inject-helper.c 2.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125
  1. #include <stdio.h>
  2. #include <stdlib.h>
  3. #include <wchar.h>
  4. #include <windows.h>
  5. #include <shellapi.h>
  6. #include <stdbool.h>
  7. #include "../obfuscate.h"
  8. #include "../inject-library.h"
  9. #if defined(_MSC_VER) && !defined(inline)
  10. #define inline __inline
  11. #endif
  12. static void load_debug_privilege(void)
  13. {
  14. const DWORD flags = TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY;
  15. TOKEN_PRIVILEGES tp;
  16. HANDLE token;
  17. LUID val;
  18. if (!OpenProcessToken(GetCurrentProcess(), flags, &token)) {
  19. return;
  20. }
  21. if (!!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &val)) {
  22. tp.PrivilegeCount = 1;
  23. tp.Privileges[0].Luid = val;
  24. tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
  25. AdjustTokenPrivileges(token, false, &tp,
  26. sizeof(tp), NULL, NULL);
  27. }
  28. CloseHandle(token);
  29. }
  30. static inline HANDLE open_process(DWORD desired_access, bool inherit_handle,
  31. DWORD process_id)
  32. {
  33. HANDLE (WINAPI *open_process_proc)(DWORD, BOOL, DWORD);
  34. open_process_proc = get_obfuscated_func(GetModuleHandleW(L"KERNEL32"),
  35. "HxjcQrmkb|~", 0xc82efdf78201df87);
  36. return open_process_proc(desired_access, inherit_handle, process_id);
  37. }
  38. static inline int inject_library(HANDLE process, const wchar_t *dll)
  39. {
  40. return inject_library_obf(process, dll,
  41. "E}mo|d[cefubWk~bgk", 0x7c3371986918e8f6,
  42. "Rqbr`T{cnor{Bnlgwz", 0x81bf81adc9456b35,
  43. "]`~wrl`KeghiCt", 0xadc6a7b9acd73c9b,
  44. "Zh}{}agHzfd@{", 0x57135138eb08ff1c,
  45. "DnafGhj}l~sX", 0x350bfacdf81b2018);
  46. }
  47. static inline int inject_library_safe(DWORD thread_id, const wchar_t *dll)
  48. {
  49. return inject_library_safe_obf(thread_id, dll,
  50. "[bs^fbkmwuKfmfOvI", 0xEAD293602FCF9778ULL);
  51. }
  52. static inline int inject_library_full(DWORD process_id, const wchar_t *dll)
  53. {
  54. HANDLE process = open_process(PROCESS_ALL_ACCESS, false, process_id);
  55. int ret;
  56. if (process) {
  57. ret = inject_library(process, dll);
  58. CloseHandle(process);
  59. } else {
  60. ret = INJECT_ERROR_OPEN_PROCESS_FAIL;
  61. }
  62. return ret;
  63. }
  64. static int inject_helper(wchar_t *argv[], const wchar_t *dll)
  65. {
  66. DWORD id;
  67. DWORD use_safe_inject;
  68. use_safe_inject = wcstol(argv[2], NULL, 10);
  69. id = wcstol(argv[3], NULL, 10);
  70. if (id == 0) {
  71. return INJECT_ERROR_INVALID_PARAMS;
  72. }
  73. return use_safe_inject
  74. ? inject_library_safe(id, dll)
  75. : inject_library_full(id, dll);
  76. }
  77. #define UNUSED_PARAMETER(x) ((void)(x))
  78. int main(int argc, char *argv_ansi[])
  79. {
  80. wchar_t dll_path[MAX_PATH];
  81. LPWSTR pCommandLineW;
  82. LPWSTR *argv;
  83. int ret = INJECT_ERROR_INVALID_PARAMS;
  84. SetErrorMode(SEM_FAILCRITICALERRORS);
  85. load_debug_privilege();
  86. pCommandLineW = GetCommandLineW();
  87. argv = CommandLineToArgvW(pCommandLineW, &argc);
  88. if (argv && argc == 4) {
  89. DWORD size = GetModuleFileNameW(NULL,
  90. dll_path, MAX_PATH);
  91. if (size) {
  92. wchar_t *name_start = wcsrchr(dll_path, '\\');
  93. if (name_start) {
  94. *(++name_start) = 0;
  95. wcscpy(name_start, argv[1]);
  96. ret = inject_helper(argv, dll_path);
  97. }
  98. }
  99. }
  100. LocalFree(argv);
  101. UNUSED_PARAMETER(argv_ansi);
  102. return ret;
  103. }