C++ DLL ENFECKTOR

Posted on by damrakoc

C++
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
// We Will Be Using These.
 
#include "stdafx.h"
#include <windows.h>
#include <tlhelp32.h>
#include <shlwapi.h>
#include <conio.h>
#include <stdio.h>
#include <cstdlib>
#include <iostream>
 
using namespace std;
 
// Lets Just Define Some Variables
#define WIN32_LEAN_AND_MEAN
#define CREATE_THREAD_ACCESS (PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ
 
/////////////////////////////////////
DWORD WINAPI GetCurrentProcessId(void);
BOOL WINAPI TerminateProcess(_In_ HANDLE hProcess, _In_ UINT uExitCode);
 
/////////////////////////////////////
 
// Lets declare our function
BOOL CreateRemoteThreadInject(DWORD ID, const char *dll);
 
// Let declare GetProcessId
DWORD GetProcessId(IN PCHAR szExeName);
 
HANDLE
CreateRemoteThreadEx(HANDLE hProcess, LPSECURITY_ATTRIBUTES lpThreadAttributes,
                     SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress,
                     DWORD dwCreationFlags, LPDWORD lpThreadId, LPSTR szFormat,
                     ...) {
  char *lpCallGate, *lpData, *lpCode, *lpArg;
  va_list vlParameters;
  BYTE i, j;
  DWORD dwDataSize, dwCallSize, dwWritten, dwAmount = 0; // amount of parameters
 
  char CallGateShellcode[] =
      "\xE8\x1D\x00\x00\x00"       // CALL $+0x1D
                                   /*/*/
      /*|*/ "\x50"                 // PUSH EAX
      /*|*/ "\x68\x58\x58\xC3\x90" // PUSH 90C35858 (code for POP EAX\nPOP
                                   // EAX\nRETN)"
      /*|*/ "\x68\x00\x40\x00\x00" // PUSH MEM_RELEASE
      /*|*/ "\x6A\x01"             // PUSH 1
      /*|*/ "\x68\x00\x00\x00\x00" // PUSH 00000000 (-> PUSH lpCallGate)
      /*|*/ "\x54"                 // PUSH ESP
      /*|*/ "\x83\x04\x24\x0C"     // ADD DWORD [ESP], 0x0C
      /*|*/ "\x68\x00\x00\x00\x00" // PUSH 00000000 (-> PUSH VirtualFree)
      /*|*/ "\xC3"                 // RETN
                                   /*\*/
      "\x68\x00\x00\x00\x00"       // PUSH 00000000 (-> PUSH lpStartAddress)
      "\xC3"                       // RETN
      ;
 
  // Calculate the size of our callgate. Depends on
  // amount of parameters.
 
  if (szFormat) {
    // Count %'s
    for (i = 0; szFormat[i] != '\0'; i++)
      if (szFormat[i] == '%')
        dwAmount++;
 
    // Calculate size of data (%s, %[num]d)
    i = 0;
    dwDataSize = 0;
    va_start(vlParameters, dwAmount);
    while (szFormat[i] != '\0') {
      if (szFormat[i] != '%')
        return NULL;
      i++;
 
      switch (szFormat[i]) {
      case 'd':
      case 'u':
      case 'x':
        va_arg(vlParameters, DWORD);
        break;
      case 's':
        dwDataSize += lstrlen(va_arg(vlParameters, char *)) + 1;
        break;
      default: // number?
        // Conversion from string to integer
        for (j = 0; szFormat[i] >= '0' && szFormat[i] <= '9'; i++)
          j = j * 10 + szFormat[i] - '0';
        if (!j || szFormat[i] != 'd')
          return 0; // Converting failed
 
        va_arg(vlParameters, char *);
        dwDataSize += j;
        break;
      }
      i++;
    }
    va_end(vlParameters);
  } // if(szFormat)
 
  dwCallSize = dwAmount * (4 + 1) // Size of  PUSH instructions
               + dwDataSize       // %s, %d
               + sizeof(CallGateShellcode);
 
  // Allocate memory for callgate constructing (local process)
  char *lpShellcodeBuffer =
      (char *)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, dwCallSize);
  if (!lpShellcodeBuffer)
    return NULL;
 
  // Allocate memory from remote process
  lpCallGate = (char *)VirtualAllocEx(hProcess, NULL, dwCallSize, MEM_COMMIT,
                                      PAGE_EXECUTE_READWRITE);
  if (!lpCallGate) {
    HeapFree(GetProcessHeap(), 0, lpShellcodeBuffer);
    return NULL;
  }
 
  // Construct it. Copy data/strings to beginning of the buffer,
  // code to the end.
  va_start(vlParameters, dwAmount);
  lpData = lpShellcodeBuffer;
  lpCode = lpShellcodeBuffer + dwDataSize + dwAmount * (1 + 4);
  i = 0;
  if (szFormat) {
    while (szFormat[i] != '\0') {
      i++; // %
      switch (szFormat[i]) {
      case 'd':
      case 'u':
      case 'x':
        lpCode -= 5;      // due to calling conventions
        (*lpCode) = 0x68; // PUSH
        *(DWORD *)(lpCode + 1) = (DWORD)va_arg(vlParameters, DWORD);
        break;
      case 's':
        lpArg = va_arg(vlParameters, char *);
        j = lstrlen(lpArg) + 1;
        break;
      default:
        // Conversion from string to integer
        lpArg = va_arg(vlParameters, char *);
        for (j = 0; szFormat[i] >= '0' && szFormat[i] <= '9'; i++)
          j = j * 10 + szFormat[i] - '0';
        break;
      }
      if (szFormat[i] == 's' || szFormat[i] == 'd') {
        lpCode -= 5;
        (*lpCode) = 0x68;
        *(DWORD *)(lpCode + 1) =
            (DWORD)(lpCallGate + (lpData - lpShellcodeBuffer));
 
        while (j) {
          (*lpData) = *lpArg;
          lpData++, lpArg++;
          j--;
        }
      }
      i++; // xsd
    }
    va_end(vlParameters);
  } // if(szFormat)
 
  // Copy the shellcode
  // (it's responsible to push arguments to stack, virtualfree itself, call the
  // thread)
  lpCode = lpShellcodeBuffer + dwDataSize + dwAmount * (1 + 4);
  *(DWORD *)(CallGateShellcode + 19) = (DWORD)lpCallGate;
  *(DWORD *)(CallGateShellcode + 35) = (DWORD)lpStartAddress;
  *(DWORD *)(CallGateShellcode + 29) =
      (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"), "VirtualFree");
  for (i = 0; i < sizeof(CallGateShellcode); i++, lpCode++)
    (*lpCode) = CallGateShellcode[i];
 
  // Write the shellcode to remote process and call it
  WriteProcessMemory(hProcess, lpCallGate, lpShellcodeBuffer, dwCallSize,
                     &dwWritten);
  HeapFree(GetProcessHeap(), 0, lpShellcodeBuffer);
 
  if (!dwWritten)
    return NULL;
  return CreateRemoteThread(hProcess, lpThreadAttributes, dwStackSize,
                            (LPTHREAD_START_ROUTINE)(lpCallGate + dwDataSize),
                            0, dwCreationFlags, lpThreadId);
}
 
// Our Application Starts Here.
int main() {
  cout << "Damra KOC DLL ENFECKTOR" << endl << endl;
  // Declare our dll variable
  char dll[MAX_PATH];
 
  // Get the full path of our .dll
  GetFullPathName("TaskFucker.dll", MAX_PATH, dll, NULL);
  cout << dll << endl;
  // We will be using this neat little function written by batfitch -
  // GetProcessId.
  DWORD ID = GetProcessId("VB6.exe");
  if (!CreateRemoteThreadInject(ID, dll)) {
 
    printf("Injection failed!");
    // TerminateProcess(INVALID_HANDLE_VALUE,0);
 
    exit(1);
 
  } else {
 
    printf("Injection Successful!");
    // TerminateProcess(INVALID_HANDLE_VALUE,0);
 
    exit(1);
  }
  return 1;
}
 
DWORD GetProcessId(IN PCHAR szExeName){
  DWORD dwRet = 0;
  DWORD dwCount = 0;
 
  HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
 
  if (hSnapshot != INVALID_HANDLE_VALUE) {
    PROCESSENTRY32 pe = {0};
    pe.dwSize = sizeof(PROCESSENTRY32);
 
    BOOL bRet = Process32First(hSnapshot, &pe);
 
    while (bRet) {
      if (!_stricmp(pe.szExeFile, szExeName)) {
        dwCount++;
        dwRet = pe.th32ProcessID;
      }
      bRet = Process32Next(hSnapshot, &pe);
    }
 
    if (dwCount > 1)
      dwRet = 0xFFFFFFFF;
 
    CloseHandle(hSnapshot);
  }
 
  return dwRet;
}
 
BOOL CreateRemoteThreadInject(DWORD ID, const char *dll){
  HANDLE Process;
 
  LPVOID Memory;
 
  LPVOID LoadLibrary;
 
  if (!ID) {
    return false;
  }
 
  // Open the process with read , write and execute priviledges
  Process =
      OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION |
                      PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_VM_OPERATION,
                  FALSE, ID);
 
  // Get the address of LoadLibraryA
  LoadLibrary =
      (LPVOID)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
 
  // Allocate space in the process for our DLL
  Memory = (LPVOID)VirtualAllocEx(Process, NULL, strlen(dll) + 1,
                                  MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
 
  // Write the string name of our DLL in the memory allocated
  WriteProcessMemory(Process, (LPVOID)Memory, dll, strlen(dll) + 1, NULL);
 
  // Load our DLL
  // CreateRemoteThreadex(Process, NULL, NULL,
  //(LPTHREAD_START_ROUTINE)LoadLibrary, (LPVOID)Memory, NULL, NULL);
  CreateRemoteThreadEx(Process, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibrary,
                       NULL, NULL, NULL);
 
  // Let the program regain control of itself
  CloseHandle(Process);
 
  // Lets free the memory we are not using anymore.
  VirtualFreeEx(Process, (LPVOID)Memory, 0, MEM_RELEASE);
 
  return true;
}

 

Read More

Dll ile paket skill gönderilmesi

Posted on by damrakoc

MemoryFunctions.h

1
2
#include <windows.h>
#include <iostream>

Gerekli olan bağdaştırıcılar

1
2
3
4
5
6
7
#define CopyBytes(Dest, Src) memcpy(Dest, (BYTE *)&Src, sizeof(Src))
 
DWORD GAME_CHRPTR = 0x00C27C50;
DWORD GAME_PKTPTR = 0x00C27F10;
DWORD GAME_SNDPTR = 0x00C1D368;
DWORD GAME_SNDFNC;
WORD GAME_CHARID = 0x5C4;

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
#pragma region MEMORYFUNCTİONS
 
DWORD RDWORD(DWORD ulBase) {
  if (!IsBadReadPtr((VOID *)ulBase, sizeof(DWORD))) {
    return (*(DWORD *)(ulBase));
  }
  return 0;
}
 
float Rfloat(DWORD ulBase) {
  if (!IsBadReadPtr((VOID *)ulBase, sizeof(DWORD))) {
    return (*(float *)(ulBase));
  }
  return 0;
}
 
WORD RWORD(DWORD ulBase) {
  if (!IsBadReadPtr((VOID *)ulBase, sizeof(DWORD))) {
    return (*(WORD *)(ulBase));
  }
  return 0;
}
 
BYTE RBYTE(DWORD ulBase) {
  if (!IsBadReadPtr((VOID *)ulBase, sizeof(DWORD))) {
    return (*(BYTE *)(ulBase));
  }
  return 0;
}
 
#pragma endregion

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
void SendFunction() {
  switch ((*(BYTE *)(GAME_SNDPTR))) {
  case 22:
    __asm mov GAME_SNDFNC, 0 break;
  case 23:
    __asm mov GAME_SNDFNC, 1 break;
  case 20:
    __asm mov GAME_SNDFNC, 2 break;
  case 21:
    __asm mov GAME_SNDFNC, 3 break;
  case 18:
    __asm mov GAME_SNDFNC, 4 break;
  case 19:
    __asm mov GAME_SNDFNC, 5 break;
  case 16:
    __asm mov GAME_SNDFNC, 6 break;
  case 17:
    __asm mov GAME_SNDFNC, 7 break;
  case 30:
    __asm mov GAME_SNDFNC, 8 break;
  case 31:
    __asm mov GAME_SNDFNC, 9 break;
  }
}
 
void SendPacketz(BYTE *packets, size_t sizes) {
  __asm {
        mov ecx, GAME_PKTPTR
        mov ecx, dword ptr ds:[ecx]
        mov eax, GAME_SNDFNC
        push sizes
        push packets
        call [eax*4+ecx+40064h]
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
void isMinorHealling() {
  SendFunction();
 
  while (1) {
 
    if (GetAsyncKeyState(VK_END)) {
 
      DWORD ADDR_CHRB = RDWORD(GAME_CHRPTR);
      WORD MEID = RWORD(ADDR_CHRB + GAME_CHARID);
 
      DWORD SkillID = 108705;
      BYTE packet[] = {0x31, 0x03, 0x73, 0x8E, 0x01, 0,    0,    0,
                       0,    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
 
      CopyBytes(packet + 2, SkillID);
      CopyBytes(packet + 6, MEID);
      CopyBytes(packet + 8, MEID);
 
      SendPacketz(packet, sizeof(packet));
      // puts("Sent.");
    }
    Sleep(500);
  }
}

  dllmain.cpp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
#include "MemoryFunctions.h"
extern void isMinorHealling();
DWORD ThreadID;
 
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call,
                      LPVOID lpReserved) {
  switch (ul_reason_for_call) {
  case DLL_PROCESS_ATTACH:
 
    CreateThread(0, 0, (LPTHREAD_START_ROUTINE)&isMinorHealling, 0, 0,
                 &ThreadID);
 
  case DLL_THREAD_ATTACH:
  case DLL_THREAD_DETACH:
  case DLL_PROCESS_DETACH:
    break;
  }
  return TRUE;
}

 

Read More