admin/bats3c-DarkLoadLibrary
1
0
Fork 0
mirror of https://github.com/bats3c/DarkLoadLibrary synced 2026-06-06 15:14:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix ParseFileName to be better, and to get rid of ucrtbased

Browse Source
This commit is contained in:
hypervis0r
2021-10-21 16:55:28 -07:00
parent 6de15faa2c
commit c301793e6a
3 changed files with 14 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DarkLoadLibrary/include/darkloadlibrary.h
+3
View File
@@ -1,6 +1,8 @@
#include <stdio.h>
#include <windows.h>
#pragma comment(lib, "Shlwapi.lib")
#define LOAD_LOCAL_FILE 0x00000001
#define LOAD_REMOTE_FILE 0x00000002
#define LOAD_MEMORY 0x00000003
@@ -17,6 +19,7 @@ typedef BOOL(WINAPI* HEAPFREE)(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem);
typedef void(__cdecl* _WSPLITPATH)(const wchar_t* _FullPath, wchar_t* _Drive, wchar_t* _Dir, wchar_t* _Filename, wchar_t* _Ext);
typedef wchar_t*(_cdecl* WCSCPY)(wchar_t* Dest, const wchar_t* _Source);
typedef wchar_t* (__cdecl* WCSCAT)(wchar_t* _dst, const wchar_t* __src);
typedef LPCWSTR(WINAPI *PATHFINDFILENAMEW)(LPCWSTR pszPath);
#pragma once
typedef struct _DARKMODULE {
DarkLoadLibrary/src/darkloadlibrary.c
+10 -44
View File
@@ -42,9 +42,7 @@ BOOL ParseFileName(
{
HEAPALLOC pHeapAlloc = (HEAPALLOC)GetFunctionAddress(IsModulePresent(L"Kernel32.dll"), "HeapAlloc");
GETPROCESSHEAP pGetProcessHeap = (GETPROCESSHEAP)GetFunctionAddress(IsModulePresent(L"Kernel32.dll"), "GetProcessHeap");
_WSPLITPATH p_wsplitpath = (_WSPLITPATH)GetFunctionAddress(IsModulePresent(L"ucrtbased.dll"), "_wsplitpath");
WCSCPY pwcscpy = (WCSCPY)GetFunctionAddress(IsModulePresent(L"ucrtbased.dll"), "wcscpy");
WCSCAT pwcscat = (WCSCAT)GetFunctionAddress(IsModulePresent(L"ucrtbased.dll"), "wcscat");
PATHFINDFILENAMEW pPathFindFileNameW = (PATHFINDFILENAMEW)GetFunctionAddress(IsModulePresent(L"Shlwapi.dll"), "PathFindFileNameW");
if (lpwFileName == NULL)
{
@@ -67,53 +65,21 @@ BOOL ParseFileName(
MAX_PATH * 2
);
PWCHAR lpwExt = (PWCHAR)pHeapAlloc(
hHeap,
HEAP_ZERO_MEMORY,
MAX_PATH
);
PWCHAR lpwFilename = (PWCHAR)pHeapAlloc(
hHeap,
HEAP_ZERO_MEMORY,
MAX_PATH
);
if (!pdModule->CrackedDLLName || !lpwExt || !lpwFilename)
if (!pdModule->CrackedDLLName)
{
pdModule->ErrorMsg = L"Failed to allocate memory";
return FALSE;
}
p_wsplitpath(
lpwFileName,
NULL,
NULL,
lpwFilename,
lpwExt
);
LPWSTR lpwFileNameLocation = pPathFindFileNameW(lpwFileName);
if (lpwFilename == NULL || lpwExt == NULL)
{
pdModule->ErrorMsg = L"Failed to crack filename";
return FALSE;
}
PCHAR lpCpy = (PCHAR)pwcscpy(
pdModule->CrackedDLLName,
lpwFilename
);
PCHAR lpCat = (PCHAR)pwcscat(
pdModule->CrackedDLLName,
lpwExt
);
if (!lpCpy || !lpCat)
{
pdModule->ErrorMsg = L"Failed to format cracked path";
return FALSE;
}
/*
Copy the length of the filename modulo sizeof pdModule->CrackedDLLName - 1 for null byte.
TODO:
Get a working wstrcpy implementation
*/
memcpy(pdModule->CrackedDLLName, lpwFileNameLocation, (WideStringLength(lpwFileNameLocation) % (MAX_PATH - 1)) * 2);
return TRUE;
}
DarkLoadLibrary/src/main.c
+1 -1
View File
@@ -13,7 +13,7 @@ VOID main()
PDARKMODULE DarkModule = DarkLoadLibrary(
LOAD_LOCAL_FILE,
L"amsi.dll",
L".\\amsi.dll",
NULL,
0,
NULL