public static ProcessModuleEx FromMappedModule(PointerEx moduleHandle, byte[] moduleData) { ProcessModuleEx pmx = new ProcessModuleEx(moduleHandle, null); pmx.CacheExports(moduleData); pmx.IsManualMapped = true; return(pmx); }
/// <summary> /// Rewrite IAT for manually mapped remote module. /// </summary> /// <author>Ruben Boonen (@FuzzySec)</author> (modified for external ProcessEx) /// <param name="PEINFO">Module meta data struct (PE.PE_META_DATA).</param> /// <param name="ModuleMemoryBase">Base address of the module in memory.</param> /// <returns>void</returns> private void __MMRewriteModuleIAT(PE_META_DATA PEINFO, IntPtr ModuleMemoryBase, byte[] moduleRaw, byte[] moduleRemote) { IMAGE_DATA_DIRECTORY idd = PEINFO.Is32Bit ? PEINFO.OptHeader32.ImportTable : PEINFO.OptHeader64.ImportTable; // Check if there is no import table if (idd.VirtualAddress == 0) { // Return so that the rest of the module mapping process may continue. return; } // Ptr for the base import directory IntPtr pImportTable = (IntPtr)(idd.VirtualAddress); // Get API Set mapping dictionary if on Win10+ Native.OSVERSIONINFOEX OSVersion = new Native.OSVERSIONINFOEX(); Native.RtlGetVersionD(ref OSVersion); if (OSVersion.MajorVersion < 10) { throw new Exception(DSTR(DSTR_OS_VERSION_TOO_OLD)); } #if DEBUG DLog($"Starting IAT rewrite..."); #endif // Loop IID's int counter = 0; Native.IMAGE_IMPORT_DESCRIPTOR iid = new Native.IMAGE_IMPORT_DESCRIPTOR(); iid = moduleRemote.Skip(pImportTable.ToInt32() + (int)(Marshal.SizeOf(typeof(Native.IMAGE_IMPORT_DESCRIPTOR)) * counter)).Take(Marshal.SizeOf(typeof(Native.IMAGE_IMPORT_DESCRIPTOR))).ToArray().ToStruct <Native.IMAGE_IMPORT_DESCRIPTOR>(); while (iid.Name != 0) { // Get DLL string DllName = string.Empty; try { DllName = moduleRemote.String((int)iid.Name); } catch { } // Loop imports if (DllName == string.Empty) { throw new Exception(DSTR(DSTR_MODULE_NAME_INVALID)); } else { // API Set DLL? string dll_resolved; if ((DllName.StartsWith("api-") || DllName.StartsWith("ext-"))) { // for some reason, Lunar's resolve apiset is 1000x better than the dictionary setup done in dinvoke, so we will just use that. // lmfao: https://github.com/cobbr/SharpSploit/issues/58 if ((dll_resolved = ResolveAPISet(DllName)) == null) { throw new Exception(DSTR(DSTR_API_DLL_UNRESOLVED, DllName)); } // Not all API set DLL's have a registered host mapping DllName = dll_resolved; } #if DEBUG DLog($"Resolving {DllName}..."); #endif // Check and / or load DLL IntPtr hModule = GetLoadedModuleAddress(DllName); if (hModule == IntPtr.Zero) { #if DEBUG DLog($"Unresolved: {DllName}, Loading into memory..."); #endif hModule = LoadAndRegisterDllRemote(DllName).BaseAddress; if (hModule == IntPtr.Zero) { throw new Exception(DSTR(DSTR_MODULE_FILE_NOT_FOUND, DllName)); } } // Locate the module by its base address ProcessModuleEx sModule = FindModuleByAddress(hModule); #if DEBUG DLog($"Resolved Module: {sModule.ModuleName}:{sModule.BaseAddress:X}, {sModule.ModulePath}"); #endif // Loop thunks if (PEINFO.Is32Bit) { IMAGE_THUNK_DATA32 oft_itd = new IMAGE_THUNK_DATA32(); for (int i = 0; true; i++) { oft_itd = moduleRemote.Skip((int)(iid.OriginalFirstThunk + (UInt32)(i * (sizeof(UInt32))))).Take(4).ToArray().ToStruct <IMAGE_THUNK_DATA32>(); IntPtr ft_itd = (IntPtr)((UInt64)iid.FirstThunk + (UInt64)(i * (sizeof(UInt32)))); if (oft_itd.AddressOfData == 0) { break; } if (oft_itd.AddressOfData < 0x80000000) // !IMAGE_ORDINAL_FLAG32 { uint pImpByName = (uint)((uint)oft_itd.AddressOfData + sizeof(UInt16)); var pFunc = GetProcAddress(sModule.ModuleName, moduleRemote.String((int)pImpByName)); // Write ProcAddress BitConverter.GetBytes((int)pFunc).CopyTo(moduleRemote, ft_itd.ToInt32()); } else { ulong fOrdinal = oft_itd.AddressOfData & 0xFFFF; var pFunc = GetModuleExportAddress(sModule.ModuleName, (short)fOrdinal); // Write ProcAddress BitConverter.GetBytes((int)pFunc).CopyTo(moduleRemote, ft_itd.ToInt32()); } } } else { IMAGE_THUNK_DATA64 oft_itd = new IMAGE_THUNK_DATA64(); for (int i = 0; true; i++) { oft_itd = moduleRemote.Skip((int)(iid.OriginalFirstThunk + (uint)(i * sizeof(ulong)))).Take(8).ToArray().ToStruct <IMAGE_THUNK_DATA64>(); IntPtr ft_itd = (IntPtr)((UInt64)iid.FirstThunk + (UInt64)(i * (sizeof(UInt64)))); if (oft_itd.AddressOfData == 0) { break; } if (oft_itd.AddressOfData < 0x8000000000000000) // !IMAGE_ORDINAL_FLAG64 { uint pImpByName = (uint)((uint)oft_itd.AddressOfData + sizeof(UInt16)); var pFunc = GetProcAddress(sModule.ModuleName, moduleRemote.String((int)pImpByName)); // Write pointer BitConverter.GetBytes((long)pFunc).CopyTo(moduleRemote, ft_itd.ToInt32()); } else { ulong fOrdinal = oft_itd.AddressOfData & 0xFFFF; var pFunc = GetModuleExportAddress(sModule.ModuleName, (short)fOrdinal); // Write pointer BitConverter.GetBytes((long)pFunc).CopyTo(moduleRemote, ft_itd.ToInt32()); } } } counter++; iid = moduleRemote.Skip(pImportTable.ToInt32() + (int)(Marshal.SizeOf(typeof(Native.IMAGE_IMPORT_DESCRIPTOR)) * counter)).Take(Marshal.SizeOf(typeof(Native.IMAGE_IMPORT_DESCRIPTOR))).ToArray().ToStruct <Native.IMAGE_IMPORT_DESCRIPTOR>(); } } }