure IMAGE_NT_HEADERS
Public Signature As UInt32
Public FileHeader As IMAGE_FILE_HEADER
Public OptionalHeader As IMAGE_OPTIONAL_HEADER32
End Structure
#End Region
#Region "Enums"
Public Enum EFileAccess As System.Int32
DELETE = &H10000
READ_CONTROL = &H20000
WRITE_DAC = &H40000
WRITE_OWNER = &H80000
SYNCHRONIZE = &H100000
STANDARD_RIGHTS_REQUIRED = &HF0000
STANDARD_RIGHTS_READ = READ_CONTROL
STANDARD_RIGHTS_WRITE = READ_CONTROL
STANDARD_RIGHTS_EXECUTE = READ_CONTROL
STANDARD_RIGHTS_ALL = &H1F0000
SPECIFIC_RIGHTS_ALL = &HFFFF
ACCESS_SYSTEM_SECURITY = &H1000000
MAXIMUM_ALLOWED = &H2000000
GENERIC_READ = &H80000000
GENERIC_WRITE = &H40000000
GENERIC_EXECUTE = &H20000000
GENERIC_ALL = &H10000000
End Enum
Public Enum EFileShare
FILE_SHARE_NONE = &H0
FILE_SHARE_READ = &H1
FILE_SHARE_WRITE = &H2
FILE_SHARE_DELETE = &H4
End Enum
Public Enum ECreationDisposition
CREATE_NEW = 1
CREATE_ALWAYS = 2
OPEN_EXISTING = 3
OPEN_ALWAYS = 4
TRUNCATE_EXISTING = 5
End Enum
Public Enum EFileAttributes
FILE_ATTRIBUTE_READONLY = &H1
FILE_ATTRIBUTE_HIDDEN = &H2
FILE_ATTRIBUTE_SYSTEM = &H4
FILE_ATTRIBUTE_DIRECTORY = &H10
FILE_ATTRIBUTE_ARCHIVE = &H20
FILE_ATTRIBUTE_DEVICE = &H40
FILE_ATTRIBUTE_NORMAL = &H80
FILE_ATTRIBUTE_TEMPORARY = &H100
FILE_ATTRIBUTE_SPARSE_FILE = &H200
FILE_ATTRIBUTE_REPARSE_POINT = &H400
FILE_ATTRIBUTE_COMPRESSED = &H800
FILE_ATTRIBUTE_OFFLINE = &H1000
FILE_ATTRIBUTE_NOT_CONTENT_INDEXED = &H2000
FILE_ATTRIBUTE_ENCRYPTED = &H4000
FILE_ATTRIBUTE_VIRTUAL = &H10000
FILE_FLAG_BACKUP_SEMANTICS = &H2000000
FILE_FLAG_DELETE_ON_CLOSE = &H4000000
FILE_FLAG_NO_BUFFERING = &H2000000
FILE_FLAG_OPEN_NO_RECALL = &H100000
FILE_FLAG_OPEN_REPARSE_POINT = &H200000
FILE_FLAG_OVERLAPPED = &H40000000
FILE_FLAG_POSIX_SEMANTICS = &H100000
FILE_FLAG_RANDOM_ACCESS = &H10000000
FILE_FLAG_SEQUENTIAL_SCAN = &H8000000
FILE_FLAG_WRITE_THROUGH = &H80000000
End Enum
#End Region
<DllImport("kernel32.dll", SetLastError:=True, CharSet:=CharSet.Auto)> _
Public Shared Function CreateFile(ByVal lpFileName As String, _
ByVal dwDesiredAccess As EFileAccess, _
ByVal dwShareMode As EFileShare, _
ByVal lpSecurityAttributes As IntPtr, _
ByVal dwCreationDisposition As ECreationDisposition, _
ByVal dwFlagsAndAttributes As EFileAttributes, _
ByVal hTemplateFile As IntPtr) As IntPtr
End Function
<DllImport("kernel32.dll")> _
Public Shared Function GetFileAttributes(ByVal lpFileName As String) As Integer
End Function
<DllImport("kernel32.dll")> _
Public Shared Function GetCompressedFileSize(ByVal lpFileName As String, ByRef lpFileSizeHigh As UInteger) As UInteger
End Function
<DllImport("kernel32.dll")> _
Private Shared Function GetFileSize(ByVal hFile As IntPtr, ByVal lpFileSizeHigh As IntPtr) As UInteger
End Function
<DllImport("kernel32.dll", SetlastError:=True)> _
Private Shared Function ReadFile(ByVal hFile As IntPtr, ByVal Buffer As Byte(), _
ByVal nNumberOfBytesToRead As UInteger, ByRef lpNumberOfBytesRead As UInteger, _
ByRef lpOverlapped As System.Threading.NativeOverlapped) As Integer
End Function
<DllImport("kernel32.dll", SetLastError:=True)> _
Public Shared Function CloseHandle(ByVal hObject As IntPtr) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
#Region "Const"
Private Const FILE_ATTRIBUTE_COMPRESSED = &H800
#End Region
Private Function MapRemoteModule(ByVal pID As Integer, ByVal moduleName As String) As Boolean
Dim dosHd As IMAGE_DOS_HEADER
Dim ntHd As IMAGE_NT_HEADERS
Dim hFile As IntPtr = _
CreateFile(moduleName, _
EFileAccess.GENERIC_READ, _
EFileShare.FILE_SHARE_READ Or EFileShare.FILE_SHARE_WRITE, _
IntPtr.Zero, _
ECreationDisposition.OPEN_EXISTING, _
EFileAttributes.FILE_ATTRIBUTE_NORMAL, _
IntPtr.Zero)
'CreateFile always screws up so yeahs..
If hFile = IntPtr.Zero Or hFile.ToInt32 < 0 Then Return False
Dim fSize As UInteger
If GetFileAttributes(moduleName) And FILE_ATTRIBUTE_COMPRESSED Then
fSize = GetCompressedFileSize(moduleName, 0)
Else
fSize = GetFileSize(hFile, IntPtr.Zero)
End If
Dim dllBin(fSize - 1) As Byte
Dim nBytes As UInteger
ReadFile(hFile, dllBin, fSize, nBytes, Nothing)
CloseHandle(hFile)
Dim gHandle As GCHandle = GCHandle.Alloc(dllBin, GCHandleType.Pinned)
dosHd = CType(Marshal.PtrToStructure(gHandle.AddrOfPinnedO bject, GetType(IMAGE_DOS_HEADER)), IMAGE_DOS_HEADER)
End Function[/highlight]
[highlight=vb.net]#Region "Structures"
Public Structure IMAGE_DOS_HEADER
Public e_magic As UInt16
Public e_cblp As UInt16
Public e_cp As UInt16
Public e_crlc As UInt16
Public e_cparhdr As UInt16
Public e_minalloc As UInt16
Public e_maxalloc As UInt16
Public e_ss As UInt16
Public e_sp As UInt16
Public e_csum As UInt16
Public e_ip As UInt16
Public e_cs As UInt16
Public e_lfarlc As UInt16
Public e_ovno As UInt16
Public e_res_0 As UInt16
Public e_res_1 As UInt16
Public e_res_2 As UInt16
Public e_res_3 As UInt16
Public e_oemid As UInt16
Public e_oeminfo As UInt16
Public e_res2_0 As UInt16
Public e_res2_1 As UInt16
Public e_res2_2 As UInt16
Public e_res2_3 As UInt16
Public e_res2_4 As UInt16
Public e_res2_5 As UInt16
Public e_res2_6 As UInt16
Public e_res2_7 As UInt16
Public e_res2_8 As UInt16
Public e_res2_9 As UInt16
Public e_lfanew As UInt32
End Structure
<StructLayout(LayoutKind.Sequential, Pack:=1)> _
Public Structure IMAGE_OPTIONAL_HEADER32
Public Magic As UInt16
Public MajorLinkerVersion As [Byte]
Public MinorLinkerVersion As [Byte]
Public SizeOfCode As UInt32
Public SizeOfInitializedData As UInt32
Public SizeOfUninitializedData As UInt32
Public AddressOfEntryPoint As UInt32
Public BaseOfCode As UInt32
Public BaseOfData As UInt32
Public ImageBase As UInt32
Public SectionAlignment As UInt32
Public FileAlignment As UInt32
Public MajorOperatin****temVersion As UInt16
Public MinorOperatin****temVersion As UInt16
Public MajorImageVersion As UInt16
Public MinorImageVersion As UInt16
Public MajorSubsystemVersion As UInt16
Public MinorSubsystemVersion As UInt16
Public Win32VersionValue As UInt32
Public SizeOfImage As UInt32
Public SizeOfHeaders As UInt32
Public CheckSum As UInt32
Public Subsystem As UInt16
Public DllCharacteristics As UInt16
Public SizeOfStackReserve As UInt32
Public SizeOfStackCommit As UInt32
Public SizeOfHeapReserve As UInt32
Public SizeOfHeapCommit As UInt32
Public LoaderFlags As UInt32
Public NumberOfRvaAndSizes As UInt32
End Structure
<StructLayout(LayoutKind.Sequential, Pack:=1)> _
Public Structure IMAGE_FILE_HEADER
Public Machine As UInt16
Public NumberOfSections As UInt16
Public TimeDateStamp As UInt32
Public PointerToSymbolTable As UInt32
Public NumberOfSymbols As UInt32
Public SizeOfOptionalHeader As UInt16
Public Characteristics As UInt16
End Structure
<StructLayout(LayoutKind.Sequential)> _
Public Structure IMAGE_NT_HEADERS
Public Signature As UInt32
Public FileHeader As IMAGE_FILE_HEADER
Public OptionalHeader As IMAGE_OPTIONAL_HEADER32
End Structure
#End Region
#Region "Enums"
Public Enum EFileAccess As System.Int32
DELETE = &H10000
READ_CONTROL = &H20000
WRITE_DAC = &H40000
WRITE_OWNER = &H80000
SYNCHRONIZE = &H100000
STANDARD_RIGHTS_REQUIRED = &HF0000
STANDARD_RIGHTS_READ = READ_CONTROL
STANDARD_RIGHTS_WRITE = READ_CONTROL
STANDARD_RIGHTS_EXECUTE = READ_CONTROL
STANDARD_RIGHTS_ALL = &H1F0000
SPECIFIC_RIGHTS_ALL = &HFFFF
ACCESS_SYSTEM_SECURITY = &H1000000
MAXIMUM_ALLOWED = &H2000000
GENERIC_READ = &H80000000
GENERIC_WRITE = &H40000000
GENERIC_EXECUTE = &H20000000
GENERIC_ALL = &H10000000
End Enum
Public Enum EFileShare
FILE_SHARE_NONE = &H0
FILE_SHARE_READ = &H1
FILE_SHARE_WRITE = &H2
FILE_SHARE_DELETE = &H4
End Enum
Public Enum ECreationDisposition
CREATE_NEW = 1
CREATE_ALWAYS = 2
OPEN_EXISTING = 3
OPEN_ALWAYS = 4
TRUNCATE_EXISTING = 5
End Enum
Public Enum EFileAttributes
FILE_ATTRIBUTE_READONLY = &H1
FILE_ATTRIBUTE_HIDDEN = &H2
FILE_ATTRIBUTE_SYSTEM = &H4
FILE_ATTRIBUTE_DIRECTORY = &H10
FILE_ATTRIBUTE_ARCHIVE = &H20
FILE_ATTRIBUTE_DEVICE = &H40
FILE_ATTRIBUTE_NORMAL = &H80
FILE_ATTRIBUTE_TEMPORARY = &H100
FILE_ATTRIBUTE_SPARSE_FILE = &H200
FILE_ATTRIBUTE_REPARSE_POINT = &H400
FILE_ATTRIBUTE_COMPRESSED = &H800
FILE_ATTRIBUTE_OFFLINE = &H1000
FILE_ATTRIBUTE_NOT_CONTENT_INDEXED = &H2000
FILE_ATTRIBUTE_ENCRYPTED = &H4000
FILE_ATTRIBUTE_VIRTUAL = &H10000
FILE_FLAG_BACKUP_SEMANTICS = &H2000000
FILE_FLAG_DELETE_ON_CLOSE = &H4000000
FILE_FLAG_NO_BUFFERING = &H2000000
FILE_FLAG_OPEN_NO_RECALL = &H100000
FILE_FLAG_OPEN_REPARSE_POINT = &H200000
FILE_FLAG_OVERLAPPED = &H40000000
FILE_FLAG_POSIX_SEMANTICS = &H100000
FILE_FLAG_RANDOM_ACCESS = &H10000000
FILE_FLAG_SEQUENTIAL_SCAN = &H8000000
FILE_FLAG_WRITE_THROUGH = &H80000000
End Enum
#End Region
<DllImport("kernel32.dll", SetLastError:=True, CharSet:=CharSet.Auto)> _
Public Shared Function CreateFile(ByVal lpFileName As String, _
ByVal dwDesiredAccess As EFileAccess, _
ByVal dwShareMode As EFileShare, _
ByVal lpSecurityAttributes As IntPtr, _
ByVal dwCreationDisposition As ECreationDisposition, _
ByVal dwFlagsAndAttributes As EFileAttributes, _
ByVal hTemplateFile As IntPtr) As IntPtr
End Function
<DllImport("kernel32.dll")> _
Public Shared Function GetFileAttributes(ByVal lpFileName As String) As Integer
End Function
<DllImport("kernel32.dll")> _
Public Shared Function GetCompressedFileSize(ByVal lpFileName As String, ByRef lpFileSizeHigh As UInteger) As UInteger
End Function
<DllImport("kernel32.dll")> _
Private Shared Function GetFileSize(ByVal hFile As IntPtr, ByVal lpFileSizeHigh As IntPtr) As UInteger
End Function
<DllImport("kernel32.dll", SetlastError:=True)> _
Private Shared Function ReadFile(ByVal hFile As IntPtr, ByVal Buffer As Byte(), _
ByVal nNumberOfBytesToRead As UInteger, ByRef lpNumberOfBytesRead As UInteger, _
ByRef lpOverlapped As System.Threading.NativeOverlapped) As Integer
End Function
<DllImport("kernel32.dll", SetLastError:=True)> _
Public Shared Function CloseHandle(ByVal hObject As IntPtr) As <MarshalAs(UnmanagedType.Bool)> Boolean
End Function
#Region "Const"
Private Const FILE_ATTRIBUTE_COMPRESSED = &H800
#End Region
Private Function MapRemoteModule(ByVal pID As Integer, ByVal moduleName As String) As Boolean
Dim dosHd As IMAGE_DOS_HEADER
Dim ntHd As IMAGE_NT_HEADERS
Dim hFile As IntPtr = _
CreateFile(moduleName, _
EFileAccess.GENERIC_READ, _
EFileShare.FILE_SHARE_READ Or EFileShare.FILE_SHARE_WRITE, _
IntPtr.Zero, _
ECreationDisposition.OPEN_EXISTING, _
EFileAttributes.FILE_ATTRIBUTE_NORMAL, _
IntPtr.Zero)
'CreateFile always screws up so yeahs..
If hFile = IntPtr.Zero Or hFile.ToInt32 < 0 Then Return False
Dim fSize As UInteger
If GetFileAttributes(moduleName) And FILE_ATTRIBUTE_COMPRESSED Then
fSize = GetCompressedFileSize(moduleName, 0)
Else
fSize = GetFileSize(hFile, IntPtr.Zero)
End If
Dim dllBin(fSize - 1) As Byte
Dim nBytes As UInteger
ReadFile(hFile, dllBin, fSize, nBytes, Nothing)
CloseHandle(hFile)
Dim gHandle As GCHandle = GCHandle.Alloc(dllBin, GCHandleType.Pinned)
dosHd = CType(Marshal.PtrToStructure(gHandle.AddrOfPinnedO bject, GetType(IMAGE_DOS_HEADER)), IMAGE_DOS_HEADER)
End Function[/highlight]
What is the point of converting it to managed code if you are just going to try fuck around with unmanaged. There's a System.IO namespace for a reason, you don't even need the CreateFile method. If you actually read what it's doing it's pretty much just reading all the shit inside the file. It's just a long way of saying something like IO.File.ReadAllBytes -> dllBin.
[highlight=vb.net]
For Each procMod As ProcessModule in Process.GetProcessById(pID)
If procMod.ModuleName = moduleName Then
Dim moduleBytes() As Byte = IO.File.ReadAllBytes(procMod.FileName)
Exit For
End If
Next[/highlight]
Better?
For Each procMod As ProcessModule in Process.GetProcessById(pID)
If procMod.ModuleName = moduleName Then
Dim moduleBytes() As Byte = IO.File.ReadAllBytes(procMod.FileName)
Exit For
End If
Next[/highlight]
Better?
Originally Posted by master131
[highlight=vb.net]
For Each procMod As ProcessModule in Process.GetProcessById(pID)
If procMod.ModuleName = moduleName Then
Dim moduleBytes() As Byte = IO.File.ReadAllBytes(procMod.FileName)
Exit For
End If
Next[/highlight]
Better?
For Each procMod As ProcessModule in Process.GetProcessById(pID)
If procMod.ModuleName = moduleName Then
Dim moduleBytes() As Byte = IO.File.ReadAllBytes(procMod.FileName)
Exit For
End If
Next[/highlight]
Better?
In spite of the fact that only the first 5px (wide) of the above code is shown, you're lagging my phone. --"
Gawd. Plus, I thought the point of .NET and abstraction was so that you need not p-invoke everything.
Originally Posted by Jason
No sense you make my young padawan.
Apparently my phone stopped responding just before I hit the didn't have a "t" key on my phone.
Gawd. Plus, I thought the point of .NET and abstraction was so that you need not p-invoke everything.
Originally Posted by Jason
No sense you make my young padawan.