Skip to content

Commit b7c73ba

Browse files
zeroSteinerzeroSteiner
committed
Make the proof of concept into an RDLL
1 parent ba21841 commit b7c73ba

File tree

7 files changed

+111
-23
lines changed

7 files changed

+111
-23
lines changed

‎.gitignore‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
1+
*.dll
2+
*.exe
3+
*.vcxproj.user
14
.vs/*
25
Release/
36
Debug/
47
x64/
58
ReflectiveUnloader.v12.suo
6-
*.dll
7-
*.exe

‎.gitmodules‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[submodule "ReflectiveDLLInjection"]
2+
path = ReflectiveDLLInjection
3+
url = [email protected]:zeroSteiner/ReflectiveDLLInjection

‎ReflectiveDLLInjection‎

Submodule ReflectiveDLLInjection added at 1c3c9c0

‎ReflectiveUnloader/Main.c‎

Lines changed: 41 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
#include <stdio.h>
2+
#include <tchar.h>
3+
#include <Windows.h>
4+
#include "ReflectiveDLLInjection.h"
25
#include "ReflectiveUnloader.h"
36

4-
VOID DumpImage(LPCSTR pFile, PVOID pBaseAddress, SIZE_T dwSize) {
7+
HMODULE g_hModule = NULL;
8+
9+
VOID DumpImage(LPTSTR pFile, PVOID pBaseAddress, SIZE_T dwSize) {
510
HANDLE hFile;
611
DWORD dwNumberOfBytesWritten;
712

813
hFile = CreateFile(pFile, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
914
if (hFile == INVALID_HANDLE_VALUE) {
10-
printf("[-] Failed to open the file for writting.\n");
15+
MessageBox(NULL, _T("Could not open the file for writing."), _T("Failed"), MB_OK);
1116
return;
1217
}
1318
WriteFile(hFile, pBaseAddress, (DWORD)dwSize, &dwNumberOfBytesWritten, NULL);
@@ -17,18 +22,45 @@ VOID DumpImage(LPCSTR pFile, PVOID pBaseAddress, SIZE_T dwSize) {
1722
VOID ProofOfConcept(HINSTANCE hInstance) {
1823
PVOID pBaseAddress = NULL;
1924
SIZE_T dwSize;
25+
TCHAR ctPath[MAX_PATH + 1];
26+
DWORD dwChars;
27+
28+
MessageBox(NULL, _T("Select OK to proceed."), _T("Waiting"), MB_OK);
2029

2130
pBaseAddress = ReflectiveUnloader(hInstance, &dwSize);
2231
if (!pBaseAddress) {
23-
printf("[-] Unload failed.\n");
32+
MessageBox(NULL, _T("Unload failed."), _T("Failed"), MB_OK);
2433
return;
2534
}
26-
printf("[+] Unload succedded.\n");
27-
DumpImage("unloaded.exe", pBaseAddress, dwSize);
35+
36+
dwChars = ExpandEnvironmentStrings(_T("%USERPROFILE%\\Desktop\\unloaded.dll"), ctPath, MAX_PATH + 1);
37+
if ((dwChars == 0) || (dwChars > MAX_PATH + 1)) {
38+
MessageBox(NULL, _T("Could not get the file path for writing."), _T("Failed"), MB_OK);
39+
return;
40+
}
41+
DumpImage(ctPath, pBaseAddress, dwSize);
2842
ReflectiveUnloaderFree(pBaseAddress, dwSize);
2943
}
3044

31-
int main(int argc, char **argv) {
32-
ProofOfConcept(GetModuleHandle(NULL));
33-
return 0;
34-
}
45+
BOOL WINAPI DllMain(HINSTANCE hInstDll, DWORD dwReason, LPVOID lpReserved) {
46+
switch (dwReason) {
47+
case DLL_QUERY_HMODULE:
48+
if (lpReserved) {
49+
*(HMODULE *)lpReserved = g_hModule;
50+
}
51+
break;
52+
case DLL_PROCESS_ATTACH:
53+
if (!g_hModule) {
54+
g_hModule = hInstDll;
55+
/* start a new thread so DllMain returns */
56+
CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)ProofOfConcept, hInstDll, 0, 0);
57+
}
58+
break;
59+
case DLL_PROCESS_DETACH:
60+
case DLL_THREAD_ATTACH:
61+
case DLL_THREAD_DETACH:
62+
default:
63+
break;
64+
}
65+
return TRUE;
66+
}

‎ReflectiveUnloader/ReflectiveUnloader.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -268,9 +268,9 @@ PVOID ReflectiveUnloader(HINSTANCE hInstance, PSIZE_T pdwSize) {
268268
pImgSecHeader = (PIMAGE_SECTION_HEADER)((ULONG_PTR)pImgNtHeaders + sizeof(IMAGE_NT_HEADERS));
269269

270270
/*
271-
* 0x00400000 for EXEs and 0x10000000 for DLLs
272-
* see: https://msdn.microsoft.com/en-us/library/windows/desktop/ms680339(v=vs.85).aspx
273-
*/
271+
* 0x00400000 for EXEs and 0x10000000 for DLLs
272+
* see: https://msdn.microsoft.com/en-us/library/windows/desktop/ms680339(v=vs.85).aspx
273+
*/
274274
if (pImgNtHeaders->FileHeader.Characteristics & IMAGE_FILE_DLL) {
275275
pImgNtHeaders->OptionalHeader.ImageBase = IMAGE_BASE_DLL;
276276
}

‎ReflectiveUnloader/ReflectiveUnloader.vcxproj‎

Lines changed: 54 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -26,26 +26,24 @@
2626
</PropertyGroup>
2727
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
2828
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
29-
<ConfigurationType>Application</ConfigurationType>
29+
<ConfigurationType>DynamicLibrary</ConfigurationType>
3030
<UseDebugLibraries>true</UseDebugLibraries>
3131
<PlatformToolset>v120_xp</PlatformToolset>
32-
<CharacterSet>MultiByte</CharacterSet>
3332
</PropertyGroup>
3433
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
35-
<ConfigurationType>Application</ConfigurationType>
34+
<ConfigurationType>DynamicLibrary</ConfigurationType>
3635
<UseDebugLibraries>false</UseDebugLibraries>
3736
<PlatformToolset>v120_xp</PlatformToolset>
3837
<WholeProgramOptimization>true</WholeProgramOptimization>
39-
<CharacterSet>MultiByte</CharacterSet>
4038
</PropertyGroup>
4139
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
42-
<ConfigurationType>Application</ConfigurationType>
40+
<ConfigurationType>DynamicLibrary</ConfigurationType>
4341
<UseDebugLibraries>true</UseDebugLibraries>
4442
<PlatformToolset>v120_xp</PlatformToolset>
4543
<CharacterSet>MultiByte</CharacterSet>
4644
</PropertyGroup>
4745
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
48-
<ConfigurationType>Application</ConfigurationType>
46+
<ConfigurationType>DynamicLibrary</ConfigurationType>
4947
<UseDebugLibraries>false</UseDebugLibraries>
5048
<PlatformToolset>v120_xp</PlatformToolset>
5149
<WholeProgramOptimization>true</WholeProgramOptimization>
@@ -69,24 +67,53 @@
6967
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
7068
</ImportGroup>
7169
<PropertyGroup Label="UserMacros" />
72-
<PropertyGroup />
70+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
71+
<OutDir>$(SolutionDir)$(Configuration)\</OutDir>
72+
<IntDir>$(Configuration)\</IntDir>
73+
<TargetName>$(ProjectName).x64</TargetName>
74+
</PropertyGroup>
75+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
76+
<OutDir>$(SolutionDir)$(Configuration)\</OutDir>
77+
<IntDir>$(Configuration)\</IntDir>
78+
<TargetName>$(ProjectName).x64</TargetName>
79+
</PropertyGroup>
80+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
81+
<TargetName>$(ProjectName).x86</TargetName>
82+
</PropertyGroup>
83+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
84+
<TargetName>$(ProjectName).x86</TargetName>
85+
</PropertyGroup>
7386
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
7487
<ClCompile>
7588
<WarningLevel>Level3</WarningLevel>
7689
<Optimization>Disabled</Optimization>
7790
<SDLCheck>true</SDLCheck>
7891
<TreatWarningAsError>true</TreatWarningAsError>
79-
<PreprocessorDefinitions>_MBCS;%(PreprocessorDefinitions);DEBUG</PreprocessorDefinitions>
92+
<PreprocessorDefinitions>REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions)</PreprocessorDefinitions>
93+
<AdditionalIncludeDirectories>$(SolutionDir)ReflectiveDLLInjection\dll\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
8094
</ClCompile>
95+
<PostBuildEvent>
96+
<Command>python $(SolutionDir)pe_patch.py "$(TargetPath)" "$(TargetPath)"</Command>
97+
</PostBuildEvent>
98+
<PostBuildEvent>
99+
<Message>Patch in the .restore section</Message>
100+
</PostBuildEvent>
81101
</ItemDefinitionGroup>
82102
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
83103
<ClCompile>
84104
<WarningLevel>Level3</WarningLevel>
85105
<Optimization>Disabled</Optimization>
86106
<SDLCheck>true</SDLCheck>
87107
<TreatWarningAsError>true</TreatWarningAsError>
88-
<PreprocessorDefinitions>_MBCS;%(PreprocessorDefinitions);DEBUG</PreprocessorDefinitions>
108+
<PreprocessorDefinitions>REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions)</PreprocessorDefinitions>
109+
<AdditionalIncludeDirectories>$(SolutionDir)ReflectiveDLLInjection\dll\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
89110
</ClCompile>
111+
<PostBuildEvent>
112+
<Command>python $(SolutionDir)pe_patch.py "$(TargetPath)" "$(TargetPath)"</Command>
113+
</PostBuildEvent>
114+
<PostBuildEvent>
115+
<Message>Patch in the .restore section</Message>
116+
</PostBuildEvent>
90117
</ItemDefinitionGroup>
91118
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
92119
<ClCompile>
@@ -96,11 +123,19 @@
96123
<IntrinsicFunctions>true</IntrinsicFunctions>
97124
<SDLCheck>true</SDLCheck>
98125
<TreatWarningAsError>true</TreatWarningAsError>
126+
<AdditionalIncludeDirectories>$(SolutionDir)ReflectiveDLLInjection\dll\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
127+
<PreprocessorDefinitions>REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions)</PreprocessorDefinitions>
99128
</ClCompile>
100129
<Link>
101130
<EnableCOMDATFolding>true</EnableCOMDATFolding>
102131
<OptimizeReferences>true</OptimizeReferences>
103132
</Link>
133+
<PostBuildEvent>
134+
<Command>python $(SolutionDir)pe_patch.py "$(TargetPath)" "$(TargetPath)"</Command>
135+
</PostBuildEvent>
136+
<PostBuildEvent>
137+
<Message>Patch in the .restore section</Message>
138+
</PostBuildEvent>
104139
</ItemDefinitionGroup>
105140
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
106141
<ClCompile>
@@ -110,17 +145,27 @@
110145
<IntrinsicFunctions>true</IntrinsicFunctions>
111146
<SDLCheck>true</SDLCheck>
112147
<TreatWarningAsError>true</TreatWarningAsError>
148+
<AdditionalIncludeDirectories>$(SolutionDir)ReflectiveDLLInjection\dll\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
149+
<PreprocessorDefinitions>REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions)</PreprocessorDefinitions>
113150
</ClCompile>
114151
<Link>
115152
<EnableCOMDATFolding>true</EnableCOMDATFolding>
116153
<OptimizeReferences>true</OptimizeReferences>
117154
</Link>
155+
<PostBuildEvent>
156+
<Command>python $(SolutionDir)pe_patch.py "$(TargetPath)" "$(TargetPath)"</Command>
157+
</PostBuildEvent>
158+
<PostBuildEvent>
159+
<Message>Patch in the .restore section</Message>
160+
</PostBuildEvent>
118161
</ItemDefinitionGroup>
119162
<ItemGroup>
163+
<ClCompile Include="..\ReflectiveDLLInjection\dll\src\ReflectiveLoader.c" />
120164
<ClCompile Include="Main.c" />
121165
<ClCompile Include="ReflectiveUnloader.c" />
122166
</ItemGroup>
123167
<ItemGroup>
168+
<ClInclude Include="..\ReflectiveDLLInjection\dll\src\ReflectiveLoader.h" />
124169
<ClInclude Include="ReflectiveUnloader.h" />
125170
</ItemGroup>
126171
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />

‎ReflectiveUnloader/ReflectiveUnloader.vcxproj.filters‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,16 @@
2121
<ClCompile Include="Main.c">
2222
<Filter>Source Files</Filter>
2323
</ClCompile>
24+
<ClCompile Include="..\ReflectiveDLLInjection\dll\src\ReflectiveLoader.c">
25+
<Filter>Source Files</Filter>
26+
</ClCompile>
2427
</ItemGroup>
2528
<ItemGroup>
2629
<ClInclude Include="ReflectiveUnloader.h">
2730
<Filter>Header Files</Filter>
2831
</ClInclude>
32+
<ClInclude Include="..\ReflectiveDLLInjection\dll\src\ReflectiveLoader.h">
33+
<Filter>Header Files</Filter>
34+
</ClInclude>
2935
</ItemGroup>
3036
</Project>

0 commit comments

Comments
 (0)