Inject DLL from Memory

[Megamorph]

Ich überlege mittlerweile sogar, das ganze Tool in C++ zu schreiben, weil es dort schöne Lib gibt und man mit 10 Zeilen Code drin ist...
Delphi wäre mir trotzdem wegen meiner etwas besseren Kenntnisse lieber.

Hier der Code in meinem Timer:

Delphi-Quellcode:

  tempstream.Seek(0, soFromBeginning);
  ImageSize:= tempstream.Size;
  body:= VirtualAllocEx(PID, nil, ImageSize, MEM_COMMIT, PAGE_READWRITE);
  dllptr:= Pointer(ReadLibrary2('',Cardinal(body)));
  WriteProcessMemory(PID, body, dllptr, ImageSize, BytesWritten);
  Thread :=  CreateRemoteThread(PID, nil, 0,
             GetProcAddress(GetModuleHandle('KERNEL32.DLL'), 'LoadLibraryA'),
             body, 0, ThreadId);
  if Thread <> 0 then  Memo1.Lines.Add('Injected!')
                 else  Memo1.Lines.Add('Failed!');

Hier die modifizierte ReadLibrary:
(alle Überprüfungen innerhalb der Funktion sind erfolgreich)

Delphi-Quellcode:

function ReadLibrary2(pLibraryName: PChar; OrigBase: DWord): DWord; stdcall;
var
  DllMain    : function (dwHandle, dwReason, dwReserved: DWord): DWord; stdcall;
  IDH        : PImageDosHeader;
  INH        : PImageNtHeaders;
  SEC        : PImageSectionHeader;
  dwread     : DWord;
  dwSecCount : DWord;
  dwFileSize : DWord;
  dwmemsize  : DWord;
  i          : Integer;
  iFileHandle: Integer;
  pFileMem   : Pointer;
  pAll       : Pointer;
  SysDirP    : array [0..MAX_PATH-1] of Char;
  SysDir     : String;
begin
  Result := 0;
  (*
  iFileHandle := CreateFileA(pLibraryName,GENERIC_READ,FILE_SHARE_READ,nil,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);
  if (iFileHandle <= 0) then
  begin
    GetSystemDirectory(SysDirP, MAX_PATH);
    SysDir := SysDirP;
    iFileHandle := CreateFileA(PChar(SysDir+'\'+pLibraryName),GENERIC_READ,FILE_SHARE_READ,nil,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);
    if (iFileHandle <= 0) then
      iFileHandle := CreateFileA(PChar(SysDir+'\DRIVERS\'+pLibraryName),GENERIC_READ,FILE_SHARE_READ,nil,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);
      if (iFileHandle <= 0) then
        Exit;
  end;
  *)

  //dwFileSize := GetFileSize(iFileHandle,nil);
  dwFileSize := tempstream.Size;

  pFileMem := VirtualAlloc(nil,dwFileSize,MEM_COMMIT or MEM_RESERVE,PAGE_EXECUTE_READWRITE);
  if (pFileMem = nil) then
  begin
//    CloseHandle(iFileHandle);
    Exit;
  end;

  //ReadFile(iFileHandle,pFileMem^,dwFileSize,dwRead,nil);
  tempstream.Seek(0, soFromBeginning);
  getmem ( pFileMem,tempstream.Size);
  tempstream.Read(pFileMem^,tempstream.Size-1);

  IDH := pFileMem;
  if (isBadReadPtr(IDH,SizeOf(TImageDosHeader))) or
     (IDH^.e_magic <> IMAGE_DOS_SIGNATURE) then
  begin
    VirtualFree(pFileMem,dwFileSize,MEM_DECOMMIT);
    //CloseHandle(iFileHandle);
    Exit;
  end;

  INH := pointer(cardinal(pFileMem)+cardinal(IDH^._lfanew));
  if (isBadReadPtr(INH, SizeOf(TImageNtHeaders))) or
     (INH^.Signature <> IMAGE_NT_SIGNATURE) then
  begin
    VirtualFree(pFileMem,dwFileSize,MEM_DECOMMIT);
    //CloseHandle(iFileHandle);
    Exit;
  end;

  SEC := Pointer(Integer(INH)+SizeOf(TImageNtHeaders));
  dwMemSize := INH^.OptionalHeader.SizeOfImage;
  if (dwMemSize = 0) then
  begin
    VirtualFree(pFileMem,dwFileSize,MEM_DECOMMIT);
    //CloseHandle(iFileHandle);
    Exit;
  end;

  pAll := VirtualAlloc(nil,dwMemSize,MEM_COMMIT or MEM_RESERVE,PAGE_EXECUTE_READWRITE);
  if (pAll = nil) then
  begin
    VirtualFree(pFileMem,dwFileSize,MEM_DECOMMIT);
    //CloseHandle(iFileHandle);
    Exit;
  end;

  dwSecCount := INH^.FileHeader.NumberOfSections;
  CopyMemory(pAll,IDH,DWord(SEC)-DWord(IDH)+dwSecCount*SizeOf(TImageSectionHeader));

  for i := 0 to dwSecCount-1 do
  begin
    CopyMemory(Pointer(DWord(pAll)+SEC^.VirtualAddress),
      Pointer(DWord(pFileMem)+DWord(SEC^.PointerToRawData)),
      SEC^.SizeOfRawData);
    SEC := Pointer(Integer(SEC)+SizeOf(TImageSectionHeader));
  end;

  if (INH^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress <> 0) then
  ChangeReloc(Pointer(INH^.OptionalHeader.ImageBase),
              pAll,
              Pointer(DWord(pAll)+INH^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress),
              Pointer(OrigBase),
              INH^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size);
  CreateImportTable(pAll, Pointer(DWord(pAll)+INH^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress));

  @DllMain := Pointer(INH^.OptionalHeader.AddressOfEntryPoint+DWord(pAll));
  Result := DWord(pAll);
  //VirtualFree(pFileMem,dwFileSize,MEM_DECOMMIT);

  //CloseHandle(iFileHandle);
  Form1.Memo1.Lines.Add('bam');
end;

Leider kann ich ihn nicht dazu bewegen, dass im Memofeld 'Injected!' erscheint...
Hat vlt. noch jemand einen Tip?
Thx, Megamorph