[RESOLVED] Fail to inject image of dll file in remote process

I want inject and execute the image of a x32 dll file in a remote x32 process (manual map injection) and to make this i found this following code, but he have a error in a line present in FixImports() method :(:

Code:

---

  if(!GetRemoteModuleHandle(pId, module))
  {
    retfix=0;
    break;
  };

---

Attachment 35189

How fix it?

Complete code:

Code:

---

// Mapping.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include "resource.h"
#include <windows.h>
#include <tlhelp32.h>
#include <shlwapi.h>
#include <string>
#include <iostream>

using namespace std;

#pragma comment(lib, "shlwapi.lib")

#define ID_LOADER_DLL        MAKEINTRESOURCE(IDR_DLL1)

#define IMAGE_DIRECTORY_ENTRY_IMPORT 1
#define IMAGE_DIRECTORY_ENTRY_BASERELOC 5

#define MakePtr( cast, ptr, addValue ) (cast)( (DWORD_PTR)(ptr) + (DWORD_PTR)(addValue))
#define MakeDelta(cast, x, y) (cast) ( (DWORD_PTR)(x) - (DWORD_PTR)(y))

HMODULE GetRemoteModuleHandle(unsigned long, char *);
FARPROC GetRemoteProcAddress(unsigned long, char *, char *);

bool FixImports(unsigned long, void *, IMAGE_NT_HEADERS *, IMAGE_IMPORT_DESCRIPTOR *);
bool FixRelocs(void *, void *, IMAGE_NT_HEADERS *, IMAGE_BASE_RELOCATION *, unsigned int);
bool MapSections(HANDLE, void *, void *, IMAGE_NT_HEADERS *);

PIMAGE_SECTION_HEADER GetEnclosingSectionHeader(DWORD, PIMAGE_NT_HEADERS);
LPVOID GetPtrFromRVA(DWORD, PIMAGE_NT_HEADERS, PBYTE);

__declspec(naked) void DllCall_stub(HMODULE hMod)
{
  _asm
  {
      push 0
      push 1
      push [esp+0Ch]               
      mov eax, 0xDEADBEEF 
      call eax                                                       
      ret                                                                               
  }
}

__declspec(naked) void DC_stubend(void) { } 

bool MapRemoteModule(unsigned long pId, /*LPCSTR ResName*/char *module)
{
  IMAGE_DOS_HEADER *dosHd;
  IMAGE_NT_HEADERS *ntHd;

/*  HMODULE hModule = GetModuleHandle(NULL);
  HRSRC hResource = FindResource(hModule, ResName, RT_RCDATA);
  HGLOBAL hMemory = LoadResource(hModule, hResource);
  DWORD dwSize = SizeofResource(hModule, hResource);
  LPVOID lpAddress = LockResource(hMemory);

  unsigned char *dllBin = new unsigned char[dwSize];
  memcpy(dllBin, lpAddress, dwSize);

  unsigned int nBytes = dwSize;  */

  HANDLE hFile = CreateFile(module,
          GENERIC_READ,
          FILE_SHARE_READ | FILE_SHARE_WRITE,
          NULL,
          OPEN_EXISTING,
          FILE_ATTRIBUTE_NORMAL,
          NULL);

  if (hFile == INVALID_HANDLE_VALUE)
          return false;

  unsigned int fSize;

  if (GetFileAttributes(module) & FILE_ATTRIBUTE_COMPRESSED)
          fSize = GetCompressedFileSize(module, NULL);
  else
          fSize = GetFileSize(hFile, NULL);

  unsigned char *dllBin = new unsigned char[fSize];
  unsigned int nBytes;

  ReadFile(hFile, dllBin, fSize, (LPDWORD)&nBytes, FALSE);
  CloseHandle(hFile);

  dosHd = MakePtr(IMAGE_DOS_HEADER *, dllBin, 0);

  if(dosHd->e_magic != IMAGE_DOS_SIGNATURE)
  {
      delete dllBin;
      return false;
  }

  ntHd = MakePtr(IMAGE_NT_HEADERS *, dllBin, dosHd->e_lfanew);

  if(ntHd->Signature != IMAGE_NT_SIGNATURE)
  {
      delete dllBin;
      return false;
  }

  HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pId);

  if(!hProcess)
      return false;

  void *moduleBase = VirtualAllocEx(hProcess,
      NULL,
      ntHd->OptionalHeader.SizeOfImage,
      MEM_COMMIT | MEM_RESERVE,
      PAGE_EXECUTE_READWRITE);

  if(!moduleBase)
      return false;

  void *stubBase = VirtualAllocEx(hProcess,
      NULL,
      MakeDelta(SIZE_T, DC_stubend, DllCall_stub),
      MEM_COMMIT | MEM_RESERVE,
      PAGE_EXECUTE_READWRITE);

  if(!stubBase)
      return false;

  IMAGE_IMPORT_DESCRIPTOR *impDesc = (IMAGE_IMPORT_DESCRIPTOR *)GetPtrFromRVA(
      (DWORD)(ntHd->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress),
      ntHd,
      (PBYTE)dllBin);

  if(ntHd->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size)
  {
          if(!FixImports(pId,
        (unsigned char *)dllBin,
        ntHd,
        impDesc)) return FALSE;

  };
 
  IMAGE_BASE_RELOCATION *reloc = (IMAGE_BASE_RELOCATION *)GetPtrFromRVA(
      (DWORD)(ntHd->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress),
      ntHd,
      (PBYTE)dllBin);

  if(ntHd->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size)
  {
       
          FixRelocs(dllBin,
                  moduleBase,
                  ntHd,
                  reloc,
                  ntHd->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size);
  }
  else
  {
          return false;
  };

  WriteProcessMemory(hProcess,
      moduleBase,
      dllBin,
      ntHd->FileHeader.SizeOfOptionalHeader + sizeof(ntHd->FileHeader) + sizeof(ntHd->Signature),
      (SIZE_T *)&nBytes);

  MapSections(hProcess, moduleBase, dllBin, ntHd);
 
  VirtualProtect((LPVOID)DllCall_stub,
      MakeDelta(SIZE_T, DC_stubend, DllCall_stub),
      PAGE_EXECUTE_READWRITE,
      (DWORD *)&nBytes);

  *MakePtr(unsigned long *, DllCall_stub, 9) =
      MakePtr(unsigned long, moduleBase, ntHd->OptionalHeader.AddressOfEntryPoint);

  WriteProcessMemory(hProcess,
      stubBase,
      (LPVOID)DllCall_stub,
      MakeDelta(SIZE_T, DC_stubend, DllCall_stub),
      (SIZE_T *)&nBytes);

  CreateRemoteThread(hProcess,
      NULL,
      0,
      (LPTHREAD_START_ROUTINE)stubBase,
      moduleBase,
      0,
      NULL);

  delete dllBin;
  return true;
}

bool MapSections(HANDLE hProcess, void *moduleBase, void *dllBin, IMAGE_NT_HEADERS *ntHd)
{
  IMAGE_SECTION_HEADER *header = IMAGE_FIRST_SECTION(ntHd);
  unsigned int nBytes = 0;
  unsigned int virtualSize = 0;
  unsigned int n = 0;

  for(unsigned int i = 0; ntHd->FileHeader.NumberOfSections; i++)
  {
     
      if(nBytes >= ntHd->OptionalHeader.SizeOfImage)
        break;
   
      WriteProcessMemory(hProcess,
        MakePtr(LPVOID, moduleBase, header->VirtualAddress),
        MakePtr(LPCVOID, dllBin, header->PointerToRawData),
        header->SizeOfRawData,
        (LPDWORD)&n);

      virtualSize = header->VirtualAddress;
      header++;
      virtualSize = header->VirtualAddress - virtualSize;
      nBytes += virtualSize;

      VirtualProtectEx(hProcess,
        MakePtr(LPVOID, moduleBase, header->VirtualAddress),
        virtualSize,
        header->Characteristics & 0x00FFFFFF,
        NULL);
  }

  return true;
}

bool FixImports(unsigned long pId, void *base, IMAGE_NT_HEADERS *ntHd, IMAGE_IMPORT_DESCRIPTOR *impDesc)
{
  char *module;
  bool retfix=1;
  char tempstr[MAX_PATH]="";

  while((module = (char *)GetPtrFromRVA((DWORD)(impDesc->Name), ntHd, (PBYTE)base)))
  {
     
      if(!GetRemoteModuleHandle(pId, module))
          {
                retfix=0;
                break;
          };
     
      IMAGE_THUNK_DATA *itd =
        (IMAGE_THUNK_DATA *)GetPtrFromRVA((DWORD)(impDesc->FirstThunk), ntHd, (PBYTE)base);

      while(itd->u1.AddressOfData)
      {
        IMAGE_IMPORT_BY_NAME *iibn;
        iibn = (IMAGE_IMPORT_BY_NAME *)GetPtrFromRVA((DWORD)(itd->u1.AddressOfData), ntHd, (PBYTE)base);

            itd->u1.Function = MakePtr(DWORD, GetRemoteProcAddress(pId,
            module,
            (char *)iibn->Name), 0);

        itd++;
      }     
      impDesc++;
  }
 
  return retfix;
}

bool FixRelocs(void *base, void *rBase, IMAGE_NT_HEADERS *ntHd, IMAGE_BASE_RELOCATION *reloc, unsigned int size)
{
  unsigned long ImageBase = ntHd->OptionalHeader.ImageBase;
  unsigned int nBytes = 0;

  unsigned long delta = MakeDelta(unsigned long, rBase, ImageBase);

  while(1)
  {
      unsigned long *locBase =
        (unsigned long *)GetPtrFromRVA((DWORD)(reloc->VirtualAddress), ntHd, (PBYTE)base);
      unsigned int numRelocs = (reloc->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(WORD);

      if(nBytes >= size) break;

      unsigned short *locData = MakePtr(unsigned short *, reloc, sizeof(IMAGE_BASE_RELOCATION));
      for(unsigned int i = 0; i < numRelocs; i++)
      {     
        if(((*locData >> 12) & IMAGE_REL_BASED_HIGHLOW))
            *MakePtr(unsigned long *, locBase, (*locData & 0x0FFF)) += delta;

        locData++;
      }

      nBytes += reloc->SizeOfBlock;
      reloc = (IMAGE_BASE_RELOCATION *)locData;
  }

  return true;
}

FARPROC GetRemoteProcAddress(unsigned long pId, char *module, char *func)
{
  HMODULE remoteMod = GetRemoteModuleHandle(pId, module);
  HMODULE localMod = GetModuleHandle(module);

  unsigned long delta = MakeDelta(unsigned long, remoteMod, localMod);
  return MakePtr(FARPROC, GetProcAddress(localMod, func), delta);
}

HMODULE GetRemoteModuleHandle(unsigned long pId, char *module)
{
  MODULEENTRY32 modEntry;
  HANDLE tlh = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pId);

  modEntry.dwSize = sizeof(MODULEENTRY32);
    Module32First(tlh, &modEntry);

  do
  {
      if(!_stricmp(modEntry.szModule, module))
        return modEntry.hModule;
      modEntry.dwSize = sizeof(MODULEENTRY32);
  }
  while(Module32Next(tlh, &modEntry));

  return NULL;
}

PIMAGE_SECTION_HEADER GetEnclosingSectionHeader(DWORD rva, PIMAGE_NT_HEADERS pNTHeader)
{
    PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(pNTHeader);
    unsigned int i;
 
    for ( i = 0; i < pNTHeader->FileHeader.NumberOfSections; i++, section++ )
    {
     
      DWORD size = section->Misc.VirtualSize;
      if ( 0 == size )
        size = section->SizeOfRawData;
       
        if ( (rva >= section->VirtualAddress) &&
            (rva < (section->VirtualAddress + size)))
            return section;
    }
 
    return 0;
}

LPVOID GetPtrFromRVA( DWORD rva, IMAGE_NT_HEADERS *pNTHeader, PBYTE imageBase )
{
  PIMAGE_SECTION_HEADER pSectionHdr;
  INT delta;
   
  pSectionHdr = GetEnclosingSectionHeader( rva, pNTHeader );
  if ( !pSectionHdr )
      return 0;
 
  delta = (INT)(pSectionHdr->VirtualAddress-pSectionHdr->PointerToRawData);
  return (PVOID) ( imageBase + rva - delta );
}

int _tmain(int argc, _TCHAR* argv[])
{
        ULONG rc;

        STARTUPINFO StartupInfo;
    PROCESS_INFORMATION ProcessInfo;

        memset(&StartupInfo, 0, sizeof(StartupInfo));
    StartupInfo.cb = sizeof(STARTUPINFO);
    StartupInfo.dwFlags = STARTF_USESHOWWINDOW;
    StartupInfo.wShowWindow = SW_HIDE;

        if (!CreateProcess( NULL, "c:\\windows\\system32\\calc.exe", NULL, NULL, FALSE,
        CREATE_NEW_CONSOLE,
        NULL,
        NULL,
        &StartupInfo,
        &ProcessInfo))
    {
                return 0;     
    }

    WaitForSingleObject(ProcessInfo.hProcess, 5000);
    if(!GetExitCodeProcess(ProcessInfo.hProcess, &rc))
        rc = 0;

        MapRemoteModule(ProcessInfo.dwProcessId, /*ID_LOADER_DLL*/"c:\\bob.dll");

    CloseHandle(ProcessInfo.hThread);
    CloseHandle(ProcessInfo.hProcess);

  return 0;
}

---

Already solved, i'm using this code actually.