Skip to content

Commit 30720e1

Browse files
dledda-r7dledda-r7
committed
feat: adding VirtualQuery(Ex) and VirtualFree
1 parent 35311d9 commit 30720e1

6 files changed

Lines changed: 37 additions & 4 deletions

File tree

‎c/meterpreter/source/common/common_winapi.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ typedef struct _WinApiKernel32 {
88
LPVOID (*VirtualAllocEx)(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize,DWORD flAllocationType, DWORD flProtect);
99
BOOL (*VirtualProtect)(LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect);
1010
BOOL (*VirtualProtectEx)(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect);
11+
SIZE_T (*VirtualQuery)(LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer,SIZE_T dwLength);
12+
SIZE_T (*VirtualQueryEx)(HANDLE hProcess, LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer, SIZE_T dwLength);
13+
BOOL (*VirtualFree)(LPVOID lpAddress, SIZE_T dwSize, DWORD dwFreeType);
1114
HANDLE (*CreateRemoteThread)(HANDLE hProcess, LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId);
1215

1316
} WinApiKernel32;

‎c/meterpreter/source/metsrv/base_inject.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,7 @@ DWORD inject_via_apcthread( Remote * remote, Packet * response, HANDLE hProcess,
208208
if( !lpRemoteAddress )
209209
BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: VirtualAllocEx 0x6B0095F0 failed" );
210210

211-
if( VirtualQueryEx( hProcess, lpRemoteAddress, &mbi, sizeof(MEMORY_BASIC_INFORMATION) ) == 0 )
211+
if( met_api->win_api.kernel32.VirtualQueryEx( hProcess, lpRemoteAddress, &mbi, sizeof(MEMORY_BASIC_INFORMATION) ) == 0 )
212212
BREAK_ON_ERROR( "[INJECT] inject_via_apcthread: VirtualQueryEx failed" );
213213

214214
lpNopSled = (BYTE *)malloc( mbi.RegionSize );

‎c/meterpreter/source/metsrv/libloader.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -341,7 +341,7 @@ void patch_function(SHELLCODE_CTX *ctx, UINT_PTR address, unsigned char *stub,
341341
/* Patch original function */
342342

343343
/* Fix protection */
344-
VirtualQuery((LPVOID)address, &mbi_thunk,
344+
met_api->win_api.kernel32.VirtualQuery((LPVOID)address, &mbi_thunk,
345345
sizeof(MEMORY_BASIC_INFORMATION));
346346
met_api->win_api.kernel32.VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize,
347347
PAGE_EXECUTE_READWRITE, &mbi_thunk.Protect);
@@ -435,7 +435,7 @@ void restore_function(SHELLCODE_CTX *ctx, DWORD_PTR address, unsigned char *stub
435435
/* Patch original function */
436436

437437
/* Fix protection */
438-
VirtualQuery((LPVOID)address, &mbi_thunk,
438+
met_api->win_api.kernel32.VirtualQuery((LPVOID)address, &mbi_thunk,
439439
sizeof(MEMORY_BASIC_INFORMATION));
440440
met_api->win_api.kernel32.VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize,
441441
PAGE_EXECUTE_READWRITE, &mbi_thunk.Protect);
@@ -607,7 +607,7 @@ HMODULE libloader_load_library(LPCSTR name, PUCHAR buffer, DWORD bufferLength)
607607

608608
remove_hooks(ctx);
609609

610-
VirtualFree(ctx, 0, MEM_RELEASE);
610+
met_api->win_api.kernel32.VirtualFree(ctx, 0, MEM_RELEASE);
611611

612612
return mod;
613613
}

‎c/meterpreter/source/metsrv/metapi.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,9 @@ MetApi api_instance = {
158158
winapi_kernel32_VirtualAllocEx,
159159
winapi_kernel32_VirtualProtect,
160160
winapi_kernel32_VirtualProtectEx,
161+
winapi_kernel32_VirtualQuery,
162+
winapi_kernel32_VirtualQueryEx,
163+
winapi_kernel32_VirtualFree,
161164
winapi_kernel32_CreateRemoteThread
162165
}
163166
},

‎c/meterpreter/source/metsrv/winapi.c‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,30 @@ BOOL winapi_kernel32_VirtualProtectEx(HANDLE hProcess, LPVOID lpAddress, SIZE_T
7474
return FALSE;
7575
}
7676

77+
SIZE_T winapi_kernel32_VirtualQuery(LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer,SIZE_T dwLength) {
78+
SIZE_T (*pVirtualQuery)(LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer,SIZE_T dwLength) = GetFunction(KERNEL32_DLL, "VirtualQuery");
79+
if(pVirtualQuery) {
80+
return pVirtualQuery(lpAddress, lpBuffer, dwLength);
81+
}
82+
return 0;
83+
}
84+
85+
SIZE_T winapi_kernel32_VirtualQueryEx(HANDLE hProcess, LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer, SIZE_T dwLength) {
86+
SIZE_T (*pVirtualQueryEx)(HANDLE hProcess, LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer, SIZE_T dwLength) = GetFunction(KERNEL32_DLL, "VirtualQueryEx");
87+
if(pVirtualQueryEx) {
88+
return pVirtualQueryEx(hProcess, lpAddress, lpBuffer, dwLength);
89+
}
90+
return 0;
91+
}
92+
93+
BOOL winapi_kernel32_VirtualFree(LPVOID lpAddress, SIZE_T dwSize, DWORD dwFreeType) {
94+
BOOL (*pVirtualFree)(LPVOID lpAddress, SIZE_T dwSize, DWORD dwFreeType) = GetFunction(KERNEL32_DLL, "VirtualFree");
95+
if(pVirtualFree) {
96+
return pVirtualFree(lpAddress, dwSize, dwFreeType);
97+
}
98+
return FALSE;
99+
}
100+
77101
HANDLE winapi_kernel32_CreateRemoteThread(HANDLE hProcess, LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId) {
78102
HANDLE (*pCreateRemoteThread)(HANDLE hProcess, LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId) = GetFunction(KERNEL32_DLL, "CreateRemoteThread");
79103
if(pCreateRemoteThread) {

‎c/meterpreter/source/metsrv/winapi.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ LPVOID winapi_kernel32_VirtualAlloc(LPVOID lpAddress, SIZE_T dwSize, DWORD flAll
77
LPVOID winapi_kernel32_VirtualAllocEx(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect);
88
BOOL winapi_kernel32_VirtualProtect(LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect);
99
BOOL winapi_kernel32_VirtualProtectEx(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect);
10+
SIZE_T winapi_kernel32_VirtualQuery(LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer,SIZE_T dwLength);
11+
SIZE_T winapi_kernel32_VirtualQueryEx(HANDLE hProcess, LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer, SIZE_T dwLength);
12+
BOOL winapi_kernel32_VirtualFree(LPVOID lpAddress, SIZE_T dwSize, DWORD dwFreeType);
1013
HANDLE winapi_kernel32_CreateRemoteThread(HANDLE hProcess, LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId);
1114

1215
#endif

0 commit comments

Comments
 (0)