From a32f925e8c9e273d7049781ed46cc2c5ad3ffb2f Mon Sep 17 00:00:00 2001 From: Boring <1079299053@qq.com> Date: Mon, 6 Feb 2023 16:04:03 +0800 Subject: [PATCH] Removed some redundant definitions --- MemoryModule/LoadDllMemoryApi.cpp | 72 +++++++++++++++++++++---------- MemoryModule/Loader.cpp | 37 +--------------- MemoryModule/Loader.h | 17 -------- MemoryModule/MemoryModulePP.def | 2 - 4 files changed, 50 insertions(+), 78 deletions(-) diff --git a/MemoryModule/LoadDllMemoryApi.cpp b/MemoryModule/LoadDllMemoryApi.cpp index 1d06a95..3e61cdf 100644 --- a/MemoryModule/LoadDllMemoryApi.cpp +++ b/MemoryModule/LoadDllMemoryApi.cpp @@ -1,27 +1,5 @@ #include "stdafx.h" - -HMEMORYMODULE WINAPI LoadLibraryMemory(_In_ PVOID BufferAddress) { - HMEMORYMODULE hMemoryModule = nullptr; - NTSTATUS status = LdrLoadDllMemory(&hMemoryModule, BufferAddress, 0); - if (!NT_SUCCESS(status) || status == STATUS_IMAGE_MACHINE_TYPE_MISMATCH) { - SetLastError(RtlNtStatusToDosError(status)); - } - return hMemoryModule; -} - -HMEMORYMODULE WINAPI LoadLibraryMemoryExA( - _In_ PVOID BufferAddress, - _In_ size_t Reserved, - _In_opt_ LPCSTR DllBaseName, - _In_opt_ LPCSTR DllFullName, - _In_ DWORD Flags) { - HMEMORYMODULE hMemoryModule = nullptr; - NTSTATUS status = LdrLoadDllMemoryExA(&hMemoryModule, nullptr, Flags, BufferAddress, Reserved, DllBaseName, DllFullName); - if (!NT_SUCCESS(status) || status == STATUS_IMAGE_MACHINE_TYPE_MISMATCH) { - SetLastError(RtlNtStatusToDosError(status)); - } - return hMemoryModule; -} +#include HMEMORYMODULE WINAPI LoadLibraryMemoryExW( _In_ PVOID BufferAddress, @@ -37,6 +15,54 @@ HMEMORYMODULE WINAPI LoadLibraryMemoryExW( return hMemoryModule; } +HMEMORYMODULE WINAPI LoadLibraryMemoryExA( + _In_ PVOID BufferAddress, + _In_ size_t Reserved, + _In_opt_ LPCSTR DllBaseName, + _In_opt_ LPCSTR DllFullName, + _In_ DWORD Flags) { + LPWSTR _DllName = nullptr, _DllFullName = nullptr; + size_t size; + HMEMORYMODULE result = nullptr; + HANDLE heap = NtCurrentPeb()->ProcessHeap; + + do { + if (DllBaseName) { + size = strlen(DllBaseName) + 1; + _DllName = (LPWSTR)RtlAllocateHeap(heap, 0, sizeof(WCHAR) * size); + + if (!_DllName) { + RtlNtStatusToDosError(STATUS_INSUFFICIENT_RESOURCES); + break; + } + + mbstowcs_s(nullptr, _DllName, size, DllBaseName, size); + } + + if (DllFullName) { + size = strlen(DllFullName) + 1; + _DllFullName = (LPWSTR)RtlAllocateHeap(heap, 0, sizeof(WCHAR) * size); + + if (!_DllFullName) { + RtlNtStatusToDosError(STATUS_INSUFFICIENT_RESOURCES); + break; + } + + mbstowcs_s(nullptr, _DllFullName, size, DllFullName, size); + } + + result = LoadLibraryMemoryExW(BufferAddress, 0, _DllName, _DllFullName, 0); + } while (false); + + RtlFreeHeap(heap, 0, _DllName); + RtlFreeHeap(heap, 0, _DllFullName); + return result; +} + +HMEMORYMODULE WINAPI LoadLibraryMemory(_In_ PVOID BufferAddress) { + return LoadLibraryMemoryExW(BufferAddress, 0, nullptr, nullptr, 0); +} + BOOL WINAPI FreeLibraryMemory(_In_ HMEMORYMODULE hMemoryModule) { NTSTATUS status = LdrUnloadDllMemory(hMemoryModule); if (!NT_SUCCESS(status)) { diff --git a/MemoryModule/Loader.cpp b/MemoryModule/Loader.cpp index 5ca1283..cd8c927 100644 --- a/MemoryModule/Loader.cpp +++ b/MemoryModule/Loader.cpp @@ -1,5 +1,4 @@ #include "stdafx.h" -#include static NTSTATUS NTAPI LdrMapDllMemory( _In_ HMEMORYMODULE ViewBase, @@ -34,13 +33,6 @@ static NTSTATUS NTAPI LdrMapDllMemory( return STATUS_SUCCESS; } -NTSTATUS NTAPI LdrLoadDllMemory( - _Out_ HMEMORYMODULE* BaseAddress, - _In_ LPVOID BufferAddress, - _In_ size_t Reserved) { - return LdrLoadDllMemoryExW(BaseAddress, nullptr, 0, BufferAddress, Reserved, nullptr, nullptr); -} - NTSTATUS NTAPI LdrLoadDllMemoryExW( _Out_ HMEMORYMODULE* BaseAddress, _Out_opt_ PVOID* LdrEntry, @@ -198,33 +190,6 @@ NTSTATUS NTAPI LdrLoadDllMemoryExW( return status; } -NTSTATUS NTAPI LdrLoadDllMemoryExA( - _Out_ HMEMORYMODULE* BaseAddress, - _Out_opt_ PVOID* LdrEntry, - _In_ DWORD dwFlags, - _In_ LPVOID BufferAddress, - _In_ size_t BufferSize, - _In_opt_ LPCSTR DllName, - _In_opt_ LPCSTR DllFullName) { - LPWSTR _DllName = nullptr, _DllFullName = nullptr; - size_t size; - NTSTATUS status; - if (DllName) { - size = strlen(DllName) + 1; - _DllName = new wchar_t[size]; - mbstowcs_s(nullptr, _DllName, size, DllName, size); - } - if (DllFullName) { - size = strlen(DllFullName) + 1; - _DllFullName = new wchar_t[size]; - mbstowcs_s(nullptr, _DllFullName, size, DllFullName, size); - } - status = LdrLoadDllMemoryExW(BaseAddress, LdrEntry, dwFlags, BufferAddress, BufferSize, _DllName, _DllFullName); - delete[]_DllName; - delete[]_DllFullName; - return status; -} - NTSTATUS NTAPI LdrUnloadDllMemory(_In_ HMEMORYMODULE BaseAddress) { PLDR_DATA_TABLE_ENTRY CurEntry; ULONG count = 0; @@ -291,7 +256,7 @@ NTSTATUS NTAPI LdrUnloadDllMemory(_In_ HMEMORYMODULE BaseAddress) { return status; } -__declspec(noreturn) +DECLSPEC_NORETURN VOID NTAPI LdrUnloadDllMemoryAndExitThread(_In_ HMEMORYMODULE BaseAddress, _In_ DWORD dwExitCode) { LdrUnloadDllMemory(BaseAddress); RtlExitUserThread(dwExitCode); diff --git a/MemoryModule/Loader.h b/MemoryModule/Loader.h index 2819b3e..9ce45ed 100644 --- a/MemoryModule/Loader.h +++ b/MemoryModule/Loader.h @@ -1,12 +1,5 @@ #pragma once -//Load dll from the provided buffer. -NTSTATUS NTAPI LdrLoadDllMemory( - _Out_ HMEMORYMODULE* BaseAddress, // Output module base address - _In_ LPVOID BufferAddress, // Pointer to the dll file data buffer - _In_ size_t Reserved // Reserved parameter, must be 0 -); - #define MEMORY_FEATURE_SUPPORT_VERSION 0x00000001 #define MEMORY_FEATURE_MODULE_BASEADDRESS_INDEX 0x00000002 /* Windows8 and greater */ #define MEMORY_FEATURE_LDRP_HEAP 0x00000004 @@ -65,16 +58,6 @@ NTSTATUS NTAPI LdrLoadDllMemoryExW( _In_opt_ LPCWSTR DllFullName // Module file full path ); -NTSTATUS NTAPI LdrLoadDllMemoryExA( - _Out_ HMEMORYMODULE* BaseAddress, - _Out_opt_ PVOID* LdrEntry, - _In_ DWORD dwFlags, - _In_ LPVOID BufferAddress, - _In_ size_t Reserved, - _In_opt_ LPCSTR DllName, - _In_opt_ LPCSTR DllFullName -); - //Unload modules previously loaded from memory NTSTATUS NTAPI LdrUnloadDllMemory(_In_ HMEMORYMODULE BaseAddress); diff --git a/MemoryModule/MemoryModulePP.def b/MemoryModule/MemoryModulePP.def index 98b8e4f..7491bc1 100644 --- a/MemoryModule/MemoryModulePP.def +++ b/MemoryModule/MemoryModulePP.def @@ -5,8 +5,6 @@ LoadLibraryMemoryExA LoadLibraryMemoryExW FreeLibraryMemory -LdrLoadDllMemory -LdrLoadDllMemoryExA LdrLoadDllMemoryExW LdrUnloadDllMemory LdrUnloadDllMemoryAndExitThread