Пример #1
0
        /// <summary>
        /// Obtains the memory address of an assembly.
        /// </summary>
        /// <param name="name">The name of the assembly to find the address of.</param>
        public uint GetProcAddress(string name)
        {
            unsafe
            {
                IntPtr codeBase = module.codeBase;
                int    idx      = -1;
                uint   i;
                IMAGE_DATA_DIRECTORY directory = module.headers.OptionalHeader.DataDirectory[0];
                if (directory.Size == 0)
                {
                    return(0);
                }
                var exports = PointerHelpers.ToStruct <IMAGE_EXPORT_DIRECTORY>(codeBase, directory.VirtualAddress);
                var nameRef = (uint *)new IntPtr(codeBase.ToInt32() + exports.AddressOfNames);
                var ordinal = (ushort *)new IntPtr(codeBase.ToInt32() + exports.AddressOfNameOrdinals);
                for (i = 0; i < exports.NumberOfNames; i++, nameRef++, ordinal++)
                {
                    var    str = codeBase + (int)(*nameRef);
                    string tmp = Marshal.PtrToStringAnsi(str);
                    if (tmp == name)
                    {
                        idx = *ordinal;
                        break;
                    }
                }

                var tmpaa = (uint *)(codeBase.ToInt32() + (exports.AddressOfFunctions + (idx * 4)));
                var addr  = (uint)((codeBase.ToInt32()) + (*tmpaa));
                return(addr);
            }
        }
Пример #2
0
        /// <summary>
        /// Gets the total amount of modules within an assembly.
        /// </summary>
        public int GetModuleCount()
        {
            int    count    = 0;
            IntPtr codeBase = module.codeBase;
            IMAGE_DATA_DIRECTORY directory = module.headers.OptionalHeader.DataDirectory[1];

            if (directory.Size > 0)
            {
                var importDesc = PointerHelpers.ToStruct <IMAGE_IMPORT_DESCRIPTOR>(codeBase, directory.VirtualAddress);
                while (importDesc.Name > 0)
                {
                    var    str    = codeBase + (int)importDesc.Name;
                    string tmp    = Marshal.PtrToStringAnsi(str);
                    int    handle = Win32Imports.LoadLibrary(tmp);

                    if (handle == -1)
                    {
                        break;
                    }
                    count++;
                    importDesc = PointerHelpers.ToStruct <IMAGE_IMPORT_DESCRIPTOR>(codeBase, (uint)(directory.VirtualAddress + (Marshal.SizeOf(typeof(IMAGE_IMPORT_DESCRIPTOR)) * (count))));
                }
            }
            return(count);
        }
Пример #3
0
        /// <summary>
        /// Relocates pointers so we can allow our injected assembly to be run.
        /// </summary>
        /// <param name="delta">The PE code and the old headers before injection.</param>
        public void PerformBaseRelocation(uint delta)
        {
            IntPtr codeBase   = module.codeBase;
            int    sizeOfBase = Marshal.SizeOf(typeof(IMAGE_BASE_RELOCATION));
            IMAGE_DATA_DIRECTORY directory = module.headers.OptionalHeader.DataDirectory[5];
            int cnt = 0;

            if (directory.Size > 0)
            {
                var relocation = PointerHelpers.ToStruct <IMAGE_BASE_RELOCATION>(codeBase, directory.VirtualAddress);
                while (relocation.VirtualAddress > 0)
                {
                    unsafe
                    {
                        var  dest    = (IntPtr)(codeBase.ToInt32() + (int)relocation.VirtualAddress);
                        var  relInfo = (ushort *)(codeBase.ToInt32() + (int)directory.VirtualAddress + sizeOfBase);
                        uint i;
                        for (i = 0; i < ((relocation.SizeOfBlock - Marshal.SizeOf(typeof(IMAGE_BASE_RELOCATION))) / 2); i++, relInfo++)
                        {
                            int type   = *relInfo >> 12;
                            int offset = (*relInfo & 0xfff);
                            switch (type)
                            {
                            case 0x00:
                                break;

                            case 0x03:
                                var patchAddrHl  = (uint *)((dest) + (offset));
                                *   patchAddrHl += delta;
                                break;
                            }
                        }
                    }
                    cnt       += (int)relocation.SizeOfBlock;
                    relocation = PointerHelpers.ToStruct <IMAGE_BASE_RELOCATION>(codeBase, (uint)(directory.VirtualAddress + cnt));
                }
            }
        }
Пример #4
0
        /// <summary>
        /// Rebuilds the PE import table after address relocations.
        /// </summary>
        public int BuildImportTable()
        {
            int ucount = GetModuleCount();

            module.modules = Marshal.AllocHGlobal((ucount) * sizeof(int));
            int    pcount   = 0;
            int    result   = 1;
            IntPtr codeBase = module.codeBase;
            IMAGE_DATA_DIRECTORY directory = module.headers.OptionalHeader.DataDirectory[1];

            if (directory.Size > 0)
            {
                var importDesc = PointerHelpers.ToStruct <IMAGE_IMPORT_DESCRIPTOR>(codeBase, directory.VirtualAddress);
                while (importDesc.Name > 0)
                {
                    var    str = codeBase + (int)importDesc.Name;
                    string tmp = Marshal.PtrToStringAnsi(str);
                    unsafe
                    {
                        uint *thunkRef;
                        uint *funcRef;

                        int handle = Win32Imports.LoadLibrary(tmp);

                        if (handle == -1)
                        {
                            result = 0;
                            break;
                        }

                        if (importDesc.CharacteristicsOrOriginalFirstThunk > 0)
                        {
                            IntPtr thunkRefAddr = codeBase + (int)importDesc.CharacteristicsOrOriginalFirstThunk;
                            thunkRef = (uint *)thunkRefAddr;
                            funcRef  = (uint *)(codeBase + (int)importDesc.FirstThunk);
                        }
                        else
                        {
                            thunkRef = (uint *)(codeBase + (int)importDesc.FirstThunk);
                            funcRef  = (uint *)(codeBase + (int)importDesc.FirstThunk);
                        }
                        for (; *thunkRef > 0; thunkRef++, funcRef++)
                        {
                            if ((*thunkRef & 0x80000000) != 0)
                            {
                                *funcRef = (uint)Win32Imports.GetProcAddress(new IntPtr(handle), new IntPtr(*thunkRef & 0xffff));
                            }
                            else
                            {
                                var str2    = codeBase + (int)(*thunkRef) + 2;
                                var tmpaa   = Marshal.PtrToStringAnsi(str2);
                                *   funcRef = Win32Imports.GetProcAddress(new IntPtr(handle), tmpaa);
                            }
                            if (*funcRef == 0)
                            {
                                result = 0;
                                break;
                            }
                        }


                        pcount++;
                        importDesc = PointerHelpers.ToStruct <IMAGE_IMPORT_DESCRIPTOR>(codeBase, directory.VirtualAddress + (uint)(Marshal.SizeOf(typeof(IMAGE_IMPORT_DESCRIPTOR)) * pcount));
                    }
                }
            }
            return(result);
        }