| 511 | return reinterpret_cast<FARPROC>((reinterpret_cast<DWORD*>((ImageDirectory->AddressOfFunctions + reinterpret_cast<DWORD_PTR>(wDll->Image)))[Oridinal] + reinterpret_cast<DWORD_PTR>(wDll->Image))); |
| 512 | } |
| 513 | BOOL UnloadFile(WDLL* wDll) |
| 514 | { |
| 515 | |
| 516 | |
| 517 | typedef NTSTATUS(NTAPI*_RtlCreateUserThread)(HANDLE Process, PSECURITY_DESCRIPTOR ThreadSecurityDescriptor, BOOLEAN CreateSuspended, ULONG_PTR ZeroBits, SIZE_T MaximumStackSize, SIZE_T CommittedStackSize, PVOID StartAddress, PVOID Parameter, PHANDLE Thread, PVOID ClientId); |
| 518 | static _RtlCreateUserThread RtlCreateUserThread = reinterpret_cast<_RtlCreateUserThread>(GetProcAddress(GetModuleHandle("ntdll.dll"), "RtlCreateUserThread")); |
| 519 | |
| 520 | BOOL Result = TRUE; |
| 521 | LPVOID lpUnloadThread = 0, lpwDll = 0; |
| 522 | HANDLE hThread = 0; |
| 523 | |
| 524 | |
| 525 | |
| 526 | if (!(wDll->Flags & ManualMap_FLAGS::CALL_NO_ENTRYPOINT)) |
| 527 | { |
| 528 | if (wDll->Entrypoint) |
| 529 | { |
| 530 | lpwDll = VirtualAllocEx(wDll->hProcess, 0, 0x1000, MEM_COMMIT, PAGE_EXECUTE_READWRITE); |
| 531 | if (!lpwDll) |
| 532 | { |
| 533 | SetLastError(3000); |
| 534 | Result = FALSE; |
| 535 | } |
| 536 | if (!WriteProcessMemory(wDll->hProcess, lpwDll, wDll, 0x1000, 0)) |
| 537 | { |
| 538 | SetLastError(3000); |
| 539 | Result = FALSE; |
| 540 | } |
| 541 | lpUnloadThread = VirtualAllocEx(wDll->hProcess, 0, 0x1000, MEM_COMMIT, PAGE_EXECUTE_READWRITE); |
| 542 | if (!lpUnloadThread) |
| 543 | { |
| 544 | SetLastError(3000); |
| 545 | Result = FALSE; |
| 546 | } |
| 547 | if (!WriteProcessMemory(wDll->hProcess, lpUnloadThread, UnloadFile_Thread, 0x1000, 0)) |
| 548 | { |
| 549 | SetLastError(3000); |
| 550 | Result = FALSE; |
| 551 | } |
| 552 | if (RtlCreateUserThread(wDll->hProcess, 0, 0, 0, 0, 0, reinterpret_cast<PVOID>(lpUnloadThread), lpwDll, &hThread, 0)) |
| 553 | { |
| 554 | SetLastError(3000); |
| 555 | Result = FALSE; |
| 556 | } |
| 557 | |
| 558 | if (hThread) |
| 559 | WaitForSingleObject(hThread, INFINITE); |
| 560 | if (lpUnloadThread && |
| 561 | !VirtualFreeEx(wDll->hProcess, lpUnloadThread, 0x1000, MEM_DECOMMIT) || |
| 562 | lpwDll && |
| 563 | !VirtualFreeEx(wDll->hProcess, lpwDll, 0x1000, MEM_DECOMMIT)) |
| 564 | { |
| 565 | SetLastError(3000); |
| 566 | Result = FALSE; |
| 567 | } |
| 568 | } |
| 569 | } |
| 570 | if (wDll->Image) |
nothing calls this directly
no outgoing calls
no test coverage detected