EXETOOLS FORUM  

Go Back   EXETOOLS FORUM > General > Source Code

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 07-30-2016, 15:49
WorldCrackersUnited WorldCrackersUnited is offline
Friend
 
Join Date: Jun 2015
Posts: 3
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 14
Thanks Rcvd at 8 Times in 2 Posts
WorldCrackersUnited Reputation: 0
Usermode APC Injection

By: karman
Credits: The owner of the web "kkamagui.springnote.com"

Hi, this is a modification of a code (Code Injection) that uses QueueUserAPC to inject a dll (it also use NtMapViewOfSection because some anticheats hooks NtWriteVirtualMemory)

Code:
#define _WIN32_WINNT 0x0500
#include 
#include 

DWORD APCInject(PCHAR sProcName,PCHAR sDllName){
  DWORD dRet=0;
  //define type and pointer to function
  typedef NTSTATUS (WINAPI *tNtMapViewOfSection)(HANDLE,HANDLE,LPVOID,ULONG,SIZE_T,LARGE_INTEGER*,SIZE_T*,SECTION_INHERIT,ULONG,ULONG);
  tNtMapViewOfSection NtMapViewOfSection=(tNtMapViewOfSection)GetProcAddress(GetModuleHandle("ntdll.dll"),"NtMapViewOfSection");
  if(!NtMapViewOfSection)return -1;
  //create buffer
  HANDLE hFile=CreateFileMapping(INVALID_HANDLE_VALUE,NULL,PAGE_READWRITE,0,strlen(sDllName)+1,NULL);
  if(!hFile)return -2;
  PCHAR hView=MapViewOfFile(hFile,FILE_MAP_ALL_ACCESS,0,0,0);
  if(!hView){
    CloseHandle(hFile);
    return -3;
  }else//set value to buffer
    strcpy(hView,sDllName);
  // Starting target process
  PROCESS_INFORMATION pi;STARTUPINFO st;
  ZeroMemory(&pi,sizeof(pi));
  ZeroMemory(&st,sizeof(st));
  st.cb=sizeof(STARTUPINFO);
  //create suspended process
  if(CreateProcess(sProcName,NULL,NULL,NULL,FALSE,CREATE_SUSPENDED,NULL,NULL,&st,&pi)){
    LPVOID RemoteString=NULL;ULONG ViewSize=0;
    if(NtMapViewOfSection(hFile,pi.hProcess,&RemoteString,0,0,NULL,&ViewSize,ViewShare,0,PAGE_READONLY)==0){
      LPVOID nLoadLibrary=(LPVOID)GetProcAddress(GetModuleHandle("kernel32.dll"),"LoadLibraryA");
      if(!QueueUserAPC((PAPCFUNC)nLoadLibrary,pi.hThread,(ULONG_PTR)RemoteString))
        dRet=-6;
    }else
      dRet=-5;
    ResumeThread(pi.hThread);
    CloseHandle(pi.hThread);
    CloseHandle(pi.hProcess);
  }else
    dRet=-4;
  UnmapViewOfFile(hView);
  CloseHandle(hFile);
  return dRet;
}

int main(void){
  DWORD dwRet=APCInject("C:\\Games\\Counter-Strike\\hl.exe","C:\\cheat.dll");
  if(!dwRet)
    puts("Injection Ok!");
  else
    printf("Injection fail -> %d!",dwRet);
  system("pause");
  return 0;
}
my site:
http://www.rompiendocodigo.net/
Reply With Quote
The Following 7 Users Say Thank You to WorldCrackersUnited For This Useful Post:
alephz (08-04-2016), besoeso (07-30-2016), mr.exodia (12-23-2016), niculaita (07-31-2016), Scabtree (08-24-2016), schrodyn (12-21-2016)
  #2  
Old 12-21-2016, 10:54
SLV SLV is offline
Friend
 
Join Date: May 2005
Posts: 62
Rept. Given: 3
Rept. Rcvd 4 Times in 3 Posts
Thanks Given: 4
Thanks Rcvd at 1 Time in 1 Post
SLV Reputation: 4
Fails if process doesn't have alertable threads.
Reply With Quote
  #3  
Old 02-14-2017, 21:08
deroko's Avatar
deroko deroko is offline
cr4zyserb
 
Join Date: Nov 2005
Posts: 212
Rept. Given: 10
Rept. Rcvd 30 Times in 14 Posts
Thanks Given: 6
Thanks Rcvd at 17 Times in 8 Posts
deroko Reputation: 30
Well int this case code always works as prior to execution of NtContinue there is call for NtTestAlert which will trigger APCs, and also NtContinue how it is called by LdrInitializeThunk always has Alertable set to 1, so APCs will always get executed in this example.
__________________
http://accessroot.com
Reply With Quote
The Following 2 Users Say Thank You to deroko For This Useful Post:
niculaita (02-15-2017), sh3dow (02-17-2017)
  #4  
Old 06-05-2017, 06:46
aliali aliali is offline
Friend
 
Join Date: Jan 2002
Posts: 52
Rept. Given: 4
Rept. Rcvd 8 Times in 4 Posts
Thanks Given: 1
Thanks Rcvd at 5 Times in 4 Posts
aliali Reputation: 8
InjectProc explains almost the same idea

https://github.com/secrary/InjectProc
Reply With Quote
The Following User Says Thank You to aliali For This Useful Post:
Gladiyator (06-05-2017)
  #5  
Old 06-05-2017, 15:42
Gladiyator's Avatar
Gladiyator Gladiyator is offline
Family
 
Join Date: Jan 2009
Location: .:: Tehran ::.
Posts: 83
Rept. Given: 74
Rept. Rcvd 54 Times in 16 Posts
Thanks Given: 48
Thanks Rcvd at 47 Times in 10 Posts
Gladiyator Reputation: 54
Quote:
Originally Posted by aliali View Post
InjectProc explains almost the same idea

https://github.com/secrary/InjectProc
Thanks for nice share
I think it's not working on windows 10 x64
any idea to fix it ?
__________________
Artan Protector
Ultimate Anti-Reversing Tool

Official Website : www.artanprotector.com
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On


Similar Threads
Thread Thread Starter Forum Replies Last Post
Code Injection R@dier General Discussion 18 10-30-2003 04:00


All times are GMT +8. The time now is 16:58.


ICP05004977
vBulletin Security provided by vBSecurity v2.2.0 (Lite) - vBulletin Mods & Addons Copyright © 2017 DragonByte Technologies Ltd.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX