コード例 #1
0
        private static bool doCreateRemoteThread(Process pToBeInjected, string sDllPath, out string sError, out IntPtr hwnd)
        {
            try
            {
                sError = "";
                IntPtr hProcess = WINAPI.OpenProcess(0x43a, 1, (uint)pToBeInjected.Id);
                hwnd = hProcess;
                if (hProcess == IntPtr.Zero)
                {
                    Console.WriteLine("Error: dCRT Code: " + Marshal.GetLastWin32Error());
                    return(false);
                }
                IntPtr procAddress = WINAPI.GetProcAddress(WINAPI.GetModuleHandle("kernel32.dll"), "LoadLibraryA");
                if (procAddress == IntPtr.Zero)
                {
                    Console.WriteLine("Unable to find address of \"LoadLibraryA\".\n");
                    Console.WriteLine("Error code: " + Marshal.GetLastWin32Error());
                    return(false);
                }
                IntPtr lpBaseAddress = WINAPI.VirtualAllocEx(hProcess, IntPtr.Zero, (IntPtr)sDllPath.Length, 0x3000, 0x40);
                if ((lpBaseAddress == IntPtr.Zero) && (lpBaseAddress == IntPtr.Zero))
                {
                    Console.WriteLine("Unable to allocate memory to target process.\n");
                    Console.WriteLine("Error code: " + Marshal.GetLastWin32Error());
                    return(false);
                }
                byte[] byteLength = GetByteLength(sDllPath);
                IntPtr zero       = IntPtr.Zero;
                WINAPI.WriteProcessMemory(hProcess, lpBaseAddress, byteLength, (uint)byteLength.Length, out zero);
                //if (Marshal.GetLastWin32Error() != 0)
                //{
                //    sError = "Unable to write memory to process.";
                //    sError = sError + "Error code: " + Marshal.GetLastWin32Error();
                //    return false;
                //}
                if (WINAPI.CreateRemoteThread(hProcess, IntPtr.Zero, IntPtr.Zero, procAddress, lpBaseAddress, 0, IntPtr.Zero) == IntPtr.Zero)
                {
                    Console.WriteLine("Memoryspace Error on LOAD_DLL\n");
                    Console.WriteLine("Error code: " + Marshal.GetLastWin32Error());
                    return(false);
                }
                WINAPI.VirtualFreeEx(hProcess, IntPtr.Zero, UIntPtr.Zero, 0x8000);
                return(true);
            }
            catch (Exception exception)
            {
                sError = "";

                hwnd = IntPtr.Zero;
                Console.WriteLine(exception.ToString());
                return(false);
            }
        }
コード例 #2
0
        private static bool CRT(
            Process pToBeInjected,
            string sDllPath,
            out string sError,
            out IntPtr hwnd)
        {
            sError = String.Empty; //in case we encounter no errors

            IntPtr hndProc = WINAPI.OpenProcess(
                (0x2 | 0x8 | 0x10 | 0x20 | 0x400), //create thread, query info, operation
                //write, and read
                1,
                (uint)pToBeInjected.Id);

            hwnd = hndProc;

            if (hndProc == (IntPtr)0)
            {
                sError  = "Unable to attatch to process.\n";
                sError += "Error code: " + Marshal.GetLastWin32Error();
                return(false);
            }

            IntPtr lpLLAddress = WINAPI.GetProcAddress(
                WINAPI.GetModuleHandle("kernel32.dll"),
                "LoadLibraryA");

            if (lpLLAddress == (IntPtr)0)
            {
                sError  = "Unable to find address of \"LoadLibraryA\".\n";
                sError += "Error code: " + Marshal.GetLastWin32Error();
                return(false);
            }

            IntPtr lpAddress = WINAPI.VirtualAllocEx(
                hndProc,
                (IntPtr)null,
                (IntPtr)sDllPath.Length, //520 bytes should be enough
                (uint)WINAPI.VAE_Enums.AllocationType.MEM_COMMIT |
                (uint)WINAPI.VAE_Enums.AllocationType.MEM_RESERVE,
                (uint)WINAPI.VAE_Enums.ProtectionConstants.PAGE_EXECUTE_READWRITE);

            if (lpAddress == (IntPtr)0)
            {
                if (lpAddress == (IntPtr)0)
                {
                    sError  = "Unable to allocate memory to target process.\n";
                    sError += "Error code: " + Marshal.GetLastWin32Error();
                    return(false);
                }
            }

            byte[] bytes = CalcBytes(sDllPath);
            IntPtr ipTmp = IntPtr.Zero;

            WINAPI.WriteProcessMemory(
                hndProc,
                lpAddress,
                bytes,
                (uint)bytes.Length,
                out ipTmp);

            if (Marshal.GetLastWin32Error() != 0)
            {
                sError  = "Unable to write memory to process.";
                sError += "Error code: " + Marshal.GetLastWin32Error();
                return(false);
            }

            IntPtr ipThread = WINAPI.CreateRemoteThread(
                hndProc,
                (IntPtr)null,
                (IntPtr)0,
                lpLLAddress,
                lpAddress,
                0,
                (IntPtr)null);

            if (ipThread == (IntPtr)0)
            {
                sError  = "Unable to load dll into memory.";
                sError += "Error code: " + Marshal.GetLastWin32Error();
                return(false);
            }

            return(true);
        }
コード例 #3
0
ファイル: InjectorTwo.cs プロジェクト: gavinlwz/Cloud_Game
        private static bool CRT(
            Process pToBeInjected,
            string sDllPath,
            out string sError,
            out IntPtr hwnd)
        {
            sError = String.Empty; //in case we encounter no errors

            IntPtr hndProc = WINAPI.OpenProcess((0x2 | 0x8 | 0x10 | 0x20 | 0x400), 1, (uint)pToBeInjected.Id);

            hwnd = hndProc;

            if (hndProc == (IntPtr)0)
            {
                sError  = "Unable to attatch to process.\n";
                sError += "Error code: " + Marshal.GetLastWin32Error();
                return(false);
            }

            IntPtr lpLLAddress = WINAPI.GetProcAddress(
                WINAPI.GetModuleHandle("kernel32.dll"),
                "LoadLibraryA");

            if (lpLLAddress == (IntPtr)0)
            {
                sError  = "Unable to find address of \"LoadLibraryA\".\n";
                sError += "Error code: " + Marshal.GetLastWin32Error();
                return(false);
            }

            IntPtr lpAddress = WINAPI.VirtualAllocEx(
                hndProc,
                (IntPtr)null,
                (IntPtr)sDllPath.Length,
                //520 bytes should be enough
                (uint)WINAPI.VAE_Enums.AllocationType.MEM_COMMIT |
                (uint)WINAPI.VAE_Enums.AllocationType.MEM_RESERVE,
                (uint)WINAPI.VAE_Enums.ProtectionConstants.PAGE_EXECUTE_READWRITE);

            if (lpAddress == (IntPtr)0)
            {
                sError  = "Unable to allocate memory to target process.\n";
                sError += "Error code: " + Marshal.GetLastWin32Error();
                return(false);
            }

            byte[] bytes = CalcBytes(sDllPath);
            IntPtr ipTmp;

            WINAPI.WriteProcessMemory(
                hndProc,
                lpAddress,
                bytes,
                (uint)bytes.Length,
                out ipTmp);

            if (Marshal.GetLastWin32Error() != 0)
            {
                sError  = "Unable to write memory to process.\n";
                sError += "Error code: " + Marshal.GetLastWin32Error();
                return(false);
            }

            IntPtr hThread = WINAPI.CreateRemoteThread(
                hndProc,
                (IntPtr)null,
                (IntPtr)0,
                lpLLAddress,
                lpAddress,
                0,
                (IntPtr)null);

            if (hThread == (IntPtr)0)
            {
                sError  = "Unable to load dll into memory.";
                sError += "Error code: " + Marshal.GetLastWin32Error();
                return(false);
            }

            //added so it won't crash while thread is initializing
            // Time-out is 10 seconds...
            int Result = WaitForSingleObject(hThread, 10 * 1000);

            // Check whether thread timed out...
            if (Result == 0x00000080L || Result == 0x00000102L || Result == 0xFFFFFFFF)
            {
                // Make sure thread handle is valid before closing... prevents crashes.
                if (hThread != null)
                {
                    //Close thread in target process
                    WINAPI.CloseHandle(hThread);
                }

                /* Thread timed out... */
                throw new Exception("WaitForSingleObject failed!\n\n Call tech support.");
            }

            // Sleep thread for so as not to crash host
            Thread.Sleep(1000);

            // Clear up allocated space ( Allocmem )
            VirtualFreeEx(hndProc, lpAddress, (UIntPtr)0, 0x8000);

            // Make sure thread handle is valid before closing... prevents crashes.
            if (hThread != null)
            {
                //Close thread in target process
                WINAPI.CloseHandle(hThread);
            }

            Trace.TraceInformation("Injecter thinks all is OK");
            return(true);
        }
コード例 #4
0
ファイル: InjectorOne.cs プロジェクト: gavinlwz/Cloud_Game
        public static bool InjectDLL(IntPtr hProcess, String strDLLName)
        {
            IntPtr bytesout;

            // Length of string containing the DLL file name +1 byte padding
            Int32 LenWrite = strDLLName.Length + 1;

            // Allocate memory within the virtual address space of the target process
            IntPtr AllocMem = (IntPtr)WINAPI.VirtualAllocEx(hProcess, (IntPtr)null, (uint)LenWrite, 0x1000, 0x40);

            // Write DLL file name to allocated memory in target process
            WINAPI.WriteProcessMemory(hProcess, AllocMem, strDLLName, (UIntPtr)LenWrite, out bytesout);

            // Function pointer "Injector"
            UIntPtr Injector = (UIntPtr)WINAPI.GetProcAddress(WINAPI.GetModuleHandle("kernel32.dll"), "LoadLibraryA");

            if (Injector == null)
            {
                throw new Exception("GetProcAddress failed!\n\n Call tech support.");
            }

            // Create thread in target process, and store handle in hThread
            IntPtr hThread = (IntPtr)WINAPI.CreateRemoteThread(hProcess, (IntPtr)null, 0, Injector, AllocMem, 0, out bytesout);

            // Make sure thread handle is valid
            if (hThread == null)
            {
                //incorrect thread handle ... return failed
                throw new Exception("CreateRemoteThread failed!\n\n Call tech support.");
            }

            // Time-out is 10 seconds...
            int Result = WINAPI.WaitForSingleObject(hThread, 10 * 1000);

            // Check whether thread timed out...
            if (Result == 0x00000080L || Result == 0x00000102L || Result == 0xFFFFFFFF)
            {
                // Make sure thread handle is valid before closing... prevents crashes.
                if (hThread != null)
                {
                    //Close thread in target process
                    WINAPI.CloseHandle(hThread);
                }

                /* Thread timed out... */
                throw new Exception("WaitForSingleObject failed!\n\n Call tech support.");
            }

            // Sleep thread so as not to crash host
            Thread.Sleep(5000);

            // Clear up allocated space ( Allocmem )
            WINAPI.VirtualFreeEx(hProcess, AllocMem, (UIntPtr)0, 0x8000);

            // Make sure thread handle is valid before closing... prevents crashes.
            if (hThread != null)
            {
                //Close thread in target process
                WINAPI.CloseHandle(hThread);
            }

            return(true);
        }
コード例 #5
0
ファイル: Inject.cs プロジェクト: killvxk/OSPE
        /// <summary>
        /// Injects a x86 or x64 DLL into the process
        /// </summary>
        /// <param name="pToBeInjected">Process to be injected (obtained with Process.GetProcesses() ) </param>
        /// <param name="sDllPath">Full path to the DLL to be injected</param>
        /// <param name="sError">OUT parameter with an error string</param>
        /// <returns></returns>
        public static bool DoInject(
            Process pToBeInjected,
            string sDllPath,
            out string sError)
        {
            IntPtr hwnd = IntPtr.Zero;

            sError = String.Empty; //in case we encounter no errors

            //Open the target process with read , write and execute priviledges
            IntPtr hndProc = WINAPI.OpenProcess(
                (0x000F0000   // STANDARD_RIGHTS_REQUIRED
                 | 0x00100000 // SYNCHRONIZE
                 | 0xFFFF
                ), 0, (uint)pToBeInjected.Id);

            hwnd = hndProc;

            if (hndProc == (IntPtr)0)
            {
                sError  = "Unable to attatch to process.\n";
                sError += "Error code: " + Marshal.GetLastWin32Error();
                return(false);
            }
            //Get the address of LoadLibraryA
            IntPtr lpLLAddress = WINAPI.GetProcAddress(
                WINAPI.GetModuleHandle("kernel32.dll"),
                "LoadLibraryA");

            if (lpLLAddress == (IntPtr)0)
            {
                sError  = "Unable to find address of \"LoadLibraryA\".\n";
                sError += "Error code: " + Marshal.GetLastWin32Error();
                return(false);
            }
            // Allocate space in the process for our DLL
            IntPtr lpAddress = WINAPI.VirtualAllocEx(
                hndProc,
                (IntPtr)null,
                (IntPtr)sDllPath.Length, //520 bytes should be enough
                (uint)WINAPI.VAE_Enums.AllocationType.MEM_COMMIT |
                (uint)WINAPI.VAE_Enums.AllocationType.MEM_RESERVE,
                (uint)WINAPI.VAE_Enums.ProtectionConstants.PAGE_EXECUTE_READWRITE);


            if (lpAddress == (IntPtr)0)
            {
                sError  = "Unable to allocate memory to target process.\n";
                sError += "Error code: " + Marshal.GetLastWin32Error();
                return(false);
            }


            byte[] bytes = CalcBytes(sDllPath);
            IntPtr ipTmp = IntPtr.Zero;
            // Write the string name of our DLL in the memory allocated
            int bResult = WINAPI.WriteProcessMemory(
                hndProc,
                lpAddress,
                bytes,
                (uint)bytes.Length,
                out ipTmp);

            // ERROR x64: "Unable to write memory to process. Error code: 1300"
            if (bResult == 0)
            {
                sError  = "Unable to write memory to process.";
                sError += "Error code: " + Marshal.GetLastWin32Error();
                return(false);
            }
            // Load our DLL
            IntPtr ipThread = WINAPI.CreateRemoteThread(
                hndProc,
                (IntPtr)null,
                (IntPtr)0,
                lpLLAddress,
                lpAddress,
                0,
                (IntPtr)null);

            if (ipThread == (IntPtr)0)
            {
                sError  = "Unable to load dll into memory.";
                sError += "Error code: " + Marshal.GetLastWin32Error();
                return(false);
            }

            WINAPI.CloseHandle(hndProc);

            return(true);
        }