forked from mq1n/DLLThreadInjectionDetector
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathDLLCheck.cpp
More file actions
34 lines (26 loc) · 1.28 KB
/
Copy pathDLLCheck.cpp
File metadata and controls
34 lines (26 loc) · 1.28 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
#include "main.h"
#include "Utils.h"
typedef ULONG(NTAPI* RtlGetFullPathName_U)(PCWSTR FileName, ULONG Size, PWSTR Buffer, PWSTR* ShortName);
static RtlGetFullPathName_U RtlGetFullPathName_U_ = nullptr;
ULONG NTAPI RtlGetFullPathName_U_t(PCWSTR FileName, ULONG Size, PWSTR Buffer, PWSTR* ShortName)
{
printf("RtlGetFullPathName_U_t -> %ls - %u\n", FileName, Size);
auto pModuleBase = CUtils::GetModuleAddressFromName(FileName);
if (pModuleBase)
printf("Injected dll detected! Base: %p\n", pModuleBase);
return RtlGetFullPathName_U_(FileName, Size, Buffer, ShortName);
}
void InitializeDLLCheck()
{
auto hNtdll = LoadLibraryA("ntdll.dll");
printf("hNtdll: %p\n", hNtdll);
assert(hNtdll);
auto RtlGetFullPathName_U_o = reinterpret_cast<RtlGetFullPathName_U>(GetProcAddress(hNtdll, "RtlGetFullPathName_U"));
printf("RtlGetFullPathName_U: %p\n", RtlGetFullPathName_U_o);
assert(RtlGetFullPathName_U_o);
RtlGetFullPathName_U_ = reinterpret_cast<RtlGetFullPathName_U>(CUtils::DetourFunc(reinterpret_cast<PBYTE>(RtlGetFullPathName_U_o), reinterpret_cast<PBYTE>(RtlGetFullPathName_U_t), 5));
printf("RtlGetFullPathName_U(detour): %p\n", RtlGetFullPathName_U_);
DWORD dwOld = 0;
auto bProtectRet = VirtualProtect(RtlGetFullPathName_U_, 5, PAGE_EXECUTE_READWRITE, &dwOld);
assert(bProtectRet);
}