More error checking, fixed readme (updated this one by accident lmao), proper unicode implementation of setwindowhookex injection, GH Injector SM is also a unicode project now

Author: Broihon

GH Injector Library/Error.h

@@ -282,6 +282,7 @@
 #define HOOK_SCAN_ERR_CREATE_PROCESS_FAILED			0x50000008	//CreateProcessW		:	win32 error
 #define HOOK_SCAN_ERR_WAIT_FAILED					0x50000009	//WaitForSingleObject	:	win32 error
 #define HOOK_SCAN_ERR_WAIT_TIMEOUT					0x5000000A	//WaitForSingleObject	:	waiting timed out
+#define HOOK_SCAN_ERR_BUFFER_TOO_SMALL				0x5000000B	//internal error		:	the buffer passed to ValidateInjectionFunctions is too small
 
 
 

GH Injector Library/Handle Hijacking.cpp

@@ -11,7 +11,7 @@ NTSTATUS EnumHandles(char * pBuffer, ULONG Size, ULONG * SizeOut, UINT & Count)
 
 	if (NT_FAIL(ntRet))
 	{
-		LOG("Failed to grab handle list\n");
+		LOG("Failed to grab handle list: %08X\n", ntRet);
 
 		return ntRet;
 	}

GH Injector Library/Hook Scanner.cpp

@@ -326,6 +326,8 @@ bool __stdcall ValidateInjectionFunctions(DWORD dwTargetProcessId, DWORD & Error
 	{
 		LOG("Provided buffer too small\n");
 
+		ErrorCode = HOOK_SCAN_ERR_BUFFER_TOO_SMALL;
+
 		return false;
 	}
 
@@ -381,10 +383,10 @@ bool __stdcall RestoreInjectionFunctions(DWORD dwTargetProcessId, DWORD & ErrorC
 		*CountOut = SuccessCount;
 	}
 
-	LOG("%d of %d hook(s) restored\n", SuccessCount, Count);
-
 	CloseHandle(hTargetProc);
 
+	LOG("%d of %d hook(s) restored\n", SuccessCount, Count);
+
 	return true;
 }
 

GH Injector Library/Injection Generic WOW64.cpp

@@ -109,7 +109,7 @@ DWORD InjectDLL_WOW64(const wchar_t * szDllFile, HANDLE hTargetProc, INJECTION_M
 
 	LOG("Shell written to memory\n");
 
-	LOG("Enterting StartRoutine_WOW64\n");
+	LOG("Entering StartRoutine_WOW64\n");
 
 	DWORD remote_ret = 0;
 	DWORD dwRet = StartRoutine_WOW64(hTargetProc, (f_Routine_WOW64)(MDWD(pShell)), MDWD(pArg), Method, (Flags & INJ_THREAD_CREATE_CLOAKED) != 0, remote_ret, Timeout, error_data);

GH Injector Library/Injection Generic.cpp

@@ -96,7 +96,7 @@ DWORD InjectDLL(const wchar_t * szDllFile, HANDLE hTargetProc, INJECTION_MODE Mo
 
 	LOG("Shell written to memory\n");
 
-	LOG("Enterting StartRoutine\n");
+	LOG("Entering StartRoutine\n");
 
 	DWORD remote_ret = 0;
 	DWORD dwRet = StartRoutine(hTargetProc, ReCa<f_Routine>(pShell), pArg, Method, (Flags & INJ_THREAD_CREATE_CLOAKED) != 0, remote_ret, Timeout, error_data);

GH Injector Library/Injection.cpp

@@ -488,15 +488,19 @@ DWORD HijackHandle(INJECTIONDATAW * pData, ERROR_DATA & error_data)
 			LastErrCode = INJ_ERR_CANT_OPEN_PROCESS;
 			INIT_ERROR_DATA(error_data, GetLastError());
 
+			LOG("Failed to attach to process %06X\n", i.OwnerPID);
+
 			continue;
 		}
+
+		LOG("Attached to process %06X\n", i.OwnerPID);
 
 		if (!IsElevatedProcess(hHijackProc) || !IsNativeProcess(hHijackProc))
 		{
 			LastErrCode = INJ_ERR_HIJACK_NO_NATIVE_HANDLE;
 			INIT_ERROR_DATA(error_data, INJ_ERR_ADVANCED_NOT_DEFINED);
 
-			LOG("Can't open process %06X\n", i.OwnerPID);
+			LOG("Process isn't elevated or native\n");
 
 			CloseHandle(hHijackProc);
 
@@ -518,7 +522,7 @@ DWORD HijackHandle(INJECTIONDATAW * pData, ERROR_DATA & error_data)
 			continue;
 		}
 
-		LOG("Injection module loaded\n");
+		LOG("Injection module loaded into hijack process\n");
 
 		HINSTANCE hInjectionModuleEx = hijack_data.hDllOut;
 		f_Routine pRemoteInjectW = ReCa<f_Routine>(ReCa<UINT_PTR>(InjectW) - ReCa<UINT_PTR>(g_hInjMod) + ReCa<UINT_PTR>(hInjectionModuleEx));
@@ -554,6 +558,8 @@ DWORD HijackHandle(INJECTIONDATAW * pData, ERROR_DATA & error_data)
 			continue;
 		}
 
+		LOG("Handle value: %04X\n", i.hValue);
+
 		pData->hHandleValue = 0;
 
 		LOG("Injection data written to hijack process\n");

GH Injector Library/Manual Mapping WOW64.cpp

@@ -120,7 +120,7 @@ DWORD MMAP_WOW64::ManualMap_WOW64(const wchar_t * szDllFile, HANDLE hTargetProc,
 
 	LOG("Shell written to memory\n");
 
-	LOG("Enterting StartRoutine_WOW64\n");
+	LOG("Entering StartRoutine_WOW64\n");
 
 	DWORD remote_ret = 0;
 	DWORD dwRet = StartRoutine_WOW64(hTargetProc, (f_Routine_WOW64)(MDWD(pShell)), MDWD(pArg), Method, (Flags & INJ_THREAD_CREATE_CLOAKED) != 0, remote_ret, Timeout, error_data);

GH Injector Library/Manual Mapping.cpp

@@ -128,7 +128,7 @@ DWORD MMAP_NATIVE::ManualMap(const wchar_t * szDllFile, HANDLE hTargetProc, LAUN
 
 	LOG("Shell written to memory\n");
 
-	LOG("Enterting StartRoutine\n");
+	LOG("Entering StartRoutine\n");
 
 	DWORD remote_ret = 0;
 	DWORD dwRet = StartRoutine(hTargetProc, ReCa<f_Routine>(pShell), pArg, Method, (Flags & INJ_THREAD_CREATE_CLOAKED) != 0, remote_ret, Timeout, error_data);

GH Injector Library/SetWindowsHookEx WOW64.cpp

@@ -98,7 +98,7 @@ DWORD SR_SetWindowsHookEx_WOW64(HANDLE hTargetProc, f_Routine_WOW64 pRoutine, DW
 	std::wstring smPath = g_RootPathW;
 	smPath += SM_EXE_FILENAME86;
 
-	wchar_t cmdLine[] = L"\"" SM_EXE_FILENAME86 "\"";
+	wchar_t cmdLine[] = L"\"" SM_EXE_FILENAME86 "\" 0";
 
 	PROCESS_INFORMATION pi{ 0 };
 	STARTUPINFOW		si{ 0 };
@@ -156,6 +156,8 @@ DWORD SR_SetWindowsHookEx_WOW64(HANDLE hTargetProc, f_Routine_WOW64 pRoutine, DW
 
 		LOG("Token prepared\n");
 
+		LOG("Launching %ls:\n %ls\n", SM_EXE_FILENAME86, cmdLine);
+
 		if (!CreateProcessAsUserW(hAdminToken, smPath.c_str(), cmdLine, nullptr, nullptr, FALSE, CREATE_NO_WINDOW, nullptr, nullptr, &si, &pi))
 		{
 			INIT_ERROR_DATA(error_data, GetLastError());
@@ -178,6 +180,8 @@ DWORD SR_SetWindowsHookEx_WOW64(HANDLE hTargetProc, f_Routine_WOW64 pRoutine, DW
 	}
 	else
 	{
+		LOG("Launching %ls:\n %ls\n", SM_EXE_FILENAME86, cmdLine);
+
 		if (!CreateProcessW(smPath.c_str(), cmdLine, nullptr, nullptr, FALSE, CREATE_NO_WINDOW, nullptr, nullptr, &si, &pi))
 		{
 			INIT_ERROR_DATA(error_data, GetLastError());

GH Injector Library/SetWindowsHookEx.cpp

@@ -138,7 +138,7 @@ DWORD SR_SetWindowsHookEx(HANDLE hTargetProc, f_Routine pRoutine, void * pArg, U
 	std::wstring smPath = g_RootPathW;
 	smPath += SM_EXE_FILENAME;
 
-	wchar_t cmdLine[] = L"\"" SM_EXE_FILENAME "\"";
+	wchar_t cmdLine[] = L"\"" SM_EXE_FILENAME "\" 0";
 
 	PROCESS_INFORMATION pi{ 0 };
 	STARTUPINFOW		si{ 0 };
@@ -199,6 +199,8 @@ DWORD SR_SetWindowsHookEx(HANDLE hTargetProc, f_Routine pRoutine, void * pArg, U
 
 		LOG("Token prepared\n");
 
+		LOG("Launching %ls:\n %ls\n", SM_EXE_FILENAME, cmdLine);
+
 		if (!CreateProcessAsUserW(hAdminToken, smPath.c_str(), cmdLine, nullptr, nullptr, FALSE, CREATE_NO_WINDOW, nullptr, nullptr, &si, &pi))
 		{
 			INIT_ERROR_DATA(error_data, GetLastError());
@@ -221,7 +223,9 @@ DWORD SR_SetWindowsHookEx(HANDLE hTargetProc, f_Routine pRoutine, void * pArg, U
 		CloseHandle(hUserToken);
 	}
 	else
-	{		
+	{
+		LOG("Launching %ls:\n %ls\n", SM_EXE_FILENAME, cmdLine);
+
 		if (!CreateProcessW(smPath.c_str(), cmdLine, nullptr, nullptr, FALSE, CREATE_NO_WINDOW, nullptr, nullptr, &si, &pi))
 		{
 			INIT_ERROR_DATA(error_data, GetLastError());

GH Injector Library/Tools.cpp

@@ -143,12 +143,9 @@ bool IsElevatedProcess(HANDLE hTargetProc)
 
 void ErrorLog(ERROR_INFO * info)
 {
-	wchar_t ErrorLogName[] = L"GH_Inj_Log.txt";
+	auto FullPath = g_RootPathW;
+	FullPath += L"GH_Inj_Log.txt";
 
-	wchar_t FullPath[MAX_PATH]{ 0 };
-	StringCbCopyW(FullPath, sizeof(FullPath), g_RootPathW.c_str());
-	StringCbCatW(FullPath, sizeof(FullPath), ErrorLogName);
-		
 	time_t time_raw	= time(nullptr);
 	tm time_info;
 	localtime_s(&time_info, &time_raw);
@@ -189,7 +186,7 @@ void ErrorLog(ERROR_INFO * info)
 	std::wofstream error_log(FullPath, std::ios_base::out | std::ios_base::app);
 	if (!error_log.good())
 	{
-		LOG("Failed to open/create error log file:\n%ls\n", FullPath);
+		LOG("Failed to open/create error log file:\n%ls\n", FullPath.c_str());
 
 		return;
 	}
@@ -226,6 +223,9 @@ std::wstring InjectionModeToString(INJECTION_MODE mode)
 		case INJECTION_MODE::IM_LdrpLoadDll:
 			return std::wstring(L"LdrpLoadDll");
 
+		case INJECTION_MODE::IM_LdrpLoadDllInternal:
+			return std::wstring(L"LdrpLoadDllInternal");
+
 		case INJECTION_MODE::IM_ManualMap:
 			return std::wstring(L"ManualMap");
 

GH Injector Library/main.cpp

@@ -86,7 +86,9 @@ BOOL WINAPI DllMain(HINSTANCE hDll, DWORD dwReason, void * pReserved)
 		if (sym_ntdll_native_ret.wait_for(std::chrono::milliseconds(0)) != std::future_status::ready)
 		{
 			LOG("Attempting to interrupt native ntdll.pdb donwload thread\n");
+
 			sym_ntdll_native.Interrupt();
+
 			if (sym_ntdll_native_ret.wait_for(std::chrono::milliseconds(100)) != std::future_status::ready)
 			{
 				LOG("Native ntdll pdb download thread didn't exit properly.\n");
@@ -97,7 +99,9 @@ BOOL WINAPI DllMain(HINSTANCE hDll, DWORD dwReason, void * pReserved)
 		if (sym_ntdll_wow64_ret.wait_for(std::chrono::milliseconds(0)) != std::future_status::ready)
 		{
 			LOG("Attempting to interrupt wow64 ntdll.pdb donwload thread\n");
+
 			sym_ntdll_wow64.Interrupt();
+
 			if (sym_ntdll_wow64_ret.wait_for(std::chrono::milliseconds(100)) != std::future_status::ready)
 			{
 				LOG("Wow64 ntdll pdb download thread didn't exit properly.\n");

GH Injector SM/GH Injector SM/main.cpp

@@ -2,7 +2,9 @@
 
 #include "main.h"
 
-int main(int argc, char * argv[])
+#pragma comment(linker, "/SUBSYSTEM:WINDOWS /ENTRY:wmainCRTStartup")
+
+int wmain(int argc, wchar_t * argv[])
 {
 	if (argc < 2)
 	{
@@ -16,10 +18,10 @@ int main(int argc, char * argv[])
 #ifndef _WIN64
 	else if (argv[1][0] == '1')
 	{
-		HANDLE hEventStart = reinterpret_cast<HANDLE>(strtol(argv[2], nullptr, 0x10));
+		HANDLE hEventStart = reinterpret_cast<HANDLE>(wcstol(argv[2], nullptr, 0x10));
 		SetEvent(hEventStart);
 
-		HANDLE hEventEnd = reinterpret_cast<HANDLE>(strtol(argv[3], nullptr, 0x10));
+		HANDLE hEventEnd = reinterpret_cast<HANDLE>(wcstol(argv[3], nullptr, 0x10));
 		WaitForSingleObject(hEventEnd, INFINITE);
 
 		CloseHandle(hEventStart);

README.md

@@ -31,20 +31,14 @@ Session seperation can be bypassed with all methods.
 - TLS initialization
 - Security cookie initalization
 
-### Additional features
+### Additional features:
+
 - Various cloaking options
 	- PEB unlinking
 	- PE header cloaking
 	- Thread cloaking
 - Handle hijacking
 - Hook scanning/restoring
-- Fancy process picker
-
-### Shortcut generation:
-
-Too lazy to reopen the injector everytime you want to inject the same dll? Generate a shortcut.
-Select the dll you want to inject in the list, configure the options you want and make sure the target process is running. Then click the "Generate Shortcut" button and a shortcut will be generated in the directory of the injector.
-Now you can just double click to perform the injection. The spawned console injector waits for the specified target process to launch.
 
 ----