mirror of
https://github.com/3xpl01tc0d3r/ProcessInjection
synced 2026-06-06 15:14:27 +00:00
3xpl01tc0d3r
336 lines
11 KiB
C#
336 lines
11 KiB
C#
using System;
|
|
using System.Linq;
|
|
using System.Text;
|
|
using System.Threading.Tasks;
|
|
using System.Runtime.InteropServices;
|
|
|
|
|
|
namespace ProcessInjection.Native
|
|
{
|
|
public static class PE
|
|
{
|
|
public const uint DLL_PROCESS_DETACH = 0;
|
|
public const uint DLL_PROCESS_ATTACH = 1;
|
|
public const uint DLL_THREAD_ATTACH = 2;
|
|
public const uint DLL_THREAD_DETACH = 3;
|
|
|
|
[UnmanagedFunctionPointer(CallingConvention.StdCall)]
|
|
public delegate bool DllMain(IntPtr hinstDll, uint fdwReason, IntPtr lpvReserved);
|
|
|
|
[Flags]
|
|
public enum DataSectionFlags : uint
|
|
{
|
|
TYPE_NO_PAD = 0x00000008,
|
|
CNT_CODE = 0x00000020,
|
|
CNT_INITIALIZED_DATA = 0x00000040,
|
|
CNT_UNINITIALIZED_DATA = 0x00000080,
|
|
LNK_INFO = 0x00000200,
|
|
LNK_REMOVE = 0x00000800,
|
|
LNK_COMDAT = 0x00001000,
|
|
NO_DEFER_SPEC_EXC = 0x00004000,
|
|
GPREL = 0x00008000,
|
|
MEM_FARDATA = 0x00008000,
|
|
MEM_PURGEABLE = 0x00020000,
|
|
MEM_16BIT = 0x00020000,
|
|
MEM_LOCKED = 0x00040000,
|
|
MEM_PRELOAD = 0x00080000,
|
|
ALIGN_1BYTES = 0x00100000,
|
|
ALIGN_2BYTES = 0x00200000,
|
|
ALIGN_4BYTES = 0x00300000,
|
|
ALIGN_8BYTES = 0x00400000,
|
|
ALIGN_16BYTES = 0x00500000,
|
|
ALIGN_32BYTES = 0x00600000,
|
|
ALIGN_64BYTES = 0x00700000,
|
|
ALIGN_128BYTES = 0x00800000,
|
|
ALIGN_256BYTES = 0x00900000,
|
|
ALIGN_512BYTES = 0x00A00000,
|
|
ALIGN_1024BYTES = 0x00B00000,
|
|
ALIGN_2048BYTES = 0x00C00000,
|
|
ALIGN_4096BYTES = 0x00D00000,
|
|
ALIGN_8192BYTES = 0x00E00000,
|
|
ALIGN_MASK = 0x00F00000,
|
|
LNK_NRELOC_OVFL = 0x01000000,
|
|
MEM_DISCARDABLE = 0x02000000,
|
|
MEM_NOT_CACHED = 0x04000000,
|
|
MEM_NOT_PAGED = 0x08000000,
|
|
MEM_SHARED = 0x10000000,
|
|
MEM_EXECUTE = 0x20000000,
|
|
MEM_READ = 0x40000000,
|
|
MEM_WRITE = 0x80000000
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Sequential)]
|
|
public struct IMAGE_DATA_DIRECTORY
|
|
{
|
|
public uint VirtualAddress;
|
|
public uint Size;
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
|
public struct IMAGE_OPTIONAL_HEADER32
|
|
{
|
|
public ushort Magic;
|
|
public byte MajorLinkerVersion;
|
|
public byte MinorLinkerVersion;
|
|
public uint SizeOfCode;
|
|
public uint SizeOfInitializedData;
|
|
public uint SizeOfUninitializedData;
|
|
public uint AddressOfEntryPoint;
|
|
public uint BaseOfCode;
|
|
public uint BaseOfData;
|
|
public uint ImageBase;
|
|
public uint SectionAlignment;
|
|
public uint FileAlignment;
|
|
public ushort MajorOperatingSystemVersion;
|
|
public ushort MinorOperatingSystemVersion;
|
|
public ushort MajorImageVersion;
|
|
public ushort MinorImageVersion;
|
|
public ushort MajorSubsystemVersion;
|
|
public ushort MinorSubsystemVersion;
|
|
public uint Win32VersionValue;
|
|
public uint SizeOfImage;
|
|
public uint SizeOfHeaders;
|
|
public uint CheckSum;
|
|
public ushort Subsystem;
|
|
public ushort DllCharacteristics;
|
|
public uint SizeOfStackReserve;
|
|
public uint SizeOfStackCommit;
|
|
public uint SizeOfHeapReserve;
|
|
public uint SizeOfHeapCommit;
|
|
public uint LoaderFlags;
|
|
public uint NumberOfRvaAndSizes;
|
|
|
|
public IMAGE_DATA_DIRECTORY ExportTable;
|
|
public IMAGE_DATA_DIRECTORY ImportTable;
|
|
public IMAGE_DATA_DIRECTORY ResourceTable;
|
|
public IMAGE_DATA_DIRECTORY ExceptionTable;
|
|
public IMAGE_DATA_DIRECTORY CertificateTable;
|
|
public IMAGE_DATA_DIRECTORY BaseRelocationTable;
|
|
public IMAGE_DATA_DIRECTORY Debug;
|
|
public IMAGE_DATA_DIRECTORY Architecture;
|
|
public IMAGE_DATA_DIRECTORY GlobalPtr;
|
|
public IMAGE_DATA_DIRECTORY TLSTable;
|
|
public IMAGE_DATA_DIRECTORY LoadConfigTable;
|
|
public IMAGE_DATA_DIRECTORY BoundImport;
|
|
public IMAGE_DATA_DIRECTORY IAT;
|
|
public IMAGE_DATA_DIRECTORY DelayImportDescriptor;
|
|
public IMAGE_DATA_DIRECTORY CLRRuntimeHeader;
|
|
public IMAGE_DATA_DIRECTORY Reserved;
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
|
public struct IMAGE_OPTIONAL_HEADER64
|
|
{
|
|
public ushort Magic;
|
|
public byte MajorLinkerVersion;
|
|
public byte MinorLinkerVersion;
|
|
public uint SizeOfCode;
|
|
public uint SizeOfInitializedData;
|
|
public uint SizeOfUninitializedData;
|
|
public uint AddressOfEntryPoint;
|
|
public uint BaseOfCode;
|
|
public ulong ImageBase;
|
|
public uint SectionAlignment;
|
|
public uint FileAlignment;
|
|
public ushort MajorOperatingSystemVersion;
|
|
public ushort MinorOperatingSystemVersion;
|
|
public ushort MajorImageVersion;
|
|
public ushort MinorImageVersion;
|
|
public ushort MajorSubsystemVersion;
|
|
public ushort MinorSubsystemVersion;
|
|
public uint Win32VersionValue;
|
|
public uint SizeOfImage;
|
|
public uint SizeOfHeaders;
|
|
public uint CheckSum;
|
|
public ushort Subsystem;
|
|
public ushort DllCharacteristics;
|
|
public ulong SizeOfStackReserve;
|
|
public ulong SizeOfStackCommit;
|
|
public ulong SizeOfHeapReserve;
|
|
public ulong SizeOfHeapCommit;
|
|
public uint LoaderFlags;
|
|
public uint NumberOfRvaAndSizes;
|
|
|
|
public IMAGE_DATA_DIRECTORY ExportTable;
|
|
public IMAGE_DATA_DIRECTORY ImportTable;
|
|
public IMAGE_DATA_DIRECTORY ResourceTable;
|
|
public IMAGE_DATA_DIRECTORY ExceptionTable;
|
|
public IMAGE_DATA_DIRECTORY CertificateTable;
|
|
public IMAGE_DATA_DIRECTORY BaseRelocationTable;
|
|
public IMAGE_DATA_DIRECTORY Debug;
|
|
public IMAGE_DATA_DIRECTORY Architecture;
|
|
public IMAGE_DATA_DIRECTORY GlobalPtr;
|
|
public IMAGE_DATA_DIRECTORY TLSTable;
|
|
public IMAGE_DATA_DIRECTORY LoadConfigTable;
|
|
public IMAGE_DATA_DIRECTORY BoundImport;
|
|
public IMAGE_DATA_DIRECTORY IAT;
|
|
public IMAGE_DATA_DIRECTORY DelayImportDescriptor;
|
|
public IMAGE_DATA_DIRECTORY CLRRuntimeHeader;
|
|
public IMAGE_DATA_DIRECTORY Reserved;
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
|
public struct IMAGE_FILE_HEADER
|
|
{
|
|
public ushort Machine;
|
|
public ushort NumberOfSections;
|
|
public uint TimeDateStamp;
|
|
public uint PointerToSymbolTable;
|
|
public uint NumberOfSymbols;
|
|
public ushort SizeOfOptionalHeader;
|
|
public ushort Characteristics;
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Explicit)]
|
|
public struct IMAGE_SECTION_HEADER
|
|
{
|
|
[FieldOffset(0)]
|
|
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)]
|
|
public char[] Name;
|
|
[FieldOffset(8)]
|
|
public uint VirtualSize;
|
|
[FieldOffset(12)]
|
|
public uint VirtualAddress;
|
|
[FieldOffset(16)]
|
|
public uint SizeOfRawData;
|
|
[FieldOffset(20)]
|
|
public uint PointerToRawData;
|
|
[FieldOffset(24)]
|
|
public uint PointerToRelocations;
|
|
[FieldOffset(28)]
|
|
public uint PointerToLinenumbers;
|
|
[FieldOffset(32)]
|
|
public ushort NumberOfRelocations;
|
|
[FieldOffset(34)]
|
|
public ushort NumberOfLinenumbers;
|
|
[FieldOffset(36)]
|
|
public DataSectionFlags Characteristics;
|
|
|
|
public string Section
|
|
{
|
|
get
|
|
{
|
|
int i = Name.Length - 1;
|
|
while (Name[i] == 0)
|
|
{
|
|
--i;
|
|
}
|
|
char[] NameCleaned = new char[i + 1];
|
|
Array.Copy(Name, NameCleaned, i + 1);
|
|
return new string(NameCleaned);
|
|
}
|
|
}
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Sequential)]
|
|
public struct IMAGE_BASE_RELOCATION
|
|
{
|
|
public uint VirtualAdress;
|
|
public uint SizeOfBlock;
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Sequential)]
|
|
public struct PE_META_DATA
|
|
{
|
|
public uint Pe;
|
|
public bool Is32Bit;
|
|
public IMAGE_FILE_HEADER ImageFileHeader;
|
|
public IMAGE_OPTIONAL_HEADER32 OptHeader32;
|
|
public IMAGE_OPTIONAL_HEADER64 OptHeader64;
|
|
public IMAGE_SECTION_HEADER[] Sections;
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Sequential)]
|
|
public struct PE_MANUAL_MAP
|
|
{
|
|
public string DecoyModule;
|
|
public IntPtr ModuleBase;
|
|
public PE_META_DATA PEINFO;
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Explicit)]
|
|
public struct IMAGE_THUNK_DATA32
|
|
{
|
|
[FieldOffset(0)]
|
|
public uint ForwarderString;
|
|
[FieldOffset(0)]
|
|
public uint Function;
|
|
[FieldOffset(0)]
|
|
public uint Ordinal;
|
|
[FieldOffset(0)]
|
|
public uint AddressOfData;
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Explicit)]
|
|
public struct IMAGE_THUNK_DATA64
|
|
{
|
|
[FieldOffset(0)]
|
|
public ulong ForwarderString;
|
|
[FieldOffset(0)]
|
|
public ulong Function;
|
|
[FieldOffset(0)]
|
|
public ulong Ordinal;
|
|
[FieldOffset(0)]
|
|
public ulong AddressOfData;
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Explicit)]
|
|
public struct ApiSetNamespace
|
|
{
|
|
[FieldOffset(0x0C)]
|
|
public int Count;
|
|
|
|
[FieldOffset(0x10)]
|
|
public int EntryOffset;
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Explicit)]
|
|
public struct ApiSetNamespaceEntry
|
|
{
|
|
[FieldOffset(0x04)]
|
|
public int NameOffset;
|
|
|
|
[FieldOffset(0x08)]
|
|
public int NameLength;
|
|
|
|
[FieldOffset(0x10)]
|
|
public int ValueOffset;
|
|
|
|
[FieldOffset(0x14)]
|
|
public int ValueLength;
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Explicit)]
|
|
public struct ApiSetValueEntry
|
|
{
|
|
[FieldOffset(0x00)]
|
|
public int Flags;
|
|
|
|
[FieldOffset(0x04)]
|
|
public int NameOffset;
|
|
|
|
[FieldOffset(0x08)]
|
|
public int NameCount;
|
|
|
|
[FieldOffset(0x0C)]
|
|
public int ValueOffset;
|
|
|
|
[FieldOffset(0x10)]
|
|
public int ValueCount;
|
|
}
|
|
|
|
[StructLayout(LayoutKind.Sequential)]
|
|
public struct LDR_DATA_TABLE_ENTRY
|
|
{
|
|
public Structs.LIST_ENTRY InLoadOrderLinks;
|
|
public Structs.LIST_ENTRY InMemoryOrderLinks;
|
|
public Structs.LIST_ENTRY InInitializationOrderLinks;
|
|
public IntPtr DllBase;
|
|
public IntPtr EntryPoint;
|
|
public uint SizeOfImage;
|
|
public Structs.UNICODE_STRING FullDllName;
|
|
public Structs.UNICODE_STRING BaseDllName;
|
|
}
|
|
}
|
|
}
|