A simple LoadLibrary injector.
Currently only APC injection is implemented. I may add one or two more injection methods later.
-
APC injection.
-
Two allocation methods:
- Regular allocation.
- Section allocation (used by default).
-
Memory reading to get a module base by its name.
-
The driver tries to use physical memory first. If that is not possible, it falls back to virtual memory.
-
Memory writing currently uses only virtual memory. Writing through physical memory is not possible when the page has just been created. If I continue working on this project, this will be one of the first things I improve. The page simply needs to be touched first before physical memory can be used. There is plenty of information about this online.
<name>.exe <PID/process_name> <absolute_dll_path>
<name>.exe 1337 C:\hello_world.dll
<name>.exe notepad.exe C:\hello_world.dll
The DLL path must be an absolute path.
The driver uses IOCTL codes.
The device name is randomized every time the driver starts. The client automatically finds the current name. The implementation can be found in:
client/source/driver.cc
I didn't want to use the registry, so instead the driver creates a file containing the current device name. I personally preferred this approach.
The driver also supports unloading.
The client code is honestly pretty bad. It works fine for normal use, but I really don't like how I wrote it. If you're planning to build something on top of this project, I recommend rewriting the client.
The driver should also be able to run without a mapper using sc.
I haven't actually tested this. Because of the DOS device name, the client probably won't be able to connect, but feel free to try it.
If I continue working on this project, the first thing I'll improve is physical memory writing. I may also add one or two more injection methods.