[C++] How does manual mapping work + example

[vaynz]

Even though the concept of manually mapping a file into memory is nothing new, I see (too) many people not understanding it:

• Their injectors are 95% copy-pasted from blackbone/xenos
• Hardly anyone who did not bother with those annoying anti-cheats like XTrap, XignCode, doesn't even know that manual mapping exists or why to use it

Also, while lurking the S4 League section, I notice ppl don't have a clue about this topic either.

(which maybe has emerged because of the perpetual existence of a public full-bypass
and because of the incompetence of the developers forgetting to implement the serverside alive-check lolz)


Concept

What manual mapping really is, is just emulating the behavior of LoadLibraryA/W and/or the windows pe loader.
As you may know, LoadLibrary is just a "wrapper", exposing many internal loader APIs.
This means anti-cheats can hook LoadLibrary itself or one of the elementary functions called inside of it and, thus,
find out that something's gonna get injected and what is gonna get injected and take appropriate action.

Now, to know what to emulate, you need to know what LoadLibrary is really doing.
After a quick look at MSDN, you may notice that it says "The specified module may cause other modules to be loaded".
This recursive approach needs to be taken into account later, e.g. if your DLL needs other dependencies to work in the target process.

So, it roughly explains that LoadLibrary "loads" the module, specified by an absolute or relative path, into the calling process.
What loading practically means:

1. Use the path to open a handle to the library file (DLL)
2. Using the handle, read the contents of the file into the injector's process' address space
3. Optionally check if the image is really a DLL file by considering the characteristics field in the PE header
4. Allocate space for the image and the shellcode which will call the entrypoint and resolve some stuff (in-depth later)
5. Copy the whole image into the allocated space
6. Copy the shellcode into the other code-cave and execute it

Since some of the loader's internal APIs were not called, another advantage is that the image is not registered in the PEB's module lists.
The reason that you need to additionally use shellcode is that you could theoretically just create a remote thread with
the start address of your dll entry point but you may only supply one argument.

The shellcode takes care of resolving the imports or more precisely the import address table entries. Your image uses a particular table
in memory which contains pointers to APIs like from NTDLL or KERNEL. There is no guarantee that those are loaded at the same place everytime.
As well, those entries are RVAs instead of VAs in case your image is not loaded at default imagebase.
That's why you will have to manually rebuild the IAT which is pretty easy:

1. Easy way: Load dependency with LoadLibraryA (hopefully anti-cheat doesn't detect LoadLibrary when loading windows dlls)
   and then parse its export table with GetProcAddress. (hopefully ac doesn't detect GetProcAddress :P)
2. Not soo easy way: This is a little bit costlier but still easy. Recursively call your mapping code again, applying the conquer and divide principle, for every dependency + emulate GetProcAddress (it's just parsing the dependency's export table)

Moreover you will have to resolve the relocation table. Relocations are just locations in code that use absolute virtual addresses.
In this case you need to add the difference between the assumed imagebase and the real imagebase to each entry.
This difference is always relative to the assumed imagebase, hence it can also be negative, causing a subtraction.
(That is because the relocations are also relative to the assumed imagebase and not to the real imagebase)

At the end of the shellcode it will call the entry point of the valid, mapped module.


Code examples (snippets)

Open & read file on disk

 Spoiler

// can also be done with CRT functions or std lib

HANDLE file_handle = CreateFile( "my_cool_cheat.dll", GENERIC_READ, FILE_SHARE_WRITE | FILE_SHARE_READ,
                                nullptr, OPEN_EXISTING, 0, NULL ); // dll must be in same folder

if( file_handle == INVALID_HANDLE_VALUE )
	return false;

unsigned int file_size = GetFileSize( file_handle, nullptr );

char buffer[ file_size ]; // stack-allocated. doesn't matter if it's stack- or heap-allocated or even globally allocated

unsigned int bytes_read;

if ( ReadFile( file_handle, buffer, file_size, &bytes_read, nullptr ) != TRUE )
	return false;

Check if valid DLL image

 Spoiler

auto dos_header = reinterpret_cast< IMAGE_DOS_HEADER* >( buffer );
auto pe_header = reinterpret_cast< IMAGE_NT_HEADERS* >( buffer + dos_header->e_lfanew );

if( ~( pe_header->FileHeader.Characteristics ) & IMAGE_FILE_DLL )
	return false;

Copy file contents to image

 Spoiler

HANDLE process_handle = OpenProcess( PROCESS_ALL_ACCESS, FALSE, process_id );

if( process_handle == NULL )
	return false;

byte* image = VirtualAllocEx( process_handle, nullptr, pe_header->OptionalHeader.SizeOfImage, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE );

if( image == NULL )
	return false;

WriteProcessMemory( process_handle, image, buffer, pe_header->OptionalHeader.SizeOfHeaders, nullptr );

auto section = reinterpret_cast<IMAGE_SECTION_HEADER*>( pe_header + 1 );

for( auto i = 0; i < pe_header->FileHeader.NumberOfSections; i++, section++ )
	WriteProcessMemory( process_handle, image + section->VirtualAddress, buffer + section->PointerToRawData, section->SizeOfRawData, nullptr );

Fix relocations

 Spoiler

auto reloc_table = reinterpret_cast< IMAGE_BASE_RELOCATION* >( image + nt_header->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_BASERELOC ].VirtualAddress );

while( reloc_table->VirtualAddress && reloc_table->SizeOfBlock > sizeof( IMAGE_BASE_RELOCATION ) )
{
	uint16_t* entries = reloc_table + 1;
	for( auto i = 0; i < reloc_table->SizeOfBlock - sizeof( IMAGE_BASE_RELOCATION ) / sizeof( uint16_t ); i++ )
		entries[ i ] = entries[ i ] + ( image - nt_header->OptionalHeader.ImageBase );
	
	reloc_table += reloc_table->SizeOfBlock;
}

[Devsome]

@ you can send him a private message instead of asking in the thread. @ Good tutorial

[Master674b]

You forgot that there is a lot more stuff to consider if you want to do this right. You need to apply the proper protection flags to each region, the PEB has to be locked if you want to link in the new module, then there is delayed imports, tls callbacks, SEH, security cookie, the list goes on...

Stick to a proper implementation instead of making your own.

You forgot that there is a lot more stuff to consider if you want to do this right. You need to apply the proper protection flags to each region, the PEB has to be locked if you want to link in the new module, then there is delayed imports, tls callbacks, SEH, security cookie, the list goes on...

Stick to a proper implementation instead of making your own.

[CSGOCheats]

Great post! Simple to the point and nothing extra. Although some Anti-Cheats do detect load library.

Edit: My bad kinda skimmed it didn't realize you warned about that already :P