| 184 | |
| 185 | |
| 186 | BOOL LoadFileFromMemory(HANDLE hProcess, LPVOID lpDll, DWORD Flags, WDLL*& wFile) |
| 187 | { |
| 188 | |
| 189 | PIMAGE_SECTION_HEADER SectionHeaders = 0; |
| 190 | LPVOID lpwDll = 0, lpwThread = 0; |
| 191 | HANDLE hThread = 0; |
| 192 | BOOL Status = TRUE; |
| 193 | DWORD_PTR Functions[9]; |
| 194 | SIZE_T Written = 0; |
| 195 | ZeroMemory(Functions, 9); |
| 196 | |
| 197 | typedef NTSTATUS(NTAPI*_RtlCreateUserThread)(HANDLE Process, PSECURITY_DESCRIPTOR ThreadSecurityDescriptor, BOOLEAN CreateSuspended, ULONG_PTR ZeroBits, SIZE_T MaximumStackSize, SIZE_T CommittedStackSize, PVOID StartAddress, PVOID Parameter, PHANDLE Thread, PVOID ClientId); |
| 198 | static _RtlCreateUserThread RtlCreateUserThread = reinterpret_cast<_RtlCreateUserThread>(GetProcAddress(GetModuleHandle("ntdll.dll"), "RtlCreateUserThread")); |
| 199 | |
| 200 | if (!wFile) |
| 201 | { |
| 202 | SetLastError(1890); |
| 203 | return 0; |
| 204 | } |
| 205 | wFile->Module = reinterpret_cast<HMODULE>(lpDll); |
| 206 | if (!wFile->Module) |
| 207 | { |
| 208 | SetLastError(1790); |
| 209 | return 0; |
| 210 | } |
| 211 | wFile->DosHeader = reinterpret_cast<PIMAGE_DOS_HEADER>(wFile->Module); |
| 212 | if (wFile->DosHeader && |
| 213 | wFile->DosHeader->e_magic != IMAGE_DOS_SIGNATURE) |
| 214 | { |
| 215 | SetLastError(1792); |
| 216 | return 0; |
| 217 | } |
| 218 | wFile->NtHeader = reinterpret_cast<PIMAGE_NT_HEADERS>((reinterpret_cast<DWORD_PTR>(wFile->Module) + wFile->DosHeader->e_lfanew)); |
| 219 | if (!wFile->NtHeader || |
| 220 | wFile->NtHeader->Signature != IMAGE_NT_SIGNATURE) |
| 221 | { |
| 222 | |
| 223 | SetLastError(1793); |
| 224 | return 0; |
| 225 | } |
| 226 | |
| 227 | if (!(wFile->NtHeader->FileHeader.Characteristics & IMAGE_FILE_DLL) && |
| 228 | !(wFile->NtHeader->FileHeader.Characteristics & IMAGE_FILE_EXECUTABLE_IMAGE)) |
| 229 | { |
| 230 | |
| 231 | SetLastError(1794); |
| 232 | return 0; |
| 233 | } |
| 234 | |
| 235 | |
| 236 | #if defined _M_X64 |
| 237 | if (wFile->NtHeader->FileHeader.Machine != IMAGE_FILE_MACHINE_AMD64 && |
| 238 | wFile->NtHeader->FileHeader.Machine != IMAGE_FILE_MACHINE_IA64) |
| 239 | { |
| 240 | |
| 241 | SetLastError(1795); |
| 242 | return 0; |
| 243 | } |
no test coverage detected