admin/bats3c-DarkLoadLibrary
1
0
Fork 0
mirror of https://github.com/bats3c/DarkLoadLibrary synced 2026-06-06 15:14:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

remove ucrtbased from darkloadlibrary.c

Browse Source
This commit is contained in:
hypervis0r
2021-10-21 17:19:22 -07:00
parent c301793e6a
commit f67b431dd4
2 changed files with 17 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DarkLoadLibrary/include/darkloadlibrary.h
+1 -3
View File
@@ -16,10 +16,8 @@ typedef DWORD(WINAPI* GETFILESIZE)(HANDLE hFile, LPDWORD lpFileSizeHigh);
typedef BOOL(WINAPI* READFILE)(HANDLE hFile, LPVOID lpBuffer, DWORD nNumberOfBytesToRead, LPDWORD lpNumberOfBytesRead, LPOVERLAPPED lpOverlapped);
typedef BOOL(WINAPI* CLOSEHANDLE)(HANDLE hObject);
typedef BOOL(WINAPI* HEAPFREE)(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem);
typedef void(__cdecl* _WSPLITPATH)(const wchar_t* _FullPath, wchar_t* _Drive, wchar_t* _Dir, wchar_t* _Filename, wchar_t* _Ext);
typedef wchar_t*(_cdecl* WCSCPY)(wchar_t* Dest, const wchar_t* _Source);
typedef wchar_t* (__cdecl* WCSCAT)(wchar_t* _dst, const wchar_t* __src);
typedef LPCWSTR(WINAPI *PATHFINDFILENAMEW)(LPCWSTR pszPath);
typedef int(__cdecl *WSPRINTFW)(LPWSTR, LPCWSTR, ...);
#pragma once
typedef struct _DARKMODULE {
DarkLoadLibrary/src/darkloadlibrary.c
+16 -14
View File
@@ -170,7 +170,16 @@ PDARKMODULE DarkLoadLibrary(
{
HEAPALLOC pHeapAlloc = (HEAPALLOC)GetFunctionAddress(IsModulePresent(L"Kernel32.dll"), "HeapAlloc");
GETPROCESSHEAP pGetProcessHeap = (GETPROCESSHEAP)GetFunctionAddress(IsModulePresent(L"Kernel32.dll"), "GetProcessHeap");
WCSCAT pwcscat = (WCSCAT)GetFunctionAddress(IsModulePresent(L"ucrtbased.dll"), "wcscat");
/*
TODO:
I would really love to stop using error messages that need this.
All the other safe versions of wsprintfW are located in the CRT,
which is an issue if there is no CRT in the process.
For now let us hope nobody will pass a name larger than 500 bytes. :/
*/
WSPRINTFW pwsprintfW = (WSPRINTFW)GetFunctionAddress(IsModulePresent(L"User32.dll"), "wsprintfW");
PDARKMODULE dModule = (DARKMODULE*)pHeapAlloc(pGetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(DARKMODULE));
if (!dModule)
@@ -217,9 +226,7 @@ PDARKMODULE DarkLoadLibrary(
lpwName = dModule->CrackedDLLName;
}
HMODULE hModule = IsModulePresent(
lpwName
);
HMODULE hModule = IsModulePresent(lpwName);
if (hModule != NULL)
{
@@ -236,8 +243,7 @@ PDARKMODULE DarkLoadLibrary(
if (!dModule->ErrorMsg)
goto Cleanup;
pwcscat(dModule->ErrorMsg, L"Data is an invalid PE: ");
pwcscat(dModule->ErrorMsg, lpwName);
pwsprintfW(dModule->ErrorMsg, TEXT("Data is an invalid PE: %s"), lpwName);
goto Cleanup;
}
@@ -248,8 +254,7 @@ PDARKMODULE DarkLoadLibrary(
if (!dModule->ErrorMsg)
goto Cleanup;
pwcscat(dModule->ErrorMsg, L"Failed to map sections: ");
pwcscat(dModule->ErrorMsg, lpwName);
pwsprintfW(dModule->ErrorMsg, TEXT("Failed to map sections: %s"), lpwName);
goto Cleanup;
}
@@ -260,8 +265,7 @@ PDARKMODULE DarkLoadLibrary(
if (!dModule->ErrorMsg)
goto Cleanup;
pwcscat(dModule->ErrorMsg, L"Failed to resolve imports: ");
pwcscat(dModule->ErrorMsg, lpwName);
pwsprintfW(dModule->ErrorMsg, TEXT("Failed to resolve imports: %s"), lpwName);
goto Cleanup;
}
@@ -274,8 +278,7 @@ PDARKMODULE DarkLoadLibrary(
if (!dModule->ErrorMsg)
goto Cleanup;
pwcscat(dModule->ErrorMsg, L"Failed to link module to PEB: ");
pwcscat(dModule->ErrorMsg, lpwName);
pwsprintfW(dModule->ErrorMsg, TEXT("Failed to link module to PEB: %s"), lpwName);
goto Cleanup;
}
}
@@ -287,8 +290,7 @@ PDARKMODULE DarkLoadLibrary(
if (!dModule->ErrorMsg)
goto Cleanup;
pwcscat(dModule->ErrorMsg, L"Failed to execute: ");
pwcscat(dModule->ErrorMsg, lpwName);
pwsprintfW(dModule->ErrorMsg, TEXT("Failed to execute: %s"), lpwName);
goto Cleanup;
}