Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- //Dll loader in remote process
- DWORD __stdcall LibraryLoader(LPVOID memory)
- {
- LoaderData* loaderParams = (LoaderData*)memory;
- PIMAGE_BASE_RELOCATION imageRelocation = loaderParams->baseReloc;
- DWORD delta = (DWORD)((LPBYTE)loaderParams->imageBase - loaderParams->ntHeaders->OptionalHeader.ImageBase);
- while (imageRelocation->VirtualAddress)
- {
- if (imageRelocation->SizeOfBlock >= sizeof(PIMAGE_BASE_RELOCATION))
- {
- int count = (imageRelocation->SizeOfBlock - sizeof(PIMAGE_BASE_RELOCATION) / sizeof(WORD);
- PWORD list = (PWORD)(imageRelocation + 1);
- for (int i = 0; i < count; i++)
- {
- if (list[i])
- {
- PDWORD ptr = (PDWORD)((LPBYTE)loaderParams->imageBase + (imageRelocation->VirtualAddress + (list[i] & 0xFFF)));
- ptr += delta;
- }
- }
- }
- }
- PIMAGE_IMPORT_DESCRIPTOR importDesc = loaderParams->importDir;
- while (importDesc->Characteristics)
- {
- PIMAGE_THUNK_DATA origFirstThunk = (PIMAGE_THUNK_DATA)((LPBYTE)loaderParams->imageBase + importDesc->OriginalFirstThunk);
- PIMAGE_THUNK_DATA firstThunk = (PIMAGE_THUNK_DATA)((LPBYTE)loaderParams->imageBase + importDesc->FirstThunk);
- HMODULE hModule = loaderParams->fnLoadLibraryA((LPCSTR)loaderParams->imageBase + importDesc->Name);
- if (!hModule) return false;
- while (origFirstThunk->u1.AddressOfData)
- {
- if (origFirstThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG)
- {
- //Import by ordinal
- DWORD function = (DWORD)loaderParams->fnGetProcAddress(hModule, (LPCSTR)(origFirstThunk->u1.Ordinal & 0xFFF));
- if (!function) return false;
- firstThunk->u1.Function = function;
- }
- else
- {
- //Import by name
- PIMAGE_IMPORT_BY_NAME pINB = (PIMAGE_IMPORT_BY_NAME)((LPBYTE)loaderParams->imageBase + origFirstThunk->u1.AddressOfData);
- DWORD function = (DWORD)loaderParams->fnGetProcAddress(hModule, (LPCSTR)pINB->Name);
- if (!function) return false;
- firstThunk->u1.Function = function;
- }
- origFirstThunk++;
- firstThunk++;
- }
- importDesc++;
- }
- if (loaderParams->ntHeaders->OptionalHeader.AddressOfEntryPoint)
- {
- dllmain entryPoint = (dllmain)((LPBYTE)loaderParams->imageBase + loaderParams->ntHeaders->OptionalHeader.AddressOfEntryPoint);
- return entryPoint((HMODULE)loaderParams->imageBase, DLL_PROCESS_ATTACH, NULL);
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement