Пример #1
0
        public void EjectModule(RemoteModule module)
        {
            if (module == null || !module.IsValid)
            {
                throw new DllNotFoundException("Module is invalid!");
            }
            IntPtr       moduleHandle   = module.Handle;
            RemoteModule kernel32Module = GetModule("kernel32");

            if (kernel32Module == null)
            {
                throw new DllNotFoundException("Module 'kernel32' not found!");
            }
            RemoteFunction freeLibrary = kernel32Module.GetFunction("FreeLibrary");

            if (freeLibrary == null)
            {
                throw new MissingMethodException("Function 'FreeLibrary' not found in kernel32");
            }
            try {
                if (freeLibrary.Call(moduleHandle) == 0)
                {
                    throw new MethodAccessException("FreeLibrary call failed. This usually means that you tried to eject a non existent Module");
                }
            } catch (Exception e) {
                throw new MethodAccessException("Method FreeLibrary could not be called!", e);
            }
            Refresh();
        }
Пример #2
0
        /// <summary>
        ///     Injects a module, throws an exception on failure.
        /// </summary>
        /// <param name="filePath">The filepath of the dynamic link library.</param>
        /// <returns></returns>
        public RemoteModule InjectModule(string filePath)
        {
            filePath = Path.GetFullPath(filePath);
            if (!File.Exists(filePath))
            {
                throw new FileNotFoundException(filePath + " could not be found");
            }
            RemoteModule kernel32Module = GetModule("kernel32");

            if (kernel32Module == null)
            {
                throw new DllNotFoundException("Module 'kernel32' not found!");
            }
            RemoteFunction loadLibraryW = kernel32Module.GetFunction("LoadLibraryW");

            if (loadLibraryW == null || loadLibraryW.Address == IntPtr.Zero)
            {
                throw new MissingMethodException("Function 'LoadLibraryW' not found in kernel32");
            }
            try {
                if (loadLibraryW.Call(filePath) == 0)
                {
                    throw new MethodAccessException("LoadLibrary call failed. This usually means that you tried to inject a incompatible 32 bit dll in a 64 bit Process, or vice versa.");
                }
            } catch (Exception e) {
                throw new MethodAccessException("Method LoadLibraryW could not be called!", e);
            }
            Refresh();
            return(GetModule(filePath));
        }
Пример #3
0
        private IntPtr GetFunctionAddress(int ordinal, int nameIndex)
        {
            var addressOffset =
                Process.Memory.Read <int>(BaseAddress + (int)ExportDirectory.AddressOfFunctions + ordinal * sizeof(int)); //exportFunctions[ordinal];

            if (addressOffset < ExportDirectoryInfo.VirtualAddress || addressOffset >= ExportDirectoryInfo.VirtualAddress + ExportDirectoryInfo.Size)
            {
                return(BaseAddress + addressOffset);
            }
            string forwardingString = Process.Memory.ReadString(BaseAddress + addressOffset);
            int    dot = forwardingString.IndexOf('.');

            if (dot <= -1)
            {
                return(IntPtr.Zero);
            }
            string       redirectModuleName   = forwardingString.Substring(0, dot);
            string       redirectFunctionName = forwardingString.Substring(dot + 1);
            RemoteModule redirectModule       = Process.GetModule(redirectModuleName);

            if (redirectModule == null || redirectModule.BaseAddress == BaseAddress)
            {
                return(IntPtr.Zero);
            }
            if (redirectFunctionName[0] == '#')
            {
                redirectFunctionName = redirectFunctionName.Remove(0, 1);
                UInt32 redirectOrdinal;
                UInt32.TryParse(redirectFunctionName, out redirectOrdinal);
                if (redirectOrdinal == 0)
                {
                    return(IntPtr.Zero);
                }
                IntPtr         namePtr = ExportDirectory.AddressOfNames != 0 ? BaseAddress + Process.Memory.Read <int>(BaseAddress + (int)ExportDirectory.AddressOfNames + nameIndex * sizeof(int)) : IntPtr.Zero;
                RemoteFunction foo     = redirectModule.GetFunctionByOrdinal(redirectOrdinal, namePtr);
                return(foo != null ? foo.Address : IntPtr.Zero);
            }
            else
            {
                RemoteFunction foo = redirectModule.GetFunction(redirectFunctionName);
                return(foo != null ? foo.Address : IntPtr.Zero);
            }
        }