private Process _process; /* Process to DLL Inject into. */
/// <summary>
/// Initializes the DLL Injector.
/// </summary>
/// <param name="process">The process to inject DLLs into.</param>
public Injector(Process process)
{
Safety.WaitForModuleInitialization(process);
// Initiate target process.
_process = process;
_circularBuffer = new CircularBuffer(4096, new ExternalMemory(process));
_shellCode = new Shellcode(process);
}
private long _getProcAddressReturnValuePtr; /* Address of GetProcAddress' return value. */
/// <summary>
/// Builds the shellcode necessary to successfully call LoadLibraryW and GetProcAddress
/// inside the address space of another executable.
/// </summary>
/// <param name="targetProcess">Process inside which to execute.</param>
public Shellcode(Process targetProcess)
{
Safety.WaitForModuleInitialization(targetProcess);
_privateBuffer = new MemoryBufferHelper(targetProcess).CreatePrivateMemoryBuffer(4096);
_assembler = new Assembler.Assembler();
_memory = new ExternalMemory(targetProcess);
_circularBuffer = new CircularBuffer(4096, _memory);
_targetProcess = targetProcess;
// Get arch of target process.
PeFile targetPeFile = new PeFile(targetProcess.Modules[0].FileName);
_machineType = (MachineType)targetPeFile.ImageNtHeaders.FileHeader.Machine;
// Get Kernel32 load address in target.
Module kernel32Module = GetKernel32InRemoteProcess(targetProcess);
Kernel32Handle = (long)kernel32Module.BaseAddress;
// We need to change the module path if 32bit process; because the given path is not true,
// it is being actively redirected by Windows on Windows 64 (WoW64)
if (_machineType == MachineType.I386)
{
StringBuilder builder = new StringBuilder(256);
GetSystemWow64Directory(builder, (uint)builder.Capacity);
kernel32Module.ModulePath = builder.ToString() + "\\" + Path.GetFileName(kernel32Module.ModulePath);
}
// Parse Kernel32 loaded by target and get address of LoadLibrary & GetProcAddress.
PeFile kernel32PeFile = new PeFile(kernel32Module.ModulePath);
var exportedFunctions = kernel32PeFile.ExportedFunctions;
_loadLibraryWOffset = GetExportedFunctionOffset(exportedFunctions, "LoadLibraryW");
_getProcAddressOffset = GetExportedFunctionOffset(exportedFunctions, "GetProcAddress");
if (_loadLibraryWOffset == 0 || _getProcAddressOffset == 0)
{
throw new ShellCodeGeneratorException("Failed to find GetProcAddress or LoadLibraryW methods in target process' Kernel32.");
}
if (_machineType == MachineType.AMD64)
{
BuildLoadLibraryW64();
BuildGetProcAddress64();
}
else
{
BuildLoadLibraryW86();
BuildGetProcAddress86();
}
_assembler.Dispose();
_assembler = null;
}