its a tranlaste from c++ code
credits go to 'RTFLOL'
i hope for nice tnks comment's
convert it took me couple hours,
and bcz some problem's
i move'd to unsafe code
[it faster and cleaner
to write some char's Or byte's
by WriteProcessMemory with void*
it so easy. use Fixed statement
with pointer to array]
v2 version [fixed]
http://pastebin.com/8mujr2ps
v1 version
C# code
C++ code
credits go to 'RTFLOL'
i hope for nice tnks comment's
convert it took me couple hours,
and bcz some problem's
i move'd to unsafe code
[it faster and cleaner
to write some char's Or byte's
by WriteProcessMemory with void*
it so easy. use Fixed statement
with pointer to array]
v2 version [fixed]
http://pastebin.com/8mujr2ps
v1 version
C# code
Code
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Runtime.InteropServices;
using System.Diagnostics;
namespace cSharp
{
/// <summary>
/// [SRC] Patch ImageBase in PEB
/// Coded by RTFLOL
/// Released on http://hackhound.org/
/// Convertd by Me.
/// </summary>
unsafe class PEBPatcher
{
[StructLayout(LayoutKind.Sequential)]
struct UNICODE_STRING : IDisposable
{
public ushort Length;
public ushort MaximumLength;
public IntPtr buffer;
public UNICODE_STRING(string s)
{
Length = (ushort)(s.Length * 2);
MaximumLength = (ushort)(Length + 2);
buffer = Marshal.StringToHGlobalUni(s);
}
public void Dispose()
{
Marshal.FreeHGlobal(buffer);
buffer = IntPtr.Zero;
}
public override string ToString()
{
return Marshal.PtrToStringUni(buffer);
}
}
[StructLayout(LayoutKind.Sequential, Pack = 1)]
struct PROCESS_BASIC_INFORMATION
{
public IntPtr ExitStatus;
public IntPtr PebBaseAddress;
public IntPtr AffinityMask;
public IntPtr BasePriority;
public UIntPtr UniqueProcessId;
public IntPtr InheritedFromUniqueProcessId;
public int Size
{
get { return (6 * IntPtr.Size); }
}
}
[DllImport("ntdll.dll", SetLastError = true)]
static extern int NtQueryInformationProcess(IntPtr processHandle,
int processInformationClass, ref PROCESS_BASIC_INFORMATION processInformation, int processInformationLength,
IntPtr returnLength);
[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, int dwSize, int flAllocationType, int flProtect);
[DllImport("kernel32.dll")]
static extern IntPtr OpenProcess(int dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, int dwProcessId);
[DllImport("kernel32.dll", SetLastError = true)]
static extern bool ReadProcessMemory(
IntPtr hProcess,
IntPtr lpBaseAddress,
void* lpBuffer,
int dwSize,
out int lpNumberOfBytesRead
);
[DllImport("kernel32.dll", SetLastError = true)]
static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, void* lpBuffer, int nSize, out UIntPtr lpNumberOfBytesWritten);
public static bool Patch(IntPtr handle, string path, string cmdLine)
{
//
// Get Handle
//
var intOutput = 0;
var intPtrOutput = IntPtr.Zero;
var uIntPtrOutput = UIntPtr.Zero;
var hProcess = handle;
PROCESS_BASIC_INFORMATION pbi = new PROCESS_BASIC_INFORMATION();
NtQueryInformationProcess(hProcess, 0, ref pbi, Marshal.SizeOf(pbi), (IntPtr)0);
var peb = pbi.PebBaseAddress;
var rtlUserProcParamsAddress = IntPtr.Zero;
if (!ReadProcessMemory(hProcess, peb + 0x10, (void*)&rtlUserProcParamsAddress, Marshal.SizeOf(typeof(IntPtr)), out intOutput))
{
Console.WriteLine("ERROR: Could not read rtlUserProcParamsAddress!\n");
return false;
}
UNICODE_STRING Current_ImageBase = new UNICODE_STRING();
if (!ReadProcessMemory(hProcess, rtlUserProcParamsAddress + 0x38, &Current_ImageBase, Marshal.SizeOf(typeof(UNICODE_STRING)), out intOutput))
{
Console.WriteLine("ERROR: Could not read ImageBase of the target process.\n");
return false;
}
//
// Update data
//
var input = string.Empty;
IntPtr pNewAddr = IntPtr.Zero;
char[] array = null;
//
// <-- Path -->
//
input = path;
array = input.ToArray();
Current_ImageBase.Length = (ushort)(input.Length * 2);
pNewAddr = VirtualAllocEx(hProcess, IntPtr.Zero, Current_ImageBase.Length, /* AllocationType.Commit */ 0x1000 | /* AllocationType.Reserve */ 0x2000, /* MemoryProtection.ExecuteReadWrite */ 0x40);
if (pNewAddr == IntPtr.Zero)
{
Console.WriteLine("ERROR: Could not allocate memory in target process.\n");
return false;
}
fixed (char* arr = array)
{
if (!WriteProcessMemory(hProcess, pNewAddr, (void*)arr, Current_ImageBase.Length, out uIntPtrOutput))
{
Console.WriteLine("ERROR: Failed to write to address.\n");
return false;
}
}
Current_ImageBase.buffer = pNewAddr;
if (!WriteProcessMemory(hProcess, rtlUserProcParamsAddress + 0x38, &Current_ImageBase, Marshal.SizeOf(typeof(UNICODE_STRING)), out uIntPtrOutput))
{
Console.WriteLine("ERROR: Failed to reflect change back to PEB.\n");
return false;
}
//
// <-- cmdLine -->
//
input = cmdLine;
array = input.ToArray();
Current_ImageBase.Length = (ushort)(input.Length * 2);
pNewAddr = VirtualAllocEx(hProcess, IntPtr.Zero, Current_ImageBase.Length, /* AllocationType.Commit */ 0x1000 | /* AllocationType.Reserve */ 0x2000, /* MemoryProtection.ExecuteReadWrite */ 0x40);
if (pNewAddr == IntPtr.Zero)
{
Console.WriteLine("ERROR: Could not allocate memory in target process.\n");
return false;
}
fixed (char* arr = array)
{
if (!WriteProcessMemory(hProcess, pNewAddr, (void*)arr, Current_ImageBase.Length, out uIntPtrOutput))
{
Console.WriteLine("ERROR: Failed to write to address.\n");
return false;
}
}
Current_ImageBase.buffer = pNewAddr;
if (!WriteProcessMemory(hProcess, rtlUserProcParamsAddress + 0x40, &Current_ImageBase, Marshal.SizeOf(typeof(UNICODE_STRING)), out uIntPtrOutput))
{
Console.WriteLine("ERROR: Failed to reflect change back to PEB.\n");
return false;
}
//
// Done
//
return true;
}
public static bool Patch(int dwPid, string path, string cmdLine)
{
return Patch(
OpenProcess(/* ProcessAccessFlags.All */ 0x001F0FFF, false, dwPid),
path, cmdLine);
}
}
class Program
{
static void Main(string[] args)
{
PEBPatcher.Patch(
Process.GetProcessesByName("notepad")[0].Id,
"c:\\windows\\aaa.cmd",
"c:\\windows\\aaa.cmd bbb ccc ddd");
PEBPatcher.Patch(
Process.GetProcessesByName("notepad")[1].Handle,
"c:\\windows\\aaa.cmd",
"c:\\windows\\aaa.cmd bbb ccc ddd");
}
}
}C++ code
Code
#include <stdio.h>
#include <windows.h>
#include <cstdlib>
#include <string>
using namespace std;
// [SRC] Patch ImageBase in PEB
// http://www.ic0de.org/showthread.php?8435-SRC-Patch-ImageBase-in-PEB
//
// Coded by RTFLOL
// Released on http://hackhound.org/
// Date: 2/1/2010
/*
This application patches an ImageBase of an external executable and replaces it
with the path of this file.
Please give credits if you use. Don't be a ripper fag, k?
*/
typedef struct _UNICODE_STRING
{
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
typedef struct _PROCESS_BASIC_INFORMATION
{
LONG ExitStatus;
PVOID PebBaseAddress;
ULONG_PTR AffinityMask;
LONG BasePriority;
ULONG_PTR UniqueProcessId;
ULONG_PTR ParentProcessId;
} PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
typedef LONG (WINAPI *_NtQueryInformationProcess)(
HANDLE ProcessHandle,
DWORD ProcessInformationClass,
PVOID ProcessInformation,
DWORD ProcessInformationLength,
PDWORD ReturnLength
);
_NtQueryInformationProcess NtQueryInformationProcess =
(_NtQueryInformationProcess)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQueryInformationProcess");
int Patch(DWORD dwPid, WCHAR *path, WCHAR *cmdLine)
{
//
// Get Handle
//
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
PROCESS_BASIC_INFORMATION pbi;
NtQueryInformationProcess(hProcess, 0, &pbi, sizeof(pbi), NULL);
PVOID peb = pbi.PebBaseAddress;
PVOID rtlUserProcParamsAddress = NULL;
if (!ReadProcessMemory(hProcess, (PCHAR)peb + 0x10, &rtlUserProcParamsAddress, sizeof(PVOID), NULL))
{
printf("ERROR: Could not read rtlUserProcParamsAddress!\n");
return GetLastError();
}
UNICODE_STRING Current_ImageBase;
if (!ReadProcessMemory(hProcess, (PCHAR)rtlUserProcParamsAddress + 0x38, &Current_ImageBase, sizeof(Current_ImageBase), NULL))
{
printf("ERROR: Could not read ImageBase of the target process.\n");
return GetLastError();
}
//
// Update data
//
WCHAR *input;
LPVOID pNewAddr;
//
// <-- Path -->
//
input = path;
Current_ImageBase.Length = lstrlenW(input) * 2;
pNewAddr = VirtualAllocEx(hProcess, NULL, Current_ImageBase.Length, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if (!pNewAddr)
{
printf("ERROR: Could not allocate memory in target process.\n");
return GetLastError();
}
if(!WriteProcessMemory(hProcess, pNewAddr, input, Current_ImageBase.Length, NULL))
{
printf("ERROR: Failed to write to address.\n");
return GetLastError();
}
Current_ImageBase.Buffer = (WCHAR*)pNewAddr;
if(!WriteProcessMemory(hProcess, (PCHAR)rtlUserProcParamsAddress + 0x38, &Current_ImageBase, sizeof(Current_ImageBase), NULL))
{
printf("ERROR: Failed to reflect change back to PEB.\n");
return GetLastError();
}
//
// <-- cmdLine -->
//
input = cmdLine;
Current_ImageBase.Length = lstrlenW(input) * 2;
pNewAddr = VirtualAllocEx(hProcess, NULL, Current_ImageBase.Length, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if (!pNewAddr)
{
printf("ERROR: Could not allocate memory in target process.\n");
return GetLastError();
}
if(!WriteProcessMemory(hProcess, pNewAddr, input, Current_ImageBase.Length, NULL))
{
printf("ERROR: Failed to write to address.\n");
return GetLastError();
}
Current_ImageBase.Buffer = (WCHAR*)pNewAddr;
if(!WriteProcessMemory(hProcess, (PCHAR)rtlUserProcParamsAddress + 0x40, &Current_ImageBase, sizeof(Current_ImageBase), NULL))
{
printf("ERROR: Failed to reflect change back to PEB.\n");
return GetLastError();
}
//
// Done
//
return 1;
}
int main(void)
{
wchar_t
*path = L"c:\\windows\\aaa.cmd",
*cmdLine = L"c:\\windows\\aaa.cmd test";
if (Patch(
3032,
path,
cmdLine))
{
printf("\n... All done. <!>\n");
}
else
{
printf("\n... Faile'd. <!>.\n");
}
system("PAUSE");
return 0;
}
![[Image: rD7TvGj.gif]](https://i.imgur.com/rD7TvGj.gif)