diff --git a/nasa-injector.sln b/reverse-injector.sln similarity index 52% rename from nasa-injector.sln rename to reverse-injector.sln index 3f2b9b2..569ee3c 100644 --- a/nasa-injector.sln +++ b/reverse-injector.sln @@ -3,24 +3,15 @@ Microsoft Visual Studio Solution File, Format Version 12.00 # Visual Studio Version 16 VisualStudioVersion = 16.0.30503.244 MinimumVisualStudioVersion = 10.0.40219.1 -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "nasa-injector", "nasa-injector\nasa-injector.vcxproj", "{ED392663-3AF3-40DE-8AC7-2F373B3E9B45}" +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "reverse-injector", "reverse-injector\reverse-injector.vcxproj", "{ED392663-3AF3-40DE-8AC7-2F373B3E9B45}" EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|x64 = Debug|x64 - Debug|x86 = Debug|x86 Release|x64 = Release|x64 - Release|x86 = Release|x86 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution - {ED392663-3AF3-40DE-8AC7-2F373B3E9B45}.Debug|x64.ActiveCfg = Debug|x64 - {ED392663-3AF3-40DE-8AC7-2F373B3E9B45}.Debug|x64.Build.0 = Debug|x64 - {ED392663-3AF3-40DE-8AC7-2F373B3E9B45}.Debug|x86.ActiveCfg = Debug|Win32 - {ED392663-3AF3-40DE-8AC7-2F373B3E9B45}.Debug|x86.Build.0 = Debug|Win32 {ED392663-3AF3-40DE-8AC7-2F373B3E9B45}.Release|x64.ActiveCfg = Release|x64 {ED392663-3AF3-40DE-8AC7-2F373B3E9B45}.Release|x64.Build.0 = Release|x64 - {ED392663-3AF3-40DE-8AC7-2F373B3E9B45}.Release|x86.ActiveCfg = Release|Win32 - {ED392663-3AF3-40DE-8AC7-2F373B3E9B45}.Release|x86.Build.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE diff --git a/reverse-injector/icon.rc b/reverse-injector/icon.rc new file mode 100644 index 0000000..5856874 --- /dev/null +++ b/reverse-injector/icon.rc @@ -0,0 +1,3 @@ +// Icon Resource Definition +#define MAIN_ICON 102 +MAIN_ICON ICON "small.ico" \ No newline at end of file diff --git a/nasa-injector/injector_ctx/injector_ctx.cpp b/reverse-injector/injector_ctx/injector_ctx.cpp similarity index 54% rename from nasa-injector/injector_ctx/injector_ctx.cpp rename to reverse-injector/injector_ctx/injector_ctx.cpp index b126c3f..6439def 100644 --- a/nasa-injector/injector_ctx/injector_ctx.cpp +++ b/reverse-injector/injector_ctx/injector_ctx.cpp @@ -5,17 +5,18 @@ namespace nasa injector_ctx::injector_ctx(nasa::mem_ctx* map_into, nasa::mem_ctx* map_from) : map_into(map_into), - map_from(map_from) + map_from(map_from), + pml4_index_map{} {} injector_ctx::~injector_ctx() { const auto pml4 = reinterpret_cast( - this->map_into->set_page( - this->map_into->get_dirbase())); - + map_into->set_page( + map_into->get_dirbase())); + // zero inserted pml4e's... - for (const auto [real_idx, inserted_idx] : this->pml4_index_map) + for (const auto [real_idx, inserted_idx] : pml4_index_map) pml4[inserted_idx] = pml4e{ NULL }; while (!SwitchToThread()); @@ -36,13 +37,13 @@ namespace nasa std::vector> present_pml4es; std::vector empty_pml4es; - // find present pml4e's in usermode, and also find empty pml4e's in usermode... - for (auto idx = 0u; idx < 256; ++idx) + // find present pml4e's in map_from, and also find empty pml4e's in map_into... + for (auto idx = 100u; idx < 256; ++idx) { if (source_pml4[idx].present) present_pml4es.push_back({ idx, source_pml4[idx] }); - if (!target_pml4[idx].present) + if (!target_pml4[idx].value) empty_pml4es.push_back(idx); } @@ -53,7 +54,7 @@ namespace nasa // setup translation table and insert pml4e's... for (auto idx = 0u; idx < present_pml4es.size(); ++idx) { - this->pml4_index_map.insert({ present_pml4es[idx].first, empty_pml4es[idx] }); + pml4_index_map.insert({ present_pml4es[idx].first, empty_pml4es[idx] }); target_pml4[empty_pml4es[idx]] = present_pml4es[idx].second; } return true; @@ -63,7 +64,40 @@ namespace nasa std::uintptr_t injector_ctx::translate(std::uintptr_t translate) const { virt_addr_t virt_addr{ reinterpret_cast(translate) }; - virt_addr.pml4_index = pml4_index_map[virt_addr.pml4_index]; + try + { + virt_addr.pml4_index = pml4_index_map.at(virt_addr.pml4_index); + } + catch (const std::out_of_range& e) + { + // the pml4e is not in the map so we need to go get it + // and put it inside of the map. also put it inside of + // map_into's pml4... + + const auto map_into_pml4 = + reinterpret_cast( + map_into->set_page( + map_into->get_dirbase())); + + const auto map_from_pml4 = + reinterpret_cast( + map_from->set_page( + map_from->get_dirbase())); + + const auto new_pml4e = + map_from_pml4[virt_addr.pml4_index]; + + for (auto idx = 100u; idx < 256; ++idx) + { + if (!map_into_pml4[idx].value) + { + map_into_pml4[idx] = new_pml4e; + pml4_index_map[virt_addr.pml4_index] = idx; + virt_addr.pml4_index = idx; + break; + } + } + } return reinterpret_cast(virt_addr.value); } } \ No newline at end of file diff --git a/nasa-injector/injector_ctx/injector_ctx.hpp b/reverse-injector/injector_ctx/injector_ctx.hpp similarity index 100% rename from nasa-injector/injector_ctx/injector_ctx.hpp rename to reverse-injector/injector_ctx/injector_ctx.hpp diff --git a/nasa-injector/main.cpp b/reverse-injector/main.cpp similarity index 90% rename from nasa-injector/main.cpp rename to reverse-injector/main.cpp index 315ca4e..f1cf10c 100644 --- a/nasa-injector/main.cpp +++ b/reverse-injector/main.cpp @@ -4,6 +4,12 @@ int __cdecl main(int argc, char** argv) { + if (argc < 3 || strcmp(argv[1], "--pid")) + { + std::printf("[!] please provide a process id... (--pid X)\n"); + return false; + } + const auto [drv_handle, drv_key] = vdm::load_drv(); if (!drv_handle || drv_key.empty()) { @@ -49,7 +55,7 @@ int __cdecl main(int argc, char** argv) vdm.set_read(_read_phys); vdm.set_write(_write_phys); - nasa::mem_ctx notepad_proc(vdm, util::get_pid("notepad.exe")); + nasa::mem_ctx notepad_proc(vdm, std::atoi(argv[2])); nasa::injector_ctx injector(&my_proc, ¬epad_proc); if (!injector.init()) diff --git a/nasa-injector/mem_ctx/mem_ctx.cpp b/reverse-injector/mem_ctx/mem_ctx.cpp similarity index 97% rename from nasa-injector/mem_ctx/mem_ctx.cpp rename to reverse-injector/mem_ctx/mem_ctx.cpp index 0f80b7d..8d84258 100644 --- a/nasa-injector/mem_ctx/mem_ctx.cpp +++ b/reverse-injector/mem_ctx/mem_ctx.cpp @@ -75,31 +75,30 @@ namespace nasa mem_ctx::~mem_ctx() { - set_pml4e(reinterpret_cast<::ppml4e>(get_dirbase()) + this->pml4e_index, pml4e{NULL}); - while (!SwitchToThread()); + const auto pml4 = + reinterpret_cast( + set_page(dirbase))[pml4e_index] = pml4e{ NULL }; } void* mem_ctx::set_page(void* addr) { // table entry change. + ++pte_index; + if (pte_index >= 511) { - ++pte_index; - if (pte_index >= 511) - { - ++pde_index; - pte_index = 0; - } - - if (pde_index >= 511) - { - ++pdpte_index; - pde_index = 0; - } + ++pde_index; + pte_index = 0; + } - if (pdpte_index >= 511) - pdpte_index = 0; + if (pde_index >= 511) + { + ++pdpte_index; + pde_index = 0; } + if (pdpte_index >= 511) + pdpte_index = 0; + pdpte new_pdpte = { NULL }; new_pdpte.present = true; new_pdpte.rw = true; diff --git a/nasa-injector/mem_ctx/mem_ctx.hpp b/reverse-injector/mem_ctx/mem_ctx.hpp similarity index 100% rename from nasa-injector/mem_ctx/mem_ctx.hpp rename to reverse-injector/mem_ctx/mem_ctx.hpp diff --git a/nasa-injector/nasa-injector.vcxproj b/reverse-injector/reverse-injector.vcxproj similarity index 60% rename from nasa-injector/nasa-injector.vcxproj rename to reverse-injector/reverse-injector.vcxproj index 8e883b0..9a90603 100644 --- a/nasa-injector/nasa-injector.vcxproj +++ b/reverse-injector/reverse-injector.vcxproj @@ -1,14 +1,6 @@ - - Debug - Win32 - - - Release - Win32 - Debug x64 @@ -24,21 +16,9 @@ {ed392663-3af3-40de-8ac7-2f373b3e9b45} nasainjector 10.0 + reverse-injector - - Application - true - v142 - Unicode - - - Application - false - v142 - true - Unicode - Application true @@ -57,12 +37,6 @@ - - - - - - @@ -70,46 +44,12 @@ - - true - - - false - true false - - - Level3 - true - WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) - true - - - Console - true - - - - - Level3 - true - true - true - WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) - true - - - Console - true - true - true - - Level3 @@ -158,6 +98,9 @@ + + + diff --git a/nasa-injector/nasa-injector.vcxproj.filters b/reverse-injector/reverse-injector.vcxproj.filters similarity index 93% rename from nasa-injector/nasa-injector.vcxproj.filters rename to reverse-injector/reverse-injector.vcxproj.filters index 71363a7..0ce1288 100644 --- a/nasa-injector/nasa-injector.vcxproj.filters +++ b/reverse-injector/reverse-injector.vcxproj.filters @@ -56,4 +56,9 @@ Header Files + + + Header Files + + \ No newline at end of file diff --git a/nasa-injector/nasa-injector.vcxproj.user b/reverse-injector/reverse-injector.vcxproj.user similarity index 100% rename from nasa-injector/nasa-injector.vcxproj.user rename to reverse-injector/reverse-injector.vcxproj.user diff --git a/reverse-injector/small.ico b/reverse-injector/small.ico new file mode 100644 index 0000000..ce58e66 Binary files /dev/null and b/reverse-injector/small.ico differ diff --git a/nasa-injector/util/loadup.hpp b/reverse-injector/util/loadup.hpp similarity index 100% rename from nasa-injector/util/loadup.hpp rename to reverse-injector/util/loadup.hpp diff --git a/nasa-injector/util/nt.hpp b/reverse-injector/util/nt.hpp similarity index 100% rename from nasa-injector/util/nt.hpp rename to reverse-injector/util/nt.hpp diff --git a/nasa-injector/util/util.hpp b/reverse-injector/util/util.hpp similarity index 100% rename from nasa-injector/util/util.hpp rename to reverse-injector/util/util.hpp diff --git a/nasa-injector/vdm/raw_driver.hpp b/reverse-injector/vdm/raw_driver.hpp similarity index 100% rename from nasa-injector/vdm/raw_driver.hpp rename to reverse-injector/vdm/raw_driver.hpp diff --git a/nasa-injector/vdm/vdm.hpp b/reverse-injector/vdm/vdm.hpp similarity index 100% rename from nasa-injector/vdm/vdm.hpp rename to reverse-injector/vdm/vdm.hpp diff --git a/nasa-injector/vdm_ctx/vdm_ctx.cpp b/reverse-injector/vdm_ctx/vdm_ctx.cpp similarity index 100% rename from nasa-injector/vdm_ctx/vdm_ctx.cpp rename to reverse-injector/vdm_ctx/vdm_ctx.cpp diff --git a/nasa-injector/vdm_ctx/vdm_ctx.hpp b/reverse-injector/vdm_ctx/vdm_ctx.hpp similarity index 100% rename from nasa-injector/vdm_ctx/vdm_ctx.hpp rename to reverse-injector/vdm_ctx/vdm_ctx.hpp