T
HIER das neuste ding, geht aber immer noch nicht, ACCESS VIOLATION!
/***********************************************************************************
Author : Tobias Stein
Data : 6th March '08
Project : WinApi hook
Remarks : ---
All Rights Reserved! (c)Copyright by Tobias Stein!
***********************************************************************************/
//--- Includes ---------------------------------------------------------------------
#include "stdafx.h"
using namespace std;
//--- Usertypes --------------------------------------------------------------------
typedef HINSTANCE (*fpLoadLibrary)( char* );
typedef FARPROC (*fpGetProcAddress)( HINSTANCE, char* );
typedef void (*fpMyFunction)( void );
typedef struct {
fpLoadLibrary LoadLib;
fpGetProcAddress GetProcAdd;
char szDLLName[ 128 ];
} INJECTDATA;
//--- Globals ----------------------------------------------------------------------
//--- Prototypes -------------------------------------------------------------------
DWORD GetPID( const char *szWindowName );
DWORD WINAPI ThreadProc( LPVOID vParam );
void ThreadEnd( );
bool InjectDLL( DWORD dwProcessID );
bool EnableDebugPrivilege( );
//--- Main -------------------------------------------------------------------------
int main( int argc, char* argv[ ] ) {
DWORD dwPID = 0;
// ***** Set console name *****
SetConsoleTitle( "WinApi Hook" );
// ***** Get PID *****
cout << "\n - Try to get process ID ..." << endl;
dwPID = GetPID( "WinApi Victim" );
if( dwPID == 0 ) {
cout << " FAILED!" << endl;
Sleep( 1500 );
return 0;
}
cout << " Process ID: " << dwPID << endl;
if( !( InjectDLL( dwPID ) ) ) {
cout << " FAILED!" << endl;
Sleep( 1500 );
return 0;
}
getchar( );
return 0;
}
//--- Definitions ------------------------------------------------------------------
// ***** This function get the PID from window name *****
DWORD GetPID( const char *szWindowName ) {
HWND hWindow = 0;
DWORD dwPID = 0;
hWindow = FindWindow( 0, szWindowName );
if( !hWindow )
return 0;
GetWindowThreadProcessId( hWindow, &dwPID );
return dwPID;
}
// ***** Thread procedure *****
DWORD WINAPI ThreadProc( LPVOID vParam ) {
INJECTDATA *iData = (INJECTDATA*)vParam;
HINSTANCE hDLL = iData->LoadLib( iData->szDLLName );
return 0;
}
// ***** End of thread function *****
void ThreadEnd( ) { }
// ***** DLL inject routine *****
bool InjectDLL( DWORD dwProcessID ) {
DWORD rw;
// ***** Get all access *****
EnableDebugPrivilege( );
// ***** Get process handle *****
cout << "\n - Try to recieve the process handle ..." << endl;
HANDLE hProcess = OpenProcess( PROCESS_ALL_ACCESS, 0, dwProcessID );
if( !hProcess ) {
CloseHandle( hProcess );
return false;
}
cout << " Process handle: " << hex << hProcess << endl;
// ***** Get Thread function size *****
cout << "\n - Determine structur & thread function size ..." << endl;
DWORD dwThreadSize = (DWORD)ThreadEnd - (DWORD)ThreadProc;
cout << " Inject structur size: " << dec << sizeof( INJECTDATA ) << " Bytes" << endl;
cout << " Thread function size: " << dec << dwThreadSize << " Bytes" << endl;
// ***** Allocate some memory for INJECTDATA *****
cout << "\n - Try to allocate memory for INJECTDATA structur (" << sizeof( INJECTDATA ) << ") ..." << endl;
LPVOID pMemData = VirtualAllocEx( hProcess, 0, sizeof( INJECTDATA ), MEM_COMMIT, PAGE_EXECUTE_READWRITE );
if( pMemData == 0 ) {
CloseHandle( hProcess );
return false;
}
cout << " Allocated memory: 0x" << hex << (DWORD)pMemData << " - 0x" << ( (DWORD)pMemData + sizeof( INJECTDATA ) ) << endl;
// ***** Create INJECTDATA struct and wirte to allocate memory *****
INJECTDATA iData;
memset( &iData, 0, sizeof( INJECTDATA ) );
iData.LoadLib = (fpLoadLibrary)GetProcAddress( GetModuleHandle( "Kernel32.dll" ), "LoadLibraryA" );
iData.GetProcAdd = (fpGetProcAddress)GetProcAddress( GetModuleHandle( "Kernel32.dll" ), "GetProcAddress" );
strcpy( iData.szDLLName, "WinApiHookDLL.dll" );
cout << "\n - Write IINJECTDATA struct to allocated memory (" << dec << (DWORD)pMemData << ") ..." << endl;
rw = 0;
if( ( WriteProcessMemory( hProcess, (LPVOID)pMemData, &iData, sizeof( INJECTDATA ), &rw ) ) == 0 ) {
CloseHandle( hProcess );
return false;
}
cout << " Done!" << endl;
// ***** Allocate some memory for thread func *****
cout << "\n - Try to allocate memory for thread function (" << dwThreadSize << ") ..." << endl;
LPVOID pMemThread = VirtualAllocEx( hProcess, 0, dwThreadSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE );
if( pMemThread == 0 ) {
CloseHandle( hProcess );
return false;
}
cout << " Allocated memory: 0x" << hex << (DWORD)pMemThread << " - 0x" << ( (DWORD)pMemThread + dwThreadSize ) << endl;
// ***** Write thread function to allocated memory *****
cout << "\n - Write Thread function to allocated memory (" << dec << (DWORD)pMemThread << ") ..." << endl;
rw = 0;
if( ( WriteProcessMemory( hProcess, (LPVOID)pMemThread, ThreadProc, dwThreadSize, &rw ) ) == 0 ) {
CloseHandle( hProcess );
return false;
}
cout << " Done!" << endl;
// ***** Now start remote thread *****
cout << "\n - Start remote thread ..." << endl;
HANDLE hThread = CreateRemoteThread( hProcess, 0, 0, (LPTHREAD_START_ROUTINE)pMemThread, pMemData, 0, 0 );
if( !hThread ) {
CloseHandle( hThread );
CloseHandle( hProcess );
return false;
}
WaitForSingleObject( hThread, INFINITE );
int iSuccess = 0;
GetExitCodeThread( hThread, (LPDWORD)iSuccess );
if( iSuccess == 0 ) {
CloseHandle( hThread );
CloseHandle( hProcess );
return false;
}
cout << " Thread was successfully started!" << endl;
// ***** Free allocated memory *****
cout << " - Try to free allocated memory ..." << endl;
if( ( VirtualFreeEx( hProcess, pMemData, 0, MEM_RELEASE ) ) == 0 ) {
CloseHandle( hThread );
CloseHandle( hProcess );
return false;
}
if( ( VirtualFreeEx( hProcess, pMemThread, 0, MEM_RELEASE ) ) == 0 ) {
CloseHandle( hThread );
CloseHandle( hProcess );
return false;
}
cout << " Free memory done!" << endl;
// ***** READY *****
CloseHandle( hThread );
CloseHandle( hProcess );
return true;
}
// ***** Get more access *****
bool EnableDebugPrivilege( ) {
TOKEN_PRIVILEGES priv;
HANDLE hThis, hToken;
LUID luid;
hThis = GetCurrentProcess();
OpenProcessToken(hThis, TOKEN_ADJUST_PRIVILEGES, &hToken);
LookupPrivilegeValue(0, "seDebugPrivilege", &luid);
priv.PrivilegeCount = 1;
priv.Privileges[0].Luid = luid;
priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken, false, &priv, 0, 0, 0);
CloseHandle(hToken);
CloseHandle(hThis);
return true;
}
//--- EXIT -------------------------------------------------------------------------
