private void CreateSyscall <TSyscall>() where TSyscall : class { // Get the address of the function to syscall var functionAddress = PInvoke.GetProcAddress(_ntDllAddress, typeof(TSyscall).Name.Replace("Definition", "")); // Copy the first 8 bytes of the function var functionBytes = new byte[8]; Marshal.Copy(functionAddress, functionBytes, 0, 8); // Retrieve the syscall index from the bytes var syscallIndexBytes = Environment.Is64BitProcess ? functionBytes.Skip(4).Take(4) : functionBytes.Skip(1).Take(4); // Write the shellcode used to perform the syscall into the local process var shellcode = Environment.Is64BitProcess ? SyscallX64.GetShellcode(syscallIndexBytes.ToArray()) : SyscallX86.GetShellcode(syscallIndexBytes.ToArray()); var shellcodeBuffer = LocalMemoryTools.StoreBytesInBuffer(shellcode); // Create an instance of the syscall class var syscallInstance = Activator.CreateInstance(typeof(TSyscall), BindingFlags.Instance | BindingFlags.NonPublic, null, new object[] { shellcodeBuffer }, null); // Get the parameter and return types of the syscall method var methodInformation = typeof(TSyscall).GetMethod("Invoke", BindingFlags.Instance | BindingFlags.NonPublic); var methodTypes = new List <Type>(methodInformation.GetParameters().Select(parameter => parameter.ParameterType)) { methodInformation.ReturnType }; // Create the delegate type to represent the syscall method Type delegateType; if (methodTypes.Last() == typeof(void)) { methodTypes.RemoveAt(methodTypes.Count - 1); delegateType = Expression.GetActionType(methodTypes.ToArray()); } else { delegateType = Expression.GetFuncType(methodTypes.ToArray()); } // Create a delegate for the syscall method var syscallDelegate = Delegate.CreateDelegate(delegateType, syscallInstance, "Invoke"); _syscallCache.Add(typeof(TSyscall).Name, new SyscallInstance(syscallDelegate, shellcodeBuffer)); }
internal PeParser(byte[] dllBytes) { _dllBuffer = LocalMemoryTools.StoreBytesInBuffer(dllBytes); _peHeaders = new PeHeaders(); ReadPeHeaders(); }
internal PeParser(string dllPath) { _dllBuffer = LocalMemoryTools.StoreBytesInBuffer(File.ReadAllBytes(dllPath)); _peHeaders = new PeHeaders(); ReadPeHeaders(); }
public bool Call(InjectionProperties injectionProperties) { var localDllAddress = injectionProperties.DllPath is null ? LocalMemoryTools.StoreBytesInBuffer(injectionProperties.DllBytes) : LocalMemoryTools.StoreBytesInBuffer(File.ReadAllBytes(injectionProperties.DllPath)); // Build the import table of the DLL BuildImportTable(injectionProperties, localDllAddress); var peHeaders = injectionProperties.PeParser.GetHeaders(); // Allocate memory for the DLL in the target process var allocationBaseAddress = injectionProperties.RemoteProcess.IsWow64 ? peHeaders.NtHeaders32.OptionalHeader.ImageBase : peHeaders.NtHeaders64.OptionalHeader.ImageBase; var dllSize = injectionProperties.RemoteProcess.IsWow64 ? peHeaders.NtHeaders32.OptionalHeader.SizeOfImage : peHeaders.NtHeaders64.OptionalHeader.SizeOfImage; IntPtr remoteDllAddress; try { remoteDllAddress = injectionProperties.MemoryManager.AllocateVirtualMemory((IntPtr)allocationBaseAddress, (int)dllSize, Enumerations.MemoryProtectionType.ExecuteReadWrite); } catch (Win32Exception) { remoteDllAddress = injectionProperties.MemoryManager.AllocateVirtualMemory(IntPtr.Zero, (int)dllSize, Enumerations.MemoryProtectionType.ExecuteReadWrite); } // Perform any needed relocations PerformRelocations(injectionProperties, localDllAddress, remoteDllAddress); // Map the sections of the DLL MapSections(injectionProperties, localDllAddress, remoteDllAddress); // Map randomised PE headers MapHeaders(injectionProperties, remoteDllAddress); // Call any TLS callbacks CallTlsCallbacks(injectionProperties, remoteDllAddress); // Call the entry point of the DLL var dllEntryPointAddress = injectionProperties.RemoteProcess.IsWow64 ? remoteDllAddress.AddOffset(peHeaders.NtHeaders32.OptionalHeader.AddressOfEntryPoint) : remoteDllAddress.AddOffset(peHeaders.NtHeaders64.OptionalHeader.AddressOfEntryPoint); if (dllEntryPointAddress != remoteDllAddress) { CallEntryPoint(injectionProperties, remoteDllAddress, dllEntryPointAddress); } LocalMemoryTools.FreeMemoryForBuffer(localDllAddress); return(true); }