From 4e2c47f82427278dc0afc13b9fef4e9f5fdbc626 Mon Sep 17 00:00:00 2001 From: Shulga Konstantin Date: Thu, 24 Dec 2020 21:08:42 +0300 Subject: [PATCH] feat: implement the third lab --- Lab_3/DllInjection/DllInjection.cpp | 110 ++++++++++++ Lab_3/DllInjection/DllInjection.vcxproj | 150 +++++++++++++++++ .../DllInjection/DllInjection.vcxproj.filters | 22 +++ .../DllStringReplacement.vcxproj | 159 ++++++++++++++++++ .../DllStringReplacement.vcxproj.filters | 25 +++ Lab_3/DllStringReplacement/StringReplacer.cpp | 62 +++++++ Lab_3/DllStringReplacement/dllmain.cpp | 18 ++ Lab_3/InjectableDll/InjectableDll.vcxproj | 159 ++++++++++++++++++ .../InjectableDll.vcxproj.filters | 22 +++ Lab_3/InjectableDll/dllmain.cpp | 25 +++ Lab_3/Lab_3.sln | 51 ++++++ 11 files changed, 803 insertions(+) create mode 100644 Lab_3/DllInjection/DllInjection.cpp create mode 100644 Lab_3/DllInjection/DllInjection.vcxproj create mode 100644 Lab_3/DllInjection/DllInjection.vcxproj.filters create mode 100644 Lab_3/DllStringReplacement/DllStringReplacement.vcxproj create mode 100644 Lab_3/DllStringReplacement/DllStringReplacement.vcxproj.filters create mode 100644 Lab_3/DllStringReplacement/StringReplacer.cpp create mode 100644 Lab_3/DllStringReplacement/dllmain.cpp create mode 100644 Lab_3/InjectableDll/InjectableDll.vcxproj create mode 100644 Lab_3/InjectableDll/InjectableDll.vcxproj.filters create mode 100644 Lab_3/InjectableDll/dllmain.cpp create mode 100644 Lab_3/Lab_3.sln diff --git a/Lab_3/DllInjection/DllInjection.cpp b/Lab_3/DllInjection/DllInjection.cpp new file mode 100644 index 0000000..b80b114 --- /dev/null +++ b/Lab_3/DllInjection/DllInjection.cpp @@ -0,0 +1,110 @@ +#include +#include +#include + +using namespace std; + +extern "C" __declspec(dllimport) void __stdcall ReplaceString( + DWORD pid, + const char* srcString, + const char* resString); + +typedef void __stdcall TReplaceString(DWORD, const char*, const char*); + +void ReplaceStringDynamic(DWORD, const char*, const char*); +void InjectLibrary(DWORD); + +int main() +{ + DWORD pid = GetCurrentProcessId(); + bool isExit = false; + + const char src_str[] = "Hello, world"; + const char res_str[] = "dlrow ,olleH"; + + while (!isExit) + { + cout << "Available actions:" << endl + << "\t0 - Static import and call" << endl + << "\t1 - Dynamic import and call" << endl + << "\t2 - Dll injection" << endl + << "Enter action: "; + + char action; + + cin >> action; + + switch (action) + { + case '0': + cout << endl << "String before change: " << src_str << endl; + ReplaceString(pid, src_str, res_str); + cout << "String after changes: " << src_str << endl << endl; + break; + case '1': + cout << endl << "String before change: " << src_str << endl; + ReplaceStringDynamic(pid, src_str, res_str); + cout << "String after changes: " << src_str << endl << endl; + break; + case '2': + cout << endl << "String before change: " << src_str << endl; + InjectLibrary(pid); + cout << "String after changes: " << src_str << endl << endl; + break; + default: + isExit = true; + break; + } + } + + system("pause"); + return 0; +} + +void ReplaceStringDynamic(DWORD pid, const char* src_str, const char* res_str) +{ + HMODULE hDll = LoadLibrary("DllStringReplacement.dll"); + + if (hDll != NULL) + { + TReplaceString* lpReplaceString = (TReplaceString*)GetProcAddress(hDll, "_ReplaceString@12"); + + if (lpReplaceString != NULL) + { + lpReplaceString(pid, src_str, res_str); + } + + FreeLibrary(hDll); + } +} + +void InjectLibrary(DWORD procID) +{ + HANDLE hProc = OpenProcess(PROCESS_VM_READ | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | + PROCESS_CREATE_THREAD | PROCESS_CREATE_PROCESS, + FALSE, procID); + + if (hProc) + { + LPVOID baseAddress = VirtualAllocEx(hProc, NULL, strlen("InjectableDll.dll") + 1, + MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); + + if (baseAddress) + { + WriteProcessMemory(hProc, baseAddress, "InjectableDll.dll", + strlen("InjectableDll.dll") + 1, NULL); + + DWORD threadId; + + HANDLE hThread = CreateRemoteThread(hProc, NULL, NULL, + (LPTHREAD_START_ROUTINE)LoadLibraryA, (LPVOID)baseAddress, NULL, &threadId); + + if (hThread == NULL) + cout << "Error" << endl; + else + WaitForSingleObject(hThread, INFINITE); + } + + CloseHandle(hProc); + } +} \ No newline at end of file diff --git a/Lab_3/DllInjection/DllInjection.vcxproj b/Lab_3/DllInjection/DllInjection.vcxproj new file mode 100644 index 0000000..1378683 --- /dev/null +++ b/Lab_3/DllInjection/DllInjection.vcxproj @@ -0,0 +1,150 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {8fb03a9c-626a-4e56-b1a9-44de94ef3556} + DllInjection + 10.0 + + + + Application + true + v142 + MultiByte + + + Application + false + v142 + true + Unicode + + + Application + true + v142 + Unicode + + + Application + false + v142 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + D:\University\OSaSP\OSaSP-Labs\Lab_3\DllStringReplacement;%(AdditionalIncludeDirectories) + + + Console + true + D:\University\OSaSP\OSaSP-Labs\Lab_3\$(IntDir);%(AdditionalLibraryDirectories) + DllStringReplacement.lib;%(AdditionalDependencies) + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + \ No newline at end of file diff --git a/Lab_3/DllInjection/DllInjection.vcxproj.filters b/Lab_3/DllInjection/DllInjection.vcxproj.filters new file mode 100644 index 0000000..bb4939c --- /dev/null +++ b/Lab_3/DllInjection/DllInjection.vcxproj.filters @@ -0,0 +1,22 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + \ No newline at end of file diff --git a/Lab_3/DllStringReplacement/DllStringReplacement.vcxproj b/Lab_3/DllStringReplacement/DllStringReplacement.vcxproj new file mode 100644 index 0000000..f6d218d --- /dev/null +++ b/Lab_3/DllStringReplacement/DllStringReplacement.vcxproj @@ -0,0 +1,159 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {0e39f8a2-ca66-4878-b0e2-c69e0bf3df50} + DllStringReplacement + 10.0 + + + + DynamicLibrary + true + v142 + Unicode + + + DynamicLibrary + false + v142 + true + Unicode + + + DynamicLibrary + true + v142 + Unicode + + + DynamicLibrary + false + v142 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;DLLSTRINGREPLACEMENT_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + NotUsing + + + Windows + true + false + + + + + Level3 + true + true + true + WIN32;NDEBUG;DLLSTRINGREPLACEMENT_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false + + + + + Level3 + true + _DEBUG;DLLSTRINGREPLACEMENT_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + false + + + + + Level3 + true + true + true + NDEBUG;DLLSTRINGREPLACEMENT_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false + + + + + + + + + + \ No newline at end of file diff --git a/Lab_3/DllStringReplacement/DllStringReplacement.vcxproj.filters b/Lab_3/DllStringReplacement/DllStringReplacement.vcxproj.filters new file mode 100644 index 0000000..96c3c1b --- /dev/null +++ b/Lab_3/DllStringReplacement/DllStringReplacement.vcxproj.filters @@ -0,0 +1,25 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + Source Files + + + \ No newline at end of file diff --git a/Lab_3/DllStringReplacement/StringReplacer.cpp b/Lab_3/DllStringReplacement/StringReplacer.cpp new file mode 100644 index 0000000..01f2ce8 --- /dev/null +++ b/Lab_3/DllStringReplacement/StringReplacer.cpp @@ -0,0 +1,62 @@ +#include +#include + +extern "C" void __declspec(dllexport) __stdcall ReplaceString( + DWORD pid, + const char* srcString, + const char* resString) +{ + HANDLE hProcess = OpenProcess( + PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_QUERY_INFORMATION, + FALSE, + pid); + + if (hProcess) + { + SYSTEM_INFO systemInfo; + GetSystemInfo(&systemInfo); + + MEMORY_BASIC_INFORMATION memoryInfo; + std::vector chunk; + char* p = 0; + + while (p < systemInfo.lpMaximumApplicationAddress) + { + if (VirtualQueryEx(hProcess, p, &memoryInfo, sizeof(memoryInfo)) == sizeof(memoryInfo)) + { + if (memoryInfo.State == MEM_COMMIT && memoryInfo.AllocationProtect == PAGE_READWRITE) + { + p = (char*)memoryInfo.BaseAddress; + + chunk.resize(memoryInfo.RegionSize); + SIZE_T bytesRead; + + try + { + if (ReadProcessMemory(hProcess, p, &chunk[0], memoryInfo.RegionSize, &bytesRead)) + { + for (size_t i = 0; i < (bytesRead - strlen(srcString)); ++i) + { + if (memcmp(srcString, &chunk[i], strlen(srcString)) == 0) + { + char* ref = (char*)p + i; + + for (int j = 0; j < strlen(resString); j++) + ref[j] = resString[j]; + + ref[strlen(resString)] = 0; + } + } + } + } + catch (std::bad_alloc& e) + { + + } + } + + p += memoryInfo.RegionSize; + } + } + } +} \ No newline at end of file diff --git a/Lab_3/DllStringReplacement/dllmain.cpp b/Lab_3/DllStringReplacement/dllmain.cpp new file mode 100644 index 0000000..6285b34 --- /dev/null +++ b/Lab_3/DllStringReplacement/dllmain.cpp @@ -0,0 +1,18 @@ +#include + +BOOL APIENTRY DllMain( + HMODULE hModule, + DWORD ul_reason_for_call, + LPVOID lpReserved) +{ + switch (ul_reason_for_call) + { + case DLL_PROCESS_ATTACH: + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + case DLL_PROCESS_DETACH: + break; + } + + return TRUE; +} \ No newline at end of file diff --git a/Lab_3/InjectableDll/InjectableDll.vcxproj b/Lab_3/InjectableDll/InjectableDll.vcxproj new file mode 100644 index 0000000..3331fc0 --- /dev/null +++ b/Lab_3/InjectableDll/InjectableDll.vcxproj @@ -0,0 +1,159 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {84810481-81e8-4c26-8085-b44be93d3828} + InjectableDll + 10.0 + + + + DynamicLibrary + true + v142 + Unicode + + + DynamicLibrary + false + v142 + true + Unicode + + + DynamicLibrary + true + v142 + Unicode + + + DynamicLibrary + false + v142 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;INJECTABLEDLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + NotUsing + + + + Windows + true + false + + + + + Level3 + true + true + true + WIN32;NDEBUG;INJECTABLEDLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false + + + + + Level3 + true + _DEBUG;INJECTABLEDLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + false + + + + + Level3 + true + true + true + NDEBUG;INJECTABLEDLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false + + + + + + + + + \ No newline at end of file diff --git a/Lab_3/InjectableDll/InjectableDll.vcxproj.filters b/Lab_3/InjectableDll/InjectableDll.vcxproj.filters new file mode 100644 index 0000000..e86417e --- /dev/null +++ b/Lab_3/InjectableDll/InjectableDll.vcxproj.filters @@ -0,0 +1,22 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + \ No newline at end of file diff --git a/Lab_3/InjectableDll/dllmain.cpp b/Lab_3/InjectableDll/dllmain.cpp new file mode 100644 index 0000000..0f9becb --- /dev/null +++ b/Lab_3/InjectableDll/dllmain.cpp @@ -0,0 +1,25 @@ +#include + +#include "../DllStringReplacement/StringReplacer.cpp" + +BOOL APIENTRY DllMain( + HMODULE hModule, + DWORD ul_reason_for_call, + LPVOID lpReserved) +{ + DWORD pid = GetCurrentProcessId(); + + const char src_str[] = "Hello, world"; + const char res_str[] = "dlrow ,olleH"; + + switch (ul_reason_for_call) + { + case DLL_PROCESS_ATTACH: + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + ReplaceString(pid, src_str, res_str); + case DLL_PROCESS_DETACH: + break; + } + return TRUE; +} \ No newline at end of file diff --git a/Lab_3/Lab_3.sln b/Lab_3/Lab_3.sln new file mode 100644 index 0000000..e4b35e5 --- /dev/null +++ b/Lab_3/Lab_3.sln @@ -0,0 +1,51 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 16 +VisualStudioVersion = 16.0.30711.63 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "DllStringReplacement", "DllStringReplacement\DllStringReplacement.vcxproj", "{0E39F8A2-CA66-4878-B0E2-C69E0BF3DF50}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "DllInjection", "DllInjection\DllInjection.vcxproj", "{8FB03A9C-626A-4E56-B1A9-44DE94EF3556}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "InjectableDll", "InjectableDll\InjectableDll.vcxproj", "{84810481-81E8-4C26-8085-B44BE93D3828}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {0E39F8A2-CA66-4878-B0E2-C69E0BF3DF50}.Debug|x64.ActiveCfg = Debug|x64 + {0E39F8A2-CA66-4878-B0E2-C69E0BF3DF50}.Debug|x64.Build.0 = Debug|x64 + {0E39F8A2-CA66-4878-B0E2-C69E0BF3DF50}.Debug|x86.ActiveCfg = Debug|Win32 + {0E39F8A2-CA66-4878-B0E2-C69E0BF3DF50}.Debug|x86.Build.0 = Debug|Win32 + {0E39F8A2-CA66-4878-B0E2-C69E0BF3DF50}.Release|x64.ActiveCfg = Release|x64 + {0E39F8A2-CA66-4878-B0E2-C69E0BF3DF50}.Release|x64.Build.0 = Release|x64 + {0E39F8A2-CA66-4878-B0E2-C69E0BF3DF50}.Release|x86.ActiveCfg = Release|Win32 + {0E39F8A2-CA66-4878-B0E2-C69E0BF3DF50}.Release|x86.Build.0 = Release|Win32 + {8FB03A9C-626A-4E56-B1A9-44DE94EF3556}.Debug|x64.ActiveCfg = Debug|x64 + {8FB03A9C-626A-4E56-B1A9-44DE94EF3556}.Debug|x64.Build.0 = Debug|x64 + {8FB03A9C-626A-4E56-B1A9-44DE94EF3556}.Debug|x86.ActiveCfg = Debug|Win32 + {8FB03A9C-626A-4E56-B1A9-44DE94EF3556}.Debug|x86.Build.0 = Debug|Win32 + {8FB03A9C-626A-4E56-B1A9-44DE94EF3556}.Release|x64.ActiveCfg = Release|x64 + {8FB03A9C-626A-4E56-B1A9-44DE94EF3556}.Release|x64.Build.0 = Release|x64 + {8FB03A9C-626A-4E56-B1A9-44DE94EF3556}.Release|x86.ActiveCfg = Release|Win32 + {8FB03A9C-626A-4E56-B1A9-44DE94EF3556}.Release|x86.Build.0 = Release|Win32 + {84810481-81E8-4C26-8085-B44BE93D3828}.Debug|x64.ActiveCfg = Debug|x64 + {84810481-81E8-4C26-8085-B44BE93D3828}.Debug|x64.Build.0 = Debug|x64 + {84810481-81E8-4C26-8085-B44BE93D3828}.Debug|x86.ActiveCfg = Debug|Win32 + {84810481-81E8-4C26-8085-B44BE93D3828}.Debug|x86.Build.0 = Debug|Win32 + {84810481-81E8-4C26-8085-B44BE93D3828}.Release|x64.ActiveCfg = Release|x64 + {84810481-81E8-4C26-8085-B44BE93D3828}.Release|x64.Build.0 = Release|x64 + {84810481-81E8-4C26-8085-B44BE93D3828}.Release|x86.ActiveCfg = Release|Win32 + {84810481-81E8-4C26-8085-B44BE93D3828}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {837A6389-682E-4D36-B815-2C9A23C5BC1C} + EndGlobalSection +EndGlobal