From da43012aabedd84e53f7a9bb03b7b3d105fb0c81 Mon Sep 17 00:00:00 2001
From: Hypervisor <hyp3rvisor@protonmail.com>
Date: Sat, 7 Aug 2021 14:31:44 -0700
Subject: [PATCH 1/2] Implement NO_LINK flag

---
 DarkLoadLibrary/TestDLL.dll               | Bin 0 -> 10752 bytes
 DarkLoadLibrary/include/darkloadlibrary.h |   3 ++-
 DarkLoadLibrary/src/darkloadlibrary.c     |  24 ++++++++++++----------
 DarkLoadLibrary/src/main.c                |   2 +-
 4 files changed, 16 insertions(+), 13 deletions(-)
 create mode 100644 DarkLoadLibrary/TestDLL.dll

diff --git a/DarkLoadLibrary/TestDLL.dll b/DarkLoadLibrary/TestDLL.dll
new file mode 100644
index 0000000000000000000000000000000000000000..d6d164690b4792d15141653b446b375c58ffdf73
GIT binary patch
literal 10752
zcmeHNeRLbum49+Pj_ugU2^MPtDHEb#2WnTbvcbWa$XJ5sB7^Wppdmq4>~SoRC9O09
zhlWFfY&ObNt?7Y<vMnVE?e=t`8(I!^!fsc_DRu&39mCm8_*l}y!Z^<1m~0o406Y7;
zGo#oJ+0*@F`3HDDGxy`&d*6Ha-FM%cCpWDfU~?E_xp*{<u|Ys8F8%#yUKYmAyJYWq
z?Ad~Yiw7;<gNs|cgK;q$i)@Sqdc=-EI2@714U!m3gvDT3bl=n>_Cz|Rs^a28yJ@<j
z(UJ^RM8>j@<ok3i40`-K;X?+z<B+7&cOL50Vdzi<@Jd(sP!KRw5gxk{@bua)UH<gi
z$e|vc9vCxVk4`rSJG!Zjvq$9fFxL4%9((q!q4sRu6uVTMmvi35tOT5k4epcY0}{>H
z77W|Ka~R7b93=}`6a+aFC5N>`)KJQT&(j8Htei0)bi@kuhm=8_B<Nynx85KTDD8}q
z??x9hy(waytGF&@tY)U3$k^1m1WjI*EcMF3E6&4<x=fEb4q$o_(Rx*^Gav^r-XgHT
zU?g9PXGU?M*HwlX<K!3z9{7r(Pcw^)u}oFe5Y)#AhAu|~oKak4FBXq=fT#P!2ZZch
zhG#}`>2gvi0zutGJ1R*IKAl-yj9ojE{wm{KIpj?X56oxGx!>d5&$Xo+F!L{;DLi?+
zB6-@9xDb^PTn|B>wsq<9nr$Uy2Pw*Ua$m*p8KsxIx~!M<>2Bq<#XBxx>_lP#9~vs@
z`glmwP9$<p4D+G=B@>Sz^FWE(=pUC?C68I;3VL0D7UjZe!|GZ@(WIbW0bqSDqc_&5
zj1io$qM4@tjP>Cmoh(Cdcxs(JpQmJd2~Tadi}h>JfXI~-UgbmQe)Ry1^kuAlqfk_D
z78u)pc$?eqa{bnltUE|yW9|Pv-Xp?4fuOOeKZa0WM!re?`vOq^nv2(Gc)<@Jpmm-u
zej7l2eI8@|nZz=6l_4&o{&z<GKT!R%s2>r!VU$ABRjqA*N&VGaV0~I*wfZMuTsh2>
zHB7d1WmNq{@1|VlRbJdn3XRGuT$$rlioXqG_1Ym#*!m6A`I9-$3|H3K9bA#^HC)+j
z=kSGCfBWzrSY_%j@E#yPlV5IuGaRn%rxc+c`u&;viVbBKR2=?cZ8RlRphCS8Bh)=3
zChMMCf=(x{RByn@)b}uH>Rb7YC6_)9KEp8HM_--euI>M#TF}%-hc9{~`Hn?xg0wO`
zxzp&x66(aj%Us#VQ@4uVl&dV|!~F34HMi&!<Z4u=l+&1^{_%u$mF>wzjNLcanVI+i
zO{A~Yk|!;9d$=Mzg?z)|=E4!T-9fW6S*qEt1XDSj0tbQ6_iJ$BHRa#nGWChiG;O--
zk(pJC&r~HfOJXIARzuA>PHF<`c>hO;D)q(x2C4{7qha~Htc+&M6vKg<EF`r#3D=nx
ztInA1&&bQ5c?x3G<%0CB7R-QSvNS8J+3rQ1(Y?t$=NnY34AWHhVm4g$xBG9WMKvAI
zG<jm9a#DGnD<9Ib6x6?k6THfZ@+zkQITHk!fB(b}&~@m$T8ss7#JOLy-G;=?m6tTz
zS|FOut&^jB3vwB)EAcjDfC}QJyjVlY<28H!0zOmA5&0O-+&vVE2bUq{e}j!t{Us=_
zxDj+I;W5k@PZOTZVD$-?6RikI0x9877a5W+;3uIvBD?|)wK^h<0;8!M5ynky5aGr6
zof%qO2S{@y*Fr5%^RW(ypYrC4S*C?6#g$nm6jK<6ibIWtan+C?T`g<KfiA8b(QHmE
zN3Q&a_7kV(!5T=n+S}nn&2}@@V6dxrveRCJE_m(TTtTf@86~$kFnz>~5>bJiiD?rx
z+XAR*BS|f1^D{Jg{@ZWM&YjrCmE*<~2oEiU@#m{|zFqmFD}dDwCuE+K%Fs$vnPz*S
zkUHfl<0(&xX4?Wv$?)ZbZ#M9BlW5RxqCFziO8C%GkvoAqJtf>Z#P?vxD6q5ygmbzn
zZgmgA{qv~{h!oC09s_y$LXepG^~3Pl)5z6`fR8ZUh`V(0Pe4z6faT580_AbYm=HNz
zeIL#6WWHT}&p>iu2ipLKTA}_Ol;Fh05?6AU(gA=gJbzN)wWD&WGc(1l&lGpVVB&*n
zBcJcKOnywUPP%s*x^va%kc1{LR9iqJCH5KY-0IBaT=iZMyDfTyq=Up>hZsU)f7q~>
zwH1e4UnW6H3)C)yn5(V_GI@N4zIp>V>UDUTOwy-($x|WPM`U}Mx%f^|qQd%{Q1>Ch
zVO?L4{KS%&ucrmB9OTM~X8Sq(M<H{o;<fwCRT-kxEZbe=YyZTrp{tMeKHZ310%vz4
z@6v!Ko(50-onc*2f2NDVvF12;nDoS>K#a9*eNI?H*?j-=w2rLq;cdeCl*I3%T>V!N
zGd)nMb{a$h{Pi86lgGBhES9~oKG1@=rS346EK`moHYQJ5?!H5P3zLAEtmuCuVMi}t
zK&>i37el9BA0Ya_44Eo;+1X`{2usNU$x-b;t@jBJ8X17{1Ce^3NC~?@z9{tIZP7iB
zF6@C(rk=)2j{|IdLxW9g8S7dlv?0_Iy}YA%8xU-)9s+X?Y+Xg?_k@3N9<oE%s`|1-
ztM`f*tiP=<<>{Nt_?$7Ic|2XT#hWfVz*D96#@a)2ney!-Z|zX5P`NgL&XBh@6GNhV
zp<?oF=QzjaLy=ONyvNS&C9Du}nFpAohiTcc;qUE7)DgJWIS#+f>w6<Hm;bfxF=REv
zm4?igx*yQD!}cR`Zr^yKNIeDx?3M2TWCu(!mKOFvY&f~}M<hM0$6OmvKV^4)f+21_
zo`F-8BSse90bR71tGsk@*&g6b{XG^Qx}9#CsvjJ~9H<;@A~jnxVwo#HQ6a|D4<AM)
z(moQMW{Xk{>|C8qaOtCZtu8d3<gnJ$DpgRLBb$VXw1<@Iru#>!5{b~qQ~lHobwp>@
z4?aq*>ia<dHtOdym>;ef8rY}Xv3vV$h+e=}3R%teU5pc(JnbN`hXWZ;d#0=p!69xt
zr$%=|fLe2Dwx0q;^cBJL`Ds2!{bzlP{;_?GM7HiDm#s%Y>%P=iEl)41rL3N=TLCb+
z04FJOK%Qp%lvI+#`Mmb+*o3iCX?+^=kkz#sy7_16Qak6;eE|VXZBM6-5@*J_-@4PS
z40)VyxRsacw@!s+DOA7p!|SDR!mW%eQ_lVM=?05u-l%nF{nit~u+*5!wR`3rfSp|B
z6g;1wYPA<7d^}ma5#L+d(y7&&wJwuqVRA)XdtMHc7uQ7zEEIO1`V{9S@oqccW5LEs
z{^izPL-A6#BDj(K>yx7vcS=|VbaF0u4j_YcQgo;JC$&?XFQdMqb+<w%lH6?D*1hi(
z#0x$1hM@ZyHjNSCReThab$6<G45)SQ`=!?8g9hVyFrG)8u+*Ywjk=5Cn;>y<JPz}g
zF+TK1k<T0B7?nsz2=UV4tA-P|D8d7fPLAe}2niq*<S8Kztp1~6QLagjiX*~0kZ?UJ
z)&d)Z)R=q8VR!A}M44{Me)Q_2iQ;5&Eoxn<MauzbW-I8RE8~=$+*jhKe5Ze40C8qk
z33do!>loIS#?Yp=bhG{r>+b>meZT&e_4niYd&>-dpN@ZDe;-A#@3suXF112s`g=$_
zYH()1XVfpf12$Z3l!>`=Y<rW7a?1LNK4gQJXRt*z2F`$9IXqoq2)}wND~wNqV_dN)
z2t_Pn^0hZz{Jj&J=2bjVr48qrrgpUy;$+EzMS~`E4d?!?HSlr9`p}Rv1U}sTb@>u{
zAbf=}sCP~HiV2@J;o~OUX2M@xZpb&A^fe~D+=N9YoHFI!G~o*-%(}35Sr#+k4^8@j
z34eK3Ju~%BnEdxl_)U|4qY3XY;Q|xhZ^CSAtrr>hcUc%+WY7a=!L0oM7xX!dcBV|2
zwTu0GR%vAti!+(InHPUZtvdAMI<T4D#2T1~wcyXs>RBuP>cQbzQ)lilk$xbDi^?T<
z=<^LFd%uZqBK^8<6m_F#)!|!|xuE<e>fSu74qw0LEH#w>zkrf|mY=dsOo`_G>tYjT
zE3)tl>QC1E{}rAz`<ZX{v&4jsm9zWZ+~RKWH7}@|_>Vu<Kele@=Z`Jg+)Z1t@2Yh?
z*eSKe8obTxTBW$`_IlU#u3WLMSqe#kxRmAL{&YjOPuRj3Jv9HgpkvoJw0h|tw;dC!
z-|yOc!eFy@9J*HmW_fmpgZ&M7KRm<hWlS{gi>rckKWqO>R5AEoze=rgI6AsEGFG;j
zv3&5W8k+H`(@;+`;%pvH@6egWYt-c&vw6B)%`BczmvhbL>2iD)uT_`xfrp`*eQDL@
z+QAdyjO?8?t%oPh(Dr-oxu<gjhQY+k%yGoz4trz0Zm(h%Z>?_6F_YJ7$koi^8FDW0
z1}tc|*SOox-tAXO22FSTKI*IC+iIXJ3SQYX&q=&(;7v{QRuGT!=J#m~hAvH`e!uPl
z$lkfT92id?=ne5WRWlczM?jl*?bLWX*!rEi-LV`fYX^@G?Ius}6Y>9CvE*7<?zP4-
zaK0^{+2jId>zvDMEAp7Fdj8Q8#1*>BiV%?B#Y1sM<==r%%%Ckey5?2q_~sYpvceVl
ztgtyRO1k*OU`rO@!XD4lrfwPVwRm1M=?>uG8TCX*X4Drf%wr2zSlPnZ1xHJx=eLtx
zxP$!+G71*V>!1nheQ3_{S*&@?iZNI*25a@asHMQd3O1lVKbPgla-(zFa~x)W9hTx;
zR=lEs6<6o^3dk3iA`VUaKgEPD!$G+OpW*~9ITn@!KU+%kS!pMp*14<{ZIo7*L@hP}
zKHJM|mO++BGP)n~SYdTu)aVcTvO-|i1@ofhKk7e~EHo(NO&bbfIfx&s&ps#18T%BE
zzKBck(+%nwGm}eIXDGxP0-+H7hId^e+#v@elr3iL!w&%O6)~O}yw`wl1J5yo_dV>n
zzW|ToH(O59xj@WPpNC(ybIA6bCMg~dY?Q8z^xneST0G6pYJCcjQT_e~e>^I61iOMA
z{_a4yGbF_rTMB+$?)1x>qLM!t?uz(3u`R?RoBW|*96#M%!+NBixCCrXLv!1Wt&L5d
z<trS9&6NxqL0Oh!J?zS9+%K`!%paG!{awKjD*Y4#Wz63Z33mlICSsC59Eimtcl!ge
zjd$Vu-p~vNLcx2^R7v5xg0V=rM+&3m6|*EFVW~GL`{lrfkVHTJ`K4Z|BOy!vSrr$c
zJ(6QA5DixL#4GO(hATT_awUE>mV-S~WoUWj@=9YMujV$(p@u+IM&BAD_=Lu9mah}f
z8;RVRh-Smq6P9C}82ba&tO>^CL?F}_hS^TW{!wTP8!qki^ma&5it_99!6QEjEt34d
zRxirAUXmLUu^2|`i$yvxee5xz6)p{i1G1E5vDBQ#xJg7}*GU2Dt1l+S$w9u{n-fxO
zlTV6uMPfaHa0f<#QDS<(@p<cwo$S&X+}7@x6zBw#O%b<cQ(TsMTH&DjI0hgQ#zJ!%
zG0nyVwRjO094hR7^vEr3NNn6F#j-uQ!P9)B$D570&#%X?IbRJA99%DscfF=**<U2G
zdk5_qv~Pb)H2rYWfW-g0e0e+|;vC?`Lub}@z^!;V@IJuTOg_P5IIDTVKMokhxoH46
z!5ug^y$hWFKjsg3N^!n;7qF}p|9=9U-~=8!@Z*5%aqIg{;O&4#7oc6>HGnOI!%iz;
z+QbI{_nA1sBPRYPU@pE-NuJ<^CVnyCW;`-%5`4<!6U>-6!2+DisBcApkC^zQfDW9|
zyx<dT#X~X#?=|rOz}FYzTm$}_fMxix@loIeai5^$w*sERP5zVMM{y2};TZ%z07z%w
z3~+*UmfeQ_6Qpx2;RNX{N;p9}Hx@yjApIsE0{+Doi~bD)S8SQx4$iG$IL^VxFSz;*
z1bsg|I9o}lu3p{S6B6%|VsUJ=b>+*e9Oa@E?uc{-!yD_$+gh)ytSJ}cG7dR`5RL_P
z<(s5<`RZ$m3$G5u<5JIt&?XTE!tuKDL@az&yrWy{3B)UVf*r9)Jkljsc0_uv3dDP=
z?pj_hVnYpf;Y_q<W@}{XTUlEm&e6xOG)px8S8D2slTWZ6`8!H>bnl4ncy#CPor61X
T-POLUdslSVSK2>c^1=TP*OEFZ

literal 0
HcmV?d00001

diff --git a/DarkLoadLibrary/include/darkloadlibrary.h b/DarkLoadLibrary/include/darkloadlibrary.h
index 11cb860..771d3ee 100644
--- a/DarkLoadLibrary/include/darkloadlibrary.h
+++ b/DarkLoadLibrary/include/darkloadlibrary.h
@@ -4,7 +4,7 @@
 #define LOAD_LOCAL_FILE  0x00000001
 #define LOAD_REMOTE_FILE 0x00000002
 #define LOAD_MEMORY		 0x00000003
-#define NO_LINK			 0x00000004
+#define NO_LINK			 0x00010000
 
 #pragma once
 typedef struct _DARKMODULE {
@@ -15,6 +15,7 @@ typedef struct _DARKMODULE {
 	LPWSTR    LocalDLLName;
 	PWCHAR CrackedDLLName;
     ULONG_PTR ModuleBase;
+	BOOL		bLinkedToPeb;
 } DARKMODULE, *PDARKMODULE;
 
 PDARKMODULE DarkLoadLibrary(
diff --git a/DarkLoadLibrary/src/darkloadlibrary.c b/DarkLoadLibrary/src/darkloadlibrary.c
index fd3aa26..e28f4a1 100644
--- a/DarkLoadLibrary/src/darkloadlibrary.c
+++ b/DarkLoadLibrary/src/darkloadlibrary.c
@@ -153,9 +153,10 @@ PDARKMODULE DarkLoadLibrary(
 	PDARKMODULE dModule = (DARKMODULE*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(DARKMODULE));
 
 	dModule->bSuccess = FALSE;
+	dModule->bLinkedToPeb = TRUE;
 
 	// get the DLL data into memory, whatever the format it's in
-	switch (dwFlags)
+	switch (LOWORD(dwFlags))
 	{
 	case LOAD_LOCAL_FILE:
 		if (!ParseFileName(dModule, lpwBuffer) || !ReadFileToBuffer(dModule))
@@ -176,15 +177,13 @@ PDARKMODULE DarkLoadLibrary(
 
 		break;
 
-	case NO_LINK:
-		dModule->ErrorMsg = L"Not implemented yet, sorry";
-		goto Cleanup;
-		break;
-
 	default:
 		break;
 	}
 
+	if (dwFlags & NO_LINK)
+		dModule->bLinkedToPeb = FALSE;
+
 	// is there a module with the same name already loaded
 	if (lpwName == NULL)
 	{
@@ -231,12 +230,15 @@ PDARKMODULE DarkLoadLibrary(
 	}
 
 	// link the module to the PEB
-	if (!LinkModuleToPEB(dModule))
+	if (dModule->bLinkedToPeb)
 	{
-		dModule->ErrorMsg = (wchar_t*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 500);
-		wcscat(dModule->ErrorMsg, L"Failed to link module to PEB: ");
-		wcscat(dModule->ErrorMsg, lpwName);
-		goto Cleanup;
+		if (!LinkModuleToPEB(dModule))
+		{
+			dModule->ErrorMsg = (wchar_t*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 500);
+			wcscat(dModule->ErrorMsg, L"Failed to link module to PEB: ");
+			wcscat(dModule->ErrorMsg, lpwName);
+			goto Cleanup;
+		}
 	}
 
 	// trigger tls callbacks, set permissions and call the entry point
diff --git a/DarkLoadLibrary/src/main.c b/DarkLoadLibrary/src/main.c
index 550ecbb..1ee16b9 100644
--- a/DarkLoadLibrary/src/main.c
+++ b/DarkLoadLibrary/src/main.c
@@ -9,7 +9,7 @@ typedef DWORD (WINAPI * _ThisIsAFunction) (LPCWSTR);
 VOID main()
 {
 	PDARKMODULE DarkModule = DarkLoadLibrary(
-		LOAD_LOCAL_FILE,
+		LOAD_LOCAL_FILE | NO_LINK,
 		L"TestDLL.dll",
 		NULL,
 		0,

From 53211bef191b3c1d9ff8bee187d50250361ddadc Mon Sep 17 00:00:00 2001
From: Hypervisor <hyp3rvisor@protonmail.com>
Date: Sat, 7 Aug 2021 14:38:49 -0700
Subject: [PATCH 2/2] Add some extra checks into darkloadlibrary.c

---
 DarkLoadLibrary/src/darkloadlibrary.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/DarkLoadLibrary/src/darkloadlibrary.c b/DarkLoadLibrary/src/darkloadlibrary.c
index e28f4a1..0cd3568 100644
--- a/DarkLoadLibrary/src/darkloadlibrary.c
+++ b/DarkLoadLibrary/src/darkloadlibrary.c
@@ -151,6 +151,8 @@ PDARKMODULE DarkLoadLibrary(
 )
 {
 	PDARKMODULE dModule = (DARKMODULE*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(DARKMODULE));
+	if (!dModule)
+		return NULL;
 
 	dModule->bSuccess = FALSE;
 	dModule->bLinkedToPeb = TRUE;
@@ -175,6 +177,9 @@ PDARKMODULE DarkLoadLibrary(
 		dModule->CrackedDLLName = lpwName;
 		dModule->LocalDLLName = lpwName;
 
+		if (lpwName == NULL)
+			goto Cleanup;
+
 		break;
 
 	default:
@@ -206,6 +211,9 @@ PDARKMODULE DarkLoadLibrary(
 	if (!IsValidPE(dModule->pbDllData))
 	{
 		dModule->ErrorMsg = (wchar_t*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 500);
+		if (!dModule->ErrorMsg)
+			goto Cleanup;
+
 		wcscat(dModule->ErrorMsg, L"Data is an invalid PE: ");
 		wcscat(dModule->ErrorMsg, lpwName);
 		goto Cleanup;
@@ -215,6 +223,9 @@ PDARKMODULE DarkLoadLibrary(
 	if (!MapSections(dModule))
 	{
 		dModule->ErrorMsg = (wchar_t*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 500);
+		if (!dModule->ErrorMsg)
+			goto Cleanup;
+
 		wcscat(dModule->ErrorMsg, L"Failed to map sections: ");
 		wcscat(dModule->ErrorMsg, lpwName);
 		goto Cleanup;
@@ -224,6 +235,9 @@ PDARKMODULE DarkLoadLibrary(
 	if (!ResolveImports(dModule))
 	{
 		dModule->ErrorMsg = (wchar_t*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 500);
+		if (!dModule->ErrorMsg)
+			goto Cleanup;
+
 		wcscat(dModule->ErrorMsg, L"Failed to resolve imports: ");
 		wcscat(dModule->ErrorMsg, lpwName);
 		goto Cleanup;
@@ -235,6 +249,9 @@ PDARKMODULE DarkLoadLibrary(
 		if (!LinkModuleToPEB(dModule))
 		{
 			dModule->ErrorMsg = (wchar_t*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 500);
+			if (!dModule->ErrorMsg)
+				goto Cleanup;
+			
 			wcscat(dModule->ErrorMsg, L"Failed to link module to PEB: ");
 			wcscat(dModule->ErrorMsg, lpwName);
 			goto Cleanup;
@@ -245,6 +262,9 @@ PDARKMODULE DarkLoadLibrary(
 	if (!BeginExecution(dModule))
 	{
 		dModule->ErrorMsg = (wchar_t*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 500);
+		if (!dModule->ErrorMsg)
+			goto Cleanup;
+
 		wcscat(dModule->ErrorMsg, L"Failed to execute: ");
 		wcscat(dModule->ErrorMsg, lpwName);
 		goto Cleanup;