Injector

[nefarearworm]

Hi, man! Clean work!
The main question is can I just use any reflective injector and just fit name of the export function like this?
#define ExportName = "MochiLdr"

and the second question is this support fowarded imports? As I understand - no.

Thank you in advance,

[mochabyte0x]

Hi, thanks for the kind words!

Yes this should work, as you said you just need to specific the reflective function which is MochiLdr(). I took the injector of 5pider as a base and modified it a bit, but it should also work as‑is.

Also, the GetPrcAddr() function in helpers.c doesn’t support forwarded functions. Technically, you should avoid doing too much in the reflective function anyway. The APIs needed in the reflective function do not need forwarding support. You could however implement another GetPrcAddr() function (or modify the current one to support forwarded functions) to use later in your payload code once the reflective function is finished.

[nefarearworm]

Thank you! I did it :)

[nefarearworm]

Do you plan to develop the project further? Adding opsec (unhook LdrLoadDll, syscalls, encryption and etc).

[mochabyte0x]

Very nice, well done!

I‘m not sure if I‘m gonna add opsec related stuff to this project. It‘s very hard to do complexe tasks inside the reflective function mainly because it needs to be PIC (we need to unhook, use direct/indirect syscalls etc before relocations are done). Currently I‘m trying to make indirect syscalls to work, but it‘s a huge pain. If I‘m able to implement this, I‘m at least gonna push that to this project :p !

[nefarearworm]

I hope you can do it :)
I research ur code a bit.
In the MLoadLibrary function u used MStringLengthW to determine unicode length but as I understand its just (USHORT)dwModuleNameSize * sizeof(WCHAR), cuz u already get it using MStringLengthA, isnt it?

[mochabyte0x]

Yes you are correct, my code is definitely messy and a bit redundant at some parts. I could have just put this:

usModule.Length        = (USHORT)(dwModuleNameSize * sizeof(WCHAR));
usModule.MaximumLength = usModule.Length + sizeof(WCHAR);

Instead of:

usModule.Length = (USHORT)(MStringLengthW(pwszModuleName) * sizeof(WCHAR));

I have gone through multiple versions of MLoadLibrary and what you pointed out are leftovers from past versions that weren't working correctly.

So yeah, definitely redundant code you are right :D

[nefarearworm]

Sorry if I annoying u but found another interesting thing. Ur code always calls MLoadLibrary for each imported DLL, even if it's already loaded in the process, is it better to call GetModHandle for first and them if failed use MLoadLibrary?

Here:

ImportModuleName = MochiImage + pImportDescriptor->Name;
ImportModule = MLoadLibrary(Functions, ImportModuleName);

if (!ImportModule) {
return FALSE;
}

OriginalTD = MochiImage + pImportDescriptor->OriginalFirstThunk;
FirstTD = MochiImage + pImportDescriptor->FirstThunk;

[mochabyte0x]

Imho it's not needed and is just extra steps. LdrLoadDll checks the module list. If the module is already mapped in the process, then it skips it and does not copy it. It just returns the existing base address. So what you said:

Your code always calls MLoadLibrary even if the module is already loaded

True, but that doesn't mean that we're mapping duplicate copies. Since the loader runs once per imported DLL (per module), that's not a performance disaster (if we even care about performance).

[nefarearworm]

Myabe in scenario where main function of reflective dll dont use external functions (only ntdll for example) which already present. Will be good to use only GetModuleHandle instead of highly monitored LdrLoadLibrary.

Im not have deep knowledges in this area. Just try too dive a bit deeper :)

Thank you for answers, its means a lot to me!

[mochabyte0x]

Hi, completely forgot to answer you. I'm sorry.

GetModuleHandle and LdrLoadDll have different purposes, although it can seem confusing. GetModuleHandle gets you a (as the name says) a handle to the DLL. It assumes that the DLL is already loaded in the process. LdrLoadDll actually loads the DLL into the process memory, which GetModuleHandle can later use.

So there's no "one or the other". Hope that answers your question!

[mochabyte0x]

Myabe in scenario where main function of reflective dll dont use external functions (only ntdll for example) which already present. Will be good to use only GetModuleHandle instead of highly monitored LdrLoadLibrary.

Im not have deep knowledges in this area. Just try too dive a bit deeper :)

Thank you for answers, its means a lot to me!

And actually you are right yes. If your function (whatever you're executing after the reflective function) doesn't use any functions that need imports (so you only use functions from NTDLL for example), then you would not need LdrLoadDll. Thats correct :D