diff --git a/Wow64Injectx64/ReadMe.md b/Wow64Injectx64/ReadMe.md new file mode 100644 index 0000000..cc10cd6 --- /dev/null +++ b/Wow64Injectx64/ReadMe.md @@ -0,0 +1,3 @@ +##Wow64进程注入x64进程 +在Win7 Ultimate Sp1 测试成功 +[http://www.cnblogs.com/lanrenxinxin/p/4821152.html](http://www.cnblogs.com/lanrenxinxin/p/4821152.html) \ No newline at end of file diff --git a/Wow64Injectx64/Wow64Injectx64.sln b/Wow64Injectx64/Wow64Injectx64.sln new file mode 100644 index 0000000..547f87d --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64.sln @@ -0,0 +1,20 @@ +锘 +Microsoft Visual Studio Solution File, Format Version 11.00 +# Visual Studio 2010 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Wow64Injectx64", "Wow64Injectx64\Wow64Injectx64.vcxproj", "{D39AFEDB-19C8-4F2E-AAD2-8F25A75D581C}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Win32 = Debug|Win32 + Release|Win32 = Release|Win32 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {D39AFEDB-19C8-4F2E-AAD2-8F25A75D581C}.Debug|Win32.ActiveCfg = Debug|Win32 + {D39AFEDB-19C8-4F2E-AAD2-8F25A75D581C}.Debug|Win32.Build.0 = Debug|Win32 + {D39AFEDB-19C8-4F2E-AAD2-8F25A75D581C}.Release|Win32.ActiveCfg = Release|Win32 + {D39AFEDB-19C8-4F2E-AAD2-8F25A75D581C}.Release|Win32.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/Wow64Injectx64/Wow64Injectx64.suo b/Wow64Injectx64/Wow64Injectx64.suo new file mode 100644 index 0000000..ca75c46 Binary files /dev/null and b/Wow64Injectx64/Wow64Injectx64.suo differ diff --git a/Wow64Injectx64/Wow64Injectx64/Messagebox.dll b/Wow64Injectx64/Wow64Injectx64/Messagebox.dll new file mode 100644 index 0000000..2def98e Binary files /dev/null and b/Wow64Injectx64/Wow64Injectx64/Messagebox.dll differ diff --git a/Wow64Injectx64/Wow64Injectx64/Resource.h b/Wow64Injectx64/Wow64Injectx64/Resource.h new file mode 100644 index 0000000..b454227 --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64/Resource.h @@ -0,0 +1,17 @@ +//{{NO_DEPENDENCIES}} +// Microsoft Visual C++ generated include file. +// Used by Wow64Injectx64.rc +// + +#define IDS_APP_TITLE 103 + +// 新对象的下一组默认值 +// +#ifdef APSTUDIO_INVOKED +#ifndef APSTUDIO_READONLY_SYMBOLS +#define _APS_NEXT_RESOURCE_VALUE 101 +#define _APS_NEXT_COMMAND_VALUE 40001 +#define _APS_NEXT_CONTROL_VALUE 1000 +#define _APS_NEXT_SYMED_VALUE 101 +#endif +#endif diff --git a/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.cpp b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.cpp new file mode 100644 index 0000000..a13165b --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.cpp @@ -0,0 +1,161 @@ +// Wow64Injectx64.cpp : 定义控制台应用程序的入口点。 +// + +#include "stdafx.h" +#include "Wow64Injectx64.h" +#include +#include +#include +#include "wow64ext.h" +#ifdef _DEBUG +#define new DEBUG_NEW +#endif + +#pragma comment(lib,"wow64ext.lib") + +// 唯一的应用程序对象 +CWinApp theApp; + +using namespace std; + +typedef struct _UNICODE_STRING { + USHORT Length; //UNICODE占用的内存字节数，个数*2； + USHORT MaximumLength; + DWORD64 Buffer; //注意这里指针的问题 +} UNICODE_STRING ,*PUNICODE_STRING; + + + +unsigned char shell_code[] = { + 0x48, 0x89, 0x4c, 0x24, 0x08, // mov qword ptr [rsp+8],rcx + 0x57, // push rdi + 0x48, 0x83, 0xec, 0x20, // sub rsp,20h + 0x48, 0x8b, 0xfc, // mov rdi,rsp + 0xb9, 0x08, 0x00, 0x00, 0x00, // mov ecx,8 + 0xb8, 0xcc, 0xcc, 0xcc, 0xcc, // mov eac,0CCCCCCCCh + 0xf3, 0xab, // rep stos dword ptr [rdi] + 0x48, 0x8b, 0x4c, 0x24, 0x30, // mov rcx,qword ptr [__formal] + 0x49, 0xb9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // mov r9,0 //PVOID* BaseAddr opt + 0x49, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // mov r8,0 //PUNICODE_STRING Name + 0x48, 0xba, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // mov rdx,0 + 0x48, 0xb9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // mov rcx,0 + 0x48, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // mov rax,0 + 0xff, 0xd0, // call rax LdrLoadDll + 0x48, 0xb9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // mov rcx,0 + 0x48, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // mov rax,0 + 0xff, 0xd0 // call rax +}; + + +enum InjectResult{ + OK, + Error_NoSuchFile, + Error_OpenProcess, + Error_VirtualAllocEx, + Error_GetProcAddress, + Error_WriteProcessMemory, + Error_CreateRemoteThread +}; + + +InjectResult Wow64Injectx64(DWORD processid,const TCHAR* file_path); + +int _tmain(int argc, TCHAR* argv[], TCHAR* envp[]) +{ + cout<<"查看要注入进程的ID"<>ProcessID; + WCHAR file_path[] = L"E:\\Messagebox.dll"; + + + if (OK==Wow64Injectx64(ProcessID,file_path)) + { + printf("Inject Success!\n"); + } + return 0; +} + + +InjectResult Wow64Injectx64(DWORD processid,const TCHAR* file_path) +{ + + if (!PathFileExists(file_path)) + { + return Error_NoSuchFile; + } + + HANDLE handle = OpenProcess(PROCESS_ALL_ACCESS,FALSE,processid); + if (INVALID_HANDLE_VALUE == handle) + { + return Error_OpenProcess; + } + + size_t file_path_mem_length = (size_t)::_tcslen(file_path); + size_t paramemter_size = (file_path_mem_length+1)*sizeof(TCHAR) + sizeof(UNICODE_STRING) + sizeof(DWORD64); + DWORD64 paramemter_mem_addr = (DWORD64)VirtualAllocEx64(handle,NULL,paramemter_size,MEM_COMMIT,PAGE_READWRITE); + DWORD64 shell_code_addr = (DWORD64)VirtualAllocEx64(handle,NULL,sizeof(shell_code),MEM_COMMIT,PAGE_EXECUTE_READWRITE); + if ((!paramemter_mem_addr) || (!shell_code_addr)) + { + return Error_VirtualAllocEx; + } + + char * paramemter_mem_local = new char[paramemter_size]; + memset(paramemter_mem_local,0,paramemter_size); + + PUNICODE_STRING ptr_unicode_string = (PUNICODE_STRING)(paramemter_mem_local + sizeof(DWORD64)); + ptr_unicode_string->Length = file_path_mem_length; + ptr_unicode_string->MaximumLength = file_path_mem_length*2; + wcscpy((WCHAR*)(ptr_unicode_string+1),file_path); + ptr_unicode_string->Buffer = (DWORD64)((char*)paramemter_mem_addr+sizeof(DWORD64)+sizeof(UNICODE_STRING)); + + DWORD64 ntdll64 = GetModuleHandle64(L"ntdll.dll"); + DWORD64 ntdll_LdrLoadDll = GetProcAddress64(ntdll64,"LdrLoadDll"); + DWORD64 ntdll_RtlCreateUserThread = GetProcAddress64(ntdll64,"RtlCreateUserThread"); + DWORD64 ntdll_RtlExitThread = GetProcAddress64(ntdll64,"RtlExitUserThread"); + if (NULL == ntdll_LdrLoadDll || NULL==ntdll_RtlCreateUserThread || NULL==ntdll_RtlExitThread) + { + return Error_GetProcAddress; + } + + //r9 + memcpy(shell_code+32,¶memter_mem_addr,sizeof(DWORD64)); + + //r8 + DWORD64 ptr = paramemter_mem_addr+sizeof(DWORD64); + memcpy(shell_code+42,&ptr,sizeof(PUNICODE_STRING)); + + //LdrLoaddll + memcpy(shell_code+72,&ntdll_LdrLoadDll,sizeof(DWORD64)); + + //RtlExitUserThread + memcpy(shell_code+94,&ntdll_RtlExitThread,sizeof(DWORD64)); + size_t write_size = 0; + if (!WriteProcessMemory64(handle,paramemter_mem_addr,paramemter_mem_local,paramemter_size,NULL) || + !WriteProcessMemory64(handle,shell_code_addr,shell_code,sizeof(shell_code),NULL)) + { + return Error_WriteProcessMemory; + } + DWORD64 hRemoteThread = 0; + struct { + DWORD64 UniqueProcess; + DWORD64 UniqueThread; + } client_id; + int a = X64Call(ntdll_RtlCreateUserThread,10, + (DWORD64)handle, // ProcessHandle + (DWORD64)NULL, // SecurityDescriptor + (DWORD64)FALSE, // CreateSuspended + (DWORD64)0, // StackZeroBits + (DWORD64)NULL, // StackReserved + (DWORD64)NULL, // StackCommit + shell_code_addr, // StartAddress + (DWORD64)NULL, // StartParameter + (DWORD64)&hRemoteThread, // ThreadHandle + (DWORD64)&client_id); // ClientID) + if (INVALID_HANDLE_VALUE == (HANDLE)hRemoteThread) + { + return Error_CreateRemoteThread; + } + return OK; +} \ No newline at end of file diff --git a/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.h b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.h new file mode 100644 index 0000000..d00d47e --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.h @@ -0,0 +1,3 @@ +#pragma once + +#include "resource.h" diff --git a/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.rc b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.rc new file mode 100644 index 0000000..c5bbc67 Binary files /dev/null and b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.rc differ diff --git a/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.vcxproj b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.vcxproj new file mode 100644 index 0000000..7505830 --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.vcxproj @@ -0,0 +1,99 @@ +锘 + + + + Debug + Win32 + + + Release + Win32 + + + + {D39AFEDB-19C8-4F2E-AAD2-8F25A75D581C} + Win32Proj + Wow64Injectx64 + + + + Application + true + Unicode + Dynamic + + + Application + false + true + Unicode + Dynamic + + + + + + + + + + + + + true + + + false + + + + Use + Level3 + Disabled + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + + + Console + true + + + + + Level3 + Use + MaxSpeed + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + + + Console + true + true + true + + + + + + + + + + + + + + + Create + Create + + + + + + + + + + \ No newline at end of file diff --git a/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.vcxproj.filters b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.vcxproj.filters new file mode 100644 index 0000000..ba69034 --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.vcxproj.filters @@ -0,0 +1,50 @@ +锘 + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hpp;hxx;hm;inl;inc;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + + + + 澶存枃浠 + + + 澶存枃浠 + + + 澶存枃浠 + + + 澶存枃浠 + + + 澶存枃浠 + + + + + 婧愭枃浠 + + + 婧愭枃浠 + + + + + 璧勬簮鏂囦欢 + + + \ No newline at end of file diff --git a/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.vcxproj.user b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.vcxproj.user new file mode 100644 index 0000000..ace9a86 --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.vcxproj.user @@ -0,0 +1,3 @@ +锘 + + \ No newline at end of file diff --git a/Wow64Injectx64/Wow64Injectx64/stdafx.cpp b/Wow64Injectx64/Wow64Injectx64/stdafx.cpp new file mode 100644 index 0000000..264f1b4 --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64/stdafx.cpp @@ -0,0 +1,8 @@ +// stdafx.cpp : 只包括标准包含文件的源文件 +// Wow64Injectx64.pch 将作为预编译头 +// stdafx.obj 将包含预编译类型信息 + +#include "stdafx.h" + +// TODO: 在 STDAFX.H 中 +// 引用任何所需的附加头文件，而不是在此文件中引用 diff --git a/Wow64Injectx64/Wow64Injectx64/stdafx.h b/Wow64Injectx64/Wow64Injectx64/stdafx.h new file mode 100644 index 0000000..4721a60 --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64/stdafx.h @@ -0,0 +1,32 @@ +// stdafx.h : 标准系统包含文件的包含文件， +// 或是经常使用但不常更改的 +// 特定于项目的包含文件 +// + +#pragma once + +#include "targetver.h" + +#include +#include +#define _ATL_CSTRING_EXPLICIT_CONSTRUCTORS // 某些 CString 构造函数将是显式的 + +#ifndef VC_EXTRALEAN +#define VC_EXTRALEAN // 从 Windows 头文件中排除极少使用的信息 +#endif + +#include +#include // MFC 核心组件和标准组件 +#include // MFC 扩展 +#ifndef _AFX_NO_OLE_SUPPORT +#include // MFC 对 Internet Explorer 4 公共控件的支持 +#endif +#ifndef _AFX_NO_AFXCMN_SUPPORT +#include // MFC 对 Windows 公共控件的支持 +#endif // _AFX_NO_AFXCMN_SUPPORT + +#include + + + +// TODO: 在此处引用程序需要的其他头文件 diff --git a/Wow64Injectx64/Wow64Injectx64/targetver.h b/Wow64Injectx64/Wow64Injectx64/targetver.h new file mode 100644 index 0000000..7a7d2c8 --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64/targetver.h @@ -0,0 +1,8 @@ +#pragma once + +// 包括 SDKDDKVer.h 将定义可用的最高版本的 Windows 平台。 + +// 如果要为以前的 Windows 平台生成应用程序，请包括 WinSDKVer.h，并将 +// WIN32_WINNT 宏设置为要支持的平台，然后再包括 SDKDDKVer.h。 + +#include diff --git a/Wow64Injectx64/Wow64Injectx64/wow64ext.dll b/Wow64Injectx64/Wow64Injectx64/wow64ext.dll new file mode 100644 index 0000000..61d5620 Binary files /dev/null and b/Wow64Injectx64/Wow64Injectx64/wow64ext.dll differ diff --git a/Wow64Injectx64/Wow64Injectx64/wow64ext.h b/Wow64Injectx64/Wow64Injectx64/wow64ext.h new file mode 100644 index 0000000..93ef224 --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64/wow64ext.h @@ -0,0 +1,374 @@ +/** + * + * WOW64Ext Library + * + * Copyright (c) 2014 ReWolf + * http://blog.rewolf.pl/ + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published + * by the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with this program. If not, see . + * + */ +#pragma once + +#include + +#ifndef STATUS_SUCCESS +# define STATUS_SUCCESS 0 +#endif + +#pragma pack(push) +#pragma pack(1) +template +struct _LIST_ENTRY_T +{ + T Flink; + T Blink; +}; + +template +struct _UNICODE_STRING_T +{ + union + { + struct + { + WORD Length; + WORD MaximumLength; + }; + T dummy; + }; + T Buffer; +}; + +template +struct _NT_TIB_T +{ + T ExceptionList; + T StackBase; + T StackLimit; + T SubSystemTib; + T FiberData; + T ArbitraryUserPointer; + T Self; +}; + +template +struct _CLIENT_ID +{ + T UniqueProcess; + T UniqueThread; +}; + +template +struct _TEB_T_ +{ + _NT_TIB_T NtTib; + T EnvironmentPointer; + _CLIENT_ID ClientId; + T ActiveRpcHandle; + T ThreadLocalStoragePointer; + T ProcessEnvironmentBlock; + DWORD LastErrorValue; + DWORD CountOfOwnedCriticalSections; + T CsrClientThread; + T Win32ThreadInfo; + DWORD User32Reserved[26]; + //rest of the structure is not defined for now, as it is not needed +}; + +template +struct _LDR_DATA_TABLE_ENTRY_T +{ + _LIST_ENTRY_T InLoadOrderLinks; + _LIST_ENTRY_T InMemoryOrderLinks; + _LIST_ENTRY_T InInitializationOrderLinks; + T DllBase; + T EntryPoint; + union + { + DWORD SizeOfImage; + T dummy01; + }; + _UNICODE_STRING_T FullDllName; + _UNICODE_STRING_T BaseDllName; + DWORD Flags; + WORD LoadCount; + WORD TlsIndex; + union + { + _LIST_ENTRY_T HashLinks; + struct + { + T SectionPointer; + T CheckSum; + }; + }; + union + { + T LoadedImports; + DWORD TimeDateStamp; + }; + T EntryPointActivationContext; + T PatchInformation; + _LIST_ENTRY_T ForwarderLinks; + _LIST_ENTRY_T ServiceTagLinks; + _LIST_ENTRY_T StaticLinks; + T ContextInformation; + T OriginalBase; + _LARGE_INTEGER LoadTime; +}; + +template +struct _PEB_LDR_DATA_T +{ + DWORD Length; + DWORD Initialized; + T SsHandle; + _LIST_ENTRY_T InLoadOrderModuleList; + _LIST_ENTRY_T InMemoryOrderModuleList; + _LIST_ENTRY_T InInitializationOrderModuleList; + T EntryInProgress; + DWORD ShutdownInProgress; + T ShutdownThreadId; + +}; + +template +struct _PEB_T +{ + union + { + struct + { + BYTE InheritedAddressSpace; + BYTE ReadImageFileExecOptions; + BYTE BeingDebugged; + BYTE BitField; + }; + T dummy01; + }; + T Mutant; + T ImageBaseAddress; + T Ldr; + T ProcessParameters; + T SubSystemData; + T ProcessHeap; + T FastPebLock; + T AtlThunkSListPtr; + T IFEOKey; + T CrossProcessFlags; + T UserSharedInfoPtr; + DWORD SystemReserved; + DWORD AtlThunkSListPtr32; + T ApiSetMap; + T TlsExpansionCounter; + T TlsBitmap; + DWORD TlsBitmapBits[2]; + T ReadOnlySharedMemoryBase; + T HotpatchInformation; + T ReadOnlyStaticServerData; + T AnsiCodePageData; + T OemCodePageData; + T UnicodeCaseTableData; + DWORD NumberOfProcessors; + union + { + DWORD NtGlobalFlag; + NGF dummy02; + }; + LARGE_INTEGER CriticalSectionTimeout; + T HeapSegmentReserve; + T HeapSegmentCommit; + T HeapDeCommitTotalFreeThreshold; + T HeapDeCommitFreeBlockThreshold; + DWORD NumberOfHeaps; + DWORD MaximumNumberOfHeaps; + T ProcessHeaps; + T GdiSharedHandleTable; + T ProcessStarterHelper; + T GdiDCAttributeList; + T LoaderLock; + DWORD OSMajorVersion; + DWORD OSMinorVersion; + WORD OSBuildNumber; + WORD OSCSDVersion; + DWORD OSPlatformId; + DWORD ImageSubsystem; + DWORD ImageSubsystemMajorVersion; + T ImageSubsystemMinorVersion; + T ActiveProcessAffinityMask; + T GdiHandleBuffer[A]; + T PostProcessInitRoutine; + T TlsExpansionBitmap; + DWORD TlsExpansionBitmapBits[32]; + T SessionId; + ULARGE_INTEGER AppCompatFlags; + ULARGE_INTEGER AppCompatFlagsUser; + T pShimData; + T AppCompatInfo; + _UNICODE_STRING_T CSDVersion; + T ActivationContextData; + T ProcessAssemblyStorageMap; + T SystemDefaultActivationContextData; + T SystemAssemblyStorageMap; + T MinimumStackCommit; + T FlsCallback; + _LIST_ENTRY_T FlsListHead; + T FlsBitmap; + DWORD FlsBitmapBits[4]; + T FlsHighIndex; + T WerRegistrationData; + T WerShipAssertPtr; + T pContextData; + T pImageHeaderHash; + T TracingFlags; +}; + +typedef _LDR_DATA_TABLE_ENTRY_T LDR_DATA_TABLE_ENTRY32; +typedef _LDR_DATA_TABLE_ENTRY_T LDR_DATA_TABLE_ENTRY64; + +typedef _TEB_T_ TEB32; +typedef _TEB_T_ TEB64; + +typedef _PEB_LDR_DATA_T PEB_LDR_DATA32; +typedef _PEB_LDR_DATA_T PEB_LDR_DATA64; + +typedef _PEB_T PEB32; +typedef _PEB_T PEB64; + +struct _XSAVE_FORMAT64 +{ + WORD ControlWord; + WORD StatusWord; + BYTE TagWord; + BYTE Reserved1; + WORD ErrorOpcode; + DWORD ErrorOffset; + WORD ErrorSelector; + WORD Reserved2; + DWORD DataOffset; + WORD DataSelector; + WORD Reserved3; + DWORD MxCsr; + DWORD MxCsr_Mask; + _M128A FloatRegisters[8]; + _M128A XmmRegisters[16]; + BYTE Reserved4[96]; +}; + +struct _CONTEXT64 +{ + DWORD64 P1Home; + DWORD64 P2Home; + DWORD64 P3Home; + DWORD64 P4Home; + DWORD64 P5Home; + DWORD64 P6Home; + DWORD ContextFlags; + DWORD MxCsr; + WORD SegCs; + WORD SegDs; + WORD SegEs; + WORD SegFs; + WORD SegGs; + WORD SegSs; + DWORD EFlags; + DWORD64 Dr0; + DWORD64 Dr1; + DWORD64 Dr2; + DWORD64 Dr3; + DWORD64 Dr6; + DWORD64 Dr7; + DWORD64 Rax; + DWORD64 Rcx; + DWORD64 Rdx; + DWORD64 Rbx; + DWORD64 Rsp; + DWORD64 Rbp; + DWORD64 Rsi; + DWORD64 Rdi; + DWORD64 R8; + DWORD64 R9; + DWORD64 R10; + DWORD64 R11; + DWORD64 R12; + DWORD64 R13; + DWORD64 R14; + DWORD64 R15; + DWORD64 Rip; + _XSAVE_FORMAT64 FltSave; + _M128A Header[2]; + _M128A Legacy[8]; + _M128A Xmm0; + _M128A Xmm1; + _M128A Xmm2; + _M128A Xmm3; + _M128A Xmm4; + _M128A Xmm5; + _M128A Xmm6; + _M128A Xmm7; + _M128A Xmm8; + _M128A Xmm9; + _M128A Xmm10; + _M128A Xmm11; + _M128A Xmm12; + _M128A Xmm13; + _M128A Xmm14; + _M128A Xmm15; + _M128A VectorRegister[26]; + DWORD64 VectorControl; + DWORD64 DebugControl; + DWORD64 LastBranchToRip; + DWORD64 LastBranchFromRip; + DWORD64 LastExceptionToRip; + DWORD64 LastExceptionFromRip; +}; + +// Below defines for .ContextFlags field are taken from WinNT.h +#ifndef CONTEXT_AMD64 +#define CONTEXT_AMD64 0x100000 +#endif + +#define CONTEXT64_CONTROL (CONTEXT_AMD64 | 0x1L) +#define CONTEXT64_INTEGER (CONTEXT_AMD64 | 0x2L) +#define CONTEXT64_SEGMENTS (CONTEXT_AMD64 | 0x4L) +#define CONTEXT64_FLOATING_POINT (CONTEXT_AMD64 | 0x8L) +#define CONTEXT64_DEBUG_REGISTERS (CONTEXT_AMD64 | 0x10L) +#define CONTEXT64_FULL (CONTEXT64_CONTROL | CONTEXT64_INTEGER | CONTEXT64_FLOATING_POINT) +#define CONTEXT64_ALL (CONTEXT64_CONTROL | CONTEXT64_INTEGER | CONTEXT64_SEGMENTS | CONTEXT64_FLOATING_POINT | CONTEXT64_DEBUG_REGISTERS) +#define CONTEXT64_XSTATE (CONTEXT_AMD64 | 0x20L) + +#pragma pack(pop) + +#ifdef WOW64EXT_EXPORTS +# define SPEC dllexport +#else +# define SPEC dllimport +#endif + +extern "C" +{ + __declspec(SPEC)DWORD64 __cdecl X64Call(DWORD64 func, int argC, ...); + __declspec(SPEC)DWORD64 __cdecl GetModuleHandle64(wchar_t* lpModuleName); + __declspec(SPEC)DWORD64 __cdecl GetProcAddress64(DWORD64 hModule, char* funcName); + __declspec(SPEC)SIZE_T __cdecl VirtualQueryEx64(HANDLE hProcess, DWORD64 lpAddress, MEMORY_BASIC_INFORMATION64* lpBuffer, SIZE_T dwLength); + __declspec(SPEC)DWORD64 __cdecl VirtualAllocEx64(HANDLE hProcess, DWORD64 lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect); + __declspec(SPEC)BOOL __cdecl VirtualFreeEx64(HANDLE hProcess, DWORD64 lpAddress, SIZE_T dwSize, DWORD dwFreeType); + __declspec(SPEC)BOOL __cdecl VirtualProtectEx64(HANDLE hProcess, DWORD64 lpAddress, SIZE_T dwSize, DWORD flNewProtect, DWORD* lpflOldProtect); + __declspec(SPEC)BOOL __cdecl ReadProcessMemory64(HANDLE hProcess, DWORD64 lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesRead); + __declspec(SPEC)BOOL __cdecl WriteProcessMemory64(HANDLE hProcess, DWORD64 lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten); + __declspec(SPEC)BOOL __cdecl GetThreadContext64(HANDLE hThread, _CONTEXT64* lpContext); + __declspec(SPEC)BOOL __cdecl SetThreadContext64(HANDLE hThread, _CONTEXT64* lpContext); + __declspec(SPEC)VOID __cdecl SetLastErrorFromX64Call(DWORD64 status); +} diff --git a/Wow64Injectx64/Wow64Injectx64/wow64ext.lib b/Wow64Injectx64/Wow64Injectx64/wow64ext.lib new file mode 100644 index 0000000..f09c639 Binary files /dev/null and b/Wow64Injectx64/Wow64Injectx64/wow64ext.lib differ