ccdescipline / cinject

Windows Kernel inject (no module no thread)

Cinject

Cinject is a project that executes dll injection in the Windows kernel. It is characterized by no modules and no threads. It uses remote stretching pe to achieve no modules. It uses APC or SupendThread to replace Rip registers to hijack threads to achieve no threads. The running environment was tested in 1909. If you want to run in other versions, you need to modify and find the function signatures of KeSuspendThread and KeResumeThread. I will tell you how to modify the offset of OFFSET_KTRAP_FRAME below. The injected dll also requires attributes ->code generation ->runtime multi-threaded MT. In short, other dll modules in the import table of the dll must also exist in the target process!

Objectives

Temporarily test that the Apex Legends protected by EAC can be injected in 1909 (Os version 18363)

How to find KeSuspendThread and KeResumeThread?

You need to open windbg in the target system as an administrator to open Kernel Debug, enter u KeSuspendThread to view the KeSuspendThread function address and disassembly, and record the characteristic code. The same is true for KeResumeThread, and finally in EipInject Cpp Modify the signature in the FindKeSuspendThread and FindKeResumeThread functions.

How to modify OFFSET_ KTRAP_ FRAME？

It is in EipInject H 'is the same as above. You also need the windbg administrator to start and enable kernel debugging, and type dt_ KTHREAD View _KTRAP_FRAME The offset can be modified

Switch APC and EIP modes

In the injectDll function, you can use APCExecuteFunction or EipExceptionFunction to switch between different execution methods

Cinject

Cinject 是在windows内核执行dll注入的一个项目，特点是无模块和无线程，使用远程拉伸pe实现无模块，使用APC 或 SupendThread 替换Rip寄存器劫持线程实现无线程，运行环境在1909得到测试，如想在其他版本运行，需要修改寻找 KeSuspendThread 和 KeResumeThread 函数特征码和 OFFSET_KTRAP_FRAME 的偏移，我会在下文告诉大家如何修改。注入的dll也有要求，属性->代码生成->运行库 多线程MT。简单来说就是该dll的导入表里的其他dll模块在目标进程里也必须存在！

目标

暂时测试可以注入受EAC 保护的 Apex legends 在 1909（Os version 18363）

怎样寻找 KeSuspendThread 和 KeResumeThread？

您需要在目标系统中以管理员方式打开 windbg 开启 Kernel Debug 输入 u KeSuspendThread即可查看 KeSuspendThread 函数地址和反汇编，记录下特征码即可，KeResumeThread 也是如此 u KeResumeThread ,最后在EipInject.cpp修改FindKeSuspendThread 和 FindKeResumeThread函数里的特征码即可。

根据找到的函数查看反汇编，更新特征码，如图

怎样修改 OFFSET_KTRAP_FRAME？

它在EipInject.h中 同上，也需要windbg管理员启动并开启内核调试，键入 dt _KTHREAD 查看 _KTRAP_FRAME的偏移，修改即可

切换APC 和 EIP 方式

在injectDll函数中，你可以使用 APCExecuteFunction 或EipExcuteFuntion 切换不同的执行方式

cinject's Issues

error from no were

Severity Code Description Project File Line Suppression State Details
Error No file digest algorithm specified. Please specify the digest algorithm with the /fd flag. Using /fd SHA256 is recommended and more secure than SHA1. Calling signtool with /fd sha1 is equivalent to the previous behavior. In order to select the hash algorithm used in the signing certificate's signature, use the /fd certHash option. TestDriver E:\F\c++\CInject-master\CInject-master\TestDriver\SIGNTASK 1

hello

OFFSET_KTRAP_FRAME与KeSuspendThread 和 KeResumeThread都获取到了并且正确，使用APC注入时，notepad崩溃，windbg调试发现可能时dll的问题，能否留个联系方式互相解决一下?

.

无法获取两个dll的模块基址

我使用的是EIP注入
'api-ms-win-crt-stdio-l1-1-0.dll'和另一个名称类似的runtime基地址，获取到的都是0...
可是我查看了系统中是有这两个dll文件的

我没法解决，于是我在'FillRavAddress()'方法中加了判断
'
if (!moudlebase) {
i++;
continue;
}
'
尝试忽略掉这两个获取不到的基地址
后续一直正常运行
一直到
'
//等待30秒，清空shellcode
LARGE_INTEGER li = { 0 };
li.QuadPart = -10000 * 1000 * cleartimeSecond;
KeDelayExecutionThread(KernelMode, NULL, &li);
RemoteFreeMemory(process, virtualaddr, sizeof(shellcode));
'
我给notepad.exe注入 记事本会奇怪地重启...
然后当我等待30秒后 运行到RemoteFreeMemory直接报错蓝屏

有没有通用的

想要能够自动获取其他windows的地址