Merge pull request #8 from hypervis0r/master

Implement NO_LINK flag

DarkLoadLibrary/include/darkloadlibrary.h

@@ -4,7 +4,7 @@
 #define LOAD_LOCAL_FILE  0x00000001
 #define LOAD_REMOTE_FILE 0x00000002
 #define LOAD_MEMORY		 0x00000003
-#define NO_LINK			 0x00000004
+#define NO_LINK			 0x00010000
 
 #pragma once
 typedef struct _DARKMODULE {
@@ -15,6 +15,7 @@ typedef struct _DARKMODULE {
 	LPWSTR    LocalDLLName;
 	PWCHAR CrackedDLLName;
     ULONG_PTR ModuleBase;
+	BOOL		bLinkedToPeb;
 } DARKMODULE, *PDARKMODULE;
 
 PDARKMODULE DarkLoadLibrary(

DarkLoadLibrary/src/darkloadlibrary.c

@@ -151,11 +151,14 @@ PDARKMODULE DarkLoadLibrary(
 )
 {
 	PDARKMODULE dModule = (DARKMODULE*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(DARKMODULE));
+	if (!dModule)
+		return NULL;
 
 	dModule->bSuccess = FALSE;
+	dModule->bLinkedToPeb = TRUE;
 
 	// get the DLL data into memory, whatever the format it's in
-	switch (dwFlags)
+	switch (LOWORD(dwFlags))
 	{
 	case LOAD_LOCAL_FILE:
 		if (!ParseFileName(dModule, lpwBuffer) || !ReadFileToBuffer(dModule))
@@ -174,17 +177,18 @@ PDARKMODULE DarkLoadLibrary(
 		dModule->CrackedDLLName = lpwName;
 		dModule->LocalDLLName = lpwName;
 
-		break;
+		if (lpwName == NULL)
+			goto Cleanup;
 
-	case NO_LINK:
-		dModule->ErrorMsg = L"Not implemented yet, sorry";
-		goto Cleanup;
 		break;
 
 	default:
 		break;
 	}
 
+	if (dwFlags & NO_LINK)
+		dModule->bLinkedToPeb = FALSE;
+
 	// is there a module with the same name already loaded
 	if (lpwName == NULL)
 	{
@@ -207,6 +211,9 @@ PDARKMODULE DarkLoadLibrary(
 	if (!IsValidPE(dModule->pbDllData))
 	{
 		dModule->ErrorMsg = (wchar_t*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 500);
+		if (!dModule->ErrorMsg)
+			goto Cleanup;
+
 		wcscat(dModule->ErrorMsg, L"Data is an invalid PE: ");
 		wcscat(dModule->ErrorMsg, lpwName);
 		goto Cleanup;
@@ -216,6 +223,9 @@ PDARKMODULE DarkLoadLibrary(
 	if (!MapSections(dModule))
 	{
 		dModule->ErrorMsg = (wchar_t*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 500);
+		if (!dModule->ErrorMsg)
+			goto Cleanup;
+
 		wcscat(dModule->ErrorMsg, L"Failed to map sections: ");
 		wcscat(dModule->ErrorMsg, lpwName);
 		goto Cleanup;
@@ -225,24 +235,36 @@ PDARKMODULE DarkLoadLibrary(
 	if (!ResolveImports(dModule))
 	{
 		dModule->ErrorMsg = (wchar_t*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 500);
+		if (!dModule->ErrorMsg)
+			goto Cleanup;
+
 		wcscat(dModule->ErrorMsg, L"Failed to resolve imports: ");
 		wcscat(dModule->ErrorMsg, lpwName);
 		goto Cleanup;
 	}
 
 	// link the module to the PEB
-	if (!LinkModuleToPEB(dModule))
+	if (dModule->bLinkedToPeb)
 	{
-		dModule->ErrorMsg = (wchar_t*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 500);
-		wcscat(dModule->ErrorMsg, L"Failed to link module to PEB: ");
-		wcscat(dModule->ErrorMsg, lpwName);
-		goto Cleanup;
+		if (!LinkModuleToPEB(dModule))
+		{
+			dModule->ErrorMsg = (wchar_t*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 500);
+			if (!dModule->ErrorMsg)
+				goto Cleanup;
+			
+			wcscat(dModule->ErrorMsg, L"Failed to link module to PEB: ");
+			wcscat(dModule->ErrorMsg, lpwName);
+			goto Cleanup;
+		}
 	}
 
 	// trigger tls callbacks, set permissions and call the entry point
 	if (!BeginExecution(dModule))
 	{
 		dModule->ErrorMsg = (wchar_t*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 500);
+		if (!dModule->ErrorMsg)
+			goto Cleanup;
+
 		wcscat(dModule->ErrorMsg, L"Failed to execute: ");
 		wcscat(dModule->ErrorMsg, lpwName);
 		goto Cleanup;

DarkLoadLibrary/src/main.c

@@ -9,7 +9,7 @@ typedef DWORD (WINAPI * _ThisIsAFunction) (LPCWSTR);
 VOID main()
 {
 	PDARKMODULE DarkModule = DarkLoadLibrary(
-		LOAD_LOCAL_FILE,
+		LOAD_LOCAL_FILE | NO_LINK,
 		L"TestDLL.dll",
 		NULL,
 		0,