void ThreadPicker::OnAttachProfilerAll(wxCommandEvent& event)
{
if ( AttachToProcess(true) )
{
EndModal(ATTACH);
}
}
void ThreadPicker::OnAttachProfiler()
{
if ( AttachToProcess(false) )
{
EndModal(ATTACH);
}
}
/// <summary>
/// Load selected image and do some validation
/// </summary>
DWORD MainDlg::SetActiveProcess( bool createNew, const wchar_t* path, DWORD pid /*= 0xFFFFFFFF*/ )
{
HWND hCombo = GetDlgItem( _hMainDlg, IDC_COMBO_PROC );
if (createNew)
{
std::wstring procName = blackbone::Utils::StripPath( path ) + L" (New process)";
// Update process list
auto idx = ComboBox_AddString( hCombo, procName.c_str() );
ComboBox_SetItemData( hCombo, idx, -1 );
ComboBox_SetCurSel( hCombo, idx );
// Enable command line options field
EnableWindow( GetDlgItem( _hMainDlg, IDC_CMDLINE ), TRUE );
_newProcess = true;
_procPath = path;
}
else if (pid != 0xFFFFFFFF && AttachToProcess( pid ) == ERROR_SUCCESS)
{
FillThreads();
_newProcess = false;
if (path != nullptr)
{
std::wstring procName = std::wstring( path ) + L" (" + std::to_wstring( _proc.pid() ) + L")";
_procPath = path;
auto idx = ComboBox_AddString( hCombo, procName.c_str() );
ComboBox_SetItemData( hCombo, idx, -1 );
ComboBox_SetCurSel( hCombo, idx );
}
else
_procPath = _proc.modules().GetMainModule()->name;
// Disable command line option field
EnableWindow( GetDlgItem( _hMainDlg, IDC_CMDLINE ), FALSE );
}
return ERROR_SUCCESS;
}
/// <summary>
/// Injection routine
/// </summary>
/// <param name="path">Image path</param>
/// <param name="init">Initizliation routine/param>
/// <param name="arg">Initizliation routine argument</param>
/// <returns>Error code</returns>
DWORD MainDlg::InjectWorker( std::wstring path, std::string init, std::wstring arg )
{
blackbone::Thread *pThread = nullptr;
const blackbone::ModuleData* mod = nullptr;
PROCESS_INFORMATION pi = { 0 };
wchar_t cmdline[256] = { 0 };
HWND hCombo = GetDlgItem( _hMainDlg, IDC_THREADS );
DWORD thdId = (DWORD)ComboBox_GetItemData( hCombo, ComboBox_GetCurSel( hCombo ) );
bool bManual = ComboBox_GetCurSel( GetDlgItem( _hMainDlg, IDC_OP_TYPE ) ) == 1;
GetDlgItemTextW( _hMainDlg, IDC_CMDLINE, cmdline, ARRAYSIZE( cmdline ) );
// Check export
if (ValidateInit( init.c_str() ) != STATUS_SUCCESS)
return ERROR_CANCELLED;
// Create new process
if (_newProcess)
{
STARTUPINFOW si = { 0 };
si.cb = sizeof(si);
if (!CreateProcessW( _procPath.c_str(), cmdline, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi ))
{
MessageBoxW( _hMainDlg, L"Failed to create new process", L"Error", MB_ICONERROR );
return GetLastError();
}
thdId = 0;
// Wait for process to initialize loader
Sleep( 1 );
AttachToProcess( pi.dwProcessId );
}
// Final sanity check
if (ValidateImage( path.c_str(), init.c_str() ) != ERROR_SUCCESS)
{
if (_newProcess)
TerminateProcess( pi.hProcess, 0 );
return ERROR_CANCELLED;
}
// Normal inject
if (bManual == false)
{
if (_imagePE.IsPureManaged())
{
DWORD code = 0;
if (!_proc.modules().InjectPureIL( blackbone::ImageNET::GetImageRuntimeVer( path.c_str() ),
path, blackbone::Utils::AnsiToWstring( init ), arg, code ))
{
if (_newProcess)
TerminateProcess( pi.hProcess, 0 );
MessageBoxW( _hMainDlg, L"Failed to inject image", L"Error", MB_ICONERROR );
return ERROR_FUNCTION_FAILED;
}
}
else if (!_newProcess && thdId != 0)
{
pThread = _proc.threads().get( thdId );
if (pThread == nullptr)
{
if (_newProcess)
TerminateProcess( pi.hProcess, 0 );
MessageBoxW( _hMainDlg, L"Selected thread does not exist", L"Error", MB_ICONERROR );
return ERROR_NOT_FOUND;
}
// Load
auto pLoadLib = _proc.modules().GetExport( _proc.modules().GetModule( L"kernel32.dll" ), "LoadLibraryW" ).procAddress;
blackbone::RemoteFunction<decltype(&LoadLibraryW)> pfn( _proc, (decltype(&LoadLibraryW))pLoadLib, path.c_str() );
decltype(pfn)::ReturnType junk = 0;
pfn.Call( junk, pThread );
mod = _proc.modules().GetModule( path );
}
else
mod = _proc.modules().Inject( path );
}
// Manual map
else
{
thdId = 0;
int flags = blackbone::RebaseProcess | blackbone::NoDelayLoad | MmapFlags();
mod = _proc.mmap().MapImage( path, flags );
}
if (mod == 0 && !_imagePE.IsPureManaged())
{
if (_newProcess)
TerminateProcess( pi.hProcess, 0 );
MessageBoxW( _hMainDlg, L"Failed to inject image", L"Error", MB_ICONERROR );
return ERROR_NOT_FOUND;
}
// Call init for native image
if (!init.empty() && !_imagePE.IsPureManaged())
{
auto fnPtr = _proc.modules().GetExport( mod, init.c_str() ).procAddress;
if (thdId == 0)
{
auto argMem = _proc.memory().Allocate( 0x1000, PAGE_READWRITE );
argMem.Write( 0, arg.length() * sizeof(wchar_t)+2, arg.c_str() );
_proc.remote().ExecDirect( fnPtr, argMem.ptr() );
}
else
{
pThread = _proc.threads().get( thdId );
if (pThread == nullptr)
{
if (_newProcess)
TerminateProcess( pi.hProcess, 0 );
MessageBoxW( _hMainDlg, L"Selected thread does not exist", L"Error", MB_ICONERROR );
return ERROR_NOT_FOUND;
}
blackbone::RemoteFunction<int( _stdcall* )(const wchar_t*)> pfn( _proc, (int( _stdcall* )(const wchar_t*))fnPtr, arg.c_str() );
int junk = 0;
pfn.Call( junk, pThread );
}
}
// Unlink module if required
if (!_imagePE.IsPureManaged() && !bManual && Button_GetCheck( GetDlgItem( _hMainDlg, IDC_UNLINK ) ))
if (_proc.modules().Unlink( mod ) == false)
MessageBoxW( _hMainDlg, L"Failed to unlink module", L"Error", MB_ICONERROR );
// MessageBoxW( _hMainDlg, L"Successfully injected", L"Info", MB_ICONINFORMATION );
//ResumeThread( pi.hThread );
return ERROR_SUCCESS;
}
