From 2eac8058a820720aeba9fb9a4eac2abcc3c0b7c5 Mon Sep 17 00:00:00 2001 From: physics-sp Date: Wed, 21 Jul 2021 18:57:29 -0300 Subject: [PATCH] add support for 32 bit builds --- DarkLoadLibrary/src/ldrutils.c | 140 ++++++++++++++++++++------------- 1 file changed, 86 insertions(+), 54 deletions(-) diff --git a/DarkLoadLibrary/src/ldrutils.c b/DarkLoadLibrary/src/ldrutils.c index 1f1ea2c..cd828b3 100644 --- a/DarkLoadLibrary/src/ldrutils.c +++ b/DarkLoadLibrary/src/ldrutils.c @@ -7,8 +7,8 @@ BOOL IsValidPE( PIMAGE_NT_HEADERS pNtHeaders; pNtHeaders = RVA( - PIMAGE_NT_HEADERS, - pbData, + PIMAGE_NT_HEADERS, + pbData, ((PIMAGE_DOS_HEADER)pbData)->e_lfanew ); @@ -30,12 +30,13 @@ BOOL MapSections( PIMAGE_SECTION_HEADER pSectionHeader; pNtHeaders = RVA( - PIMAGE_NT_HEADERS, - pdModule->pbDllData, + PIMAGE_NT_HEADERS, + pdModule->pbDllData, ((PIMAGE_DOS_HEADER)pdModule->pbDllData)->e_lfanew ); // try get prefered address +#if _M_X64 pdModule->ModuleBase = pNtHeaders->OptionalHeader.ImageBase; SIZE_T RegionSize = pNtHeaders->OptionalHeader.SizeOfImage; NTSTATUS status = NtAllocateVirtualMemory( @@ -45,7 +46,7 @@ BOOL MapSections( &RegionSize, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE - ); + ); if (!NT_SUCCESS(status) || pdModule->ModuleBase != pNtHeaders->OptionalHeader.ImageBase) { pdModule->ModuleBase = NULL; @@ -63,7 +64,29 @@ BOOL MapSections( { return FALSE; } +#else + pdModule->ModuleBase = (ULONG_PTR)VirtualAlloc( + (LPVOID)(pNtHeaders->OptionalHeader.ImageBase), + (SIZE_T)pNtHeaders->OptionalHeader.SizeOfImage, + MEM_RESERVE | MEM_COMMIT, + PAGE_READWRITE + ); + if (!pdModule->ModuleBase) + { + pdModule->ModuleBase = (ULONG_PTR)VirtualAlloc( + 0, + (SIZE_T)pNtHeaders->OptionalHeader.SizeOfImage, + MEM_RESERVE | MEM_COMMIT, + PAGE_READWRITE + ); + } + + if (!pdModule->ModuleBase) + { + return FALSE; + } +#endif // copy across the headers for (INT i = 0; i < pNtHeaders->OptionalHeader.SizeOfHeaders; i++) { @@ -88,8 +111,8 @@ BOOL MapSections( if ((pdModule->ModuleBase - pNtHeaders->OptionalHeader.ImageBase) && pDataDir) { pRelocation = RVA( - PIMAGE_BASE_RELOCATION, - pdModule->ModuleBase, + PIMAGE_BASE_RELOCATION, + pdModule->ModuleBase, pDataDir->VirtualAddress ); @@ -143,8 +166,8 @@ BOOL ResolveImports( LDRGETPROCADDRESS pLdrGetProcAddress = NULL; pNtHeaders = RVA( - PIMAGE_NT_HEADERS, - pdModule->pbDllData, + PIMAGE_NT_HEADERS, + pdModule->pbDllData, ((PIMAGE_DOS_HEADER)pdModule->pbDllData)->e_lfanew ); @@ -164,8 +187,8 @@ BOOL ResolveImports( if (pDataDir->Size) { pImportDesc = RVA( - PIMAGE_IMPORT_DESCRIPTOR, - pdModule->ModuleBase, + PIMAGE_IMPORT_DESCRIPTOR, + pdModule->ModuleBase, pDataDir->VirtualAddress ); @@ -178,7 +201,7 @@ BOOL ResolveImports( pImportDesc = RVA( PIMAGE_IMPORT_DESCRIPTOR, - pdModule->ModuleBase, + pdModule->ModuleBase, pDataDir->VirtualAddress ); @@ -191,14 +214,14 @@ BOOL ResolveImports( ); pFirstThunk = RVA( - PIMAGE_THUNK_DATA, - pdModule->ModuleBase, + PIMAGE_THUNK_DATA, + pdModule->ModuleBase, pImportDesc->FirstThunk ); - + pOrigFirstThunk = RVA( - PIMAGE_THUNK_DATA, - pdModule->ModuleBase, + PIMAGE_THUNK_DATA, + pdModule->ModuleBase, pImportDesc->OriginalFirstThunk ); @@ -207,30 +230,30 @@ BOOL ResolveImports( if (IMAGE_SNAP_BY_ORDINAL(pOrigFirstThunk->u1.Ordinal)) { pLdrGetProcAddress( - hLibrary, - NULL, - (WORD)pOrigFirstThunk->u1.Ordinal, - (PVOID *)&(pFirstThunk->u1.Function) + hLibrary, + NULL, + (WORD)pOrigFirstThunk->u1.Ordinal, + (PVOID*)&(pFirstThunk->u1.Function) ); } else { pImportByName = RVA( - PIMAGE_IMPORT_BY_NAME, - pdModule->ModuleBase, + PIMAGE_IMPORT_BY_NAME, + pdModule->ModuleBase, pOrigFirstThunk->u1.AddressOfData ); - + FILL_STRING( - aString, + aString, pImportByName->Name ); pLdrGetProcAddress( - hLibrary, - &aString, - 0, - (PVOID *)&(pFirstThunk->u1.Function) + hLibrary, + &aString, + 0, + (PVOID*)&(pFirstThunk->u1.Function) ); } } @@ -243,8 +266,8 @@ BOOL ResolveImports( if (pDataDir->Size) { pDelayDesc = RVA( - PIMAGE_DELAYLOAD_DESCRIPTOR, - pdModule->ModuleBase, + PIMAGE_DELAYLOAD_DESCRIPTOR, + pdModule->ModuleBase, pDataDir->VirtualAddress ); @@ -255,14 +278,14 @@ BOOL ResolveImports( HMODULE hLibrary = LoadLibraryA((LPSTR)(pdModule->ModuleBase + pDelayDesc->DllNameRVA)); pFirstThunk = RVA( - PIMAGE_THUNK_DATA, - pdModule->ModuleBase, + PIMAGE_THUNK_DATA, + pdModule->ModuleBase, pDelayDesc->ImportAddressTableRVA ); - + pOrigFirstThunk = RVA( - PIMAGE_THUNK_DATA, - pdModule->ModuleBase, + PIMAGE_THUNK_DATA, + pdModule->ModuleBase, pDelayDesc->ImportNameTableRVA ); @@ -271,30 +294,30 @@ BOOL ResolveImports( if (IMAGE_SNAP_BY_ORDINAL(pOrigFirstThunk->u1.Ordinal)) { pLdrGetProcAddress( - hLibrary, - NULL, - (WORD)pOrigFirstThunk->u1.Ordinal, - (PVOID *)&(pFirstThunk->u1.Function) + hLibrary, + NULL, + (WORD)pOrigFirstThunk->u1.Ordinal, + (PVOID*)&(pFirstThunk->u1.Function) ); } else { pImportByName = RVA( - PIMAGE_IMPORT_BY_NAME, - pdModule->ModuleBase, + PIMAGE_IMPORT_BY_NAME, + pdModule->ModuleBase, pOrigFirstThunk->u1.AddressOfData ); - + FILL_STRING( - aString, + aString, pImportByName->Name ); pLdrGetProcAddress( - hLibrary, - &aString, - 0, - (PVOID *)&(pFirstThunk->u1.Function) + hLibrary, + &aString, + 0, + (PVOID*)&(pFirstThunk->u1.Function) ); } } @@ -319,8 +342,8 @@ BOOL BeginExecution( DLLMAIN DllMain = NULL; pNtHeaders = RVA( - PIMAGE_NT_HEADERS, - pdModule->pbDllData, + PIMAGE_NT_HEADERS, + pdModule->pbDllData, ((PIMAGE_DOS_HEADER)pdModule->pbDllData)->e_lfanew ); @@ -348,6 +371,7 @@ BOOL BeginExecution( { dwProtect |= PAGE_NOCACHE; } +#if _M_X64 PVOID BaseAddress = pdModule->ModuleBase + pSectionHeader->VirtualAddress; SIZE_T RegionSize = pSectionHeader->SizeOfRawData; NTSTATUS status = NtProtectVirtualMemory( @@ -356,11 +380,19 @@ BOOL BeginExecution( &RegionSize, dwProtect, &dwProtect - ); + ); if (!NT_SUCCESS(status)) { return FALSE; } +#else + VirtualProtect( + (LPVOID)(pdModule->ModuleBase + pSectionHeader->VirtualAddress), + pSectionHeader->SizeOfRawData, + dwProtect, + &dwProtect + ); +#endif } } @@ -373,12 +405,12 @@ BOOL BeginExecution( if (pDataDir->Size) { pTlsDir = RVA( - PIMAGE_TLS_DIRECTORY, - pdModule->ModuleBase, + PIMAGE_TLS_DIRECTORY, + pdModule->ModuleBase, pDataDir->VirtualAddress ); - ppCallback = (PIMAGE_TLS_CALLBACK *)(pTlsDir->AddressOfCallBacks); + ppCallback = (PIMAGE_TLS_CALLBACK*)(pTlsDir->AddressOfCallBacks); for (; *ppCallback; ppCallback++) {