rovnix
Newbie cheater
![]() Reputation: 0
Joined: 09 Feb 2014
Posts: 18
|
 Posted: Sun Feb 21, 2016 2:54 pm Post subject: Hooking Send (), PE injection |
 |
|
Hello,
I been taking studies on PE injection and hooking i need help here , is this the right way to go about using PE injection to hook Send?
Source code looks thus
| Code: |
#include <stdio.h>
#include <stdlib.h>
#include <Windows.h>
#include <tlhelp32.h>
#include <Winsock.h>
#include "detours.h"
#pragma comment (lib, "ws2_32")
typedef int (*WINAPI oldsend)(SOCKET s,const char* buf,int len,int flags);
DWORD GetProcessIdByName(LPWSTR name)
{
PROCESSENTRY32 pe32;
HANDLE snapshot = NULL;
DWORD pid = 0;
snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (snapshot != INVALID_HANDLE_VALUE) {
pe32.dwSize = sizeof(PROCESSENTRY32);
if (Process32First(snapshot, &pe32)) {
do {
if (!lstrcmp(pe32.szExeFile, name)) {
pid = pe32.th32ProcessID;
break;
}
} while (Process32Next(snapshot, &pe32));
}
CloseHandle(snapshot);
}
return pid;
}
LPVOID CopyModule(HANDLE proc, LPVOID image)
{
PIMAGE_NT_HEADERS headers = (PIMAGE_NT_HEADERS)((LPBYTE)image + ((PIMAGE_DOS_HEADER)image)->e_lfanew);
PIMAGE_DATA_DIRECTORY datadir;
DWORD size = headers->OptionalHeader.SizeOfImage;
LPVOID mem = NULL;
LPBYTE buf = NULL;
BOOL ok = FALSE;
if (headers->Signature != IMAGE_NT_SIGNATURE)
return NULL;
if (IsBadReadPtr(image, size))
return NULL;
mem = VirtualAllocEx(proc, NULL, size, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (mem != NULL) {
buf = (LPBYTE)VirtualAlloc(NULL, size, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (buf != NULL) {
RtlCopyMemory(buf, image, size);
datadir = &headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC];
if (datadir->Size > 0 && datadir->VirtualAddress > 0) {
DWORD_PTR delta = (DWORD_PTR)((LPBYTE)mem - headers->OptionalHeader.ImageBase);
DWORD_PTR olddelta = (DWORD_PTR)((LPBYTE)image - headers->OptionalHeader.ImageBase);
PIMAGE_BASE_RELOCATION reloc = (PIMAGE_BASE_RELOCATION)(buf + datadir->VirtualAddress);
while(reloc->VirtualAddress != 0) {
if (reloc->SizeOfBlock >= sizeof(IMAGE_BASE_RELOCATION)) {
DWORD count = (reloc->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(WORD);
LPWORD list = (LPWORD)((LPBYTE)reloc + sizeof(IMAGE_BASE_RELOCATION));
DWORD i;
for (i = 0; i < count; i++) {
if (list[i] > 0) {
DWORD_PTR *p = (DWORD_PTR *)(buf + (reloc->VirtualAddress + (0x0FFF & (list[i]))));
*p -= olddelta;
*p += delta;
}
}
}
reloc = (PIMAGE_BASE_RELOCATION)((LPBYTE)reloc + reloc->SizeOfBlock);
}
ok = WriteProcessMemory(proc, mem, buf, size, NULL);
}
VirtualFree(buf, 0, MEM_RELEASE); // release buf
}
if (!ok) {
VirtualFreeEx(proc, mem, 0, MEM_RELEASE);
mem = NULL;
}
}
return mem;
}
BOOL EnableDebugPrivileges(void)
{
HANDLE token;
TOKEN_PRIVILEGES priv;
BOOL ret = FALSE;
if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &token)) {
priv.PrivilegeCount = 1;
priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if (LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &priv.Privileges[0].Luid) != FALSE &&
AdjustTokenPrivileges(token, FALSE, &priv, 0, NULL, NULL) != FALSE) {
ret = TRUE;
}
CloseHandle(token);
}
return ret;
}
BOOL BeginInject(DWORD pid, LPTHREAD_START_ROUTINE start)
{
HANDLE proc, thread;
HMODULE module, newmodule;
BOOL ok = FALSE;
proc = OpenProcess(PROCESS_QUERY_INFORMATION |
PROCESS_VM_OPERATION |
PROCESS_VM_WRITE |
PROCESS_VM_READ |
PROCESS_CREATE_THREAD |
PROCESS_DUP_HANDLE,
FALSE, pid);
if (proc != NULL) {
module = GetModuleHandle(NULL);
newmodule = (HMODULE)CopyModule(proc, module);
if (newmodule != NULL) {
LPTHREAD_START_ROUTINE entry = (LPTHREAD_START_ROUTINE)((LPBYTE)newmodule + (DWORD_PTR)((LPBYTE)start - (LPBYTE)module));
thread = CreateRemoteThread(proc, NULL, 0, entry, NULL, 0, NULL);
if (thread != NULL) {
CloseHandle(thread);
ok = TRUE;
}
else {
VirtualFreeEx(proc, module, 0, MEM_RELEASE);
}
}
CloseHandle(proc);
}
return ok;
}
DWORD WINAPI ThreadProc(LPVOID param)
{
FILE *bufFile;
bufFile = fopen("C:\\logz.txt","a+");
fprintf(bufFile,"%s",buf);
fclose(bufFile);
return oldsend(s,buf,len,flags);
//return 0;
}
int main()
{
EnableDebugPrivileges();
//oldsend = (oldsend)DetourFunction((PBYTE)Printaddy, (PBYTE)hkPrint);
BeginInject(GetProcessIdByName(L"Odesk.exe"), ThreadProc);
return 0;
}
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
Reputation: 205
