public static void RelocateModule(PE.PE_META_DATA PEINFO, IntPtr ModuleMemoryBase) { PE.IMAGE_DATA_DIRECTORY idd = PEINFO.Is32Bit ? PEINFO.OptHeader32.BaseRelocationTable : PEINFO.OptHeader64.BaseRelocationTable; Int64 ImageDelta = PEINFO.Is32Bit ? (Int64)((UInt64)ModuleMemoryBase - PEINFO.OptHeader32.ImageBase) : (Int64)((UInt64)ModuleMemoryBase - PEINFO.OptHeader64.ImageBase); IntPtr pRelocTable = (IntPtr)((UInt64)ModuleMemoryBase + idd.VirtualAddress); Int32 nextRelocTableBlock = -1; while (nextRelocTableBlock != 0) { PE.IMAGE_BASE_RELOCATION ibr = new PE.IMAGE_BASE_RELOCATION(); ibr = (PE.IMAGE_BASE_RELOCATION)Marshal.PtrToStructure(pRelocTable, typeof(PE.IMAGE_BASE_RELOCATION)); Int64 RelocCount = ((ibr.SizeOfBlock - Marshal.SizeOf(ibr)) / 2); for (int i = 0; i < RelocCount; i++) { IntPtr pRelocEntry = (IntPtr)((UInt64)pRelocTable + (UInt64)Marshal.SizeOf(ibr) + (UInt64)(i * 2)); UInt16 RelocValue = (UInt16)Marshal.ReadInt16(pRelocEntry); UInt16 RelocType = (UInt16)(RelocValue >> 12); UInt16 RelocPatch = (UInt16)(RelocValue & 0xfff); if (RelocType != 0) { try { IntPtr pPatch = (IntPtr)((UInt64)ModuleMemoryBase + ibr.VirtualAdress + RelocPatch); if (RelocType == 0x3) { Int32 OriginalPtr = Marshal.ReadInt32(pPatch); Marshal.WriteInt32(pPatch, (OriginalPtr + (Int32)ImageDelta)); } else { Int64 OriginalPtr = Marshal.ReadInt64(pPatch); Marshal.WriteInt64(pPatch, (OriginalPtr + ImageDelta)); } } catch { throw new InvalidOperationException("Memory access violation."); } } } pRelocTable = (IntPtr)((UInt64)pRelocTable + ibr.SizeOfBlock); nextRelocTableBlock = Marshal.ReadInt32(pRelocTable); } }
public static void SetModuleSectionPermissions(PE.PE_META_DATA PEINFO, IntPtr ModuleMemoryBase) { IntPtr BaseOfCode = PEINFO.Is32Bit ? (IntPtr)PEINFO.OptHeader32.BaseOfCode : (IntPtr)PEINFO.OptHeader64.BaseOfCode; SpDi2.Native.NtProtectVirtualMemory((IntPtr)(-1), ref ModuleMemoryBase, ref BaseOfCode, SpDi.Win32.WinNT.PAGE_READONLY); foreach (PE.IMAGE_SECTION_HEADER ish in PEINFO.Sections) { bool isRead = (ish.Characteristics & PE.DataSectionFlags.MEM_READ) != 0; bool isWrite = (ish.Characteristics & PE.DataSectionFlags.MEM_WRITE) != 0; bool isExecute = (ish.Characteristics & PE.DataSectionFlags.MEM_EXECUTE) != 0; uint flNewProtect = 0; if (isRead & !isWrite & !isExecute) { flNewProtect = SpDi.Win32.WinNT.PAGE_READONLY; } else if (isRead & isWrite & !isExecute) { flNewProtect = SpDi.Win32.WinNT.PAGE_READWRITE; } else if (isRead & isWrite & isExecute) { flNewProtect = SpDi.Win32.WinNT.PAGE_EXECUTE_READWRITE; } else if (isRead & !isWrite & isExecute) { flNewProtect = SpDi.Win32.WinNT.PAGE_EXECUTE_READ; } else if (!isRead & !isWrite & isExecute) { flNewProtect = SpDi.Win32.WinNT.PAGE_EXECUTE; } else { throw new InvalidOperationException("Unknown section flag, " + ish.Characteristics); } IntPtr pVirtualSectionBase = (IntPtr)((UInt64)ModuleMemoryBase + ish.VirtualAddress); IntPtr ProtectSize = (IntPtr)ish.VirtualSize; SpDi2.Native.NtProtectVirtualMemory((IntPtr)(-1), ref pVirtualSectionBase, ref ProtectSize, flNewProtect); } }
public static PE.PE_MANUAL_MAP MapModuleToMemory(IntPtr pModule) { PE.PE_META_DATA PEINFO = SpDi2.Generic.GetPeMetaData(pModule); if ((PEINFO.Is32Bit && IntPtr.Size == 8) || (!PEINFO.Is32Bit && IntPtr.Size == 4)) { Marshal.FreeHGlobal(pModule); throw new InvalidOperationException("The module architecture does not match the process architecture."); } IntPtr BaseAddress = IntPtr.Zero; IntPtr RegionSize = PEINFO.Is32Bit ? (IntPtr)PEINFO.OptHeader32.SizeOfImage : (IntPtr)PEINFO.OptHeader64.SizeOfImage; IntPtr pImage = SpDi2.Native.NtAllocateVirtualMemory( (IntPtr)(-1), ref BaseAddress, IntPtr.Zero, ref RegionSize, SpDi.Win32.Kernel32.MEM_COMMIT | SpDi.Win32.Kernel32.MEM_RESERVE, SpDi.Win32.WinNT.PAGE_READWRITE ); return(MapModuleToMemory(pModule, pImage, PEINFO)); }
public static PE.PE_MANUAL_MAP MapModuleToMemory(IntPtr pModule, IntPtr pImage, PE.PE_META_DATA PEINFO) { if ((PEINFO.Is32Bit && IntPtr.Size == 8) || (!PEINFO.Is32Bit && IntPtr.Size == 4)) { Marshal.FreeHGlobal(pModule); throw new InvalidOperationException("The module architecture does not match the process architecture."); } UInt32 SizeOfHeaders = PEINFO.Is32Bit ? PEINFO.OptHeader32.SizeOfHeaders : PEINFO.OptHeader64.SizeOfHeaders; UInt32 BytesWritten = SpDi2.Native.NtWriteVirtualMemory((IntPtr)(-1), pImage, pModule, SizeOfHeaders); foreach (PE.IMAGE_SECTION_HEADER ish in PEINFO.Sections) { IntPtr pVirtualSectionBase = (IntPtr)((UInt64)pImage + ish.VirtualAddress); IntPtr pRawSectionBase = (IntPtr)((UInt64)pModule + ish.PointerToRawData); BytesWritten = SpDi2.Native.NtWriteVirtualMemory((IntPtr)(-1), pVirtualSectionBase, pRawSectionBase, ish.SizeOfRawData); if (BytesWritten != ish.SizeOfRawData) { throw new InvalidOperationException("Failed to write to memory."); } } RelocateModule(PEINFO, pImage); RewriteModuleIAT(PEINFO, pImage); SetModuleSectionPermissions(PEINFO, pImage); Marshal.FreeHGlobal(pModule); PE.PE_MANUAL_MAP ManMapObject = new PE.PE_MANUAL_MAP { ModuleBase = pImage, PEINFO = PEINFO }; return(ManMapObject); }
public static PE.PE_MANUAL_MAP MapModuleToMemory(IntPtr pModule, IntPtr pImage) { PE.PE_META_DATA PEINFO = SpDi2.Generic.GetPeMetaData(pModule); return(MapModuleToMemory(pModule, pImage, PEINFO)); }
public static void RewriteModuleIAT(PE.PE_META_DATA PEINFO, IntPtr ModuleMemoryBase) { PE.IMAGE_DATA_DIRECTORY idd = PEINFO.Is32Bit ? PEINFO.OptHeader32.ImportTable : PEINFO.OptHeader64.ImportTable; IntPtr pImportTable = (IntPtr)((UInt64)ModuleMemoryBase + idd.VirtualAddress); SpDi.Native.OSVERSIONINFOEX OSVersion = new SpDi.Native.OSVERSIONINFOEX(); SpDi2.Native.RtlGetVersion(ref OSVersion); Dictionary <string, string> ApiSetDict = new Dictionary <string, string>(); if (OSVersion.MajorVersion >= 10) { ApiSetDict = SpDi2.Generic.GetApiSetMapping(); } int counter = 0; SpDi.Win32.Kernel32.IMAGE_IMPORT_DESCRIPTOR iid = new SpDi.Win32.Kernel32.IMAGE_IMPORT_DESCRIPTOR(); iid = (SpDi.Win32.Kernel32.IMAGE_IMPORT_DESCRIPTOR)Marshal.PtrToStructure( (IntPtr)((UInt64)pImportTable + (uint)(Marshal.SizeOf(iid) * counter)), typeof(SpDi.Win32.Kernel32.IMAGE_IMPORT_DESCRIPTOR) ); while (iid.Name != 0) { string DllName = string.Empty; try { DllName = Marshal.PtrToStringAnsi((IntPtr)((UInt64)ModuleMemoryBase + iid.Name)); } catch { } if (DllName == string.Empty) { throw new InvalidOperationException("Failed to read DLL name."); } else { if (OSVersion.MajorVersion >= 10 && (DllName.StartsWith("api-") || DllName.StartsWith("ext-")) && ApiSetDict.ContainsKey(DllName) && ApiSetDict[DllName].Length > 0) { DllName = ApiSetDict[DllName]; } IntPtr hModule = SpDi2.Generic.GetLoadedModuleAddress(DllName); if (hModule == IntPtr.Zero) { hModule = SpDi2.Generic.LoadModuleFromDisk(DllName); if (hModule == IntPtr.Zero) { throw new FileNotFoundException(DllName + ", unable to find the specified file."); } } if (PEINFO.Is32Bit) { PE.IMAGE_THUNK_DATA32 oft_itd = new PE.IMAGE_THUNK_DATA32(); for (int i = 0; true; i++) { oft_itd = (PE.IMAGE_THUNK_DATA32)Marshal.PtrToStructure((IntPtr)((UInt64)ModuleMemoryBase + iid.OriginalFirstThunk + (UInt32)(i * (sizeof(UInt32)))), typeof(PE.IMAGE_THUNK_DATA32)); IntPtr ft_itd = (IntPtr)((UInt64)ModuleMemoryBase + iid.FirstThunk + (UInt64)(i * (sizeof(UInt32)))); if (oft_itd.AddressOfData == 0) { break; } if (oft_itd.AddressOfData < 0x80000000) { IntPtr pImpByName = (IntPtr)((UInt64)ModuleMemoryBase + oft_itd.AddressOfData + sizeof(UInt16)); IntPtr pFunc = IntPtr.Zero; pFunc = SpDi2.Generic.GetNativeExportAddress(hModule, Marshal.PtrToStringAnsi(pImpByName)); Marshal.WriteInt32(ft_itd, pFunc.ToInt32()); } else { ulong fOrdinal = oft_itd.AddressOfData & 0xFFFF; IntPtr pFunc = IntPtr.Zero; pFunc = SpDi2.Generic.GetNativeExportAddress(hModule, (short)fOrdinal); Marshal.WriteInt32(ft_itd, pFunc.ToInt32()); } } } else { PE.IMAGE_THUNK_DATA64 oft_itd = new PE.IMAGE_THUNK_DATA64(); for (int i = 0; true; i++) { oft_itd = (PE.IMAGE_THUNK_DATA64)Marshal.PtrToStructure((IntPtr)((UInt64)ModuleMemoryBase + iid.OriginalFirstThunk + (UInt64)(i * (sizeof(UInt64)))), typeof(PE.IMAGE_THUNK_DATA64)); IntPtr ft_itd = (IntPtr)((UInt64)ModuleMemoryBase + iid.FirstThunk + (UInt64)(i * (sizeof(UInt64)))); if (oft_itd.AddressOfData == 0) { break; } if (oft_itd.AddressOfData < 0x8000000000000000) { IntPtr pImpByName = (IntPtr)((UInt64)ModuleMemoryBase + oft_itd.AddressOfData + sizeof(UInt16)); IntPtr pFunc = IntPtr.Zero; pFunc = SpDi2.Generic.GetNativeExportAddress(hModule, Marshal.PtrToStringAnsi(pImpByName)); Marshal.WriteInt64(ft_itd, pFunc.ToInt64()); } else { ulong fOrdinal = oft_itd.AddressOfData & 0xFFFF; IntPtr pFunc = IntPtr.Zero; pFunc = SpDi2.Generic.GetNativeExportAddress(hModule, (short)fOrdinal); Marshal.WriteInt64(ft_itd, pFunc.ToInt64()); } } } counter++; iid = (SpDi.Win32.Kernel32.IMAGE_IMPORT_DESCRIPTOR)Marshal.PtrToStructure( (IntPtr)((UInt64)pImportTable + (uint)(Marshal.SizeOf(iid) * counter)), typeof(SpDi.Win32.Kernel32.IMAGE_IMPORT_DESCRIPTOR) ); } } }