diff --git a/DarkLoadLibrary/TestDLL.dll b/DarkLoadLibrary/TestDLL.dll new file mode 100644 index 0000000..d6d1646 Binary files /dev/null and b/DarkLoadLibrary/TestDLL.dll differ diff --git a/DarkLoadLibrary/include/darkloadlibrary.h b/DarkLoadLibrary/include/darkloadlibrary.h index 11cb860..771d3ee 100644 --- a/DarkLoadLibrary/include/darkloadlibrary.h +++ b/DarkLoadLibrary/include/darkloadlibrary.h @@ -4,7 +4,7 @@ #define LOAD_LOCAL_FILE 0x00000001 #define LOAD_REMOTE_FILE 0x00000002 #define LOAD_MEMORY 0x00000003 -#define NO_LINK 0x00000004 +#define NO_LINK 0x00010000 #pragma once typedef struct _DARKMODULE { @@ -15,6 +15,7 @@ typedef struct _DARKMODULE { LPWSTR LocalDLLName; PWCHAR CrackedDLLName; ULONG_PTR ModuleBase; + BOOL bLinkedToPeb; } DARKMODULE, *PDARKMODULE; PDARKMODULE DarkLoadLibrary( diff --git a/DarkLoadLibrary/src/darkloadlibrary.c b/DarkLoadLibrary/src/darkloadlibrary.c index fd3aa26..e28f4a1 100644 --- a/DarkLoadLibrary/src/darkloadlibrary.c +++ b/DarkLoadLibrary/src/darkloadlibrary.c @@ -153,9 +153,10 @@ PDARKMODULE DarkLoadLibrary( PDARKMODULE dModule = (DARKMODULE*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(DARKMODULE)); dModule->bSuccess = FALSE; + dModule->bLinkedToPeb = TRUE; // get the DLL data into memory, whatever the format it's in - switch (dwFlags) + switch (LOWORD(dwFlags)) { case LOAD_LOCAL_FILE: if (!ParseFileName(dModule, lpwBuffer) || !ReadFileToBuffer(dModule)) @@ -176,15 +177,13 @@ PDARKMODULE DarkLoadLibrary( break; - case NO_LINK: - dModule->ErrorMsg = L"Not implemented yet, sorry"; - goto Cleanup; - break; - default: break; } + if (dwFlags & NO_LINK) + dModule->bLinkedToPeb = FALSE; + // is there a module with the same name already loaded if (lpwName == NULL) { @@ -231,12 +230,15 @@ PDARKMODULE DarkLoadLibrary( } // link the module to the PEB - if (!LinkModuleToPEB(dModule)) + if (dModule->bLinkedToPeb) { - dModule->ErrorMsg = (wchar_t*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 500); - wcscat(dModule->ErrorMsg, L"Failed to link module to PEB: "); - wcscat(dModule->ErrorMsg, lpwName); - goto Cleanup; + if (!LinkModuleToPEB(dModule)) + { + dModule->ErrorMsg = (wchar_t*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 500); + wcscat(dModule->ErrorMsg, L"Failed to link module to PEB: "); + wcscat(dModule->ErrorMsg, lpwName); + goto Cleanup; + } } // trigger tls callbacks, set permissions and call the entry point diff --git a/DarkLoadLibrary/src/main.c b/DarkLoadLibrary/src/main.c index 550ecbb..1ee16b9 100644 --- a/DarkLoadLibrary/src/main.c +++ b/DarkLoadLibrary/src/main.c @@ -9,7 +9,7 @@ typedef DWORD (WINAPI * _ThisIsAFunction) (LPCWSTR); VOID main() { PDARKMODULE DarkModule = DarkLoadLibrary( - LOAD_LOCAL_FILE, + LOAD_LOCAL_FILE | NO_LINK, L"TestDLL.dll", NULL, 0,