PureBasic Forums - English

Code: Select all

NTSYSAPI NTSTATUS NTAPI 
  KeUserModeCallback(
  IN ULONG ApiNumber,
  IN PVOID InputBuffer,
  IN ULONG InputLength,
  OUT PVOID *OutputBuffer,
  IN PULONG OutputLength
  );
typedef struct _CLientLoadLibraryParam
{
  DWORD dwSize;//+0
  DWORD dwStringLength; //+4
  DWORD ReservedZero1;//+8
  DWORD ReservedZero2;//+C
  DWORD ReservedZero3;//+10
  DWORD ReservedZero4;//+14
  DWORD ReservedZero5;//+18 () +1A () //不需要！
  DWORD ptrDllString;//+1C
  DWORD ReservedZero6;//+20
  DWORD ptrApiString;//+24
  WCHAR szDllName[MAX_PATH];
  WCHAR szApiName[MAX_PATH];
}CLientLoadLibraryParam,*PCLientLoadLibraryParam;

NTSTATUS InjectDll(LPCWSTR lpszDll,LPCWSTR lpszApi)
{
  PVOID Return;
  ULONG RetLen;
  PVOID BaseAddress = NULL;
  SIZE_T size = sizeof(CLientLoadLibraryParam);
  NTSTATUS ns;
  ns = ZwAllocateVirtualMemory(NtCurrentProcess(),
    &BaseAddress,
    0,
    &size,
    MEM_COMMIT,
    PAGE_EXECUTE_READWRITE);
  if (NT_SUCCESS(ns))
  {
    PCLientLoadLibraryParam p = (PCLientLoadLibraryParam)BaseAddress;
    RtlZeroMemory(p,sizeof(CLientLoadLibraryParam));
    p->dwSize = sizeof(CLientLoadLibraryParam);
    p->ReservedZero4 = 1;//
    wcsncpy(p->szApiName,lpszApi,MAX_PATH);
    wcsncpy(p->szDllName,lpszDll,MAX_PATH);
    p->ptrApiString = (DWORD)p->szApiName;
    p->ptrDllString = (DWORD)p->szDllName;
    
    ns = KeUserModeCallback(0x42,//Win7  0x41
      BaseAddress,
      sizeof(CLientLoadLibraryParam),
      &Return,
      &RetLen
      );
  }
  return ns;
}

Code: Select all

IncludePath #PB_Compiler_Home+"DDK\"
XIncludeFile "ntddk.pbi"
XIncludeFile "ntstatus.pbi"
XIncludeFile "ntfunct.pbi"

Import "ntoskrnl.lib"
  KeUserModeCallback(ApiNumber,*InputBuffer,InputLength,*OutputBuffer,OutputLength)
  RtlZeroMemory(*p,len)
EndImport

CompilerIf #PB_Compiler_Unicode = 0
  CompilerError "Please enable unicode mode."
CompilerEndIf

Structure CLientLoadLibraryParam
  dwSize.l;//+0
  dwStringLength.l; //+4
  ReservedZero1.l;//+8
  ReservedZero2.l;//+C
  ReservedZero3.l;//+10
  ReservedZero4.l;//+14
  ReservedZero5.l;//+18 () +1A () //不需要！
  ptrDllString.l;//+1C
  ReservedZero6.l;//+20
  ptrApiString.l;//+24
  szDllName.s{#MAX_PATH};
  szApiName.s{#MAX_PATH};
EndStructure

Macro NtCurrentProcess()
  -1
EndMacro

Procedure InjectDll(lpszDll.s, lpszApi.s)
  *Ret=0;
  RetLen.l;
  *BaseAddress = #Null;
  size = SizeOf(CLientLoadLibraryParam);
  ns.i=0;
  
  ns = ZwAllocateVirtualMemory(NtCurrentProcess(),
                               @*BaseAddress,
                               0,
                               @size,
                               #MEM_COMMIT,
                               #PAGE_EXECUTE_READWRITE);
  
  If ns = #STATUS_SUCCESS
    *p.CLientLoadLibraryParam = *BaseAddress
    RtlZeroMemory(*p,SizeOf(CLientLoadLibraryParam));
    *p\dwSize = SizeOf(CLientLoadLibraryParam)      ;
    *p\ReservedZero4 = 1                            ;//
    *p\szApiName = lpszApi
    *p\szDllName = lpszDll;
    *p\ptrApiString = @*p\szApiName;
    *p\ptrDllString = @*p\szDllName;
    
    ns = KeUserModeCallback($42, ;//Win7  0x41
                            *BaseAddress,
                            SizeOf(CLientLoadLibraryParam),
                            @*Ret,
                            @RetLen);
  EndIf
  
    ProcedureReturn ns
EndProcedure