search

x64dbg / ScyllaHide

Advanced usermode anti-anti-debugger. Forked from https://bitbucket.org/NtQuery/scyllahide
GNU General Public License v3.0
3.48k stars 434 forks source link

A confusing question when reading the InjectorCLI source code #144

Closed Eleven-LA closed 2 years ago

Eleven-LA commented 2 years ago

The startInjection function calls the MapModuleToProcess function to implement the injection of HookLibrary.dll,But the MapModuleToProcess function first maps the HookLibrary.dll into its own memory and resolves the import table,and then uses WriteProcessMemory to write the resolved image to the target process.At this time, shouldn't the function address pointed to by FirstThunk belong to the InjectorCLI process? Why can HookLibrary.dll be executed normally in the target process?The function address of the dll used by the HookLibrary.dll may be different in the two processes.

ResolveImports((PIMAGE_IMPORT_DESCRIPTOR)((DWORD_PTR)imageLocal + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress), (DWORD_PTR)imageLocal); SIZE_T skipBytes = wipeHeaders ? pNtHeader->OptionalHeader.SizeOfHeaders : 0; (WriteProcessMemory(hProcess, (PVOID)((ULONG_PTR)imageRemote + skipBytes), (PVOID)((ULONG_PTR)imageLocal + skipBytes)

markhc commented 2 years ago

HookLibrary only imports NTDLL functions. NTDLL is always mapped at the same location in every running process. This is also the case for Kernel32.dll.