private static bool TryStartRemoteDllThreadHelper(SafeProcessHandle hRemoteProcess, SafeRemoteBufferHandle hRemoteDllPathBuffer, out SafeRemoteThreadHandle hRemoteThreadOut)
        {
            var hProcessUnsafe = hRemoteProcess.DangerousGetHandle();
             var pRemoteDllPath = hRemoteDllPathBuffer.DangerousGetHandle();

             try {
            uint remoteThreadId;
            var hRemoteThread = WinAPI.CreateRemoteThread(
               hProcessUnsafe,
               IntPtr.Zero,
               0,
               pLoadLibraryA,
               pRemoteDllPath,
               0,
               out remoteThreadId
            );
            if (hRemoteThread == IntPtr.Zero) {
               logger.Warn($"CreateRemoteThread failed with errno {Marshal.GetLastWin32Error()}.");
               hRemoteThreadOut = null;
            } else {
               hRemoteThreadOut = new SafeRemoteThreadHandle(hRemoteThread);
            }
             } catch (Win32Exception e) {
            var errno = Marshal.GetLastWin32Error();
            logger.Warn("Win32Exception thrown when creating remote thread. Errno: " + errno + ".", e);
            hRemoteThreadOut = null;
             }

             return hRemoteThreadOut != null;
        }
        public static SafeRemoteThreadHandle StartRemoteDllThreadOrThrow(SafeProcessHandle hRemoteProcess, SafeRemoteBufferHandle hRemoteDllPathBuffer, int attempts)
        {
            for (var i = 0; i < attempts; i++) {
            SafeRemoteThreadHandle result;
            if (TryStartRemoteDllThreadHelper(hRemoteProcess, hRemoteDllPathBuffer, out result)) {
               return result;
            }
             }

             throw new Exception(
            "Could not create remote thread after " + attempts + " attempts!\n" +
            "\r\nhProcess: " + hRemoteProcess.DangerousGetHandle() +
            "\r\nhRemoteDllPathBuffer: " + hRemoteDllPathBuffer.DangerousGetHandle() +
            "\r\npLoadLibraryA: " + pLoadLibraryA +
            "\r\nErrno: " + Marshal.GetLastWin32Error()
             );
        }
        public ProcessInjectionResult InjectToProcessOrThrow(int targetProcessId, string dllPath)
        {
            // Normalize dll path so it is properly loaded in target process
            dllPath = Path.GetFullPath(dllPath);

            logger.Info("Injecting into processId " + targetProcessId + " dll " + dllPath);
            using (var hProcess = SafeProcessHandle.OpenOrThrow(targetProcessId))
                using (var hDllPathBuffer = SafeRemoteBufferHandle.AllocateOrThrow(hProcess, dllPath))
                    using (var hRemoteThread = SafeRemoteThreadHandle.StartRemoteDllThreadOrThrow(hProcess, hDllPathBuffer, 10)) {
                        logger.Info("Our dll is running in a remote thread.");
                        if (hRemoteThread.TryWaitForTermination(kDllCompletionTimeoutMilliseconds))
                        {
                            return(ProcessInjectionResult.Success);
                        }
                        else
                        {
                            return(ProcessInjectionResult.DllFailed);
                        }
                    }
        }
示例#4
0
        private static bool TryStartRemoteDllThreadHelper(SafeProcessHandle hRemoteProcess, SafeRemoteBufferHandle hRemoteDllPathBuffer, out SafeRemoteThreadHandle hRemoteThreadOut)
        {
            var hProcessUnsafe = hRemoteProcess.DangerousGetHandle();
            var pRemoteDllPath = hRemoteDllPathBuffer.DangerousGetHandle();

            try {
                uint remoteThreadId;
                var  hRemoteThread = WinAPI.CreateRemoteThread(
                    hProcessUnsafe,
                    IntPtr.Zero,
                    0,
                    pLoadLibraryA,
                    pRemoteDllPath,
                    0,
                    out remoteThreadId
                    );
                if (hRemoteThread == IntPtr.Zero)
                {
                    logger.Warn($"CreateRemoteThread failed with errno {Marshal.GetLastWin32Error()}.");
                    hRemoteThreadOut = null;
                }
                else
                {
                    hRemoteThreadOut = new SafeRemoteThreadHandle(hRemoteThread);
                }
            } catch (Win32Exception e) {
                var errno = Marshal.GetLastWin32Error();
                logger.Warn("Win32Exception thrown when creating remote thread. Errno: " + errno + ".", e);
                hRemoteThreadOut = null;
            }

            return(hRemoteThreadOut != null);
        }
示例#5
0
        public static SafeRemoteThreadHandle StartRemoteDllThreadOrThrow(SafeProcessHandle hRemoteProcess, SafeRemoteBufferHandle hRemoteDllPathBuffer, int attempts)
        {
            for (var i = 0; i < attempts; i++)
            {
                SafeRemoteThreadHandle result;
                if (TryStartRemoteDllThreadHelper(hRemoteProcess, hRemoteDllPathBuffer, out result))
                {
                    return(result);
                }
            }

            throw new Exception(
                      "Could not create remote thread after " + attempts + " attempts!\n" +
                      "\r\nhProcess: " + hRemoteProcess.DangerousGetHandle() +
                      "\r\nhRemoteDllPathBuffer: " + hRemoteDllPathBuffer.DangerousGetHandle() +
                      "\r\npLoadLibraryA: " + pLoadLibraryA +
                      "\r\nErrno: " + Marshal.GetLastWin32Error()
                      );
        }