Skip to content

Commit 04e487a

Browse files
BroihonBroihon
committed
Updated to V4.6
1 parent f408d89 commit 04e487a

18 files changed

+448
-345
lines changed

‎GH Injector Library/Error.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,7 @@
148148
#define SR_NTCTE_ERR_SHELLCODE_SETUP_FAIL 0x1010000B //shellcode : - : argument passed to the shellcode is 0
149149
#define SR_NTCTE_ERR_RPM_FAIL 0x1010000C //ReadProcessMemory : win32 error : reading the results of the shellcode failed
150150
#define SR_NTCTE_ERR_CANT_FIND_THREAD 0x1010000D //internal error : - : ProcessInfo class failed to resolve information about the new thread
151+
#define SR_NTCTE_ERR_NTQIT_FAIL 0x1010000E //NtQueryInformationThread : NTSTATUS : failed to get THREAD_BASIC_INFORMATION
151152

152153

153154
///////////////

‎GH Injector Library/FakeVEH WOW64.cpp‎

Lines changed: 103 additions & 116 deletions
Large diffs are not rendered by default.

‎GH Injector Library/FakeVEH.cpp‎

Lines changed: 208 additions & 176 deletions
Large diffs are not rendered by default.

‎GH Injector Library/GH Injector Library.aps‎

556 Bytes
Binary file not shown.

‎GH Injector Library/GH Injector Library.rc‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,8 @@ END
5151
//
5252

5353
VS_VERSION_INFO VERSIONINFO
54-
FILEVERSION 4,5,0,0
55-
PRODUCTVERSION 4,5,0,0
54+
FILEVERSION 4,6,0,0
55+
PRODUCTVERSION 4,6,0,0
5656
FILEFLAGSMASK 0x3fL
5757
#ifdef _DEBUG
5858
FILEFLAGS 0x1L
@@ -69,10 +69,10 @@ BEGIN
6969
BEGIN
7070
VALUE "CompanyName", "Guided Hacking"
7171
VALUE "FileDescription", "Injection library of the GH Injector"
72-
VALUE "FileVersion", "4.5.0.0"
72+
VALUE "FileVersion", "4.6.0.0"
7373
VALUE "LegalCopyright", "Broihon (C) 1987 - 2035"
7474
VALUE "ProductName", "GH Injection Library"
75-
VALUE "ProductVersion", "4.5.0.0"
75+
VALUE "ProductVersion", "4.6.0.0"
7676
END
7777
END
7878
BLOCK "VarFileInfo"

‎GH Injector Library/GH Injector Library.vcxproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
<VCProjectVersion>15.0</VCProjectVersion>
2323
<ProjectGuid>{AC732425-E265-40FF-842F-C59CECE9A96C}</ProjectGuid>
2424
<RootNamespace>GHInjectorLibrary</RootNamespace>
25-
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
25+
<WindowsTargetPlatformVersion>10.0.20348.0</WindowsTargetPlatformVersion>
2626
</PropertyGroup>
2727
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
2828
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">

‎GH Injector Library/Injection Generic.cpp‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -331,20 +331,22 @@ DWORD __declspec(code_seg(".inj_sec$1")) __stdcall InjectionShell(INJECTION_DATA
331331
return INJ_ERR_LDRP_PREPROCESS_FAILED;
332332
}
333333

334-
ULONG_PTR unknown = 0;
334+
NTSTATUS nt_out = 0;
335335

336336
if (pData->OSBuildNumber >= g_Win11_21H2) //Win11 prototype has an additional argument
337337
{
338338
auto _LdrpLoadDllInternal = ReCa<f_LdrpLoadDllInternal_WIN11>(f->LdrpLoadDllInternal);
339-
pData->LastError = _LdrpLoadDllInternal(&pData->ModuleFileNameBundle.String, ctx, ctx_flags, 4, nullptr, nullptr, ReCa<LDR_DATA_TABLE_ENTRY_WIN11 **>(&entry_out), &unknown, 0);
339+
_LdrpLoadDllInternal(&pData->ModuleFileNameBundle.String, ctx, ctx_flags, 4, nullptr, nullptr, ReCa<LDR_DATA_TABLE_ENTRY_WIN11 **>(&entry_out), &nt_out, 0);
340340
}
341341
else
342342
{
343-
pData->LastError = f->LdrpLoadDllInternal(&pData->ModuleFileNameBundle.String, ctx, ctx_flags, 4, nullptr, nullptr, ReCa<LDR_DATA_TABLE_ENTRY_WIN10 **>(&entry_out), &unknown);
343+
f->LdrpLoadDllInternal(&pData->ModuleFileNameBundle.String, ctx, ctx_flags, 4, nullptr, nullptr, ReCa<LDR_DATA_TABLE_ENTRY_WIN10 **>(&entry_out), &nt_out);
344344
}
345345

346-
if (NT_FAIL(pData->LastError))
346+
if (NT_FAIL(nt_out))
347347
{
348+
pData->LastError = (DWORD)nt_out;
349+
348350
return INJ_ERR_LDRPLDLLINTERNAL_FAILED;
349351
}
350352
}

‎GH Injector Library/Manual Mapping.cpp‎

Lines changed: 30 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -447,7 +447,7 @@ __forceinline NTSTATUS LoadModule(MANUAL_MAPPING_DATA * pData, MANUAL_MAPPING_FU
447447
DeleteObject(f, pModPathW);
448448
DeleteObject(f, ModNameW->szBuffer);
449449
DeleteObject(f, ModNameW);
450-
450+
451451
return ntRet;
452452
}
453453

@@ -470,16 +470,14 @@ __forceinline NTSTATUS LoadModule(MANUAL_MAPPING_DATA * pData, MANUAL_MAPPING_FU
470470
ctx->OriginalFullDllName = ModNameW->szBuffer;
471471
}
472472

473-
ULONG_PTR unknown3 = 0;
474-
475473
if (pData->OSBuildNumber >= g_Win11_21H2)
476474
{
477475
auto _LdrpLoadDllInternal = ReCa<f_LdrpLoadDllInternal_WIN11>(f->LdrpLoadDllInternal);
478-
ntRet = _LdrpLoadDllInternal(&pModPathW->String, ctx, ctx_flags, 4, nullptr, nullptr, ReCa<LDR_DATA_TABLE_ENTRY_WIN11 **>(&entry_out), &unknown3, 0);
476+
_LdrpLoadDllInternal(&pModPathW->String, ctx, ctx_flags, 4, nullptr, nullptr, ReCa<LDR_DATA_TABLE_ENTRY_WIN11 **>(&entry_out), &ntRet, 0);
479477
}
480478
else
481479
{
482-
ntRet = f->LdrpLoadDllInternal(&pModPathW->String, ctx, ctx_flags, 4, nullptr, nullptr, ReCa<LDR_DATA_TABLE_ENTRY_WIN10 **>(&entry_out), &unknown3);
480+
f->LdrpLoadDllInternal(&pModPathW->String, ctx, ctx_flags, 4, nullptr, nullptr, ReCa<LDR_DATA_TABLE_ENTRY_WIN10 **>(&entry_out), &ntRet);
483481
}
484482

485483
DeleteObject(f, ctx);
@@ -817,6 +815,7 @@ DWORD __declspec(code_seg(".mmap_sec$1")) __stdcall ManualMapping_Shell(MANUAL_M
817815
veh_shell_data->ImgBase = ReCa<ULONG_PTR>(pBase);
818816
veh_shell_data->ImgSize = pOptionalHeader->SizeOfImage;
819817
veh_shell_data->OSVersion = pData->OSVersion;
818+
820819
veh_shell_data->_LdrpInvertedFunctionTable = f->LdrpInvertedFunctionTable;
821820
veh_shell_data->_LdrProtectMrdata = f->LdrProtectMrdata;
822821

@@ -945,6 +944,18 @@ DWORD __declspec(code_seg(".mmap_sec$1")) __stdcall ManualMapping_Shell(MANUAL_M
945944

946945
if (NT_FAIL(ntRet))
947946
{
947+
if (ntRet == STATUS_APISET_NOT_HOSTED)
948+
{
949+
++pImportDescr;
950+
951+
if (pImportDescr >= ReCa<IMAGE_IMPORT_DESCRIPTOR *>(pBase + pImportDir->VirtualAddress + pImportDir->Size))
952+
{
953+
break;
954+
}
955+
956+
continue;
957+
}
958+
948959
//unable to load required library
949960
ErrorBreak = true;
950961
break;
@@ -1046,12 +1057,23 @@ DWORD __declspec(code_seg(".mmap_sec$1")) __stdcall ManualMapping_Shell(MANUAL_M
10461057
while (pDelayImportDescr && pDelayImportDescr->DllNameRVA)
10471058
{
10481059
char * szMod = ReCa<char *>(pBase + pDelayImportDescr->DllNameRVA);
1049-
10501060
HINSTANCE hDll = NULL;
10511061
ntRet = LoadModule(pData, f, szMod, &hDll, &delay_imports);
10521062

10531063
if (NT_FAIL(ntRet))
10541064
{
1065+
if (ntRet == STATUS_APISET_NOT_HOSTED)
1066+
{
1067+
++pDelayImportDescr;
1068+
1069+
if (pDelayImportDescr >= ReCa<IMAGE_DELAYLOAD_DESCRIPTOR *>(pBase + pDelayImportDir->VirtualAddress + pDelayImportDir->Size))
1070+
{
1071+
break;
1072+
}
1073+
1074+
continue;
1075+
}
1076+
10551077
ErrorBreak = true;
10561078
break;
10571079
}
@@ -1217,9 +1239,9 @@ DWORD __declspec(code_seg(".mmap_sec$1")) __stdcall ManualMapping_Shell(MANUAL_M
12171239
bool partial = true;
12181240

12191241
#ifdef _WIN64
1220-
if (veh_shell_fixed)
1242+
if (veh_shell_fixed) //really needed for x64?
12211243
{
1222-
//register VEH shell to fill handler list
1244+
//register VEH shell to fill SEH handler list
12231245
pData->hVEH = f->RtlAddVectoredExceptionHandler(0, ReCa<PVECTORED_EXCEPTION_HANDLER>(pVEHShell));
12241246
}
12251247
#endif

‎GH Injector Library/NT Defs.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
#define STATUS_UNSUCCESSFUL 0xC0000001
3131
#define STATUS_NOT_IMPLEMENTED 0xC0000002
3232
#define STATUS_INFO_LENGTH_MISMATCH 0xC0000004
33+
#define STATUS_APISET_NOT_HOSTED 0xC0000481
3334

3435
#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020
3536

‎GH Injector Library/NT Funcs.h‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,7 @@ using f_LdrpLoadDll = NTSTATUS (__fastcall *)
160160
LDR_DATA_TABLE_ENTRY ** ldr_out
161161
);
162162

163-
using f_LdrpLoadDllInternal = NTSTATUS (__fastcall *)
163+
using f_LdrpLoadDllInternal = VOID (__fastcall *)
164164
(
165165
UNICODE_STRING * dll_path,
166166
LDRP_PATH_SEARCH_CONTEXT * search_path,
@@ -169,10 +169,10 @@ using f_LdrpLoadDllInternal = NTSTATUS (__fastcall *)
169169
LDR_DATA_TABLE_ENTRY_WIN10 * Unknown1, //set to nullptr
170170
LDR_DATA_TABLE_ENTRY_WIN10 * Unknown2, //set to nullptr
171171
LDR_DATA_TABLE_ENTRY_WIN10 ** ldr_out,
172-
ULONG_PTR * Unknown3 //set to pointer to nullptr
172+
NTSTATUS * ntRet
173173
);
174174

175-
using f_LdrpLoadDllInternal_WIN11 = NTSTATUS (__fastcall *)
175+
using f_LdrpLoadDllInternal_WIN11 = VOID (__fastcall *)
176176
(
177177
UNICODE_STRING * dll_path,
178178
LDRP_PATH_SEARCH_CONTEXT * search_path,
@@ -181,7 +181,7 @@ using f_LdrpLoadDllInternal_WIN11 = NTSTATUS (__fastcall *)
181181
LDR_DATA_TABLE_ENTRY_WIN11 * Unknown1, //set to nullptr
182182
LDR_DATA_TABLE_ENTRY_WIN11 * Unknown2, //set to nullptr
183183
LDR_DATA_TABLE_ENTRY_WIN11 ** ldr_out,
184-
ULONG_PTR * Unknown3, //set to pointer to nullptr
184+
NTSTATUS * ntRet,
185185
ULONG Unknown4 //set to 0
186186
);
187187

@@ -476,9 +476,9 @@ using f_LdrpTlsList = LIST_ENTRY *;
476476
using f_RtlpUnhandledExceptionFilter = ULONG_PTR *; //encrypted with RtlEncodePointer, points to kernel32.UnhandledExceptionFilter
477477

478478
//kernel32.dll:
479-
using f_UnhandledExceptionFilter = ULONG_PTR *; //PTOP_LEVEL_EXCEPTION_FILTER
479+
using f_UnhandledExceptionFilter = ULONG_PTR *; //PTOP_LEVEL_EXCEPTION_FILTER
480480
using f_SingleHandler = ULONG_PTR *; //encrypted with RtlEncodePointer, points to kernel32.DefaultHandler
481-
using f_DefaultHandler = ULONG_PTR *; //PTOP_LEVEL_EXCEPTION_FILTER
481+
using f_DefaultHandler = ULONG_PTR *; //PTOP_LEVEL_EXCEPTION_FILTER
482482

483483
#pragma endregion
484484

0 commit comments

Comments
 (0)