Skip to content

Instantly share code, notes, and snippets.

@markhc
Created May 13, 2016 07:47
Show Gist options
  • Save markhc/a01cd8b2954fbcd498fb0ec2a78a0ec8 to your computer and use it in GitHub Desktop.
Save markhc/a01cd8b2954fbcd498fb0ec2a78a0ec8 to your computer and use it in GitHub Desktop.
NTSTATUS RDrvInjectModule(
IN PINJECT_MODULE pInput,
OUT PINJECT_MODULE_RESULT pOutput
) {
NTSTATUS status = STATUS_SUCCESS;
PEPROCESS pProcess = NULL;
KAPC_STATE apc;
status = PsLookupProcessByProcessId((HANDLE)pInput->TargetProcessId, &pProcess);
if(NT_SUCCESS(status)) {
KeStackAttachProcess(pProcess, &apc);
if(pInput->InjectionType == InjectLdrLoadDll)
status = RDrvInjectLdrLoadDll(pProcess, pInput->ModulePath, &pOutput->ModuleBaseAddress);
else
status = RDrvInjectManualMap(pProcess, pInput->ModulePath, &pOutput->ModuleBaseAddress);
if(NT_SUCCESS(status)) {
if(pInput->ErasePE == TRUE) {
RDrvStripHeaders((PVOID)pOutput->ModuleBaseAddress);
}
if(pInput->HideModule == TRUE) {
RDrvHideFromLoadedList(pProcess, (PVOID)pOutput->ModuleBaseAddress);
}
}
KeUnstackDetachProcess(&apc);
} else
RDRVLOG("%s: PsLookupProcessByProcessId failed with status %lX", __FUNCTION__, status);
if(pProcess)
ObDereferenceObject(pProcess);
return status;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment