public static ulong GetModuleByName(this Process process, string moduleName)
{
ulong[] moduleHandleArray = new ulong[1000];
fixed(ulong *hMods = moduleHandleArray)
{
if (NT.EnumProcessModules(process.Handle, (ulong)hMods, (uint)(sizeof(ulong) * moduleHandleArray.Length), out uint cbNeeded) > 0)
{
for (int moduleIndex = 0; moduleIndex < cbNeeded / sizeof(ulong); moduleIndex++)
{
string name = NTM.GetModuleBaseName(process.Handle, moduleHandleArray[moduleIndex]);
if (String.Equals(name, moduleName, StringComparison.InvariantCultureIgnoreCase))
{
return(moduleHandleArray[moduleIndex]);
}
}
}
}
return(0);
}
public static Dictionary <string, ulong> GetModules(this Process process)
{
var result = new Dictionary <string, ulong>();
ulong[] moduleHandleArray = new ulong[1000];
fixed(ulong *hMods = moduleHandleArray)
{
if (NT.EnumProcessModules(process.Handle, (ulong)hMods, (uint)(sizeof(ulong) * moduleHandleArray.Length), out uint cbNeeded) > 0)
{
for (int moduleIndex = 0; moduleIndex < cbNeeded / sizeof(ulong); moduleIndex++)
{
string name = NTM.GetModuleBaseName(process.Handle, moduleHandleArray[moduleIndex]);
result[name.ToLower()] = moduleHandleArray[moduleIndex];
//if (String.Equals(name, moduleName, StringComparison.InvariantCultureIgnoreCase))
// return moduleHandleArray[moduleIndex];
}
}
}
return(result);
}
public void FixImportTable(UInt32 localImage, NT.IMAGE_OPTIONAL_HEADER64 optionalHeader)
{
NT.IMAGE_IMPORT_DESCRIPTOR *importDescriptor = (NT.IMAGE_IMPORT_DESCRIPTOR *)(localImage + optionalHeader.ImportTable.VirtualAddress);
for (; importDescriptor->FirstThunk > 0; ++importDescriptor)
{
string libraryName = Marshal.PtrToStringAnsi((IntPtr)(localImage + importDescriptor->Name));
// RECODE THIS, THIS IS STUPID & DANGEROUS
// I AM ONLY DOING THIS BECAUSE OF API-SET DLLS
// I COULDNT BE ARSED TO MAKE A PINVOKE FOR ApiSetResolveToHost
ulong localLibraryHandle = NT.LoadLibrary(libraryName);
libraryName = NTM.GetModuleBaseName(Process.GetCurrentProcess().Handle, localLibraryHandle).ToLower();
// IF WE MAPPED DEPENDENCY EARLIER, WE SHOULD USE RVA
// INSTEAD OF STATIC MEMORY ADDRESS
bool mappedDependency = MappedModules.TryGetValue(libraryName, out ulong remoteLibraryHandle);
bool linkedInProcess = LinkedModules.TryGetValue(libraryName, out remoteLibraryHandle);
if (!mappedDependency && !linkedInProcess) // DEPENDENCY NOT FOUND, MAP IT!
{
string dependencyPath = Tools.FindDll(libraryName);
// SKIP IF DEPENDENCY COULDN'T BE FOUND
if (dependencyPath == null)
{
continue;
}
// [8:44 PM] markhc: i had something similar
// [8:44 PM] markhc: it was deep inside CRT initialization(edited)
// [8:45 PM] Ch40zz: how did you fix it?
// [8:46 PM] markhc: i didnt fix it
// [8:46 PM] markhc: i thought it was something wrong with my manual mapper code, but i couldnt figure out what was it
// [8:46 PM] markhc: so i threw it all away
if (libraryName == "msvcp140.dll")
{
var tempOptions = Options;
tempOptions.EraseHeaders = false;
new LoadLibraryInjection(TargetProcess, TypeOfExecution, tempOptions).InjectImage(dependencyPath);
--importDescriptor;
continue;
}
remoteLibraryHandle = MapImage(libraryName, File.ReadAllBytes(dependencyPath));
mappedDependency = true;
}
UInt32 *functionAddress = (UInt32 *)(localImage + importDescriptor->FirstThunk);
UInt32 *importEntry = (UInt32 *)(localImage + importDescriptor->OriginalFirstThunk);
do
{
ulong procNamePointer = *importEntry < 0x8000000000000000 /*IMAGE_ORDINAL_FLAG64*/ ? // IS ORDINAL?
localImage + *importEntry + sizeof(ushort) /*SKIP HINT*/ : // FUNCTION BY NAME
*importEntry & 0xFFFF; // ORDINAL
var localFunctionPointer = NT.GetProcAddress(localLibraryHandle, procNamePointer);
var rva = localFunctionPointer - localLibraryHandle;
// SET NEW FUNCTION POINTER
*functionAddress = (UInt32)(mappedDependency ? remoteLibraryHandle + rva : localFunctionPointer);
// GET NEXT ENTRY
++functionAddress;
++importEntry;
} while (*importEntry > 0);
}
}