diff --git a/trunk/Injector/Injector.c b/trunk/Injector/Injector.c index e2a46b17c..d90ee50b4 100644 --- a/trunk/Injector/Injector.c +++ b/trunk/Injector/Injector.c @@ -18,6 +18,8 @@ * along with this program. If not, see . */ +#define UNICODE + #include #include #include @@ -34,14 +36,14 @@ typedef BOOL (__stdcall *RCreateProcessW)( LPCWSTR lpCurrentDirectory, LPSTARTUPINFOW lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation - ); + ); typedef BOOL (__stdcall *RCloseHandle)(HANDLE handle); typedef BOOL (__stdcall *RExitProcess)(DWORD ExitCode); #define MAX_STR 4000 #define MAX_CODE 8192 -#define STREQ(x,y) (wcscmp((x), _T(y)) == 0) +#define STREQ(x,y) (wcscmp((x), L##y) == 0) #define MODE_CMDLINE 1 #define MODE_CREATEPROCESSA 2 #define MODE_CREATEPROCESSC 3 @@ -49,13 +51,13 @@ typedef BOOL (__stdcall *RExitProcess)(DWORD ExitCode); struct data_struct_s { - DWORD last_error; // error code from thread - RCreateProcessW fCPW; - RCloseHandle fCH; - RExitProcess fEP; - RGetCommandLineW fGCLW; - wchar_t winsta_desktop[64]; - wchar_t str[MAX_STR]; + DWORD last_error; // error code from thread + RCreateProcessW fCPW; + RCloseHandle fCH; + RExitProcess fEP; + RGetCommandLineW fGCLW; + wchar_t winsta_desktop[64]; + wchar_t str[MAX_STR]; }; typedef struct data_struct_s data_struct; @@ -66,291 +68,296 @@ void Ep(data_struct *data); DWORD CpApp(data_struct *data); DWORD CpCmd(data_struct *data); DWORD GRcl(data_struct *data); -BOOL EnableTokenPrivilege(LPCTSTR pszPrivilege); +BOOL EnableTokenPrivilege(LPWSTR pszPrivilege); -int _tmain(int argc, wchar_t *argv[]) +int main() { - HANDLE handle = 0; - DWORD old_protect; - DWORD pid; - wchar_t *mode_str; - DWORD mode = 0; - void *local_code = 0; - void *remote_code = 0; - data_struct *remote_data = 0; - data_struct local_data; - DWORD return_code = 0; - HMODULE kernel32 = 0; - HANDLE remote_thread = 0; - DWORD rc = 0; - wchar_t *winsta_desktop = GetDesktopName(); - - if (!EnableTokenPrivilege(SE_DEBUG_NAME)) - printf("Could not get debug privilege!\n"); + int argc; + wchar_t **argv; + + HANDLE handle = 0; + DWORD old_protect; + DWORD pid; + wchar_t *mode_str; + DWORD mode = 0; + void *local_code = 0; + void *remote_code = 0; + data_struct *remote_data = 0; + data_struct local_data; + DWORD return_code = 0; + HMODULE kernel32 = 0; + HANDLE remote_thread = 0; + DWORD rc = 0; + wchar_t *winsta_desktop = GetDesktopName(); + + argv = CommandLineToArgvW(GetCommandLineW(), &argc); + + if (!EnableTokenPrivilege(SE_DEBUG_NAME)) + printf("Could not get debug privilege!\n"); - if (argc < 3) - { - printf("Need more arguments.\n"); - return ERROR_INVALID_PARAMETER; - } + if (argc < 3) + { + printf("Need more arguments.\n"); + return ERROR_INVALID_PARAMETER; + } - mode_str = argv[1]; + mode_str = argv[1]; - if (STREQ(mode_str, "cmdline")) - mode = MODE_CMDLINE; - else if (STREQ(mode_str, "createprocess")) - mode = MODE_CREATEPROCESSA; - else if (STREQ(mode_str, "createprocessa")) - mode = MODE_CREATEPROCESSA; - else if (STREQ(mode_str, "createprocessc")) - mode = MODE_CREATEPROCESSC; - else if (STREQ(mode_str, "exitprocess")) - mode = MODE_EXITPROCESS; - else - { - printf("Invalid mode.\n"); - return ERROR_INVALID_PARAMETER; - } - - pid = _wtoi(argv[2]); - - if (argc > 3) - wcscpy(local_data.str, argv[3]); - else - local_data.str[0] = 0; + if (STREQ(mode_str, "cmdline")) + mode = MODE_CMDLINE; + else if (STREQ(mode_str, "createprocess")) + mode = MODE_CREATEPROCESSA; + else if (STREQ(mode_str, "createprocessa")) + mode = MODE_CREATEPROCESSA; + else if (STREQ(mode_str, "createprocessc")) + mode = MODE_CREATEPROCESSC; + else if (STREQ(mode_str, "exitprocess")) + mode = MODE_EXITPROCESS; + else + { + wprintf(L"Invalid mode %s.\n", mode_str); + return ERROR_INVALID_PARAMETER; + } + + pid = _wtoi(argv[2]); + + if (argc > 3) + wcscpy(local_data.str, argv[3]); + else + local_data.str[0] = 0; - wcscpy(local_data.winsta_desktop, winsta_desktop); + wcscpy(local_data.winsta_desktop, winsta_desktop); - if (!(handle = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | - PROCESS_VM_WRITE | PROCESS_VM_READ, FALSE, pid))) - { - printf("Could not open process!\n"); - return GetLastError(); - } - - if (!(remote_code = VirtualAllocEx(handle, 0, MAX_CODE, MEM_COMMIT, PAGE_EXECUTE_READWRITE))) - { - printf("Could not allocate memory!\n"); - return_code = GetLastError(); - goto clean_up; - } + if (!(handle = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | + PROCESS_VM_WRITE | PROCESS_VM_READ, FALSE, pid))) + { + printf("Could not open process!\n"); + return GetLastError(); + } + + if (!(remote_code = VirtualAllocEx(handle, 0, MAX_CODE, MEM_COMMIT, PAGE_EXECUTE_READWRITE))) + { + printf("Could not allocate memory!\n"); + return_code = GetLastError(); + goto clean_up; + } - if (!(remote_data = (data_struct *)VirtualAllocEx(handle, 0, - sizeof(local_data), MEM_COMMIT, PAGE_READWRITE))) - { - printf("Could not allocate memory!\n"); - return_code = GetLastError(); - goto clean_up; - } + if (!(remote_data = (data_struct *)VirtualAllocEx(handle, 0, + sizeof(local_data), MEM_COMMIT, PAGE_READWRITE))) + { + printf("Could not allocate memory!\n"); + return_code = GetLastError(); + goto clean_up; + } - if (mode == MODE_CMDLINE) - local_code = &GRcl; - else if (mode == MODE_CREATEPROCESSA) - local_code = &CpApp; - else if (mode == MODE_CREATEPROCESSC) - local_code = &CpCmd; - else if (mode == MODE_EXITPROCESS) - local_code = &Ep; - - if (!WriteProcessMemory(handle, remote_code, local_code, MAX_CODE, 0)) - { - printf("Could not write remote code!\n"); - return_code = GetLastError(); - goto clean_up; - } + if (mode == MODE_CMDLINE) + local_code = &GRcl; + else if (mode == MODE_CREATEPROCESSA) + local_code = &CpApp; + else if (mode == MODE_CREATEPROCESSC) + local_code = &CpCmd; + else if (mode == MODE_EXITPROCESS) + local_code = &Ep; + + if (!WriteProcessMemory(handle, remote_code, local_code, MAX_CODE, 0)) + { + printf("Could not write remote code!\n"); + return_code = GetLastError(); + goto clean_up; + } - if (!VirtualProtectEx(handle, remote_code, MAX_CODE, PAGE_EXECUTE, &old_protect)) - printf("Warning: could not set page protection on code to PAGE_EXECUTE\n"); + if (!VirtualProtectEx(handle, remote_code, MAX_CODE, PAGE_EXECUTE, &old_protect)) + printf("Warning: could not set page protection on code to PAGE_EXECUTE\n"); - if (!(kernel32 = LoadLibrary(L"kernel32.dll"))) - { - printf("Could not load kernel32.dll!\n"); - return_code = GetLastError(); - goto clean_up; - } + if (!(kernel32 = LoadLibraryW(L"kernel32.dll"))) + { + printf("Could not load kernel32.dll!\n"); + return_code = GetLastError(); + goto clean_up; + } - local_data.last_error = 0; - - if (!(local_data.fGCLW = (RGetCommandLineW)GetProcAddress(kernel32, "GetCommandLineW"))) - { - printf("Could not get address of GetCommandLineW!\n"); - return_code = GetLastError(); - goto clean_up; - } - - if (!(local_data.fCPW = (RCreateProcessW)GetProcAddress(kernel32, "CreateProcessW"))) - { - printf("Could not get address of CreateProcessW!\n"); - return_code = GetLastError(); - goto clean_up; - } - - if (!(local_data.fCH = (RCloseHandle)GetProcAddress(kernel32, "CloseHandle"))) - { - printf("Could not get address of CloseHandle!\n"); - return_code = GetLastError(); - goto clean_up; - } - - if (!(local_data.fEP = (RExitProcess)GetProcAddress(kernel32, "ExitProcess"))) - { - printf("Could not get address of ExitProcess!\n"); - return_code = GetLastError(); - goto clean_up; - } + local_data.last_error = 0; + + if (!(local_data.fGCLW = (RGetCommandLineW)GetProcAddress(kernel32, "GetCommandLineW"))) + { + printf("Could not get address of GetCommandLineW!\n"); + return_code = GetLastError(); + goto clean_up; + } + + if (!(local_data.fCPW = (RCreateProcessW)GetProcAddress(kernel32, "CreateProcessW"))) + { + printf("Could not get address of CreateProcessW!\n"); + return_code = GetLastError(); + goto clean_up; + } + + if (!(local_data.fCH = (RCloseHandle)GetProcAddress(kernel32, "CloseHandle"))) + { + printf("Could not get address of CloseHandle!\n"); + return_code = GetLastError(); + goto clean_up; + } + + if (!(local_data.fEP = (RExitProcess)GetProcAddress(kernel32, "ExitProcess"))) + { + printf("Could not get address of ExitProcess!\n"); + return_code = GetLastError(); + goto clean_up; + } - if (!WriteProcessMemory(handle, remote_data, &local_data, sizeof(local_data), 0)) - { - printf("Could not write remote data!\n"); - return_code = GetLastError(); - goto clean_up; - } + if (!WriteProcessMemory(handle, remote_data, &local_data, sizeof(local_data), 0)) + { + printf("Could not write remote data!\n"); + return_code = GetLastError(); + goto clean_up; + } - if (!(remote_thread = CreateRemoteThread(handle, 0, 0, (LPTHREAD_START_ROUTINE)remote_code, - remote_data, 0, &rc))) - { - printf("Could not create remote thread!\n"); - return_code = GetLastError(); - goto clean_up; - } - - rc = WaitForSingleObject(remote_thread, 5000); + if (!(remote_thread = CreateRemoteThread(handle, 0, 0, (LPTHREAD_START_ROUTINE)remote_code, + remote_data, 0, &rc))) + { + printf("Could not create remote thread!\n"); + return_code = GetLastError(); + goto clean_up; + } + + rc = WaitForSingleObject(remote_thread, 5000); - if (mode == MODE_CMDLINE) - { - switch (rc) - { - case WAIT_TIMEOUT: - printf("WaitForSingleObject timed out!\n"); - goto clean_up; - case WAIT_FAILED: - printf("WaitForSingleObject failed!\n"); - return_code = GetLastError(); - goto clean_up; - case WAIT_OBJECT_0: - if (!ReadProcessMemory(handle, remote_data, &local_data, sizeof(local_data), 0)) - { - printf("Could not read process memory!\n"); - return_code = GetLastError(); - goto clean_up; - } + if (mode == MODE_CMDLINE) + { + switch (rc) + { + case WAIT_TIMEOUT: + printf("WaitForSingleObject timed out!\n"); + goto clean_up; + case WAIT_FAILED: + printf("WaitForSingleObject failed!\n"); + return_code = GetLastError(); + goto clean_up; + case WAIT_OBJECT_0: + if (!ReadProcessMemory(handle, remote_data, &local_data, sizeof(local_data), 0)) + { + printf("Could not read process memory!\n"); + return_code = GetLastError(); + goto clean_up; + } - if (local_data.last_error != 0) - { - printf("Error in remote thread!\n"); - return_code = GetLastError(); - goto clean_up; - } + if (local_data.last_error != 0) + { + printf("Error in remote thread!\n"); + return_code = GetLastError(); + goto clean_up; + } - return_code = 0; - - break; - } + return_code = 0; + + break; + } - wprintf(_T("%s"), local_data.str); - } + wprintf(L"%s", local_data.str); + } clean_up: - if (remote_code != 0) - VirtualFreeEx(handle, remote_code, 0, MEM_RELEASE); - if (remote_data != 0) - VirtualFreeEx(handle, remote_data, 0, MEM_RELEASE); + if (remote_code != 0) + VirtualFreeEx(handle, remote_code, 0, MEM_RELEASE); + if (remote_data != 0) + VirtualFreeEx(handle, remote_data, 0, MEM_RELEASE); - return return_code; + return return_code; } wchar_t *GetDesktopName() { - HDESK desktop = GetThreadDesktop(GetCurrentThreadId()); - wchar_t *desktop_name = 0; - DWORD required_size = 0; + HDESK desktop = GetThreadDesktop(GetCurrentThreadId()); + wchar_t *desktop_name = 0; + DWORD required_size = 0; - GetUserObjectInformation(desktop, UOI_NAME, desktop_name, 0, &required_size); - desktop_name = (wchar_t *)malloc(required_size); - GetUserObjectInformation(desktop, UOI_NAME, desktop_name, required_size, 0); + GetUserObjectInformation(desktop, UOI_NAME, desktop_name, 0, &required_size); + desktop_name = (wchar_t *)malloc(required_size); + GetUserObjectInformation(desktop, UOI_NAME, desktop_name, required_size, 0); - return desktop_name; + return desktop_name; } -static void Ep(data_struct *data) +void Ep(data_struct *data) { - data->fEP(0); + data->fEP(0); } -static DWORD CpApp(data_struct *data) +DWORD CpApp(data_struct *data) { - STARTUPINFOW startup_info; - PROCESS_INFORMATION proc_info; - - startup_info.cb = sizeof(startup_info); - startup_info.lpDesktop = data->winsta_desktop; - startup_info.lpTitle = NULL; - startup_info.dwFlags = STARTF_FORCEONFEEDBACK; + STARTUPINFOW startup_info; + PROCESS_INFORMATION proc_info; + + startup_info.cb = sizeof(startup_info); + startup_info.lpDesktop = data->winsta_desktop; + startup_info.lpTitle = NULL; + startup_info.dwFlags = STARTF_FORCEONFEEDBACK; - if (!data->fCPW(data->str, NULL, 0, 0, FALSE, 0, NULL, NULL, &startup_info, - &proc_info)) - { - data->last_error = 1; - return 1; - } + if (!data->fCPW(data->str, NULL, 0, 0, FALSE, 0, NULL, NULL, &startup_info, + &proc_info)) + { + data->last_error = 1; + return 1; + } - data->fCH(proc_info.hProcess); - data->fCH(proc_info.hThread); + data->fCH(proc_info.hProcess); + data->fCH(proc_info.hThread); - return 0; + return 0; } -static DWORD CpCmd(data_struct *data) +DWORD CpCmd(data_struct *data) { - STARTUPINFOW startup_info; - PROCESS_INFORMATION proc_info; - - startup_info.cb = sizeof(startup_info); - startup_info.lpDesktop = data->winsta_desktop; - startup_info.lpTitle = NULL; - startup_info.dwFlags = STARTF_FORCEONFEEDBACK; + STARTUPINFOW startup_info; + PROCESS_INFORMATION proc_info; + + startup_info.cb = sizeof(startup_info); + startup_info.lpDesktop = data->winsta_desktop; + startup_info.lpTitle = NULL; + startup_info.dwFlags = STARTF_FORCEONFEEDBACK; - if (!data->fCPW(NULL, data->str, 0, 0, FALSE, 0, NULL, NULL, &startup_info, - &proc_info)) - { - data->last_error = 1; - return 1; - } + if (!data->fCPW(NULL, data->str, 0, 0, FALSE, 0, NULL, NULL, &startup_info, + &proc_info)) + { + data->last_error = 1; + return 1; + } - data->fCH(proc_info.hProcess); - data->fCH(proc_info.hThread); + data->fCH(proc_info.hProcess); + data->fCH(proc_info.hThread); - return 0; + return 0; } -static DWORD GRcl(data_struct *data) +DWORD GRcl(data_struct *data) { - const wchar_t *src; - wchar_t *tgt, *end; + const wchar_t *src; + wchar_t *tgt, *end; - src = data->fGCLW(); - tgt = data->str; - end = &data->str[MAX_STR - 1]; + src = data->fGCLW(); + tgt = data->str; + end = &data->str[MAX_STR - 1]; - if (src == 0 || tgt == 0 || end == 0) - { - data->last_error = 1; - return 1; - } + if (src == 0 || tgt == 0 || end == 0) + { + data->last_error = 1; + return 1; + } - for (; *src != 0 && tgt < end; ++src, ++tgt) - *tgt = *src; + for (; *src != 0 && tgt < end; ++src, ++tgt) + *tgt = *src; - *tgt = 0; - data->last_error = 0; + *tgt = 0; + data->last_error = 0; - return 0; + return 0; } -BOOL EnableTokenPrivilege(LPCTSTR privilege) +BOOL EnableTokenPrivilege(LPWSTR privilege) { HANDLE token_handle = 0; - TOKEN_PRIVILEGES tkp = {0}; + TOKEN_PRIVILEGES tkp = {0}; if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &token_handle)) { @@ -359,11 +366,11 @@ BOOL EnableTokenPrivilege(LPCTSTR privilege) if (LookupPrivilegeValue(NULL, privilege, &tkp.Privileges[0].Luid)) { - tkp.PrivilegeCount = 1; + tkp.PrivilegeCount = 1; tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; AdjustTokenPrivileges(token_handle, FALSE, &tkp, 0, (PTOKEN_PRIVILEGES)NULL, 0); - CloseHandle(token_handle); + CloseHandle(token_handle); if (GetLastError() != ERROR_SUCCESS) return FALSE; @@ -371,7 +378,7 @@ BOOL EnableTokenPrivilege(LPCTSTR privilege) return TRUE; } - CloseHandle(token_handle); + CloseHandle(token_handle); return FALSE; } diff --git a/trunk/Injector/Injector.sln b/trunk/Injector/Injector.sln deleted file mode 100644 index 814fb621a..000000000 --- a/trunk/Injector/Injector.sln +++ /dev/null @@ -1,20 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 10.00 -# Visual C++ Express 2008 -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Injector", "Injector.vcproj", "{0676E20E-1836-4C31-AA5D-7AF107AB22A7}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Win32 = Debug|Win32 - Release|Win32 = Release|Win32 - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {0676E20E-1836-4C31-AA5D-7AF107AB22A7}.Debug|Win32.ActiveCfg = Debug|Win32 - {0676E20E-1836-4C31-AA5D-7AF107AB22A7}.Debug|Win32.Build.0 = Debug|Win32 - {0676E20E-1836-4C31-AA5D-7AF107AB22A7}.Release|Win32.ActiveCfg = Release|Win32 - {0676E20E-1836-4C31-AA5D-7AF107AB22A7}.Release|Win32.Build.0 = Release|Win32 - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/trunk/Injector/Injector.vcproj b/trunk/Injector/Injector.vcproj deleted file mode 100644 index ecbf64eab..000000000 --- a/trunk/Injector/Injector.vcproj +++ /dev/null @@ -1,185 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -