43 lines
1.5 KiB
C
43 lines
1.5 KiB
C
|
//===============================================================================================//
|
||
|
|
// This is a stub for the actuall functionality of the DLL.
|
||
|
|
//===============================================================================================//
|
||
|
|
#include "ReflectiveLoader.h"
|
||
|
|
#include "NtApiHooks.h"
|
||
|
|
|
||
|
|
// Note: REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR and REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN are
|
||
|
|
// defined in the project properties (Properties->C++->Preprocessor) so as we can specify our own
|
||
|
|
// DllMain and use the LoadRemoteLibraryR() API to inject this DLL.
|
||
|
|
|
||
|
|
// You can use this value as a pseudo hinstDLL value (defined and set via ReflectiveLoader.c)
|
||
|
|
extern HINSTANCE hAppInstance;
|
||
|
|
|
||
|
|
// Store the parameter passed to ReflectiveLoader
|
||
|
|
extern LPVOID g_lpReflectiveParameter;
|
||
|
|
|
||
|
|
//===============================================================================================//
|
||
|
|
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
|
||
|
|
{
|
||
|
|
BOOL bReturnValue = TRUE;
|
||
|
|
switch (dwReason)
|
||
|
|
{
|
||
|
|
case DLL_QUERY_HMODULE:
|
||
|
|
if (lpReserved != NULL)
|
||
|
|
*(HMODULE*)lpReserved = hAppInstance;
|
||
|
|
break;
|
||
|
|
case DLL_PROCESS_ATTACH:
|
||
|
|
hAppInstance = hinstDLL;
|
||
|
|
DisableThreadLibraryCalls(hinstDLL);
|
||
|
|
|
||
|
|
// Install NT API hooks with the parameter passed from the injector
|
||
|
|
InstallNtApiHooks(g_lpReflectiveParameter);
|
||
|
|
break;
|
||
|
|
case DLL_PROCESS_DETACH:
|
||
|
|
// Remove hooks on detach
|
||
|
|
RemoveNtApiHooks();
|
||
|
|
break;
|
||
|
|
case DLL_THREAD_ATTACH:
|
||
|
|
case DLL_THREAD_DETACH:
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
return bReturnValue;
|
||
|
|
}
|