admin/bats3c-DarkLoadLibrary
1
0
Fork 0
mirror of https://github.com/bats3c/DarkLoadLibrary synced 2026-06-06 15:14:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

add support for 32 bit builds

Browse Source
This commit is contained in:
physics-sp
2021-07-21 18:57:29 -03:00
parent a29eb09550
commit 2eac8058a8
1 changed files with 86 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DarkLoadLibrary/src/ldrutils.c
+86 -54
View File
@@ -7,8 +7,8 @@ BOOL IsValidPE(
PIMAGE_NT_HEADERS pNtHeaders;
pNtHeaders = RVA(
PIMAGE_NT_HEADERS,
pbData,
PIMAGE_NT_HEADERS,
pbData,
((PIMAGE_DOS_HEADER)pbData)->e_lfanew
);
@@ -30,12 +30,13 @@ BOOL MapSections(
PIMAGE_SECTION_HEADER pSectionHeader;
pNtHeaders = RVA(
PIMAGE_NT_HEADERS,
pdModule->pbDllData,
PIMAGE_NT_HEADERS,
pdModule->pbDllData,
((PIMAGE_DOS_HEADER)pdModule->pbDllData)->e_lfanew
);
// try get prefered address
#if _M_X64
pdModule->ModuleBase = pNtHeaders->OptionalHeader.ImageBase;
SIZE_T RegionSize = pNtHeaders->OptionalHeader.SizeOfImage;
NTSTATUS status = NtAllocateVirtualMemory(
@@ -45,7 +46,7 @@ BOOL MapSections(
&RegionSize,
MEM_RESERVE | MEM_COMMIT,
PAGE_READWRITE
);
);
if (!NT_SUCCESS(status) || pdModule->ModuleBase != pNtHeaders->OptionalHeader.ImageBase)
{
pdModule->ModuleBase = NULL;
@@ -63,7 +64,29 @@ BOOL MapSections(
{
return FALSE;
}
#else
pdModule->ModuleBase = (ULONG_PTR)VirtualAlloc(
(LPVOID)(pNtHeaders->OptionalHeader.ImageBase),
(SIZE_T)pNtHeaders->OptionalHeader.SizeOfImage,
MEM_RESERVE | MEM_COMMIT,
PAGE_READWRITE
);
if (!pdModule->ModuleBase)
{
pdModule->ModuleBase = (ULONG_PTR)VirtualAlloc(
0,
(SIZE_T)pNtHeaders->OptionalHeader.SizeOfImage,
MEM_RESERVE | MEM_COMMIT,
PAGE_READWRITE
);
}
if (!pdModule->ModuleBase)
{
return FALSE;
}
#endif
// copy across the headers
for (INT i = 0; i < pNtHeaders->OptionalHeader.SizeOfHeaders; i++)
{
@@ -88,8 +111,8 @@ BOOL MapSections(
if ((pdModule->ModuleBase - pNtHeaders->OptionalHeader.ImageBase) && pDataDir)
{
pRelocation = RVA(
PIMAGE_BASE_RELOCATION,
pdModule->ModuleBase,
PIMAGE_BASE_RELOCATION,
pdModule->ModuleBase,
pDataDir->VirtualAddress
);
@@ -143,8 +166,8 @@ BOOL ResolveImports(
LDRGETPROCADDRESS pLdrGetProcAddress = NULL;
pNtHeaders = RVA(
PIMAGE_NT_HEADERS,
pdModule->pbDllData,
PIMAGE_NT_HEADERS,
pdModule->pbDllData,
((PIMAGE_DOS_HEADER)pdModule->pbDllData)->e_lfanew
);
@@ -164,8 +187,8 @@ BOOL ResolveImports(
if (pDataDir->Size)
{
pImportDesc = RVA(
PIMAGE_IMPORT_DESCRIPTOR,
pdModule->ModuleBase,
PIMAGE_IMPORT_DESCRIPTOR,
pdModule->ModuleBase,
pDataDir->VirtualAddress
);
@@ -178,7 +201,7 @@ BOOL ResolveImports(
pImportDesc = RVA(
PIMAGE_IMPORT_DESCRIPTOR,
pdModule->ModuleBase,
pdModule->ModuleBase,
pDataDir->VirtualAddress
);
@@ -191,14 +214,14 @@ BOOL ResolveImports(
);
pFirstThunk = RVA(
PIMAGE_THUNK_DATA,
pdModule->ModuleBase,
PIMAGE_THUNK_DATA,
pdModule->ModuleBase,
pImportDesc->FirstThunk
);
pOrigFirstThunk = RVA(
PIMAGE_THUNK_DATA,
pdModule->ModuleBase,
PIMAGE_THUNK_DATA,
pdModule->ModuleBase,
pImportDesc->OriginalFirstThunk
);
@@ -207,30 +230,30 @@ BOOL ResolveImports(
if (IMAGE_SNAP_BY_ORDINAL(pOrigFirstThunk->u1.Ordinal))
{
pLdrGetProcAddress(
hLibrary,
NULL,
(WORD)pOrigFirstThunk->u1.Ordinal,
(PVOID *)&(pFirstThunk->u1.Function)
hLibrary,
NULL,
(WORD)pOrigFirstThunk->u1.Ordinal,
(PVOID*)&(pFirstThunk->u1.Function)
);
}
else
{
pImportByName = RVA(
PIMAGE_IMPORT_BY_NAME,
pdModule->ModuleBase,
PIMAGE_IMPORT_BY_NAME,
pdModule->ModuleBase,
pOrigFirstThunk->u1.AddressOfData
);
FILL_STRING(
aString,
aString,
pImportByName->Name
);
pLdrGetProcAddress(
hLibrary,
&aString,
0,
(PVOID *)&(pFirstThunk->u1.Function)
hLibrary,
&aString,
0,
(PVOID*)&(pFirstThunk->u1.Function)
);
}
}
@@ -243,8 +266,8 @@ BOOL ResolveImports(
if (pDataDir->Size)
{
pDelayDesc = RVA(
PIMAGE_DELAYLOAD_DESCRIPTOR,
pdModule->ModuleBase,
PIMAGE_DELAYLOAD_DESCRIPTOR,
pdModule->ModuleBase,
pDataDir->VirtualAddress
);
@@ -255,14 +278,14 @@ BOOL ResolveImports(
HMODULE hLibrary = LoadLibraryA((LPSTR)(pdModule->ModuleBase + pDelayDesc->DllNameRVA));
pFirstThunk = RVA(
PIMAGE_THUNK_DATA,
pdModule->ModuleBase,
PIMAGE_THUNK_DATA,
pdModule->ModuleBase,
pDelayDesc->ImportAddressTableRVA
);
pOrigFirstThunk = RVA(
PIMAGE_THUNK_DATA,
pdModule->ModuleBase,
PIMAGE_THUNK_DATA,
pdModule->ModuleBase,
pDelayDesc->ImportNameTableRVA
);
@@ -271,30 +294,30 @@ BOOL ResolveImports(
if (IMAGE_SNAP_BY_ORDINAL(pOrigFirstThunk->u1.Ordinal))
{
pLdrGetProcAddress(
hLibrary,
NULL,
(WORD)pOrigFirstThunk->u1.Ordinal,
(PVOID *)&(pFirstThunk->u1.Function)
hLibrary,
NULL,
(WORD)pOrigFirstThunk->u1.Ordinal,
(PVOID*)&(pFirstThunk->u1.Function)
);
}
else
{
pImportByName = RVA(
PIMAGE_IMPORT_BY_NAME,
pdModule->ModuleBase,
PIMAGE_IMPORT_BY_NAME,
pdModule->ModuleBase,
pOrigFirstThunk->u1.AddressOfData
);
FILL_STRING(
aString,
aString,
pImportByName->Name
);
pLdrGetProcAddress(
hLibrary,
&aString,
0,
(PVOID *)&(pFirstThunk->u1.Function)
hLibrary,
&aString,
0,
(PVOID*)&(pFirstThunk->u1.Function)
);
}
}
@@ -319,8 +342,8 @@ BOOL BeginExecution(
DLLMAIN DllMain = NULL;
pNtHeaders = RVA(
PIMAGE_NT_HEADERS,
pdModule->pbDllData,
PIMAGE_NT_HEADERS,
pdModule->pbDllData,
((PIMAGE_DOS_HEADER)pdModule->pbDllData)->e_lfanew
);
@@ -348,6 +371,7 @@ BOOL BeginExecution(
{
dwProtect |= PAGE_NOCACHE;
}
#if _M_X64
PVOID BaseAddress = pdModule->ModuleBase + pSectionHeader->VirtualAddress;
SIZE_T RegionSize = pSectionHeader->SizeOfRawData;
NTSTATUS status = NtProtectVirtualMemory(
@@ -356,11 +380,19 @@ BOOL BeginExecution(
&RegionSize,
dwProtect,
&dwProtect
);
);
if (!NT_SUCCESS(status))
{
return FALSE;
}
#else
VirtualProtect(
(LPVOID)(pdModule->ModuleBase + pSectionHeader->VirtualAddress),
pSectionHeader->SizeOfRawData,
dwProtect,
&dwProtect
);
#endif
}
}
@@ -373,12 +405,12 @@ BOOL BeginExecution(
if (pDataDir->Size)
{
pTlsDir = RVA(
PIMAGE_TLS_DIRECTORY,
pdModule->ModuleBase,
PIMAGE_TLS_DIRECTORY,
pdModule->ModuleBase,
pDataDir->VirtualAddress
);
ppCallback = (PIMAGE_TLS_CALLBACK *)(pTlsDir->AddressOfCallBacks);
ppCallback = (PIMAGE_TLS_CALLBACK*)(pTlsDir->AddressOfCallBacks);
for (; *ppCallback; ppCallback++)
{