admin/bats3c-DarkLoadLibrary
1
0
Fork 0
mirror of https://github.com/bats3c/DarkLoadLibrary synced 2026-06-06 15:14:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

add a few more changes and improvements

Browse Source
This commit is contained in:
physics-sp
2021-08-01 18:40:21 -03:00
parent 5480a9e4b0
commit 2820acf36b
8 changed files with 354 additions and 289 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DarkLoadLibrary/include/darkloadlibrary.h
+2 -2
View File
@@ -13,11 +13,11 @@ typedef struct _DARKMODULE {
PBYTE pbDllData;
DWORD dwDllDataLen;
LPWSTR LocalDLLName;
PWCHAR CrackedDLLName;
PWCHAR CrackedDLLName;
ULONG_PTR ModuleBase;
} DARKMODULE, *PDARKMODULE;
DARKMODULE DarkLoadLibrary(
PDARKMODULE DarkLoadLibrary(
DWORD dwFlags,
LPCWSTR lpwBuffer,
LPVOID lpFileBuffer,
DarkLoadLibrary/include/ldrutils.h
+1 -1
View File
@@ -6,7 +6,7 @@
#define RVA(type, base_addr, rva) (type)((ULONG_PTR) base_addr + rva)
typedef BOOL(WINAPI * DLLMAIN)(HINSTANCE, DWORD, LPVOID);
typedef NTSTATUS(WINAPI *LDRGETPROCADDRESS)(HMODULE, PANSI_STRING, WORD, PVOID*);
typedef HMODULE(WINAPI* LOADLIBRARYA)(LPCSTR);
BOOL IsValidPE(PBYTE pbData);
BOOL MapSections(PDARKMODULE pdModule);
DarkLoadLibrary/include/pebutils.h
+9 -2
View File
@@ -8,12 +8,15 @@
string.MaximumLength = string.Length; \
string.Buffer = buffer
typedef NTSTATUS(WINAPI* LDRGETPROCADDRESS)(HMODULE, PANSI_STRING, WORD, PVOID*);
typedef VOID(WINAPI* RTLRBINSERTNODEEX)(_In_ PRTL_RB_TREE Tree, _In_opt_ PRTL_BALANCED_NODE Parent, _In_ BOOLEAN Right, _Out_ PRTL_BALANCED_NODE Node);
#ifdef _WIN64
#define PEB_OFFSET 0x60
#define READ_MEMLOC __readgsqword
#else
#define PEB_OFFSET 0x30
#define READ_MEMLOC __readfsdword
#define READ_MEMLOC __readfsdword
#endif
#pragma once
@@ -27,8 +30,12 @@
#define LDR_HASH_TABLE_ENTRIES 32
NTSYSAPI NTSTATUS NTAPI RtlHashUnicodeString(__in PCUNICODE_STRING String, __in BOOLEAN CaseInSensitive, __in ULONG HashAlgorithm, __out PULONG HashValue);
NTSYSAPI VOID NTAPI RtlRbInsertNodeEx(_In_ PRTL_RB_TREE Tree, _In_opt_ PRTL_BALANCED_NODE Parent, _In_ BOOLEAN Right, _Out_ PRTL_BALANCED_NODE Node);
HMODULE IsModulePresent(LPCWSTR lpwName);
HMODULE IsModulePresentA(char* Name);
BOOL LinkModuleToPEB(PDARKMODULE pdModule);
FARPROC GetFunctionAddress(HMODULE hModule, char* ProcName);
BOOL LocalLdrGetProcedureAddress(HMODULE hLibrary, PANSI_STRING ProcName, WORD Ordinal, PVOID* FunctionAddress);
BOOL LocalLdrGetProcedureAddress(HMODULE hLibrary, PANSI_STRING ProcName, WORD Ordinal, PVOID* FunctionAddress);
BOOL _LocalLdrGetProcedureAddress(HMODULE hLibrary, PANSI_STRING ProcName, WORD Ordinal, PVOID* FunctionAddress);