[C#] 64 Bit DLL Mapping

Discussion in 'Mixed Languages' started by CODYQX4, May 23, 2013.

  1. CODYQX4

    CODYQX4 MDL Developer

    Sep 4, 2009
    4,813
    45,775
    150
    #1 CODYQX4, May 23, 2013
    Last edited: Apr 12, 2019
    .
     
  2. Josh Cell

    Josh Cell MDL Developer

    Jan 8, 2011
    3,515
    7,170
    120
    #2 Josh Cell, May 23, 2013
    Last edited: May 23, 2013
    The x86 memory areas really are not the same from x64, so your code will not work because it is writing the module in another memory block.

    You need to convert the code making the write area x2. You can see it on IntPtr.Size that is 4 for x86 and 8 for x64. You just will need what are the blocks to convert while the process is x64. Just math it and see the results.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. CODYQX4

    CODYQX4 MDL Developer

    Sep 4, 2009
    4,813
    45,775
    150
    #3 CODYQX4, May 24, 2013
    Last edited: Apr 12, 2019
    (OP)
    .
     
  4. CODYQX4

    CODYQX4 MDL Developer

    Sep 4, 2009
    4,813
    45,775
    150
    #4 CODYQX4, May 24, 2013
    Last edited: Apr 12, 2019
    (OP)
    .
     
  5. PAYMYRENT

    PAYMYRENT MDL Developer

    Jul 28, 2009
    1,460
    420
    60
    #5 PAYMYRENT, May 24, 2013
    Last edited: May 24, 2013
    Have you tried taking a look at how the VB.NET RunPE code works? You are trying to recreate it will what you are doing here - basic image injection -- http://pastebin.com/jSNyuc08

    EDIT: This might even suite your needs better - This is the C++ RunPE - I have used this before and it works for both x86 files and x64 files

    http://pastebin.com/8QMupfQg

    EDIT2: Even better this is the C# one - Untested but still the basics of loading up files

    http://pastebin.com/7Maq937s
     
  6. CODYQX4

    CODYQX4 MDL Developer

    Sep 4, 2009
    4,813
    45,775
    150
    #6 CODYQX4, May 24, 2013
    Last edited: Apr 12, 2019
    (OP)
    .
     
  7. PAYMYRENT

    PAYMYRENT MDL Developer

    Jul 28, 2009
    1,460
    420
    60
    Not sure about the C# one but I know the vb.net and C++ ones works - Needed it for my software protection methods
     
  8. CODYQX4

    CODYQX4 MDL Developer

    Sep 4, 2009
    4,813
    45,775
    150
    #8 CODYQX4, May 24, 2013
    Last edited: Apr 12, 2019
    (OP)
    .
     
  9. PAYMYRENT

    PAYMYRENT MDL Developer

    Jul 28, 2009
    1,460
    420
    60
    To be honest - I have never tried anycpu with it ... just plain x86 .. and x64.. I can reboot and test real quick lol
     
  10. qad

    qad MDL Member

    Dec 17, 2012
    218
    829
    10
    #10 qad, May 26, 2013
    Last edited: May 26, 2013
    @CODYQX4

    I managed to get AnyCPU build working.
    KMSLibrary.7z

    Basically, I changed the pointer arithmetics to fit 64bit and the basic functionality seems to be working.
    One thing that I couldn't test is the 64bit relocation because the DLL is always mapped at original ImageBase in my tests.
    I hope this helps you.

    P.S
    I also changed the way of marshalling Request/Response in KMS.cs so that they use built-in MarshalAs like DllLoader.
    If you don't want them, please just use DynamicDllLoader.cs only and adjust Main func in Program.cs.

    P.S 2
    I refer this repo what is needed to make it work for x64.

    Regard.
     
  11. CODYQX4

    CODYQX4 MDL Developer

    Sep 4, 2009
    4,813
    45,775
    150
    #11 CODYQX4, May 26, 2013
    Last edited: Apr 12, 2019
    (OP)
    .
     
  12. Josh Cell

    Josh Cell MDL Developer

    Jan 8, 2011
    3,515
    7,170
    120
    Yeah, nice work.

    That's like I have looked in a first moment inside the thread.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...