Exetools  

Go Back   Exetools > General > Source Code

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 07-30-2016, 15:49
WorldCrackersUnited WorldCrackersUnited is offline
Guest
 
Join Date: Jun 2015
Posts: 3
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 14
Thanks Rcvd at 8 Times in 2 Posts
WorldCrackersUnited Reputation: 0
Usermode APC Injection

By: karman
Credits: The owner of the web "kkamagui.springnote.com"

Hi, this is a modification of a code (Code Injection) that uses QueueUserAPC to inject a dll (it also use NtMapViewOfSection because some anticheats hooks NtWriteVirtualMemory)

Code:
#define _WIN32_WINNT 0x0500
#include 
#include 

DWORD APCInject(PCHAR sProcName,PCHAR sDllName){
  DWORD dRet=0;
  //define type and pointer to function
  typedef NTSTATUS (WINAPI *tNtMapViewOfSection)(HANDLE,HANDLE,LPVOID,ULONG,SIZE_T,LARGE_INTEGER*,SIZE_T*,SECTION_INHERIT,ULONG,ULONG);
  tNtMapViewOfSection NtMapViewOfSection=(tNtMapViewOfSection)GetProcAddress(GetModuleHandle("ntdll.dll"),"NtMapViewOfSection");
  if(!NtMapViewOfSection)return -1;
  //create buffer
  HANDLE hFile=CreateFileMapping(INVALID_HANDLE_VALUE,NULL,PAGE_READWRITE,0,strlen(sDllName)+1,NULL);
  if(!hFile)return -2;
  PCHAR hView=MapViewOfFile(hFile,FILE_MAP_ALL_ACCESS,0,0,0);
  if(!hView){
    CloseHandle(hFile);
    return -3;
  }else//set value to buffer
    strcpy(hView,sDllName);
  // Starting target process
  PROCESS_INFORMATION pi;STARTUPINFO st;
  ZeroMemory(&pi,sizeof(pi));
  ZeroMemory(&st,sizeof(st));
  st.cb=sizeof(STARTUPINFO);
  //create suspended process
  if(CreateProcess(sProcName,NULL,NULL,NULL,FALSE,CREATE_SUSPENDED,NULL,NULL,&st,&pi)){
    LPVOID RemoteString=NULL;ULONG ViewSize=0;
    if(NtMapViewOfSection(hFile,pi.hProcess,&RemoteString,0,0,NULL,&ViewSize,ViewShare,0,PAGE_READONLY)==0){
      LPVOID nLoadLibrary=(LPVOID)GetProcAddress(GetModuleHandle("kernel32.dll"),"LoadLibraryA");
      if(!QueueUserAPC((PAPCFUNC)nLoadLibrary,pi.hThread,(ULONG_PTR)RemoteString))
        dRet=-6;
    }else
      dRet=-5;
    ResumeThread(pi.hThread);
    CloseHandle(pi.hThread);
    CloseHandle(pi.hProcess);
  }else
    dRet=-4;
  UnmapViewOfFile(hView);
  CloseHandle(hFile);
  return dRet;
}

int main(void){
  DWORD dwRet=APCInject("C:\\Games\\Counter-Strike\\hl.exe","C:\\cheat.dll");
  if(!dwRet)
    puts("Injection Ok!");
  else
    printf("Injection fail -> %d!",dwRet);
  system("pause");
  return 0;
}
my site:
http://www.rompiendocodigo.net/
Reply With Quote
The Following 7 Users Say Thank You to WorldCrackersUnited For This Useful Post:
alephz (08-04-2016), besoeso (07-30-2016), mr.exodia (12-23-2016), niculaita (07-31-2016), Scabtree (08-24-2016), schrodyn (12-21-2016)
  #2  
Old 12-21-2016, 10:54
SLV SLV is offline
Friend
 
Join Date: May 2005
Posts: 62
Rept. Given: 3
Rept. Rcvd 4 Times in 3 Posts
Thanks Given: 5
Thanks Rcvd at 2 Times in 2 Posts
SLV Reputation: 4
Fails if process doesn't have alertable threads.
Reply With Quote
  #3  
Old 02-14-2017, 21:08
deroko's Avatar
deroko deroko is offline
cr4zyserb
 
Join Date: Nov 2005
Posts: 217
Rept. Given: 13
Rept. Rcvd 30 Times in 14 Posts
Thanks Given: 7
Thanks Rcvd at 33 Times in 16 Posts
deroko Reputation: 30
Well int this case code always works as prior to execution of NtContinue there is call for NtTestAlert which will trigger APCs, and also NtContinue how it is called by LdrInitializeThunk always has Alertable set to 1, so APCs will always get executed in this example.
__________________
http://accessroot.com
Reply With Quote
The Following 2 Users Say Thank You to deroko For This Useful Post:
niculaita (02-15-2017), sh3dow (02-17-2017)
  #4  
Old 06-05-2017, 06:46
aliali aliali is offline
Friend
 
Join Date: Jan 2002
Posts: 59
Rept. Given: 4
Rept. Rcvd 8 Times in 4 Posts
Thanks Given: 1
Thanks Rcvd at 13 Times in 8 Posts
aliali Reputation: 8
InjectProc explains almost the same idea

https://github.com/secrary/InjectProc
Reply With Quote
The Following User Says Thank You to aliali For This Useful Post:
Gladiyator (06-05-2017)
  #5  
Old 06-05-2017, 15:42
Gladiyator's Avatar
Gladiyator Gladiyator is offline
Family
 
Join Date: Jan 2009
Location: .:: Tehran ::.
Posts: 106
Rept. Given: 78
Rept. Rcvd 59 Times in 19 Posts
Thanks Given: 130
Thanks Rcvd at 107 Times in 35 Posts
Gladiyator Reputation: 59
Quote:
Originally Posted by aliali View Post
InjectProc explains almost the same idea

https://github.com/secrary/InjectProc
Thanks for nice share
I think it's not working on windows 10 x64
any idea to fix it ?
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On


Similar Threads
Thread Thread Starter Forum Replies Last Post
[Delphi/Native API] ZwTerminateProcess without declaration from UserMode Agmcz Source Code 3 07-25-2018 04:48
Code Injection R@dier General Discussion 18 10-30-2003 04:00


All times are GMT +8. The time now is 15:57.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )