Skip to content

Commit 128f3cf

Browse files
RenardDevRenardDev
committed
Better manual map
1 parent 04dcf0f commit 128f3cf

File tree

2 files changed

+65
-9
lines changed

2 files changed

+65
-9
lines changed

‎HiJack/HiJack.cpp

+63-7
Original file line numberDiff line numberDiff line change
@@ -428,11 +428,21 @@ using fnNtFlushInstructionCache = NTSTATUS(NTAPI*)(HANDLE ProcessHandle, PVOID B
428428

429429
using fnDllMain = BOOL(WINAPI*)(HINSTANCE, DWORD, LPVOID);
430430

431+
using fnNtOpenThread = NTSTATUS(NTAPI*)(PHANDLE ThreadHandle, ACCESS_MASK AccessMask, POBJECT_ATTRIBUTES ObjectAttributes, CLIENT_ID* ClientId);
432+
using fnNtSuspendThread = NTSTATUS(NTAPI*)(HANDLE ThreadHandle, PULONG PreviousSuspendCount);
433+
using fnNtResumeThread = NTSTATUS(NTAPI*)(HANDLE ThreadHandle, PULONG SuspendCount);
434+
431435
typedef struct _LOADER_DATA {
432436
void* m_pImageAddress;
433437

438+
DWORD m_unMainThread;
439+
434440
HMODULE m_hNTDLL;
435441

442+
fnNtOpenThread m_pNtOpenThread;
443+
fnNtSuspendThread m_pNtSuspendThread;
444+
fnNtResumeThread m_pNtResumeThread;
445+
436446
fnRtlDosPathNameToNtPathName_U m_pRtlDosPathNameToNtPathName_U;
437447

438448
fnRtlFreeUnicodeString m_pRtlFreeUnicodeString;
@@ -779,27 +789,62 @@ DEFINE_CODE_IN_SECTION(".load") DWORD WINAPI Loader(LPVOID lpParameter) { SELF_I
779789
return EXIT_FAILURE;
780790
}
781791

792+
HANDLE hMainThread = nullptr;
793+
794+
CLIENT_ID cid = {};
795+
cid.UniqueProcess = nullptr;
796+
cid.UniqueThread = reinterpret_cast<HANDLE>(static_cast<ULONG_PTR>(pLD->m_unMainThread));
797+
798+
OBJECT_ATTRIBUTES oa = {};
799+
InitializeObjectAttributes(&oa, nullptr, 0, nullptr, nullptr);
800+
801+
if (!NT_SUCCESS(pLD->m_pNtOpenThread(&hMainThread, THREAD_SUSPEND_RESUME, &oa, &cid))) {
802+
return EXIT_FAILURE;
803+
}
804+
805+
ULONG unSuspendCount = 0;
806+
if (!NT_SUCCESS(pLD->m_pNtSuspendThread(hMainThread, &unSuspendCount))) {
807+
return EXIT_FAILURE;
808+
}
809+
782810
if (!MapImage(pLD)) {
783811
return EXIT_FAILURE;
784812
}
785813

786814
if (!FixRelocations(pLD)) {
815+
SIZE_T unSize = 0;
816+
pLD->m_pNtFreeVirtualMemory(reinterpret_cast<HANDLE>(-1), &pLD->m_pImageAddress, &unSize, MEM_RELEASE);
787817
return EXIT_FAILURE;
788818
}
789819

790820
if (!ResolveImports(pLD)) {
821+
SIZE_T unSize = 0;
822+
pLD->m_pNtFreeVirtualMemory(reinterpret_cast<HANDLE>(-1), &pLD->m_pImageAddress, &unSize, MEM_RELEASE);
791823
return EXIT_FAILURE;
792824
}
793825

794826
if (!ProtectSections(pLD)) {
827+
SIZE_T unSize = 0;
828+
pLD->m_pNtFreeVirtualMemory(reinterpret_cast<HANDLE>(-1), &pLD->m_pImageAddress, &unSize, MEM_RELEASE);
795829
return EXIT_FAILURE;
796830
}
797831

798832
if (!ExecuteTLS(pLD, DLL_PROCESS_ATTACH)) { // Useless for simple patching dlls
833+
SIZE_T unSize = 0;
834+
pLD->m_pNtFreeVirtualMemory(reinterpret_cast<HANDLE>(-1), &pLD->m_pImageAddress, &unSize, MEM_RELEASE);
799835
return EXIT_FAILURE;
800836
}
801837

802838
if (!CallDllMain(pLD, DLL_PROCESS_ATTACH)) {
839+
SIZE_T unSize = 0;
840+
pLD->m_pNtFreeVirtualMemory(reinterpret_cast<HANDLE>(-1), &pLD->m_pImageAddress, &unSize, MEM_RELEASE);
841+
return EXIT_FAILURE;
842+
}
843+
844+
unSuspendCount = 0;
845+
if (!NT_SUCCESS(pLD->m_pNtResumeThread(hMainThread, &unSuspendCount))) {
846+
SIZE_T unSize = 0;
847+
pLD->m_pNtFreeVirtualMemory(reinterpret_cast<HANDLE>(-1), &pLD->m_pImageAddress, &unSize, MEM_RELEASE);
803848
return EXIT_FAILURE;
804849
}
805850

@@ -1165,6 +1210,18 @@ bool FillLoaderData(HANDLE hProcess, PLOADER_DATA pLoaderData) {
11651210
return false;
11661211
}
11671212

1213+
if (!GetRemoteProcAddress(hProcess, _T("ntdll.dll"), "NtOpenThread", &pLoaderData->m_pNtOpenThread)) {
1214+
return false;
1215+
}
1216+
1217+
if (!GetRemoteProcAddress(hProcess, _T("ntdll.dll"), "NtSuspendThread", &pLoaderData->m_pNtSuspendThread)) {
1218+
return false;
1219+
}
1220+
1221+
if (!GetRemoteProcAddress(hProcess, _T("ntdll.dll"), "NtResumeThread", &pLoaderData->m_pNtResumeThread)) {
1222+
return false;
1223+
}
1224+
11681225
if (!GetRemoteProcAddress(hProcess, _T("ntdll.dll"), "RtlDosPathNameToNtPathName_U", &pLoaderData->m_pRtlDosPathNameToNtPathName_U)) {
11691226
return false;
11701227
}
@@ -1260,7 +1317,7 @@ void OnExitThreadEvent(DWORD unProcessID, DWORD unThreadID, DWORD unExitCode) {
12601317
#endif // _DEBUG
12611318
}
12621319

1263-
void OnLoadModuleEvent(DWORD unProcessID, LPVOID pImageBase) {
1320+
void OnLoadModuleEvent(DWORD unProcessID, DWORD unThreadID, LPVOID pImageBase) {
12641321
auto Process = GetDebugProcess(unProcessID);
12651322
if (!Process) {
12661323
return;
@@ -1297,9 +1354,7 @@ void OnLoadModuleEvent(DWORD unProcessID, LPVOID pImageBase) {
12971354

12981355
DWORD dwAttrib = GetFileAttributes(ProcessHiJackLibraryPath.c_str());
12991356
if (!((dwAttrib != INVALID_FILE_ATTRIBUTES) && !(dwAttrib & FILE_ATTRIBUTE_DIRECTORY))) { // File not exist
1300-
#ifndef HIJACK_DETACH_IF_NO_INJECTABLE
13011357
g_bContinueDebugging = false;
1302-
#endif
13031358
return;
13041359
}
13051360

@@ -1418,6 +1473,7 @@ void OnLoadModuleEvent(DWORD unProcessID, LPVOID pImageBase) {
14181473
}
14191474

14201475
LoaderData.m_pImageAddress = pImageAddress;
1476+
LoaderData.m_unMainThread = unThreadID;
14211477

14221478
if (!FillLoaderData(Process, &LoaderData)) {
14231479
VirtualFreeEx(Process, pImageAddress, 0, MEM_RELEASE);
@@ -1459,7 +1515,7 @@ void OnLoadModuleEvent(DWORD unProcessID, LPVOID pImageBase) {
14591515
}
14601516
}
14611517

1462-
void OnUnloadModuleEvent(DWORD unProcessID, LPVOID ImageBase) {
1518+
void OnUnloadModuleEvent(DWORD unProcessID, DWORD unThreadID, LPVOID ImageBase) {
14631519
#ifdef _DEBUG
14641520
#ifdef _WIN64
14651521
_tprintf_s(_T("MODULE UNLOAD: 0x%016llX\n"), reinterpret_cast<size_t>(ImageBase));
@@ -1579,7 +1635,7 @@ bool DebugProcess(DWORD unTimeout, bool* pbContinue, bool* pbStopped) {
15791635
g_Modules[DebugEvent.dwProcessId][DebugEvent.u.CreateProcessInfo.lpBaseOfImage] = GetFilePath(DebugEvent.u.CreateProcessInfo.hFile);
15801636
OnCreateProcessEvent(DebugEvent.dwProcessId);
15811637
OnCreateThreadEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId);
1582-
OnLoadModuleEvent(DebugEvent.dwProcessId, DebugEvent.u.CreateProcessInfo.lpBaseOfImage);
1638+
OnLoadModuleEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId, DebugEvent.u.CreateProcessInfo.lpBaseOfImage);
15831639
SafeCloseHandle(DebugEvent.u.CreateProcessInfo.hFile);
15841640
break;
15851641

@@ -1614,12 +1670,12 @@ bool DebugProcess(DWORD unTimeout, bool* pbContinue, bool* pbStopped) {
16141670

16151671
case LOAD_DLL_DEBUG_EVENT:
16161672
g_Modules[DebugEvent.dwProcessId][DebugEvent.u.LoadDll.lpBaseOfDll] = GetFilePath(DebugEvent.u.LoadDll.hFile);
1617-
OnLoadModuleEvent(DebugEvent.dwProcessId, DebugEvent.u.LoadDll.lpBaseOfDll);
1673+
OnLoadModuleEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId, DebugEvent.u.LoadDll.lpBaseOfDll);
16181674
SafeCloseHandle(DebugEvent.u.LoadDll.hFile);
16191675
break;
16201676

16211677
case UNLOAD_DLL_DEBUG_EVENT:
1622-
OnUnloadModuleEvent(DebugEvent.dwProcessId, DebugEvent.u.UnloadDll.lpBaseOfDll);
1678+
OnUnloadModuleEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId, DebugEvent.u.UnloadDll.lpBaseOfDll);
16231679

16241680
g_Modules[DebugEvent.dwProcessId].erase(DebugEvent.u.UnloadDll.lpBaseOfDll);
16251681
if (g_Modules[DebugEvent.dwProcessId].empty()) {

‎HiJack/HiJack.vcxproj

+2-2
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636
<ConfigurationType>Application</ConfigurationType>
3737
<UseDebugLibraries>false</UseDebugLibraries>
3838
<PlatformToolset>v143</PlatformToolset>
39-
<WholeProgramOptimization>true</WholeProgramOptimization>
39+
<WholeProgramOptimization>false</WholeProgramOptimization>
4040
<CharacterSet>Unicode</CharacterSet>
4141
</PropertyGroup>
4242
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
@@ -49,7 +49,7 @@
4949
<ConfigurationType>Application</ConfigurationType>
5050
<UseDebugLibraries>false</UseDebugLibraries>
5151
<PlatformToolset>v143</PlatformToolset>
52-
<WholeProgramOptimization>true</WholeProgramOptimization>
52+
<WholeProgramOptimization>false</WholeProgramOptimization>
5353
<CharacterSet>Unicode</CharacterSet>
5454
</PropertyGroup>
5555
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />

0 commit comments

Comments
 (0)