The Tor Browser / file comparison
comparison: build/win32/crashinject.cpp
build/win32/crashinject.cpp
- changeset 0
- 6474c204b198
equal
deleted
inserted
replaced
| -1:000000000000 | 0:587632061785 |
|---|---|
| 1 /* This Source Code Form is subject to the terms of the Mozilla Public | |
| 2 * License, v. 2.0. If a copy of the MPL was not distributed with this | |
| 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | |
| 4 | |
| 5 /* | |
| 6 * Given a PID, this program attempts to inject a DLL into the process | |
| 7 * with that PID. The DLL it attempts to inject, "crashinjectdll.dll", | |
| 8 * must exist alongside this exe. The DLL will then crash the process. | |
| 9 */ | |
| 10 #include <stdio.h> | |
| 11 #include <stdlib.h> | |
| 12 #include <string.h> | |
| 13 #include <windows.h> | |
| 14 | |
| 15 int main(int argc, char** argv) | |
| 16 { | |
| 17 if (argc != 2) { | |
| 18 fprintf(stderr, "Usage: crashinject <PID>\n"); | |
| 19 return 1; | |
| 20 } | |
| 21 | |
| 22 int pid = atoi(argv[1]); | |
| 23 if (pid <= 0) { | |
| 24 fprintf(stderr, "Usage: crashinject <PID>\n"); | |
| 25 return 1; | |
| 26 } | |
| 27 | |
| 28 // find our DLL to inject | |
| 29 wchar_t filename[_MAX_PATH]; | |
| 30 if (GetModuleFileNameW(nullptr, filename, | |
| 31 sizeof(filename) / sizeof(wchar_t)) == 0) | |
| 32 return 1; | |
| 33 | |
| 34 wchar_t* slash = wcsrchr(filename, L'\\'); | |
| 35 if (slash == nullptr) | |
| 36 return 1; | |
| 37 | |
| 38 slash++; | |
| 39 wcscpy(slash, L"crashinjectdll.dll"); | |
| 40 | |
| 41 // now find our target process | |
| 42 HANDLE targetProc = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION, | |
| 43 FALSE, | |
| 44 pid); | |
| 45 if (targetProc == nullptr) { | |
| 46 fprintf(stderr, "Error %d opening target process\n", GetLastError()); | |
| 47 return 1; | |
| 48 } | |
| 49 | |
| 50 /* | |
| 51 * This is sort of insane, but we're implementing a technique described here: | |
| 52 * http://www.codeproject.com/KB/threads/winspy.aspx#section_2 | |
| 53 * | |
| 54 * The gist is to use CreateRemoteThread to create a thread in the other | |
| 55 * process, but cheat and make the thread function kernel32!LoadLibrary, | |
| 56 * so that the only remote data we have to pass to the other process | |
| 57 * is the path to the library we want to load. The library we're loading | |
| 58 * will then do its dirty work inside the other process. | |
| 59 */ | |
| 60 HMODULE hKernel32 = GetModuleHandleW(L"Kernel32"); | |
| 61 // allocate some memory to hold the path in the remote process | |
| 62 void* pLibRemote = VirtualAllocEx(targetProc, nullptr, sizeof(filename), | |
| 63 MEM_COMMIT, PAGE_READWRITE); | |
| 64 if (pLibRemote == nullptr) { | |
| 65 fprintf(stderr, "Error %d in VirtualAllocEx\n", GetLastError()); | |
| 66 CloseHandle(targetProc); | |
| 67 return 1; | |
| 68 } | |
| 69 | |
| 70 if (!WriteProcessMemory(targetProc, pLibRemote, (void*)filename, | |
| 71 sizeof(filename), nullptr)) { | |
| 72 fprintf(stderr, "Error %d in WriteProcessMemory\n", GetLastError()); | |
| 73 VirtualFreeEx(targetProc, pLibRemote, sizeof(filename), MEM_RELEASE); | |
| 74 CloseHandle(targetProc); | |
| 75 return 1; | |
| 76 } | |
| 77 // Now create a thread in the target process that will load our DLL | |
| 78 HANDLE hThread = CreateRemoteThread( | |
| 79 targetProc, nullptr, 0, | |
| 80 (LPTHREAD_START_ROUTINE)GetProcAddress(hKernel32, | |
| 81 "LoadLibraryW"), | |
| 82 pLibRemote, 0, nullptr); | |
| 83 if (hThread == nullptr) { | |
| 84 fprintf(stderr, "Error %d in CreateRemoteThread\n", GetLastError()); | |
| 85 VirtualFreeEx(targetProc, pLibRemote, sizeof(filename), MEM_RELEASE); | |
| 86 CloseHandle(targetProc); | |
| 87 return 1; | |
| 88 } | |
| 89 WaitForSingleObject(hThread, INFINITE); | |
| 90 // Cleanup, not that it's going to matter at this point | |
| 91 CloseHandle(hThread); | |
| 92 VirtualFreeEx(targetProc, pLibRemote, sizeof(filename), MEM_RELEASE); | |
| 93 CloseHandle(targetProc); | |
| 94 | |
| 95 return 0; | |
| 96 } |
