Implement NO_LINK flag

This commit is contained in:
Hypervisor
2021-08-07 14:31:44 -07:00
parent 22459ca64b
commit da43012aab
4 changed files with 16 additions and 13 deletions
Binary file not shown.
+2 -1
View File
@@ -4,7 +4,7 @@
#define LOAD_LOCAL_FILE 0x00000001
#define LOAD_REMOTE_FILE 0x00000002
#define LOAD_MEMORY 0x00000003
#define NO_LINK 0x00000004
#define NO_LINK 0x00010000
#pragma once
typedef struct _DARKMODULE {
@@ -15,6 +15,7 @@ typedef struct _DARKMODULE {
LPWSTR LocalDLLName;
PWCHAR CrackedDLLName;
ULONG_PTR ModuleBase;
BOOL bLinkedToPeb;
} DARKMODULE, *PDARKMODULE;
PDARKMODULE DarkLoadLibrary(
+13 -11
View File
@@ -153,9 +153,10 @@ PDARKMODULE DarkLoadLibrary(
PDARKMODULE dModule = (DARKMODULE*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(DARKMODULE));
dModule->bSuccess = FALSE;
dModule->bLinkedToPeb = TRUE;
// get the DLL data into memory, whatever the format it's in
switch (dwFlags)
switch (LOWORD(dwFlags))
{
case LOAD_LOCAL_FILE:
if (!ParseFileName(dModule, lpwBuffer) || !ReadFileToBuffer(dModule))
@@ -176,15 +177,13 @@ PDARKMODULE DarkLoadLibrary(
break;
case NO_LINK:
dModule->ErrorMsg = L"Not implemented yet, sorry";
goto Cleanup;
break;
default:
break;
}
if (dwFlags & NO_LINK)
dModule->bLinkedToPeb = FALSE;
// is there a module with the same name already loaded
if (lpwName == NULL)
{
@@ -231,12 +230,15 @@ PDARKMODULE DarkLoadLibrary(
}
// link the module to the PEB
if (!LinkModuleToPEB(dModule))
if (dModule->bLinkedToPeb)
{
dModule->ErrorMsg = (wchar_t*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 500);
wcscat(dModule->ErrorMsg, L"Failed to link module to PEB: ");
wcscat(dModule->ErrorMsg, lpwName);
goto Cleanup;
if (!LinkModuleToPEB(dModule))
{
dModule->ErrorMsg = (wchar_t*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 500);
wcscat(dModule->ErrorMsg, L"Failed to link module to PEB: ");
wcscat(dModule->ErrorMsg, lpwName);
goto Cleanup;
}
}
// trigger tls callbacks, set permissions and call the entry point
+1 -1
View File
@@ -9,7 +9,7 @@ typedef DWORD (WINAPI * _ThisIsAFunction) (LPCWSTR);
VOID main()
{
PDARKMODULE DarkModule = DarkLoadLibrary(
LOAD_LOCAL_FILE,
LOAD_LOCAL_FILE | NO_LINK,
L"TestDLL.dll",
NULL,
0,