Advertisement
yasi04

Untitled

Jan 22nd, 2025
43
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 8.16 KB | None | 0 0
  1. #include <windows.h>
  2. #include <tlhelp32.h>
  3. #include <fstream>
  4. #include <iostream>
  5. #include <string>
  6. #include <vector>
  7. #include <psapi.h>
  8.  
  9. #define IMAGE_REL_BASED_DIR64 10
  10. typedef ULONGLONG QWORD;
  11.  
  12. struct MANUAL_MAPPING_DATA {
  13.     PVOID ImageBase;
  14.     PVOID EntryPoint;
  15. };
  16.  
  17. // Улучшенное логирование
  18. void Log(const std::string& message) {
  19.     std::ofstream log("C:\\Windows\\Temp\\inj.log", std::ios::app);
  20.     if (log) {
  21.         log << "[" << __TIME__ << "] " << message << std::endl;
  22.     }
  23. }
  24.  
  25. DWORD GetProcessIdByName(const std::wstring& processName) {
  26.     DWORD processId = 0;
  27.     HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  28.    
  29.     if (snapshot == INVALID_HANDLE_VALUE) {
  30.         Log("Snapshot error: " + std::to_string(GetLastError()));
  31.         return 0;
  32.     }
  33.  
  34.     PROCESSENTRY32W entry = { sizeof(PROCESSENTRY32W) };
  35.     if (Process32FirstW(snapshot, &entry)) {
  36.         do {
  37.             if (processName == entry.szExeFile) {
  38.                 processId = entry.th32ProcessID;
  39.                 break;
  40.             }
  41.         } while (Process32NextW(snapshot, &entry));
  42.     }
  43.    
  44.     CloseHandle(snapshot);
  45.     return processId;
  46. }
  47.  
  48. void ApplyRelocations(PIMAGE_NT_HEADERS64 pNtHeaders, PVOID base, ULONGLONG delta) {
  49.     if (delta == 0) return;
  50.  
  51.     auto dir = &pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC];
  52.     if (dir->Size == 0) return;
  53.  
  54.     auto reloc = (PIMAGE_BASE_RELOCATION)((ULONGLONG)base + dir->VirtualAddress);
  55.     while (reloc->VirtualAddress > 0) {
  56.         ULONGLONG relocAddr = (ULONGLONG)base + reloc->VirtualAddress;
  57.         UINT numEntries = (reloc->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(WORD);
  58.         auto entries = (PBASE_RELOCATION_ENTRY)(reloc + 1);
  59.  
  60.         for (UINT i = 0; i < numEntries; i++) {
  61.             if (entries[i].Type == IMAGE_REL_BASED_DIR64) {
  62.                 ULONGLONG* patchAddr = (ULONGLONG*)(relocAddr + entries[i].Offset);
  63.                 *patchAddr += delta;
  64.             }
  65.         }
  66.         reloc = (PIMAGE_BASE_RELOCATION)((ULONGLONG)reloc + reloc->SizeOfBlock);
  67.     }
  68. }
  69.  
  70. bool ResolveImports(HANDLE hProcess, PIMAGE_NT_HEADERS64 pNtHeaders, PVOID base) {
  71.     auto dir = &pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
  72.     if (dir->Size == 0) return true;
  73.  
  74.     auto importDesc = (PIMAGE_IMPORT_DESCRIPTOR)((ULONGLONG)base + dir->VirtualAddress);
  75.     while (importDesc->Name) {
  76.         char* moduleName = (char*)((ULONGLONG)base + importDesc->Name);
  77.         HMODULE hModule = GetModuleHandleA(moduleName);
  78.         if (!hModule) {
  79.             hModule = LoadLibraryA(moduleName);
  80.             if (!hModule) return false;
  81.         }
  82.  
  83.         auto thunk = (PIMAGE_THUNK_DATA64)((ULONGLONG)base + importDesc->FirstThunk);
  84.         while (thunk->u1.AddressOfData) {
  85.             if (IMAGE_SNAP_BY_ORDINAL64(thunk->u1.Ordinal)) {
  86.                 auto proc = GetProcAddress(hModule, (LPCSTR)IMAGE_ORDINAL64(thunk->u1.Ordinal));
  87.                 if (!proc) return false;
  88.                 thunk->u1.Function = (ULONGLONG)proc;
  89.             }
  90.             else {
  91.                 auto import = (PIMAGE_IMPORT_BY_NAME)((ULONGLONG)base + thunk->u1.AddressOfData);
  92.                 auto proc = GetProcAddress(hModule, import->Name);
  93.                 if (!proc) return false;
  94.                 thunk->u1.Function = (ULONGLONG)proc;
  95.             }
  96.             thunk++;
  97.         }
  98.         importDesc++;
  99.     }
  100.     return true;
  101. }
  102.  
  103. bool ManualMap(HANDLE hProcess, const std::string& dllPath) {
  104.     Log("Starting manual mapping...");
  105.  
  106.     HANDLE hFile = CreateFileA(dllPath.c_str(), GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);
  107.     if (hFile == INVALID_HANDLE_VALUE) {
  108.         Log("CreateFile failed: " + std::to_string(GetLastError()));
  109.         return false;
  110.     }
  111.  
  112.     DWORD fileSize = GetFileSize(hFile, NULL);
  113.     std::vector<BYTE> dllData(fileSize);
  114.     DWORD bytesRead;
  115.    
  116.     if (!ReadFile(hFile, dllData.data(), fileSize, &bytesRead, NULL)) {
  117.         Log("ReadFile failed: " + std::to_string(GetLastError()));
  118.         CloseHandle(hFile);
  119.         return false;
  120.     }
  121.     CloseHandle(hFile);
  122.  
  123.     auto pDosHeader = (PIMAGE_DOS_HEADER)dllData.data();
  124.     if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
  125.         Log("Invalid DOS header");
  126.         return false;
  127.     }
  128.  
  129.     auto pNtHeaders = (PIMAGE_NT_HEADERS64)((ULONGLONG)dllData.data() + pDosHeader->e_lfanew);
  130.     if (pNtHeaders->Signature != IMAGE_NT_SIGNATURE ||
  131.         pNtHeaders->OptionalHeader.Magic != IMAGE_NT_OPTIONAL_HDR64_MAGIC) {
  132.         Log("Invalid NT header");
  133.         return false;
  134.     }
  135.  
  136.     PVOID remoteBase = VirtualAllocEx(hProcess, (PVOID)pNtHeaders->OptionalHeader.ImageBase,
  137.         pNtHeaders->OptionalHeader.SizeOfImage, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
  138.    
  139.     if (!remoteBase) {
  140.         remoteBase = VirtualAllocEx(hProcess, NULL, pNtHeaders->OptionalHeader.SizeOfImage,
  141.             MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
  142.         if (!remoteBase) {
  143.             Log("Memory allocation failed: " + std::to_string(GetLastError()));
  144.             return false;
  145.         }
  146.     }
  147.  
  148.     WriteProcessMemory(hProcess, remoteBase, dllData.data(), pNtHeaders->OptionalHeader.SizeOfHeaders, NULL);
  149.  
  150.     auto pSection = IMAGE_FIRST_SECTION(pNtHeaders);
  151.     for (int i = 0; i < pNtHeaders->FileHeader.NumberOfSections; i++, pSection++) {
  152.         PVOID secDest = (BYTE*)remoteBase + pSection->VirtualAddress;
  153.         WriteProcessMemory(hProcess, secDest, dllData.data() + pSection->PointerToRawData, pSection->SizeOfRawData, NULL);
  154.     }
  155.  
  156.     ULONGLONG delta = (ULONGLONG)remoteBase - pNtHeaders->OptionalHeader.ImageBase;
  157.     ApplyRelocations(pNtHeaders, remoteBase, delta);
  158.  
  159.     if (!ResolveImports(hProcess, pNtHeaders, remoteBase)) {
  160.         Log("Import resolution failed");
  161.         VirtualFreeEx(hProcess, remoteBase, 0, MEM_RELEASE);
  162.         return false;
  163.     }
  164.  
  165.     MANUAL_MAPPING_DATA mappingData{};
  166.     mappingData.ImageBase = remoteBase;
  167.     mappingData.EntryPoint = (PVOID)((ULONGLONG)remoteBase + pNtHeaders->OptionalHeader.AddressOfEntryPoint);
  168.  
  169.     HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0,
  170.         (LPTHREAD_START_ROUTINE)mappingData.EntryPoint,
  171.         mappingData.ImageBase, 0, NULL);
  172.    
  173.     if (!hThread) {
  174.         Log("Thread creation failed: " + std::to_string(GetLastError()));
  175.         VirtualFreeEx(hProcess, remoteBase, 0, MEM_RELEASE);
  176.         return false;
  177.     }
  178.  
  179.     WaitForSingleObject(hThread, INFINITE);
  180.     CloseHandle(hThread);
  181.     Log("Manual mapping completed");
  182.     return true;
  183. }
  184.  
  185. bool Inject(HANDLE hProcess, const std::string& dllPath) {
  186.     return ManualMap(hProcess, dllPath);
  187. }
  188.  
  189. void HideConsole() {
  190.     HWND hwnd = GetConsoleWindow();
  191.     if (hwnd) ShowWindow(hwnd, SW_HIDE);
  192. }
  193.  
  194. int main() {
  195.     HideConsole();
  196.     Log("Injector started");
  197.  
  198.     const std::string dllPath = "C:\\downloads\\your_dll_name.dll";
  199.     const std::wstring targetProcess = L"RainbowSix_DX11.exe";
  200.  
  201.     // Вариант 1: Запуск через инжектор
  202.     STARTUPINFOW si = { sizeof(si) };
  203.     PROCESS_INFORMATION pi;
  204.     if (CreateProcessW(L"D:\\Games\\Tom Clancy's Rainbow Six Siege\\RainbowSix_DX11.exe",
  205.                       NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi)) {
  206.         Log("Process created in suspended state");
  207.         if (Inject(pi.hProcess, dllPath)) {
  208.             Log("Injection successful, resuming thread");
  209.             ResumeThread(pi.hThread);
  210.             CloseHandle(pi.hThread);
  211.             CloseHandle(pi.hProcess);
  212.             return 0;
  213.         }
  214.     }
  215.  
  216.     // Вариант 2: Инжекция в уже запущенный процесс
  217.     DWORD pid = GetProcessIdByName(targetProcess);
  218.     if (pid) {
  219.         HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
  220.         if (hProcess) {
  221.             if (Inject(hProcess, dllPath)) {
  222.                 Log("Injection into existing process successful");
  223.                 CloseHandle(hProcess);
  224.                 return 0;
  225.             }
  226.             CloseHandle(hProcess);
  227.         }
  228.     }
  229.  
  230.     Log("Injection failed");
  231.     return 1;
  232. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement