bats3c / darkloadlibrary Goto Github PK

View Code? Open in Web Editor NEW

1.0K 25.0 202.0 53.01 MB

LoadLibrary for offensive operations

Home Page: https://www.mdsec.co.uk/2021/06/bypassing-image-load-kernel-callbacks/

C 98.36% Assembly 1.64%

darkloadlibrary's Introduction

DarkLoadLibrary

LoadLibrary for offensive operations.

How does it work?

https://www.mdsec.co.uk/2021/06/bypassing-image-load-kernel-callbacks/

Usage

DARKMODULE DarkModule = DarkLoadLibrary(
    LOAD_LOCAL_FILE, // control flags
    L"TestDLL.dll", // local dll path, if loading from disk
    NULL, // dll buffer to load from if loading from memory
    0, // dll size if loading from memory
    NULL // dll name if loaded from memory
);

Control Flags:

LOAD_LOCAL_FILE - Load a DLL from the file system.
LOAD_MEMORY - Load a DLL from a buffer.
NO_LINK - Don't link this module to the PEB, just execute it.

DLL Path:

This can be any path that CreateFileW will open.

DLL Buffer:

This argument is only needed when LOAD_MEMORY is set. In that case this argument should be the buffer containing the DLL.

DLL Size:

This argument is only needed when LOAD_MEMORY is set. In that case this argument should be the size of the buffer containing the DLL.

DLL Name:

This argument is only needed when LOAD_MEMORY is set. In that case this argument should be the name which the DLL should be set in the PEB under.

Considerations

The windows loader is very complex and can handle all the edge case's and intricacies of loading DLLs. There are going to be edge case's which I have not had the time to discover, reverse engineer and implement. So there's going to be DLLs that this loader simply will not work with.

That being said I plan on making this loader as complete as possible, so please open issue's for DLLs that are not correctly loaded.

darkloadlibrary's People

Contributors

Stargazers

Watchers

Forkers

ashr emiltayl jordanpotti gavz psmitty7373 0x09al b0y1n4o4 leftp egebalci ohio813 a10ncoder firehak solomonsklash moloch-- hypervis0r d1sabl4 qiaomu2333 msf-ntdll fengjixuchui tuoitrechuatraisudoi daffodi1 zzhsec wbaby crackercat jaychouzzk debox103 arryboom freeide mitchelltesla yougar0 sarvex sunnyneo linecode wadewfsssss siwonheo zhouzu asdlei99 deeby w1nds killvxk meesong rocker9527 jilvan1234 tzf-omkey 3453-315h bigbael idkwim hackflame y11en ykankaya yang-zhiyuan 0x738a ariesike eragon226 red-infosec devbabygo mikeyhodl liushouhuo bb33bb pyonghe invokethreatguy evilashz actorexpose re-expoc yangfan6888 5l1v3r1 physics-sec segg21 idfix007 xiaoxiaozhu5 preventions fdlucifer beyondcy hddmm5 ckwindowsproject benheise arrnitage sairson idlcode wuyadie tututu-patch tai-rex bigbrobro iamasbcx icyfox168168 modulexcite inosec2 johnlatwc askyeye wisdark sasqwatch izj007 ricardo-rossini koolacac int2ecall ririmaiyuliani l34rn adversaryemulator 2217936322 workcha

darkloadlibrary's Issues

Hello, doesn't DarkLoadLibrary support x86?

I use vs2019's x64 to compile normally, but it fails to compile on X86.

1>Assembling src\syscallsstubs.asm...
1>src\syscallsstubs.asm(1): error A2013: .MODEL must precede this directive
1>src\syscallsstubs.asm(5): error A2034: must be in segment block : NtProtectVirtualMemory
1>src\syscallsstubs.asm(6): error A2034: must be in segment block
1>src\syscallsstubs.asm(7): error A2034: must be in segment block
1>src\syscallsstubs.asm(8): error A2034: must be in segment block
1>src\syscallsstubs.asm(9): error A2034: must be in segment block
1>src\syscallsstubs.asm(10): error A2034: must be in segment block
1>src\syscallsstubs.asm(11): error A2034: must be in segment block
1>src\syscallsstubs.asm(12): error A2034: must be in segment block
1>src\syscallsstubs.asm(13): error A2034: must be in segment block
1>src\syscallsstubs.asm(14): error A2034: must be in segment block
1>src\syscallsstubs.asm(15): error A2034: must be in segment block
1>src\syscallsstubs.asm(16): error A2034: must be in segment block
1>src\syscallsstubs.asm(17): error A2034: must be in segment block
1>src\syscallsstubs.asm(18): error A2034: must be in segment block
1>src\syscallsstubs.asm(19): error A2034: must be in segment block
1>src\syscallsstubs.asm(20): error A2034: must be in segment block
1>src\syscallsstubs.asm(21): fatal error A1010: unmatched block nesting : NtProtectVirtualMemory

it doesn't work in VS2019 release x64

and work well in VS2019 debug x64

[Feature Request] DarkLoadLibrary for DLL Imports

Hey, great tool. Are there any near-term plans to add DarkLoadLibrary loading for a DLL's dependencies/imports? They're current just using LoadLibrary, and I can see you added a note to say support would (hopefully) be added in future (in ldrutils.c).

can i use darkloadlibrary for UDRL(user-defined reflective loader)

Crashes when loading libffi-7.dll

OS: Win10/Win11 (Tested both)
DLL: libffi-7.dll (http://sourceware.cygnus.com/libffi/)

When attempting to import either from disk (LOAD_LOCAL_FILE) or from memory (LOAD_MEMORY) the DarkLoadLibrary function call crashes with an error 0xc0000409. The specific version of libffi-7.dll comes with python3.10's portable zip package.

Loading clr.dll return `false` when calling the entry point

Good day,

When I try to load the CLR DLL (e.g: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll), the call to the entry point return false.

Appart from that, the DLL loading seems fine, do you have an idea why this call return false ? Is this an edge case scenario ?

Other DLL doesn't seems to have this behaviour.

Regards.

Various different memory leaks

yeah very few HeapAlloc calls actually get freed. I would fix this myself but that seems more fitting of a punishment for the creator of said leaks.

ahem @bats3c

vs memorymodule

I analyzed your code.
Your project is not completed, not support TLS, LoadConfig and so on.
I wish you upgrade it more prefectly.