Skip to content

Commit d86a3e2

Browse files
BroihonBroihon
committed
Fixed dumb issue with function addresses (fuck apphelp and GetProcAddress)
1 parent e5f53c7 commit d86a3e2

11 files changed

+57
-69
lines changed

‎GH Injector Library/Hook Scanner.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ static const char nt_functions[][MAX_PATH] =
2727
"LdrGetProcedureAddressForCaller",
2828
"LdrLockLoaderLock",
2929
"LdrUnlockLoaderLock",
30-
"RtlMoveMemory",
30+
"memmove",
3131
"RtlAllocateHeap",
3232
"RtlFreeHeap",
3333
"RtlHashUnicodeString",

‎GH Injector Library/Import Handler WOW64.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ DWORD ResolveImports_WOW64(ERROR_DATA & error_data)
133133
if (LoadNtSymbolWOW64(S_FUNC(LdrGetDllHandleEx))) return INJ_ERR_GET_SYMBOL_ADDRESS_FAILED;
134134
if (LoadNtSymbolWOW64(S_FUNC(LdrGetProcedureAddress))) return INJ_ERR_GET_SYMBOL_ADDRESS_FAILED;
135135

136-
if (LoadNtSymbolWOW64(S_FUNC(RtlMoveMemory))) return INJ_ERR_GET_SYMBOL_ADDRESS_FAILED;
136+
if (LoadNtSymbolWOW64(WOW64::memmove_WOW64, "memmove")) return INJ_ERR_GET_SYMBOL_ADDRESS_FAILED;
137137
if (LoadNtSymbolWOW64(S_FUNC(RtlZeroMemory))) return INJ_ERR_GET_SYMBOL_ADDRESS_FAILED;
138138
if (LoadNtSymbolWOW64(S_FUNC(RtlAllocateHeap))) return INJ_ERR_GET_SYMBOL_ADDRESS_FAILED;
139139
if (LoadNtSymbolWOW64(S_FUNC(RtlFreeHeap))) return INJ_ERR_GET_SYMBOL_ADDRESS_FAILED;

‎GH Injector Library/Import Handler.cpp‎

Lines changed: 32 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -6,18 +6,6 @@ using namespace NATIVE;
66

77
#define S_FUNC(f) f, #f
88

9-
template <typename T>
10-
DWORD LoadExportedFunction(T & Function, const char * szFunction)
11-
{
12-
Function = ReCa<T>(GetProcAddress(g_hNTDLL, szFunction));
13-
if (!Function)
14-
{
15-
return GetLastError();
16-
}
17-
18-
return INJ_ERR_SUCCESS;
19-
}
20-
219
template <typename T>
2210
DWORD LoadNtSymbolNative(T & Function, const char * szFunction)
2311
{
@@ -41,39 +29,7 @@ DWORD ResolveImports(ERROR_DATA & error_data)
4129

4230
WIN32_FUNC_INIT(LoadLibraryExW, hK32);
4331
WIN32_FUNC_INIT(GetLastError, hK32);
44-
if (!NATIVE::pLoadLibraryExW || !NATIVE::pGetLastError) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
45-
46-
if (LoadExportedFunction(S_FUNC(LdrLoadDll))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
47-
48-
if (LoadExportedFunction(S_FUNC(LdrGetDllHandleEx))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
49-
if (LoadExportedFunction(S_FUNC(LdrGetProcedureAddress))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
50-
51-
if (LoadExportedFunction(S_FUNC(NtQueryInformationProcess))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
52-
if (LoadExportedFunction(S_FUNC(NtQuerySystemInformation))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
53-
if (LoadExportedFunction(S_FUNC(NtQueryInformationThread))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
54-
55-
if (LoadExportedFunction(S_FUNC(RtlMoveMemory))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
56-
if (LoadExportedFunction(S_FUNC(RtlZeroMemory))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
57-
if (LoadExportedFunction(S_FUNC(RtlAllocateHeap))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
58-
if (LoadExportedFunction(S_FUNC(RtlFreeHeap))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
59-
60-
if (LoadExportedFunction(S_FUNC(RtlAnsiStringToUnicodeString))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
61-
62-
if (LoadExportedFunction(S_FUNC(RtlRbRemoveNode))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
63-
64-
if (LoadExportedFunction(S_FUNC(NtOpenFile))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
65-
if (LoadExportedFunction(S_FUNC(NtReadFile))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
66-
if (LoadExportedFunction(S_FUNC(NtSetInformationFile))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
67-
if (LoadExportedFunction(S_FUNC(NtQueryInformationFile))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
68-
69-
if (LoadExportedFunction(S_FUNC(NtClose))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
70-
71-
if (LoadExportedFunction(S_FUNC(NtAllocateVirtualMemory))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
72-
if (LoadExportedFunction(S_FUNC(NtFreeVirtualMemory))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
73-
if (LoadExportedFunction(S_FUNC(NtProtectVirtualMemory))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
74-
75-
if (LoadExportedFunction(S_FUNC(NtCreateThreadEx))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
76-
if (LoadExportedFunction(S_FUNC(RtlQueueApcWow64Thread))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
32+
if (!NATIVE::pLoadLibraryExW || !NATIVE::pGetLastError) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
7733

7834
if (sym_ntdll_native_ret.wait_for(std::chrono::milliseconds(100)) != std::future_status::ready)
7935
{
@@ -90,6 +46,37 @@ DWORD ResolveImports(ERROR_DATA & error_data)
9046
return INJ_ERR_SYMBOL_INIT_FAIL;
9147
}
9248

49+
if (LoadNtSymbolNative(S_FUNC(LdrLoadDll))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
50+
51+
if (LoadNtSymbolNative(S_FUNC(LdrGetDllHandleEx))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
52+
if (LoadNtSymbolNative(S_FUNC(LdrGetProcedureAddress))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
53+
54+
if (LoadNtSymbolNative(S_FUNC(NtQueryInformationProcess))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
55+
if (LoadNtSymbolNative(S_FUNC(NtQuerySystemInformation))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
56+
if (LoadNtSymbolNative(S_FUNC(NtQueryInformationThread))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
57+
58+
if (LoadNtSymbolNative(NATIVE::memmove, "memmove")) return INJ_ERR_GET_PROC_ADDRESS_FAIL; //I hate compilers
59+
if (LoadNtSymbolNative(S_FUNC(RtlZeroMemory))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
60+
if (LoadNtSymbolNative(S_FUNC(RtlAllocateHeap))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
61+
if (LoadNtSymbolNative(S_FUNC(RtlFreeHeap))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
62+
63+
if (LoadNtSymbolNative(S_FUNC(RtlAnsiStringToUnicodeString))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
64+
65+
if (LoadNtSymbolNative(S_FUNC(RtlRbRemoveNode))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
66+
if (LoadNtSymbolNative(S_FUNC(NtOpenFile))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
67+
if (LoadNtSymbolNative(S_FUNC(NtReadFile))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
68+
if (LoadNtSymbolNative(S_FUNC(NtSetInformationFile))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
69+
if (LoadNtSymbolNative(S_FUNC(NtQueryInformationFile))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
70+
71+
if (LoadNtSymbolNative(S_FUNC(NtClose))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
72+
73+
if (LoadNtSymbolNative(S_FUNC(NtAllocateVirtualMemory))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
74+
if (LoadNtSymbolNative(S_FUNC(NtFreeVirtualMemory))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
75+
if (LoadNtSymbolNative(S_FUNC(NtProtectVirtualMemory))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
76+
77+
if (LoadNtSymbolNative(S_FUNC(NtCreateThreadEx))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
78+
if (LoadNtSymbolNative(S_FUNC(RtlQueueApcWow64Thread))) return INJ_ERR_GET_PROC_ADDRESS_FAIL;
79+
9380
if (LoadNtSymbolNative(S_FUNC(LdrpLoadDll))) return INJ_ERR_GET_SYMBOL_ADDRESS_FAILED;
9481

9582
if (LoadNtSymbolNative(S_FUNC(LdrpPreprocessDllName))) return INJ_ERR_GET_SYMBOL_ADDRESS_FAILED;

‎GH Injector Library/Import Handler.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ namespace NATIVE
3838
NT_FUNC(RtlInsertInvertedFunctionTable);
3939
NT_FUNC(LdrpHandleTlsData);
4040

41-
NT_FUNC(RtlMoveMemory);
41+
NT_FUNC(memmove);
4242
NT_FUNC(RtlZeroMemory);
4343
NT_FUNC(RtlAllocateHeap);
4444
NT_FUNC(RtlFreeHeap);
@@ -89,7 +89,7 @@ namespace WOW64
8989
WOW64_FUNCTION_POINTER(RtlInsertInvertedFunctionTable);
9090
WOW64_FUNCTION_POINTER(LdrpHandleTlsData);
9191

92-
WOW64_FUNCTION_POINTER(RtlMoveMemory);
92+
WOW64_FUNCTION_POINTER(memmove);
9393
WOW64_FUNCTION_POINTER(RtlZeroMemory);
9494
WOW64_FUNCTION_POINTER(RtlAllocateHeap);
9595
WOW64_FUNCTION_POINTER(RtlFreeHeap);

‎GH Injector Library/Injection Generic WOW64.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,7 @@ INJECTION_FUNCTION_TABLE_WOW64::INJECTION_FUNCTION_TABLE_WOW64()
160160

161161
WOW64_FUNC_CONSTRUCTOR_INIT(GetLastError);
162162

163-
WOW64_FUNC_CONSTRUCTOR_INIT(RtlMoveMemory);
163+
WOW64_FUNC_CONSTRUCTOR_INIT(memmove);
164164
WOW64_FUNC_CONSTRUCTOR_INIT(RtlZeroMemory);
165165
WOW64_FUNC_CONSTRUCTOR_INIT(RtlFreeHeap);
166166

‎GH Injector Library/Injection Generic.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -256,7 +256,7 @@ DWORD InjectionShell(INJECTION_DATA_INTERNAL * pData)
256256
return INJ_ERR_INVALID_PEB_DATA;
257257
}
258258

259-
f->RtlMoveMemory(base, ntdll_ldr->DllBase, header_size);
259+
f->memmove(base, ntdll_ldr->DllBase, header_size);
260260
}
261261

262262
pData->LastError = (DWORD)f->NtProtectVirtualMemory(hProc, &base, &header_size, old_access, &old_access);
@@ -326,7 +326,7 @@ INJECTION_FUNCTION_TABLE::INJECTION_FUNCTION_TABLE()
326326

327327
WIN32_FUNC_CONSTRUCTOR_INIT(GetLastError);
328328

329-
NT_FUNC_CONSTRUCTOR_INIT(RtlMoveMemory);
329+
NT_FUNC_CONSTRUCTOR_INIT(memmove);
330330
NT_FUNC_CONSTRUCTOR_INIT(RtlZeroMemory);
331331
NT_FUNC_CONSTRUCTOR_INIT(RtlFreeHeap);
332332

‎GH Injector Library/Injection Internal.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ ALIGN struct INJECTION_FUNCTION_TABLE
1212

1313
ALIGN WIN32_FUNC_LOCAL(GetLastError);
1414

15-
ALIGN NT_FUNC_LOCAL(RtlMoveMemory);
15+
ALIGN NT_FUNC_LOCAL(memmove);
1616
ALIGN NT_FUNC_LOCAL(RtlZeroMemory);
1717
ALIGN NT_FUNC_LOCAL(RtlFreeHeap);
1818

@@ -53,7 +53,7 @@ ALIGN_86 struct INJECTION_FUNCTION_TABLE_WOW64
5353

5454
ALIGN_86 WOW64_FUNCTION_POINTER_LOCAL(GetLastError);
5555

56-
ALIGN_86 WOW64_FUNCTION_POINTER_LOCAL(RtlMoveMemory);
56+
ALIGN_86 WOW64_FUNCTION_POINTER_LOCAL(memmove);
5757
ALIGN_86 WOW64_FUNCTION_POINTER_LOCAL(RtlZeroMemory);
5858
ALIGN_86 WOW64_FUNCTION_POINTER_LOCAL(RtlFreeHeap);
5959

‎GH Injector Library/Manual Mapping WOW64.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,7 @@ MANUAL_MAPPING_FUNCTION_TABLE_WOW64::MANUAL_MAPPING_FUNCTION_TABLE_WOW64()
160160
WOW64_FUNC_CONSTRUCTOR_INIT(NtProtectVirtualMemory);
161161
WOW64_FUNC_CONSTRUCTOR_INIT(NtFreeVirtualMemory);
162162

163-
WOW64_FUNC_CONSTRUCTOR_INIT(RtlMoveMemory);
163+
WOW64_FUNC_CONSTRUCTOR_INIT(memmove);
164164
WOW64_FUNC_CONSTRUCTOR_INIT(RtlZeroMemory);
165165
WOW64_FUNC_CONSTRUCTOR_INIT(RtlAllocateHeap);
166166
WOW64_FUNC_CONSTRUCTOR_INIT(RtlFreeHeap);

‎GH Injector Library/Manual Mapping.cpp‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,7 @@ DWORD MMAP_NATIVE::ManualMap(const wchar_t * szDllFile, HANDLE hTargetProc, LAUN
9696
}
9797

9898
LOG("Data written\n");
99+
LOG("NtSetInformationFile: %p\n", data.f.NtSetInformationFile);
99100

100101
DWORD remote_ret = 0;
101102
DWORD dwRet = StartRoutine(hTargetProc, ReCa<f_Routine>(pShell), pArg, Method, (Flags & INJ_THREAD_CREATE_CLOAKED) != 0, remote_ret, Timeout, error_data);
@@ -198,7 +199,7 @@ __forceinline bool InitAnsiString(MANUAL_MAPPING_FUNCTION_TABLE * f, ANSI_STRING
198199

199200
String->Length = Length;
200201
String->MaxLength = Length + 1 * sizeof(char);
201-
f->RtlMoveMemory(String->szBuffer, szString, Length);
202+
f->memmove(String->szBuffer, szString, Length);
202203

203204
return true;
204205
}
@@ -241,8 +242,8 @@ DWORD ManualMapping_Shell(MANUAL_MAPPING_DATA * pData)
241242
}
242243

243244
//nt path prefix "\??\"
244-
f->RtlMoveMemory(DllNtPath.szBuffer + 0, pData->NtPathPrefix, sizeof(wchar_t[4]));
245-
f->RtlMoveMemory(DllNtPath.szBuffer + 4, pData->szPathBuffer, DllNtPath.Length);
245+
f->memmove(DllNtPath.szBuffer + 0, pData->NtPathPrefix, sizeof(wchar_t[4]));
246+
f->memmove(DllNtPath.szBuffer + 4, pData->szPathBuffer, DllNtPath.Length);
246247
DllNtPath.Length += sizeof(wchar_t[4]);
247248

248249
UNICODE_STRING DllName = pData->DllName;
@@ -294,7 +295,7 @@ DWORD ManualMapping_Shell(MANUAL_MAPPING_DATA * pData)
294295
LARGE_INTEGER ImageSize{ pNtHeaders->OptionalHeader.SizeOfImage };
295296

296297
DeleteObject(f, Headers);
297-
298+
298299
auto * fsi = NewObject<FILE_STANDARD_INFO>(f);
299300
ntRet = f->NtQueryInformationFile(hDllFile, &io_status, fsi, sizeof(FILE_STANDARD_INFO), FILE_INFORMATION_CLASS::FileStandardInformation);
300301
if (NT_FAIL(ntRet))
@@ -335,7 +336,7 @@ DWORD ManualMapping_Shell(MANUAL_MAPPING_DATA * pData)
335336
f->NtFreeVirtualMemory(hProc, ReCa<void**>(&pRawData), &RawSize, MEM_RELEASE);
336337
f->NtClose(hDllFile);
337338

338-
return INJ_MM_ERR_NT_READ_FILE;
339+
return INJ_MM_ERR_SET_FILE_POSITION;
339340
}
340341

341342
ntRet = f->NtReadFile(hDllFile, nullptr, nullptr, nullptr, &io_status, pRawData, fsi->AllocationSize.LowPart, nullptr, nullptr);
@@ -373,14 +374,14 @@ DWORD ManualMapping_Shell(MANUAL_MAPPING_DATA * pData)
373374
}
374375

375376
//copy header and sections
376-
f->RtlMoveMemory(pBase, pRawData, pOptionalHeader->SizeOfHeaders);
377+
f->memmove(pBase, pRawData, pOptionalHeader->SizeOfHeaders);
377378

378379
auto * pCurrentSectionHeader = IMAGE_FIRST_SECTION(pNtHeaders);
379380
for (UINT i = 0; i != pFileHeader->NumberOfSections; ++i, ++pCurrentSectionHeader)
380381
{
381382
if (pCurrentSectionHeader->SizeOfRawData)
382383
{
383-
f->RtlMoveMemory(pBase + pCurrentSectionHeader->VirtualAddress, pRawData + pCurrentSectionHeader->PointerToRawData, pCurrentSectionHeader->SizeOfRawData);
384+
f->memmove(pBase + pCurrentSectionHeader->VirtualAddress, pRawData + pCurrentSectionHeader->PointerToRawData, pCurrentSectionHeader->SizeOfRawData);
384385
}
385386
}
386387

@@ -1003,7 +1004,7 @@ DWORD ManualMapping_Shell(MANUAL_MAPPING_DATA * pData)
10031004

10041005
auto * ntdll_ldr = ReCa<LDR_DATA_TABLE_ENTRY*>(pPEB->Ldr->InLoadOrderModuleListHead.Flink->Flink);
10051006

1006-
f->RtlMoveMemory(pBase, ntdll_ldr->DllBase, pOptionalHeader->SizeOfHeaders);
1007+
f->memmove(pBase, ntdll_ldr->DllBase, pOptionalHeader->SizeOfHeaders);
10071008
}
10081009

10091010
if (Flags & INJ_MM_SET_PAGE_PROTECTIONS)
@@ -1046,7 +1047,7 @@ MANUAL_MAPPING_FUNCTION_TABLE::MANUAL_MAPPING_FUNCTION_TABLE()
10461047
NT_FUNC_CONSTRUCTOR_INIT(NtProtectVirtualMemory);
10471048
NT_FUNC_CONSTRUCTOR_INIT(NtFreeVirtualMemory);
10481049

1049-
NT_FUNC_CONSTRUCTOR_INIT(RtlMoveMemory);
1050+
NT_FUNC_CONSTRUCTOR_INIT(memmove);
10501051
NT_FUNC_CONSTRUCTOR_INIT(RtlZeroMemory);
10511052
NT_FUNC_CONSTRUCTOR_INIT(RtlAllocateHeap);
10521053
NT_FUNC_CONSTRUCTOR_INIT(RtlFreeHeap);

‎GH Injector Library/Manual Mapping.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ namespace MMAP_NATIVE
3737
ALIGN NT_FUNC_LOCAL(NtProtectVirtualMemory);
3838
ALIGN NT_FUNC_LOCAL(NtFreeVirtualMemory);
3939

40-
ALIGN NT_FUNC_LOCAL(RtlMoveMemory);
40+
ALIGN NT_FUNC_LOCAL(memmove);
4141
ALIGN NT_FUNC_LOCAL(RtlZeroMemory);
4242
ALIGN NT_FUNC_LOCAL(RtlAllocateHeap);
4343
ALIGN NT_FUNC_LOCAL(RtlFreeHeap);
@@ -100,7 +100,7 @@ namespace MMAP_WOW64
100100
ALIGN_86 WOW64_FUNCTION_POINTER_LOCAL(NtProtectVirtualMemory);
101101
ALIGN_86 WOW64_FUNCTION_POINTER_LOCAL(NtFreeVirtualMemory);
102102

103-
ALIGN_86 WOW64_FUNCTION_POINTER_LOCAL(RtlMoveMemory);
103+
ALIGN_86 WOW64_FUNCTION_POINTER_LOCAL(memmove);
104104
ALIGN_86 WOW64_FUNCTION_POINTER_LOCAL(RtlZeroMemory);
105105
ALIGN_86 WOW64_FUNCTION_POINTER_LOCAL(RtlAllocateHeap);
106106
ALIGN_86 WOW64_FUNCTION_POINTER_LOCAL(RtlFreeHeap);

0 commit comments

Comments
 (0)