new code Upcoming Tests...soon..
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
.386 ; create 32 bit code
.model flat, stdcall ; 32 bit memory model
option casemap:none
option prologue:none
option epilogue:none
; include files
; ~~~~~~~~~~~~~
include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc
include \masm32\include\advapi32.inc
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\advapi32.lib
; ----------------------------------------
; prototypes for local procedures go here
; ----------------------------------------
CopyMemory PROTO STDCALL :DWORD, :DWORD, :DWORD; Workaround for rtlCopyMemory for moving around return values.
InlineCode PROTO STDCALL :DWORD; Inline Code injection routine
GetDbg PROTO STDCALL ; Enables the SE_DEBUG privilege
GetCPI PROTO STDCALL :DWORD, :DWORD; Gets Current Process_Info
.data?
hInstance dd ?
hThreadDll dd ?
Buffer db 256 dup(?)
ThePID dd ?
lpProcess dd ?
lpBuffer dd ?
lpCode dd ?
lpCodeBuffer db 256 dup(?)
threadid dd ?
hthread dd ?
lpPID dd ?
hwnd dd ?
sObject dd ?
nBytesWritten dd ?
IEvent_Handle DD ?
.data
SE_DEBUG DB "SeDebugPrivilege",0
IEvent_Name DB "WinEvent",0
CTEXT MACRO y:VARARG
LOCAL sym, dummy
dummy EQU $;; MASM error fix
CONST segment
IFIDNI <y>,<>
sym db 0
ELSE
sym db y,0
ENDIF
CONST ends
EXITM <OFFSET sym>
ENDM
EJUMP MACRO TARGET_CODE; jump when EAX is 0.
CMP EAX, 0
JE TARGET_CODE
ENDM
szText MACRO Name, Text:VARARG
LOCAL lbl
jmp lbl
Name db Text,0
lbl:
ENDM
return MACRO arg
mov eax, arg
ret
ENDM
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
.code
LibMain proc hInstDLL:DWORD, reason:DWORD, unused:DWORD
mov eax, TRUE ; put TRUE in EAX to continue loading the DLL
ret
LibMain Endp
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
align DWORD
InvokeFunc PROC STDCALL public, funcptr:DWORD
pop ecx; save return address
pop edx; Get function pointer
push ecx; Restore return address
jmp edx; Transfer control to the function pointer
InvokeFunc endp
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
align DWORD
InlineCode proc STDCALL public, CodeBuffer:DWORD
pushad
invoke GetCurrentProcess
mov [lpProcess], eax
push 40; page_execute_readwrite
push 3000 ; page mem_commit
mov ebx, sizeof CodeBuffer
push ebx
push DWORD PTR CodeBuffer
push DWORD PTR lpProcess
call VirtualAllocEx
cmp eax, 0
jz ret1
;invoke VirtualAllocEx [lpProcess], [CodeBuffer], sizeof CodeBuffer, MEM_COMMIT, PAGE_EXECUTE_READWRITE
mov [lpCode], eax
invoke WriteProcessMemory, [lpProcess], [lpCode], [CodeBuffer], sizeof CodeBuffer, nBytesWritten
invoke VirtualAllocEx, [lpProcess], [Buffer], sizeof Buffer, MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE
mov [lpBuffer], eax
invoke WriteProcessMemory, [lpProcess], [lpBuffer], [Buffer], sizeof Buffer, nBytesWritten
invoke CreateThread, 0, 0, [lpCode], addr lpCodeBuffer, 0, threadid
mov [hthread],eax
invoke WaitForSingleObject, [hthread], 60000
mov [sObject], eax
invoke CopyMemory, [sObject], [lpBuffer], sizeof sObject;some mashaling of data here
invoke VirtualFreeEx, [lpProcess], [lpCode], sizeof lpCode, MEM_RELEASE
invoke VirtualFreeEx, [lpProcess], [lpCodeBuffer], sizeof lpCodeBuffer, MEM_RELEASE
invoke CloseHandle, [hthread]
ret1:
popad
ret
InlineCode endp
; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««
align DWORD
CopyMemory proc uses esi edi,Dest:DWORD, Source:DWORD, mlength:DWORD
; This routine is provided in place of Visual C's CopyMemory
; ----------------------------------------------------------
; It could be developed a little more to move data faster as double words (movsd)
; but possibly needs checking to ensure we copy the exact number of bytes
; in the bitmap; this could be an odd number and a possible solution is to
; copy as many Dwords as possible 1st then any remaining word or byte.
; Leave this upgrade until later.
cld ; Work upwards
mov esi, Source ; Source address
mov edi, Dest ; Destination address
mov ecx, mlength ; Get size in bytes
shr ecx, 1 ; Convert to words
rep movsw ; repeat copy util all done
ret
CopyMemory endp
align DWORD
GetDbg PROC ; enables the SE_DEBUG privilege for ourself
LOCAL token:HANDLE
LOCAL priv:TOKEN_PRIVILEGES
LOCAL luid:LUID
INVOKE LookupPrivilegeValue, 0,OFFSET SE_DEBUG, ADDR luid
EJUMP DBE0
MOV priv.PrivilegeCount, 01H
MOV priv.Privileges.Attributes, 02H
MOV EAX,luid.LowPart
MOV priv.Privileges.Luid.LowPart,EAX
MOV EAX,luid.HighPart
MOV priv.Privileges.Luid.HighPart,EAX
INVOKE GetCurrentProcess
MOV ECX,EAX
INVOKE OpenProcessToken,ECX,020H, ADDR token
MOV ECX, token
CMP ECX, 0
JE DBE0
INVOKE AdjustTokenPrivileges,ECX,0,ADDR priv,0,0,0
MOV ECX,EAX
INVOKE CloseHandle, token
MOV EAX,ECX
DBE0: RET
GetDbg endp
align DWORD
GetCPI PROC, TRUSTED:DWORD, pProcessInfo:DWORD
; This function fills a PROCESS_INFORMATION
; structure with the ID and handle of the
; required named process and its primary
; thread. The tool helper API is used to
; retrieve this information.
LOCAL p32:PROCESSENTRY32
LOCAL t32:THREADENTRY32
LOCAL hShot:DWORD
MOV p32.dwSize, SIZEOF PROCESSENTRY32
MOV t32.dwSize, SIZEOF THREADENTRY32
INVOKE GetDbg; we need SE_DEBUG first
; Create a snapshot of all processes and
; threads. 06H is the appropriate bitmask
; for this purpose, look it up if you
; dont trust me.
INVOKE CreateToolhelp32Snapshot,06H,0
MOV hShot,EAX
; Start to search for the trusted process.
; We will compare the name of the process'
; primary module with the string buffer
; TRUSTED until we find a match.
INVOKE Process32First, hShot, ADDR p32
CMP EAX, 0
JE GSE1
GSL: LEA EDX, p32.szExeFile
INVOKE lstrcmpi, EDX, TRUSTED
CMP EAX, 0; lstrcmpi is not case sensitive!
JE GSL1 ; good, we found the process
INVOKE Process32Next, hShot, ADDR p32
CMP EAX, 0; no more processes,
JE GSE1 ; no success
JMP GSL ; otherwise, continue loop
; We have found an instance of the trusted
; process, continue to retrieve information
; about its primary thread and gain an open
; handle to both the process itself and the
; thread. To find the thread, we have to
; loop through all thread entries in our
; snapshot until we discover a thread that
; has been created by the process we found.
GSL1: INVOKE Thread32First, hShot, ADDR t32
MOV EBX, 0
TSL: MOV EDX, t32.th32OwnerProcessID
CMP EDX, p32.th32ProcessID
JE TSL0
INVOKE Thread32Next, hShot, ADDR t32
CMP EAX, 0; no more threads (weird),
JE GSE1 ; no success
JMP TSL ; otherwise, continue loop
; Now, since we have got the ID's of both
; the process itself and the primary thread,
; use OpenProcess() and OpenThread() to
; get a handle to both of them. You are right,
; OpenThread is NOT a documented call, but
; it looks like that was rather an accident.
; It is exported by kernel32.dll just like
; OpenProcess().
TSL0: MOV EDX, pProcessInfo ; the structure address
MOV EAX,p32.th32ProcessID; copy the process ID
MOV [EDX+08H], EAX
MOV EAX, t32.th32ThreadID; copy the thread ID
MOV [EDX+0CH], EAX
PUSH EDX ; safe the address
INVOKE OpenProcess, PROCESS_ALL_ACCESS, \
0, p32.th32ProcessID
CMP EAX, 0
JE GSE1
MOV EBX, EAX
INVOKE OpenThread, THREAD_ALL_ACCESS, 0, \
t32.th32ThreadID
CMP EAX, 0
JE GSE1
POP EDX ; restore the address
MOV [EDX], EBX ; copy the process handle
MOV [EDX+04H], EAX ; copy the thread handle
PUSH 1 ; success
JMP GSE0
GSE1: PUSH 0 ; failure
GSE0: CMP hShot, 0
JE GSE
INVOKE CloseHandle, hShot ; cleanup
GSE: POP EAX ; pop the return value to EAX
RET ; that's it.
GetCPI endp
end LibMain
1 question : would any of you be interested in a modularized implementation of Tsongkies Trainer Engine Part 3 in a separate Dll or in this one along with all the other Functions.. i also plan to make a sister dll that initializes a gui Edit Box with a Button for Direct execution of asm, im gonna try and mimic all the functionality of masm commands i can so bear with me as i go through this prilimanary mapping stages.. and hack out some examples.
