From c301793e6a578d729c88a750f8953af97137336c Mon Sep 17 00:00:00 2001
From: hypervis0r <hypervis0r@phasetw0.com>
Date: Thu, 21 Oct 2021 16:55:28 -0700
Subject: [PATCH] fix ParseFileName to be better, and to get rid of ucrtbased

---
 DarkLoadLibrary/include/darkloadlibrary.h |  3 ++
 DarkLoadLibrary/src/darkloadlibrary.c     | 54 +++++------------------
 DarkLoadLibrary/src/main.c                |  2 +-
 3 files changed, 14 insertions(+), 45 deletions(-)

diff --git a/DarkLoadLibrary/include/darkloadlibrary.h b/DarkLoadLibrary/include/darkloadlibrary.h
index e5780d1..983bad5 100644
--- a/DarkLoadLibrary/include/darkloadlibrary.h
+++ b/DarkLoadLibrary/include/darkloadlibrary.h
@@ -1,6 +1,8 @@
 #include <stdio.h>
 #include <windows.h>
 
+#pragma comment(lib, "Shlwapi.lib")
+
 #define LOAD_LOCAL_FILE  0x00000001
 #define LOAD_REMOTE_FILE 0x00000002
 #define LOAD_MEMORY		 0x00000003
@@ -17,6 +19,7 @@ typedef BOOL(WINAPI* HEAPFREE)(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem);
 typedef void(__cdecl* _WSPLITPATH)(const wchar_t* _FullPath, wchar_t* _Drive, wchar_t* _Dir, wchar_t* _Filename, wchar_t* _Ext);
 typedef wchar_t*(_cdecl* WCSCPY)(wchar_t* Dest, const wchar_t* _Source);
 typedef wchar_t* (__cdecl* WCSCAT)(wchar_t* _dst, const wchar_t* __src);
+typedef LPCWSTR(WINAPI *PATHFINDFILENAMEW)(LPCWSTR pszPath);
 
 #pragma once
 typedef struct _DARKMODULE {
diff --git a/DarkLoadLibrary/src/darkloadlibrary.c b/DarkLoadLibrary/src/darkloadlibrary.c
index a998d23..16724b5 100644
--- a/DarkLoadLibrary/src/darkloadlibrary.c
+++ b/DarkLoadLibrary/src/darkloadlibrary.c
@@ -42,9 +42,7 @@ BOOL ParseFileName(
 {
 	HEAPALLOC pHeapAlloc = (HEAPALLOC)GetFunctionAddress(IsModulePresent(L"Kernel32.dll"), "HeapAlloc");
 	GETPROCESSHEAP pGetProcessHeap = (GETPROCESSHEAP)GetFunctionAddress(IsModulePresent(L"Kernel32.dll"), "GetProcessHeap");
-	_WSPLITPATH p_wsplitpath = (_WSPLITPATH)GetFunctionAddress(IsModulePresent(L"ucrtbased.dll"), "_wsplitpath");
-	WCSCPY pwcscpy = (WCSCPY)GetFunctionAddress(IsModulePresent(L"ucrtbased.dll"), "wcscpy");
-	WCSCAT pwcscat = (WCSCAT)GetFunctionAddress(IsModulePresent(L"ucrtbased.dll"), "wcscat");
+	PATHFINDFILENAMEW pPathFindFileNameW = (PATHFINDFILENAMEW)GetFunctionAddress(IsModulePresent(L"Shlwapi.dll"), "PathFindFileNameW");
 
 	if (lpwFileName == NULL)
 	{
@@ -67,53 +65,21 @@ BOOL ParseFileName(
 		MAX_PATH * 2
 	);
 
-	PWCHAR lpwExt = (PWCHAR)pHeapAlloc(
-		hHeap,
-		HEAP_ZERO_MEMORY,
-		MAX_PATH
-	);
-
-	PWCHAR lpwFilename = (PWCHAR)pHeapAlloc(
-		hHeap,
-		HEAP_ZERO_MEMORY,
-		MAX_PATH
-	);
-
-	if (!pdModule->CrackedDLLName || !lpwExt || !lpwFilename)
+	if (!pdModule->CrackedDLLName)
 	{
 		pdModule->ErrorMsg = L"Failed to allocate memory";
 		return FALSE;
 	}
 
-	p_wsplitpath(
-        lpwFileName,
-        NULL,
-        NULL,
-        lpwFilename,
-        lpwExt
-    );
+	LPWSTR lpwFileNameLocation = pPathFindFileNameW(lpwFileName);
 
-	if (lpwFilename == NULL || lpwExt == NULL)
-	{
-		pdModule->ErrorMsg = L"Failed to crack filename";
-		return FALSE;
-	}
-
-	PCHAR lpCpy = (PCHAR)pwcscpy(
-		pdModule->CrackedDLLName,
-		lpwFilename
-	);
-    
-	PCHAR lpCat = (PCHAR)pwcscat(
-		pdModule->CrackedDLLName,
-		lpwExt
-	);
-
-	if (!lpCpy || !lpCat)
-	{
-		pdModule->ErrorMsg = L"Failed to format cracked path";
-		return FALSE;
-	}
+	/*
+		Copy the length of the filename modulo sizeof pdModule->CrackedDLLName - 1 for null byte.
+		
+		TODO:
+		Get a working wstrcpy implementation
+	*/
+	memcpy(pdModule->CrackedDLLName, lpwFileNameLocation, (WideStringLength(lpwFileNameLocation) % (MAX_PATH - 1)) * 2);
 
 	return TRUE;
 }
diff --git a/DarkLoadLibrary/src/main.c b/DarkLoadLibrary/src/main.c
index d48b5cc..f1ef0e9 100644
--- a/DarkLoadLibrary/src/main.c
+++ b/DarkLoadLibrary/src/main.c
@@ -13,7 +13,7 @@ VOID main()
 
 	PDARKMODULE DarkModule = DarkLoadLibrary(
 		LOAD_LOCAL_FILE,
-		L"amsi.dll",
+		L".\\amsi.dll",
 		NULL,
 		0,
 		NULL