Redirect Execution

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar

//If a new thread is created in a process, the system makes sure that DllMain's of loaded
//DLLs gets called in the context of the new thread. This is accomplished by iterating
//through all _LDR_MODULE nodes of the "InMemoryOrderModuleList" doubly-linked list.
//The DllMain of a DLL is called if certain conditions are met:
// (1) The new thread is not exempted from calling DllMain's. See "SkipThreadAttach" flag of TEB.
// (2) The _LDR_MODULE node does not belong to the main executable e.g. "calc.exe".
// (3) The _LDR_MODULE node does not have the "LDRP_DONT_CALL_FOR_THREADS"
//     flag set. see "DisableThreadLibraryCalls" function.
// (4) The LDR_MODULE node has a non-zero entrypoint.
//     N.B. ntdll.dll meets all conditions except that its entrypoint is always zero.
// (5) The LDR_MODULE node has the "LDRP_PROCESS_ATTACH_CALLED" flag set. i.e. Its DllMain was
//     previously called as part of the "DLL_PROCESS_ATTACH" reason.
// (6) The LDR_MODULE node has the "LDRP_IMAGE_DLL" flag set. i.e. the image is loaded in an
//     executable state. N.B. Dlls loaded via the "LoadLibraryExW" function
//     with the "DONT_RESOLVE_DLL_REFERENCES" flag don't have this flag set.

//Given the above knowledge, we can fool ntdll to think that our main executable is a Dll that needs
//to have its DllMain called upon threads creation and termination. This gives us a new way to redirect
//execution.

//This manipulation may result into certain functions e.g. GetModuleFileNameEx failing to behave,
//and this why we should undo the manipulation.

#include "stdafx.h"
#include "windows.h"
#include "stdio.h"




#define LDRP_IMAGE_DLL                          0x00000004
#define LDRP_ENTRY_PROCESSED                    0x00004000
#define LDRP_PROCESS_ATTACH_CALLED              0x00080000

extern "C"
{
    void __stdcall LdrFindEntryForAddress(unsigned long addr,void* pLdrModule);
}

__declspec(naked) void dummy()
{
    __asm ret
}

void Restore()
{
        //restore original LDR_MODULE
        __asm
        {
            pushad
            mov eax,dword ptr fs:[0x30] ;PEB
            mov esi,dword ptr[eax+0x8] ;ImageBase
            inc esi
            mov eax,dword ptr[eax+0xC]  ;_PEB->Ldr
            lea eax,[eax+0x14]          ;InMemoryOrderModuleList
            mov ebx,eax
looop:
            mov ebx,dword ptr[ebx]
            cmp esi,dword ptr[ebx+0x10]
            jne skip
            dec dword ptr[ebx+0x10]  //Restore original ImageBase
            mov dword ptr[ebx+0x34],LDRP_ENTRY_PROCESSED  //Restore original LDRP_** flags
skip:
            cmp ebx,eax
            jnz looop
            popad
        }
        return;
}
void main()
{
    static unsigned long i=0;
    if(i++==1)
    {
        Restore();
        //Do your own stuff here
        MessageBox(0,"Redirected!","waliedassar",0);
        ExitProcess(0);
    }
    unsigned long pLdrModule=0;
    LdrFindEntryForAddress((unsigned long)&main,&pLdrModule);
    (*(unsigned long*)(pLdrModule+0x18))++; //Change ImageBase
    *(unsigned long*)(pLdrModule+0x34)=LDRP_IMAGE_DLL|LDRP_PROCESS_ATTACH_CALLED;
    unsigned long tid=0;
    CreateThread(0,0x1000,(LPTHREAD_START_ROUTINE)dummy,0,0,&tid);
    Sleep(INFINITE);
    return;
}