Skip to content

Commit 04e487a

Browse files
BroihonBroihon
committed
Updated to V4.6
1 parent f408d89 commit 04e487a

18 files changed

+448
-345
lines changed

‎GH Injector Library/Error.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,7 @@
148148
#define SR_NTCTE_ERR_SHELLCODE_SETUP_FAIL 0x1010000B //shellcode : - : argument passed to the shellcode is 0
149149
#define SR_NTCTE_ERR_RPM_FAIL 0x1010000C //ReadProcessMemory : win32 error : reading the results of the shellcode failed
150150
#define SR_NTCTE_ERR_CANT_FIND_THREAD 0x1010000D //internal error : - : ProcessInfo class failed to resolve information about the new thread
151+
#define SR_NTCTE_ERR_NTQIT_FAIL 0x1010000E //NtQueryInformationThread : NTSTATUS : failed to get THREAD_BASIC_INFORMATION
151152

152153

153154
///////////////

‎GH Injector Library/FakeVEH WOW64.cpp

Lines changed: 103 additions & 116 deletions
Large diffs are not rendered by default.

‎GH Injector Library/FakeVEH.cpp

Lines changed: 208 additions & 176 deletions
Large diffs are not rendered by default.

‎GH Injector Library/GH Injector Library.aps

556 Bytes
Binary file not shown.

‎GH Injector Library/GH Injector Library.rc

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,8 @@ END
5151
//
5252

5353
VS_VERSION_INFO VERSIONINFO
54-
FILEVERSION 4,5,0,0
55-
PRODUCTVERSION 4,5,0,0
54+
FILEVERSION 4,6,0,0
55+
PRODUCTVERSION 4,6,0,0
5656
FILEFLAGSMASK 0x3fL
5757
#ifdef _DEBUG
5858
FILEFLAGS 0x1L
@@ -69,10 +69,10 @@ BEGIN
6969
BEGIN
7070
VALUE "CompanyName", "Guided Hacking"
7171
VALUE "FileDescription", "Injection library of the GH Injector"
72-
VALUE "FileVersion", "4.5.0.0"
72+
VALUE "FileVersion", "4.6.0.0"
7373
VALUE "LegalCopyright", "Broihon (C) 1987 - 2035"
7474
VALUE "ProductName", "GH Injection Library"
75-
VALUE "ProductVersion", "4.5.0.0"
75+
VALUE "ProductVersion", "4.6.0.0"
7676
END
7777
END
7878
BLOCK "VarFileInfo"

‎GH Injector Library/GH Injector Library.vcxproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
<VCProjectVersion>15.0</VCProjectVersion>
2323
<ProjectGuid>{AC732425-E265-40FF-842F-C59CECE9A96C}</ProjectGuid>
2424
<RootNamespace>GHInjectorLibrary</RootNamespace>
25-
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
25+
<WindowsTargetPlatformVersion>10.0.20348.0</WindowsTargetPlatformVersion>
2626
</PropertyGroup>
2727
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
2828
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">

‎GH Injector Library/Injection Generic.cpp

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -331,20 +331,22 @@ DWORD __declspec(code_seg(".inj_sec$1")) __stdcall InjectionShell(INJECTION_DATA
331331
return INJ_ERR_LDRP_PREPROCESS_FAILED;
332332
}
333333

334-
ULONG_PTR unknown = 0;
334+
NTSTATUS nt_out = 0;
335335

336336
if (pData->OSBuildNumber >= g_Win11_21H2) //Win11 prototype has an additional argument
337337
{
338338
auto _LdrpLoadDllInternal = ReCa<f_LdrpLoadDllInternal_WIN11>(f->LdrpLoadDllInternal);
339-
pData->LastError = _LdrpLoadDllInternal(&pData->ModuleFileNameBundle.String, ctx, ctx_flags, 4, nullptr, nullptr, ReCa<LDR_DATA_TABLE_ENTRY_WIN11 **>(&entry_out), &unknown, 0);
339+
_LdrpLoadDllInternal(&pData->ModuleFileNameBundle.String, ctx, ctx_flags, 4, nullptr, nullptr, ReCa<LDR_DATA_TABLE_ENTRY_WIN11 **>(&entry_out), &nt_out, 0);
340340
}
341341
else
342342
{
343-
pData->LastError = f->LdrpLoadDllInternal(&pData->ModuleFileNameBundle.String, ctx, ctx_flags, 4, nullptr, nullptr, ReCa<LDR_DATA_TABLE_ENTRY_WIN10 **>(&entry_out), &unknown);
343+
f->LdrpLoadDllInternal(&pData->ModuleFileNameBundle.String, ctx, ctx_flags, 4, nullptr, nullptr, ReCa<LDR_DATA_TABLE_ENTRY_WIN10 **>(&entry_out), &nt_out);
344344
}
345345

346-
if (NT_FAIL(pData->LastError))
346+
if (NT_FAIL(nt_out))
347347
{
348+
pData->LastError = (DWORD)nt_out;
349+
348350
return INJ_ERR_LDRPLDLLINTERNAL_FAILED;
349351
}
350352
}

‎GH Injector Library/Manual Mapping.cpp

Lines changed: 30 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -447,7 +447,7 @@ __forceinline NTSTATUS LoadModule(MANUAL_MAPPING_DATA * pData, MANUAL_MAPPING_FU
447447
DeleteObject(f, pModPathW);
448448
DeleteObject(f, ModNameW->szBuffer);
449449
DeleteObject(f, ModNameW);
450-
450+
451451
return ntRet;
452452
}
453453

@@ -470,16 +470,14 @@ __forceinline NTSTATUS LoadModule(MANUAL_MAPPING_DATA * pData, MANUAL_MAPPING_FU
470470
ctx->OriginalFullDllName = ModNameW->szBuffer;
471471
}
472472

473-
ULONG_PTR unknown3 = 0;
474-
475473
if (pData->OSBuildNumber >= g_Win11_21H2)
476474
{
477475
auto _LdrpLoadDllInternal = ReCa<f_LdrpLoadDllInternal_WIN11>(f->LdrpLoadDllInternal);
478-
ntRet = _LdrpLoadDllInternal(&pModPathW->String, ctx, ctx_flags, 4, nullptr, nullptr, ReCa<LDR_DATA_TABLE_ENTRY_WIN11 **>(&entry_out), &unknown3, 0);
476+
_LdrpLoadDllInternal(&pModPathW->String, ctx, ctx_flags, 4, nullptr, nullptr, ReCa<LDR_DATA_TABLE_ENTRY_WIN11 **>(&entry_out), &ntRet, 0);
479477
}
480478
else
481479
{
482-
ntRet = f->LdrpLoadDllInternal(&pModPathW->String, ctx, ctx_flags, 4, nullptr, nullptr, ReCa<LDR_DATA_TABLE_ENTRY_WIN10 **>(&entry_out), &unknown3);
480+
f->LdrpLoadDllInternal(&pModPathW->String, ctx, ctx_flags, 4, nullptr, nullptr, ReCa<LDR_DATA_TABLE_ENTRY_WIN10 **>(&entry_out), &ntRet);
483481
}
484482

485483
DeleteObject(f, ctx);
@@ -817,6 +815,7 @@ DWORD __declspec(code_seg(".mmap_sec$1")) __stdcall ManualMapping_Shell(MANUAL_M
817815
veh_shell_data->ImgBase = ReCa<ULONG_PTR>(pBase);
818816
veh_shell_data->ImgSize = pOptionalHeader->SizeOfImage;
819817
veh_shell_data->OSVersion = pData->OSVersion;
818+
820819
veh_shell_data->_LdrpInvertedFunctionTable = f->LdrpInvertedFunctionTable;
821820
veh_shell_data->_LdrProtectMrdata = f->LdrProtectMrdata;
822821

@@ -945,6 +944,18 @@ DWORD __declspec(code_seg(".mmap_sec$1")) __stdcall ManualMapping_Shell(MANUAL_M
945944

946945
if (NT_FAIL(ntRet))
947946
{
947+
if (ntRet == STATUS_APISET_NOT_HOSTED)
948+
{
949+
++pImportDescr;
950+
951+
if (pImportDescr >= ReCa<IMAGE_IMPORT_DESCRIPTOR *>(pBase + pImportDir->VirtualAddress + pImportDir->Size))
952+
{
953+
break;
954+
}
955+
956+
continue;
957+
}
958+
948959
//unable to load required library
949960
ErrorBreak = true;
950961
break;
@@ -1046,12 +1057,23 @@ DWORD __declspec(code_seg(".mmap_sec$1")) __stdcall ManualMapping_Shell(MANUAL_M
10461057
while (pDelayImportDescr && pDelayImportDescr->DllNameRVA)
10471058
{
10481059
char * szMod = ReCa<char *>(pBase + pDelayImportDescr->DllNameRVA);
1049-
10501060
HINSTANCE hDll = NULL;
10511061
ntRet = LoadModule(pData, f, szMod, &hDll, &delay_imports);
10521062

10531063
if (NT_FAIL(ntRet))
10541064
{
1065+
if (ntRet == STATUS_APISET_NOT_HOSTED)
1066+
{
1067+
++pDelayImportDescr;
1068+
1069+
if (pDelayImportDescr >= ReCa<IMAGE_DELAYLOAD_DESCRIPTOR *>(pBase + pDelayImportDir->VirtualAddress + pDelayImportDir->Size))
1070+
{
1071+
break;
1072+
}
1073+
1074+
continue;
1075+
}
1076+
10551077
ErrorBreak = true;
10561078
break;
10571079
}
@@ -1217,9 +1239,9 @@ DWORD __declspec(code_seg(".mmap_sec$1")) __stdcall ManualMapping_Shell(MANUAL_M
12171239
bool partial = true;
12181240

12191241
#ifdef _WIN64
1220-
if (veh_shell_fixed)
1242+
if (veh_shell_fixed) //really needed for x64?
12211243
{
1222-
//register VEH shell to fill handler list
1244+
//register VEH shell to fill SEH handler list
12231245
pData->hVEH = f->RtlAddVectoredExceptionHandler(0, ReCa<PVECTORED_EXCEPTION_HANDLER>(pVEHShell));
12241246
}
12251247
#endif

‎GH Injector Library/NT Defs.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
#define STATUS_UNSUCCESSFUL 0xC0000001
3131
#define STATUS_NOT_IMPLEMENTED 0xC0000002
3232
#define STATUS_INFO_LENGTH_MISMATCH 0xC0000004
33+
#define STATUS_APISET_NOT_HOSTED 0xC0000481
3334

3435
#define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020
3536

‎GH Injector Library/NT Funcs.h

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,7 @@ using f_LdrpLoadDll = NTSTATUS (__fastcall *)
160160
LDR_DATA_TABLE_ENTRY ** ldr_out
161161
);
162162

163-
using f_LdrpLoadDllInternal = NTSTATUS (__fastcall *)
163+
using f_LdrpLoadDllInternal = VOID (__fastcall *)
164164
(
165165
UNICODE_STRING * dll_path,
166166
LDRP_PATH_SEARCH_CONTEXT * search_path,
@@ -169,10 +169,10 @@ using f_LdrpLoadDllInternal = NTSTATUS (__fastcall *)
169169
LDR_DATA_TABLE_ENTRY_WIN10 * Unknown1, //set to nullptr
170170
LDR_DATA_TABLE_ENTRY_WIN10 * Unknown2, //set to nullptr
171171
LDR_DATA_TABLE_ENTRY_WIN10 ** ldr_out,
172-
ULONG_PTR * Unknown3 //set to pointer to nullptr
172+
NTSTATUS * ntRet
173173
);
174174

175-
using f_LdrpLoadDllInternal_WIN11 = NTSTATUS (__fastcall *)
175+
using f_LdrpLoadDllInternal_WIN11 = VOID (__fastcall *)
176176
(
177177
UNICODE_STRING * dll_path,
178178
LDRP_PATH_SEARCH_CONTEXT * search_path,
@@ -181,7 +181,7 @@ using f_LdrpLoadDllInternal_WIN11 = NTSTATUS (__fastcall *)
181181
LDR_DATA_TABLE_ENTRY_WIN11 * Unknown1, //set to nullptr
182182
LDR_DATA_TABLE_ENTRY_WIN11 * Unknown2, //set to nullptr
183183
LDR_DATA_TABLE_ENTRY_WIN11 ** ldr_out,
184-
ULONG_PTR * Unknown3, //set to pointer to nullptr
184+
NTSTATUS * ntRet,
185185
ULONG Unknown4 //set to 0
186186
);
187187

@@ -476,9 +476,9 @@ using f_LdrpTlsList = LIST_ENTRY *;
476476
using f_RtlpUnhandledExceptionFilter = ULONG_PTR *; //encrypted with RtlEncodePointer, points to kernel32.UnhandledExceptionFilter
477477

478478
//kernel32.dll:
479-
using f_UnhandledExceptionFilter = ULONG_PTR *; //PTOP_LEVEL_EXCEPTION_FILTER
479+
using f_UnhandledExceptionFilter = ULONG_PTR *; //PTOP_LEVEL_EXCEPTION_FILTER
480480
using f_SingleHandler = ULONG_PTR *; //encrypted with RtlEncodePointer, points to kernel32.DefaultHandler
481-
using f_DefaultHandler = ULONG_PTR *; //PTOP_LEVEL_EXCEPTION_FILTER
481+
using f_DefaultHandler = ULONG_PTR *; //PTOP_LEVEL_EXCEPTION_FILTER
482482

483483
#pragma endregion
484484

‎GH Injector Library/NtCreateThreadEx.cpp

Lines changed: 56 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,8 @@ DWORD SR_NtCreateThreadEx(HANDLE hTargetProc, f_Routine pRoutine, void * pArg, D
5555

5656
if (Flags & INJ_CTF_SKIP_THREAD_ATTACH)
5757
{
58-
ntFlags |= THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH;
58+
ntFlags |= THREAD_CREATE_FLAGS_CREATE_SUSPENDED;
59+
//ntFlags |= THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH;
5960
}
6061

6162
if (Flags & INJ_CTF_FAKE_TEB_CLIENT_ID)
@@ -297,7 +298,61 @@ DWORD SR_NtCreateThreadEx(HANDLE hTargetProc, f_Routine pRoutine, void * pArg, D
297298
}
298299

299300
LOG(2, "Thread redirected\n");
301+
}
302+
303+
if (Flags & INJ_CTF_SKIP_THREAD_ATTACH)
304+
{
305+
THREAD_BASIC_INFORMATION tbi{ 0 };
306+
ntRet = NATIVE::NtQueryInformationThread(hThread, THREADINFOCLASS::ThreadBasicInformation, &tbi, sizeof(tbi), nullptr);
307+
if (NT_FAIL(ntRet) || !tbi.TebBaseAddress)
308+
{
309+
INIT_ERROR_DATA(error_data, ntRet);
310+
311+
LOG(2, "NtQueryInformationThread failed: %08X\n", error_data.AdvErrorCode);
312+
313+
TerminateThread(hThread, 0);
314+
CloseHandle(hThread);
300315

316+
VirtualFreeEx(hTargetProc, pMem, 0, MEM_RELEASE);
317+
318+
return SR_NTCTE_ERR_NTQIT_FAIL;
319+
}
320+
321+
WORD same_teb_flags = 0;
322+
if (!ReadProcessMemory(hTargetProc, ReCa<BYTE *>(tbi.TebBaseAddress) + TEB_SameTebFlags, &same_teb_flags, sizeof(same_teb_flags), nullptr))
323+
{
324+
INIT_ERROR_DATA(error_data, GetLastError());
325+
326+
LOG(2, "ReadProcessMemory failed: %08X\n", error_data.AdvErrorCode);
327+
328+
TerminateThread(hThread, 0);
329+
CloseHandle(hThread);
330+
331+
VirtualFreeEx(hTargetProc, pMem, 0, MEM_RELEASE);
332+
333+
return SR_NTCTE_ERR_RPM_FAIL;
334+
}
335+
336+
same_teb_flags |= TEB_SAMETEB_FLAGS_SkipAttach;
337+
if (!WriteProcessMemory(hTargetProc, ReCa<BYTE *>(tbi.TebBaseAddress) + TEB_SameTebFlags, &same_teb_flags, sizeof(same_teb_flags), nullptr))
338+
{
339+
INIT_ERROR_DATA(error_data, GetLastError());
340+
341+
LOG(2, "WriteProcessMemory failed: %08X\n", error_data.AdvErrorCode);
342+
343+
TerminateThread(hThread, 0);
344+
CloseHandle(hThread);
345+
346+
VirtualFreeEx(hTargetProc, pMem, 0, MEM_RELEASE);
347+
348+
return SR_NTCTE_ERR_WPM_FAIL;
349+
}
350+
351+
LOG(2, "Fixed TEB flags\n");
352+
}
353+
354+
if (ntFlags & THREAD_CREATE_FLAGS_CREATE_SUSPENDED)
355+
{
301356
if (ResumeThread(hThread) == (DWORD)-1)
302357
{
303358
INIT_ERROR_DATA(error_data, GetLastError());

‎GH Injector Library/Process Info.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,8 @@
1919

2020
#define TEB_WowTebOffset_64 0x180C //Win10+ only
2121

22-
#define TEB_SAMETEB_FLAGS_LoaderWorker 0x2000
22+
#define TEB_SAMETEB_FLAGS_SkipAttach 0x0008
23+
#define TEB_SAMETEB_FLAGS_LoaderWorker 0x2000
2324

2425
#ifdef _WIN64
2526
#define TEB_SameTebFlags TEB_SameTebFlags_64

‎GH Injector Library/Start Routine.h

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ ALIGN struct SR_REMOTE_DATA_VEH
5555
ALIGN f_LdrProtectMrdata pLdrProtectMrdata = nullptr;
5656
ALIGN LIST_ENTRY * pListHead = nullptr;
5757
ALIGN LIST_ENTRY * pFakeEntry = nullptr;
58+
ALIGN bool bRemoveVEHBit = false;
5859
};
5960

6061
#define PTR_64_ARR 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -63,8 +64,8 @@ ALIGN struct SR_REMOTE_DATA_VEH
6364
#define SR_REMOTE_DATA_BUFFER_64 PTR_64_ARR PTR_64_ARR PTR_64_ARR PTR_64_ARR PTR_64_ARR PTR_64_ARR
6465
#define SR_REMOTE_DATA_BUFFER_86 PTR_86_ARR PTR_86_ARR PTR_86_ARR PTR_86_ARR PTR_86_ARR PTR_86_ARR
6566

66-
#define SR_REMOTE_DATA_BUFFER_VEH_64 SR_REMOTE_DATA_BUFFER_64 PTR_64_ARR PTR_64_ARR PTR_64_ARR
67-
#define SR_REMOTE_DATA_BUFFER_VEH_86 SR_REMOTE_DATA_BUFFER_86 PTR_86_ARR PTR_86_ARR PTR_86_ARR
67+
#define SR_REMOTE_DATA_BUFFER_VEH_64 SR_REMOTE_DATA_BUFFER_64 PTR_64_ARR PTR_64_ARR PTR_64_ARR PTR_64_ARR
68+
#define SR_REMOTE_DATA_BUFFER_VEH_86 SR_REMOTE_DATA_BUFFER_86 PTR_86_ARR PTR_86_ARR PTR_86_ARR PTR_86_ARR
6869

6970
#ifdef _WIN64
7071
#define SR_REMOTE_DATA_BUFFER SR_REMOTE_DATA_BUFFER_64
@@ -125,6 +126,7 @@ ALIGN_86 struct SR_REMOTE_DATA_VEH_WOW64
125126
ALIGN_86 DWORD pLdrProtectMrdata = 0;
126127
ALIGN_86 DWORD pListHead = 0;
127128
ALIGN_86 DWORD pFakeEntry = 0;
129+
ALIGN_86 DWORD bRemoveVEHBit = 0;
128130
};
129131

130132
#define SR_REMOTE_DATA_BUFFER_WOW64 SR_REMOTE_DATA_BUFFER_86

‎GH Injector Library/Tools.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@
66

77
#define GH_INJ_MOD_NAME64W L"GH Injector - x64.dll"
88
#define GH_INJ_MOD_NAME86W L"GH Injector - x86.dll"
9-
#define GH_INJ_VERSIONW L"4.5"
9+
#define GH_INJ_VERSIONW L"4.6"
1010

1111
#define GH_INJ_MOD_NAME64A "GH Injector - x64.dll"
1212
#define GH_INJ_MOD_NAME86A "GH Injector - x86.dll"
13-
#define GH_INJ_VERSIONA "4.5"
13+
#define GH_INJ_VERSIONA "4.6"
1414

1515
#ifdef _WIN64
1616
#define GH_INJ_MOD_NAMEW GH_INJ_MOD_NAME64W

0 commit comments

Comments
 (0)