Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add ManualMap support #12

Closed
wants to merge 9 commits into from
Closed

Add ManualMap support #12

wants to merge 9 commits into from

Conversation

CasualX
Copy link
Owner

@CasualX CasualX commented Jan 7, 2018

Adds an extension method mmap(self) on all 'a, P: Pe<'a> + Copy which will manually map the module and prepare it for execution.

The scope of this PR is to prepare a DLL image for execution inside the calling process (no DLL injection).

@CasualX CasualX mentioned this pull request Jan 7, 2018
@CasualX
Copy link
Owner Author

CasualX commented Jan 7, 2018

TLS support is iffy, the tests are crashing when trying to call a method from the demo dll.

The code from Dummy64.dll, annotated, is

; int __cdecl fnPasswdsBypass(void)
; Load the tls index
mov         ecx,dword ptr [__tls_index]
; Load the ThreadLocalStoragePointer from the TEB
mov         rax,qword ptr gs:[58h]
mov         edx,1
; Load the TLS pointer for our module, here it goes wrong and returns garbage
; If you look at TlsSetValue in KernelBase.dll you see it saved the tls pointer to
; 	mov         qword ptr [rdi+rbx*8+1480h],rdx
; Note the offset of 0x1480 and lacking offset in demo code
mov         rax,qword ptr [rax+rcx*8]
mov         byte ptr [rdx+rax],1
mov         eax,2Ah
ret

I compiled the demo on Windows 7 before I upgraded to Windows 10 maybe that has something to do with this? Idk.

@CasualX CasualX force-pushed the features/manualmap branch 4 times, most recently from 2748fd3 to 734bcc4 Compare January 11, 2018 17:45
@chtotut
Copy link

chtotut commented Apr 22, 2019

Is this PR proof of concept only?
Do you plan to add this functionality to the library?

@CasualX
Copy link
Owner Author

CasualX commented Apr 22, 2019

In its current state it is a proof of concept:

  • I remain undecided on the API
  • TLS issues (see above) that I am unable to solve in a satisfying manner without hacking it with inline assembly
  • I am mainly motivated by my own use cases and I haven't had a need for manual mapping recently

I don't foresee this changing any time soon.

@CasualX CasualX closed this Apr 22, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants