├── README.md ├── .gitignore ├── .gitattributes ├── Injection.dpr └── Injection.dproj /README.md: -------------------------------------------------------------------------------- 1 | # One Time API Redirection Library 2 | This DLL library redirects a specified API for a one time execution of code upon injection into a process. 3 | 4 | It currently only supports x86 arcitecture. 5 | 6 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Windows thumbnail cache files 2 | Thumbs.db 3 | ehthumbs.db 4 | ehthumbs_vista.db 5 | 6 | # Folder config file 7 | Desktop.ini 8 | 9 | # Recycle Bin used on file shares 10 | $RECYCLE.BIN/ 11 | 12 | # Windows Installer files 13 | *.cab 14 | *.msi 15 | *.msm 16 | *.msp 17 | 18 | # Windows shortcuts 19 | *.lnk 20 | 21 | # ========================= 22 | # Operating System Files 23 | # ========================= 24 | -------------------------------------------------------------------------------- /.gitattributes: -------------------------------------------------------------------------------- 1 | # Auto detect text files and perform LF normalization 2 | * text=auto 3 | 4 | # Custom for Visual Studio 5 | *.cs diff=csharp 6 | 7 | # Standard to msysgit 8 | *.doc diff=astextplain 9 | *.DOC diff=astextplain 10 | *.docx diff=astextplain 11 | *.DOCX diff=astextplain 12 | *.dot diff=astextplain 13 | *.DOT diff=astextplain 14 | *.pdf diff=astextplain 15 | *.PDF diff=astextplain 16 | *.rtf diff=astextplain 17 | *.RTF diff=astextplain 18 | -------------------------------------------------------------------------------- /Injection.dpr: -------------------------------------------------------------------------------- 1 | library Injection; 2 | 3 | //One Time API Redirection Library 4 | //Copyright © 2020 Chester Fritz 5 | //GNU Public License. 6 | 7 | //This DLL library is designed to redirect a specified API for a one time execution of code upon injection into a process. 8 | //Set RedirAPI to the name of the API you wish to redirect. This is case sensitive. 9 | //Set DLLOFAPI to the name of the DLL you which to redirect including the .dll extension. 10 | //It should look like this: 11 | //CONST RedirAPI:AnsiString='CreateWindowExA'; 12 | //CONST DLLOFAPI:WideString='user32.dll'; 13 | //Add your code to execute to the "DoYourStuff" Procedure. I've added a simple PatchMemoryByte function for your convenience. 14 | 15 | uses 16 | Windows; 17 | CONST UnloadDLL:Boolean= FALSE;//if true, this will unload this dll after executing your code. DO NOT USE WITH REGISTER BASED or FASTCALL CALLING CONVENTIONS; 18 | CONST RedirAPI:AnsiString='YOURAPIHERE'; //api to be redirected////////////////////////////////////////////////////////////////////////////////////////////// 19 | CONST DLLOFAPI:WideString='YOURDLLHERE.DLL'; //dll containing that api/////////////////////////////////////////////////////////////////////////////////////// 20 | CONST LOCALDLLNAME:WideString='Injection.dll'; 21 | var 22 | RedirectedAPIAddr:Cardinal; //Address of the RedirectedAPI 23 | FreeLibAddr:Cardinal; //Address of FreeLibrary 24 | mimgbase:Cardinal; //Image Base of Main Executable 25 | localModHWND:Cardinal; // Module Handle of this DLL; 26 | originalBytes:Array[0..4] of byte; //Original Bytes of Redirected API for Restoration 27 | RedirectedModHWND:Cardinal;//Module Handle of Redirected DLL; 28 | 29 | 30 | Procedure PatchMemoryByte(VirtualAddress:Integer; val:Byte; IsWriteProtected:Boolean); 31 | var 32 | Tmp:Cardinal; 33 | Begin 34 | if VirtualAddress<0 then exit; 35 | 36 | if IsWriteProtected=true then 37 | if VirtualProtect(Pointer(VirtualAddress), 1, PAGE_EXECUTE_READWRITE, Tmp)=false then exit; 38 | 39 | PByte(VirtualAddress)^:=val; 40 | End; 41 | 42 | 43 | 44 | ////////////////////////////////////////////////////////////////////////////////////// 45 | Procedure DoYourStuff(returnAddress:Integer); STDCALL;//this is where you add your code; 46 | Begin 47 | 48 | End; 49 | ////////////////////////////////////////////////////////////////////////////////////// 50 | 51 | 52 | 53 | Procedure FixFunction(); STDCALL; //Restores the redirected API bytes 54 | Begin 55 | CopyMemory(Pointer(RedirectedAPIAddr),@originalBytes[0],5); 56 | End; 57 | 58 | Procedure InjectionJmpProcedure; assembler; 59 | label 60 | noUnload,DoneUnloadSetup; 61 | ASM 62 | CMP [UnloadDLL],0 63 | JE @noUnload 64 | PUSH localModHWND//Module Handle of Injection.DLL 65 | PUSH RedirectedAPIAddr //address of RedirectedAPI; 66 | PUSH FreeLibAddr//Address of FreeLibrary; 67 | PUSH EAX //VOLATILE REGISTER PRESERVATION SUPPORT FOR REGISTER BASED CALLS OR FASTCALL CONVENTIONS 68 | MOV EAX, DWORD PTR DS:[ESP+$10]//Gets Return Address from Stack 69 | JMP @DoneUnloadSetup 70 | @noUnload: 71 | PUSH RedirectedAPIAddr 72 | PUSH EAX //VOLATILE REGISTER PRESERVATION SUPPORT FOR REGISTER BASED CALLS OR FASTCALL CONVENTIONS 73 | MOV EAX, DWORD PTR DS:[ESP+$8]//Gets Return Address from Stack 74 | @DoneUnloadSetup: 75 | PUSH EBX //VOLATILE REGISTER PRESERVATION SUPPORT FOR REGISTER BASED CALLS OR FASTCALL CONVENTIONS 76 | PUSH ECX 77 | PUSH EDX 78 | PUSH EAX 79 | CALL DoYourStuff 80 | CALL FixFunction 81 | POP EDX 82 | POP ECX 83 | POP EBX 84 | POP EAX 85 | RET 86 | END; 87 | 88 | Function LongJumpCalculator(location,destination:integer;VAR jmp:Cardinal):Boolean; 89 | CONST SelfVal:integer=-5; 90 | Begin 91 | if (location<0) or (destination <0) then 92 | Begin 93 | result:=false; 94 | exit; 95 | End; 96 | jmp:=SelfVal+(destination-location); 97 | result:=true; 98 | End; 99 | 100 | 101 | Procedure InitilizeAndRedirect(); 102 | var 103 | tmp,jmpval:Cardinal; 104 | Begin 105 | mimgbase:=GetModuleHandleW(nil); 106 | RedirectedModHWND:=GetModuleHandleW(@DLLOFAPI[1]); 107 | if RedirectedModHWND=0 then exit; 108 | 109 | localModHWND:=GetModuleHandleW(@LOCALDLLNAME[1]); 110 | if localModHWND=0 then Exit; 111 | 112 | tmp:=GetModuleHandleW(WideString('kernel32.dll')); 113 | if tmp=0 then Exit; 114 | 115 | FreeLibAddr:=Cardinal(GetProcAddress(tmp,AnsiString('FreeLibrary'))); 116 | if FreeLibAddr=0 then Exit; 117 | 118 | RedirectedAPIAddr:=Cardinal(GetProcAddress(RedirectedModHWND,PAnsiChar(@RedirAPI[1]))); 119 | if RedirectedAPIAddr= 0 then exit; 120 | 121 | VirtualProtect(Pointer(RedirectedAPIAddr),10,PAGE_EXECUTE_READWRITE ,tmp); 122 | CopyMemory(@originalBytes[0],Pointer(RedirectedAPIAddr),5); 123 | LongJumpCalculator(Integer(RedirectedAPIAddr),Integer(@InjectionJmpProcedure),jmpval); 124 | PByte(RedirectedAPIAddr)^:=$e9; //set jmp 125 | pCardinal(RedirectedAPIAddr+1)^:=jmpval; //set jmp location 126 | End; 127 | 128 | begin //Function Main 129 | 130 | InitilizeAndRedirect; 131 | 132 | end. 133 | -------------------------------------------------------------------------------- /Injection.dproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | {7450D470-B7BC-49E2-97A8-FAF0031C6821} 4 | 12.3 5 | Injection.dpr 6 | True 7 | Release 8 | Win32 9 | Library 10 | None 11 | DCC32 12 | 13 | 14 | true 15 | 16 | 17 | true 18 | Base 19 | true 20 | 21 | 22 | true 23 | Base 24 | true 25 | 26 | 27 | true 28 | WinTypes=Windows;WinProcs=Windows;DbiTypes=BDE;DbiProcs=BDE;DbiErrs=BDE;$(DCC_UnitAlias) 29 | 00400000 30 | x86 31 | 32 | 33 | false 34 | RELEASE;$(DCC_Define) 35 | 0 36 | false 37 | 38 | 39 | DEBUG;$(DCC_Define) 40 | 41 | 42 | 43 | MainSource 44 | 45 | 46 | Cfg_2 47 | Base 48 | 49 | 50 | Base 51 | 52 | 53 | Cfg_1 54 | Base 55 | 56 | 57 | 58 | 59 | 60 | Delphi.Personality.12 61 | 62 | 63 | 64 | 65 | True 66 | False 67 | 1 68 | 0 69 | 0 70 | 0 71 | False 72 | False 73 | False 74 | False 75 | False 76 | 1033 77 | 1252 78 | 79 | 80 | 81 | 82 | 1.0.0.0 83 | 84 | 85 | 86 | 87 | 88 | 1.0.0.0 89 | 90 | 91 | /n software inc. - IP*Works! V9 - www.nsoftware.com 92 | /n software inc. - IP*Works! SSL V9 - www.nsoftware.com 93 | KHexEditor - design time package 94 | Microsoft Office 2000 Sample Automation Server Wrapper Components 95 | Microsoft Office XP Sample Automation Server Wrapper Components 96 | Embarcadero C++Builder Office 2000 Servers Package 97 | Embarcadero C++Builder Office XP Servers Package 98 | TeeChart Pro 2015 Components 99 | 100 | 101 | Injection.dpr 102 | 103 | 104 | 105 | True 106 | 107 | 108 | 12 109 | 110 | 111 | --------------------------------------------------------------------------------