Injector thread worker Injection context Error code
| 499 | /// <param name="context">Injection context</param> |
| 500 | /// <returns>Error code</returns> |
| 501 | NTSTATUS InjectionCore::InjectSingle( InjectContext& context, blackbone::pe::PEImage& img ) |
| 502 | { |
| 503 | NTSTATUS status = ERROR_SUCCESS; |
| 504 | blackbone::ThreadPtr pThread; |
| 505 | blackbone::ModuleDataPtr mod; |
| 506 | uint32_t exportRVA = 0; |
| 507 | |
| 508 | xlog::Critical( "Injecting image '%ls'", img.path().c_str() ); |
| 509 | |
| 510 | // Check export |
| 511 | status = ValidateInit( blackbone::Utils::WstringToUTF8( context.cfg.initRoutine ), exportRVA, img ); |
| 512 | if (!NT_SUCCESS( status )) |
| 513 | { |
| 514 | xlog::Error( "Image init routine check failed, status: 0x%X", status ); |
| 515 | return status; |
| 516 | } |
| 517 | |
| 518 | // Final sanity check |
| 519 | if (context.cfg.injectMode < Kernel_Thread || context.cfg.injectMode == Kernel_DriverMap) |
| 520 | { |
| 521 | if (!NT_SUCCESS( status = ValidateContext( context, img ) )) |
| 522 | { |
| 523 | xlog::Error( "Context validation failed, status: 0x%X", status ); |
| 524 | return status; |
| 525 | } |
| 526 | } |
| 527 | |
| 528 | // Get context thread |
| 529 | if (context.cfg.hijack && context.cfg.injectMode < Kernel_Thread) |
| 530 | { |
| 531 | xlog::Normal( "Searching for thread to hijack" ); |
| 532 | pThread = _process.threads().getMostExecuted(); |
| 533 | if (!pThread) |
| 534 | { |
| 535 | Message::ShowError( _hMainDlg, L"Failed to get suitable thread for execution"); |
| 536 | return status = STATUS_NOT_FOUND; |
| 537 | } |
| 538 | } |
| 539 | |
| 540 | auto modCallback = []( blackbone::CallbackType type, void*, blackbone::Process&, const blackbone::ModuleData& modInfo ) |
| 541 | { |
| 542 | if (type == blackbone::PreCallback) |
| 543 | { |
| 544 | if (modInfo.name == L"user32.dll") |
| 545 | return blackbone::LoadData( blackbone::MT_Native, blackbone::Ldr_Ignore ); |
| 546 | } |
| 547 | |
| 548 | return blackbone::LoadData( blackbone::MT_Default, blackbone::Ldr_Ignore ); |
| 549 | }; |
| 550 | |
| 551 | // Actual injection |
| 552 | if (NT_SUCCESS( status )) |
| 553 | { |
| 554 | switch (context.cfg.injectMode) |
| 555 | { |
| 556 | case Normal: |
| 557 | { |
| 558 | auto injectedMod = InjectDefault( context, img, pThread ); |