diff --git a/.gitignore b/.gitignore index 8173ee7..f0e7d6d 100644 --- a/.gitignore +++ b/.gitignore @@ -338,4 +338,5 @@ ASALocalRun/ # BeatPulse healthcheck temp database healthchecksdb -/test/a.dll \ No newline at end of file +/test/a.dll +/MemoryModule/DebugDll diff --git a/MemoryModule/Loader.cpp b/MemoryModule/Loader.cpp index a3f2a13..73eb5ff 100644 --- a/MemoryModule/Loader.cpp +++ b/MemoryModule/Loader.cpp @@ -1,6 +1,16 @@ #include "stdafx.h" #include +#ifdef _USRDLL +#if (defined(_WIN64) || defined(_M_ARM)) +#pragma comment(linker,"/export:LdrUnloadDllMemoryAndExitThread") +#pragma comment(linker,"/export:FreeLibraryMemoryAndExitThread=LdrUnloadDllMemoryAndExitThread") +#else +#pragma comment(linker,"/export:LdrUnloadDllMemoryAndExitThread=_LdrUnloadDllMemoryAndExitThread@8") +#pragma comment(linker,"/export:FreeLibraryMemoryAndExitThread=_LdrUnloadDllMemoryAndExitThread@8") +#endif +#endif + NTSTATUS NTAPI LdrMapDllMemory( _In_ HMEMORYMODULE ViewBase, _In_ DWORD dwFlags, diff --git a/MemoryModule/Loader.h b/MemoryModule/Loader.h index 310ab6a..8bdce28 100644 --- a/MemoryModule/Loader.h +++ b/MemoryModule/Loader.h @@ -61,16 +61,6 @@ NTSTATUS NTAPI LdrLoadDllMemoryExW( //Unload modules previously loaded from memory NTSTATUS NTAPI LdrUnloadDllMemory(_In_ HMEMORYMODULE BaseAddress); -#if (!defined(_USRDLL) && defined(_MEMORY_MODULE)) -#ifdef _WIN64 -#pragma comment(linker,"/export:LdrUnloadDllMemoryAndExitThread") -#pragma comment(linker,"/export:FreeLibraryMemoryAndExitThread=LdrUnloadDllMemoryAndExitThread") -#else -#pragma comment(linker,"/export:LdrUnloadDllMemoryAndExitThread=_LdrUnloadDllMemoryAndExitThread@8") -#pragma comment(linker,"/export:FreeLibraryMemoryAndExitThread=_LdrUnloadDllMemoryAndExitThread@8") -#endif -#endif - extern "C" { __declspec(noreturn) VOID NTAPI LdrUnloadDllMemoryAndExitThread( _In_ HMEMORYMODULE BaseAddress, diff --git a/MemoryModule/MemoryModule.cpp b/MemoryModule/MemoryModule.cpp index 166d942..32ff600 100644 --- a/MemoryModule/MemoryModule.cpp +++ b/MemoryModule/MemoryModule.cpp @@ -1,6 +1,10 @@ #include "stdafx.h" -#ifdef _WIN64 +#if defined(_M_ARM64) +#define HOST_MACHINE IMAGE_FILE_MACHINE_ARM64 +#elif defined(_M_ARM) +#define HOST_MACHINE IMAGE_FILE_MACHINE_ARM +#elif defined(_WIN64) #define HOST_MACHINE IMAGE_FILE_MACHINE_AMD64 #else #define HOST_MACHINE IMAGE_FILE_MACHINE_I386 diff --git a/MemoryModule/MemoryModule.vcxproj b/MemoryModule/MemoryModule.vcxproj index 51b0ac3..5ea04bc 100644 --- a/MemoryModule/MemoryModule.vcxproj +++ b/MemoryModule/MemoryModule.vcxproj @@ -1,6 +1,14 @@ + + DebugDll + ARM + + + DebugDll + ARM64 + DebugDll Win32 @@ -9,10 +17,26 @@ DebugDll x64 + + Debug + ARM + + + Debug + ARM64 + Debug Win32 + + ReleaseDll + ARM + + + ReleaseDll + ARM64 + ReleaseDll Win32 @@ -21,6 +45,14 @@ ReleaseDll x64 + + Release + ARM + + + Release + ARM64 + Release Win32 @@ -59,17 +91,29 @@ false + false false + false false + false false + false false + false false + false false + false false + false false + false false + false false + false false + false @@ -144,12 +188,24 @@ v142 Unicode + + StaticLibrary + true + v142 + Unicode + DynamicLibrary true v142 Unicode + + DynamicLibrary + true + v142 + Unicode + StaticLibrary false @@ -157,6 +213,13 @@ true Unicode + + StaticLibrary + false + v142 + true + Unicode + DynamicLibrary false @@ -164,6 +227,13 @@ true Unicode + + DynamicLibrary + false + v142 + true + Unicode + StaticLibrary true @@ -171,6 +241,13 @@ Unicode false + + StaticLibrary + true + v142 + Unicode + false + DynamicLibrary true @@ -178,6 +255,13 @@ Unicode false + + DynamicLibrary + true + v142 + Unicode + false + StaticLibrary false @@ -185,6 +269,13 @@ true Unicode + + StaticLibrary + false + v142 + true + Unicode + DynamicLibrary false @@ -192,6 +283,13 @@ true Unicode + + DynamicLibrary + false + v142 + true + Unicode + @@ -201,65 +299,121 @@ + + + + + + + + + + + + + + + + + + + + + + + + true $(VC_IncludePath);$(WindowsSDK_IncludePath);$(SolutionDir); $(SolutionDir)$(Configuration)\ + + true + $(VC_IncludePath);$(WindowsSDK_IncludePath);$(SolutionDir); + true $(VC_IncludePath);$(WindowsSDK_IncludePath);$(SolutionDir); $(SolutionDir)Debug\ + + true + $(VC_IncludePath);$(WindowsSDK_IncludePath);$(SolutionDir); + true $(VC_IncludePath);$(WindowsSDK_IncludePath);$(SolutionDir); + + true + $(VC_IncludePath);$(WindowsSDK_IncludePath);$(SolutionDir); + true $(VC_IncludePath);$(WindowsSDK_IncludePath);$(SolutionDir); $(SolutionDir)$(Platform)\Debug\ + + true + $(VC_IncludePath);$(WindowsSDK_IncludePath);$(SolutionDir); + false $(VC_IncludePath);$(WindowsSDK_IncludePath);$(SolutionDir); + + false + $(VC_IncludePath);$(WindowsSDK_IncludePath);$(SolutionDir); + false $(VC_IncludePath);$(WindowsSDK_IncludePath);$(SolutionDir); $(SolutionDir)Release\ + + false + $(VC_IncludePath);$(WindowsSDK_IncludePath);$(SolutionDir); + false $(VC_IncludePath);$(WindowsSDK_IncludePath);$(SolutionDir); + + false + $(VC_IncludePath);$(WindowsSDK_IncludePath);$(SolutionDir); + false $(VC_IncludePath);$(WindowsSDK_IncludePath);$(SolutionDir); $(SolutionDir)$(Platform)\Release\ + + false + $(VC_IncludePath);$(WindowsSDK_IncludePath);$(SolutionDir); + NotUsing @@ -278,6 +432,25 @@ MemoryModulePP.def + + + NotUsing + Level3 + true + _MEMORY_MODULE;WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions) + true + + + + + MultiThreadedDebug + + + Windows + true + MemoryModulePP.def + + NotUsing @@ -297,6 +470,25 @@ MemoryModulePP.def + + + NotUsing + Level3 + true + _MEMORY_MODULE;WIN32;_DEBUG;_USRDLL;%(PreprocessorDefinitions) + true + + + + + MultiThreadedDebug + + + Windows + true + MemoryModulePP.def + + NotUsing @@ -315,6 +507,25 @@ MemoryModulePP.def + + + NotUsing + Level3 + true + _MEMORY_MODULE;_DEBUG;_LIB;%(PreprocessorDefinitions) + true + + + + + MultiThreadedDebug + + + Windows + true + MemoryModulePP.def + + NotUsing @@ -334,6 +545,25 @@ MemoryModulePP.def + + + NotUsing + Level3 + true + _MEMORY_MODULE;_DEBUG;_USRDLL;%(PreprocessorDefinitions) + true + + + + + MultiThreadedDebug + + + Windows + true + MemoryModulePP.def + + NotUsing @@ -356,6 +586,29 @@ MemoryModulePP.def + + + NotUsing + Level3 + true + true + true + _MEMORY_MODULE;WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions) + true + + + + + MultiThreaded + + + Windows + true + true + true + MemoryModulePP.def + + NotUsing @@ -379,6 +632,29 @@ MemoryModulePP.def + + + NotUsing + Level3 + true + true + true + _MEMORY_MODULE;WIN32;NDEBUG;_USRDLL;%(PreprocessorDefinitions) + true + + + + + MultiThreaded + + + Windows + true + true + true + MemoryModulePP.def + + NotUsing @@ -401,6 +677,29 @@ MemoryModulePP.def + + + NotUsing + Level3 + true + true + true + _MEMORY_MODULE;NDEBUG;_LIB;%(PreprocessorDefinitions) + true + + + + + MultiThreaded + + + Windows + true + true + true + MemoryModulePP.def + + NotUsing @@ -424,6 +723,29 @@ MemoryModulePP.def + + + NotUsing + Level3 + true + true + true + _MEMORY_MODULE;NDEBUG;_USRDLL;%(PreprocessorDefinitions) + true + + + + + MultiThreaded + + + Windows + true + true + true + MemoryModulePP.def + + diff --git a/MemoryModule/MmpGlobalData.h b/MemoryModule/MmpGlobalData.h index 2f73ddf..e4530a2 100644 --- a/MemoryModule/MmpGlobalData.h +++ b/MemoryModule/MmpGlobalData.h @@ -100,7 +100,7 @@ typedef enum class _WINDOWS_VERSION :BYTE { #define MEMORY_MODULE_GET_MINOR_VERSION(MinorVersion) (~0x8000&(MinorVersion)) #define MEMORY_MODULE_MAJOR_VERSION 2 -#define MEMORY_MODULE_MINOR_VERSION 0 +#define MEMORY_MODULE_MINOR_VERSION MEMORY_MODULE_MAKE_PREVIEW(1) typedef struct _MMP_GLOBAL_DATA { diff --git a/MemoryModule/MmpTls.cpp b/MemoryModule/MmpTls.cpp index 112847a..b2cd34b 100644 --- a/MemoryModule/MmpTls.cpp +++ b/MemoryModule/MmpTls.cpp @@ -231,7 +231,7 @@ __skip_tls: return Context.ThreadStartRoutine(Context.ThreadParameter); } -#ifdef _WIN64 +#if (defined(_WIN64) || defined(_M_ARM)) VOID NTAPI HookRtlUserThreadStart( _In_ PTHREAD_START_ROUTINE Function, _In_ PVOID Parameter) { @@ -256,7 +256,7 @@ HookRtlUserThreadStart( // Context.ThreadParameter = Parameter; mov dword ptr ds : [esp + 4] , ebx; - + mov eax, MmpUserThreadStart; mov ebx, esp; diff --git a/MemoryModule/ReflectiveLoader.c b/MemoryModule/ReflectiveLoader.c index 7044911..7845adc 100644 --- a/MemoryModule/ReflectiveLoader.c +++ b/MemoryModule/ReflectiveLoader.c @@ -1,4 +1,4 @@ -#ifdef _USRDLL +#if !(defined(_M_ARM) || defined(_M_ARM64) || defined(_USRDLL)) //===============================================================================================// // Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) diff --git a/MemoryModulePP.sln b/MemoryModulePP.sln index 0b985a5..3df6af9 100644 --- a/MemoryModulePP.sln +++ b/MemoryModulePP.sln @@ -1,7 +1,7 @@  Microsoft Visual Studio Solution File, Format Version 12.00 -# Visual Studio Version 16 -VisualStudioVersion = 16.0.29709.97 +# Visual Studio Version 17 +VisualStudioVersion = 17.7.34202.233 MinimumVisualStudioVersion = 10.0.40219.1 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MemoryModule", "MemoryModule\MemoryModule.vcxproj", "{5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}" EndProject @@ -11,34 +11,62 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "a", "a\a.vcxproj", "{DA79C6 EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|ARM = Debug|ARM + Debug|ARM64 = Debug|ARM64 Debug|x64 = Debug|x64 Debug|x86 = Debug|x86 + Release|ARM = Release|ARM + Release|ARM64 = Release|ARM64 Release|x64 = Release|x64 Release|x86 = Release|x86 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution + {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Debug|ARM.ActiveCfg = Debug|ARM + {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Debug|ARM.Build.0 = Debug|ARM + {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Debug|ARM64.ActiveCfg = Debug|ARM64 + {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Debug|ARM64.Build.0 = Debug|ARM64 {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Debug|x64.ActiveCfg = Debug|x64 {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Debug|x64.Build.0 = Debug|x64 {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Debug|x86.ActiveCfg = Debug|Win32 {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Debug|x86.Build.0 = Debug|Win32 + {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Release|ARM.ActiveCfg = Release|ARM + {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Release|ARM.Build.0 = Release|ARM + {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Release|ARM64.ActiveCfg = Release|ARM64 + {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Release|ARM64.Build.0 = Release|ARM64 {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Release|x64.ActiveCfg = Release|x64 {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Release|x64.Build.0 = Release|x64 {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Release|x86.ActiveCfg = Release|Win32 {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Release|x86.Build.0 = Release|Win32 + {5B3131BA-178A-4A28-BD54-315A45C97ED1}.Debug|ARM.ActiveCfg = Debug|ARM + {5B3131BA-178A-4A28-BD54-315A45C97ED1}.Debug|ARM.Build.0 = Debug|ARM + {5B3131BA-178A-4A28-BD54-315A45C97ED1}.Debug|ARM64.ActiveCfg = Debug|ARM64 + {5B3131BA-178A-4A28-BD54-315A45C97ED1}.Debug|ARM64.Build.0 = Debug|ARM64 {5B3131BA-178A-4A28-BD54-315A45C97ED1}.Debug|x64.ActiveCfg = Debug|x64 {5B3131BA-178A-4A28-BD54-315A45C97ED1}.Debug|x64.Build.0 = Debug|x64 {5B3131BA-178A-4A28-BD54-315A45C97ED1}.Debug|x64.Deploy.0 = Debug|x64 {5B3131BA-178A-4A28-BD54-315A45C97ED1}.Debug|x86.ActiveCfg = Debug|Win32 {5B3131BA-178A-4A28-BD54-315A45C97ED1}.Debug|x86.Build.0 = Debug|Win32 {5B3131BA-178A-4A28-BD54-315A45C97ED1}.Debug|x86.Deploy.0 = Debug|Win32 + {5B3131BA-178A-4A28-BD54-315A45C97ED1}.Release|ARM.ActiveCfg = Release|ARM + {5B3131BA-178A-4A28-BD54-315A45C97ED1}.Release|ARM.Build.0 = Release|ARM + {5B3131BA-178A-4A28-BD54-315A45C97ED1}.Release|ARM64.ActiveCfg = Release|ARM64 + {5B3131BA-178A-4A28-BD54-315A45C97ED1}.Release|ARM64.Build.0 = Release|ARM64 {5B3131BA-178A-4A28-BD54-315A45C97ED1}.Release|x64.ActiveCfg = Release|x64 {5B3131BA-178A-4A28-BD54-315A45C97ED1}.Release|x64.Build.0 = Release|x64 {5B3131BA-178A-4A28-BD54-315A45C97ED1}.Release|x86.ActiveCfg = Release|Win32 {5B3131BA-178A-4A28-BD54-315A45C97ED1}.Release|x86.Build.0 = Release|Win32 + {DA79C619-BDAC-4CF1-A38C-B1F5E05F4485}.Debug|ARM.ActiveCfg = Debug|ARM + {DA79C619-BDAC-4CF1-A38C-B1F5E05F4485}.Debug|ARM.Build.0 = Debug|ARM + {DA79C619-BDAC-4CF1-A38C-B1F5E05F4485}.Debug|ARM64.ActiveCfg = Debug|ARM64 + {DA79C619-BDAC-4CF1-A38C-B1F5E05F4485}.Debug|ARM64.Build.0 = Debug|ARM64 {DA79C619-BDAC-4CF1-A38C-B1F5E05F4485}.Debug|x64.ActiveCfg = Debug|x64 {DA79C619-BDAC-4CF1-A38C-B1F5E05F4485}.Debug|x64.Build.0 = Debug|x64 {DA79C619-BDAC-4CF1-A38C-B1F5E05F4485}.Debug|x86.ActiveCfg = Debug|Win32 {DA79C619-BDAC-4CF1-A38C-B1F5E05F4485}.Debug|x86.Build.0 = Debug|Win32 + {DA79C619-BDAC-4CF1-A38C-B1F5E05F4485}.Release|ARM.ActiveCfg = Release|ARM + {DA79C619-BDAC-4CF1-A38C-B1F5E05F4485}.Release|ARM.Build.0 = Release|ARM + {DA79C619-BDAC-4CF1-A38C-B1F5E05F4485}.Release|ARM64.ActiveCfg = Release|ARM64 + {DA79C619-BDAC-4CF1-A38C-B1F5E05F4485}.Release|ARM64.Build.0 = Release|ARM64 {DA79C619-BDAC-4CF1-A38C-B1F5E05F4485}.Release|x64.ActiveCfg = Release|x64 {DA79C619-BDAC-4CF1-A38C-B1F5E05F4485}.Release|x64.Build.0 = Release|x64 {DA79C619-BDAC-4CF1-A38C-B1F5E05F4485}.Release|x86.ActiveCfg = Release|Win32 diff --git a/a/a.vcxproj b/a/a.vcxproj index 2bdc7fc..b157e90 100644 --- a/a/a.vcxproj +++ b/a/a.vcxproj @@ -1,10 +1,26 @@ + + Debug + ARM + + + Debug + ARM64 + Debug Win32 + + Release + ARM + + + Release + ARM64 + Release Win32 @@ -33,6 +49,13 @@ Unicode false + + DynamicLibrary + true + v142 + Unicode + false + DynamicLibrary false @@ -40,12 +63,25 @@ true Unicode + + DynamicLibrary + false + v142 + true + Unicode + DynamicLibrary true v142 Unicode + + DynamicLibrary + true + v142 + Unicode + DynamicLibrary false @@ -53,6 +89,13 @@ true Unicode + + DynamicLibrary + false + v142 + true + Unicode + @@ -61,28 +104,52 @@ + + + + + + + + + + + + true + + true + true + + true + false + + false + false + + false + NotUsing @@ -104,6 +171,29 @@ true + + + NotUsing + Level3 + true + WIN32;_DEBUG;A_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + + + MultiThreadedDebug + + + Sync + + + Windows + true + false + m.def + + + + NotUsing @@ -123,6 +213,26 @@ m.def + + + NotUsing + Level3 + true + _DEBUG;A_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + + + MultiThreadedDebug + + + + + Windows + true + false + m.def + + NotUsing @@ -146,6 +256,30 @@ m.def + + + NotUsing + Level3 + true + true + true + WIN32;NDEBUG;A_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + + + MultiThreaded + + + + + Windows + true + true + true + false + m.def + + NotUsing @@ -170,13 +304,36 @@ m.def + + + NotUsing + Level3 + true + true + true + NDEBUG;A_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + + + MultiThreaded + Sync + + + + + Windows + true + true + true + false + m.def + + - - @@ -188,11 +345,6 @@ - - - {5b1f46db-036e-4a50-af5f-f5d6584d42c6} - - diff --git a/a/a.vcxproj.filters b/a/a.vcxproj.filters index 3cd8839..6239210 100644 --- a/a/a.vcxproj.filters +++ b/a/a.vcxproj.filters @@ -18,18 +18,12 @@ Source Files - - Source Files - Source Files Source Files - - Source Files - Source Files diff --git a/a/load.cpp b/a/load.cpp deleted file mode 100644 index 72babcb..0000000 --- a/a/load.cpp +++ /dev/null @@ -1,51 +0,0 @@ -#include "../MemoryModule/stdafx.h" -#include - -static PVOID ReadDllFile(LPCSTR FileName) { - LPVOID buffer; - size_t size; - FILE* f; - fopen_s(&f, FileName, "rb"); - if (!f)return 0; - _fseeki64(f, 0, SEEK_END); - if (!(size = _ftelli64(f))) { - fclose(f); - return 0; - } - _fseeki64(f, 0, SEEK_SET); - fread(buffer = new char[size], 1, size, f); - fclose(f); - return buffer; -} - -int __stdcall test_user32() { - HMODULE hModule; - NTSTATUS status; - PVOID buffer = ReadDllFile("C:\\Windows\\System32\\user32.dll"); - if (!buffer) return 0; - - hModule = GetModuleHandleA("user32.dll"); - if (hModule)return 0; - - status = LdrLoadDllMemoryExW( - &hModule, // ModuleHandle - nullptr, // LdrEntry - 0, // Flags - buffer, // Buffer - 0, // Reserved - L"user32.dll", // DllBaseName - L"C:\\Windows\\System32\\user32.dll" // DllFullName - ); - if (NT_SUCCESS(status) && status != STATUS_IMAGE_MACHINE_TYPE_MISMATCH) { - - auto _MessageBoxW = (decltype(&MessageBoxW))GetProcAddress(hModule, "MessageBoxW"); - _MessageBoxW(nullptr, L"Hello, from memory user32!", L"Caption", MB_OK); - - // - // After calling MessageBox, we can't free it. - // - //LdrUnloadDllMemory(hModule); - } - - return 0; -} diff --git a/a/m.def b/a/m.def index 545acdc..95aaa7b 100644 --- a/a/m.def +++ b/a/m.def @@ -4,6 +4,4 @@ test = __test__ thread Socket = ws2_32.WSASocketW VerifyTruse = wintrust.WinVerifyTrust -test_user32 -unhandled_exception GdiplusTest \ No newline at end of file diff --git a/a/unhandled_exception.cpp b/a/unhandled_exception.cpp deleted file mode 100644 index f442ed2..0000000 --- a/a/unhandled_exception.cpp +++ /dev/null @@ -1,49 +0,0 @@ -#include -#include - -#ifdef _WIN64 -DWORD Value; -volatile LPDWORD lpAddr; - -LONG WINAPI Filter(_In_ struct _EXCEPTION_POINTERS* ExceptionInfo) { - - if (ExceptionInfo->ExceptionRecord->ExceptionCode == STATUS_ACCESS_VIOLATION) { - - lpAddr = &Value; - - // +++++++ - // begin compiler specific - // +++++++ - - //ExceptionInfo->ContextRecord->Rip -= 7; - ExceptionInfo->ContextRecord->Rax = (ULONG_PTR)lpAddr; - - // +++++++ - // end compiler specific - // +++++++ - - return EXCEPTION_CONTINUE_EXECUTION; - } - - return EXCEPTION_CONTINUE_SEARCH; -} -#endif - -int unhandled_exception() { -#ifdef _WIN64 - auto filter = SetUnhandledExceptionFilter(Filter); - auto ff = SetUnhandledExceptionFilter(filter); - - if (ff != Filter) { - printf("%p\t%p\t%p\nfailed\n", filter, ff, Filter); - return 0; - } - - filter = SetUnhandledExceptionFilter(Filter); - lpAddr = nullptr; - *lpAddr = 1; - SetUnhandledExceptionFilter(filter); -#endif - - return 1234; -} diff --git a/test/test.cpp b/test/test.cpp index 09b68f0..3ea4e30 100644 --- a/test/test.cpp +++ b/test/test.cpp @@ -3,11 +3,6 @@ #include #pragma comment(lib,"ntdll.lib") -PMMP_GLOBAL_DATA MmpGlobalDataPtr; - -decltype(&LdrLoadDllMemoryExW)__LdrLoadDllMemoryExW; -decltype(&LdrUnloadDllMemory)__LdrUnloadDllMemory; - static void DisplayStatus() { printf( "\ @@ -82,7 +77,7 @@ int test() { HGLOBAL gRes; char str[10]; - if (!NT_SUCCESS(__LdrLoadDllMemoryExW(&hModule, nullptr, 0, buffer, 0, L"kernel64", nullptr))) goto end; + if (!NT_SUCCESS(LdrLoadDllMemoryExW(&hModule, nullptr, 0, buffer, 0, L"kernel64", nullptr))) goto end; //forward export pfn = (decltype(pfn))(GetProcAddress(hModule, "Socket")); //ws2_32.WSASocketW @@ -128,45 +123,15 @@ int test() { } end: - __LdrUnloadDllMemory(hModule); + LdrUnloadDllMemory(hModule); VirtualFree(buffer, 0, MEM_RELEASE); return 0; } -ULONG_PTR ReflectiveLoaderOffset() { - ULONG_PTR offset = 0; - - auto hm = LoadLibrary(L"MemoryModule.dll"); - if (hm) { - auto pfn = GetProcAddress(hm, "ReflectiveLoader"); - offset = ULONG_PTR(pfn) - ULONG_PTR(hm); - - auto header = RtlImageNtHeader(hm); - auto section = IMAGE_FIRST_SECTION(header); - for (int i = 0; i < header->FileHeader.NumberOfSections; ++i, ++section) { - if (offset >= section->VirtualAddress && offset < section->VirtualAddress + section->SizeOfRawData) { - offset = ULONG_PTR(pfn) - (ULONG_PTR(hm) + section->VirtualAddress) + section->PointerToRawData; - break; - } - } - } - - return offset; -} - -typedef ULONG_PTR(WINAPI* LOADER)(PVOID); - int main() { - printf("%08x\n", ReflectiveLoaderOffset()); - auto buffer = ReadDllFile2("MemoryModule.dll"); - auto loader = LOADER(ULONG_PTR(buffer) + 0x96e0); //ReflectiveLoaderOffset() -> 0x96e0 - auto hm = (HMODULE)loader(buffer); - - MmpGlobalDataPtr = *(PMMP_GLOBAL_DATA*)GetProcAddress(hm, "MmpGlobalDataPtr"); - __LdrLoadDllMemoryExW = (decltype(&LdrLoadDllMemoryExW))GetProcAddress(hm, "LdrLoadDllMemoryExW"); - __LdrUnloadDllMemory = (decltype(&LdrUnloadDllMemory))GetProcAddress(hm, "LdrUnloadDllMemory"); DisplayStatus(); + test(); return 0; diff --git a/test/test.vcxproj b/test/test.vcxproj index f6c4203..a7616ce 100644 --- a/test/test.vcxproj +++ b/test/test.vcxproj @@ -1,10 +1,26 @@ + + Debug + ARM + + + Debug + ARM64 + Debug Win32 + + Release + ARM + + + Release + ARM64 + Release Win32 @@ -32,6 +48,12 @@ v142 Unicode + + Application + true + v142 + Unicode + Application false @@ -39,12 +61,25 @@ true Unicode + + Application + false + v142 + true + Unicode + Application true v142 Unicode + + Application + true + v142 + Unicode + Application false @@ -52,6 +87,13 @@ true Unicode + + Application + false + v142 + true + Unicode + @@ -60,28 +102,52 @@ + + + + + + + + + + + + true + + true + true + + true + false + + false + false + + false + @@ -97,6 +163,21 @@ true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreadedDebug + + + Console + true + + @@ -112,6 +193,21 @@ true + + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreadedDebug + + + Console + true + + @@ -131,6 +227,25 @@ true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreaded + + + Console + true + true + true + + @@ -152,18 +267,52 @@ + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + MultiThreaded + + + Console + true + true + true + + + + + + + + + + + + + + + {5b1f46db-036e-4a50-af5f-f5d6584d42c6} + +