/* * rocks/insert_code.c * * Inserts code into the child process to load the rocks library. * Uses file entry.bin and preload.bin generated by NASM. * * Copyright (C) 2001 Victor Zandy, Greg Quinn * See COPYING for distribution terms. */ #include #include #include "insert_code.h" BOOL insert_code(DWORD entry_address, DWORD preload_address, PBYTE old_entry_code, HANDLE process) { HRSRC entry_rsrc, preload_rsrc; HGLOBAL entry_glob, preload_glob; PBYTE entry_code, preload_code; DWORD rv; PROC tmp_proc; printf("inserting code, dude!\n"); /* insert the entry code */ entry_rsrc = FindResource(GetModuleHandle(NULL), TEXT("ENTRY"), TEXT("ENTRY_TYPE")); entry_glob = LoadResource(GetModuleHandle(NULL), entry_rsrc); entry_code = LockResource(entry_glob); printf("found entry code %p: %.02x%.02x%.02x%.02x\n", entry_code, entry_code[0], entry_code[1], entry_code[2], entry_code[3]); rv = preload_address + PRELOAD_START_OFFSET; memcpy(&entry_code[EP_PRELOAD_ADDRESS], &rv, 4); WriteProcessMemory(process, (PCHAR)NULL + entry_address, entry_code, ENTRY_BIN_SIZE, &rv); assert(rv == ENTRY_BIN_SIZE); FreeResource(entry_code); /* insert the preload code */ preload_rsrc = FindResource(GetModuleHandle(NULL), TEXT("PRELOLD"), TEXT("PRELOLD_TYPE")); preload_glob = LoadResource(GetModuleHandle(NULL), preload_rsrc); preload_code = LockResource(preload_glob); printf("found preload code %p: %.02x%.02x%.02x%.02x\n", preload_code, preload_code[0], preload_code[1], preload_code[2], preload_code[3]); memcpy(&preload_code[PP_OLD_ENTRY_BUF], old_entry_code, ENTRY_BIN_SIZE); tmp_proc = (PROC)LoadLibrary; memcpy(&preload_code[PP_LOAD_LIBRARY], &tmp_proc, 4); memcpy(&preload_code[PP_ENTRY_POINT_1], &entry_address, 4); tmp_proc = (PROC)GetCurrentProcess; memcpy(&preload_code[PP_GET_CURRENT_PROCESS], &tmp_proc, 4); tmp_proc = (PROC)WriteProcessMemory; memcpy(&preload_code[PP_WRITE_PROCESS_MEMORY], &tmp_proc, 4); memcpy(&preload_code[PP_ENTRY_POINT_2], &entry_address, 4); rv = preload_address + P_ROCKSDLL; memcpy(&preload_code[PP_DLLSTRING_ADDRESS], &rv, 4); rv = preload_address + PP_OLD_ENTRY_BUF; memcpy(&preload_code[PP_OLD_ENTRY_ADDRESS], &rv, 4); printf("writing process memory\n"); WriteProcessMemory(process, (PCHAR)NULL + preload_address, preload_code, PRELOAD_BIN_SIZE, &rv); FreeResource(preload_code); printf("finished\n"); return TRUE; }