Package src ::
Module pyfault
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17 import pyfault_defines
18 import faultx
19 import ctypes
20
21
22 kernel32 = ctypes.windll.kernel32
23
24
26
27 '''
28 This class is mainly a DLL injector/ejector, but I hope to expand it to be a fault injection suite,
29 to torture software on those days the elusive 0-day doesn't come knocking. For now inject
30 away until I have time to code up some other lovin'
31 '''
32
34
35 self.dll_path = None
36 self.pid = None
37
38
39
40 '''
41 This function is basically a nice wrapper around CreateToolhelp32Snapshot() to retrieve detailed
42 information on a DLL for use in ejection.
43 '''
44
45
47
48
49
50
51
52
53
54
55
56 current_process = pyfault_defines.MODULEENTRY32()
57 h_snap = kernel32.CreateToolhelp32Snapshot(pyfault_defines.TH32CS_SNAPMODULE,pid)
58
59
60 if h_snap == pyfault_defines.INVALID_HANDLE_VALUE:
61 raise faultx("CreateToolHelp32Snapshot(TH32CS_SNAPMODULE,%d) failed." % pid)
62
63
64 current_process.dwSize = ctypes.sizeof(current_process)
65
66
67 if not kernel32.Module32First(h_snap, ctypes.byref(current_process)):
68 raise faultx("Couldn't find a valid reference to the module %s" % dll_name)
69
70
71
72 while current_process.szModule.lower() != dll_name.lower():
73
74 if not kernel32.Module32Next(h_snap, ctypes.byref(current_process)):
75 raise faultx("Couldn't find the DLL %s" % dll_name)
76
77
78
79 kernel32.CloseHandle(h_snap)
80
81
82 return current_process
83
84
85
86
87 '''
88 This function removes a DLL from a running process, use at your own RISK! :)
89 '''
90
91
93 '''
94 Eject a loaded DLL from a running process.
95 @type dll_name: String
96 @param dll_name: The name of the DLL you wish to eject.
97 @type pid: Integer
98 @param pid: The process ID that you want to eject a DLL from.
99
100 @returns True if successful, False if not.
101 '''
102
103
104 current_process = self.get_module_info(dll_name,pid)
105
106 if current_process != False:
107
108
109 h_process = kernel32.OpenProcess(pyfault_defines.PROCESS_ALL_ACCESS, False, pid)
110
111
112 h_kernel32 = kernel32.GetModuleHandleA("kernel32.dll")
113
114
115 h_freelib = kernel32.GetProcAddress(h_kernel32,"FreeLibrary")
116
117
118
119
120 count = 0
121 while count <= current_process.GlblcntUsage:
122 thread_id = ctypes.c_ulong()
123 if not kernel32.CreateRemoteThread(h_process,None,0,h_freelib,current_process.hModule,0,ctypes.byref(thread_id)):
124 raise faultx("CreateRemoteThread failed, couldn't run FreeLibrary()")
125 count += 1
126
127
128 kernel32.CloseHandle(h_process)
129 kernel32.CloseHandle(h_kernel32)
130 kernel32.CloseHandle(h_freelib)
131
132 return True
133
134 else:
135
136 return False
137
138
139
140 '''
141 This is a simple method for injecting a DLL into a running process.
142 '''
143
144
146
147 '''
148 Inject a DLL of your choice into a running process.
149 @type dll_name: String
150 @param dll_name: The path to the DLL you wish to inject.
151 @type pid: Integer
152 @param pid: The process ID that you wish to inject into.
153
154 @returns True if the DLL was injected successfully, False if it wasn't.
155 '''
156
157 dll_len = len(dll_path)
158
159
160 h_process = kernel32.OpenProcess(pyfault_defines.PROCESS_ALL_ACCESS, False, pid)
161
162
163 arg_address = kernel32.VirtualAllocEx(h_process,0,dll_len,pyfault_defines.VIRTUAL_MEM,pyfault_defines.PAGE_READWRITE)
164
165
166 written = ctypes.c_int(0)
167 kernel32.WriteProcessMemory(h_process, arg_address, dll_path, dll_len, ctypes.byref(written))
168
169
170 h_kernel32 = kernel32.GetModuleHandleA("kernel32.dll")
171
172
173 h_loadlib = kernel32.GetProcAddress(h_kernel32,"LoadLibraryA")
174
175
176 thread_id = ctypes.c_ulong(0)
177 if not kernel32.CreateRemoteThread(h_process,None,0,h_loadlib,arg_address,0,ctypes.byref(thread_id)):
178 raise faultx("CreateRemoteThread failed, unable to inject the DLL.")
179
180
181 return True
182