injection.asm

BITS 32
%include 'type-conversion.asm'
section .bss
	global _hDllBase 
	_hDllBase resd 1

SECTION .data
	sDllName db u('procrewriter.dll'), 0

SECTION .text
	global _shellcode
	_shellcode:
		xor edx, edx ; edx = 0
		push sDllName
	; Stack contains arguments for LoadLibraryW
		mov esi, [fs:edx + 0x30]		; esi = [TEB + 0x30] = PEB
		mov esi, [esi + 0x0C]		   ; esi = [PEB + 0x0C] = PEB_LDR_DATA
		mov esi, [esi + 0x0C]		   ; esi = [PEB_LDR_DATA + 0x0C] = LDR_MODULE InLoadOrder[0] (process)
		lodsd							   ; eax = InLoadOrder[1] (ntdll)
		mov esi, [eax]				  ; esi = InLoadOrder[2] (kernel32)
		mov edi, [esi + 0x18]		   ; edi = [InLoadOrder[2] + 0x18] = kernel32 DllBase
	; Found kernel32 base address (edi)
		mov ebx, [edi + 0x3C]		   ; ebx = [kernel32 + 0x3C] = offset(PE header)
		mov ebx, [edi + ebx + 0x78]	 ; ebx = [kernel32 + offset(PE header) + 0x78] = offset(export table)
	; Found export table offset (ebx)
		mov esi, [edi + ebx + 0x20]	 ; esi = [kernel32 + offset(export table) + 0x20] = offset(names table)
		add esi, edi					; esi = kernel32 + offset(names table) = &(names table)
	; Found export names table (esi)
		mov ecx, [edi + ebx + 0x24]	 ; ecx = [kernel32 + offset(export table) + 0x20] = offset(ordinals table)
		add ecx, edi					; ecx = kernel32 + offset(ordinals table) = ordinals table
	; Found export ordinals table (ecx)
	find_loadlibrary_x86:
	; speculatively load ordinal (EBP)
		movzx ebp, WORD [ecx + edx * 2]   ; EBP = [ordinals table + (exported function number + 1) * 2] = exported function ordinal (eventually)
		inc edx ; edx = function number + 1
		lodsd ; eax = &(names table[function number]) = offset(function name)
		cmp [edi + eax], WORD B2DW('L', 'o', 'a', 'd')
		jne find_loadlibrary_x86
		cmp [edi + eax + 0x4], DWORD B2DW('L', 'i', 'b', 'r')
		jne find_loadlibrary_x86
		cmp [edi + eax + 0x8], DWORD B2DW('a', 'r', 'y', 'W')
		jne find_loadlibrary_x86
		mov esi, [edi + ebx + 0x1C]	 ; esi = [kernel32 + offset(export table) + 0x1C] = offset(address table)] = offset(address table)
		add esi, edi ; esi = kernel32 + offset(address table) = &(address table)
		add edi, [esi + ebp * 4]		; edi = kernel32 + [&(address table)[LoadLibraryW ordinal]] = offset(LoadLibraryW) = &(LoadLibraryW)
		call edi ; LoadLibraryW("procrewriter.dll");
		mov [ _hDllBase ], eax
		ret