Method CallInitRoutine

src/InjectionCore.cpp:746–784

Call initialization routine Injection context Target module Context thread of execution Error code

/// <param name="pThread">Context thread of execution</param>
/// <returns>Error code</returns>
NTSTATUS InjectionCore::CallInitRoutine(
    InjectContext& context,
    const blackbone::pe::PEImage& img,
    blackbone::ModuleDataPtr mod,
    uint64_t exportRVA,
    blackbone::ThreadPtr pThread /*= nullptr*/
    )
{
    // Call init for native image
    if (!context.cfg.initRoutine.empty() && !img.pureIL() && context.cfg.injectMode < Kernel_Thread)
    {
        auto fnPtr = mod->baseAddress + exportRVA;

        xlog::Normal( "Calling initialization routine for image '%ls'", img.path().c_str() );

        // Create new thread
        if (pThread == nullptr)
        {
            auto argMem = _process.memory().Allocate( 0x1000, PAGE_READWRITE );
            if (!argMem)
                return argMem.status;

            argMem->Write( 0, context.cfg.initArgs.length() * sizeof( wchar_t ) + 2, context.cfg.initArgs.c_str() );
            auto status = _process.remote().ExecDirect( fnPtr, argMem->ptr() );

            xlog::Normal( "Initialization routine returned 0x%X", status );
        }
        // Execute in existing thread
        else
        {
            blackbone::RemoteFunction<fnInitRoutine> pfn( _process, fnPtr );
            auto status = pfn.Call( context.cfg.initArgs.c_str(), pThread );

            xlog::Normal( "Initialization routine returned 0x%X", status );
        }
    }

    return STATUS_SUCCESS;
}