i added get_peb to VDM and translated the modules base address

master
_xeroxz 4 years ago
parent 489772464a
commit 80cd4b1faa

@ -31,52 +31,4 @@ and thus keep the PML4's synced.
You can call functions that do not reference absolute addresses. This last sentence is pretty ambigous but in short, when the process is injected into another the space between the PML4E's You can call functions that do not reference absolute addresses. This last sentence is pretty ambigous but in short, when the process is injected into another the space between the PML4E's
is not the same (nor is the PML4E index the same). is not the same (nor is the PML4E index the same).
My suggestion is you call only small functions if you want to call functions. My suggestion is you call only small functions if you want to call functions.
# Example
Since all of the processes memory is mapped into your process you can simply walk the processes PEB for loaded modules. Here is an example of how to do that.
```cpp
auto get_module_base(vdm::vdm_ctx* v_ctx, nasa::injector_ctx* rinjector,
std::uint32_t pid, const wchar_t* module_name) -> std::uintptr_t
{
const auto ppeb =
reinterpret_cast<PPEB>(
rinjector->translate(
reinterpret_cast<std::uintptr_t>(v_ctx->get_peb(pid))));
const auto ldr_data =
reinterpret_cast<PPEB_LDR_DATA>(
rinjector->translate(reinterpret_cast<std::uintptr_t>(ppeb->Ldr)));
auto current_entry =
reinterpret_cast<LIST_ENTRY*>(
rinjector->translate(reinterpret_cast<std::uintptr_t>(
ldr_data->InMemoryOrderModuleList.Flink)));
while (current_entry != &ldr_data->InMemoryOrderModuleList)
{
const auto current_entry_data =
reinterpret_cast<PLDR_DATA_TABLE_ENTRY>(
reinterpret_cast<std::uintptr_t>(current_entry) - sizeof LIST_ENTRY);
// shit looks like a stair case LMFAO?
// need an elevator for this...
const auto entry_module_name =
reinterpret_cast<const wchar_t*>(
rinjector->translate(
reinterpret_cast<std::uintptr_t>(
reinterpret_cast<PUNICODE_STRING>(
reinterpret_cast<std::uintptr_t>(
&current_entry_data->FullDllName) + sizeof UNICODE_STRING)->Buffer)));
if (!_wcsicmp(entry_module_name, module_name))
return reinterpret_cast<std::uintptr_t>(current_entry_data->DllBase);
current_entry = reinterpret_cast<LIST_ENTRY*>(
rinjector->translate(reinterpret_cast<std::uintptr_t>(current_entry->Flink)));
}
return {};
}
```

@ -3,6 +3,50 @@
#include "injector_ctx/injector_ctx.hpp" #include "injector_ctx/injector_ctx.hpp"
#include "set_mgr/set_mgr.hpp" #include "set_mgr/set_mgr.hpp"
auto get_module_base(vdm::vdm_ctx* v_ctx, nasa::injector_ctx* rinjector,
std::uint32_t pid, const wchar_t* module_name) -> std::uintptr_t
{
const auto ppeb =
reinterpret_cast<PPEB>(
rinjector->translate(
reinterpret_cast<std::uintptr_t>(v_ctx->get_peb(pid))));
const auto ldr_data =
reinterpret_cast<PPEB_LDR_DATA>(
rinjector->translate(reinterpret_cast<std::uintptr_t>(ppeb->Ldr)));
auto current_entry =
reinterpret_cast<LIST_ENTRY*>(
rinjector->translate(reinterpret_cast<std::uintptr_t>(
ldr_data->InMemoryOrderModuleList.Flink)));
while (current_entry != &ldr_data->InMemoryOrderModuleList)
{
const auto current_entry_data =
reinterpret_cast<PLDR_DATA_TABLE_ENTRY>(
reinterpret_cast<std::uintptr_t>(current_entry) - sizeof LIST_ENTRY);
// shit looks like a stair case LMFAO?
// need an elevator for this...
const auto entry_module_name =
reinterpret_cast<const wchar_t*>(
rinjector->translate(
reinterpret_cast<std::uintptr_t>(
reinterpret_cast<PUNICODE_STRING>(
reinterpret_cast<std::uintptr_t>(
&current_entry_data->FullDllName) + sizeof UNICODE_STRING)->Buffer)));
if (!_wcsicmp(entry_module_name, module_name))
return rinjector->translate(
reinterpret_cast<std::uintptr_t>(
current_entry_data->DllBase));
current_entry = reinterpret_cast<LIST_ENTRY*>(
rinjector->translate(reinterpret_cast<std::uintptr_t>(current_entry->Flink)));
}
return {};
}
int __cdecl main(int argc, char** argv) int __cdecl main(int argc, char** argv)
{ {
if (argc < 3 || strcmp(argv[1], "--pid")) if (argc < 3 || strcmp(argv[1], "--pid"))
@ -74,11 +118,11 @@ int __cdecl main(int argc, char** argv)
} }
const auto ntdll_base = const auto ntdll_base =
reinterpret_cast<std::uintptr_t>( get_module_base(&vdm, &injector,
GetModuleHandleA("ntdll.dll")); std::atoi(argv[2]), L"ntdll.dll");
const auto ntdll_base_injected = injector.translate(ntdll_base); std::printf("[+] ntdll reverse injected base -> 0x%p\n", ntdll_base);
std::printf("[+] ntdll base -> 0x%p\n", ntdll_base_injected); std::printf("[+] ntdll reverse injected MZ -> 0x%p\n", *(short*)ntdll_base);
std::printf("[+] press any key to close...\n"); std::printf("[+] press any key to close...\n");
std::getchar(); std::getchar();
} }

@ -114,6 +114,16 @@ namespace vdm
return peproc; return peproc;
} }
__forceinline auto get_peb(std::uint32_t pid) -> PPEB
{
static const auto ps_get_peb =
util::get_kmodule_export(
"ntoskrnl.exe", "PsGetProcessPeb");
return this->syscall<PPEB(*)(PEPROCESS)>(
ps_get_peb, get_peprocess(pid));
}
private: private:
void locate_syscall(std::uintptr_t begin, std::uintptr_t end) const; void locate_syscall(std::uintptr_t begin, std::uintptr_t end) const;
bool valid_syscall(void* syscall_addr) const; bool valid_syscall(void* syscall_addr) const;

Loading…
Cancel
Save