admin/bb107-MemoryModulePP
1
0
Fork 0
mirror of https://github.com/bb107/MemoryModulePP synced 2026-06-08 13:15:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

ImportTableResolver

Browse Source
This commit is contained in:
Boring
2023-10-08 14:43:39 +08:00
parent bb249e5625
commit 73af5f1678
11 changed files with 338 additions and 190 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/test.cpp
+67 -86
View File
@@ -4,6 +4,31 @@
//PMMP_GLOBAL_DATA MmpGlobalDataPtr = *(PMMP_GLOBAL_DATA*)GetProcAddress(GetModuleHandleA("MemoryModule.dll"), "MmpGlobalDataPtr");
static void DisplayStatus() {
printf(
"\
MemoryModulePP [Version %d.%d%s]\n\n\t\
MmpFeatures = %08X\n\n\t\
LdrpModuleBaseAddressIndex = %p\n\t\
NtdllLdrEntry = %p\n\t\
RtlRbInsertNodeEx = %p\n\t\
RtlRbRemoveNode = %p\n\n\t\
LdrpInvertedFunctionTable = %p\n\n\t\
LdrpHashTable = %p\n\n\
",
MmpGlobalDataPtr->MajorVersion,
MEMORY_MODULE_GET_MINOR_VERSION(MmpGlobalDataPtr->MinorVersion),
MEMORY_MODULE_IS_PREVIEW(MmpGlobalDataPtr->MinorVersion) ? " Preview" : "",
MmpGlobalDataPtr->MmpFeatures,
MmpGlobalDataPtr->MmpBaseAddressIndex->LdrpModuleBaseAddressIndex,
MmpGlobalDataPtr->MmpBaseAddressIndex->NtdllLdrEntry,
MmpGlobalDataPtr->MmpBaseAddressIndex->_RtlRbInsertNodeEx,
MmpGlobalDataPtr->MmpBaseAddressIndex->_RtlRbRemoveNode,
MmpGlobalDataPtr->MmpInvertedFunctionTable->LdrpInvertedFunctionTable,
MmpGlobalDataPtr->MmpLdrEntry->LdrpHashTable
);
}
static PVOID ReadDllFile(LPCSTR FileName) {
LPVOID buffer;
size_t size;
@@ -21,21 +46,6 @@ static PVOID ReadDllFile(LPCSTR FileName) {
return buffer;
}
static void DisplayStatus() {
printf(
"MemoryModulePP [Version %d.%d]\n\n\tMmpFeatures = %08X\n\n\tLdrpModuleBaseAddressIndex = %p\n\tNtdllLdrEntry = %p\n\tRtlRbInsertNodeEx = %p\n\tRtlRbRemoveNode = %p\n\n\tLdrpInvertedFunctionTable = %p\n\n\tLdrpHashTable = %p\n\n",
MmpGlobalDataPtr->MajorVersion,
MmpGlobalDataPtr->MinorVersion,
MmpGlobalDataPtr->MmpFeatures,
MmpGlobalDataPtr->MmpBaseAddressIndex->LdrpModuleBaseAddressIndex,
MmpGlobalDataPtr->MmpBaseAddressIndex->NtdllLdrEntry,
MmpGlobalDataPtr->MmpBaseAddressIndex->_RtlRbInsertNodeEx,
MmpGlobalDataPtr->MmpBaseAddressIndex->_RtlRbRemoveNode,
MmpGlobalDataPtr->MmpInvertedFunctionTable->LdrpInvertedFunctionTable,
MmpGlobalDataPtr->MmpLdrEntry->LdrpHashTable
);
}
PVOID ReadDllFile2(LPCSTR FileName) {
CHAR path[MAX_PATH + 4];
DWORD len = GetModuleFileNameA(nullptr, path, sizeof(path));
@@ -52,91 +62,62 @@ PVOID ReadDllFile2(LPCSTR FileName) {
return nullptr;
}
int test() {
LPVOID buffer = ReadDllFile2("a.dll");
#define LIBRARY_PATH "\\\\DESKTOP-1145141919810\\Debug\\"
HMEMORYMODULE m1 = nullptr, m2 = m1;
HMODULE hModule = nullptr;
FARPROC pfn = nullptr;
DWORD MemoryModuleFeatures = 0;
HMODULE WINAPI MyLoadLibrary(LPCSTR lpModuleName) {
HMODULE hModule;
PVOID buffer;
typedef int(*_exception)(int code);
_exception exception = nullptr;
HRSRC hRsrc;
DWORD SizeofRes;
HGLOBAL gRes;
char str[10];
LdrQuerySystemMemoryModuleFeatures(&MemoryModuleFeatures);
if (MemoryModuleFeatures != MEMORY_FEATURE_ALL) {
printf("not support all features on this version of windows.\n");
if (0 == _stricmp(lpModuleName, "CTestClassLibrary1.dll")) {
buffer = ReadDllFile(LIBRARY_PATH"CTestClassLibrary1.dll");
}
if (!NT_SUCCESS(LdrLoadDllMemoryExW(&m1, nullptr, 0, buffer, 0, L"kernel64", nullptr))) goto end;
LoadLibraryW(L"wininet.dll");
if (!NT_SUCCESS(LdrLoadDllMemoryExW(&m2, nullptr, 0, buffer, 0, L"kernel128", nullptr))) goto end;
//forward export
hModule = (HMODULE)m1;
pfn = (decltype(pfn))(GetProcAddress(hModule, "Socket")); //ws2_32.WSASocketW
pfn = (decltype(pfn))(GetProcAddress(hModule, "VerifyTruse")); //wintrust.WinVerifyTrust
hModule = (HMODULE)m2;
pfn = (decltype(pfn))(GetProcAddress(hModule, "Socket"));
pfn = (decltype(pfn))(GetProcAddress(hModule, "VerifyTruse"));
//exception
hModule = (HMODULE)m1;
exception = (_exception)GetProcAddress(hModule, "exception");
if (exception) {
for (int i = 0; i < 5; ++i)exception(i);
else if (0 == _stricmp(lpModuleName, "CTestClassLibrary2.dll")) {
buffer = ReadDllFile(LIBRARY_PATH"CTestClassLibrary2.dll");
}
//tls
pfn = GetProcAddress(hModule, "thread");
if (pfn && pfn()) {
printf("thread test failed.\n");
}
//resource
if (!LoadStringA(hModule, 101, str, 10)) {
printf("load string failed.\n");
else if (0 == _stricmp(lpModuleName, "CTestClassLibrary1Dep.dll")) {
buffer = ReadDllFile(LIBRARY_PATH"CTestClassLibrary1Dep.dll");
}
else {
printf("%s\n", str);
}
if (!(hRsrc = FindResourceA(hModule, MAKEINTRESOURCEA(102), "BINARY"))) {
printf("find binary resource failed.\n");
}
else {
if ((SizeofRes = SizeofResource(hModule, hRsrc)) != 0x10) {
printf("invalid res size.\n");
}
else {
if (!(gRes = LoadResource(hModule, hRsrc))) {
printf("load res failed.\n");
}
else {
if (!LockResource(gRes))printf("lock res failed.\n");
else {
printf("resource test success.\n");
}
}
}
return nullptr;
}
end:
hModule = LoadLibraryMemoryExA(buffer, 0, lpModuleName, nullptr, 0);
delete[]buffer;
if (m1)LdrUnloadDllMemory(m1);
FreeLibrary(LoadLibraryW(L"wininet.dll"));
FreeLibrary(GetModuleHandleW(L"wininet.dll"));
if (m2)LdrUnloadDllMemory(m2);
return hModule;
}
return 0;
VOID TestImportTableResolver() {
//
// Register the import table resolver.
//
HANDLE hResolver = MmRegisterImportTableResolver(MyLoadLibrary, FreeLibraryMemory);
//
// |-> CTestClassLibrary1.dll -> CTestClassLibrary1Dep.dll
// CTestClient.dll -|
// |-> CTestClassLibrary2.dll
//
PVOID Client = ReadDllFile2("CTestClient.dll");
HMODULE hm = LoadLibraryMemoryEx(Client, 0, TEXT("CTestClient.dll"), nullptr, 0);
delete[]Client;
if (hm) {
auto pfn = GetProcAddress(hm, "TestProc");
if (pfn) {
pfn();
}
FreeLibraryMemory(hm);
}
MmRemoveImportTableResolver(hResolver);
}
int main() {
DisplayStatus();
test();
TestImportTableResolver();
return 0;
}