load.c File Reference

#include <dttr_bootstrap.h>
#include <dttr_errors.h>
#include <dttr_loader.h>
#include <dttr_log.h>
#include <dttr_path.h>
#include <gen/asm.h>
#include <sds.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <windows.h>

Go to the source code of this file.

Functions
static void	log_win32_failure (const char *operation)
static bool	read_remote_bytes (HANDLE process, uintptr_t address, void *out, SIZE_T out_size, const char *name)
static bool	read_remote_image_base_from_thread_context (HANDLE process, const CONTEXT *thread_context, uintptr_t *out_image_base)
static bool	read_entry_point_rva_from_remote_image (HANDLE process, uintptr_t image_base, uintptr_t *out_entry_point_rva)
static bool	resolve_sidecar_dll_path (char *out_path, size_t out_path_size)
static bool	initialize_shellcode_payload (DTTR_LoaderShellcodePayload *out_payload, const char *dll_path, uintptr_t original_entry)
static bool	build_sidecar_shellcode (const DTTR_LoaderShellcodePayload *payload, uint8_t **out_buffer, uint32_t *out_buffer_size)
static bool	write_remote_payload (HANDLE process, const void *buffer, SIZE_T buffer_size, LPVOID *out_remote_buffer)
bool	DTTR_Loader_InjectSidecar (const PROCESS_INFORMATION *child_info)

Variables
static const char *const	SIDECAR_DLL_RELATIVE_PATH = "modules\\libdttr_sidecar.dll"
static const char	LOAD_LIBRARY_EX_NAME [] = "LoadLibraryExA"
static const char	EXIT_THREAD_NAME [] = "ExitThread"
static const char	GET_LAST_ERROR_NAME [] = "GetLastError"
static const uintptr_t	PEB_IMAGE_BASE_OFFSET = 0x8

Function Documentation

build_sidecar_shellcode()

bool build_sidecar_shellcode ( const DTTR_LoaderShellcodePayload * payload, uint8_t ** out_buffer, uint32_t * out_buffer_size )

static

Definition at line 203 of file load.c.

References DTTR_LOG_DEBUG, and DTTR_LOG_ERROR.

Referenced by DTTR_Loader_InjectSidecar().

DTTR_Loader_InjectSidecar()

bool DTTR_Loader_InjectSidecar

(

const PROCESS_INFORMATION *

child_info

)

Definition at line 291 of file load.c.

References build_sidecar_shellcode(), DTTR_LOG_DEBUG, DWORD, free, initialize_shellcode_payload(), log_win32_failure(), NULL, read_entry_point_rva_from_remote_image(), read_remote_image_base_from_thread_context(), resolve_sidecar_dll_path(), and write_remote_payload().

Referenced by dttr_launcher_main().

initialize_shellcode_payload()

bool initialize_shellcode_payload ( DTTR_LoaderShellcodePayload * out_payload, const char * dll_path, uintptr_t original_entry )

static

Definition at line 167 of file load.c.

References DTTR_LoaderShellcodePayload::dll_path, DTTR_LOG_ERROR, EXIT_THREAD_NAME, DTTR_LoaderShellcodePayload::exitthread_name, GET_LAST_ERROR_NAME, DTTR_LoaderShellcodePayload::getlasterror_name, DTTR_LoaderShellcodePayload::kernel32_name, LOAD_LIBRARY_EX_NAME, DTTR_LoaderShellcodePayload::loadlibraryex_name, and DTTR_LoaderShellcodePayload::original_entry.

Referenced by DTTR_Loader_InjectSidecar().

log_win32_failure()

void log_win32_failure ( const char * operation )

static

Definition at line 20 of file load.c.

References DTTR_LOG_ERROR, DWORD, and NULL.

Referenced by DTTR_Loader_InjectSidecar(), read_remote_bytes(), and write_remote_payload().

read_entry_point_rva_from_remote_image()

bool read_entry_point_rva_from_remote_image ( HANDLE process, uintptr_t image_base, uintptr_t * out_entry_point_rva )

static

Definition at line 102 of file load.c.

References DTTR_LOG_DEBUG, DTTR_LOG_ERROR, and read_remote_bytes().

Referenced by DTTR_Loader_InjectSidecar().

read_remote_bytes()

bool read_remote_bytes ( HANDLE process, uintptr_t address, void * out, SIZE_T out_size, const char * name )

static

Definition at line 51 of file load.c.

References DTTR_LOG_ERROR, and log_win32_failure().

Referenced by read_entry_point_rva_from_remote_image(), and read_remote_image_base_from_thread_context().

read_remote_image_base_from_thread_context()

bool read_remote_image_base_from_thread_context ( HANDLE process, const CONTEXT * thread_context, uintptr_t * out_image_base )

static

Definition at line 77 of file load.c.

References DTTR_LOG_DEBUG, PEB_IMAGE_BASE_OFFSET, and read_remote_bytes().

Referenced by DTTR_Loader_InjectSidecar().

resolve_sidecar_dll_path()

bool resolve_sidecar_dll_path ( char * out_path, size_t out_path_size )

static

Definition at line 155 of file load.c.

References DTTR_LOG_ERROR, DTTR_Path_CopySds(), DTTR_Path_ModuleSibling(), NULL, and SIDECAR_DLL_RELATIVE_PATH.

Referenced by DTTR_Loader_InjectSidecar().

write_remote_payload()

bool write_remote_payload ( HANDLE process, const void * buffer, SIZE_T buffer_size, LPVOID * out_remote_buffer )

static

Definition at line 235 of file load.c.

References DTTR_LOG_DEBUG, DTTR_LOG_ERROR, DWORD, log_win32_failure(), and NULL.

Referenced by DTTR_Loader_InjectSidecar().

Variable Documentation

EXIT_THREAD_NAME

const char EXIT_THREAD_NAME[] = "ExitThread"

static

Definition at line 15 of file load.c.

Referenced by initialize_shellcode_payload().

GET_LAST_ERROR_NAME

const char GET_LAST_ERROR_NAME[] = "GetLastError"

static

Definition at line 16 of file load.c.

Referenced by initialize_shellcode_payload().

LOAD_LIBRARY_EX_NAME

const char LOAD_LIBRARY_EX_NAME[] = "LoadLibraryExA"

static

Definition at line 14 of file load.c.

Referenced by initialize_shellcode_payload().

PEB_IMAGE_BASE_OFFSET

const uintptr_t PEB_IMAGE_BASE_OFFSET = 0x8

static

Definition at line 18 of file load.c.

Referenced by read_remote_image_base_from_thread_context().

SIDECAR_DLL_RELATIVE_PATH

const char* const SIDECAR_DLL_RELATIVE_PATH = "modules\\libdttr_sidecar.dll"

static

Definition at line 13 of file load.c.

Referenced by resolve_sidecar_dll_path().