Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 27 additions & 10 deletions DarkLoadLibrary/include/darkloadlibrary.h
Original file line number Diff line number Diff line change
@@ -1,26 +1,43 @@
#pragma once
#include <stdio.h>
#include <windows.h>
#include "darkmodule.h"
#include "pebutils.h"
#include "ldrutils.h"

#define LOAD_LOCAL_FILE 0x00000001
#define LOAD_REMOTE_FILE 0x00000002
#define LOAD_MEMORY 0x00000003
#define NO_LINK 0x00000004

#pragma once
typedef struct _DARKMODULE {
BOOL bSuccess;
LPWSTR ErrorMsg;
PBYTE pbDllData;
DWORD dwDllDataLen;
LPWSTR LocalDLLName;
PWCHAR CrackedDLLName;
ULONG_PTR ModuleBase;
} DARKMODULE, *PDARKMODULE;
// typedef struct _DARKMODULE {
// BOOL bSuccess;
// LPWSTR ErrorMsg;
// PBYTE pbDllData;
// DWORD dwDllDataLen;
// LPWSTR LocalDLLName;
// PWCHAR CrackedDLLName;
// ULONG_PTR ModuleBase;
// } DARKMODULE, *PDARKMODULE;

DARKMODULE DarkLoadLibrary(
DWORD dwFlags,
LPCWSTR lpwBuffer,
LPVOID lpFileBuffer,
DWORD dwLen,
LPCWSTR lpwName
);

BOOL ParseFileName(
PDARKMODULE pdModule,
LPWSTR lpwFileName
);

BOOL ReadFileToBuffer(
PDARKMODULE pdModule
);

BOOL ConcealLibrary(
PDARKMODULE pdModule,
BOOL bConceal
);
12 changes: 12 additions & 0 deletions DarkLoadLibrary/include/darkmodule.h
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
#pragma once
#include <windows.h>

typedef struct _DARKMODULE {
BOOL bSuccess;
LPWSTR ErrorMsg;
PBYTE pbDllData;
DWORD dwDllDataLen;
LPWSTR LocalDLLName;
PWCHAR CrackedDLLName;
ULONG_PTR ModuleBase;
} DARKMODULE, *PDARKMODULE;
8 changes: 5 additions & 3 deletions DarkLoadLibrary/include/ldrutils.h
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#pragma once
#include <windows.h>

#include "pebutils.h"
#include "darkloadlibrary.h"
#include "darkmodule.h"

#define RVA(type, base_addr, rva) (type)((ULONG_PTR) base_addr + rva)

Expand All @@ -14,4 +14,6 @@ typedef BOOL(WINAPI * DLLMAIN)(HINSTANCE, DWORD, LPVOID);
typedef NTSTATUS(WINAPI *LDRGETPROCADDRESS)(HMODULE, PANSI_STRING, WORD, PVOID*);

BOOL IsValidPE(PBYTE pbData);
BOOL MapSections(PDARKMODULE pdModule);
BOOL MapSections(PDARKMODULE pdModule);
BOOL ResolveImports(PDARKMODULE pdModule);
BOOL BeginExecution(PDARKMODULE pdModule);
37 changes: 35 additions & 2 deletions DarkLoadLibrary/include/pebutils.h
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
#pragma once
#include <windows.h>

#include <stddef.h>
#include "pebstructs.h"
#include "darkmodule.h"
#include "darkloadlibrary.h"

#ifdef _WIN32
Expand All @@ -25,4 +27,35 @@
#define LDR_HASH_TABLE_ENTRIES 32

HMODULE IsModulePresent(LPCWSTR lpwName);
BOOL LinkModuleToPEB(PDARKMODULE pdModule);
BOOL LinkModuleToPEB(PDARKMODULE pdModule);
ULONG LdrHashEntry(UNICODE_STRING UniName, BOOL XorHash);
PLDR_DATA_TABLE_ENTRY2 FindLdrTableEntry(
PCWSTR BaseName
);
PRTL_RB_TREE FindModuleBaseAddressIndex();
BOOL AddBaseAddressEntry(
PLDR_DATA_TABLE_ENTRY2 pLdrEntry,
PVOID lpBaseAddr
);
PLIST_ENTRY FindHashTable();
VOID InsertTailList(
PLIST_ENTRY ListHead,
PLIST_ENTRY Entry
);
BOOL AddHashTableEntry(
PLDR_DATA_TABLE_ENTRY2 pLdrEntry
);

NTSTATUS RtlHashUnicodeString(
PCUNICODE_STRING String,
BOOLEAN CaseInSensitive,
ULONG HashAlgorithm,
PULONG HashValue
);

void RtlRbInsertNodeEx(
RTL_RB_TREE *Tree,
RTL_BALANCED_NODE *Parent,
BOOLEAN Right,
RTL_BALANCED_NODE *Node
);
4 changes: 2 additions & 2 deletions DarkLoadLibrary/src/darkloadlibrary.c
Original file line number Diff line number Diff line change
Expand Up @@ -58,12 +58,12 @@ BOOL ParseFileName(
return FALSE;
}

PCHAR lpCpy = wcscpy(
PWCHAR lpCpy = wcscpy(
pdModule->CrackedDLLName,
lpwFilename
);

PCHAR lpCat = wcscat(
PWCHAR lpCat = wcscat(
pdModule->CrackedDLLName,
lpwExt
);
Expand Down