diff --git a/MemoryModule/Initialize.cpp b/MemoryModule/Initialize.cpp index 86f4d0d..42da0ba 100644 --- a/MemoryModule/Initialize.cpp +++ b/MemoryModule/Initialize.cpp @@ -1,7 +1,7 @@ #include "stdafx.h" #include "LoaderPrivate.h" #include -#include +#include PMMP_GLOBAL_DATA MmpGlobalDataPtr; @@ -544,7 +544,9 @@ BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReser if (ul_reason_for_call == DLL_PROCESS_ATTACH) { if (NT_SUCCESS(Initialize())) { if (lpReserved == (PVOID)-1) { - assert(ReflectiveMapDll(hModule)); + if (!ReflectiveMapDll(hModule)) { + RtlRaiseStatus(STATUS_NOT_SUPPORTED); + } } return TRUE; diff --git a/MemoryModule/Loader.h b/MemoryModule/Loader.h index 9ce45ed..310ab6a 100644 --- a/MemoryModule/Loader.h +++ b/MemoryModule/Loader.h @@ -61,7 +61,7 @@ NTSTATUS NTAPI LdrLoadDllMemoryExW( //Unload modules previously loaded from memory NTSTATUS NTAPI LdrUnloadDllMemory(_In_ HMEMORYMODULE BaseAddress); -#ifndef _USRDLL +#if (!defined(_USRDLL) && defined(_MEMORY_MODULE)) #ifdef _WIN64 #pragma comment(linker,"/export:LdrUnloadDllMemoryAndExitThread") #pragma comment(linker,"/export:FreeLibraryMemoryAndExitThread=LdrUnloadDllMemoryAndExitThread") diff --git a/MemoryModule/MemoryModule.vcxproj b/MemoryModule/MemoryModule.vcxproj index b152c6d..51b0ac3 100644 --- a/MemoryModule/MemoryModule.vcxproj +++ b/MemoryModule/MemoryModule.vcxproj @@ -265,7 +265,7 @@ NotUsing Level3 true - WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions) + _MEMORY_MODULE;WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions) true @@ -283,7 +283,7 @@ NotUsing Level3 true - WIN32;_DEBUG;_USRDLL;%(PreprocessorDefinitions) + _MEMORY_MODULE;WIN32;_DEBUG;_USRDLL;%(PreprocessorDefinitions) true @@ -302,7 +302,7 @@ NotUsing Level3 true - _DEBUG;_LIB;%(PreprocessorDefinitions) + _MEMORY_MODULE;_DEBUG;_LIB;%(PreprocessorDefinitions) true @@ -320,7 +320,7 @@ NotUsing Level3 true - _DEBUG;_USRDLL;%(PreprocessorDefinitions) + _MEMORY_MODULE;_DEBUG;_USRDLL;%(PreprocessorDefinitions) true @@ -341,7 +341,7 @@ true true true - WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions) + _MEMORY_MODULE;WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions) true @@ -363,7 +363,7 @@ true true true - WIN32;NDEBUG;_USRDLL;%(PreprocessorDefinitions) + _MEMORY_MODULE;WIN32;NDEBUG;_USRDLL;%(PreprocessorDefinitions) true @@ -386,7 +386,7 @@ true true true - NDEBUG;_LIB;%(PreprocessorDefinitions) + _MEMORY_MODULE;NDEBUG;_LIB;%(PreprocessorDefinitions) true @@ -408,7 +408,7 @@ true true true - NDEBUG;_USRDLL;%(PreprocessorDefinitions) + _MEMORY_MODULE;NDEBUG;_USRDLL;%(PreprocessorDefinitions) true diff --git a/test/test.cpp b/test/test.cpp index 2345189..09b68f0 100644 --- a/test/test.cpp +++ b/test/test.cpp @@ -1,8 +1,12 @@ #include "../MemoryModule/stdafx.h" #include "../MemoryModule/LoadDllMemoryApi.h" #include +#pragma comment(lib,"ntdll.lib") -//PMMP_GLOBAL_DATA MmpGlobalDataPtr = *(PMMP_GLOBAL_DATA*)GetProcAddress(GetModuleHandleA("MemoryModule.dll"), "MmpGlobalDataPtr"); +PMMP_GLOBAL_DATA MmpGlobalDataPtr; + +decltype(&LdrLoadDllMemoryExW)__LdrLoadDllMemoryExW; +decltype(&LdrUnloadDllMemory)__LdrUnloadDllMemory; static void DisplayStatus() { printf( @@ -41,7 +45,10 @@ static PVOID ReadDllFile(LPCSTR FileName) { return 0; } _fseeki64(f, 0, SEEK_SET); - fread(buffer = new char[size], 1, size, f); + + buffer = VirtualAlloc(0, size, MEM_COMMIT, PAGE_EXECUTE_READWRITE); + + fread(buffer, 1, size, f); fclose(f); return buffer; } @@ -63,11 +70,10 @@ PVOID ReadDllFile2(LPCSTR FileName) { } int test() { - LPVOID buffer = ReadDllFile2("a.vmp.dll"); + LPVOID buffer = ReadDllFile2("a.dll"); HMODULE hModule = nullptr; FARPROC pfn = nullptr; - DWORD MemoryModuleFeatures = 0; typedef int(*_exception)(int code); _exception exception = nullptr; @@ -76,12 +82,7 @@ int test() { HGLOBAL gRes; char str[10]; - LdrQuerySystemMemoryModuleFeatures(&MemoryModuleFeatures); - if (MemoryModuleFeatures != MEMORY_FEATURE_ALL) { - printf("not support all features on this version of windows.\n"); - } - - if (!NT_SUCCESS(LdrLoadDllMemoryExW(&hModule, nullptr, 0, buffer, 0, L"kernel64", nullptr))) goto end; + if (!NT_SUCCESS(__LdrLoadDllMemoryExW(&hModule, nullptr, 0, buffer, 0, L"kernel64", nullptr))) goto end; //forward export pfn = (decltype(pfn))(GetProcAddress(hModule, "Socket")); //ws2_32.WSASocketW @@ -127,12 +128,44 @@ int test() { } end: - LdrUnloadDllMemory(hModule); - delete[]buffer; + __LdrUnloadDllMemory(hModule); + VirtualFree(buffer, 0, MEM_RELEASE); return 0; } +ULONG_PTR ReflectiveLoaderOffset() { + ULONG_PTR offset = 0; + + auto hm = LoadLibrary(L"MemoryModule.dll"); + if (hm) { + auto pfn = GetProcAddress(hm, "ReflectiveLoader"); + offset = ULONG_PTR(pfn) - ULONG_PTR(hm); + + auto header = RtlImageNtHeader(hm); + auto section = IMAGE_FIRST_SECTION(header); + for (int i = 0; i < header->FileHeader.NumberOfSections; ++i, ++section) { + if (offset >= section->VirtualAddress && offset < section->VirtualAddress + section->SizeOfRawData) { + offset = ULONG_PTR(pfn) - (ULONG_PTR(hm) + section->VirtualAddress) + section->PointerToRawData; + break; + } + } + } + + return offset; +} + +typedef ULONG_PTR(WINAPI* LOADER)(PVOID); + int main() { + printf("%08x\n", ReflectiveLoaderOffset()); + auto buffer = ReadDllFile2("MemoryModule.dll"); + auto loader = LOADER(ULONG_PTR(buffer) + 0x96e0); //ReflectiveLoaderOffset() -> 0x96e0 + auto hm = (HMODULE)loader(buffer); + + MmpGlobalDataPtr = *(PMMP_GLOBAL_DATA*)GetProcAddress(hm, "MmpGlobalDataPtr"); + __LdrLoadDllMemoryExW = (decltype(&LdrLoadDllMemoryExW))GetProcAddress(hm, "LdrLoadDllMemoryExW"); + __LdrUnloadDllMemory = (decltype(&LdrUnloadDllMemory))GetProcAddress(hm, "LdrUnloadDllMemory"); + DisplayStatus(); test(); diff --git a/test/test.vcxproj b/test/test.vcxproj index e0883c9..f6c4203 100644 --- a/test/test.vcxproj +++ b/test/test.vcxproj @@ -164,11 +164,6 @@ - - - {5b1f46db-036e-4a50-af5f-f5d6584d42c6} - -