74 lines
1.7 KiB
Go
74 lines
1.7 KiB
Go
|
package winloader
|
||
|
|
|
||
|
|
import (
|
||
|
|
"errors"
|
||
|
|
"fmt"
|
||
|
|
"unsafe"
|
||
|
|
|
||
|
|
"golang.org/x/sys/windows"
|
||
|
|
)
|
||
|
|
|
||
|
|
var (
|
||
|
|
ntdllModule = windows.NewLazySystemDLL("ntdll")
|
||
|
|
ntdllNtQueryInformationProcess = ntdllModule.NewProc("NtQueryInformationProcess")
|
||
|
|
)
|
||
|
|
|
||
|
|
type _ProcessBasicInformation struct {
|
||
|
|
Reserved1 uintptr
|
||
|
|
PebBaseAddress uintptr
|
||
|
|
Reserved2 [2]uintptr
|
||
|
|
UniqueProcessID uintptr
|
||
|
|
Reserved3 uintptr
|
||
|
|
}
|
||
|
|
|
||
|
|
type _PEB struct {
|
||
|
|
Reserved1 [2]byte
|
||
|
|
BeingDebugged byte
|
||
|
|
Reserved2 [1]byte
|
||
|
|
Reserved3 [2]uintptr
|
||
|
|
Ldr uintptr
|
||
|
|
}
|
||
|
|
|
||
|
|
type _List struct {
|
||
|
|
Front uintptr
|
||
|
|
Back uintptr
|
||
|
|
}
|
||
|
|
|
||
|
|
type _PEBLoaderData struct {
|
||
|
|
Length uint32
|
||
|
|
Initialized uint8
|
||
|
|
Padding [3]uint8
|
||
|
|
SsHandle uintptr
|
||
|
|
InLoadOrderModuleList _List
|
||
|
|
InMemoryOrderModuleList _List
|
||
|
|
InInitializationOrderModuleList _List
|
||
|
|
}
|
||
|
|
|
||
|
|
// MakePEBEntryForModule is a hack that inserts an entry for the loaded module
|
||
|
|
// into the PEB loader data to make it appear to Windows functions.
|
||
|
|
func MakePEBEntryForModule() error {
|
||
|
|
process := -1
|
||
|
|
sizeNeeded := uint32(0)
|
||
|
|
pbi := _ProcessBasicInformation{}
|
||
|
|
status, _, _ := ntdllNtQueryInformationProcess.Call(
|
||
|
|
uintptr(process),
|
||
|
|
0,
|
||
|
|
uintptr(unsafe.Pointer(&pbi)),
|
||
|
|
unsafe.Sizeof(pbi),
|
||
|
|
uintptr(unsafe.Pointer(&sizeNeeded)),
|
||
|
|
)
|
||
|
|
if status != 0 {
|
||
|
|
return fmt.Errorf("NtQueryInformationProcess failed: %08x", status)
|
||
|
|
}
|
||
|
|
|
||
|
|
// TODO: Implement attempt to insert module entry.
|
||
|
|
return errors.New("unimplemented")
|
||
|
|
}
|
||
|
|
|
||
|
|
// GetProcessHInstance gets the HINSTANCE for the current process.
|
||
|
|
func GetProcessHInstance() (uintptr, error) {
|
||
|
|
var hinstance windows.Handle
|
||
|
|
windows.GetModuleHandleEx(0, nil, &hinstance)
|
||
|
|
return uintptr(hinstance), nil
|
||
|
|
}
|