예제 #1
0
        private bool isDllLocked()
        {
            String path = Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location);

            Native.OBJECT_ATTRIBUTES fileattributes = new Native.OBJECT_ATTRIBUTES("\\DosDevices\\" + path + "\\ws2_32.dll",
                                                                                   Native.OBJ_CASE_INSENSITIVE);
            IntPtr ws2_32;

            Native.IO_STATUS_BLOCK iosb = new Native.IO_STATUS_BLOCK();
            Native.NtStatus        stat = Native.ZwOpenFile(out ws2_32, Native.FILE_GENERIC_READ | Native.FILE_GENERIC_WRITE | Native.FILE_GENERIC_EXECUTE,
                                                            ref fileattributes, ref iosb, Native.FILE_SHARE_READ | Native.FILE_SHARE_WRITE, 0);
            if (stat == 0)
            {
                Native.ZwClose(ws2_32);
            }
            return(stat == 0);
        }
 public static String installHook(bool pernament)
 {
     String path = Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location);
     String log = path + "\\injecter.txt";
     string[] keys = { "\\KnownDlls32", "\\KnownDlls" };
     foreach(string key in keys) {
         Native.OBJECT_ATTRIBUTES section = new Native.OBJECT_ATTRIBUTES(key + "\\WS2_32.dll", Native.OBJ_CASE_INSENSITIVE);
         IntPtr ptr;
         Native.NtStatus status = Native.ZwOpenSection(out ptr, Native.SECTION_ALL_ACCESS, ref section);
         if (status == 0) {
             File.AppendAllText(log, "Removing: " + section.ObjectName + "\r\n");
             status = Native.ZwMakeTemporaryObject(ptr);
             if (status != 0) {
                 File.AppendAllText(log, "Could not remove: " + section.ObjectName + " - error "
                     + String.Format("0x{0:X}", status) + ")\r\n");
             }
             status = Native.ZwClose(ptr);
             if (status != 0) {
                 File.AppendAllText(log, "Could not close: " + section.ObjectName + " - error "
                     + String.Format("0x{0:X}", status) + ")\r\n");
             }
         }
     }
     IntPtr pPath;
     if (Native.SHGetKnownFolderPath(Native.KnownFolder.Windows, 0, IntPtr.Zero, out pPath) == 0) {
         string s = Marshal.PtrToStringUni(pPath);
         Marshal.FreeCoTaskMem(pPath);
         Native.CreateSymbolicLink(s + "\\system32\\ws2_32_org.dll", s + "\\system32\\ws2_32.dll", Native.SYMBOLIC_LINK_FLAG.File);
         Native.CreateSymbolicLink(s + "\\SysWOW64\\ws2_32_org.dll", s + "\\SysWOW64\\ws2_32.dll", Native.SYMBOLIC_LINK_FLAG.File);
     }
     Native.OBJECT_ATTRIBUTES dll32 = new Native.OBJECT_ATTRIBUTES("\\DosDevices\\" + path + "\\ws2_32.dll",
         Native.OBJ_CASE_INSENSITIVE);
     Native.OBJECT_ATTRIBUTES dll64 = new Native.OBJECT_ATTRIBUTES("\\DosDevices\\" + path + "\\x64\\ws2_32.dll",
         Native.OBJ_CASE_INSENSITIVE);
     IntPtr ws2_32, ws2_64;
     Native.IO_STATUS_BLOCK iosb32 = new Native.IO_STATUS_BLOCK(), iosb64 = new Native.IO_STATUS_BLOCK();
     Native.NtStatus statDll32 = Native.ZwOpenFile(out ws2_32, Native.FILE_GENERIC_READ | Native.FILE_GENERIC_WRITE | Native.FILE_GENERIC_EXECUTE,
         ref dll32, ref iosb32, Native.FILE_SHARE_READ | Native.FILE_SHARE_WRITE, 0);
     Native.NtStatus statDll64 = Native.ZwOpenFile(out ws2_64, Native.FILE_GENERIC_READ | Native.FILE_GENERIC_WRITE | Native.FILE_GENERIC_EXECUTE,
         ref dll64, ref iosb64, Native.FILE_SHARE_READ | Native.FILE_SHARE_WRITE, 0);
     if (statDll32 != 0) {
         File.AppendAllText(log, "Could not open: " + dll32.ObjectName + ", assuming uninstallation (error "
             + String.Format("0x{0:X}", statDll32) + ")\r\n");
     } else {
         File.AppendAllText(log, "Opened: " + dll32.ObjectName + "\r\n");
         Native.OBJECT_ATTRIBUTES secDir32 = new Native.OBJECT_ATTRIBUTES("\\KnownDlls32", Native.OBJ_CASE_INSENSITIVE);
         Native.OBJECT_ATTRIBUTES secDir64 = new Native.OBJECT_ATTRIBUTES("\\KnownDlls", Native.OBJ_CASE_INSENSITIVE);
         IntPtr dir32, dir64;
         Native.NtStatus statSec32 = Native.ZwOpenDirectoryObject(out dir32, Native.DIRECTORY_ALL_ACCESS, ref secDir32);
         Native.NtStatus statSec64 = Native.ZwOpenDirectoryObject(out dir64, Native.DIRECTORY_ALL_ACCESS, ref secDir64);
         if (statSec64 != 0) {
             File.AppendAllText(log, "Could not open: " + secDir64.ObjectName + " (error "
                 + String.Format("0x{0:X}", statSec64) + ")\r\n");
             File.AppendAllText(log, "FAIL!\r\n");
             if (statDll32 == 0) {
                 Native.ZwClose(ws2_32);
             }
             if (statDll64 == 0) {
                 Native.ZwClose(ws2_64);
             }
             return "Could not open section: " + secDir64.ObjectName + " (error " + Enum.GetName(typeof(Native.NtStatus), statSec64);
         }
         if (statSec32 != 0) {
             File.AppendAllText(log, "Could not open: " + secDir32.ObjectName + " (error "
                 + String.Format("0x{0:X}", statSec32) + ")\r\n");
             dir32 = dir64;
             secDir32 = secDir64;
             dir64 = IntPtr.Zero;
         } else {
             if (statDll64 != 0) {
                 File.AppendAllText(log, "Could not open: " + dll64.ObjectName + " (error "
                     + String.Format("0x{0:X}", statDll64) + ")\r\n");
                 File.AppendAllText(log, "FAIL!\r\n");
                 if (statDll32 == 0) {
                     Native.ZwClose(ws2_32);
                 }
                 if (statDll64 == 0) {
                     Native.ZwClose(ws2_64);
                 }
                 return "Could not open dll: " + dll64.ObjectName + " (error " + Enum.GetName(typeof(Native.NtStatus), statDll64);
             }
         }
         if (dir64 != IntPtr.Zero) {
             File.AppendAllText(log, "Going to install: " + dll64.ObjectName + " on "
                 + secDir64.ObjectName + "\r\n");
             Native.OBJECT_ATTRIBUTES secFile64 = new Native.OBJECT_ATTRIBUTES(secDir64.ObjectName + "\\WS2_32.dll", 0);
             IntPtr file64;
             long zero64 = 0;
             Native.NtStatus statFile64 = Native.ZwCreateSection(out file64, Native.SECTION_ALL_ACCESS, ref secFile64, ref zero64,
                 Native.PAGE_EXECUTE_READWRITE, Native.SEC_IMAGE, ws2_64);
             if (statFile64 != 0) {
                 File.AppendAllText(log, "Could not install: " + secFile64.ObjectName + " (error "
                     + String.Format("0x{0:X}", statFile64) + ")\r\n");
             } else {
                 if (pernament) {
                     Native.NtStatus status = Native.ZwMakePermanentObject(file64);
                     if (status != 0)
                     {
                         File.AppendAllText(log, "Could not make permanent: " + secFile64.ObjectName + " (error "
                             + String.Format("0x{0:X}", status) + ")\r\n");
                     }
                 }
             }
         }
         File.AppendAllText(log, "Going to install: " + dll32.ObjectName + " on "
             + secDir32.ObjectName + "\r\n");
         Native.OBJECT_ATTRIBUTES secFile32 = new Native.OBJECT_ATTRIBUTES(secDir32.ObjectName + "\\WS2_32.dll", 0);
         IntPtr file32;
         long zero32 = 0;
         Native.NtStatus statFile32 = Native.ZwCreateSection(out file32, Native.SECTION_ALL_ACCESS, ref secFile32, ref zero32,
             Native.PAGE_EXECUTE_READWRITE, Native.SEC_IMAGE, ws2_32);
         if (statFile32 != 0) {
             File.AppendAllText(log, "Could not install: " + secFile32.ObjectName + " (error "
                 + String.Format("0x{0:X}", statFile32) + ")\r\n");
         } else {
             if (pernament) {
                 Native.NtStatus status = Native.ZwMakePermanentObject(file32);
                 if (status != 0)
                 {
                     File.AppendAllText(log, "Could not make permanent: " + secFile32.ObjectName + " (error "
                         + String.Format("0x{0:X}", status) + ")\r\n");
                 }
             }
         }
     }
     if (statDll32 == 0) {
         Native.ZwClose(ws2_32);
     }
     if (statDll64 == 0) {
         Native.ZwClose(ws2_64);
     }
     return null;
 }
        public static String installHook(bool pernament)
        {
            String path = Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location);
            String log  = path + "\\injecter.txt";

            string[] keys = { "\\KnownDlls32", "\\KnownDlls" };
            foreach (string key in keys)
            {
                Native.OBJECT_ATTRIBUTES section = new Native.OBJECT_ATTRIBUTES(key + "\\WS2_32.dll", Native.OBJ_CASE_INSENSITIVE);
                IntPtr          ptr;
                Native.NtStatus status = Native.ZwOpenSection(out ptr, Native.SECTION_ALL_ACCESS, ref section);
                if (status == 0)
                {
                    File.AppendAllText(log, "Removing: " + section.ObjectName + "\r\n");
                    status = Native.ZwMakeTemporaryObject(ptr);
                    if (status != 0)
                    {
                        File.AppendAllText(log, "Could not remove: " + section.ObjectName + " - error "
                                           + String.Format("0x{0:X}", status) + ")\r\n");
                    }
                    status = Native.ZwClose(ptr);
                    if (status != 0)
                    {
                        File.AppendAllText(log, "Could not close: " + section.ObjectName + " - error "
                                           + String.Format("0x{0:X}", status) + ")\r\n");
                    }
                }
            }
            IntPtr pPath;

            if (Native.SHGetKnownFolderPath(Native.KnownFolder.Windows, 0, IntPtr.Zero, out pPath) == 0)
            {
                string s = Marshal.PtrToStringUni(pPath);
                Marshal.FreeCoTaskMem(pPath);
                Native.CreateSymbolicLink(s + "\\system32\\ws2_32_org.dll", s + "\\system32\\ws2_32.dll", Native.SYMBOLIC_LINK_FLAG.File);
                Native.CreateSymbolicLink(s + "\\SysWOW64\\ws2_32_org.dll", s + "\\SysWOW64\\ws2_32.dll", Native.SYMBOLIC_LINK_FLAG.File);
            }
            Native.OBJECT_ATTRIBUTES dll32 = new Native.OBJECT_ATTRIBUTES("\\DosDevices\\" + path + "\\ws2_32.dll",
                                                                          Native.OBJ_CASE_INSENSITIVE);
            Native.OBJECT_ATTRIBUTES dll64 = new Native.OBJECT_ATTRIBUTES("\\DosDevices\\" + path + "\\x64\\ws2_32.dll",
                                                                          Native.OBJ_CASE_INSENSITIVE);
            IntPtr ws2_32, ws2_64;

            Native.IO_STATUS_BLOCK iosb32 = new Native.IO_STATUS_BLOCK(), iosb64 = new Native.IO_STATUS_BLOCK();
            Native.NtStatus        statDll32 = Native.ZwOpenFile(out ws2_32, Native.FILE_GENERIC_READ | Native.FILE_GENERIC_WRITE | Native.FILE_GENERIC_EXECUTE,
                                                                 ref dll32, ref iosb32, Native.FILE_SHARE_READ | Native.FILE_SHARE_WRITE, 0);
            Native.NtStatus statDll64 = Native.ZwOpenFile(out ws2_64, Native.FILE_GENERIC_READ | Native.FILE_GENERIC_WRITE | Native.FILE_GENERIC_EXECUTE,
                                                          ref dll64, ref iosb64, Native.FILE_SHARE_READ | Native.FILE_SHARE_WRITE, 0);
            if (statDll32 != 0)
            {
                File.AppendAllText(log, "Could not open: " + dll32.ObjectName + ", assuming uninstallation (error "
                                   + String.Format("0x{0:X}", statDll32) + ")\r\n");
            }
            else
            {
                File.AppendAllText(log, "Opened: " + dll32.ObjectName + "\r\n");
                Native.OBJECT_ATTRIBUTES secDir32 = new Native.OBJECT_ATTRIBUTES("\\KnownDlls32", Native.OBJ_CASE_INSENSITIVE);
                Native.OBJECT_ATTRIBUTES secDir64 = new Native.OBJECT_ATTRIBUTES("\\KnownDlls", Native.OBJ_CASE_INSENSITIVE);
                IntPtr          dir32, dir64;
                Native.NtStatus statSec32 = Native.ZwOpenDirectoryObject(out dir32, Native.DIRECTORY_ALL_ACCESS, ref secDir32);
                Native.NtStatus statSec64 = Native.ZwOpenDirectoryObject(out dir64, Native.DIRECTORY_ALL_ACCESS, ref secDir64);
                if (statSec64 != 0)
                {
                    File.AppendAllText(log, "Could not open: " + secDir64.ObjectName + " (error "
                                       + String.Format("0x{0:X}", statSec64) + ")\r\n");
                    File.AppendAllText(log, "FAIL!\r\n");
                    if (statDll32 == 0)
                    {
                        Native.ZwClose(ws2_32);
                    }
                    if (statDll64 == 0)
                    {
                        Native.ZwClose(ws2_64);
                    }
                    return("Could not open section: " + secDir64.ObjectName + " (error " + Enum.GetName(typeof(Native.NtStatus), statSec64));
                }
                if (statSec32 != 0)
                {
                    File.AppendAllText(log, "Could not open: " + secDir32.ObjectName + " (error "
                                       + String.Format("0x{0:X}", statSec32) + ")\r\n");
                    dir32    = dir64;
                    secDir32 = secDir64;
                    dir64    = IntPtr.Zero;
                }
                else
                {
                    if (statDll64 != 0)
                    {
                        File.AppendAllText(log, "Could not open: " + dll64.ObjectName + " (error "
                                           + String.Format("0x{0:X}", statDll64) + ")\r\n");
                        File.AppendAllText(log, "FAIL!\r\n");
                        if (statDll32 == 0)
                        {
                            Native.ZwClose(ws2_32);
                        }
                        if (statDll64 == 0)
                        {
                            Native.ZwClose(ws2_64);
                        }
                        return("Could not open dll: " + dll64.ObjectName + " (error " + Enum.GetName(typeof(Native.NtStatus), statDll64));
                    }
                }
                if (dir64 != IntPtr.Zero)
                {
                    File.AppendAllText(log, "Going to install: " + dll64.ObjectName + " on "
                                       + secDir64.ObjectName + "\r\n");
                    Native.OBJECT_ATTRIBUTES secFile64 = new Native.OBJECT_ATTRIBUTES(secDir64.ObjectName + "\\WS2_32.dll", 0);
                    IntPtr          file64;
                    long            zero64     = 0;
                    Native.NtStatus statFile64 = Native.ZwCreateSection(out file64, Native.SECTION_ALL_ACCESS, ref secFile64, ref zero64,
                                                                        Native.PAGE_EXECUTE_READWRITE, Native.SEC_IMAGE, ws2_64);
                    if (statFile64 != 0)
                    {
                        File.AppendAllText(log, "Could not install: " + secFile64.ObjectName + " (error "
                                           + String.Format("0x{0:X}", statFile64) + ")\r\n");
                    }
                    else
                    {
                        if (pernament)
                        {
                            Native.NtStatus status = Native.ZwMakePermanentObject(file64);
                            if (status != 0)
                            {
                                File.AppendAllText(log, "Could not make permanent: " + secFile64.ObjectName + " (error "
                                                   + String.Format("0x{0:X}", status) + ")\r\n");
                            }
                        }
                    }
                }
                File.AppendAllText(log, "Going to install: " + dll32.ObjectName + " on "
                                   + secDir32.ObjectName + "\r\n");
                Native.OBJECT_ATTRIBUTES secFile32 = new Native.OBJECT_ATTRIBUTES(secDir32.ObjectName + "\\WS2_32.dll", 0);
                IntPtr          file32;
                long            zero32     = 0;
                Native.NtStatus statFile32 = Native.ZwCreateSection(out file32, Native.SECTION_ALL_ACCESS, ref secFile32, ref zero32,
                                                                    Native.PAGE_EXECUTE_READWRITE, Native.SEC_IMAGE, ws2_32);
                if (statFile32 != 0)
                {
                    File.AppendAllText(log, "Could not install: " + secFile32.ObjectName + " (error "
                                       + String.Format("0x{0:X}", statFile32) + ")\r\n");
                }
                else
                {
                    if (pernament)
                    {
                        Native.NtStatus status = Native.ZwMakePermanentObject(file32);
                        if (status != 0)
                        {
                            File.AppendAllText(log, "Could not make permanent: " + secFile32.ObjectName + " (error "
                                               + String.Format("0x{0:X}", status) + ")\r\n");
                        }
                    }
                }
            }
            if (statDll32 == 0)
            {
                Native.ZwClose(ws2_32);
            }
            if (statDll64 == 0)
            {
                Native.ZwClose(ws2_64);
            }
            return(null);
        }
 private bool isDllLocked()
 {
     String path = Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location);
     Native.OBJECT_ATTRIBUTES fileattributes = new Native.OBJECT_ATTRIBUTES("\\DosDevices\\" + path + "\\ws2_32.dll",
         Native.OBJ_CASE_INSENSITIVE);
     IntPtr ws2_32;
     Native.IO_STATUS_BLOCK iosb = new Native.IO_STATUS_BLOCK();
     Native.NtStatus stat = Native.ZwOpenFile(out ws2_32, Native.FILE_GENERIC_READ | Native.FILE_GENERIC_WRITE | Native.FILE_GENERIC_EXECUTE,
         ref fileattributes, ref iosb, Native.FILE_SHARE_READ | Native.FILE_SHARE_WRITE, 0);
     if (stat == 0) {
         Native.ZwClose(ws2_32);
     }
     return stat == 0;
 }