inject.h File Reference

Go to the source code of this file.

Classes
struct	LDR_DATA_TABLE_ENTRY
struct	_PEB_LDR_DATA
struct	_PEB
struct	_IMAGE_DOS_HEADER
struct	_IMAGE_FILE_HEADER
struct	_IMAGE_DATA_DIRECTORY
struct	_IMAGE_OPTIONAL_HEADER64
struct	_IMAGE_NT_HEADERS64
struct	_IMAGE_EXPORT_DIRECTORY
struct	_APC_DATA

Macros
#define	TAG   'inje'
#define	IMAGE_NUMBEROF_DIRECTORY_ENTRIES   16
#define	IMAGE_DIRECTORY_ENTRY_EXPORT   0

Typedefs
typedef unsigned long	DWORD
typedef int	BOOL
typedef unsigned char	BYTE
typedef unsigned short	WORD
typedef struct _PEB_LDR_DATA	PEB_LDR_DATA
typedef struct _PEB_LDR_DATA *	PPEB_LDR_DATA
typedef struct _PEB	PEB
typedef struct _PEB *	PPEB
typedef struct _IMAGE_DOS_HEADER	IMAGE_DOS_HEADER
typedef struct _IMAGE_DOS_HEADER *	PIMAGE_DOS_HEADER
typedef struct _IMAGE_FILE_HEADER	IMAGE_FILE_HEADER
typedef struct _IMAGE_FILE_HEADER *	PIMAGE_FILE_HEADER
typedef struct _IMAGE_DATA_DIRECTORY	IMAGE_DATA_DIRECTORY
typedef struct _IMAGE_DATA_DIRECTORY *	PIMAGE_DATA_DIRECTORY
typedef struct _IMAGE_OPTIONAL_HEADER64	IMAGE_OPTIONAL_HEADER64
typedef struct _IMAGE_OPTIONAL_HEADER64 *	PIMAGE_OPTIONAL_HEADER64
typedef struct _IMAGE_NT_HEADERS64	IMAGE_NT_HEADERS64
typedef struct _IMAGE_NT_HEADERS64 *	PIMAGE_NT_HEADERS64
typedef struct _IMAGE_EXPORT_DIRECTORY	IMAGE_EXPORT_DIRECTORY
typedef struct _IMAGE_EXPORT_DIRECTORY *	PIMAGE_EXPORT_DIRECTORY
typedef enum _KAPC_ENVIRONMENT	KAPC_ENVIRONMENT
typedef enum _KAPC_ENVIRONMENT *	PKAPC_ENVIRONMENT
typedef VOID(NTAPI *	PKNORMAL_ROUTINE) (_In_ PVOID NormalContext, _In_ PVOID SystemArgument1, _In_ PVOID SystemArgument2)
typedef VOID	KKERNEL_ROUTINE(_In_ PRKAPC Apc, _Inout_opt_ PKNORMAL_ROUTINE *NormalRoutine, _Inout_opt_ PVOID *NormalContext, _Inout_ PVOID *SystemArgument1, _Inout_ PVOID *SystemArgument2)
typedef struct _APC_DATA	APC_DATA
typedef struct _APC_DATA *	PAPC_DATA
typedef VOID(NTAPI *	PKRUNDOWN_ROUTINE) (_In_ PRKAPC Apc)

Enumerations
enum	_KAPC_ENVIRONMENT { OriginalApcEnvironment , AttachedApcEnvironment , CurrentApcEnvironment , InsertApcEnvironment }

Functions
typedef	KKERNEL_ROUTINE (NTAPI *PKKERNEL_ROUTINE)
VOID NTAPI	KeInitializeApc (_Out_ PRKAPC Apc, _In_ PRKTHREAD Thread, _In_ KAPC_ENVIRONMENT Environment, _In_ PKKERNEL_ROUTINE KernelRoutine, _In_opt_ PKRUNDOWN_ROUTINE RundownRoutine, _In_opt_ PKNORMAL_ROUTINE NormalRoutine, _In_opt_ KPROCESSOR_MODE ProcessorMode, _In_opt_ PVOID NormalContext)
BOOLEAN NTAPI	KeInsertQueueApc (_Inout_ PRKAPC Apc, _In_opt_ PVOID SystemArgument1, _In_opt_ PVOID SystemArgument2, _In_ KPRIORITY Increment)
bool	InjectDLL (HANDLE ProcessId, PVOID processInfo)
NTSTATUS	AllocateMemoryInUserProcess (PEPROCESS Process, SIZE_T Size, PVOID *AllocatedAddress)
NTSTATUS	WriteToTargetProcessMemory (PEPROCESS Process, PVOID TargetAddress, SIZE_T Size, PVOID DataToWrite)

Variables
EX_RUNDOWN_REF	PendingOperations

Macro Definition Documentation

IMAGE_DIRECTORY_ENTRY_EXPORT

#define IMAGE_DIRECTORY_ENTRY_EXPORT   0

Definition at line 9 of file inject.h.

IMAGE_NUMBEROF_DIRECTORY_ENTRIES

#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES   16

Definition at line 8 of file inject.h.

TAG

#define TAG   'inje'

Definition at line 7 of file inject.h.

Typedef Documentation

APC_DATA

typedef struct _APC_DATA APC_DATA

BOOL

typedef int BOOL

Definition at line 3 of file inject.h.

BYTE

typedef unsigned char BYTE

Definition at line 4 of file inject.h.

DWORD

typedef unsigned long DWORD

Definition at line 2 of file inject.h.

IMAGE_DATA_DIRECTORY

typedef struct _IMAGE_DATA_DIRECTORY IMAGE_DATA_DIRECTORY

IMAGE_DOS_HEADER

typedef struct _IMAGE_DOS_HEADER IMAGE_DOS_HEADER

IMAGE_EXPORT_DIRECTORY

typedef struct _IMAGE_EXPORT_DIRECTORY IMAGE_EXPORT_DIRECTORY

IMAGE_FILE_HEADER

typedef struct _IMAGE_FILE_HEADER IMAGE_FILE_HEADER

IMAGE_NT_HEADERS64

typedef struct _IMAGE_NT_HEADERS64 IMAGE_NT_HEADERS64

IMAGE_OPTIONAL_HEADER64

typedef struct _IMAGE_OPTIONAL_HEADER64 IMAGE_OPTIONAL_HEADER64

KAPC_ENVIRONMENT

typedef enum _KAPC_ENVIRONMENT KAPC_ENVIRONMENT

KKERNEL_ROUTINE

typedef VOID KKERNEL_ROUTINE(_In_ PRKAPC Apc, _Inout_opt_ PKNORMAL_ROUTINE *NormalRoutine, _Inout_opt_ PVOID *NormalContext, _Inout_ PVOID *SystemArgument1, _Inout_ PVOID *SystemArgument2)

Definition at line 214 of file inject.h.

PAPC_DATA

typedef struct _APC_DATA * PAPC_DATA

PEB

typedef struct _PEB PEB

PEB_LDR_DATA

typedef struct _PEB_LDR_DATA PEB_LDR_DATA

PIMAGE_DATA_DIRECTORY

typedef struct _IMAGE_DATA_DIRECTORY * PIMAGE_DATA_DIRECTORY

PIMAGE_DOS_HEADER

typedef struct _IMAGE_DOS_HEADER * PIMAGE_DOS_HEADER

PIMAGE_EXPORT_DIRECTORY

typedef struct _IMAGE_EXPORT_DIRECTORY * PIMAGE_EXPORT_DIRECTORY

PIMAGE_FILE_HEADER

typedef struct _IMAGE_FILE_HEADER * PIMAGE_FILE_HEADER

PIMAGE_NT_HEADERS64

typedef struct _IMAGE_NT_HEADERS64 * PIMAGE_NT_HEADERS64

PIMAGE_OPTIONAL_HEADER64

typedef struct _IMAGE_OPTIONAL_HEADER64 * PIMAGE_OPTIONAL_HEADER64

PKAPC_ENVIRONMENT

typedef enum _KAPC_ENVIRONMENT * PKAPC_ENVIRONMENT

PKNORMAL_ROUTINE

typedef VOID(NTAPI * PKNORMAL_ROUTINE) (_In_ PVOID NormalContext, _In_ PVOID SystemArgument1, _In_ PVOID SystemArgument2)

Definition at line 208 of file inject.h.

PKRUNDOWN_ROUTINE

typedef VOID(NTAPI * PKRUNDOWN_ROUTINE) (_In_ PRKAPC Apc)

Definition at line 230 of file inject.h.

PPEB

typedef struct _PEB * PPEB

PPEB_LDR_DATA

typedef struct _PEB_LDR_DATA * PPEB_LDR_DATA

WORD

typedef unsigned short WORD

Definition at line 5 of file inject.h.

Enumeration Type Documentation

_KAPC_ENVIRONMENT

enum _KAPC_ENVIRONMENT

Enumerator
OriginalApcEnvironment
AttachedApcEnvironment
CurrentApcEnvironment
InsertApcEnvironment

Definition at line 201 of file inject.h.

                               {
    OriginalApcEnvironment,
    AttachedApcEnvironment,
    CurrentApcEnvironment,
    InsertApcEnvironment
} KAPC_ENVIRONMENT, * PKAPC_ENVIRONMENT;

Function Documentation

AllocateMemoryInUserProcess()

NTSTATUS AllocateMemoryInUserProcess	(	PEPROCESS	Process,
		SIZE_T	Size,
		PVOID *	AllocatedAddress
	)

Definition at line 69 of file inject.cpp.

{
    HANDLE processHandle = NULL;
    NTSTATUS status;
    SIZE_T allocSize = Size;
    PVOID baseAddress = NULL;
 
    // Open a handle to the process
    status = ObOpenObjectByPointer(targetProcess,
        OBJ_KERNEL_HANDLE,
        NULL,
        PROCESS_ALL_ACCESS,
        *PsProcessType,
        KernelMode,
        &processHandle);
 
    if (NT_SUCCESS(status)) {
        // Allocate memory in the target process
        status = ZwAllocateVirtualMemory(processHandle,
            &baseAddress,
            0,
            &allocSize,
            MEM_COMMIT | MEM_RESERVE,
            PAGE_READWRITE);
 
        if (NT_SUCCESS(status)) {
            //RtlZeroMemory(baseAddress, Size);
            *AllocatedAddress = baseAddress;
        }
 
        // Close the process handle
        ZwClose(processHandle);
    }
 
    // Dereference the process
    ObDereferenceObject(targetProcess);
 
    return status;
}

InjectDLL()

bool InjectDLL	(	HANDLE	ProcessId,
		PVOID	processInfo
	)

KeInitializeApc()

VOID NTAPI KeInitializeApc	(	_Out_ PRKAPC	Apc,
		_In_ PRKTHREAD	Thread,
		_In_ KAPC_ENVIRONMENT	Environment,
		_In_ PKKERNEL_ROUTINE	KernelRoutine,
		_In_opt_ PKRUNDOWN_ROUTINE	RundownRoutine,
		_In_opt_ PKNORMAL_ROUTINE	NormalRoutine,
		_In_opt_ KPROCESSOR_MODE	ProcessorMode,
		_In_opt_ PVOID	NormalContext
	)

Referenced by InjectDllKernelApc(), and InstallKernelModeApcToInjectDll().

KeInsertQueueApc()

BOOLEAN NTAPI KeInsertQueueApc	(	_Inout_ PRKAPC	Apc,
		_In_opt_ PVOID	SystemArgument1,
		_In_opt_ PVOID	SystemArgument2,
		_In_ KPRIORITY	Increment
	)

Referenced by InjectDllKernelApc(), and InstallKernelModeApcToInjectDll().

KKERNEL_ROUTINE()

typedef KKERNEL_ROUTINE

(

NTAPI *

PKKERNEL_ROUTINE

)

WriteToTargetProcessMemory()

NTSTATUS WriteToTargetProcessMemory	(	PEPROCESS	Process,
		PVOID	TargetAddress,
		SIZE_T	Size,
		PVOID	DataToWrite
	)

Definition at line 11 of file inject.cpp.

{
    KAPC_STATE apcState;
    PMDL mdl = NULL;
    PVOID kernelAddress = NULL;
    NTSTATUS status = STATUS_SUCCESS;
 
    // Attach to the target process
    KeStackAttachProcess(targetProcess, &apcState);
 
    __try {
        // Create the MDL for the target process memory
        mdl = IoAllocateMdl(TargetAddress, (ULONG)Size, FALSE, FALSE, NULL);
        if (!mdl) {
            status = STATUS_INSUFFICIENT_RESOURCES;
            __leave;
        }
 
        __try {
            // Probe and lock the pages
            MmProbeAndLockPages(mdl, KernelMode, IoWriteAccess);
 
            // Map the MDL to system address space
            kernelAddress = MmGetSystemAddressForMdlSafe(mdl, NormalPagePriority);
            if (!kernelAddress) {
                status = STATUS_INSUFFICIENT_RESOURCES;
                __leave;
            }
 
            // Write to the mapped address
            RtlCopyMemory(kernelAddress, DataToWrite, Size);
        }
        __except (EXCEPTION_EXECUTE_HANDLER) {
            status = GetExceptionCode();
        }
    }
    __finally {
        // Cleanup
        if (kernelAddress) {
            MmUnmapLockedPages(kernelAddress, mdl);
        }
        if (mdl) {
            if (mdl->MdlFlags & MDL_PAGES_LOCKED) {
                MmUnlockPages(mdl);
            }
            IoFreeMdl(mdl);
        }
 
        // Detach from the target process
        KeUnstackDetachProcess(&apcState);
 
        // Dereference the process
        ObDereferenceObject(targetProcess);
    }
 
    return status;
}

Variable Documentation

PendingOperations

EX_RUNDOWN_REF PendingOperations

extern