The Tor Browser: build/win32/crashinject.cpp@b8a032363ba2

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

     1 /* This Source Code Form is subject to the terms of the Mozilla Public

     2  * License, v. 2.0. If a copy of the MPL was not distributed with this

     3  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

     5 /*

     6  * Given a PID, this program attempts to inject a DLL into the process

     7  * with that PID. The DLL it attempts to inject, "crashinjectdll.dll",

     8  * must exist alongside this exe. The DLL will then crash the process.

     9  */

    10 #include <stdio.h>

    11 #include <stdlib.h>

    12 #include <string.h>

    13 #include <windows.h>

    15 int main(int argc, char** argv)

    16 {

    17   if (argc != 2) {

    18     fprintf(stderr, "Usage: crashinject <PID>\n");

    19     return 1;

    20   }

    22   int pid = atoi(argv[1]);

    23   if (pid <= 0) {

    24     fprintf(stderr, "Usage: crashinject <PID>\n");

    25     return 1;

    26   }

    28   // find our DLL to inject

    29   wchar_t filename[_MAX_PATH];

    30   if (GetModuleFileNameW(nullptr, filename,

    31                          sizeof(filename) / sizeof(wchar_t)) == 0)

    32     return 1;

    34   wchar_t* slash = wcsrchr(filename, L'\\');

    35   if (slash == nullptr)

    36     return 1;

    38   slash++;

    39   wcscpy(slash, L"crashinjectdll.dll");

    41   // now find our target process

    42   HANDLE targetProc = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION,

    43                                   FALSE,

    44                                   pid);

    45   if (targetProc == nullptr) {

    46     fprintf(stderr, "Error %d opening target process\n", GetLastError());

    47     return 1;

    48   }

    50   /*

    51    * This is sort of insane, but we're implementing a technique described here:

    52    * http://www.codeproject.com/KB/threads/winspy.aspx#section_2

    53    *

    54    * The gist is to use CreateRemoteThread to create a thread in the other

    55    * process, but cheat and make the thread function kernel32!LoadLibrary,

    56    * so that the only remote data we have to pass to the other process

    57    * is the path to the library we want to load. The library we're loading

    58    * will then do its dirty work inside the other process.

    59    */

    60   HMODULE hKernel32 = GetModuleHandleW(L"Kernel32");

    61   // allocate some memory to hold the path in the remote process

    62   void*   pLibRemote = VirtualAllocEx(targetProc, nullptr, sizeof(filename),

    63                                       MEM_COMMIT, PAGE_READWRITE);

    64   if (pLibRemote == nullptr) {

    65     fprintf(stderr, "Error %d in VirtualAllocEx\n", GetLastError());

    66     CloseHandle(targetProc);

    67     return 1;

    68   }

    70   if (!WriteProcessMemory(targetProc, pLibRemote, (void*)filename,

    71                           sizeof(filename), nullptr)) {

    72     fprintf(stderr, "Error %d in WriteProcessMemory\n", GetLastError());

    73     VirtualFreeEx(targetProc, pLibRemote, sizeof(filename), MEM_RELEASE);

    74     CloseHandle(targetProc);

    75     return 1;

    76   }

    77   // Now create a thread in the target process that will load our DLL

    78   HANDLE hThread = CreateRemoteThread(

    79                      targetProc, nullptr, 0,

    80                      (LPTHREAD_START_ROUTINE)GetProcAddress(hKernel32,

    81                                                             "LoadLibraryW"),

    82                      pLibRemote, 0, nullptr);

    83   if (hThread == nullptr) {

    84     fprintf(stderr, "Error %d in CreateRemoteThread\n", GetLastError());

    85     VirtualFreeEx(targetProc, pLibRemote, sizeof(filename), MEM_RELEASE);

    86     CloseHandle(targetProc);

    87     return 1;

    88   }

    89   WaitForSingleObject(hThread, INFINITE);

    90   // Cleanup, not that it's going to matter at this point

    91   CloseHandle(hThread);

    92   VirtualFreeEx(targetProc, pLibRemote, sizeof(filename), MEM_RELEASE);

    93   CloseHandle(targetProc);

    95   return 0;

    96 }

The Tor Browser / file revision