Advertisement
Guest User

asdasda

a guest
Mar 21st, 2018
161
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. //Dll loader in remote process
  2.     DWORD __stdcall LibraryLoader(LPVOID memory)
  3.     {
  4.         LoaderData* loaderParams = (LoaderData*)memory;
  5.  
  6.         PIMAGE_BASE_RELOCATION imageRelocation = loaderParams->baseReloc;
  7.  
  8.         DWORD delta = (DWORD)((LPBYTE)loaderParams->imageBase - loaderParams->ntHeaders->OptionalHeader.ImageBase);
  9.  
  10.         while (imageRelocation->VirtualAddress)
  11.         {
  12.             if (imageRelocation->SizeOfBlock >= sizeof(PIMAGE_BASE_RELOCATION))
  13.             {
  14.                 int count = (imageRelocation->SizeOfBlock - sizeof(PIMAGE_BASE_RELOCATION) / sizeof(WORD);
  15.                 PWORD list = (PWORD)(imageRelocation + 1);
  16.  
  17.                 for (int i = 0; i < count; i++)
  18.                 {
  19.                     if (list[i])
  20.                     {
  21.                         PDWORD ptr = (PDWORD)((LPBYTE)loaderParams->imageBase + (imageRelocation->VirtualAddress + (list[i] & 0xFFF)));
  22.                         ptr += delta;
  23.                     }
  24.                 }
  25.             }
  26.         }
  27.  
  28.         PIMAGE_IMPORT_DESCRIPTOR importDesc = loaderParams->importDir;
  29.         while (importDesc->Characteristics)
  30.         {
  31.             PIMAGE_THUNK_DATA origFirstThunk = (PIMAGE_THUNK_DATA)((LPBYTE)loaderParams->imageBase + importDesc->OriginalFirstThunk);
  32.             PIMAGE_THUNK_DATA firstThunk = (PIMAGE_THUNK_DATA)((LPBYTE)loaderParams->imageBase + importDesc->FirstThunk);
  33.  
  34.             HMODULE hModule = loaderParams->fnLoadLibraryA((LPCSTR)loaderParams->imageBase + importDesc->Name);
  35.             if (!hModule) return false;
  36.  
  37.             while (origFirstThunk->u1.AddressOfData)
  38.             {
  39.                 if (origFirstThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG)
  40.                 {
  41.                     //Import by ordinal
  42.                     DWORD function = (DWORD)loaderParams->fnGetProcAddress(hModule, (LPCSTR)(origFirstThunk->u1.Ordinal & 0xFFF));
  43.                     if (!function) return false;
  44.  
  45.                     firstThunk->u1.Function = function;
  46.                 }
  47.                 else
  48.                 {
  49.                     //Import by name
  50.                     PIMAGE_IMPORT_BY_NAME pINB = (PIMAGE_IMPORT_BY_NAME)((LPBYTE)loaderParams->imageBase + origFirstThunk->u1.AddressOfData);
  51.  
  52.                     DWORD function = (DWORD)loaderParams->fnGetProcAddress(hModule, (LPCSTR)pINB->Name);
  53.                     if (!function) return false;
  54.                    
  55.                     firstThunk->u1.Function = function;
  56.                 }
  57.                 origFirstThunk++;
  58.                 firstThunk++;
  59.             }
  60.             importDesc++;
  61.         }
  62.  
  63.         if (loaderParams->ntHeaders->OptionalHeader.AddressOfEntryPoint)
  64.         {
  65.             dllmain entryPoint = (dllmain)((LPBYTE)loaderParams->imageBase + loaderParams->ntHeaders->OptionalHeader.AddressOfEntryPoint);
  66.             return entryPoint((HMODULE)loaderParams->imageBase, DLL_PROCESS_ATTACH, NULL);
  67.         }
  68.     }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement