O' I do have the right, O' I do have the right
This commit is contained in:
SpCreatePackaedLicense
22
MIIEowClient/MIIEowClient/MIIEowClient.filters
Normal file
22
MIIEowClient/MIIEowClient/MIIEowClient.filters
Normal file
@ -0,0 +1,22 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Source Files">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Header Files">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Resource Files">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="Source.c">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
31
MIIEowClient/MIIEowClient/MIIEowClient.sln
Normal file
31
MIIEowClient/MIIEowClient/MIIEowClient.sln
Normal file
@ -0,0 +1,31 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio Version 17
|
||||
VisualStudioVersion = 17.10.35013.160
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MIIEowClient", "MIIEowClient.vcxproj", "{F69369ED-3072-418D-9621-BDDEF9AC9194}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|x64 = Debug|x64
|
||||
Debug|x86 = Debug|x86
|
||||
Release|x64 = Release|x64
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{F69369ED-3072-418D-9621-BDDEF9AC9194}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{F69369ED-3072-418D-9621-BDDEF9AC9194}.Debug|x64.Build.0 = Debug|x64
|
||||
{F69369ED-3072-418D-9621-BDDEF9AC9194}.Debug|x86.ActiveCfg = Debug|Win32
|
||||
{F69369ED-3072-418D-9621-BDDEF9AC9194}.Debug|x86.Build.0 = Debug|Win32
|
||||
{F69369ED-3072-418D-9621-BDDEF9AC9194}.Release|x64.ActiveCfg = Release|x64
|
||||
{F69369ED-3072-418D-9621-BDDEF9AC9194}.Release|x64.Build.0 = Release|x64
|
||||
{F69369ED-3072-418D-9621-BDDEF9AC9194}.Release|x86.ActiveCfg = Release|Win32
|
||||
{F69369ED-3072-418D-9621-BDDEF9AC9194}.Release|x86.Build.0 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||
SolutionGuid = {6387F977-68F6-4156-8B73-29EA132E9A44}
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
4
MIIEowClient/MIIEowClient/MIIEowClient.user
Normal file
4
MIIEowClient/MIIEowClient/MIIEowClient.user
Normal file
@ -0,0 +1,4 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<PropertyGroup />
|
||||
</Project>
|
||||
137
MIIEowClient/MIIEowClient/MIIEowClient.vcxproj
Normal file
137
MIIEowClient/MIIEowClient/MIIEowClient.vcxproj
Normal file
@ -0,0 +1,137 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<VCProjectVersion>17.0</VCProjectVersion>
|
||||
<Keyword>Win32Proj</Keyword>
|
||||
<ProjectGuid>{f69369ed-3072-418d-9621-bddef9ac9194}</ProjectGuid>
|
||||
<RootNamespace>PhoneAct</RootNamespace>
|
||||
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
|
||||
<ProjectName>MIIEowClient</ProjectName>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="Shared">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="Source.c" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
4
MIIEowClient/MIIEowClient/MIIEowClient.vcxproj.user
Normal file
4
MIIEowClient/MIIEowClient/MIIEowClient.vcxproj.user
Normal file
@ -0,0 +1,4 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<PropertyGroup />
|
||||
</Project>
|
||||
271
MIIEowClient/MIIEowClient/Source.c
Normal file
271
MIIEowClient/MIIEowClient/Source.c
Normal file
@ -0,0 +1,271 @@
|
||||
#include <stdio.h>
|
||||
#include <Windows.h>
|
||||
#include <TlHelp32.h>
|
||||
|
||||
/* ------------------------------- CFG ------------------------------- */
|
||||
|
||||
#include <slpublic.h>
|
||||
#pragma comment(lib, "slc.lib")
|
||||
|
||||
#define DRIVER_NAME L"miieow"
|
||||
|
||||
#define PROCESS_NAME L"sppsvc.exe"
|
||||
#define MODULE_NAME L"sppsvc.exe"
|
||||
|
||||
#define OFFSET 0
|
||||
#define SIGNATURE_SZ 10
|
||||
#define SIGNATURE { 0x8B, 0x7D, 0x00, 0x85, 0xFF, 0x75, 0x00, 0x49, 0x8B, 0x06 }
|
||||
#define MASK { 0, 0, 1, 0, 0, 0, 1, 0, 0, 0 }
|
||||
|
||||
#define PATCH { 0x31, 0xff, 0x90 }
|
||||
#define PATCH_SZ 3
|
||||
|
||||
static HSLC hSLC = NULL;
|
||||
void Pre()
|
||||
{
|
||||
// Spin up an sppsvc.exe instance
|
||||
SLOpen(&hSLC);
|
||||
}
|
||||
|
||||
void Post()
|
||||
{
|
||||
SLClose(hSLC);
|
||||
}
|
||||
|
||||
/* ------------------------------- CFG ------------------------------- */
|
||||
|
||||
|
||||
/* --------------------------- MIIEow API --------------------------- */
|
||||
|
||||
// MIIEow Interface
|
||||
#define MwCtlReadProcessMemory CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
|
||||
#define MwCtlWriteProcessMemory CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
|
||||
#define MwCtlProtectProcessMemory CTL_CODE(FILE_DEVICE_UNKNOWN, 0x802, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
|
||||
#define MwCtlGetModuleInfo CTL_CODE(FILE_DEVICE_UNKNOWN, 0x803, METHOD_BUFFERED, FILE_SPECIAL_ACCESS)
|
||||
|
||||
struct MwVmRequest
|
||||
{
|
||||
_In_ DWORD ProcessId;
|
||||
_In_ PVOID Src;
|
||||
_In_ SIZE_T Size;
|
||||
_Out_ PVOID Dst;
|
||||
};
|
||||
|
||||
struct MwVpRequest
|
||||
{
|
||||
_In_ DWORD ProcessId;
|
||||
_In_ PVOID Address;
|
||||
_In_ ULONG NewProt;
|
||||
_In_ SIZE_T Size;
|
||||
_Out_ ULONG* pOldProt;
|
||||
};
|
||||
|
||||
struct MwMiRequest
|
||||
{
|
||||
_In_ DWORD ProcessId;
|
||||
_In_ WCHAR Module[256];
|
||||
_Out_ PVOID BaseAddr;
|
||||
_Out_ ULONG Size;
|
||||
};
|
||||
// MIIEow Interface
|
||||
|
||||
struct MIIEow
|
||||
{
|
||||
HANDLE hDriver;
|
||||
DWORD ProcessId;
|
||||
};
|
||||
|
||||
struct MIIEow*
|
||||
MwcCreate(_In_ DWORD ProcessId)
|
||||
{
|
||||
struct MIIEow* pMIIEow = (struct MIIEow*)malloc(sizeof(struct MIIEow));
|
||||
if (pMIIEow != NULL)
|
||||
{
|
||||
pMIIEow->ProcessId = ProcessId;
|
||||
pMIIEow->hDriver = CreateFileW(L"\\\\.\\" DRIVER_NAME, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
|
||||
return pMIIEow;
|
||||
}
|
||||
else
|
||||
{
|
||||
MessageBoxW(NULL, L"Failed to init Mwc", L"Error", MB_OK | MB_ICONERROR);
|
||||
ExitProcess(1);
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
MwcReadProcessMemory(struct MIIEow *pMIIEow, _In_ PVOID Address, _In_ SIZE_T Size, _Out_ PVOID pBuffer)
|
||||
{
|
||||
struct MwVmRequest r;
|
||||
r.ProcessId = pMIIEow->ProcessId;
|
||||
r.Src = Address;
|
||||
r.Dst = pBuffer;
|
||||
r.Size = Size;
|
||||
|
||||
if (DeviceIoControl(pMIIEow->hDriver, MwCtlReadProcessMemory, (PVOID)&r, sizeof(r), (PVOID)&r, sizeof(r), NULL, NULL) == FALSE)
|
||||
{
|
||||
MessageBoxW(NULL, L"Failed to read memory", L"Error", MB_OK | MB_ICONERROR);
|
||||
ExitProcess(1);
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
MwcWriteProcessMemory(struct MIIEow* pMIIEow, _In_ PVOID Address, _In_ SIZE_T Size, _In_ PVOID pBuffer)
|
||||
{
|
||||
struct MwVmRequest r;
|
||||
r.ProcessId = pMIIEow->ProcessId;
|
||||
r.Src = pBuffer;
|
||||
r.Dst = Address;
|
||||
r.Size = Size;
|
||||
|
||||
if (DeviceIoControl(pMIIEow->hDriver, MwCtlWriteProcessMemory, (PVOID)&r, sizeof(r), (PVOID)&r, sizeof(r), NULL, NULL) == FALSE)
|
||||
{
|
||||
MessageBoxW(NULL, L"Failed to write memory", L"Error", MB_OK | MB_ICONERROR);
|
||||
ExitProcess(1);
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
MwcProtectProcessMemory(struct MIIEow* pMIIEow, _In_ PVOID Address, _In_ SIZE_T Size, _In_ ULONG NewProt, _Out_ ULONG* pOldProt)
|
||||
{
|
||||
struct MwVpRequest r;
|
||||
r.ProcessId = pMIIEow->ProcessId;
|
||||
r.Address = Address;
|
||||
r.NewProt = NewProt;
|
||||
r.Size = Size;
|
||||
r.pOldProt = pOldProt;
|
||||
|
||||
if (DeviceIoControl(pMIIEow->hDriver, MwCtlProtectProcessMemory, (PVOID)&r, sizeof(r), (PVOID)&r, sizeof(r), NULL, NULL) == FALSE)
|
||||
{
|
||||
MessageBoxW(NULL, L"Failed to virtual protect memory", L"Error", MB_OK | MB_ICONERROR);
|
||||
ExitProcess(1);
|
||||
}
|
||||
}
|
||||
|
||||
struct MwMiRequest
|
||||
MwcGetModuleInfo(struct MIIEow* pMIIEow, LPCWSTR ModuleName)
|
||||
{
|
||||
struct MwMiRequest r;
|
||||
r.ProcessId = pMIIEow->ProcessId;
|
||||
wcscpy_s(r.Module, 256, ModuleName);
|
||||
|
||||
if (DeviceIoControl(pMIIEow->hDriver, MwCtlGetModuleInfo, (PVOID)&r, sizeof(r), (PVOID)&r, sizeof(r), NULL, NULL) == FALSE)
|
||||
{
|
||||
MessageBoxW(NULL, L"Failed to get base address", L"Error", MB_OK | MB_ICONERROR);
|
||||
ExitProcess(1);
|
||||
}
|
||||
|
||||
return r;
|
||||
}
|
||||
|
||||
void
|
||||
MwcDelete(struct MIIEow* pMIIEow)
|
||||
{
|
||||
if (pMIIEow != NULL)
|
||||
{
|
||||
if (pMIIEow->hDriver != INVALID_HANDLE_VALUE)
|
||||
{
|
||||
CloseHandle(pMIIEow->hDriver);
|
||||
}
|
||||
free(pMIIEow);
|
||||
}
|
||||
}
|
||||
|
||||
/* --------------------------- MIIEow API --------------------------- */
|
||||
|
||||
PVOID
|
||||
SignatureScan(struct MIIEow* pMIIEow, PVOID BaseAddress, SIZE_T Size)
|
||||
{
|
||||
PVOID EndAddress = (PVOID)((SIZE_T)BaseAddress + Size);
|
||||
|
||||
const BYTE Signature[SIGNATURE_SZ] = SIGNATURE;
|
||||
const BYTE Mask[SIGNATURE_SZ] = MASK;
|
||||
|
||||
for (BYTE* Address = BaseAddress; Address < ((SIZE_T)EndAddress - SIGNATURE_SZ); Address++)
|
||||
{
|
||||
// TODO: Do this by page, ioctl is expensive
|
||||
BYTE Buffer[SIGNATURE_SZ] = { 0 };
|
||||
MwcReadProcessMemory(pMIIEow, Address, SIGNATURE_SZ, Buffer);
|
||||
|
||||
BOOL Found = TRUE;
|
||||
for (int i = 0; i < SIGNATURE_SZ; i++)
|
||||
{
|
||||
if (Mask[i] == 0 && Buffer[i] != Signature[i])
|
||||
{
|
||||
Found = FALSE;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (Found) return Address + OFFSET;
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
|
||||
|
||||
DWORD
|
||||
GetProcessIdByName(LPCWSTR processName)
|
||||
{
|
||||
PROCESSENTRY32 Entry;
|
||||
Entry.dwSize = sizeof(PROCESSENTRY32);
|
||||
HANDLE Snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
|
||||
|
||||
if (Process32First(Snapshot, &Entry) == TRUE)
|
||||
{
|
||||
while (Process32Next(Snapshot, &Entry) == TRUE)
|
||||
{
|
||||
if (_wcsicmp(Entry.szExeFile, processName) == 0)
|
||||
{
|
||||
CloseHandle(Snapshot);
|
||||
return Entry.th32ProcessID;
|
||||
}
|
||||
}
|
||||
}
|
||||
CloseHandle(Snapshot);
|
||||
return (DWORD)-1;
|
||||
}
|
||||
|
||||
int main()
|
||||
{
|
||||
Pre();
|
||||
|
||||
LPCWSTR TargetProcessName = PROCESS_NAME;
|
||||
DWORD ProcessId = GetProcessIdByName(TargetProcessName);
|
||||
|
||||
if (ProcessId == (DWORD)-1)
|
||||
{
|
||||
MessageBoxW(NULL, L"Failed to find target process", L"Error", MB_OK | MB_ICONERROR);
|
||||
ExitProcess(1);
|
||||
}
|
||||
printf("[+] Located target process\n");
|
||||
|
||||
struct MIIEow* pMIIEow = MwcCreate(ProcessId);
|
||||
printf("[+] MIIEow initialised\n");
|
||||
|
||||
struct MwMiRequest ModuleInfo = MwcGetModuleInfo(pMIIEow, MODULE_NAME);
|
||||
printf("[+] Got base address : %zx\n", (SIZE_T)ModuleInfo.BaseAddr);
|
||||
|
||||
PVOID PatchAddr = SignatureScan(pMIIEow, ModuleInfo.BaseAddr, ModuleInfo.Size);
|
||||
printf("[+] Scan result : %zx\n", (SIZE_T)PatchAddr);
|
||||
|
||||
BYTE SanityByte;
|
||||
MwcReadProcessMemory(pMIIEow, PatchAddr, 1, &SanityByte);
|
||||
printf("[+] Sanity byte : %zx\n", (SIZE_T)SanityByte);
|
||||
|
||||
ULONG OldProt;
|
||||
MwcProtectProcessMemory(pMIIEow, PatchAddr, 4096, PAGE_EXECUTE_READWRITE, &OldProt);
|
||||
|
||||
printf("[+] Set protection to RWX\n");
|
||||
|
||||
const BYTE Patch[PATCH_SZ] = PATCH;
|
||||
MwcWriteProcessMemory(pMIIEow, PatchAddr, 4, Patch);
|
||||
printf("[+] Patched\n");
|
||||
|
||||
ULONG _;
|
||||
MwcProtectProcessMemory(pMIIEow, PatchAddr, 4096, OldProt, &_);
|
||||
printf("[+] Restored protection\n");
|
||||
|
||||
MwcDelete(pMIIEow);
|
||||
|
||||
Post();
|
||||
|
||||
return 0;
|
||||
}
|
||||
Reference in New Issue
Block a user