QRouland/injectionforge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Call LoadLibraryA on DllMain to fix crash

Browse Source
This commit is contained in:
Dimitris Zervas 2023-05-27 21:45:02 +03:00
parent d65438091f
commit 14e6572521
No known key found for this signature in database
GPG Key ID: 5C27D7C9D1901A30
3 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Cargo.toml
View File

@ -17,7 +17,7 @@ lazy_static = "1.4.0"
ctor = "0.2.0" ctor = "0.2.0"
[target.'cfg(windows)'.dependencies] [target.'cfg(windows)'.dependencies]
winapi = { version = "0.3.9", features = ["winnt"] } winapi = { version = "0.3.9", features = ["winnt", "libloaderapi"] }
[build-dependencies] [build-dependencies]
goblin = "0.6.1" goblin = "0.6.1"

1
build.rs
View File

@ -33,5 +33,6 @@ fn main() {
// println!("cargo:rustc-link-lib=dylib={}-orig", lib_name); // println!("cargo:rustc-link-lib=dylib={}-orig", lib_name);
} }
println!("cargo:warning=Expected library name: {}-orig.dll", lib_name); println!("cargo:warning=Expected library name: {}-orig.dll", lib_name);
println!("cargo:rustc-env=LIB_NAME={}-orig.dll", lib_name);
} }
} }

5
src/lib.rs
View File

@ -19,6 +19,8 @@ use std::ffi::c_void;
#[cfg(windows)] #[cfg(windows)]
use winapi::um::winnt::DLL_PROCESS_ATTACH; use winapi::um::winnt::DLL_PROCESS_ATTACH;
#[cfg(windows)]
use winapi::um::libloaderapi::LoadLibraryA;
#[cfg(windows)] #[cfg(windows)]
#[no_mangle] #[no_mangle]
@ -27,8 +29,9 @@ extern "system" fn DllMain(dll_module: *mut c_void, call_reason: u32, _: *mut ()
match call_reason { match call_reason {
DLL_PROCESS_ATTACH => { DLL_PROCESS_ATTACH => {
println!("[+] frida-deepfreeze-rs DLL injected"); println!("[+] frida-deepfreeze-rs DLL injected");
unsafe { LoadLibraryA(env!("LIB_NAME").as_ptr() as *const i8); }
println!("[+] Original DLL {} loaded", env!("LIB_NAME"));
attach_self(); attach_self();
} }
// Maybe we should detach? Is it useful? // Maybe we should detach? Is it useful?
_ => () _ => ()