Исходник инжектора на AutoIT3

[Getsuga =)]

#NoTrayIcon
#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_icon=ModuleSpy.ico
#AutoIt3Wrapper_Compression=4
#AutoIt3Wrapper_Res_Comment=View and unload modules in a process, or inject a module into a process.
#AutoIt3Wrapper_Res_Description=ModuleSpy
#AutoIt3Wrapper_Res_Fileversion=1.0.0.1
#AutoIt3Wrapper_Res_LegalCopyright=by Erik Pilsits
#AutoIt3Wrapper_Res_Language=1033
#AutoIt3Wrapper_Res_requestedExecutionLevel=asInvoker
#AutoIt3Wrapper_Run_Obfuscator=y
#Obfuscator_Parameters=/striponly
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****

Opt("MustDeclareVars", 1)
Opt("GUIOnEventMode", 1)
Opt("GUICloseOnESC", 0)

#include <GuiListView.au3>
#include <WindowsConstants.au3>
#include <GuiConstantsEx.au3>
#include <GUITooltip.au3>

_GetPrivilege_SEDEBUG()

Global $PSAPI = DllOpen("psapi.dll")
Global $g_aProcs, $g_aMods
Global $g_LoadLibraryA, $g_FreeLibrary
Global $LV_tooltiptext = DllStructCreate("char[1024]") ; structure for LV tooltips
Global $oWMI = ObjGet("winmgmts:{impersonationLevel=impersonate,authenticationLevel=pktPrivacy, (Debug)}!\\.\root\cimv2")
Global $borderoffset = _WinAPI_GetSystemMetrics(4) + _WinAPI_GetSystemMetrics(32) ; SM_CYCAPTION + SM_CXSIZEFRAME

Global $gui = GUICreate("ModuleSpy", 800, 400, -1, -1, BitOR($GUI_SS_DEFAULT_GUI, $WS_SIZEBOX))
; listviews
Global $hLV1 = _GUICtrlListView_Create($gui, "Process|PID", 0, 0, 220, 350, BitOR($LVS_SHOWSELALWAYS, $LVS_SINGLESEL, $LVS_NOSORTHEADER, $LVS_REPORT), $WS_EX_CLIENTEDGE)
_GUICtrlListView_SetExtendedListViewStyle($hLV1, BitOR($LVS_EX_GRIDLINES, $LVS_EX_DOUBLEBUFFER, $LVS_EX_FULLROWSELECT, $LVS_EX_INFOTIP, $LVS_EX_LABELTIP), _
											BitOR($LVS_EX_GRIDLINES, $LVS_EX_DOUBLEBUFFER, $LVS_EX_FULLROWSELECT, $LVS_EX_INFOTIP, $LVS_EX_LABELTIP))
_GUICtrlListView_SetColumnWidth($hLV1, 0, 150)
_GUICtrlListView_SetColumnWidth($hLV1, 1, $LVSCW_AUTOSIZE_USEHEADER)
Global $hLV2 = _GUICtrlListView_Create($gui, "Module|Base Address|Path", 220, 0, 800-220, 350, BitOR($LVS_SHOWSELALWAYS, $LVS_SINGLESEL, $LVS_NOSORTHEADER, $LVS_REPORT), $WS_EX_CLIENTEDGE)
_GUICtrlListView_SetExtendedListViewStyle($hLV2, BitOR($LVS_EX_GRIDLINES, $LVS_EX_DOUBLEBUFFER, $LVS_EX_FULLROWSELECT, $LVS_EX_INFOTIP, $LVS_EX_LABELTIP), _
											BitOR($LVS_EX_GRIDLINES, $LVS_EX_DOUBLEBUFFER, $LVS_EX_FULLROWSELECT, $LVS_EX_INFOTIP, $LVS_EX_LABELTIP))
_GUICtrlListView_SetColumnWidth($hLV2, 0, 150)
_GUICtrlListView_SetColumnWidth($hLV2, 1, $LVSCW_AUTOSIZE_USEHEADER)
_GUICtrlListView_SetColumnWidth($hLV2, 2, $LVSCW_AUTOSIZE_USEHEADER)
; buttons
Global $LV1Refresh = GUICtrlCreateButton("Refresh", 4, 355, 50, 25)
GUICtrlSetResizing(-1, BitOR($GUI_DOCKLEFT, $GUI_DOCKWIDTH, $GUI_DOCKBOTTOM, $GUI_DOCKHEIGHT))
Global $LV2Refresh = GUICtrlCreateButton("Refresh", 228, 355, 50, 25)
GUICtrlSetResizing(-1, BitOR($GUI_DOCKLEFT, $GUI_DOCKWIDTH, $GUI_DOCKBOTTOM, $GUI_DOCKHEIGHT))
Global $UnloadModule = GUICtrlCreateButton("Unload Module", 282, 335, 85, 25)
GUICtrlSetResizing(-1, BitOR($GUI_DOCKLEFT, $GUI_DOCKWIDTH, $GUI_DOCKBOTTOM, $GUI_DOCKHEIGHT))
Global $InjectModule = GUICtrlCreateButton("Inject Module", 371, 335, 85, 25)
GUICtrlSetResizing(-1, BitOR($GUI_DOCKLEFT, $GUI_DOCKWIDTH, $GUI_DOCKBOTTOM, $GUI_DOCKHEIGHT))

GUIRegisterMsg($WM_NOTIFY, "_MY_WM_NOTIFY")
GUIRegisterMsg($WM_SIZING, "_MY_WM_SIZE")

GUISetOnEvent($GUI_EVENT_CLOSE, "_Exit")

GUICtrlSetOnEvent($LV1Refresh, "_RefreshProcs")
GUICtrlSetOnEvent($LV2Refresh, "_RefreshMods")
GUICtrlSetOnEvent($UnloadModule, "_UnloadModule")
GUICtrlSetOnEvent($InjectModule, "_InjectModule")

_GetOffsets()
_UpdateProcs()

; get values for resizing
Global $GUIpos = WinGetPos($gui)
Global $LV1pos = ControlGetPos($gui, "", $hLV1)
Global $LV2Pos = ControlGetPos($gui, "", $hLV2)

GUISetState()

While 1
	Sleep(1000)
WEnd

Func _Exit()
	DllClose($PSAPI)
	Exit
EndFunc

Func _GetOffsets()
	; get LoadLibraryA and FreeLibrary offsets from kernel32.dll base address
	Local $hKernel32 = _WinAPI_LoadLibrary("kernel32.dll")
	$g_LoadLibraryA = _GetProcAddress($hKernel32, "LoadLibraryA") - $hKernel32
	$g_FreeLibrary = _GetProcAddress($hKernel32, "FreeLibrary") - $hKernel32
	_WinAPI_FreeLibrary($hKernel32)
EndFunc

Func _MY_WM_NOTIFY($hWnd, $iMsg, $iwParam, $ilParam)
	Local $tNMHDR = DllStructCreate($tagNMLVGETINFOTIP, $ilParam)
    Local $hWndFrom = HWnd(DllStructGetData($tNMHDR, "hWndFrom"))
;~     Local $iIDFrom = DllStructGetData($tNMHDR, "IDFrom")
    Local $iCode = DllStructGetData($tNMHDR, "Code")
    Switch $hWndFrom
        Case $hLV1
            Switch $iCode
				Case $NM_CLICK
					Local $idx = _GUICtrlListView_GetSelectedIndices($hLV1)
					If $idx <> "" Then
						_UpdateMods(Number($idx))
					Else
						_GUICtrlListView_DeleteAllItems($hLV2)
					EndIf
			EndSwitch
	EndSwitch

	Return $GUI_RUNDEFMSG
EndFunc

Func _MY_WM_SIZE($hWnd, $iMsg, $iwParam, $ilParam)
	; resize owner controls
	Local $tRECT = DllStructCreate($tagRECT, $ilParam)
	Local $newheight = DllStructGetData($tRECT, "Bottom") - DllStructGetData($tRECT, "Top")
	Local $newwidth = DllStructGetData($tRECT, "Right") - DllStructGetData($tRECT, "Left")
	; original control height/width + difference in new GUI height/width
	Local $controlheight = $LV1pos[3] + ($newheight - $GUIpos[3]) ; same for both listviews
	ControlMove($gui, "", $hLV1, $LV1pos[0], $LV1pos[1], $LV1pos[2], $controlheight)
	ControlMove($gui, "", $hLV2, $LV2pos[0], $LV2pos[1], $LV2Pos[2] + ($newwidth - $GUIpos[2]), $controlheight)
EndFunc

Func _UpdateProcs()
	_GUICtrlListView_BeginUpdate($hLV1)
	_GUICtrlListView_DeleteAllItems($hLV1)
	$g_aProcs = _EnumProcesses() ;=это список процессов
	If IsArray($g_aProcs) Then
		_ArraySort($g_aProcs, 0, 0, 0, 1)
		For $i = 0 To UBound($g_aProcs) - 1
			_GUICtrlListView_AddItem($hLV1, $g_aProcs[$i][1]) ;Название процесса
			_GUICtrlListView_AddSubItem($hLV1, $i, $g_aProcs[$i][0], 1) ; Пид
		Next
	EndIf
	_GUICtrlListView_EndUpdate($hLV1)
EndFunc

Func _EnumProcesses()
	; enumerate processes and build array
	Local $aProc
	Local $pids = DllStructCreate("dword[1024]")
	Local $ret = DllCall($PSAPI, "int", "EnumProcesses", "ptr", DllStructGetPtr($pids), "dword", DllStructGetSize($pids), "dword*", 0)
	If $ret[3] > 0 Then
		Local $numpids = $ret[3] / 4 ; number of pids
		Local $aProc[$numpids][2]
		For $i = 1 To $numpids
			$aProc[$i - 1][0] = DllStructGetData($pids, 1, $i) ; process pid
			$aProc[$i - 1][1] = "System" ; process name
			; open the process and get the filename
			Local $hProcess = _GetProcHandle(DllStructGetData($pids, 1, $i))
			If $hProcess Then
				Local $name = _GetModuleBaseNameW($hProcess)
				If $name Then $aProc[$i - 1][1] = $name
				_WinAPI_CloseHandle($hProcess)
			EndIf
		Next
	EndIf
	$pids = 0

	Return $aProc
EndFunc

Func _GetModuleBaseNameW($hProcess, $hModule = 0)
	Local $name = ""
	Local $ret = DllCall($PSAPI, "dword", "GetModuleBaseNameW", "ptr", $hProcess, "ptr", $hModule, "wstr", "", "dword", 260)
	If $ret[0] Then
		$name = $ret[3]
	EndIf

	Return $name
EndFunc

Func _GetModuleFileNameW($hProcess, $hModule = 0)
	Local $path = ""
	Local $ret = DllCall($PSAPI, "dword", "GetModuleFileNameExW", "ptr", $hProcess, "ptr", $hModule, "wstr", "", "dword", 260)
	If $ret[0] Then
		$path = $ret[3]
	EndIf

	Return $path
EndFunc

Func _UpdateMods($idx)
	_GUICtrlListView_BeginUpdate($hLV2)
	_GUICtrlListView_DeleteAllItems($hLV2)
	$g_aMods = _EnumModules($g_aProcs[$idx][0]) ;Сюда ПИД процессса
	If IsArray($g_aMods) Then
		_ArraySort($g_aMods, 0, 0, 0, 1)
		For $i = 0 To UBound($g_aMods) - 1
			_GUICtrlListView_AddItem($hLV2, $g_aMods[$i][1])
			_GUICtrlListView_AddSubItem($hLV2, $i, $g_aMods[$i][0], 1)
			_GUICtrlListView_AddSubItem($hLV2, $i, $g_aMods[$i][2], 2)
		Next
	EndIf
	_GUICtrlListView_EndUpdate($hLV2)
EndFunc

Func _EnumModules($process)
	; enumerate all modules in a process
	Local $aMods
	Local $hProcess = _GetProcHandle($process)
	If $hProcess Then
		Local $modules = DllStructCreate("ptr[1024]")
		Local $ret = DllCall($PSAPI, "int", "EnumProcessModules", "ptr", $hProcess, "ptr", DllStructGetPtr($modules), "dword", DllStructGetSize($modules), "dword*", 0)
		If $ret[4] > 0 Then
			Local $nummods = $ret[4] / 4
			Local $aMods[$nummods][3]
			For $i = 1 To $nummods
				$aMods[$i - 1][0] = DllStructGetData($modules, 1, $i) ; base address
				$aMods[$i - 1][1] = "n/a" ; module name
				$aMods[$i - 1][2] = "n/a" ; module path
				Local $name = _GetModuleBaseNameW($hProcess, Ptr($aMods[$i - 1][0]))
				If $name Then $aMods[$i - 1][1] = $name
				Local $path = _GetModuleFileNameW($hProcess, Ptr($aMods[$i - 1][0]))
				If $path Then $aMods[$i - 1][2] = $path
			Next
		EndIf
		_WinAPI_CloseHandle($hProcess)
		$modules = 0
	EndIf

	Return $aMods
EndFunc

Func _RefreshProcs()
	_GUICtrlListView_DeleteAllItems($hLV2)
	_UpdateProcs()
EndFunc

Func _RefreshMods()
	Local $idx = _GUICtrlListView_GetSelectedIndices($hLV1)
	If $idx <> "" Then _UpdateMods(Number($idx))
EndFunc

Func _InjectModule()
	Local $err = 0, $hModule = 0
	Local $procidx = _GUICtrlListView_GetSelectedIndices($hLV1) ;Какая строчка выделенна
	MsgBox(0,$procidx,$hLV1)
	If $procidx == "" Then
		$err = 1
	Else
		Local $dllpath = FileOpenDialog("Inject Module into " & $g_aProcs[Number($procidx)][1] & "...", @DesktopDir, "Modules (*.dll)", 3, "", $gui)
		If @error Then
			$err = 2
		Else
			If StringRight($dllpath, 4) <> ".dll" Then
				$err = 3
			Else
				Local $hProcess = _GetProcHandle($g_aProcs[Number($procidx)][0])
				MsgBox(1,$hProcess,Binary($hProcess))
				If Not $hProcess Then
					$err = 4
				Else
					; allocate memory in remote process for dll path
					MsgBox(0,0,$MEM_COMMIT&'!'&$PAGE_READWRITE)
					Local $pMem = _MemVirtualAllocEx($hProcess, 0, 260, $MEM_COMMIT, $PAGE_READWRITE)
					MsgBox(0,$pMem,$pMem&'!'&$MEM_COMMIT&'!'&$PAGE_READWRITE)
					If Not $pMem Then
						$err = 5
					Else
						; write dll path to remote process
						Local $ret = DllCall("kernel32.dll", "int", "WriteProcessMemory", "ptr", $hProcess, "ptr", $pMem, "str", $dllpath, "uint", 260, "uint*", 0)
						MsgBox(0,$ret[5],$ret[5])
						If $ret[5] <> 260 Then
							$err = 6
						Else
							; get LoadLibraryA address and call the remote thread with a pointer to the dll path
							Local $kernelidx = _ArraySearch($g_aMods, "kernel32.dll", 0, 0, 0, 0, 1, 1)
							MsgBox(0,$kernelidx,$kernelidx)
							If $kernelidx == -1 Then
								$err = 7
							Else
								Local $LoadLibraryA = $g_aMods[$kernelidx][0] + $g_LoadLibraryA ; add offset to base address
								$ret = DllCall("kernel32.dll", "ptr", "CreateRemoteThread", "ptr", $hProcess, "ptr", 0, "uint", 0, "ptr", $LoadLibraryA, "ptr", $pMem, "dword", 0, "ptr", 0)
								MsgBox(0,$ret[0],$ret[0])
								If Not $ret[0] Then
									$err = 8 ; create remote thread failed
								Else
									Local $hThread = $ret[0]
									_WinAPI_WaitForSingleObject($hThread) ; wait for thread to finish
									; get thread return value, which is the HMODULE (base address) of the injected dll
									$ret = DllCall("kernel32.dll", "int", "GetExitCodeThread", "ptr", $hThread, "dword*", 0)
									MsgBox(0,$ret[2],$ret[2])
									$hModule = Ptr($ret[2])
									MsgBox(0,$hModule,$hModule)
									_WinAPI_CloseHandle($hThread) ; close thread handle
								EndIf
							EndIf
						EndIf
						_MemVirtualFreeEx($hProcess, $pMem, 260, $MEM_DECOMMIT) ; release memory for dll path
					EndIf
					_WinAPI_CloseHandle($hProcess)
				EndIf
			EndIf
		EndIf
	EndIf

	_RefreshMods()

	Return SetError($err, 0, $hModule)
EndFunc

Func _UnloadModule()
	Local $err = 0, $return = 0
	Local $procidx = _GUICtrlListView_GetSelectedIndices($hLV1)
	If $procidx == "" Then
		$err = 1
	Else
		Local $modidx = _GUICtrlListView_GetSelectedIndices($hLV2)
		If $modidx == "" Then
			$err = 2
		Else
			Local $hModule = $g_aMods[Number($modidx)][0]
			MsgBox(0,$hModule,$modidx)
			Local $hProcess = _GetProcHandle($g_aProcs[Number($procidx)][0])
			If Not $hProcess Then
				$err = 3
			Else
				; get FreeLibrary address and call the remote thread with a pointer to hModule
				Local $kernelidx = _ArraySearch($g_aMods, "kernel32.dll", 0, 0, 0, 0, 1, 1)
				If $kernelidx == -1 Then
					$err = 4
				Else
					Local $FreeLibrary = $g_aMods[$kernelidx][0] + $g_FreeLibrary ; add offset to base address
					Local $ret = DllCall("kernel32.dll", "ptr", "CreateRemoteThread", "ptr", $hProcess, "ptr", 0, "uint", 0, "ptr", $FreeLibrary, "ptr", $hModule, "dword", 0, "ptr", 0)
					If Not $ret[0] Then
						$err = 4 ; create remote thread failed
					Else
						_WinAPI_WaitForSingleObject($ret[0]) ; wait for thread to finish
						_WinAPI_CloseHandle($ret[0]) ; close thread handle
					EndIf
				EndIf
				_WinAPI_CloseHandle($hProcess)
			EndIf
		EndIf
	EndIf

	_RefreshMods()

	If $err Then $return = 1
	Return SetError($err, 0, $return)
EndFunc

Func _GetProcAddress($module, $function)
	Local $call = DllCall("kernel32.dll", "ptr", "GetProcAddress", "ptr", $module, "str", $function)
	Return $call[0]
EndFunc

Func _GetProcHandle($process)
	Local $hProcess = 0
	Local $PERMISSION = BitOR(0x0002, 0x0400, 0x0008, 0x0010, 0x0020) ; CREATE_THREAD, QUERY_INFORMATION, VM_OPERATION, VM_READ, VM_WRITE

	If IsInt($process) Then
		If $process > 0 Then
			Local $ret = DllCall("kernel32.dll", "ptr", "OpenProcess", "dword", $PERMISSION, "int", 0, "dword", $process)
			If $ret[0] Then
				$hProcess = $ret[0]
			EndIf
		EndIf
	EndIf

	Return $hProcess
EndFunc

Func _GetPrivilege_SEDEBUG()
    Local $tagLUIDANDATTRIB = "int64 Luid;dword Attributes"
    Local $count = 1
    Local $tagTOKENPRIVILEGES = "dword PrivilegeCount;byte LUIDandATTRIB[" & $count * 12 & "]" ; count of LUID structs * sizeof LUID struct
    Local $TOKEN_ADJUST_PRIVILEGES = 0x20

    Local $call = DllCall("advapi32.dll", "int", "OpenProcessToken", "ptr", _WinAPI_GetCurrentProcess(), "dword", $TOKEN_ADJUST_PRIVILEGES, "ptr*", "")
    Local $hToken = $call[3]

    $call = DllCall("advapi32.dll", "int", "LookupPrivilegeValue", "str", Chr(0), "str", "SeDebugPrivilege", "int64*", "")
    Local $iLuid = $call[3]

    Local $TP = DllStructCreate($tagTOKENPRIVILEGES)
    Local $LUID = DllStructCreate($tagLUIDANDATTRIB, DllStructGetPtr($TP, "LUIDandATTRIB"))

    DllStructSetData($TP, "PrivilegeCount", $count)
    DllStructSetData($LUID, "Luid", $iLuid)
    DllStructSetData($LUID, "Attributes", $SE_PRIVILEGE_ENABLED)

    $call = DllCall("advapi32.dll", "int", "AdjustTokenPrivileges", "ptr", $hToken, "int", 0, "ptr", DllStructGetPtr($TP), "dword", 0, "ptr", Chr(0), "ptr", Chr(0))
    Return ($call[0] <> 0) ; $call[0] <> 0 is success
EndFunc   ;==>_GetPrivilege_SEDEBUG

Цитата: Вот, собственно, код. Показывает модули в выбраном процессе, подгружает выбранные DLL и показывает какие то базовые байты модулей. ЗЫ: код подкинули, просто искал инжектор со всякими прибамбасами, решил поделиться. Удачи!

[Ссылки могут видеть только зарегистрированные пользователи. ]

ЗЫ: кому надо будет готовый проект, пишите.

[Skilful]

Цитата: Сообщение от Getsuga =) показывает какие то базовые байты модулей.

//базовые адреса входа в процесс модуля.
мы определяем данные адреса в вх функциями

Цитата: GetModuleHandleA("module.dll")

[Dimedrol1536]

Цитата: Сообщение от **TOR** Ну виложил бы сразу готовый проэкт этио намного удобней чем писать что то ,кому то ,а так надо скачал и все.

Халявщик, сам напиши что-то.

[Dimedrol1536]

Цитата: Сообщение от **TOR** что сам халявщик

За словами следи.

[Dimedrol1536]

Цитата: Сообщение от **TOR** Тебе бы то же не помешало следить за своими словами.Тебя как послушать так все халявщики прежде чем писать что то подумай.

[Шварцнегр=)]

Вот закомпилиный инжектор
[Ссылки могут видеть только зарегистрированные пользователи. ]

[Getsuga =)]

Прошу почистить тему.

Цитата: Сообщение от **TOR** Mathers У меня еще остались сообщения!!Ты их че не заметил?

Овер действуе по правилам, удаляет твой флуд.
А ещё удивляешься, почему твои сообщения удаляют.