Advertisement
Guest User

Untitled

a guest
May 24th, 2019
103
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 4.08 KB | None | 0 0
  1. // dllmain.cpp : Define el punto de entrada de la aplicación DLL.
  2. #include "stdafx.h"
  3.  
  4. typedef enum
  5. {
  6. MONO_SECURITY_MODE_NONE,
  7. MONO_SECURITY_MODE_CORE_CLR,
  8. MONO_SECURITY_MODE_CAS,
  9. MONO_SECURITY_MODE_SMCS_HACK
  10. } MonoSecurityMode;
  11.  
  12. typedef PVOID(*mono_thread_get_main_t) (void);
  13. typedef PVOID(*mono_domain_get_t) (void);
  14. typedef int(*mono_get_root_domain_t) (void);
  15. typedef int(*mono_image_open_from_data_full_t) (int a_data, unsigned int a_data_len, int a_need_copy, int *a_status, int a_refonly);
  16. typedef int(*mono_assembly_load_from_full_t) (int a_image, int *a_fname, int *a_status, bool a_refonly);
  17. typedef int(*mono_domain_assembly_open_t)(PVOID a_domain, PCHAR a_file);
  18. typedef int(*mono_assembly_get_image_t) (int a_assembly);
  19. typedef PVOID(*mono_class_from_name_t) (int a_image, const char* a_name_space, const char *a_name);
  20. typedef PVOID(*mono_class_get_method_from_name_t) (PVOID a_klass, const char *a_name, int a_param_count);
  21. typedef int(*mono_runtime_invoke_t) (PVOID a_method, void *a_obj, void **a_params, int **a_exc);
  22. typedef int(*mono_runtime_exec_main_t) (PVOID a_method, void *a_args, void **a_params);
  23. typedef PVOID(*mono_thread_attach_t) (int a_domain);
  24. typedef void(*mono_security_set_t) (MonoSecurityMode a_security);
  25.  
  26. mono_security_set_t g_SetSecurity;
  27. mono_thread_get_main_t g_GetMainMonoThread;
  28. mono_domain_get_t g_GetMonoDomain;
  29. mono_get_root_domain_t g_GetRootMonoDomain;
  30. mono_image_open_from_data_full_t g_OpenImageFromDataFull;
  31. mono_domain_assembly_open_t g_OpenAssembly;
  32. mono_assembly_get_image_t g_GetAssemblyImageName;
  33. mono_class_from_name_t g_GetClassFromName;
  34. mono_class_get_method_from_name_t g_GetClassMethodFromName;
  35. mono_runtime_invoke_t g_InvokeRuntime;
  36. mono_runtime_exec_main_t g_ExecMain;
  37. mono_thread_attach_t g_MonoAttachToThread;
  38.  
  39. DWORD __stdcall Inject(LPVOID lpThreadParameter)
  40. {
  41. HMODULE hMono = NULL;
  42. do
  43. {
  44. Sleep(0xFAu);
  45. if (GetModuleHandleA("mono-1-vc.dll"))
  46. {
  47. hMono = GetModuleHandleA("mono-1-vc.dll");
  48. }
  49. else
  50. {
  51. if (!GetModuleHandleA("mono.dll"))
  52. continue;
  53. hMono = GetModuleHandleA("mono.dll");
  54. }
  55.  
  56. } while (!hMono);
  57. g_SetSecurity = (mono_security_set_t)GetProcAddress(hMono, "mono_security_set_mode");
  58. g_GetMainMonoThread = (mono_thread_get_main_t)GetProcAddress(hMono, "mono_thread_get_main");
  59. g_GetMonoDomain = (mono_domain_get_t)GetProcAddress(hMono, "mono_domain_get");
  60. g_GetRootMonoDomain = (mono_get_root_domain_t)GetProcAddress(hMono, "mono_get_root_domain");
  61. g_OpenImageFromDataFull = (mono_image_open_from_data_full_t)GetProcAddress(hMono, "mono_image_open_from_data");
  62. g_OpenAssembly = (mono_domain_assembly_open_t)GetProcAddress(hMono, "mono_domain_assembly_open");
  63. g_GetAssemblyImageName = (mono_assembly_get_image_t)GetProcAddress(hMono, "mono_assembly_get_image");
  64. g_GetClassFromName = (mono_class_from_name_t)GetProcAddress(hMono, "mono_class_from_name");
  65. g_GetClassMethodFromName = (mono_class_get_method_from_name_t)GetProcAddress(hMono, "mono_class_get_method_from_name");
  66. g_InvokeRuntime = (mono_runtime_invoke_t)GetProcAddress(hMono, "mono_runtime_invoke");
  67. g_ExecMain = (mono_runtime_exec_main_t)GetProcAddress(hMono, "mono_runtime_exec_main");
  68. g_MonoAttachToThread = (mono_thread_attach_t)GetProcAddress(hMono, "mono_thread_attach");
  69.  
  70. g_MonoAttachToThread(g_GetRootMonoDomain());
  71.  
  72. g_SetSecurity(MONO_SECURITY_MODE_NONE);
  73.  
  74. PVOID domain = g_GetMonoDomain();
  75. int domainassembly = g_OpenAssembly(domain, "C:\\path\\to\\your.dll");
  76. int Image = g_GetAssemblyImageName(domainassembly);
  77. PVOID MonoClass = g_GetClassFromName(Image, "NameSpace", "ClassName");
  78. PVOID MonoClassMethod = g_GetClassMethodFromName(MonoClass, "MethoodName", 0);
  79. g_InvokeRuntime(MonoClassMethod, NULL, NULL, NULL);
  80.  
  81. return 0;
  82. }
  83.  
  84. BOOL APIENTRY DllMain( HMODULE hModule,
  85. DWORD ul_reason_for_call,
  86. LPVOID lpReserved
  87. )
  88. {
  89. switch (ul_reason_for_call)
  90. {
  91. case DLL_PROCESS_ATTACH: {
  92. CreateThread(0, 0, Inject, 0, 0, 0);
  93. break;
  94. }
  95. case DLL_THREAD_ATTACH:
  96. case DLL_THREAD_DETACH:
  97. case DLL_PROCESS_DETACH:
  98. break;
  99. }
  100. return TRUE;
  101. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement