Click here to Skip to main content
15,895,746 members
Articles / Containers / Virtual Machine

Injective Code inside Import Table

Rate me:
Please Sign up or sign in to vote.
4.95/5 (119 votes)
29 Mar 2007GPL316 min read 240K   10.1K   285  
An introduction to injection the code into Import Table of Portable Executable file format, which is called API redirection technique.
/* main.cpp --

   This file is part of the "ZImport 0.1".

   Copyright (C) 2006-2007 Ashkbiz Danehkar
   All Rights Reserved.

   zero Dump library are free software; you can redistribute them
   and/or modify them under the terms of the GNU General Public License as
   published by the Free Software Foundation.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program; see the file COPYRIGHT.TXT.
   If not, write to the Free Software Foundation, Inc.,
   59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.

   Ashkbiz Danehkar
   <ashkbiz@yahoo.com>
*/
//#define  WIN32_LEAN_AND_MEAN
#include "stdafx.h"
#include <stdio.h>
#include <commdlg.h>
#include <commctrl.h>
#include <shellapi.h>
#include <winuser.h>
#include "main.h"
#include "TrayIcon.h"
#include "DumpSeek.h"
#include "DumpWin.h"
#include "Inject.h"

#pragma comment(linker,"/BASE:0x400000 /FILEALIGN:0x200 /MERGE:.rdata=.text /MERGE:.data=.text /SECTION:.text,EWR /IGNORE:4078")
#pragma pack(1)

// Global Variables:

HINSTANCE hInst;	// current instance
HWND	hwndMain;		// main application window 

static	HICON	hIcon;

static	HWND	hSeekedWindow;
static	DWORD	dwProcessId;
static	DWORD	dwThreadId;
static	BOOL	bSeeking;
static	HCURSOR	hSeekingCursor;
static	POINTS	points;
static	HICON	hIconDown;
static	HICON	hIconUp;
static	HWND	hSeekerIcon;
static	HDC		hDCSeekerIcon;

static	RECT	rcClip;			// new area for ClipCursor
static	RECT	rcOldClip;		// previous area for ClipCursor

static	HACCEL	hAccel;
static	char	szTemp[64];
static	bool	bStayOnTop=TRUE;

// Forward declarations of functions included in this code module:
LRESULT CALLBACK	About(HWND, UINT, WPARAM, LPARAM);
LRESULT DlgProc(HWND hDlg,UINT uMsg,WPARAM wParam,LPARAM lParam);

int APIENTRY _tWinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPTSTR    lpCmdLine,
                     int       nCmdShow)
{
	MSG msg;
	hInst=GetModuleHandle(0);

	DialogBoxParam(hInst,MAKEINTRESOURCE(IDD_MAINDLG),0,(DLGPROC)DlgProc,0);
	//DoPropertySheet(hInst);
	ExitProcess(0);
	return (int) msg.wParam;
}

void SetWindowTop(HWND hWnd,bool Value)
{
	if(Value)
	{
         SetWindowPos(hWnd, 
            HWND_TOPMOST, 
            0, 0, 0, 0,
            SWP_NOSIZE|SWP_NOMOVE|SWP_SHOWWINDOW);
	}
	else
	{
         SetWindowPos(hWnd, 
            HWND_NOTOPMOST, 
            0, 0, 0, 0,
            SWP_NOSIZE|SWP_NOMOVE|SWP_SHOWWINDOW); 
	}
}
// internal helpers
// 
static void FrameWindow(HWND hWnd)
{
	if (!IsWindow(hWnd)) return;

	RECT wndRect;
	GetWindowRect(hWnd,&wndRect);
	SetRect(&wndRect,0,0,
		wndRect.right - wndRect.left,
		wndRect.bottom - wndRect.top);

	HDC      hDC;
	int      iOldROP;
	HPEN     hPen;
	HPEN     hOldPen;
	HBRUSH   hOldBrush;

	hDC = GetWindowDC(hWnd);
	iOldROP = SetROP2(hDC, R2_XORPEN);
	hPen = CreatePen(PS_SOLID, GetSystemMetrics(SM_CXSIZEFRAME), RGB(255, 255, 255));
	hOldPen = (HPEN)SelectObject(hDC, hPen);
	hOldBrush = (HBRUSH)SelectObject(hDC, GetStockObject(NULL_BRUSH));

	Rectangle(hDC, wndRect.left, wndRect.top, wndRect.right, wndRect.bottom);
   
	SelectObject(hDC, hOldBrush);
	SelectObject(hDC, hOldPen);
	DeleteObject(hPen);
	SetROP2(hDC, iOldROP);
	ReleaseDC(hWnd, hDC);
}

//  FUNCTION: DlgProc(HWND, unsigned, WORD, LONG)
//  PURPOSE:  Processes messages for the main window.
//
//  WM_COMMAND	- process the application menu
//  WM_PAINT	- Paint the main window
//  WM_DESTROY	- post a quit message and return
LRESULT DlgProc(HWND hDlg,UINT uiMsg,WPARAM wParam,LPARAM lParam)
{
	UINT wmId, wmEvent;
	PAINTSTRUCT ps;
	HDC hdc;
	POINT point;
	DWORD dwProcessId, dwThreadId;
	switch (uiMsg) 
	{
	case WM_INITDIALOG:
		hwndMain=hDlg;

		LoadFromRegistry(&bStayOnTop);
		SetWindowTop(hDlg,bStayOnTop);
		CheckDlgButton(hDlg,IDC_STAYONTOP,bStayOnTop);

		hIcon=LoadIcon(hInst,MAKEINTRESOURCE(IDI_ICON));
		SendMessage(hDlg,WM_SETICON,TRUE,(WPARAM)hIcon);
	
		hAccel=LoadAccelerators(hInst,MAKEINTRESOURCE(IDC_ZIMPORT));
		hSeekingCursor=LoadCursor(hInst,MAKEINTRESOURCE(IDC_FINDER));

		hIconDown=LoadIcon(hInst,MAKEINTRESOURCE(IDI_FLOATINGFINDER));
		hIconUp=LoadIcon(hInst,MAKEINTRESOURCE(IDI_DOCKEDFINDER));
		hSeekerIcon=GetDlgItem(hDlg,IDC_STATIC_SEEKER);
		hDCSeekerIcon=GetWindowDC(hSeekerIcon);

		CreateTrayIcon();
		
		break;   
 	   
	case WM_COMMAND:
		TrayIconWM_COMMAND(hDlg, uiMsg, wParam, lParam);
		wmId    = LOWORD(wParam); 
		wmEvent = HIWORD(wParam); 
		// Parse the menu selections:
		switch (wmId)
		{

		case IDCLOSE:
			SendMessage(hDlg,WM_CLOSE,NULL,NULL);
			break;
              	                  
		case IDOK:
			EndDialog(hDlg,0);
			break;

		case ID_ABOUT:
			DialogBox(hInst, (LPCTSTR)IDD_ABOUTBOX, hDlg, (DLGPROC)About);
			break;

		case IDC_STAYONTOP:
			bStayOnTop=!bStayOnTop;
			SaveToRegistry(bStayOnTop);
			SetWindowTop(hDlg,bStayOnTop);
			break;

		case IDC_KILL_SHELLABOUT:
			dwProcessId = GetDlgItemInt(hDlg, IDC_PROCESSID, NULL, FALSE);
			dwThreadId = GetDlgItemInt(hDlg, IDC_THREADID, NULL, FALSE);
			if((dwProcessId!=0)&&(dwThreadId!=0))
			{
				KillShellAbout(dwProcessId, dwThreadId);
			}
			break;
		}
		break;

	case WM_LBUTTONDOWN:
			// default processing
			points = MAKEPOINTS(lParam); 
			point.x=points.x;
			point.y=points.y;
			// change the cursor
			SetCursor(hSeekingCursor);
			// change the icon itself
			DrawIcon(hDCSeekerIcon, 0, 0, hIconDown); 
			// start seeking
			bSeeking = TRUE;
			hSeekedWindow = hDlg;
			FrameWindow(hSeekedWindow);
			SetCapture(hDlg);

		break;

	case WM_LBUTTONUP:
		if (bSeeking)
		{
			// end seeking
			bSeeking = FALSE;
			FrameWindow(hSeekedWindow);
			ReleaseCapture();
			// Restore the Finder Tool icon
			//SetIcon(hIconUp);
			DrawIcon(hDCSeekerIcon, 0, 0, hIconUp); 
		}
		points = MAKEPOINTS(lParam); 
		point.x=points.x;
		point.y=points.y;
		break;

	case WM_MOUSEMOVE:
		if (bSeeking)
		{
			// !!! if you change the cursor, you change the icon !!!
			// change the cursor
			// SetCursor(m_hSeekingCursor);
   			// see if there is a different window under the mouse
			HWND hWindowUnderTheMouse;
			//HWND hWindowUnderTheMouseChild;
			points = MAKEPOINTS(lParam); 
			point.x=points.x;
			point.y=points.y;
			ClientToScreen(hDlg,&point);
			hWindowUnderTheMouse = WindowFromPoint(point);
			if((hwndMain==hWindowUnderTheMouse)||
			   (hwndMain==GetParent(hWindowUnderTheMouse)))
			{
				break;
			}
			//------------------------------
			hChildFound=NULL;
			SeekDumpWindow(hWindowUnderTheMouse,point);
			if((IsWindow(hChildFound))&&(hChildFound!=NULL))
			{
				hWindowUnderTheMouse=hChildFound;
			}
			//------------------------------
			if(hWindowUnderTheMouse != hSeekedWindow)
			{
				//
				FrameWindow(hSeekedWindow);
				hSeekedWindow = hWindowUnderTheMouse;
				FrameWindow(hSeekedWindow);

				// update the twin window
				sprintf(szTemp, "0x%08X", (DWORD)hSeekedWindow);
				SetDlgItemText(hDlg,IDC_WINDOWHANDLE,szTemp);

				dwThreadId=GetWindowThreadProcessId(hSeekedWindow, &dwProcessId);

				sprintf(szTemp, "%d", dwProcessId);
				SetDlgItemText(hDlg,IDC_PROCESSID,szTemp);

				sprintf(szTemp, "%d", dwThreadId);
				SetDlgItemText(hDlg,IDC_THREADID,szTemp);

				GetWindowInfo(hSeekedWindow);
			}
		}
		else
		{
			points = MAKEPOINTS(lParam); 
			point.x=points.x;
			point.y=points.y;
		}
		break;


	case WM_PAINT:
		hdc = BeginPaint(hDlg, &ps);
		// TODO: Add any drawing code here...
		EndPaint(hDlg, &ps);
		break;

	case WM_DESTROY:
		PostQuitMessage(0);
		break;

	case WM_CLOSE:
		EndDialog(hDlg,0);
		break;
	case WM_SIZE:
		TrayIconWM_SIZE(hDlg, wParam, lParam);
		break;
	case WM_TRAYMENU:
		TrayIconWM_TRAYMENU(hDlg, uiMsg, wParam, lParam);
		return 0;
	}
	return 0;
}

LRESULT CALLBACK About(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)
{
	UINT wmId, wmEvent;
	switch (message)
	{
	case WM_INITDIALOG:
		return TRUE;

	case WM_COMMAND:
		wmId    = LOWORD(wParam); 
		wmEvent = HIWORD(wParam); 
		// Parse the menu selections:
		switch (wmId)
		{
		case IDOK:
		case IDCANCEL:
			EndDialog(hDlg, LOWORD(wParam));
			return TRUE;
			break;
		case IDC_WEB:
			WinExec("Explorer http://www.ntcore.com/", SW_SHOWMAXIMIZED);
			break;
		}
		break;
	}
	return FALSE;
}

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The GNU General Public License (GPLv3)


Written By
Germany Germany
Ashkbiz Danehkar studied electrical engineering and computational science at the University of Rostock, Germany, where he obtained a Master of Science in Computational Engineering in the special field of Electrical Engineering in 2007. He worked as a software and hardware developer for some private limited companies until 2005, mostly focusing on industrial automation and microcontroller programming. During 2005–2006, he worked part-time remotely as a software reverse engineer for Panda Security (Bilbao, Spain). His master's thesis in 2007 was about the development of a microcontroller-based measurement system using an embedded system equipped with a real-time operating system (RTOS) and an AVR microcontroller to monitor the neuromuscular blockade and control the anesthesia.

Comments and Discussions