Skip to content

Commit 1af4e81

Browse files
bb107bb107
committed
Test MMPP multiple initialization
1 parent 53885cd commit 1af4e81

6 files changed

Lines changed: 69 additions & 93 deletions

File tree

‎MemoryModule/Initialize.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ PMMP_GLOBAL_DATA MmpGlobalDataPtr;
1212
BOOLEAN MmpBuildSectionName(_Out_ PUNICODE_STRING SectionName) {
1313
WCHAR buffer[128];
1414

15-
wsprintfW(buffer, L"\\Sessions\\%d\\BaseNamedObjects\\MMPP%d", NtCurrentPeb()->SessionId, (unsigned int)NtCurrentProcessId());
15+
swprintf(buffer, L"\\Sessions\\%d\\BaseNamedObjects\\MMPP*%08X", NtCurrentPeb()->SessionId, (unsigned int)NtCurrentProcessId());
1616
return RtlCreateUnicodeString(SectionName, buffer);
1717
}
1818

‎a/a.vcxproj‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,7 @@
172172
</ItemDefinitionGroup>
173173
<ItemGroup>
174174
<ClCompile Include="dllmain.cpp" />
175+
<ClCompile Include="load.cpp" />
175176
</ItemGroup>
176177
<ItemGroup>
177178
<ClInclude Include="resource.h" />
@@ -183,6 +184,11 @@
183184
<None Include="binary1.bin" />
184185
<None Include="m.def" />
185186
</ItemGroup>
187+
<ItemGroup>
188+
<ProjectReference Include="..\MemoryModule\MemoryModule.vcxproj">
189+
<Project>{5b1f46db-036e-4a50-af5f-f5d6584d42c6}</Project>
190+
</ProjectReference>
191+
</ItemGroup>
186192
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
187193
<ImportGroup Label="ExtensionTargets">
188194
</ImportGroup>

‎a/a.vcxproj.filters‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@
1818
<ClCompile Include="dllmain.cpp">
1919
<Filter>Source Files</Filter>
2020
</ClCompile>
21+
<ClCompile Include="load.cpp">
22+
<Filter>Source Files</Filter>
23+
</ClCompile>
2124
</ItemGroup>
2225
<ItemGroup>
2326
<ClInclude Include="resource.h">

‎a/load.cpp‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
#include "../MemoryModule/stdafx.h"
2+
#include <cstdio>
3+
4+
static PVOID ReadDllFile(LPCSTR FileName) {
5+
LPVOID buffer;
6+
size_t size;
7+
FILE* f = fopen(FileName, "rb");
8+
if (!f)return 0;
9+
_fseeki64(f, 0, SEEK_END);
10+
if (!(size = _ftelli64(f))) {
11+
fclose(f);
12+
return 0;
13+
}
14+
_fseeki64(f, 0, SEEK_SET);
15+
fread(buffer = new char[size], 1, size, f);
16+
fclose(f);
17+
return buffer;
18+
}
19+
20+
int __stdcall test_user32() {
21+
HMODULE hModule;
22+
NTSTATUS status;
23+
PVOID buffer = ReadDllFile("C:\\Windows\\System32\\user32.dll");
24+
if (!buffer) return 0;
25+
26+
hModule = GetModuleHandleA("user32.dll");
27+
if (hModule)return 0;
28+
29+
status = LdrLoadDllMemoryExW(
30+
&hModule, // ModuleHandle
31+
nullptr, // LdrEntry
32+
0, // Flags
33+
buffer, // Buffer
34+
0, // Reserved
35+
L"user32.dll", // DllBaseName
36+
L"C:\\Windows\\System32\\user32.dll" // DllFullName
37+
);
38+
if (NT_SUCCESS(status) && status != STATUS_IMAGE_MACHINE_TYPE_MISMATCH) {
39+
40+
auto _MessageBoxW = (decltype(&MessageBoxW))GetProcAddress(hModule, "MessageBoxW");
41+
_MessageBoxW(nullptr, L"Hello, from memory user32!", L"Caption", MB_OK);
42+
43+
//
44+
// After calling MessageBox, we can't free it.
45+
//
46+
//LdrUnloadDllMemory(hModule);
47+
}
48+
49+
return 0;
50+
}

‎a/m.def‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,4 @@ test = __test__
44
thread
55
Socket = ws2_32.WSASocketW
66
VerifyTruse = wintrust.WinVerifyTrust
7+
test_user32

‎test/test.cpp‎

Lines changed: 8 additions & 92 deletions
Original file line numberDiff line numberDiff line change
@@ -18,110 +18,26 @@ static PVOID ReadDllFile(LPCSTR FileName) {
1818
return buffer;
1919
}
2020

21-
int test_a_dll() {
22-
LPVOID buffer = ReadDllFile("a.dll");
23-
24-
HMEMORYMODULE m1 = nullptr, m2 = m1;
25-
HMODULE hModule = nullptr;
26-
FARPROC pfn = nullptr;
27-
DWORD MemoryModuleFeatures = 0;
28-
29-
typedef int(*_exception)(int code);
30-
_exception exception = nullptr;
31-
HRSRC hRsrc;
32-
DWORD SizeofRes;
33-
HGLOBAL gRes;
34-
char str[10];
35-
36-
LdrQuerySystemMemoryModuleFeatures(&MemoryModuleFeatures);
37-
if (MemoryModuleFeatures != MEMORY_FEATURE_ALL) {
38-
printf("not support all features on this version of windows.\n");
39-
}
40-
41-
if (!NT_SUCCESS(LdrLoadDllMemoryExW(&m1, nullptr, 0, buffer, 0, L"kernel64", nullptr))) goto end;
42-
LoadLibraryW(L"wininet.dll");
43-
if (!NT_SUCCESS(LdrLoadDllMemoryExW(&m2, nullptr, 0, buffer, 0, L"kernel128", nullptr))) goto end;
44-
45-
//forward export
46-
hModule = (HMODULE)m1;
47-
pfn = (decltype(pfn))(GetProcAddress(hModule, "Socket")); //ws2_32.WSASocketW
48-
pfn = (decltype(pfn))(GetProcAddress(hModule, "VerifyTruse")); //wintrust.WinVerifyTrust
49-
hModule = (HMODULE)m2;
50-
pfn = (decltype(pfn))(GetProcAddress(hModule, "Socket"));
51-
pfn = (decltype(pfn))(GetProcAddress(hModule, "VerifyTruse"));
52-
53-
//exception
54-
hModule = (HMODULE)m1;
55-
exception = (_exception)GetProcAddress(hModule, "exception");
56-
if (exception) {
57-
for (int i = 0; i < 5; ++i)exception(i);
58-
}
59-
60-
//tls
61-
pfn = GetProcAddress(hModule, "thread");
62-
if (pfn && pfn()) {
63-
printf("thread test failed.\n");
64-
}
65-
66-
//resource
67-
if (!LoadStringA(hModule, 101, str, 10)) {
68-
printf("load string failed.\n");
69-
}
70-
else {
71-
printf("%s\n", str);
72-
}
73-
if (!(hRsrc = FindResourceA(hModule, MAKEINTRESOURCEA(102), "BINARY"))) {
74-
printf("find binary resource failed.\n");
75-
}
76-
else {
77-
if ((SizeofRes = SizeofResource(hModule, hRsrc)) != 0x10) {
78-
printf("invalid res size.\n");
79-
}
80-
else {
81-
if (!(gRes = LoadResource(hModule, hRsrc))) {
82-
printf("load res failed.\n");
83-
}
84-
else {
85-
if (!LockResource(gRes))printf("lock res failed.\n");
86-
else {
87-
printf("resource test success.\n");
88-
}
89-
}
90-
}
91-
}
92-
93-
end:
94-
delete[]buffer;
95-
if (m1)LdrUnloadDllMemory(m1);
96-
FreeLibrary(LoadLibraryW(L"wininet.dll"));
97-
FreeLibrary(GetModuleHandleW(L"wininet.dll"));
98-
if (m2)LdrUnloadDllMemory(m2);
99-
100-
return 0;
101-
}
102-
103-
int test_user32() {
21+
int test() {
10422
HMODULE hModule;
10523
NTSTATUS status;
106-
PVOID buffer = ReadDllFile("C:\\Windows\\System32\\user32.dll");
24+
PVOID buffer = ReadDllFile("a.dll");
10725
if (!buffer) return 0;
10826

109-
hModule = GetModuleHandleA("user32.dll");
110-
if (hModule)return 0;
111-
11227
status = LdrLoadDllMemoryExW(
11328
&hModule, // ModuleHandle
11429
nullptr, // LdrEntry
11530
0, // Flags
11631
buffer, // Buffer
11732
0, // Reserved
118-
L"user32.dll", // DllBaseName
119-
L"C:\\Windows\\System32\\user32.dll" // DllFullName
33+
L"a.dll", // DllBaseName
34+
L"C:\\Windows\\System32\\a.dll" // DllFullName
12035
);
12136
if (NT_SUCCESS(status) && status != STATUS_IMAGE_MACHINE_TYPE_MISMATCH) {
12237

123-
auto _MessageBoxW = (decltype(&MessageBoxW))GetProcAddress(hModule, "MessageBoxW");
124-
_MessageBoxW(nullptr, L"Hello, from memory user32!", L"Caption", MB_OK);
38+
typedef int(__stdcall* func)();
39+
func test_user32 = (func)GetProcAddress(hModule, "test_user32");
40+
test_user32();
12541

12642
//
12743
// After calling MessageBox, we can't free it.
@@ -133,6 +49,6 @@ int test_user32() {
13349
}
13450

13551
int main() {
136-
test_a_dll();
52+
test();
13753
return 0;
13854
}

0 commit comments

Comments
 (0)