Method load_dll

src/shellcode.cpp:208–255

Load the dll base by name.

// Load the dll base by name.
HANDLE shellcode::load_dll(HANDLE pe_base, PDWORD sh_funs, PCHAR dll_name)
{
    // Resolving the needed functions.
    auto fun_ansi_to_wide = sh_resolve(pe_base, sh_funs, ansi_to_wide);
    auto fun_get_dll_handle = sh_resolve(pe_base, sh_funs, get_dll_handle);
    auto fun_get_symbol_ptr = sh_resolve(pe_base, sh_funs, get_symbol_ptr);
    auto fun_wstr_len = sh_resolve(pe_base, sh_funs, wstr_len);
    auto fun_hash_string = sh_resolve(pe_base, sh_funs, hash_string);

    // Converting the dll name.
    WCHAR dll_buffer[MAX_PATH];
    fun_ansi_to_wide(dll_name, dll_buffer, sizeof(dll_buffer));

    // Quering the ldr first.
    HANDLE h_dll = fun_get_dll_handle(pe_base, sh_funs, dll_buffer);
    if (h_dll) return h_dll;

    // Getting the base of the ntdll.
    WCHAR ntdll_name[] = { L'n', L't', L'd', L'l', L'l', L'.', L'd', L'l', L'l', L'\0' };
    HANDLE h_ntdll = fun_get_dll_handle(pe_base, sh_funs, ntdll_name);
    if (!h_ntdll) return NULL;

    // Resolving `LdrLoadDll` to load the new dll.
    u_sym_info ldr_load_dll_info;
    CHAR ldrloaddll_name[] = { 'L', 'd', 'r', 'L', 'o', 'a', 'd', 'D', 'l', 'l', '\0' };
    ldr_load_dll_info.sym_hash = fun_hash_string(ldrloaddll_name);
    pLdrLoadDll fLdrLoadDll = (pLdrLoadDll)fun_get_symbol_ptr(pe_base, sh_funs, h_ntdll, ldr_load_dll_info, TRUE);
    if (fLdrLoadDll == NULL) {
        return NULL;
    };

    // Loading the required dll using `LdrLoadDll`.
    UNICODE_STRING u_module = {
        (USHORT)(fun_wstr_len(dll_buffer) * 2),
        (USHORT)(fun_wstr_len(dll_buffer) * 2 + 2),
        (PWCHAR)dll_buffer
    };

    // Loading the dll.
    if (!NT_SUCCESS(fLdrLoadDll(
        NULL, 0,
        &u_module,
        &h_dll
    ))) return NULL;

    // Return the loaded module base.
    return h_dll;
};

// Resolve the api set schema for the dll name.
BOOL shellcode::resolve_api_set(HANDLE pe_base, PDWORD sh_funs, PVOID schema_map, PCWSTR virtual_dll, PWCHAR real_dll)