Skip to content

Commit c958100

Browse files
bb107bb107
committed
Add support for ReflectiveLoader
1 parent 3018eed commit c958100

11 files changed

Lines changed: 809 additions & 27 deletions

‎MemoryModule/Initialize.cpp‎

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
#include "stdafx.h"
2+
#include "LoaderPrivate.h"
23
#include <wchar.h>
4+
#include <cassert>
35

46
PMMP_GLOBAL_DATA MmpGlobalDataPtr;
57

@@ -489,9 +491,42 @@ NTSTATUS NTAPI Initialize() {
489491
}
490492

491493
#ifdef _USRDLL
494+
extern "C" __declspec(dllexport) BOOL WINAPI ReflectiveMapDll(HMODULE hModule) {
495+
PIMAGE_NT_HEADERS headers = RtlImageNtHeader(hModule);
496+
497+
headers->OptionalHeader.ImageBase = (SIZE_T)hModule;
498+
499+
NTSTATUS status = MmpInitializeStructure(0, nullptr, headers);
500+
if (!NT_SUCCESS(status))return FALSE;
501+
502+
PMEMORYMODULE module = MapMemoryModuleHandle(hModule);
503+
if (!module)return FALSE;
504+
505+
PLDR_DATA_TABLE_ENTRY ModuleEntry;
506+
status = LdrMapDllMemory(hModule, 0, nullptr, nullptr, &ModuleEntry);
507+
if (!NT_SUCCESS(status))return FALSE;
508+
509+
status = RtlInsertInvertedFunctionTable(hModule, headers->OptionalHeader.SizeOfImage);
510+
if (!NT_SUCCESS(status)) return FALSE;
511+
512+
module->InsertInvertedFunctionTableEntry = true;
513+
module->MappedDll = true;
514+
module->LdrEntry = ModuleEntry;
515+
516+
return TRUE;
517+
}
518+
492519
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
493520
if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
494-
return NT_SUCCESS(Initialize());
521+
if (NT_SUCCESS(Initialize())) {
522+
if (lpReserved == (PVOID)-1) {
523+
assert(ReflectiveMapDll(hModule));
524+
}
525+
526+
return TRUE;
527+
}
528+
529+
return FALSE;
495530
}
496531

497532
return TRUE;

‎MemoryModule/Loader.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#include "stdafx.h"
22

3-
static NTSTATUS NTAPI LdrMapDllMemory(
3+
NTSTATUS NTAPI LdrMapDllMemory(
44
_In_ HMEMORYMODULE ViewBase,
55
_In_ DWORD dwFlags,
66
_In_opt_ PCWSTR DllName,

‎MemoryModule/LoaderPrivate.h‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#pragma once
2+
3+
NTSTATUS NTAPI LdrMapDllMemory(
4+
_In_ HMEMORYMODULE ViewBase,
5+
_In_ DWORD dwFlags,
6+
_In_opt_ PCWSTR DllName,
7+
_In_opt_ PCWSTR lpFullDllName,
8+
_Out_opt_ PLDR_DATA_TABLE_ENTRY* DataTableEntry
9+
);

‎MemoryModule/MemoryModule.cpp‎

Lines changed: 36 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,36 @@ BOOL WINAPI IsValidMemoryModuleHandle(HMEMORYMODULE hModule) {
5555
return MapMemoryModuleHandle(hModule) != nullptr;
5656
}
5757

58+
NTSTATUS MmpInitializeStructure(DWORD ImageFileSize, LPCVOID ImageFileBuffer, PIMAGE_NT_HEADERS ImageHeaders) {
59+
60+
if (!ImageHeaders)return STATUS_ACCESS_VIOLATION;
61+
62+
//
63+
// Make sure there have enough free space to embed our structure.
64+
//
65+
int sizeOfHeaders = MmpSizeOfImageHeadersUnsafe((PVOID)ImageHeaders->OptionalHeader.ImageBase);
66+
PIMAGE_SECTION_HEADER pSections = IMAGE_FIRST_SECTION(ImageHeaders);
67+
for (int i = 0; i < ImageHeaders->FileHeader.NumberOfSections; ++i) {
68+
if (pSections[i].VirtualAddress < sizeOfHeaders + sizeof(MEMORYMODULE)) {
69+
return STATUS_NOT_SUPPORTED;
70+
}
71+
}
72+
73+
//
74+
// Setup MemoryModule structure.
75+
//
76+
PMEMORYMODULE hMemoryModule = (PMEMORYMODULE)(ImageHeaders->OptionalHeader.ImageBase + sizeOfHeaders);
77+
RtlZeroMemory(hMemoryModule, sizeof(MEMORYMODULE));
78+
hMemoryModule->codeBase = (PBYTE)ImageHeaders->OptionalHeader.ImageBase;
79+
hMemoryModule->dwImageFileSize = ImageFileSize;
80+
hMemoryModule->Signature = MEMORY_MODULE_SIGNATURE;
81+
hMemoryModule->SizeofHeaders = ImageHeaders->OptionalHeader.SizeOfHeaders;
82+
hMemoryModule->lpReserved = (LPVOID)ImageFileBuffer;
83+
hMemoryModule->dwReferenceCount = 1;
84+
85+
return STATUS_SUCCESS;
86+
}
87+
5888

5989
NTSTATUS MemoryResolveImportTable(
6090
_In_ LPBYTE base,
@@ -280,31 +310,13 @@ NTSTATUS MemoryLoadLibrary(
280310
);
281311
new_header->OptionalHeader.ImageBase = (size_t)base;
282312

283-
//
284-
// Make sure there have enough free space to embed our structure.
285-
//
286-
int sizeOfHeaders = MmpSizeOfImageHeadersUnsafe(base);
287-
PIMAGE_SECTION_HEADER pSections = IMAGE_FIRST_SECTION(new_header);
288-
for (int i = 0; i < new_header->FileHeader.NumberOfSections; ++i) {
289-
if (pSections[i].VirtualAddress < sizeOfHeaders + sizeof(MEMORYMODULE)) {
290-
status = STATUS_NOT_SUPPORTED;
291-
return status;
292-
}
293-
}
294-
295-
//
296-
// Setup MemoryModule structure.
297-
//
298-
PMEMORYMODULE hMemoryModule = (PMEMORYMODULE)(base + sizeOfHeaders);
299-
RtlZeroMemory(hMemoryModule, sizeof(MEMORYMODULE));
300-
hMemoryModule->codeBase = base;
301-
hMemoryModule->dwImageFileSize = size;
302-
hMemoryModule->Signature = MEMORY_MODULE_SIGNATURE;
303-
hMemoryModule->SizeofHeaders = old_header->OptionalHeader.SizeOfHeaders;
304-
hMemoryModule->lpReserved = (LPVOID)data;
305-
hMemoryModule->dwReferenceCount = 1;
306-
307313
do {
314+
//
315+
// Setup MEMORYMODULE structure.
316+
//
317+
status = MmpInitializeStructure(size, data, new_header);
318+
if (!NT_SUCCESS(status)) break;
319+
308320
//
309321
// Allocate and copy sections
310322
//

‎MemoryModule/MemoryModule.h‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,12 @@ extern "C" {
8888

8989
PMEMORYMODULE WINAPI MapMemoryModuleHandle(HMEMORYMODULE hModule);
9090

91+
NTSTATUS MmpInitializeStructure(
92+
DWORD ImageFileSize,
93+
LPCVOID ImageFileBuffer,
94+
PIMAGE_NT_HEADERS ImageHeaders
95+
);
96+
9197
#ifdef __cplusplus
9298
}
9399
#endif

‎MemoryModule/MemoryModule.vcxproj‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,20 @@
5555
<ClCompile Include="InvertedFunctionTable.cpp" />
5656
<ClCompile Include="LdrEntry.cpp" />
5757
<ClCompile Include="BaseAddressIndex.cpp" />
58+
<ClCompile Include="ReflectiveLoader.c">
59+
<SupportJustMyCode Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">false</SupportJustMyCode>
60+
<SupportJustMyCode Condition="'$(Configuration)|$(Platform)'=='DebugDll|Win32'">false</SupportJustMyCode>
61+
<SupportJustMyCode Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">false</SupportJustMyCode>
62+
<SupportJustMyCode Condition="'$(Configuration)|$(Platform)'=='DebugDll|x64'">false</SupportJustMyCode>
63+
<BufferSecurityCheck Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">false</BufferSecurityCheck>
64+
<BufferSecurityCheck Condition="'$(Configuration)|$(Platform)'=='ReleaseDll|Win32'">false</BufferSecurityCheck>
65+
<BufferSecurityCheck Condition="'$(Configuration)|$(Platform)'=='DebugDll|Win32'">false</BufferSecurityCheck>
66+
<BufferSecurityCheck Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">false</BufferSecurityCheck>
67+
<BufferSecurityCheck Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">false</BufferSecurityCheck>
68+
<BufferSecurityCheck Condition="'$(Configuration)|$(Platform)'=='ReleaseDll|x64'">false</BufferSecurityCheck>
69+
<BufferSecurityCheck Condition="'$(Configuration)|$(Platform)'=='DebugDll|x64'">false</BufferSecurityCheck>
70+
<BufferSecurityCheck Condition="'$(Configuration)|$(Platform)'=='Release|x64'">false</BufferSecurityCheck>
71+
</ClCompile>
5872
<ClCompile Include="Utils.cpp" />
5973
</ItemGroup>
6074
<ItemGroup>
@@ -92,6 +106,7 @@
92106
<ClInclude Include="..\3rdparty\phnt\include\subprocesstag.h" />
93107
<ClInclude Include="..\3rdparty\phnt\include\winsta.h" />
94108
<ClInclude Include="LoadDllMemoryApi.h" />
109+
<ClInclude Include="LoaderPrivate.h" />
95110
<ClInclude Include="MemoryModule.h" />
96111
<ClInclude Include="MmpDotNet.h" />
97112
<ClInclude Include="MmpGlobalData.h" />
@@ -100,6 +115,8 @@
100115
<ClInclude Include="BaseAddressIndex.h" />
101116
<ClInclude Include="InvertedFunctionTable.h" />
102117
<ClInclude Include="LdrEntry.h" />
118+
<ClInclude Include="ReflectiveDLLInjection.h" />
119+
<ClInclude Include="ReflectiveLoader.h" />
103120
<ClInclude Include="stdafx.h" />
104121
<ClInclude Include="Utils.h" />
105122
</ItemGroup>

‎MemoryModule/MemoryModule.vcxproj.filters‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,12 @@
2828
<Filter Include="Header Files\3rdparty\phnt">
2929
<UniqueIdentifier>{e1243ce3-529c-401e-83a4-fe009cda27b1}</UniqueIdentifier>
3030
</Filter>
31+
<Filter Include="Header Files\3rdparty\ReflectiveLoader">
32+
<UniqueIdentifier>{3e49fb44-9cfb-4a48-b497-6fe396e1a258}</UniqueIdentifier>
33+
</Filter>
34+
<Filter Include="Source Files\3rdparty\ReflectiveLoader">
35+
<UniqueIdentifier>{4bbbea53-468a-49af-9b66-b61471058da1}</UniqueIdentifier>
36+
</Filter>
3137
</ItemGroup>
3238
<ItemGroup>
3339
<ClCompile Include="MemoryModule.cpp">
@@ -93,6 +99,9 @@
9399
<ClCompile Include="MmpLdrpTls.cpp">
94100
<Filter>Source Files</Filter>
95101
</ClCompile>
102+
<ClCompile Include="ReflectiveLoader.c">
103+
<Filter>Source Files\3rdparty\ReflectiveLoader</Filter>
104+
</ClCompile>
96105
</ItemGroup>
97106
<ItemGroup>
98107
<ClInclude Include="MemoryModule.h">
@@ -227,6 +236,15 @@
227236
<ClInclude Include="MmpGlobalData.h">
228237
<Filter>Header Files</Filter>
229238
</ClInclude>
239+
<ClInclude Include="ReflectiveLoader.h">
240+
<Filter>Header Files\3rdparty\ReflectiveLoader</Filter>
241+
</ClInclude>
242+
<ClInclude Include="ReflectiveDLLInjection.h">
243+
<Filter>Header Files\3rdparty\ReflectiveLoader</Filter>
244+
</ClInclude>
245+
<ClInclude Include="LoaderPrivate.h">
246+
<Filter>Header Files</Filter>
247+
</ClInclude>
230248
</ItemGroup>
231249
<ItemGroup>
232250
<None Include="..\README.md">

‎MemoryModule/ReflectiveDLLInjection.h‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
//===============================================================================================//
2+
// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
3+
// All rights reserved.
4+
//
5+
// Redistribution and use in source and binary forms, with or without modification, are permitted
6+
// provided that the following conditions are met:
7+
//
8+
// * Redistributions of source code must retain the above copyright notice, this list of
9+
// conditions and the following disclaimer.
10+
//
11+
// * Redistributions in binary form must reproduce the above copyright notice, this list of
12+
// conditions and the following disclaimer in the documentation and/or other materials provided
13+
// with the distribution.
14+
//
15+
// * Neither the name of Harmony Security nor the names of its contributors may be used to
16+
// endorse or promote products derived from this software without specific prior written permission.
17+
//
18+
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
19+
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
20+
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
21+
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
22+
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
23+
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24+
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
25+
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26+
// POSSIBILITY OF SUCH DAMAGE.
27+
//===============================================================================================//
28+
#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H
29+
#define _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H
30+
//===============================================================================================//
31+
#define WIN32_LEAN_AND_MEAN
32+
#include <windows.h>
33+
34+
// we declare some common stuff in here...
35+
36+
#define DLL_QUERY_HMODULE 6
37+
38+
#define DEREF( name )*(UINT_PTR *)(name)
39+
#define DEREF_64( name )*(DWORD64 *)(name)
40+
#define DEREF_32( name )*(DWORD *)(name)
41+
#define DEREF_16( name )*(WORD *)(name)
42+
#define DEREF_8( name )*(BYTE *)(name)
43+
44+
typedef ULONG_PTR(WINAPI* REFLECTIVELOADER)(VOID);
45+
typedef BOOL(WINAPI* DLLMAIN)(HINSTANCE, DWORD, LPVOID);
46+
47+
#define DLLEXPORT __declspec( dllexport )
48+
49+
//===============================================================================================//
50+
#endif
51+
//===============================================================================================//

0 commit comments

Comments
 (0)