Sep 5, 2014 06:22 AM
(This post was last modified: Sep 5, 2014 06:40 AM by Menalix.)
My injector, which support all type of .NET Injections:
http://www19.zippyshare.com/v/54392072/file.html
It only works with .NET exe's, as I don't set the thread context, this is the .NET section anyways so fck Native exe's :D
I'm not gonna give out the source, but I want to explain myself in thise thread how you can do it yourself.
I will referer to this source-code from AeonHack: https://hackforums.net/showthread.php?tid=4420101
As it can easy be modified to support more than just x86 -> x86 injections and is very easy to follow, but leave in mind his offsets is in decimal and not hex, mostly PE Header analyzing tools shows offsets in Hex.
Remember to read this: http://msdn.microsoft.com/en-us/gg463119.aspx
If you are interrested in a more detailed description of how the PE Header actually is constructed.
So lets start, what is the difference in a 64bit and 32bit PE when we want to do a RunPE Injection?
1: First is the CONTEXT structure we use to get the Thread's Context to receive the PEBAddress is different, there is (CONTEXT and CONTEXT_AMD64, both structures can be found in the winnt header file, the CONTEXT_AMD64 is quite hard to convert though.
And we use GetThreadContext when injector is 32bit and target is 32bit or injector is 64bit and target is 64bit, and we then use Wow64GetThreadContext when injector is 64bit and target is 32bit.
As I've seen some talkning nonsense about using Wow64GetThreadContext when 64bit -> 64bit because they don't know what Wow64 is all about, I thought it was worth mentioning the right API usage here.
2: When we get the PEB Address to find BaseAddress of our Target process.
On a 32bit process the pointer address to BaseAddress will be: Ebx + 8
(Ebx is PEBAddress)
on a 64bit process the offset to BaseAddress is 10 and not 8. Keep that in mind when you later on has to overwrite the old BaseAddress of the PE and when you read with rpm as shown above code.
3: The PEBAddress on 64bit is of course 64bit sized (Int64), there for make sure to correct RPM and WPM API's to not look like this in AeonHacks source:
As you clearly see these API's is wrong when checking:
http://msdn.microsoft.com/en-us/library/...s.85).aspx
http://msdn.microsoft.com/en-us/library/...s.85).aspx
LPVOID =IntPtr
LPCVOID = IntPtr
SIZE_T = Uinteger
4: The ImageBase value in the PE Header is stored 4 bytes ahead from the 32bit offset when the file is 64bit, which means the 64bit offset is 34 and not 30, starting of the PE Header's BaseAddress
5: We actually don't have do so much else now, but here's some good tips:
Use IsWow64Process function when determining if the target is a 32bit process.
When you want to inject a payload of 32bit into a 64bit process, you'll have to rewrite the flags offset in the .NET header to 1 instead of 3, which lets the 32bit payload go into 64bit, by removing the "32bit required" flag.
Example:
Read the wMachine value in the PE Header to know wether the Payload is 64bit or not.
I heared many saying: Injecting 64bit to 32bit is impossible, well yes. But not in .NET because the code first is compiled into wether 32bit or 64bit with the JIT Compiler on runtime, so we can manipulate it into 32bit or 64bit like we want before the exe is executed, so awesome when injecting malware or using injections for legit purposes.
This tutorial is not quite detailed, but anyone who knows what a pointer is and the different datatypes and have read the PE Header documentation should be able to follow up.
I just don't want to let c&p'ers come here and steal shit :)
http://www19.zippyshare.com/v/54392072/file.html
It only works with .NET exe's, as I don't set the thread context, this is the .NET section anyways so fck Native exe's :D
I'm not gonna give out the source, but I want to explain myself in thise thread how you can do it yourself.
I will referer to this source-code from AeonHack: https://hackforums.net/showthread.php?tid=4420101
As it can easy be modified to support more than just x86 -> x86 injections and is very easy to follow, but leave in mind his offsets is in decimal and not hex, mostly PE Header analyzing tools shows offsets in Hex.
Remember to read this: http://msdn.microsoft.com/en-us/gg463119.aspx
If you are interrested in a more detailed description of how the PE Header actually is constructed.
So lets start, what is the difference in a 64bit and 32bit PE when we want to do a RunPE Injection?
1: First is the CONTEXT structure we use to get the Thread's Context to receive the PEBAddress is different, there is (CONTEXT and CONTEXT_AMD64, both structures can be found in the winnt header file, the CONTEXT_AMD64 is quite hard to convert though.
And we use GetThreadContext when injector is 32bit and target is 32bit or injector is 64bit and target is 64bit, and we then use Wow64GetThreadContext when injector is 64bit and target is 32bit.
As I've seen some talkning nonsense about using Wow64GetThreadContext when 64bit -> 64bit because they don't know what Wow64 is all about, I thought it was worth mentioning the right API usage here.
2: When we get the PEB Address to find BaseAddress of our Target process.
PHP Code
<?php
If Not ReadProcessMemory(PI.ProcessHandle, Ebx + 8, BaseAddress, 4, ReadWrite) Then Throw New Exception()
(Ebx is PEBAddress)
on a 64bit process the offset to BaseAddress is 10 and not 8. Keep that in mind when you later on has to overwrite the old BaseAddress of the PE and when you read with rpm as shown above code.
3: The PEBAddress on 64bit is of course 64bit sized (Int64), there for make sure to correct RPM and WPM API's to not look like this in AeonHacks source:
PHP Code
<?php
<DllImport("kernel32.dll", EntryPoint:="ReadProcessMemory"), SuppressUnmanagedCodeSecurity> _
Private Shared Function ReadProcessMemory( _
ByVal process As IntPtr, _
ByVal baseAddress As Integer, _
ByRef buffer As Integer, _
ByVal bufferSize As Integer, _
ByRef bytesRead As Integer) As Boolean
End Function
<DllImport("kernel32.dll", EntryPoint:="WriteProcessMemory"), SuppressUnmanagedCodeSecurity> _
Private Shared Function WriteProcessMemory( _
ByVal process As IntPtr, _
ByVal baseAddress As Integer, _
ByVal buffer As Byte(), _
ByVal bufferSize As Integer, _
ByRef bytesWritten As Integer) As Boolean
End Function
http://msdn.microsoft.com/en-us/library/...s.85).aspx
http://msdn.microsoft.com/en-us/library/...s.85).aspx
LPVOID =IntPtr
LPCVOID = IntPtr
SIZE_T = Uinteger
4: The ImageBase value in the PE Header is stored 4 bytes ahead from the 32bit offset when the file is 64bit, which means the 64bit offset is 34 and not 30, starting of the PE Header's BaseAddress
5: We actually don't have do so much else now, but here's some good tips:
Use IsWow64Process function when determining if the target is a 32bit process.
When you want to inject a payload of 32bit into a 64bit process, you'll have to rewrite the flags offset in the .NET header to 1 instead of 3, which lets the 32bit payload go into 64bit, by removing the "32bit required" flag.
Example:
PHP Code
<?php
If PayloadIs64 = False Then
If dwNetDirFlags = &H3 Then 'To make sure we dont rewrite flags on a Payload which is already AnyCPU Compiled, it will only slow us down'
Buffer.SetByte(payload, dwPEHeaderAddress + &H398, &H1) 'Replaces the .NET Header Flag on a 32bit compiled payload, to make it possible doing 32bit -> 64bit injection, without modifying the physcial target exe on the drive.'
End If
End If
Read the wMachine value in the PE Header to know wether the Payload is 64bit or not.
I heared many saying: Injecting 64bit to 32bit is impossible, well yes. But not in .NET because the code first is compiled into wether 32bit or 64bit with the JIT Compiler on runtime, so we can manipulate it into 32bit or 64bit like we want before the exe is executed, so awesome when injecting malware or using injections for legit purposes.
This tutorial is not quite detailed, but anyone who knows what a pointer is and the different datatypes and have read the PE Header documentation should be able to follow up.
I just don't want to let c&p'ers come here and steal shit :)
![[Image: gh_banner.png]](https://hexui.com/asset/img/gh_banner.png)
![[Image: jfhDhRz.gif]](https://i.imgur.com/jfhDhRz.gif)
