Created
May 13, 2016 07:47
-
-
Save markhc/a01cd8b2954fbcd498fb0ec2a78a0ec8 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
NTSTATUS RDrvInjectModule( | |
IN PINJECT_MODULE pInput, | |
OUT PINJECT_MODULE_RESULT pOutput | |
) { | |
NTSTATUS status = STATUS_SUCCESS; | |
PEPROCESS pProcess = NULL; | |
KAPC_STATE apc; | |
status = PsLookupProcessByProcessId((HANDLE)pInput->TargetProcessId, &pProcess); | |
if(NT_SUCCESS(status)) { | |
KeStackAttachProcess(pProcess, &apc); | |
if(pInput->InjectionType == InjectLdrLoadDll) | |
status = RDrvInjectLdrLoadDll(pProcess, pInput->ModulePath, &pOutput->ModuleBaseAddress); | |
else | |
status = RDrvInjectManualMap(pProcess, pInput->ModulePath, &pOutput->ModuleBaseAddress); | |
if(NT_SUCCESS(status)) { | |
if(pInput->ErasePE == TRUE) { | |
RDrvStripHeaders((PVOID)pOutput->ModuleBaseAddress); | |
} | |
if(pInput->HideModule == TRUE) { | |
RDrvHideFromLoadedList(pProcess, (PVOID)pOutput->ModuleBaseAddress); | |
} | |
} | |
KeUnstackDetachProcess(&apc); | |
} else | |
RDRVLOG("%s: PsLookupProcessByProcessId failed with status %lX", __FUNCTION__, status); | |
if(pProcess) | |
ObDereferenceObject(pProcess); | |
return status; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment