upload

.vscode/settings.json

@@ -1,5 +1,7 @@
 {
     "files.associations": {
-        "darkloadlibrary.h": "c"
+        "darkloadlibrary.h": "c",
+        "ldrutils.h": "c",
+        "pebutils.h": "c"
     }
 }

DarkLoadLibrary/DarkLoadLibrary.vcxproj

@@ -134,7 +134,7 @@
       <PreprocessorDefinitions>_CRT_SECURE_NO_WARNINGS;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <ConformanceMode>true</ConformanceMode>
       <RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
-      <AdditionalOptions>/NODEFAULTLIB %(AdditionalOptions)</AdditionalOptions>
+      <AdditionalIncludeDirectories>P:\DarkLoadLibrary\DarkLoadLibrary\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
@@ -146,15 +146,16 @@
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>
-    <ClCompile Include="darkloadlibrary.c" />
-    <ClCompile Include="ldrutils.c" />
-    <ClCompile Include="pebutils.c" />
+    <ClCompile Include="src\darkloadlibrary.c" />
+    <ClCompile Include="src\ldrutils.c" />
+    <ClCompile Include="src\main.c" />
+    <ClCompile Include="src\pebutils.c" />
   </ItemGroup>
   <ItemGroup>
-    <ClInclude Include="darkloadlibrary.h" />
-    <ClInclude Include="ldrutils.h" />
-    <ClInclude Include="payload.h" />
-    <ClInclude Include="pebutils.h" />
+    <ClInclude Include="include\darkloadlibrary.h" />
+    <ClInclude Include="include\ldrutils.h" />
+    <ClInclude Include="include\pebstructs.h" />
+    <ClInclude Include="include\pebutils.h" />
   </ItemGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">

DarkLoadLibrary/DarkLoadLibrary.vcxproj.filters

@@ -15,27 +15,30 @@
     </Filter>
   </ItemGroup>
   <ItemGroup>
-    <ClCompile Include="darkloadlibrary.c">
+    <ClCompile Include="src\darkloadlibrary.c">
       <Filter>Source Files</Filter>
     </ClCompile>
-    <ClCompile Include="pebutils.c">
+    <ClCompile Include="src\ldrutils.c">
       <Filter>Source Files</Filter>
     </ClCompile>
-    <ClCompile Include="ldrutils.c">
+    <ClCompile Include="src\pebutils.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="src\main.c">
       <Filter>Source Files</Filter>
     </ClCompile>
   </ItemGroup>
   <ItemGroup>
-    <ClInclude Include="darkloadlibrary.h">
+    <ClInclude Include="include\darkloadlibrary.h">
       <Filter>Header Files</Filter>
     </ClInclude>
-    <ClInclude Include="pebutils.h">
+    <ClInclude Include="include\ldrutils.h">
       <Filter>Header Files</Filter>
     </ClInclude>
-    <ClInclude Include="ldrutils.h">
+    <ClInclude Include="include\pebstructs.h">
       <Filter>Header Files</Filter>
     </ClInclude>
-    <ClInclude Include="payload.h">
+    <ClInclude Include="include\pebutils.h">
       <Filter>Header Files</Filter>
     </ClInclude>
   </ItemGroup>

DarkLoadLibrary/include/darkloadlibrary.h

@@ -4,6 +4,7 @@
 #define LOAD_LOCAL_FILE  0x00000001
 #define LOAD_REMOTE_FILE 0x00000002
 #define LOAD_MEMORY		 0x00000003
+#define NO_LINK			 0x00000004
 
 #pragma once
 typedef struct _DARKMODULE {

DarkLoadLibrary/src/darkloadlibrary.c

@@ -242,42 +242,9 @@ BOOL ConcealLibrary(
 	BOOL bConceal
 )
 {
-	// TODO: implement this function
+	// TODO: reimplement this function, so it is better
 
 	pdModule->ErrorMsg = L"Not implemented yet, sorry";
 
 	return FALSE;
-}
-
-typedef DWORD (WINAPI * _ThisIsAFunction) (LPCWSTR);
-
-VOID main()
-{
-	DARKMODULE dModule = DarkLoadLibrary(
-		LOAD_LOCAL_FILE,
-		L"P:\\HideUrCLR\\TestDLL\\x64\\Release\\TestDLL.dll",
-		0,
-		NULL
-	);
-
-	if (!dModule.bSuccess)
-	{
-		printf("load failed: %S\n", dModule.ErrorMsg);
-		return;
-	}
-
-	_ThisIsAFunction ThisIsAFunction = GetProcAddress(
-		dModule.ModuleBase,
-		"CallThisFunction"
-	);
-
-	if (!ThisIsAFunction)
-	{
-		printf("failed to find it\n");
-		return;
-	}
-
-    ThisIsAFunction(L"this is working!!!");
-
-	return;
 }

DarkLoadLibrary/src/main.c

@@ -7,23 +7,21 @@ typedef DWORD (WINAPI * _ThisIsAFunction) (LPCWSTR);
 
 VOID main()
 {
-	DARKMODULE dModule = DarkLoadLibrary(
+	DARKMODULE DarkModule = DarkLoadLibrary(
 		LOAD_LOCAL_FILE,
-		L"P:\\HideUrCLR\\TestDLL\\x64\\Release\\TestDLL.dll",
+		L"TestDLL.dll",
 		0,
 		NULL
 	);
 
-	if (!dModule.bSuccess)
+	if (!DarkModule.bSuccess)
 	{
-		printf("load failed: %S\n", dModule.ErrorMsg);
+		printf("load failed: %S\n", DarkModule.ErrorMsg);
 		return;
 	}
 
-	printf("Loaded: %S (%d bytes)\n", dModule.CrackedDLLName, dModule.dwDllDataLen);
-
 	_ThisIsAFunction ThisIsAFunction = GetProcAddress(
-		dModule.ModuleBase,
+		DarkModule.ModuleBase,
 		"CallThisFunction"
 	);
 

Debug/DarkLoadLibrary.exe.recipe

@@ -1,11 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project>
-  <ProjectOutputs>
-    <ProjectOutput>
-      <FullPath>P:\DarkLoadLibrary\Debug\DarkLoadLibrary.exe</FullPath>
-    </ProjectOutput>
-  </ProjectOutputs>
-  <ContentFiles />
-  <SatelliteDlls />
-  <NonRecipeFileRefs />
-</Project>

Debug/DarkLoadLibrary.log

@@ -1,8 +0,0 @@
-  darkloadlibrary.c
-P:\DarkLoadLibrary\darkloadlibrary.c(49,2): error C4996: '_wsplitpath': This function or variable may be unsafe. Consider using _wsplitpath_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
-P:\DarkLoadLibrary\darkloadlibrary.c(63,16): error C4996: 'wcscpy': This function or variable may be unsafe. Consider using wcscpy_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
-P:\DarkLoadLibrary\darkloadlibrary.c(63,1): warning C4133: 'initializing': incompatible types - from 'wchar_t *' to 'PCHAR'
-P:\DarkLoadLibrary\darkloadlibrary.c(68,16): error C4996: 'wcscat': This function or variable may be unsafe. Consider using wcscat_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
-P:\DarkLoadLibrary\darkloadlibrary.c(68,1): warning C4133: 'initializing': incompatible types - from 'wchar_t *' to 'PCHAR'
-P:\DarkLoadLibrary\darkloadlibrary.c(96,41): warning C4090: 'function': different 'const' qualifiers
-P:\DarkLoadLibrary\darkloadlibrary.c(127,1): warning C4113: 'FARPROC' differs in parameter lists from '_ThisIsAFunction'

Debug/DarkLoadLibrary.tlog/CL.command.1.tlog

@@ -1 +0,0 @@
-

Debug/DarkLoadLibrary.tlog/DarkLoadLibrary.lastbuildstate

@@ -1,2 +0,0 @@
-PlatformToolSet=v142:VCToolArchitecture=Native32Bit:VCToolsVersion=14.28.29333:TargetPlatformVersion=10.0.18362.0:
-Debug|Win32|P:\DarkLoadLibrary\|

Debug/DarkLoadLibrary.tlog/link.1936-cvtres.read.1.tlog

@@ -1 +0,0 @@
-

Debug/DarkLoadLibrary.tlog/link.1936-cvtres.write.1.tlog

@@ -1 +0,0 @@
-

Debug/DarkLoadLibrary.tlog/link.1936-rc.read.1.tlog

@@ -1 +0,0 @@
-

Debug/DarkLoadLibrary.tlog/link.1936-rc.write.1.tlog

@@ -1 +0,0 @@
-

Debug/DarkLoadLibrary.tlog/link.1936.read.1.tlog

@@ -1 +0,0 @@
-

Debug/DarkLoadLibrary.tlog/link.1936.write.1.tlog

@@ -1 +0,0 @@
-

Debug/DarkLoadLibrary.tlog/link.command.1.tlog

@@ -1 +0,0 @@
-

Debug/DarkLoadLibrary.tlog/link.read.1.tlog

@@ -1 +0,0 @@
-

Debug/DarkLoadLibrary.tlog/link.write.1.tlog

@@ -1 +0,0 @@
-

Debug/DarkLoadLibrary.vcxproj.FileListAbsolute.txt

@@ -1,2 +0,0 @@
-P:\DarkLoadLibrary\Debug\DarkLoadLibrary.exe
-P:\DarkLoadLibrary\Debug\DarkLoadLibrary.pdb

README.md

@@ -0,0 +1,41 @@
+# DarkLoadLibrary
+
+`LoadLibrary` for offensive operations.
+
+### How does is work?
+
+*link to blog post*
+
+### Usage
+
+```C
+DARKMODULE DarkModule = DarkLoadLibrary(
+    LOAD_LOCAL_FILE, // control flags
+    L"TestDLL.dll", // local dll path, if loading from disk
+    0, // dll size if loading from memory
+    NULL // dll name if loaded from memory
+);
+```
+
+#### Control Flags:
+-   LOAD_LOCAL_FILE - Load a DLL from the file system.
+-   LOAD_MEMORY - Load a DLL from a buffer.
+-   NO_LINK  - Don't link this module to the PEB, just execute it.
+
+#### DLL Path:
+
+This can be any path that `CreateFileW` will open.
+
+#### DLL Size:
+
+This argument is only needed when `LOAD_MEMORY` is set. In that case this argument should be the size of the buffer containing the DLL.
+
+#### DLL Name:
+
+This argument is only needed when `LOAD_MEMORY` is set. In that case this argument should be the name which the DLL should be set in the PEB under.
+
+### Considerations
+
+The windows loader is very complex and can handle all the edge case's and intricacies of loading DLLs. There are going to be edge case's which I have not had the time to discover, reverse engineer and implement. So there's going to be DLLs that this loader simply will not work with.
+
+That being said I plan on making this loader as complete as possible, so please open issue's for DLLs that are not correctly loaded.

x64/Debug/DarkLoadLibrary.exe.recipe

@@ -1,11 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project>
-  <ProjectOutputs>
-    <ProjectOutput>
-      <FullPath>P:\DarkLoadLibrary\x64\Debug\DarkLoadLibrary.exe</FullPath>
-    </ProjectOutput>
-  </ProjectOutputs>
-  <ContentFiles />
-  <SatelliteDlls />
-  <NonRecipeFileRefs />
-</Project>

x64/Debug/DarkLoadLibrary.log

@@ -1 +0,0 @@
-C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Microsoft\VC\v160\Microsoft.CppBuild.targets(468,5): error MSB8059: -fsanitize=address (Enable Address Sanitizer) is incompatible with option 'edit-and-continue debug information (/ZI)'.

x64/Debug/DarkLoadLibrary.tlog/DarkLoadLibrary.lastbuildstate

@@ -1,2 +0,0 @@
-PlatformToolSet=v142:VCToolArchitecture=Native32Bit:VCToolsVersion=14.28.29333:TargetPlatformVersion=10.0.18362.0:
-Debug|x64|P:\DarkLoadLibrary\|

x64/Debug/DarkLoadLibrary.vcxproj.FileListAbsolute.txt

@@ -1,2 +0,0 @@
-P:\DarkLoadLibrary\x64\Debug\DarkLoadLibrary.exe
-P:\DarkLoadLibrary\x64\Debug\DarkLoadLibrary.pdb

x64/Release/DarkLoadLibrary.Build.CppClean.log

@@ -1,13 +0,0 @@
-p:\darkloadlibrary\x64\release\vc142.pdb
-p:\darkloadlibrary\x64\release\pebutils.obj
-p:\darkloadlibrary\x64\release\ldrutils.obj
-p:\darkloadlibrary\x64\release\darkloadlibrary.obj
-p:\darkloadlibrary\x64\release\darkloadlibrary.ipdb
-p:\darkloadlibrary\x64\release\darkloadlibrary.iobj
-p:\darkloadlibrary\x64\release\darkloadlibrary.pdb
-p:\darkloadlibrary\x64\release\darkloadlibrary.tlog\cl.write.1.tlog
-p:\darkloadlibrary\x64\release\darkloadlibrary.tlog\link.read.1.tlog
-p:\darkloadlibrary\x64\release\darkloadlibrary.tlog\darkloadlibrary.write.1u.tlog
-p:\darkloadlibrary\x64\release\darkloadlibrary.tlog\link.command.1.tlog
-p:\darkloadlibrary\x64\release\darkloadlibrary.tlog\link.write.1.tlog
-p:\darkloadlibrary\x64\release\darkloadlibrary.tlog\cl.command.1.tlog

x64/Release/DarkLoadLibrary.exe.recipe

@@ -1,11 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project>
-  <ProjectOutputs>
-    <ProjectOutput>
-      <FullPath>P:\DarkLoadLibrary\x64\Release\DarkLoadLibrary.exe</FullPath>
-    </ProjectOutput>
-  </ProjectOutputs>
-  <ContentFiles />
-  <SatelliteDlls />
-  <NonRecipeFileRefs />
-</Project>

x64/Release/DarkLoadLibrary.log

@@ -1,23 +0,0 @@
-cl : command line warning D9002: ignoring unknown option '/NODEFAULTLIB'
-  darkloadlibrary.c
-P:\DarkLoadLibrary\darkloadlibrary.c(63,1): warning C4133: 'initializing': incompatible types - from 'wchar_t *' to 'PCHAR'
-P:\DarkLoadLibrary\darkloadlibrary.c(68,1): warning C4133: 'initializing': incompatible types - from 'wchar_t *' to 'PCHAR'
-P:\DarkLoadLibrary\darkloadlibrary.c(161,41): warning C4090: 'function': different 'const' qualifiers
-P:\DarkLoadLibrary\darkloadlibrary.c(181,35): warning C4013: 'IsModulePresent' undefined; assuming extern returning int
-P:\DarkLoadLibrary\darkloadlibrary.c(187,31): warning C4047: '=': 'ULONG_PTR' differs in levels of indirection from 'HMODULE'
-P:\DarkLoadLibrary\darkloadlibrary.c(194,16): warning C4013: 'IsValidPE' undefined; assuming extern returning int
-P:\DarkLoadLibrary\darkloadlibrary.c(201,18): warning C4013: 'MapSections' undefined; assuming extern returning int
-P:\DarkLoadLibrary\darkloadlibrary.c(208,21): warning C4013: 'ResolveImports' undefined; assuming extern returning int
-P:\DarkLoadLibrary\darkloadlibrary.c(215,22): warning C4013: 'LinkModuleToPEB' undefined; assuming extern returning int
-P:\DarkLoadLibrary\darkloadlibrary.c(222,21): warning C4013: 'BeginExecution' undefined; assuming extern returning int
-P:\DarkLoadLibrary\darkloadlibrary.c(181,1): warning C4047: 'initializing': 'HMODULE' differs in levels of indirection from 'int'
-P:\DarkLoadLibrary\darkloadlibrary.c(292,21): warning C4047: 'function': 'HMODULE' differs in levels of indirection from 'ULONG_PTR'
-P:\DarkLoadLibrary\darkloadlibrary.c(292,10): warning C4024: 'GetProcAddress': different types for formal and actual parameter 1
-P:\DarkLoadLibrary\darkloadlibrary.c(291,1): warning C4113: 'FARPROC' differs in parameter lists from '_ThisIsAFunction'
-P:\DarkLoadLibrary\darkloadlibrary.c(291,1): warning C4133: 'initializing': incompatible types - from 'FARPROC' to '_ThisIsAFunction'
-  Generating code
-  3 of 20 functions (15.0%) were compiled, the rest were copied from previous compilation.
-    0 functions were new in current compilation
-    0 functions had inline decision re-evaluated but remain unchanged
-  Finished generating code
-  DarkLoadLibrary.vcxproj -> P:\DarkLoadLibrary\x64\Release\DarkLoadLibrary.exe

x64/Release/DarkLoadLibrary.tlog/DarkLoadLibrary.lastbuildstate

@@ -1,2 +0,0 @@
-PlatformToolSet=v142:VCToolArchitecture=Native32Bit:VCToolsVersion=14.28.29333:TargetPlatformVersion=10.0.18362.0:
-Release|x64|P:\DarkLoadLibrary\|

x64/Release/DarkLoadLibrary.vcxproj.FileListAbsolute.txt

@@ -1 +0,0 @@
-P:\DarkLoadLibrary\x64\Release\DarkLoadLibrary.exe