C++ (Cpp) GetPathFromLinkFile示例

示例#1

文件： Loader.cpp 项目： AbyssSquall/FuckGalEngine

ForceInline VOID main2(Int argc, WChar **argv)
{
    NTSTATUS            Status;
    WCHAR               *pExePath, szDllPath[MAX_NTPATH], FullExePath[MAX_NTPATH];
    STARTUPINFOW        si;
    PROCESS_INFORMATION pi;

#if 0
    PVOID buf;
//    CNtFileDisk file;

    UNICODE_STRING str;

//    file.Open((FIELD_BASE(FindLdrModuleByName(NULL)->InLoadOrderModuleList.Flink, LDR_MODULE, InLoadOrderModuleList))->FullDllName.Buffer);
//    buf = AllocateMemory(file.GetSize32());
//    file.Read(buf);
//    file.Close();

    RTL_CONST_STRING(str, L"OllyDbg.exe");
    LoadDllFromMemory(GetNtdllHandle(), -1, &str, NULL, LMD_MAPPED_DLL);

    PrintConsoleW(
        L"%s handle = %08X\n"
        L"%s.NtSetEvent = %08X\n",
        str.Buffer, GetModuleHandleW(str.Buffer),
        str.Buffer, Nt_GetProcAddress(GetModuleHandleW(str.Buffer), "NtSetEvent")
    );

    getch();

    FreeMemory(buf);

    return;
#endif

#if 1
    if (argc == 1)
        return;

    RtlAdjustPrivilege(SE_DEBUG_PRIVILEGE, TRUE, FALSE, (PBOOLEAN)&Status);
    while (--argc)
    {
        pExePath = findextw(*++argv);
        if (CHAR_UPPER4W(*(PULONG64)pExePath) == CHAR_UPPER4W(TAG4W('.LNK')))
        {
            if (FAILED(GetPathFromLinkFile(*argv, FullExePath, countof(FullExePath))))
            {
                pExePath = *argv;
            }
            else
            {
                pExePath = FullExePath;
            }
        }
        else
        {
            pExePath = *argv;
        }

        RtlGetFullPathName_U(pExePath, sizeof(szDllPath), szDllPath, NULL);
#if 0
        Status = FakeCreateProcess(szDllPath, NULL);
        if (!NT_SUCCESS(Status))
#else
        rmnamew(szDllPath);
        ZeroMemory(&si, sizeof(si));
        si.cb = sizeof(si);
        Status = CreateProcessInternalW(
                    NULL,
                    pExePath,
                    NULL,
                    NULL,
                    NULL,
                    FALSE,
                    CREATE_SUSPENDED,
                    NULL,
                    *szDllPath == 0 ? NULL : szDllPath,
                    &si,
                    &pi,
                    NULL);

        if (!Status)
#endif
        {
            PrintConsoleW(L"%s: CreateProcess() failed\n", pExePath);
            continue;
        }

        ULONG Length;
        UNICODE_STRING DllFullPath;

        Length = Nt_GetExeDirectory(szDllPath, countof(szDllPath));
        CopyStruct(szDllPath + Length, L"XP3Viewer.dll", sizeof(L"XP3Viewer.dll"));
        DllFullPath.Buffer = szDllPath;
        DllFullPath.Length = (USHORT)(Length + CONST_STRLEN(L"XP3Viewer.dll"));
        DllFullPath.Length *= sizeof(WCHAR);
        DllFullPath.MaximumLength = DllFullPath.Length;

        Status = InjectDllToRemoteProcess(pi.hProcess, pi.hThread, &DllFullPath, FALSE);

        if (!NT_SUCCESS(Status))
        {
//            PrintError(GetLastError());
            NtTerminateProcess(pi.hProcess, 0);
        }

        NtClose(pi.hProcess);
        NtClose(pi.hThread);
    }

#endif
}

示例#2

文件： MBExt.cpp 项目： amos402/Arianrhod

ForceInline Void main2(Int argc, WChar **argv)
{
    NTSTATUS            Status;
    WCHAR               *pExePath, szDllPath[MAX_NTPATH], FullExePath[MAX_NTPATH];
    STARTUPINFOW        si;
    PROCESS_INFORMATION pi;

    if (argc == 1)
        return;

    RtlAdjustPrivilege(SE_DEBUG_PRIVILEGE, TRUE, FALSE, (PBOOLEAN)&Status);
    while (--argc)
    {
        pExePath = findextw(*++argv);
        if (CHAR_UPPER4W(*(PULONG64)pExePath) == CHAR_UPPER4W(TAG4W('.LNK')))
        {
            if (FAILED(GetPathFromLinkFile(*argv, FullExePath, countof(FullExePath))))
            {
                pExePath = *argv;
            }
            else
            {
                pExePath = FullExePath;
            }
        }
        else
        {
            pExePath = *argv;
        }

        RtlGetFullPathName_U(pExePath, sizeof(szDllPath), szDllPath, NULL);
        rmnamew(szDllPath);
        ZeroMemory(&si, sizeof(si));
        si.cb = sizeof(si);
        Status = CreateProcessInternalW(
                    NULL,
                    pExePath,
                    NULL,
                    NULL,
                    NULL,
                    FALSE,
                    CREATE_SUSPENDED,
                    NULL,
                    *szDllPath == 0 ? NULL : szDllPath,
                    &si,
                    &pi,
                    NULL);
        if (!Status)
        {
            PrintConsoleW(L"CreateProcess() failed.\n");
            continue;
        }

        Status = InjectSelfToRemoteProcess(pi.hProcess, pi.hThread);

        if (!NT_SUCCESS(Status))
        {
//            PrintError(GetLastError());
            NtTerminateProcess(pi.hProcess, 0);
        }

        NtClose(pi.hProcess);
        NtClose(pi.hThread);
    }
}