edxSilkroadLoader_Lite Beta 2

// New function for injecting a DLL into a process using a asm stub in the process
void InjectDLL(HANDLE hProcess, DWORD injectAddress, const char * dllName, const char * funcName)
{
	// Max size of data section
	DWORD dataSize = 512;

	// Max size of code section
	DWORD codeSize = 512;

	// Pointer to the stub
	LPVOID lpBuffer = 0;
	
	// Size of the stub
	DWORD dwSize = 0;

	// Generate a memory block in the target process to write to (our asm stub uses this address too)
	LPVOID allocAddress = VirtualAllocEx(hProcess, 0, dataSize + codeSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);;

	// Setup an asm generator
	AsmStubGenerator asmStub(dataSize, codeSize);

	// Call our function to store the pointer to the code and size
	AsmLoaderStub(lpBuffer, dwSize);

	// Initialuze the asm stub generator with the data
	asmStub.Initialize(lpBuffer, dwSize, 0xDEADF00D);

	///////////////////////////////////////////////////////////////////////////////
	// This is the section that we fill in the asm stub's place holder data		 //
	///////////////////////////////////////////////////////////////////////////////

	// STRING's

	CHAR error1[1024] = {0};
	_snprintf(error1, 1023, "The DLL \"%s\" was not able to be loaded successfully.", dllName);

	CHAR error2[1024] = {0};
	_snprintf(error2, 1023, "The function \"%s\" was not able to be loaded from the DLL successfully.", funcName);

	DWORD string_User32DLLName		= asmStub.AddString("user32.dll");
	DWORD string_MessageBoxAName	= asmStub.AddString("MessageBoxA");
	DWORD string_InjectDLLName		= asmStub.AddString(dllName);
	DWORD string_ErrorMsgTitle		= asmStub.AddString("Fatal Error");
	DWORD string_InjectDLLFunc		= asmStub.AddString(funcName);
	DWORD string_Error1				= asmStub.AddString(error1);
	DWORD string_Error2				= asmStub.AddString(error2);

	asmStub.SetPlaceHolder( 0, string_User32DLLName);
	asmStub.SetPlaceHolder( 2, string_MessageBoxAName);
	asmStub.SetPlaceHolder( 5, string_InjectDLLName);
	asmStub.SetPlaceHolder( 7, string_ErrorMsgTitle);
	asmStub.SetPlaceHolder( 8, string_Error1);
	asmStub.SetPlaceHolder(12, string_InjectDLLFunc);
	asmStub.SetPlaceHolder(14, string_ErrorMsgTitle);
	asmStub.SetPlaceHolder(15, string_Error2);

	// DWORD's

	DWORD dword_LoadLibraryA		= asmStub.AddDword(PtrToUlong(GetProcAddress(LoadLibrary("kernel32.dll"), "LoadLibraryA")));
	DWORD dword_GetProcAddress		= asmStub.AddDword(PtrToUlong(GetProcAddress(LoadLibrary("kernel32.dll"), "GetProcAddress")));
	DWORD dword_ExitProcess			= asmStub.AddDword(PtrToUlong(GetProcAddress(LoadLibrary("kernel32.dll"), "ExitProcess")));
	DWORD dword_MessageBoxA			= asmStub.AddDword(0);
	DWORD dword_DLLHandle			= asmStub.AddDword(0);
	DWORD dword_OEP					= asmStub.AddDword(injectAddress);
	DWORD dword_Alloc				= asmStub.AddDword(PtrToUlong(allocAddress));

	asmStub.SetPlaceHolder( 1, dword_LoadLibraryA);
	asmStub.SetPlaceHolder( 3, dword_GetProcAddress);
	asmStub.SetPlaceHolder( 4, dword_MessageBoxA);
	asmStub.SetPlaceHolder( 6, dword_LoadLibraryA);
	asmStub.SetPlaceHolder( 9, dword_MessageBoxA);
	asmStub.SetPlaceHolder(10, dword_ExitProcess);
	asmStub.SetPlaceHolder(11, dword_DLLHandle);
	asmStub.SetPlaceHolder(13, dword_GetProcAddress);
	asmStub.SetPlaceHolder(16, dword_MessageBoxA);
	asmStub.SetPlaceHolder(17, dword_ExitProcess);
	asmStub.SetPlaceHolder(19, dword_OEP);
	asmStub.SetPlaceHolder(20, dword_Alloc);

	// ARRAY's

	// This will save the original 6 bytes at OEP to the asm stub so the DLL can restore them
	BYTE oepBytes[6] = {0};
	DWORD read = 0;
	ReadProcessMemory(hProcess, UlongToPtr(injectAddress), oepBytes, 6, &read);

	DWORD addr_OepBytes = asmStub.AddArray(oepBytes, 6);

	asmStub.SetPlaceHolder(18, addr_OepBytes);

	// Write the workspace to the process now
	WriteProcessBytes(hProcess, PtrToUlong(allocAddress), asmStub.GenerateAsmStub(allocAddress), asmStub.GetTotalSize());

	// Calculate the OEP of the workspace
	DWORD oep = PtrToUlong(allocAddress) + dataSize;

	// Now that the patch is written into the process, we need to make the process call it
	BYTE patch2[6] = {0xE8, 0x00, 0x00, 0x00, 0x00, 0x90};

	// Calculate the JMP offset +5 for the FAR JMP we are adding)
	DWORD toCC = oep - (injectAddress + 5);

	// Write the offset to the patch
	memcpy(patch2 + 1, &toCC, sizeof(toCC));

	// Make the patch that will JMP to the codecave
	WriteProcessBytes(hProcess, injectAddress, patch2, 6);
}

// This is the user function to assemble - a dll loading stub
void AsmLoaderStub(LPVOID & lpBuffer, DWORD & dwSize)
{
	// This is the required macro we need to place in this function
	// to setup the aseembly code.
	ASSEMBLE_MACRO(lpBuffer, dwSize);

	__asm
	{
// The assembly code needs to have this code start marker
buffer_begin:

// Attach debugger loop
//START:	JMP START

		// Save registers
		PUSHAD

		// User32 DLL Loading
			// user32.dll string address
			PUSH 0xDEADF00D							// 0
			// LoadLibraryA address
			MOV EAX, 0xDEADF00D						// 1
			MOV EAX, [EAX]
			// Call LoadLibraryA
			CALL EAX

		// MessageBoxA Loading
			// MessageBoxA function name
			PUSH 0xDEADF00D							// 2
			// User32.dll address
			PUSH EAX
			// GetProcAddress address into eax
			MOV EAX, 0xDEADF00D						// 3
			MOV EAX, [EAX]
			// Call GetProcAddress
			CALL EAX
			// Move the address of MessageBoxA into the user stored address
			MOV ECX, 0xDEADF00D						// 4
			MOV [ECX], EAX

		// DLL Loading
			// DLL name
			PUSH 0xDEADF00D							// 5
			// Move the address of LoadLibraryA into EAX
			MOV EAX, 0xDEADF00D						// 6
			MOV EAX, [EAX]
			// Call LoadLibraryA
			CALL EAX

		// Error Checking
			CMP EAX, 0
			JNZ CONTINUE1

			// MessageBox Error
			PUSH 0x10
			PUSH 0xDEADF00D							// 7
			PUSH 0xDEADF00D							// 8
			PUSH 0
			MOV EAX, 0xDEADF00D						// 9
			MOV EAX, [EAX]
			CALL EAX

			// ExitProcess
			PUSH 0
			MOV EAX, 0xDEADF00D						// 10
			MOV EAX, [EAX]
			CALL EAX

CONTINUE1:
			// Move the handle into our own variable
			MOV ECX, 0xDEADF00D						// 11
			MOV [ECX], EAX

			// GetProcAddress
			PUSH 0xDEADF00D							// 12
			PUSH EAX
			MOV EAX,0xDEADF00D						// 13
			MOV EAX, [EAX]
			CALL EAX

		// Error Checking
			CMP EAX, 0
			JNZ CONTINUE2

			// MessageBox Error
			PUSH 0x10
			PUSH 0xDEADF00D							// 14
			PUSH 0xDEADF00D							// 15
			PUSH 0
			MOV EAX, 0xDEADF00D						// 16
			MOV EAX, [EAX]
			CALL EAX

			// ExitProcess
			PUSH 0
			MOV EAX, 0xDEADF00D						// 17
			MOV EAX, [EAX]
			CALL EAX

CONTINUE2:
		// Pointer to origianl bytes
		MOV ECX, 0xDEADF00D							// 18
		PUSH ECX

		// OEP of process to write original bytes to
		MOV ECX, 0xDEADF00D							// 19
		MOV ECX, [ECX]
		PUSH ECX

		// Allocation buffer of the stub to free
		MOV ECX, 0xDEADF00D							// 20
		MOV ECX, [ECX]
		PUSH ECX

		// Call Initialize
		CALL EAX

		// Add ESP, C, since we have 3 parameters
		ADD ESP, 0xC

		// Restore registers
		POPAD

		// Return to OEP
		POP EAX
		SUB EAX, 5
		PUSH EAX
		RET

// The assembly code needs to have this code end marker
buffer_end:
	}
}