From e8cf594cdcca241f8542cf1b8760a319dae0013f Mon Sep 17 00:00:00 2001 From: ChengChengCC Date: Thu, 3 Mar 2016 00:20:40 +0800 Subject: [PATCH] Wow64InjectX64 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Windows下32位进程注入64位进程 --- Wow64Injectx64/ReadMe.md | 3 + Wow64Injectx64/Wow64Injectx64.sln | 20 + Wow64Injectx64/Wow64Injectx64.suo | Bin 0 -> 12800 bytes Wow64Injectx64/Wow64Injectx64/Messagebox.dll | Bin 0 -> 34816 bytes Wow64Injectx64/Wow64Injectx64/Resource.h | 17 + .../Wow64Injectx64/Wow64Injectx64.cpp | 161 ++++++++ .../Wow64Injectx64/Wow64Injectx64.h | 3 + .../Wow64Injectx64/Wow64Injectx64.rc | Bin 0 -> 2650 bytes .../Wow64Injectx64/Wow64Injectx64.vcxproj | 99 +++++ .../Wow64Injectx64.vcxproj.filters | 50 +++ .../Wow64Injectx64.vcxproj.user | 3 + Wow64Injectx64/Wow64Injectx64/stdafx.cpp | 8 + Wow64Injectx64/Wow64Injectx64/stdafx.h | 32 ++ Wow64Injectx64/Wow64Injectx64/targetver.h | 8 + Wow64Injectx64/Wow64Injectx64/wow64ext.dll | Bin 0 -> 41472 bytes Wow64Injectx64/Wow64Injectx64/wow64ext.h | 374 ++++++++++++++++++ Wow64Injectx64/Wow64Injectx64/wow64ext.lib | Bin 0 -> 4134 bytes 17 files changed, 778 insertions(+) create mode 100644 Wow64Injectx64/ReadMe.md create mode 100644 Wow64Injectx64/Wow64Injectx64.sln create mode 100644 Wow64Injectx64/Wow64Injectx64.suo create mode 100644 Wow64Injectx64/Wow64Injectx64/Messagebox.dll create mode 100644 Wow64Injectx64/Wow64Injectx64/Resource.h create mode 100644 Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.cpp create mode 100644 Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.h create mode 100644 Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.rc create mode 100644 Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.vcxproj create mode 100644 Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.vcxproj.filters create mode 100644 Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.vcxproj.user create mode 100644 Wow64Injectx64/Wow64Injectx64/stdafx.cpp create mode 100644 Wow64Injectx64/Wow64Injectx64/stdafx.h create mode 100644 Wow64Injectx64/Wow64Injectx64/targetver.h create mode 100644 Wow64Injectx64/Wow64Injectx64/wow64ext.dll create mode 100644 Wow64Injectx64/Wow64Injectx64/wow64ext.h create mode 100644 Wow64Injectx64/Wow64Injectx64/wow64ext.lib diff --git a/Wow64Injectx64/ReadMe.md b/Wow64Injectx64/ReadMe.md new file mode 100644 index 0000000..cc10cd6 --- /dev/null +++ b/Wow64Injectx64/ReadMe.md @@ -0,0 +1,3 @@ +##Wow64עx64 +Win7 Ultimate Sp1 Գɹ +[http://www.cnblogs.com/lanrenxinxin/p/4821152.html](http://www.cnblogs.com/lanrenxinxin/p/4821152.html) \ No newline at end of file diff --git a/Wow64Injectx64/Wow64Injectx64.sln b/Wow64Injectx64/Wow64Injectx64.sln new file mode 100644 index 0000000..547f87d --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64.sln @@ -0,0 +1,20 @@ + +Microsoft Visual Studio Solution File, Format Version 11.00 +# Visual Studio 2010 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Wow64Injectx64", "Wow64Injectx64\Wow64Injectx64.vcxproj", "{D39AFEDB-19C8-4F2E-AAD2-8F25A75D581C}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Win32 = Debug|Win32 + Release|Win32 = Release|Win32 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {D39AFEDB-19C8-4F2E-AAD2-8F25A75D581C}.Debug|Win32.ActiveCfg = Debug|Win32 + {D39AFEDB-19C8-4F2E-AAD2-8F25A75D581C}.Debug|Win32.Build.0 = Debug|Win32 + {D39AFEDB-19C8-4F2E-AAD2-8F25A75D581C}.Release|Win32.ActiveCfg = Release|Win32 + {D39AFEDB-19C8-4F2E-AAD2-8F25A75D581C}.Release|Win32.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/Wow64Injectx64/Wow64Injectx64.suo b/Wow64Injectx64/Wow64Injectx64.suo new file mode 100644 index 0000000000000000000000000000000000000000..ca75c46a68acd7b061d9f9c6d5a080565700d207 GIT binary patch literal 12800 zcmeHNTWlOx89tjfZ7!wFjnITN+2%r>#yjk;y^ihFCF@-~apKf&d`p9ybT4CP?e&h? zosAvEL8v@bAX z=kDFRR;3WgK7jwD8TbgiK5VbyYNU?>x#nwuYk-dd*8$f9KLLCk_yiEkFE#?V05<_Q z13wA;6mTn$dxH1?R`v{>6b62#@QNOhL7Ej8uzK!ct604#^E+yE``N*NUpe;Ao1TZ* zZoAcZ5EKnDCHg>p0=XVBU*jvKueU-A70+<#+v+9mU&646iJX`g{UU|b6eD=*;7Qfz ztY%f8dmErnok`gu41?~h7?d<~HV-=HB7vGH@Vp2Jzc^quuJC*o^q)dK<(2bLp~*c} z)Z40|l2fh;^#FB%sw0n|v&)o!>Vir-K*>M*Q3t60Pa?k!$ff=?ko$wY?gZ`vdVx;^ zM}d2Qdx86ap8-AtYy$2FJ`3aw@Vh>wnw|F}4FH3{7GNuoZQAU#-A>2tRPpt^T|SI7 z4D1F*fKgx%uorj)cof(NJO(@t><69zz5pBm4gy~Uo&*j7hk=U581kopF9A;jKM&-) zmyw|;@BGi4ubnKB09zRqV~!mAI6>>0gg*O zLLFy9zs{mOhICG}L0zfDRVGzNWWLi?OUsg~{|yI!%%!{ytIJX6-y0{R#9 z8wk{K#q_(Odv)+I4NeW{L)s)KKAIZPzw~kbK}82Br%(Gs-8&1qDR7W+q)uIBji29i zJAO(Gbt|Eqey<#J66wfTh0`&>BGVsQL z|3E)x6m>bwT?{?Em`4-&BFXhf%2BdC?~*8ffH3; zIUHGhu7o+FR!CsZxUM?pY^gv|;F-mbo#ik4Sv#Dbh5}n~R8gjG>q%*q}r9!KYtCKr-O{J+$=D2()30oQiaAl7TWKrk(=Vof?3O0Z#c{V7vh@DHGe*?0V$DCVVE*|M1X!1T}o(k4`HRa(0n#VK25 z3_!-FV8>|d%GY=lcCHre#`rmvJcGHV-;B1e+8<7s^KGr;i|RlYweyMj*{m_O5a}Er z$-##m4-btDjYsv|v}w$iHFhp)iP_nOg^N*tPaqtMwE4PQLLI)=p4Nb`qr1)TYiVf< zbp(TvU^p1O^y>yy*s>2{j>=J=H??zaS@#H!Qsk+_jjG~hA4l1$*0B_;MD#wb24jdP zAZckSXY|%$kOcZ{jEY#XAtAb?Pb$PAdB(p8uen8Z;DpnQ^LiBLcON{v4#-bCa;>Nh zqTYx1VZ03@*DmWqC?6Cd)P+zJK>JJZ29vNZrE~|R_g_qv-f(Ff#hay_*>;VLTP!DU zhh+3+IlrhOR-t3AdBS3xYr(d$Etn+@9%#4JcRc-dqg4{4F3fxvO3TYj!S>d}2Q_^d zHiLTkJjM_K-;9=U1!#pUfAtXjx-c+;ed5P%;4gw*G$i(}|0sOm^=n7pdhhCu%|94> zqF+4z`|auftlcwk`R;2U-nf2+At9WxZ*SRm>!*A69Qoy6KDhKue1^d$z>sL4*mC{O z^_~4!zL)&Tw|D-nqrU#uR~mo5=oR8y7)fKN{|tJjZYs+Gg#~4`95E z|L~+soGj9OQPik*)wrSlCEcg%px=SEJGp59^pz_4MO{_wsMV|R zIW5;Yi^}BS{a!x%Ztbq(YDWX|*NM(e_6O8GtGa(3g6~NmfOim- zj9M0u`=4hB9;e;P-yyVB@t09h7?wLQEu&rYkU#n#=OKH%2dD)+fA6wsyQTje+S}m| z+!4+|`Uh<-9E1GpxLb64`@lQXRUY24k~X0hzkE+mUX9GsyDIkYWZz5gjmmuk4YM_i zpLG*TDnmdokT|&<56+?=t;soguWW~4Bpc-HS2s6xrmx@J_=|4w{k_MYy2Tf)SD@BR zm7UV!e#{rsa(}zBROw#+)%~tLXr?W|mAksOTPOK_u)0o?Rgm4w_Uba#R`lw2+nh4F zzpGnB7}?bU{0YI?MJer2R;nFPtv?!BMnXI(JWxNcEUF~!?F{n#Cr$L4vcEYy62#L# zV=R}|P z0rWoHQ7_#8ueN!p!e&WzF@4MbvLbSf0O+92$QDlmwR|6bl>fireG(&-Zs&glZI#!& zQey6n$Eq=y60mmr++tnu?XMueTb4_y@akeYV+_gzqM&_o31_1Ec$&kGwf@bc%ezDk z-i`7%3enqYQPZz^8jl^;$EO<$bmsJ7|6ku5-@iMsbHg95e)G?3F%l)&Dy{X8rgG2J z*>4@k+*O}HxoI393-@dKDzW*Efj@rXL*uJAZr|QE{kwP0US=RxO_NF;x##~FtH&Q0 zlMUAB&-m*GwBemPN!DmCU-Rtorrod>{aU7#^wm(^(ticCe{R!Xj-+1t%R#gF8%v@8 EUxdl*(EtDd literal 0 HcmV?d00001 diff --git a/Wow64Injectx64/Wow64Injectx64/Messagebox.dll b/Wow64Injectx64/Wow64Injectx64/Messagebox.dll new file mode 100644 index 0000000000000000000000000000000000000000..2def98ed8c9c3567c998c4898ff5020ff2fc3302 GIT binary patch literal 34816 zcmeHw4R{;XneLHoC5~f9=10V7yJX_XU`S$|IIzx-gA_~YIF*C&Ph!9z%hEU&ktHF` zBo3uuW2eNO=r**_a{KV?rYVJ_yM@3~NK$qyC)qd&`D;QKTDVL4cUQ)A8=$uYmNNJK z&WvQ)fqi8n6ua9J~5}II~W(DvB>(EuSf9v!r_Q4bV@=@2@Aon;Jm3>=!pcRs*;i- zo1uEdE>34SdZ8VRc__Arv0F&bcE;NDDu~NilCf$KkHpyLDE&uX!gm-u zovmk5xhh%emBDKhaVtfjwj1q0j9&s{9aXV_PxdkP@ReY7Ab`o%AY@&3pjM@eu_aTH z(T6~FhY_+aJ6cl})diE}Y-lU5GnyrYsGal$b-ACTTi6bSVgxcc>#~!+SUlzjk7Kt7 zktqm$2w9h%^u?r5gaoNGlL%zrml3iqJ7X)el7CUr<8+M@cszF8J>;~N4Yk-x#UZz? zaGf~tX0@n(u#b9SFG;-fccSXH*;S`agrqQVk4<2)aw7Q~^TuYmYL2=S=9w5`V!|qb z)Ew2Ul@FsZ;V%vxs`eh#EBc7LR`KCOX*<%{Frc=t?qTv2F6(&DN~)|{z1df0p) zxTXlRJy53&EvUC=S`f{oA9iZD=jZv>2cOI7nmM6@GA<}m2k)SBd| zjG<;onk-vt&;k*SujWQb$P-n2A+@G54I!CXDGm+Vwn7Fbp2N6%fCB6RX3-FTt zH}lHAeiO3KAREGD{d2$_xgpFsFr^g}dg@8!j+k#iQR)*N;$j$>C?THsfJq#vYetO8 z^T1n;Sn4+b6$(G=RtIfKz`OG^%!uK^vcLN#fq zEn5UK2+b5xlBH~vG61xLTT5I5#7+Qir$nOUZ{ukIiID+NBmhMNK)VP4MGjysA(8=b zCCU(htD$7zLY{2V5&QvKH2M&Ardr}fmS(*Kg48b_QtM%s!CUm)Yk2NEU)6KF$@UIZ zz^(L9fhgJAO|iC`S4K`PlS?)0 zlVl3UMz^@cq~whq9T$w7N57fTqZVq`+YGxpG;43B)R0MQv2~zjTVm9*zcyrg!MTld zDmX{Ci$|8y=6@wJWd1G4i1`P&(*?9^nW8%&@!){^EZ2W%7qa#FM-tV7it0>q()^0q zsgl%~6m#kqX3RM-%dWQAY6-;Zlm+E5Ayj5fnUm&&fj6nU_=H9+8ZytnlN;8?lq&}6 zIyXRpQbH1lu+hul7^tqzBu^!hr?@d<9=r)zav4?KfvN!whvAE010Q{cmuF7QPD%fv zX_;KbJh~4$CW$=pUPh$Nq_|L_z?2nSsOAi>BsB<;35*#~3zI&?pl9->*;$(P4KT@S zrW>EHh?6S(@%x&#C8-pqo6BpI%c1W{uJ58IJ_0s1Vk}c+#GL9z@8bd*0-zVOpyw0v zUi6aDwLCrWUcn}d=pV*tcK|W;_VB@)X{};ug4R;t6?gX$P`jb zp5~k{8XRmNxIg)kb|+}{NVL!bdL;GgbiJZVk`OejgO@OW1;vR|ty! z=$gt**QD*|BgURufUXna1V!Wo)Q{tRYxJnGFUYL-L+$!DM-UT#_0%m;pQuaT2D0q+ z_!XAfs4XA*8K+}LkKwVl?$LjrAO#O(5a+s@1Hx#N#5uT^YA6Saza`8~?- zow%p1BmLNh@lJ&O)zmMA1VEwXc~;kWD@I8{O>%4vXNi9MassYU%s(Qk!z7Eo!>zxT zo_@HbjWfi7WSKZrfJA|f6ivrs#aMq$MCOv;G^V8IR@L$kV(op0@?b+y)=;M<$zw(+)Pc`_QN17!+UGe4dUPt zU}(qlcmU(z>CM_hNj|q~6)iATt5}7*?(^hj1Me4Xy3U;_>G&l&!GFM|KGa{>$5^Af zZMYBfm}B65O`h*m4>;5_P*XWt35533yzJOdy@8UyZ(vLpNKFTaq>TC0-rTy*(c)-z ztaYrzZhFrQvdnx1SyXd~Z{5Ig)o6|CXoElHRNofW_gw0~r5?lLBC4;@+%jEMPo)Nt zcB|(c14kkH&oyWEjs5{u4#8Q(p=WKopu~*?X0_%oGge0%*7!mWNdmh=Jljqz$h}mv zUJY3>@hlfWMN`GZ_4Bdu-IrI233n&jhM8y%X7hKyK&$OZw>qL;zFR$!dYNZgwuqo( zd3#KaTYjZX6Sur-8N42x!K6Gxv!2~T#VuRrf`g%n{afOu|8S%0?PB5~TL%nu>@7eZ ze6x}$Hz}3CZWD^+g-&!OB+cz^%93r>R1`XlqUy<^5H%g6N;^BcpLzk!uNBeSXn~$U zi9x*{U}gYDl@;M}0h8_++GM~`4O4mXElE<)2OB7fmE%!e8=21m7cI`$3CWr>8BJsY z)D1$NX8qrTXV7uPYg`b4xg_@ zhrs8{JE&3I=LK+_s+ED`R)0$4%QAQfeb~1YUGjph8rhb?uY(~H)=5!)|LrHmcYiDn z49^$)-($$$)T`Hh6wu#=!PjM(JqUS}d#+%Ks10v*7SA3`DsRz@eN+<@7#eRsS#z{& zJMxQozU9M@$j1X(4)2_l|`rG!En^( z9174#vpz$ai8}-|@S9wY9t+UR==73%IRl=6o#nM$&YI83HrozTk4=f7op$qDTJSVR zW7Vx5Y=HXI_ecN(fCM$`WBoK7N``?l>U>vhQjQei)>cqAJlBW$Ee{{se zb}f*ifkb>v9k{D6iHv(VJ8n;R z4Icw`OxOBkJ@BURkMMs+b92hQ?1Wo=->tsYU|BgTZuyOTJGB|6$+k8(0PJw9zYx{8 z-1A07^$&2LjQ=<+&$VAqP5mLPYEX|m)q|SVi$30ZrKlZl7&w$KYA2MRx>e{9RcNE# zo~I#EaNo+q1%J&B7fhwqM9_!7_x6M1Gj@IQC+Crg4=zaN(l|)wR=j_whlcRmgp`o_Fzk8^5o{Ju{u*`4>|Ze~7(!XNdq`t%0 zy&@V_8w%h3DW1;6xqR1b7yVojt&M7diLXjjwi_>eO6i>s%5;m^k@6`$Q(+~=sx8mi z^KBN(b4k>ARfdyHVWSJ?hGePu2$io)Z=Pw0p&V`iW_%YX@O0_~t-smJf)i~lYh8;i z3~gW%A=^*kfk^=6s`-_exC?ud_gzDCx|~DhVxskR7sf00b0-_sw=`@2m!J#Vic8@W z{fDRw_u_VpIH&5mPgGksiE87&Y1R%1!unU-NbRMEj4lUW=NxVDJC<)r-aG8*Uv8oY ziiSk7N%;q-<$1>xgv)6nqqmZdd2f-Q@1dyr8lLtF%N*(lE+{O=^OSl}OceL2&SS;P z&c}+>59eK2CLb$|P1O!Mmc0`DIc{>VcFYDXPl4x7G@inIJA>C^LLpBrP5j68>{Ghp zMB`H^>r_W9&!6SB&`r=hb`t%jF8Y*vNO}U@^90qh{WO3YL}rhk`2?RFI(Wj=p#Dzt zlv2?}U|43`$q*{)<+Y(ajUvp^ts@k{TG6=9op43SxH3{|p<>Uw)-5}z%upL6%T8^Y zn%_9G?7i4!ToLLg^~!Gkl%cx3RMo362s>S4*RRbMm%U;cI1HvZ{L6gJy84SWs~rT; zsKx3;N>tDDm2D@u_q^T>91Vxo1mon+d0&bwTM@fWZT0>TW-|4~ zWoI{DDkfGHE~||dX~TF*EL?Uh_O{yke8PeCyzwd3dANW#9PM0RL60Pj>Ig9^9Ya$9 z2G_1_KL=%lNvFm2OU?S|-DK@ydgFve`EQU)H@uWIis~iW*ZLrj#3@QNMG-^yBj$0a zheTC(YT8YZM^7F&$1(caXm_ES&#VQ}=YKmmeRZ?iP{6X~S=yye>z zNt8TZPiyeG&73QLp1&H=x8dB}myrQqzmB%q)#RD9zti*ictGA|VqzQ5)2v5zHHw&} zhJJo|@ITSg2(1&f3>aGSFlMj@P*Z4;c48SoxIJh9TI;Cw1*C#NY>~G;0gWVf^QlTFk^K zhMAN0w2MiS?}F@5wE(Ixn_zQaT?jS0mVesj^h z515p1|M-o8_w!=ka^TgUBmZ>QlJ*w6vMsSv>l(PnX>XT{_hP%ix`v!BcI|+3-T}wJ zg)+b7>!Mhe7K{FCOg8Dw|H$A@f zB%g>*A#w8y%^`isspq(W@;WjlWF|ZX)WnX|-{|}iZbQ0?%+?lt zJ;;@aw4Z&EcX3KWk(#4$&WDEaW(_Ft#sG!+$RKncp~m$eqE=_2k>2-=@3+KdCA*uj zpj{#k50`emJFIC+-a7}y;iILabD-+DR#61}wTcfm(*56YPwUXB{(h_fO}sEcYfEl# zp~2&&pBz=QNaGK%wb6P9#5%|?+fp>S65IHFNOll}wI~k-`00tV_)xJ^46Qd8LMg=s zH_GF=0UBvn)=_gb6@;#_a#1yYBOEfnM6v*k+k*)kOSF$zs(C-xVxC710Qv1yAAX+z zcf_0r=ClHq95H_YFrbqPJa{un@NJekVZ@`F^)qPPkU4}BdXMhsapGo7)P_TE#K&w2I^Wev;o$^LyUM z@W00SgZ#dc-@Ez!R(^N$`wD)q=J#@bzntHv@cV^0)%XU#zsBz;`8~<+&+z+W{QeDo z-^%ZI<37mRA&^5Lhd>U290EB6atP!Q z$RUtJ;J+sV_Ewzm6GZh5ai|ezKwJn+WkarNimQzvr&F)Jq-opf)DezGW#mW9b@&Yj zzXjqCCU}nCzD&M;VE(Sx#*1=+Og`$vSs51sug|W!>~&`RiKH@Z#3j-%GGkK_0cENS z=hCvO`0oj1&Z-;&IRtVDmRA&^7hzZ?O2age)m2;>mR zA@FHJp!5>fM{h@SR}O)XLm>T)N&F!S!=E=W4?Yg%!Cy<$)qsyEu4XP)&svOhnBB=F z=AZnLL!OJj%vstV2()kX%aKSZ-tLdd-p){g1*j>Bq(tyfG>4+MPd@Z z)ESh6zEJRPpB#*Y4LfvwJyK63wmGeba_fC@S&$<_ya#niF+tuOmGI?HB_0f~7ebME zT!?fD#y29z?TSW%VHwhfLF3i1XqP^|>;|ng=mkmVzhY3*MdOe#&PTu>3Gu5nydfOf z6c(D4upI1>g!*m?IJjc5NUW#?5);}n37$>9c-kTxqV> zrGijYGR@!ZLx%}MJ4s!zVLeLYpxd`ccl-#8g^|KHU&c=fj$E3 z>*|vHa1>O2mjd6CH>YihNpU44lZHqXJr=whZS~VfV)YJaL5YpNkiu?b79NQ?zR;Gd)gOiCQ}Lfj|lHB$W~LN#ZV3P}EtF9wAi zo=BL$(uMqy@J1bEJujG&G607S1AfK{hNsBpI<7$ORN#g|xFUT$c> zI9t#%KG0VAf*}QS$lQv6ut2DYv-Eguj06`M?iBCdTvTvI-Uee*r=T!yiZ)<>iko?Lw&-iy&07B36Pj zt*Fb#I-!wjl94AsUl5w2;Q82Qq?=$%J!m6j;`rxd>k&%>sNSdk+TfXVTtm=UOwA_re;_y`OuJ)M~3$%WFBLb@?1sb57-Om<6! zcLJ%?~`$is7yLF8OyZ3zJ7h46Yke(nxCUN1U?N2G&MV$A1ixx zI56!|=TPe5vk(5k`7G^G>zB5-Vq%ZCJDOXY+nrK;gB*#rH)7`Wt(Q6@z3si&$UCJ@ zWqlSCA5HK4G=P$8!zYfwj?&zG`iX;_tKd_Ez`5Lb`PB5~C(#ho)p_i)CQHEXwnw=`7;kkN=qgpCQSEfiGF{UzE(mhlf6|(_=`_ zKza|-baDMzdM=q}V$+QBCgiUuV{8|~>9joMccNTT0V`TOg%vHD5}gpIe9||=#Aama zokskfx?QCA*Pp?&_-FB-6F@IfZpZ!O_RP9-I=eIQ6Vqj;e=!xGFFIFvdP=e&n(xW0 zW-MyMC%|XWmt25Rmd?m*#vVW*{X{3{p8)UIMn2IwkUI}52xud|&@~62Rw|UgJb^cB zRvw#bdVtp{;AJ0`p<6$~Yw0qJaUwd4H*5A3R$^MhxWyfL99^H0| z??kvj^}`;DA4d39+Mbr1F6IS1Tt}uH*}ZrT%ho;Xv-xbA$<6Yjdf(EQo@UK9vy#PU zf#XRw#o*Joj{qYx;cI!trb`gZT{#4D2>dxBKz~3&7az}PKsKfJq(4x9;&$Oo7yb_A z&#{d;n?D|b(o%ex9-$1c0r3pUUPTZP$Nre*V`{HN9KU(9hY{#Ijypha!``J9ar(dV z9!Ibvz6W#;_A_mWp9B3r2wM?n*t5KV@Cf2b(035_5`Px zUO`*{J%n%$@zbDpd=~oz#G{~J!oI5XZtOom-#{os{5+_W_7RACKp#YKBEAFkw+I1} z0Tl#&pF#BJ2oHfz^gV<@#IyGh{d4f&-(jC{1bm_oA?!swd;dWDh^w$4D8Twll=cF@ zgG~0Gfc6VFVExE*vc*7xlc2Tkt< zviAYmdjQ%CT!{}8o`yWps}Pci6RkqngE-O8BkVxj1KPR(xZDGKK);Gmi})VU_whr= za>QxhN_$lg@F#iT&2yX8)Au zrQ;$v=GDV~G#>X#?3f7$*W&BFQg0C7!@beu_11giQOO_d3i`b`PZYpGGVFASAC0#8 zqcRSOKn-hbUR&R^u)5mG4fY}5ACi1wFP%9j4J-(0 zG!qAUsM7iQUe5hVzBkP=dpGs?Hb_yQ+)e+j=GrNn{BeJDGsV{+FCN9AB_ne^)r^yP z0s6Uay%h6yMtdL>3Dh+4X1k}uE@z}J(rxSm+VkDn01?xV8Jo8z+7L&tF( zaXMH-F(#PT1p^Y!X~kM1jdav%s+Y_#&Vk@WM!q}Z3%G-wF<)#myy)dTQSwDs!F3or z%j5ir2)j955)B{;#y&$F{h$z8PiKWto|)GMV=@kJaoDh<9hVZhuRx~TMEZ?7*~x+y zI9)J|a~K9dct3VAYU~#Utzq5W0-4qsuEzeM0N(tu*;f@b$sxn6*6^la82vJvcy4%t z5?y7SL34%W81}+tlvD4E$~YNSAAxh?f8hRtt7(nPogRDR^I$HPL*P$`0Nzuha)iE# zHkeo*7}X!a$EVeqh`i|2jD5p2u~aT~F#^B+;g6Qz*xQ4n*EkG<*|e^FVO4dxz*ke8 zu&gU@ZCSOTwp@tInA?1`Ue%Rvmg40%t|%#5?u*Bzo=zNMg@SOru3U+Qm&X0w5{~RH z=n2vZ*hrVWz#r*Z>WlYOZCqH61Hj>6mlT)RX4eK)g0NhUDRH?0tL7i6t)`rpL&>=0 zS7JEAYox)6Np~rzMGAOg!Ht-@*GutCW_Gr#7e#3iaZ4MekPxDKUAZsb5Z)NsAjQfB zCFt4GpdS&i2P2d3?v?yB^>3c;D`=ySMLtWcQBUyLLyP?0pi4p;<9xj(q3BpXe$7 LFQO;@B#r#PN_?6$ literal 0 HcmV?d00001 diff --git a/Wow64Injectx64/Wow64Injectx64/Resource.h b/Wow64Injectx64/Wow64Injectx64/Resource.h new file mode 100644 index 0000000..b454227 --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64/Resource.h @@ -0,0 +1,17 @@ +//{{NO_DEPENDENCIES}} +// Microsoft Visual C++ generated include file. +// Used by Wow64Injectx64.rc +// + +#define IDS_APP_TITLE 103 + +// ¶һĬֵ +// +#ifdef APSTUDIO_INVOKED +#ifndef APSTUDIO_READONLY_SYMBOLS +#define _APS_NEXT_RESOURCE_VALUE 101 +#define _APS_NEXT_COMMAND_VALUE 40001 +#define _APS_NEXT_CONTROL_VALUE 1000 +#define _APS_NEXT_SYMED_VALUE 101 +#endif +#endif diff --git a/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.cpp b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.cpp new file mode 100644 index 0000000..a13165b --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.cpp @@ -0,0 +1,161 @@ +// Wow64Injectx64.cpp : ̨Ӧóڵ㡣 +// + +#include "stdafx.h" +#include "Wow64Injectx64.h" +#include +#include +#include +#include "wow64ext.h" +#ifdef _DEBUG +#define new DEBUG_NEW +#endif + +#pragma comment(lib,"wow64ext.lib") + +// ΨһӦó +CWinApp theApp; + +using namespace std; + +typedef struct _UNICODE_STRING { + USHORT Length; //UNICODEռõڴֽ*2 + USHORT MaximumLength; + DWORD64 Buffer; //עָ +} UNICODE_STRING ,*PUNICODE_STRING; + + + +unsigned char shell_code[] = { + 0x48, 0x89, 0x4c, 0x24, 0x08, // mov qword ptr [rsp+8],rcx + 0x57, // push rdi + 0x48, 0x83, 0xec, 0x20, // sub rsp,20h + 0x48, 0x8b, 0xfc, // mov rdi,rsp + 0xb9, 0x08, 0x00, 0x00, 0x00, // mov ecx,8 + 0xb8, 0xcc, 0xcc, 0xcc, 0xcc, // mov eac,0CCCCCCCCh + 0xf3, 0xab, // rep stos dword ptr [rdi] + 0x48, 0x8b, 0x4c, 0x24, 0x30, // mov rcx,qword ptr [__formal] + 0x49, 0xb9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // mov r9,0 //PVOID* BaseAddr opt + 0x49, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // mov r8,0 //PUNICODE_STRING Name + 0x48, 0xba, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // mov rdx,0 + 0x48, 0xb9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // mov rcx,0 + 0x48, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // mov rax,0 + 0xff, 0xd0, // call rax LdrLoadDll + 0x48, 0xb9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // mov rcx,0 + 0x48, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // mov rax,0 + 0xff, 0xd0 // call rax +}; + + +enum InjectResult{ + OK, + Error_NoSuchFile, + Error_OpenProcess, + Error_VirtualAllocEx, + Error_GetProcAddress, + Error_WriteProcessMemory, + Error_CreateRemoteThread +}; + + +InjectResult Wow64Injectx64(DWORD processid,const TCHAR* file_path); + +int _tmain(int argc, TCHAR* argv[], TCHAR* envp[]) +{ + cout<<"鿴Ҫע̵ID"<>ProcessID; + WCHAR file_path[] = L"E:\\Messagebox.dll"; + + + if (OK==Wow64Injectx64(ProcessID,file_path)) + { + printf("Inject Success!\n"); + } + return 0; +} + + +InjectResult Wow64Injectx64(DWORD processid,const TCHAR* file_path) +{ + + if (!PathFileExists(file_path)) + { + return Error_NoSuchFile; + } + + HANDLE handle = OpenProcess(PROCESS_ALL_ACCESS,FALSE,processid); + if (INVALID_HANDLE_VALUE == handle) + { + return Error_OpenProcess; + } + + size_t file_path_mem_length = (size_t)::_tcslen(file_path); + size_t paramemter_size = (file_path_mem_length+1)*sizeof(TCHAR) + sizeof(UNICODE_STRING) + sizeof(DWORD64); + DWORD64 paramemter_mem_addr = (DWORD64)VirtualAllocEx64(handle,NULL,paramemter_size,MEM_COMMIT,PAGE_READWRITE); + DWORD64 shell_code_addr = (DWORD64)VirtualAllocEx64(handle,NULL,sizeof(shell_code),MEM_COMMIT,PAGE_EXECUTE_READWRITE); + if ((!paramemter_mem_addr) || (!shell_code_addr)) + { + return Error_VirtualAllocEx; + } + + char * paramemter_mem_local = new char[paramemter_size]; + memset(paramemter_mem_local,0,paramemter_size); + + PUNICODE_STRING ptr_unicode_string = (PUNICODE_STRING)(paramemter_mem_local + sizeof(DWORD64)); + ptr_unicode_string->Length = file_path_mem_length; + ptr_unicode_string->MaximumLength = file_path_mem_length*2; + wcscpy((WCHAR*)(ptr_unicode_string+1),file_path); + ptr_unicode_string->Buffer = (DWORD64)((char*)paramemter_mem_addr+sizeof(DWORD64)+sizeof(UNICODE_STRING)); + + DWORD64 ntdll64 = GetModuleHandle64(L"ntdll.dll"); + DWORD64 ntdll_LdrLoadDll = GetProcAddress64(ntdll64,"LdrLoadDll"); + DWORD64 ntdll_RtlCreateUserThread = GetProcAddress64(ntdll64,"RtlCreateUserThread"); + DWORD64 ntdll_RtlExitThread = GetProcAddress64(ntdll64,"RtlExitUserThread"); + if (NULL == ntdll_LdrLoadDll || NULL==ntdll_RtlCreateUserThread || NULL==ntdll_RtlExitThread) + { + return Error_GetProcAddress; + } + + //r9 + memcpy(shell_code+32,¶memter_mem_addr,sizeof(DWORD64)); + + //r8 + DWORD64 ptr = paramemter_mem_addr+sizeof(DWORD64); + memcpy(shell_code+42,&ptr,sizeof(PUNICODE_STRING)); + + //LdrLoaddll + memcpy(shell_code+72,&ntdll_LdrLoadDll,sizeof(DWORD64)); + + //RtlExitUserThread + memcpy(shell_code+94,&ntdll_RtlExitThread,sizeof(DWORD64)); + size_t write_size = 0; + if (!WriteProcessMemory64(handle,paramemter_mem_addr,paramemter_mem_local,paramemter_size,NULL) || + !WriteProcessMemory64(handle,shell_code_addr,shell_code,sizeof(shell_code),NULL)) + { + return Error_WriteProcessMemory; + } + DWORD64 hRemoteThread = 0; + struct { + DWORD64 UniqueProcess; + DWORD64 UniqueThread; + } client_id; + int a = X64Call(ntdll_RtlCreateUserThread,10, + (DWORD64)handle, // ProcessHandle + (DWORD64)NULL, // SecurityDescriptor + (DWORD64)FALSE, // CreateSuspended + (DWORD64)0, // StackZeroBits + (DWORD64)NULL, // StackReserved + (DWORD64)NULL, // StackCommit + shell_code_addr, // StartAddress + (DWORD64)NULL, // StartParameter + (DWORD64)&hRemoteThread, // ThreadHandle + (DWORD64)&client_id); // ClientID) + if (INVALID_HANDLE_VALUE == (HANDLE)hRemoteThread) + { + return Error_CreateRemoteThread; + } + return OK; +} \ No newline at end of file diff --git a/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.h b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.h new file mode 100644 index 0000000..d00d47e --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.h @@ -0,0 +1,3 @@ +#pragma once + +#include "resource.h" diff --git a/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.rc b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.rc new file mode 100644 index 0000000000000000000000000000000000000000..c5bbc671c8c2680bd56534f4eb69e54fa7cea468 GIT binary patch literal 2650 zcmdUx&uddb5XZlG6bhcbxTYW$i>a}AZ<82nFD|3gjJvQL+zur-NC~4 z4ZWT1U(=S_>Zq%ln%dN^TB@V1u}+ofC7L$R4XvX|SjYF955*hNyC|JbQ%8Jtz2Mm- zrYccbv~{AdFb!G5_}|Fxf!pyE-x;dK!ytMT?t215!ku6Dw!=9GMDKKWdY18S!1_L1 zc?!0HH*Gl5g+W!&-38->v4qtZhRe0=a7IfFEUJ12!^jlY%CuJ0!7borR+cAM ze?wMvDpB1oW>HB!vZ@E8LY+Ac0Z#PZqP9u%=BWTVL5iTFvcvi+HO+mb63P z`=lpYWye_Wz`9QtJocKvgYz7mzm4c)@o+VdB63k$9t=H`tn*%uJ;jVHMmI12-eE0M z^E>Q3D#jV>B%x~|-5 + + + + Debug + Win32 + + + Release + Win32 + + + + {D39AFEDB-19C8-4F2E-AAD2-8F25A75D581C} + Win32Proj + Wow64Injectx64 + + + + Application + true + Unicode + Dynamic + + + Application + false + true + Unicode + Dynamic + + + + + + + + + + + + + true + + + false + + + + Use + Level3 + Disabled + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + + + Console + true + + + + + Level3 + Use + MaxSpeed + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + + + Console + true + true + true + + + + + + + + + + + + + + + Create + Create + + + + + + + + + + \ No newline at end of file diff --git a/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.vcxproj.filters b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.vcxproj.filters new file mode 100644 index 0000000..ba69034 --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.vcxproj.filters @@ -0,0 +1,50 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hpp;hxx;hm;inl;inc;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + + + + 头文件 + + + 头文件 + + + 头文件 + + + 头文件 + + + 头文件 + + + + + 源文件 + + + 源文件 + + + + + 资源文件 + + + \ No newline at end of file diff --git a/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.vcxproj.user b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.vcxproj.user new file mode 100644 index 0000000..ace9a86 --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64/Wow64Injectx64.vcxproj.user @@ -0,0 +1,3 @@ + + + \ No newline at end of file diff --git a/Wow64Injectx64/Wow64Injectx64/stdafx.cpp b/Wow64Injectx64/Wow64Injectx64/stdafx.cpp new file mode 100644 index 0000000..264f1b4 --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64/stdafx.cpp @@ -0,0 +1,8 @@ +// stdafx.cpp : ֻ׼ļԴļ +// Wow64Injectx64.pch ΪԤͷ +// stdafx.obj ԤϢ + +#include "stdafx.h" + +// TODO: STDAFX.H +// κĸͷļڴļ diff --git a/Wow64Injectx64/Wow64Injectx64/stdafx.h b/Wow64Injectx64/Wow64Injectx64/stdafx.h new file mode 100644 index 0000000..4721a60 --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64/stdafx.h @@ -0,0 +1,32 @@ +// stdafx.h : ׼ϵͳļİļ +// Ǿʹõĵ +// ضĿİļ +// + +#pragma once + +#include "targetver.h" + +#include +#include +#define _ATL_CSTRING_EXPLICIT_CONSTRUCTORS // ijЩ CString 캯ʽ + +#ifndef VC_EXTRALEAN +#define VC_EXTRALEAN // Windows ͷļųʹõϢ +#endif + +#include +#include // MFC ͱ׼ +#include // MFC չ +#ifndef _AFX_NO_OLE_SUPPORT +#include // MFC Internet Explorer 4 ؼ֧ +#endif +#ifndef _AFX_NO_AFXCMN_SUPPORT +#include // MFC Windows ؼ֧ +#endif // _AFX_NO_AFXCMN_SUPPORT + +#include + + + +// TODO: ڴ˴óҪͷļ diff --git a/Wow64Injectx64/Wow64Injectx64/targetver.h b/Wow64Injectx64/Wow64Injectx64/targetver.h new file mode 100644 index 0000000..7a7d2c8 --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64/targetver.h @@ -0,0 +1,8 @@ +#pragma once + +// SDKDDKVer.h õ߰汾 Windows ƽ̨ + +// ҪΪǰ Windows ƽ̨Ӧó WinSDKVer.h +// WIN32_WINNT ΪҪֵ֧ƽ̨Ȼٰ SDKDDKVer.h + +#include diff --git a/Wow64Injectx64/Wow64Injectx64/wow64ext.dll b/Wow64Injectx64/Wow64Injectx64/wow64ext.dll new file mode 100644 index 0000000000000000000000000000000000000000..61d562019fe870f99437c34273627ef46338257e GIT binary patch literal 41472 zcmeHw4_s7L+W#FGVAR1G6AVjhGAc_maF~IaVE~muEYVS5kW`ce8VG@gd;PQd2ODS^ zu2b%Awe@c8YFKMqyKlQ&YX3nDw5-rvbJI3z-S*nBh3P6Ld4J#M+!+|PcH4d5_xFC@ z_uavB&;RE<&vTyhoO7OY?ltfBO6gWxfBPXJd*szGjpUvm_VzV9 zRkPo|rodfUZ>aOs-sve_Zdg`YQ&Y9*o_`(yg%@nLje<>w><9`SUB6 zxd~>70;hxHW~-vO8%BtQp|l<@;+hev;T*RJDbtnIS=YnY!_~34o`oYgE{apJgpkkm zAPS~^HcG`sa9PMiC8{^*D^bG_IIa=7+Kn7Hk+R!3E<1_>7yY_9?v-fNxtrt0U6d6b zeZ+TB-vG~^@B$Zwr|{*gc%)si5D&tSXr;~$`x!WH=@d^{DPPKQTPGj`Fgfa=rEp=t zEHphuDaMT(i;T^1TDV5IuwNFaoZ_kXEJGTjwG9E##%+QN`(+V4PkD7M3OaAQc z?_jQ2cvKdS%~~J}y|apQMaS-KDk0L_t0~GA*Y3-0YU9V``qy;zQ%EbP=6b)-|@Epmx#(VEaN=EaHa-k!+z;}IvH z1Xi)$eia{6@uasuf>&)VS#l{3;Y~9HSo;aaHdj%XqyKWC+T}R4xtY`3>A`zMhepiP z1`#UjbjX~~A^GxpFGlAS(2>Nv{y}tpE{p|2qX?m46+aiWgi_>Ff*K%H--K9;LsoEG zGPNy?J^O&)hTh#!c=^Tyt|DLIDPLiKc;mAQ9{46+`g9laQhesuj|F;DsjJ0620-zjav8o|3; zlMiuEmPQgfj29x~1rW12dUZ_!5{A4!UDGEB7~6~omXs_cB_O_V5DDU|hw+s5Ge~Oj z{Uu_jlD$un{|BLDw_vu^8{dFHZ+T<~rx)WN!!zHdF!%sJT>R4a!ZAPz7~C5%bft~~ zSw`!vRM^J~`yQfv@k_tIj{L(ue=mFtk4na&1AM8kiSY0}bQI5vc=Rfj%@tpu0xxF$ z;~ge48-QqyCznv&FO0*jHLr3P_W;-JFZCu6)!yvX-P zcRJ@6N#AEM_E5`hk%Le+5|nO&azMDONSZ-WKj8wT<^|S>tS!;sjTEP`E%GhEnm1pv z0hV{S-pdH#x>zB!%&nLzvSvkfi*avc$LM!}`va`3rm;SJFcxCvU*`wzN)zA{axu9om@+(W1IpX=}c(NdlURbV;j2KzUZi7(*B*!?tXtK%0>2Dq@37j>l40FWS}g z>~rtLxO2(xySvG6rAqSqO64W3RI>yyM$t44#o?6qJLPyv4Xp%*)&s}-y}gObc;D^I zPBi3;!6DPt=#u8!P{3>-(zV!89fzRy31*n)V79?hQcTWZyKw&@D@6=he z-Z<7T#y$rsyuDhNXnLOL*()q*IxQ?@stpV_SfWV12?>fWJ9Fk@T_(m-zFPvPAy-}K zYjKZvw-!o}LH3294g=IEww?gi8p1lkDLUe+xcL;;BCN0CsyO%>q&TahUGuPJ%O(Ma zpG&@UBWUvOP7f-{;q#r+pRu-p$_J5}@U;r{V2Hk*jJ`O~_liQ_?ZCwKE%aUfZS-+I zMjy2|NFPD=g`lc2sVxB!prwjKKj}rsI442{iE*^*E!z2BHp>A~+F2&^tt~ zlaV?7R5+QVK_;h=NrR4&N%W#qwc#{}=xrOMclY0?_lDEo(w_+my=O3Y4bn@HeWoB( zqPH-N-UQK+-~^co3blHWM`9WzI7p?Mb!r-;a?wd@dUCKcM}f*K*hHx@D$7o`p9v!{ zMBko4`u6>O`erhT37>m|@;X_e@A7c^2(r%qcV$8x#CNrG9`@46etRa>?Kr&=<8vA4M0!<5on)@!2T!EyRGkHdMlKP z)Y$eN>76IW_5dIB?lA?ezty=uCOqFjY@I@EF|8g#ol9VSA*dw1H(?LU1eGb62-iI6 z_!or!xG-V-d4I6G*g(6WixhbTzLJ7(@88Gw_e>nV0pCUi->1>qAif0FX9`07W_&G| z;H%6(mku6VEG^1~h?5=1mtu=5%D^5v$0eTV%+Ycnc$swNWgO?r(TKU#zL8?C+c!ro zjx3BTO&!Wbi#cjrRMJ*tjuBC5Fkd6xi1mmsM~&3eS#=RY zoHw^F0*$Bw!$l1sXQ?T(vt;ouwStDXSD!BndVgM@R8E_r#Tu*`u9vLX;&*Xlpd_RZ z@l0Dhz{iM=e(%z{uXm!@`s1%7t4Lg{#RB36Njp^f-%+|@?ErUC@dr>`bo6;w#c?hn zebPs|9cr7mf0_rDh}&0cyln>Ej=n&I*r(eOL&+m3IhrN6dAlMiATQPmTOYqCVASo1 z1hSaSuZ-h3)Itpw_jW``8YIygvnxWkqm3#>QKh$aJND>ybWUm~yh?yrUca}r?&~EB z_ja(J@Y*;23MNaJP$>!;%)XaP=^!FV{YUYzRTIU5g=FB^%YQQI1dtzj5%S$YzFW6L zbqVtAK>h&X(ai%1{M$9DJ%F_Y7T~g=kyf!~v$g~~JQ51B@9;Mx0|iW*fR!At#hMWk zlHih_0xDvk9IrtNR2gE$zUWZReDs|6T+hl{SCQ9FH8~+cD!78q8iuqkW>ht{EnM7DrExE9!S3>R*HFL1s-qIVC-tLy04c`Uc03JR z7U>UqB`$r9jKFcJ0EOlFaloTB;YC#brGevG6Q4oo1GLf9wmL>?!PYnMu5|cnimx(A z#p7Av@+wYRMYI9@2sz4tI>!$X!Jop$9oTD>ZC%1bi=EQfZIENh_pKeU*xSG;AxgRl z@@rYE7j)8gl$WkUBT^-B>T(RAe`E>EV($38co=0WHqvY7F)(F5O8N?Wv5r6$tX4v? z^dcheI2iG(RMP#hTNf9LeYP{YMlE2tWD~1nYGA#Z03zjXtnn`|a!FsJUU9J;ABRL= zw0DkL4xqaOSXC7tr(Kk{KT?P(lBQwk7o*RlH^3K|QmeG?2IBGEh>B;$FChWQ^*N3~ zhP9S>B2w4*2C(*)4{#U2+@<5{sWegX4hXESg7MCL^$ zGVeMA^KKpo@39A>obW^k*P6|Ib!#qszeCenK=Gy?tk=4tHi7Xf9OG=E%+_qgx}wtX z9H!>lx}wrqZqQBxLkg;FQDb)SH62Azj!z=-Z$=>qkw{Fy2#ueNM0XN8PL7|5pw~_X zIH(DgbSIT@6Kpv?5qa1x8sP2ixOpq+=O=h2HGjERisiMrJVt!SPPH0b+<6&$sxe!1 z>>Nd5QFaw!Z>qw;G|K**aYark0ica-&{{B#uT%ThX?*Ln?H}t$wENfTpLyn)7d1c| zYZ(-t^v>&4u_aE`tk0S&oblf`9?{q6EUP6>gS0uqnI$Dk-)-m}hdFS_OqE~cZ<4Ss za>^^za(oJKf1T=)1P(v~jcv`1Q8Wy*Y+asHElr=JXlD~87#iF7B>&@IAVIf%k8XRU zZO_UvliIVK{s&_zzsfLQD!hhf1Z~R<73PP=HsKJsxkBr28bBqq=S167)LEs1204_7 z=8ohe9jTDpqQUGURLYlp*AlSoU;*^jPysg%=LmAXRK^M=65lpDsF~C4Dt=_c?CA0O zmW@#aHZbaRdjua(Nd`&+pyrLy#IQh2^J6SPw7wpguduPJ=@`KL3k;>peOQYNUS)TWZX#1(WA z8hMo5ARlL8H^RCdT^PN&jB~n17gGEV$yuZf3K|coNMa+@KVzKBDXqE+@_Jx8b7U-wzmbqvYwWP6l7|$ZQ}t=HPhC=;ximFc{?K-GB}|d z9Va__yq!3x>QMuN=eXDf+`49v6&7cndLM<3KaWA#FgtR*I?L9+;xvI@Cv&={Brx4Sx*LPn=g`<@sCA7+)D;E{dTGfh8W)G@P$372FE#@=3<>ev z$tS(nVm?I0=TWh^7)KlE#3t$>Q8+5Ea1V}>QDTnUu8b3>bP`5^Vqb|nU$oQ6kl#O@ zQx~CY`V7@hN73k1>6$)71S905YeGYChPt&H^ocVxt#!=Tw({_?Ylh(UN3GRYh_h$t zD|}kVQY2>uB$i_*rM)(`Wp={2=H`h{P{wg3gEa73D69n1FwMg;Y2zq zLKjU2BhQCN+J++jCC)B~27S(LxTk+Ic+3wIBZIZP_h2_O9AXxVcj)CjjR4RGQ9g=5 zq9Ir>gKKy~qe)hlPlOt2!v8k3VA}0k5=0EhV6AlDD?r$Iq{!C6*V^5`0I6>AKH?Y> zN-PP&?c#mJGQ=)NY_wBa2AhVwooY$%95T&!Qx{7y1~9(uk`IGF$UO=01`1ysgVj5@K2(3`;((`;(%@fhKksyOu#vHSh=mk1UybsQF2{%a2CEF1BGVc zcGN(1=_ocpY!;SHWGwJ@R=cEPu!_{pu?xoFYbgD@aa3D4)| zSw-8L_yVMeeQ5AX*|Y}gLXM~Hir6<;U;#xtOFFjDmImXQALEowje{lSZf`8x>}(-; zls^*l+9Fi)##9-r+9K(fSmYMl?92!jw?SrONbAkyXfu3Mc*kMLgPAXV zj^ffbOvfb7to!~%yYLPQYo*^SVYZwM?%!`Cdy8;GP_9K23BG&?G>#7K)|t2-qJ6Ta z1Y_nK_V6^nlND!B)`!9HF2~alA-!7^F4|;W876hIb>fl^%nfuP=-v(4#{}WtNq*}p z8b*iQ&$0*`eTUpzS%g^*4tecVf)h>DLMshAevH>n1v%X7u~Q+A$6O^OZXt47DQ63f zy{;&#_((EjpBW)oU1j*U2FIzcu^pUL20i99T5>W?-ie(glmn`ZCej-6A*DToGWSM zyhi(iLx|+y=i*f`N-X;+#0+ z5!+irJXE9(s? z0fWDAV1AX#U#OW6>qQZYd3Pr$1$i}!52P*bC)498GCh`r_7-TgwHa&;&d`d@;)30V zrpS9v=40}u^|bx+K1n79u4=Zw=@e#WXQ4sxz%Hk zXoEzzu(fq?&$?Zrr8+cWmFl(2VefENMM!U8?0f`)skKqSz_2omDmPDH^f(i@0JK_unwpzx4* z?g1*rlo(%)68ow&(ko;Y#UvqpfCU5Xrd<+8=Nx@5sTO7*m&Bv1T+#@v>|D}mEZ<;w zG|=-Po)F<6FKOv$Yzye9f5ee6gGb2wy`5^Cp!M{IOweAto|fwTSU367OSF9llEWE3 zlvFJJ1Ams%V*x7@;*N)*)EcV+v>vdubz(inG(WSPX z_nh$B z4|~5*BWye8xlL+?dBPII{{@i@IhCqOo5*4jBfqD>qofcB%i^O#l*MtFA4zZ)W0pD0 zpo)vT1J86hjt!vY4KUBb@K-+y22zpKC^5ouOda^N%h97o&W5!;nqYyRp#nXu0NJ)= z$pB)!Yq5#Cv5QenlPuV=hcpUF&8rXr%I7sm{SBpdusbh`2!g39D)sNmPy<(CD}%M{ zXG&ZtBpnA(Dm4|biNf_EG^qV( z`VZ57%+TVJUIZLiT8$F&O|i+~bmNK}Hs^N?&o4OPYX)U+ti2THG_~ovO(F zXWawqIQ^vG<3?Z_Mmi-jy z^ho*sCThUxZ=yVB^Wt;T0a}WM5};V?2v*2kGWCzlToNgD(U_xKyYc9U;7}K?4zgVs z<0g(v*8!#?3s)jU=KSEvXKUZ{gWWEhC^D#~b)+u3NpVDBm@e*MazfQyMaI)4VX=QA zaVW+taf2nQA5~Xe4J_9HOaFZm7-&-xBgx9sN5+OX>7*(sV*~^mLOFb!4jSk>96QAP zZm>Eof)#}HJq8J?Oco|v99sT6V%8o8&D%TM<##*}<-QT5RAp5eN?cMd`m?wg6H&XM z0X@fc5JLYZ4hy7Kyg`G7+yIWLZM*8t-nJ-j?m4-lD@*2v`*I@@xSAW@nRN{!#^&5x zL=%3-3?s98 z-syIYFaj)V2FrkjT|DFc^lGuIy+5k`)9A>QCL)?u#*w*WpoMGBQM)(e7|oxfMXg3w zOV{`cWL3`5cpd%fnX+TRc5co6#v|fM0>RiOMpN53lRnQ!H_TBt1n%z4QE$LGc~sTu z1%cuI8S zTG0z7B%0_fwg_EvT1X&iB*S*Pomb6tNsnWRU+m|jRV~ptW%;a1J+nv>Y3_`F7RSJEC+Hq*%Ry2gU5>%AzNRI*Ibyo6 zP}_2qZhMC_NAg_5<{#`IV`v=#vtgdLC0cf9n^ie4tL#KC0o| zFyUu_r0$$9vvXRIscSqAG+Lt54ZJ#im=K*4I5{WqN0vd>Fm^{^7}lo@LA|Up9+_d> z8;Ho6){wD?KTFtNkHGiZ-M8>v6gFJ;e8C#nWrGZ$fDp({k zM~*>Op*H8Z3!;naF`W?{af~YHkB>wmC@EQpUXSz|I9V0ClhLcifsd=mGM=oxIO;uh z98(FKo4FTgZf+j0-cGZ|gOKPgbXx#dInmQF;KhKpv;-j%@9&6s!@$w+%+L3)JtYmt zIHD^oyR~+-npuAZ_0z@v_CH7X)jC_d$Bb+GSh{2PiMjK}VD-rJMJ@ucmo_yF zKyK?JXv=4M3{R|zX{v#3Fbs7Jwaqlt4jWI~{vfDPW@UxN$U^}~R9KRP{-EE7Yr2o2 zoXh2!)ZyCSpXJPVx$sVq{66X2PCm^kselelc>{>uNm*XiNw-zzN zkRlZT9~d(&3$*-YZiOlDiF+iMl8mEIU#|9ItnT@}!k7?NcTpT<=4wFTXE0X0M3amq zU#n}Ji$D($7DsTLRp?Dyk6P+?eCPMH^pfpvD|De(;y zud!pEQsRviFR}k96mO#V9J@ahzn9_}c3f6d%HK!vDfSN^vMP;ypxC#rED%Ek&Z9`l(uGV(1ec*Zsp~P(2(ef|I;EeoWmMQ&*W0US zW5`?H&t`@EqSxnqn)UL_0FSFod~8z(KkQ6*s~SThP>y9Iv_kxIH28%9qX4_gvj`je zlp96lZ)0%`Je1qYl*B2cqtA%jNkYtPa{)P^Z#s!rLONqd&E&ZD9{q?u9~*FI4*5*f zN(tST^Ims~B$W+Oy5Efp{A#H5N^CE1i5Bzzm2S zy6`G2q-T^iqmbG!BA+1{DKi6XkfC3qe7Vlt2Rl^(37#X&3v;kC6&x@ALfXpkfE4`;xtY ztD$Ql+mI*=6CvURDF}DS*yoh~L`II?iNU+6$`#Pyj6H8&n9+e&9ZU+wg-gM>At^AB z6vQzp&<{z$IFbU00L}I5*QIZeaTk02%9QZFe-sB07x#VEp-b3@n*{tzesw0UX68!| zVO5M33-O1{mLvga32Yn%k#HhaE62a0a4lc@gcjV6elV+dkXakv`vzv+gG8{2F$?Su zXA`}Eh)dX)u!%O#uWPX6@}~ba`)Mq*y%T>51+Z9+|l@L4|qYln8bL2U7xbI6fQ54t_4BG(s8U`l}f(F#{wgK837z(X(%gn5{BznnAeX< ze}=iR15j^79}QVdTz-Wz94ON%_qCLX6`-bSlyna^XT`Evj^7QM2Mrw{gXZaFku)W# zrN^nuS7@Y%n6H)m%-2gz%#V}SGCx5Q$Tv$hENYM{n4c(>Fn^-tV*X@l4)c?w9OkD; z8O$FinVFv^O<{hzbUl3U?ksslmUJac%9chmKUW&T{Mk|@^PSSU1B79LbdvcCqyY05 zNq=PiQt1fu%cS?1@0Q+TeznxW{5t7n=JV2TnZHVUhWTrxR``U%_69ImdWcfD(?URM zVZmk!u4loG6y#ZumKRbb3qDA}5*B=fg83}?7zJ}#a5Dw%EVz||Q(15u1#e(MvM)&E zSg?(PqgZe^1*2JT4+YQdC(NK(IjIjphH^K>K4BSToRr>YL0TnA`&jTO1>0G$hl1N# z@E8T3VL^$4n^~}zf)BCaK?=68U>^n7vmmWaC7uQQDOkyZ0~9P_K{^eS@>!6!Vp1*( z(%mk}jvzx>OR-y62JOkEL>7#r;8+$+px{Ur97n-O7KBNYllr@f1&I{=3ky!9;3q6N znS$@LU=juQv0w@X+gXrZDc{b5>6H2m3uaMpGYe)@@F5n=rCJDd<3uj!8oHMK;ZBfq!Q$Bx(__1QP&GbA=aY;uh zB}6?|aZPROVEGgDQVk46I0>e8L;@u!CRsV27DvHena9q7=@ggd=e-^5SeG5@>ggm` zjBP_Bc&lStV7%WkfXl$R(v7DwwL;6{_WA&w;p%qeX|HYHOABB!NCyo{uqwgAfjwkP z#BiFScBypFs1q^O!DhQxM!L5hW-*r4snWHo6YD?63+cNJu-qy3@Inn<&xdJ5d7Wmo z^eT+(RbxuA~KKGm8~ z?9+%R0-dz;zu<*otk>08uWQci!i2yH>0*RcB}@TQ*IP?f!ga%s@#EViy>(iIFcyiU ztfi5H-rKJB?otmwCL9oPrrxpX%C`MI-ZoXonO%^4j!$Tb0IdM?XAp==N6+knd79(5 zR*1+T`0pUKliddtMCgyf)8Nwd6zqZ1cpiviy^2poMnSeBJi;f5;SIwBOF8Z5O*DdX)_5rWw8Ah&ri7cf==fik#7a0PI) z;j-b<;Zoql?E8=TvL84GUxF{e?}gtBzYl&N{8R8x!S9FP4}SpufL~1;Q!cVEvOmNP znTUP_ZY$hQf(@(NlD!?9h~n_DLVYlWWICK9U`ME|pHCj}udxgS`yg?s4`RPQ`Q!lF z9aoH21quTKF3HcnAD`HGK7jeWUPb zGT^1aWy38X*rC43i3A72`hvwlZCF2mHk47)F6g_^Knwb`S3lEELxN9iQDMNs$U8?# z5Wa{aaq(|W4D&?QOY-^i>ms|oeX?;EG{MuHO0|KP#AySlIkoW^pNMPZuz-z*$H{y| z;BEgjdZk}IslCHL?fhWq>%q`KFvKwWZu(P{nc~!93^B!d!k>fLmNX}>y=|hEJs-dU z_aCr>7PD4ie=vq!1?&#M%#;=O@{m*wE2HE`*$%h!cG@4%HKx|3J8(N=@JzA{u~s)d zs_9XOM{xc?7l^Uy25ed^PBrXuC+<3}jf8e@)7m;cy?5=^M&@ZsaMlt<*)Vr4#t{U; zP!2We8p3mg>mFS&Z$+F*-i6BgPIO5XqvJyrXN!ig`!DP_bx{FME_mb{q|SD9!yHE>J{=_DS(U z7+1?H%kt&Ip5nk*FjK@W4BV8!6$VcF;smhjV0jm!g*y}>oNyl4?VDMKx5`#xXEr1R ztH6b!UTHf9j?#aN#|||M2H=c9kvdS4l9-c>6bWuWA|Xj;Kc}}X0X&B2UGc5+T{qRKV@f7 zYUx%AtRAABWEe*U(YT0%^MF>mmI6s-SBryY|0*>OX(JgNy1uJOJ=JH0agG;Nm9PLC z^y{%V$5m3TyPM?HfQwdA+Yu~m>0T|4-02!g_IUlaFZc(XvvO^?J|w$tMBUAi52M;i|m`Li_%bRiq7 zD=}AVJL?%HF3?2&9v5_mPxrP>#5p)#hJd}~0&vRtL)CeA9~h#Xb!qy2i-v(eR>p+gj<0yxUp=?#4yhQ0;`9P%-sadH6r7R(G^VcX>` z@8xi16f%zU4oO(+=JA~rIeri1N_nA$c5upPYus*R;k6DjK7IvSl#8IaBigh0C9tydtTPU}XbZJ`H!T#F4dTRT6~5=&+IOq9R{Im+#) z+fy(YO@@tZA|b<%_2(U(SA`p$ee-HY#TJLvAaqTv*02= zUh0PeR~GS)kt*+GS5WZHzP)56uE0g_55+?jUMt5(W34<_I0dTyJZV2(A+PYMhhwQ+ z0erB$$2}>`0QkyIwDc4~3@-405!yN6d@K&Tha~t0Cc-Isgbgs;zS3(?GYLUvQk>nXB+cNJnAy3{rBu3TdG! zxIzp975+NOq1oTh6bP*pu$3wbXYNl30NWvDA{1mU+apC0Yd;bXO~Tvw8ocjB@0Agj zgRDGAtXw#RK;V^->S@}$>MHNqh;>@;*+?O7%j9QhCSaZ~R*6X0qF!)H?Zl*nc{wy! zQB4j7T*QfqH4+ohipmS9@V9oiSm7`raCJ=QF}un>0-Il{_jOcUjO*os7Omlg zNhAG?l3;$#D+(kr3~-Vh_KkskG~nrSdg#6XESI!YX&&!^p6^-lmP>L{T$&I@6G^l* z3JF6WC1@vuCOY5~=`2D+=}#-^Fs8m4)J!ykk=?%U6?%J@K4*EVr7*6sKs8>tirq!L z40=uU?E!_fF~8QKr;$fv0xP>qtkaMYOm#F@Vfz0!NEE&TaiKnk(#94T%W`}yXLe#j zA#Q2UbL-0o&#;vffZh0*j;73a9a^PR?Ig?;C_ULYR>UQm^XKuxPeEde_p9@~+Vb*zJ3H#Vvm3RqHx>t=i0iirOiadx&;JLB~*fJZ&B1|?Nv=%-y zO--+y?WA(Nk&d`^4$sY-4mtwU_rbAQRphl7eAvbAI1a5)0l+!<8BPZ^)vB=*p3&+KLP}nyBGPg z{3&<{CgF=$?(Ja9JgEfevT3nUtWMO-pC|K)ancLyctE>&mxim*ebF{ApFXWew}RJ0 zZ+x=8U5epTgByto-Fg+=G(9~G^hlyd7CoHwSW1sNzpnw5apErHk@n9bc#UtYf0p`I+@a`+1~zAFpr!EQT)+MEie&1W;BR4L1jzsdX9fC?U?oz|BR{`XVH)UxK9CiYz>8oOrBQ zipRP-WZa3g^|eS_zY=Nd*Vp-(VcY+D10dfjv_cKd68E=%MklkEhqt#r#=k=EU$4Ja z_ySbo=0ZER!MHpz#&@|NZ@jNp&k|1J^EWu59Y&k}oSCzPGYd-alG;m{N4ZJelir*s z?g|wc(|kEA&@Np7B3C$Be0&60ES>w3Zop$XK1TW)!Q#_V9Q0`fKdMUQ#tJ?Q`-ow% z`r&K~p$Fd!-N<5EEM9sU2GXFOEkTg!*$Xt*VRRpkcOs;9s9KC3RHV0%ZYH}|xiNP` z>ph0PT1+Ql^a0I_$J(l$@cv6schKjy)XL2kl$uDogS3XsTfJ)%C*xC7Ha>CkikqP|MD1_!IXo??jWxf8 z-nd-R8`;0rNVCwiNP#5?1a=VG!7DOB#bInK6S0|vg>1E&aKH>ZPb<#XTIOklD5gp} z^5?y*2eShsf&l>0`fk(sW~hC4X$$8$7ZfipUI+~#cLx{WLHSot!Yd4Cy06_M?!J!e z!%c%dp5bD9@q@SxqfYF&8S@g?gzvP_a3Ox<^B$OqM(pMDFg;^+y<^&MZ{KbpyUg{& zkF~_`H^BOLEq3lOeOdqPiMIZ6WkkfM)-HrP5bCt{2qWkYz<%RiYY#u{MM#b8i8%9n zv3(&~rdTUO4;OXUh&Ev&h#@VmH6A!~0$((Q(uCh9cAP0g`W~^9{K)-*nFudJ3SCn` znf=H2AKCxe{=*~o3a8GT6#Gyr4kgf;XFiSG?-^-Bxs@7^&W5rphRvCTj4SbNJmV3B zGze+Wd~oKl_XAFRQ+!YSJ+)J^OF#HAYoJMu5Nad#5VwV4h^xLH-`zhSBa4*5_hC2xN30xoCdAQ-Y$a4i;5?mVGt#BT=2Dl%>{Q|BH z?gO|!xZ#`dIeNGhxLe`M;CQ$exX0k0hua5t6z(&)({Pv3CD@C8X;bjN#$rytvEpy{ zZs`9AAgg%+T#pZKwE~Pj7(*YD$>nl6E4LhfR<0g@^eYSgO~&>nFZgF*X_T@$_{XuF zTUh!nERE_qkxIX5K|h--=a#`O=kCDM!}8{EwcLt}(&nNRkMvNfeB{?5CA{V|PT=l@ zt4BKhZbi5nEr-H2C{4deD+ z@LnIohhP&9p|%yjCfE)^RN4-;%W+DZRF2vqIHkZ|02XBkDLCXXY=`0nz?MqXhm|Qp z`(=Po9+p~wQsMDD@UJGUPCoK4j8of$6LE)Rg4)6TDF&P31dnhhID{+J$C%2sE?;h~ zXTnj2-(*7`eg+Dx#*fR(yQQq`76kBfqWh=8WtT52Uw%h9>+m_XD+a@Jm+`ffoL^qY zhZ3g=cMA1D>{g+g!MIhZVI4WG&Qr|J4TEpd+@&f*g2nHj^Q^`UFZoyL@Oe-oct0@mg3IrvTS6jn! z^M#;a%5$j8p&p0w9LjMh!y%u$jdO7GAw3RmHfQ9fa#Of$gk}?KxSZtBN7YUA2MMSEjqGL3}hL6z3j@0Q#T{b!{e$3?wW3RY!-1w`mHe55| z+QjRwzhUByH%*#+^OReXlBXI|Oy<-yi`ABH&&bT0Hho66BWGsrtXprJoi}GLzL1<> zfED|K;@cN4T3oVZY3Uuy%E~M5bXQj0RlU5Xw(f3EJuj?SxoY+I?pd>T-Fj|Dt;eyd zl6QJ)mz7h`FNfSMgIstZA?2W|45N$shDK8jq^c4n%Ap--jC)u)1Ch+da`>PCeg)vc zTu4;@1!a`nd~OyvHuD>DAV;W`hfzf(!l8%Y&gaZr5;$#SE!~VV(}0blH%NaN;A-(C ztwH$Z0fSk<#lWa3V`&u(X~nrU9*yelZ}Y2G7;Nom!>5I{XntrA8%k zYS0e`P(xHIP?sZ>w4;HQybJg%xbqn4L_PIhJs?)IGPPU<(g+^)Wr#A;Q$u{Znek~k z+9rKUI>>Rs-6Nh*bby4dO&I;Y2AU0mM(D=u%GAFdRv86rE4>kz|F}%w{-| z_9nch49Zcczo!oNcMa+i#pNhR+`1FA8qh)=>e9?ZP!;Ia@D*w)mEbBl%TY3f{l#*X zJlM`R%N0Snu)hg*h~G1y3kndYej(l~ISPk~SA^e`{}Q>ln2w}DIzl*w`1VZ{lwHK{ zsa)D%ed_H}HYyZ)XmouO3hD_gD)pD5`Di@XGVMTGvK%^*v{X5RKz%?zg^uKl zmS81&2in^_f_J<%@U!64(V?`4)6=SBGkiV#T=@9V11H_X>2aBh+YEm+ zrNd8vfB1Wxek}ZE__&46CBVl$dT!flPCpL*0{D1Qg-d{sPlR&LRd^E>zO<6lUjx4% zA5B;V|1f-7SiS=Pd+;~Irvtl3;M2>QtKjFcu|e}AjhPBYvkPfNx1tqhaFg(7z=$Eq zCJ9znREnmS;WoE3cxIq9_05GX zI8aYnyIsRzJ1>A{1w8uyKpz~_q{^=rTyyu|1ANk4TFEG z@AwP#Ao=&IhW;W{-|a6{|5EDz(UiY80;r`p{DoSi*icxHYi$3>@8a^`joP77dTuDJ zgxE{wT*HQYy^T%xeZSe)B5w5G|G=gn{P0H)KJ@U9A9?iOe)8DkKmFO}El;#=ee$WF zZ+rR|&pi9fU;X=Yzy8f{pMPQdj-4;Q^ztjOzV>=s`>u}NZ*+F;+56^O``&)%-R}Jd z-aGiaL+>B{{Rc;me)xxvdOrT-kH`M>>7S+Jp9OmV^7$8iC%!y+>aVBI^q>9e+`!l8 z<^Qk&R6f*SHN(2u!fc1Sw6jX zRS{PRTM}9OF1GX0s!g$v4cW=ffSI^-IIibFwHoLao;qlax z(G=;h5fVCR*f=$m%+2BF3FV&Eu1XItlvd}JFRxYXp>ud?ui$Jvs!R_ zllYOJo&Uv?Bc2|(_tCjeH4S@eL45mTDx^ECi}3$6Q)kvMnpw%`3U@5>l&`F)xz<1I7^6K)^`tn7g#3^-UcU*uIJ~zPOx(3(az94xpf_n+Hgy(P*nE9c2 zXCjn8exW!nq73F=e?6y9h5NRAO27H03-kAd)u()!9gBW5e9HGGUs(TQ{C+i+(}!?- zH7tB_xw@30a%;lExPdlE54E@1c42$r^iuvUb1%#fZ>J77qj@+g7sBac_=^`^n13<+ z4{+`kUOybZZ3(BJ1DCRqN+>@oHY3;;edF(c`@1}l{Kp1QEc z&5$m0tXhV{A}H^i%4!12J*kGC`S$F{S@qfFcL;ahS?+N{$pS&n!&-2XzURJ(m_@kZ zoaL_avRO6DJmt%&2p0%X2N|JsH`Sds!^v@}#GAQ}JPHp-D>%WaESo{(Vn*OT;~X{N zw7;P)sICv5=X6mRm6bD}Jro-}0qUd}V{kpu6~_Cw8NX*hx$@9V@32^Qc|Gr`UCoVE zg&)sc7sa$R7zFzWVVTdDDP7KSaTHgifb!>*E+;wojXJ-&9Oq@V)TUB&My)`6_#^mG z$yb85@0HJh?yp={im3>5Vr|W|nzH=5${MBMN#YAZELdF!3!c(yDW;`5VsjCShFMJ#aCtf=(V)=-D!^Pb9@JL`+MQBg&eW#u#6rJjP?JfWJeoW2_D z_<&mfrsCYsBiRh;EcdX`UhCg&o5VmDM5|3L1E2GENeJ5q%eqittSU^f~7@B<`1%3 z`RK)v@(bMuXoJCp=1y(UOGQMg6^LCFUOZpjB#A56Wp{CkK0&~ujK zlGiDi(Y|X2N;UGFz5#9x+$uO8t`4pmt_*GwTmf7zTsm9|+(fuUI0M``xCFR3I6a&e zP6MZggZV>0P>=VS;rif?!5xJ=2uJ1j!QTz{3fyyW+u$C9+XS}}t{H9(oEvTt+%Oz6 z(Rzh`1&Ggv%Z5vbOM#mVmk1XJr-nP_!F$zk``})I+XlB8?h&|6aLsTHaI4^OJxuS0 zTMD-T&Iy+bmj;&zmjI`Qqw*ZwDSQh17+g188{D&SkHBq$Ylh?DX2Yey5xyb3Dg2-L zqyI!G9NvF4PIz97D}7)j)P`mQXlz1Xf1lGQp>6ulG9XIqM`ft)7&tnQB?mEPKDv&h zGggQxPJlVA`IPfI`Y$hO{YmF|z9-^B?=Eg4IKQ2wEr}^1m(p+w%X>@*y}OKUDv})2H)wa`eTp1$eFJ z@45BCUm40TLiulVG{$Ib4M%?xz0?Nzg?RPiyEqhOKa!R3pCRf;*v0+d`;oq(kwf~y zfZ<8HCrufq2yxhV(vQxhnJ#Fc82v)CHb8z_x_q4anJ8d!?*2&L29vrvQzF;<=G2DCL5_S%N2>8qht|xwzH3gxzh;L70B8s=vUzPS~lK9t`=J zESK<6GrbUuGH)A@RskODT(~1bcWQFr({0UJh|wKK=pj}n33p}b?obk!g1aP1NS}gM zRNM@dp*x;*GjTO=Qf`e9@cDpJgxqStq2C^8P}Ly(Y~<3tU}~3c+bTCesT|cQ!rj~y z(7Fma%8k^a`zr=^7l>|qRih@|8osnd=-%ck^q?8}7v656yHa%Hif&oa%~rb0LTTjF zJt2Zv1gOt?W|(_q?>9Uv_ZFZhB&nn z^sZ#|(p@wjHA6R~>F)n%)SZobcd}ZT%+5nFuJiGxG;_G+0I}$!=?h0WHzJ0 zuEOw`8>~ycO?ZU*n__g|2j2qy8~9Ae45LCn(p?|A)l9eVhA8>_eFyO9SK{A=FfQie z#XQVLJr$&%ZZL%~9+FVJ8^cCh0dh$W>sgP5%hWLLIdytzeLdbAs9tSYwY<8f-abL_ z)L846xyzTA*5ACma+#;LzP5tDd0FjpYia%RDJzmE7+`#^tbp0nRqm;W5z{^)c}miR zjM(7@Lptxliw9(`{EpC!N235HNX3;y#>jyK# zvmL8Ym8_|=%U6_F8>;DPpHNyqt7b**UFDt$2BC7=GP-ncpHNX+U0*&SBmI^^*cVnF zgdbMolGf92xd7MnTLy_n_4Hdp{LFApb56_7o;7FYf(60A|D-r6{BFqC!Q|g3SDARz z_e>9(wwQiy`cvBHX=l^qv?z<#5@)%>GQl#@l3}^sa;L>(@mU_Qq*nQ7$;N$JqGV5CF_pSeCea-q;>rFPh?U%MUZKKogP2Z9}#y-Jrvd^^NVXv}# z>^}Pw_SfuP_P6ba>_@<-Q5n{Z+cK79JOi#w&wMzOCMUNFU*1dlJ}4cVd{gqW%4jw&G9EIXHAbe`Qf8z)kn*#XCsTf%vLmG{Q zqbbQ`HrY)xOt+cln~F?JOm0ZiYSTJXqp8_+zv)M&M@>I9{nFH7+H2ZxI%N8T>5ry> zsn2xA6m1@19%a75Y&B<@7nrX|ot&yo8ZZD-oSv@>ZVESFmhmg_B( zEoqR$nU*=0I?JCdf3a}Z5mvo*f_1Vr*_vl9f;6szBtC9^()xn+W$Qj`luc(d+0tz; z+hSX@Eh;@B{igK0(|zebO8-^*_VicM-%LNBKEiIW&$HLqU$RSfUBqIs`F7?fBxhN$<-@x%$(U4>aS9#S_&<9SZXXQEbA;Smfu=lwsb;n>aDL>3vJh> z|15o1`a=5~_I;2A$u8StGe&2aGwd0zjH-;fjMW(%GoH)n%gD|wBYd4$13@lMPK`2N zZoJWGGnN|bjZMZM8=p45Y<%1Jk?{ojIX>kE$iFA$rzzW0tmbM+x@i89`4RJD=FR54 z<}b{#sd1?ZspC=&z;GgZDk=4QsST-(sm-YyQ@>38IyE8f>a;{i_~f*_w3TU3r#+YU zJo@jIw6?U}X?xQ4rH!$SLoX&mm*iVptedP4SzE2!tiQDW#=6UT!g|IkTXSr;*_v!E zwjbCYwmoip!uFhPRQeU^hV*UeJJP$--$_4|o@2kwUSMBlzt1k(H`#vEEp0{|+~hwiicyx$W$HH#m^icA ztTAiNdUKpP!931vFejQPnkSo+%qiwHb2`RrwmH{4+w3$KVB{_`FEy8$-H@6(GY>tv z#@qn;X*O?!uIw{&sd`9FQffi!($un4H*{fLYG0b$T5YYf@))ygtPR#iYqNDDIPjQt zvvn)v;#uo+*5|>GSFCN;ZtFqt<*2pCddwN(BG_ literal 0 HcmV?d00001 diff --git a/Wow64Injectx64/Wow64Injectx64/wow64ext.h b/Wow64Injectx64/Wow64Injectx64/wow64ext.h new file mode 100644 index 0000000..93ef224 --- /dev/null +++ b/Wow64Injectx64/Wow64Injectx64/wow64ext.h @@ -0,0 +1,374 @@ +/** + * + * WOW64Ext Library + * + * Copyright (c) 2014 ReWolf + * http://blog.rewolf.pl/ + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published + * by the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with this program. If not, see . + * + */ +#pragma once + +#include + +#ifndef STATUS_SUCCESS +# define STATUS_SUCCESS 0 +#endif + +#pragma pack(push) +#pragma pack(1) +template +struct _LIST_ENTRY_T +{ + T Flink; + T Blink; +}; + +template +struct _UNICODE_STRING_T +{ + union + { + struct + { + WORD Length; + WORD MaximumLength; + }; + T dummy; + }; + T Buffer; +}; + +template +struct _NT_TIB_T +{ + T ExceptionList; + T StackBase; + T StackLimit; + T SubSystemTib; + T FiberData; + T ArbitraryUserPointer; + T Self; +}; + +template +struct _CLIENT_ID +{ + T UniqueProcess; + T UniqueThread; +}; + +template +struct _TEB_T_ +{ + _NT_TIB_T NtTib; + T EnvironmentPointer; + _CLIENT_ID ClientId; + T ActiveRpcHandle; + T ThreadLocalStoragePointer; + T ProcessEnvironmentBlock; + DWORD LastErrorValue; + DWORD CountOfOwnedCriticalSections; + T CsrClientThread; + T Win32ThreadInfo; + DWORD User32Reserved[26]; + //rest of the structure is not defined for now, as it is not needed +}; + +template +struct _LDR_DATA_TABLE_ENTRY_T +{ + _LIST_ENTRY_T InLoadOrderLinks; + _LIST_ENTRY_T InMemoryOrderLinks; + _LIST_ENTRY_T InInitializationOrderLinks; + T DllBase; + T EntryPoint; + union + { + DWORD SizeOfImage; + T dummy01; + }; + _UNICODE_STRING_T FullDllName; + _UNICODE_STRING_T BaseDllName; + DWORD Flags; + WORD LoadCount; + WORD TlsIndex; + union + { + _LIST_ENTRY_T HashLinks; + struct + { + T SectionPointer; + T CheckSum; + }; + }; + union + { + T LoadedImports; + DWORD TimeDateStamp; + }; + T EntryPointActivationContext; + T PatchInformation; + _LIST_ENTRY_T ForwarderLinks; + _LIST_ENTRY_T ServiceTagLinks; + _LIST_ENTRY_T StaticLinks; + T ContextInformation; + T OriginalBase; + _LARGE_INTEGER LoadTime; +}; + +template +struct _PEB_LDR_DATA_T +{ + DWORD Length; + DWORD Initialized; + T SsHandle; + _LIST_ENTRY_T InLoadOrderModuleList; + _LIST_ENTRY_T InMemoryOrderModuleList; + _LIST_ENTRY_T InInitializationOrderModuleList; + T EntryInProgress; + DWORD ShutdownInProgress; + T ShutdownThreadId; + +}; + +template +struct _PEB_T +{ + union + { + struct + { + BYTE InheritedAddressSpace; + BYTE ReadImageFileExecOptions; + BYTE BeingDebugged; + BYTE BitField; + }; + T dummy01; + }; + T Mutant; + T ImageBaseAddress; + T Ldr; + T ProcessParameters; + T SubSystemData; + T ProcessHeap; + T FastPebLock; + T AtlThunkSListPtr; + T IFEOKey; + T CrossProcessFlags; + T UserSharedInfoPtr; + DWORD SystemReserved; + DWORD AtlThunkSListPtr32; + T ApiSetMap; + T TlsExpansionCounter; + T TlsBitmap; + DWORD TlsBitmapBits[2]; + T ReadOnlySharedMemoryBase; + T HotpatchInformation; + T ReadOnlyStaticServerData; + T AnsiCodePageData; + T OemCodePageData; + T UnicodeCaseTableData; + DWORD NumberOfProcessors; + union + { + DWORD NtGlobalFlag; + NGF dummy02; + }; + LARGE_INTEGER CriticalSectionTimeout; + T HeapSegmentReserve; + T HeapSegmentCommit; + T HeapDeCommitTotalFreeThreshold; + T HeapDeCommitFreeBlockThreshold; + DWORD NumberOfHeaps; + DWORD MaximumNumberOfHeaps; + T ProcessHeaps; + T GdiSharedHandleTable; + T ProcessStarterHelper; + T GdiDCAttributeList; + T LoaderLock; + DWORD OSMajorVersion; + DWORD OSMinorVersion; + WORD OSBuildNumber; + WORD OSCSDVersion; + DWORD OSPlatformId; + DWORD ImageSubsystem; + DWORD ImageSubsystemMajorVersion; + T ImageSubsystemMinorVersion; + T ActiveProcessAffinityMask; + T GdiHandleBuffer[A]; + T PostProcessInitRoutine; + T TlsExpansionBitmap; + DWORD TlsExpansionBitmapBits[32]; + T SessionId; + ULARGE_INTEGER AppCompatFlags; + ULARGE_INTEGER AppCompatFlagsUser; + T pShimData; + T AppCompatInfo; + _UNICODE_STRING_T CSDVersion; + T ActivationContextData; + T ProcessAssemblyStorageMap; + T SystemDefaultActivationContextData; + T SystemAssemblyStorageMap; + T MinimumStackCommit; + T FlsCallback; + _LIST_ENTRY_T FlsListHead; + T FlsBitmap; + DWORD FlsBitmapBits[4]; + T FlsHighIndex; + T WerRegistrationData; + T WerShipAssertPtr; + T pContextData; + T pImageHeaderHash; + T TracingFlags; +}; + +typedef _LDR_DATA_TABLE_ENTRY_T LDR_DATA_TABLE_ENTRY32; +typedef _LDR_DATA_TABLE_ENTRY_T LDR_DATA_TABLE_ENTRY64; + +typedef _TEB_T_ TEB32; +typedef _TEB_T_ TEB64; + +typedef _PEB_LDR_DATA_T PEB_LDR_DATA32; +typedef _PEB_LDR_DATA_T PEB_LDR_DATA64; + +typedef _PEB_T PEB32; +typedef _PEB_T PEB64; + +struct _XSAVE_FORMAT64 +{ + WORD ControlWord; + WORD StatusWord; + BYTE TagWord; + BYTE Reserved1; + WORD ErrorOpcode; + DWORD ErrorOffset; + WORD ErrorSelector; + WORD Reserved2; + DWORD DataOffset; + WORD DataSelector; + WORD Reserved3; + DWORD MxCsr; + DWORD MxCsr_Mask; + _M128A FloatRegisters[8]; + _M128A XmmRegisters[16]; + BYTE Reserved4[96]; +}; + +struct _CONTEXT64 +{ + DWORD64 P1Home; + DWORD64 P2Home; + DWORD64 P3Home; + DWORD64 P4Home; + DWORD64 P5Home; + DWORD64 P6Home; + DWORD ContextFlags; + DWORD MxCsr; + WORD SegCs; + WORD SegDs; + WORD SegEs; + WORD SegFs; + WORD SegGs; + WORD SegSs; + DWORD EFlags; + DWORD64 Dr0; + DWORD64 Dr1; + DWORD64 Dr2; + DWORD64 Dr3; + DWORD64 Dr6; + DWORD64 Dr7; + DWORD64 Rax; + DWORD64 Rcx; + DWORD64 Rdx; + DWORD64 Rbx; + DWORD64 Rsp; + DWORD64 Rbp; + DWORD64 Rsi; + DWORD64 Rdi; + DWORD64 R8; + DWORD64 R9; + DWORD64 R10; + DWORD64 R11; + DWORD64 R12; + DWORD64 R13; + DWORD64 R14; + DWORD64 R15; + DWORD64 Rip; + _XSAVE_FORMAT64 FltSave; + _M128A Header[2]; + _M128A Legacy[8]; + _M128A Xmm0; + _M128A Xmm1; + _M128A Xmm2; + _M128A Xmm3; + _M128A Xmm4; + _M128A Xmm5; + _M128A Xmm6; + _M128A Xmm7; + _M128A Xmm8; + _M128A Xmm9; + _M128A Xmm10; + _M128A Xmm11; + _M128A Xmm12; + _M128A Xmm13; + _M128A Xmm14; + _M128A Xmm15; + _M128A VectorRegister[26]; + DWORD64 VectorControl; + DWORD64 DebugControl; + DWORD64 LastBranchToRip; + DWORD64 LastBranchFromRip; + DWORD64 LastExceptionToRip; + DWORD64 LastExceptionFromRip; +}; + +// Below defines for .ContextFlags field are taken from WinNT.h +#ifndef CONTEXT_AMD64 +#define CONTEXT_AMD64 0x100000 +#endif + +#define CONTEXT64_CONTROL (CONTEXT_AMD64 | 0x1L) +#define CONTEXT64_INTEGER (CONTEXT_AMD64 | 0x2L) +#define CONTEXT64_SEGMENTS (CONTEXT_AMD64 | 0x4L) +#define CONTEXT64_FLOATING_POINT (CONTEXT_AMD64 | 0x8L) +#define CONTEXT64_DEBUG_REGISTERS (CONTEXT_AMD64 | 0x10L) +#define CONTEXT64_FULL (CONTEXT64_CONTROL | CONTEXT64_INTEGER | CONTEXT64_FLOATING_POINT) +#define CONTEXT64_ALL (CONTEXT64_CONTROL | CONTEXT64_INTEGER | CONTEXT64_SEGMENTS | CONTEXT64_FLOATING_POINT | CONTEXT64_DEBUG_REGISTERS) +#define CONTEXT64_XSTATE (CONTEXT_AMD64 | 0x20L) + +#pragma pack(pop) + +#ifdef WOW64EXT_EXPORTS +# define SPEC dllexport +#else +# define SPEC dllimport +#endif + +extern "C" +{ + __declspec(SPEC)DWORD64 __cdecl X64Call(DWORD64 func, int argC, ...); + __declspec(SPEC)DWORD64 __cdecl GetModuleHandle64(wchar_t* lpModuleName); + __declspec(SPEC)DWORD64 __cdecl GetProcAddress64(DWORD64 hModule, char* funcName); + __declspec(SPEC)SIZE_T __cdecl VirtualQueryEx64(HANDLE hProcess, DWORD64 lpAddress, MEMORY_BASIC_INFORMATION64* lpBuffer, SIZE_T dwLength); + __declspec(SPEC)DWORD64 __cdecl VirtualAllocEx64(HANDLE hProcess, DWORD64 lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect); + __declspec(SPEC)BOOL __cdecl VirtualFreeEx64(HANDLE hProcess, DWORD64 lpAddress, SIZE_T dwSize, DWORD dwFreeType); + __declspec(SPEC)BOOL __cdecl VirtualProtectEx64(HANDLE hProcess, DWORD64 lpAddress, SIZE_T dwSize, DWORD flNewProtect, DWORD* lpflOldProtect); + __declspec(SPEC)BOOL __cdecl ReadProcessMemory64(HANDLE hProcess, DWORD64 lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesRead); + __declspec(SPEC)BOOL __cdecl WriteProcessMemory64(HANDLE hProcess, DWORD64 lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten); + __declspec(SPEC)BOOL __cdecl GetThreadContext64(HANDLE hThread, _CONTEXT64* lpContext); + __declspec(SPEC)BOOL __cdecl SetThreadContext64(HANDLE hThread, _CONTEXT64* lpContext); + __declspec(SPEC)VOID __cdecl SetLastErrorFromX64Call(DWORD64 status); +} diff --git a/Wow64Injectx64/Wow64Injectx64/wow64ext.lib b/Wow64Injectx64/Wow64Injectx64/wow64ext.lib new file mode 100644 index 0000000000000000000000000000000000000000..f09c639dfd606bbe6a636f9a1246028de1486430 GIT binary patch literal 4134 zcmcInPjk~o6#v;KiDNrXhID#>X=_@BKbI6caso`JlMn)AP=f0?(3>!p+Bl;iMo|Vh z^#e2?q1>2$h@Sijdgy@@2ZqnV47_LUS}SW6Y?AKGO4|3{?r-vxm>+2z8)67TB-qD%X?v+ z`9OADxewLy+prcJ)Q@WEbyy4U0Ist)y`Ree3pWYZcbE6SQ`Hr){r!PXiic$)I7n`_C+`=5DIBPV>m` z22R8GI?lntrnB$)FQd`*x+YB|rGr-WuRbA5knT0f-%$+p$cDlQWt1?1Da_yu3YbP7MNDEA8Dvv+Iar#NCut=~!qK%pmCC;^ zRFbZea55o?`DoH_^zk4!=F7rf1hR&nFv6204de-`LXDQNLAucUW|G3NM}o+h zI7VkoqXbv@GdWx?{<%}m(D^|AO(nBnJ5LUO zzqlPXfm`%J=|5IhFn4RAYqx{;MLIFU@)f=QrTSj9bM#)pwVtqB5@L!IDugHPxVeH# zFH7%viYYE7by1fwKQ~1}9*|4_OnY^9v)l2#1Mjz>a;15-Vs32R57qG}1#rJ34*-f< zQ1s5xbE5yH!q6-_-u^S1?)g`L;p0aM$bGo*{IZa%UZJGGl3gk3uaBpglM;h%ND$f7 zBMHkd@Iw?H3%Ds-{K|q3Y)Y!9d!DK*9>rT~_3Gd*VP>*@Z~3P`JD#K7TkO6ndMMtq zD5dNzf6In=v$y;|UNFkeenYcJy`U7v=Iy$?jXf^ND0@Q);XdnmJ0{BNk}CE_jxx0< zQD#Uv+x;gS;(faOj>74;gnW9Lt6meXSmApuN2r{aQnFRwdi)op{?7{&Jou0MqL z9pPmtU-G#gzcZ-_7~5y+i~99(p2!Nk;WO%lh=v~VdqT`HqV7D6L8^_BIF*Ob5U2Em zLfM%R({48^(D*xf46_pg^^}>FX>(|u>^qZ;n7CEM7C64|$aFJ=#}PQC;0=BvVsL6> zq+L9Q&%A=BUV>DNFNlp}_~d)I