[C/ASM] Easy to use DLL hijacking examples

[atom0s]

Here is another way you can make a proxy fairly easy and slim. Since you do not need to know the actual function prototype/parameters when exporting things that are just using direct jumps via inline asm, you can mix and abuse macros with inline asm to export things easy.

PHP Code:

#include <Windows.h>

HMODULE g_ModuleHandle = nullptr;       // This proxies module handle.
HMODULE g_RealModuleHandle = nullptr;   // The real modules handle being proxied.

/**
 * Obtains the original export from the real module.
 */
BOOL APIENTRY GetRealExport(const char* name, FARPROC* out)
{
    // Ensure the real module is loaded..
    if (g_RealModuleHandle == nullptr)
        return FALSE;

    // Todo: Add any type of function caching if you want here..

    // Obtain the real export function..
    *out = ::GetProcAddress(g_RealModuleHandle, name);
    return (*out == nullptr);
}

/**
 * Generates an export function wrapper for the given exported function by name.
 */
#define EXPORTORIG(n)                               \
    FARPROC orig_##n = nullptr;                     \
    __declspec(naked) void __stdcall real_##n() {   \
        GetRealExport(#n, &orig_##n);               \
        __asm jmp orig_##n                          \
    }

EXPORTORIG(Direct3DCreate9);

/**
 * Initialize the proxy for use.
 */
BOOL APIENTRY InitializeProxy(HINSTANCE hinstDLL)
{
    // Store the modules handle..
    g_ModuleHandle = hinstDLL;

    // Build the path to the original module..
    char path[MAX_PATH] = { 0 };
    ::GetSystemDirectory(path, MAX_PATH);
    strcat_s(path, "\\d3d9.dll");

    // Load the original module..
    g_RealModuleHandle = ::LoadLibrary(path);
    if (g_RealModuleHandle == nullptr)
        return FALSE;

    return TRUE;
}

/**
 * Entry point.
 */
BOOL APIENTRY DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
    switch (fdwReason)
    {
    case DLL_PROCESS_ATTACH:
        ::DisableThreadLibraryCalls(hinstDLL);
        return InitializeProxy(hinstDLL);
    }
    return TRUE;
} 


And in the .def file:

PHP Code:

LIBRARY
EXPORTS
    Direct3DCreate9 = real_Direct3DCreate9 


Beings that this is using a macro for the dirty work/heavy lifting you can easy create a template/skeleton project to auto-generate the entire proxy dll for you like this just by having it read the original exports from the target file and generating the rest.

Note, this method as-is will have issues with exports that are by ordinal and not by name. You would have to tweak the generated names a tad to work with ords instead.

[zeffy]

Thank you for sharing your code atom0s! I've used something very similar to it before I created these template projects. The reason I opted to use complete ASM instead of inline is because it isn't supported by VC in x64 builds, only x86.

Additionally, calling your InitializeProxy (and thus LoadLibrary) from DllMain can cause the process to deadlock under certain conditions. For this reason, MSDN specifically advises people not to call LoadLibrary from DllMain. Although I've never encountered it happen in practice, that could change in the future or in edge cases. That's why I opted to delay the loading until one of its functions is actually called. Either approach works though.

[atom0s]

Originally Posted by zeffy

Thank you for sharing your code atom0s! I've used something very similar to it before I created these template projects. The reason I opted to use complete ASM instead of inline is because it isn't supported by VC in x64 builds, only x86.

Additionally, calling your InitializeProxy (and thus LoadLibrary) from DllMain can cause the process to deadlock under certain conditions. For this reason, MSDN specifically advises people not to call LoadLibrary from DllMain. Although I've never encountered it happen in practice, that could change in the future or in edge cases. That's why I opted to delay the loading until one of its functions is actually called. Either approach works though.

I generally do the same with late loading, generally via exporting an 'Install' function from the main hook and using a loader to invoke it. The example above was just a quick throw together to show off the macro method of making a fast proxy.

[zeffy]

Originally Posted by atom0s

I generally do the same with late loading, generally via exporting an 'Install' function from the main hook and using a loader to invoke it. The example above was just a quick throw together to show off the macro method of making a fast proxy.

That's a neat idea about exporting an 'Install' function!

I've actually been working on simplifying my project using macros similar to how you did (except in the assembly), which has made it much easier to maintain compared to before. I also fixed the "random" crashing bug that I referred to earlier (which was caused by stack corruption and some of the volatile registers getting mutilated by my proc resolver function ). If you or anyone else is interested in taking a look, here's an example of the changes I've made:
https://github.com/zeffy/proxydll_te...inmm/winmm.asm

Edit: OK I really fixed the register mutilation now... I was restoring r8 to r9 and r9 to r8 in the last commit.