/* modfied command line plugin command added Loaddll usage replace the default cmdline plugin with new one alt+f1 type Loaddll "yourdll" if successfully loaded you can see a log entry "loaded "your dll"" in ollydbg log window and you can see your dll in memory window modified by anonymouse */ #define MEM_SHARED 0x8000000 // thanks ElicZ for this 9x hack #define STRICT // Avoids some type mismatches #include <windows.h> #include <stdio.h> #include "plugin.h" int magic(void); extern char string[TEXTLEN];// defined in cmdexec.c char copy[TEXTLEN]; ulong eip; ulong esp; ulong status; HANDLE hDebugee; char *hMem; int magic() { t_thread *thread; t_asmmodel model; char buffer[TEXTLEN] = {0}; char error[TEXTLEN] = {0}; int len,totallen; strncpy(copy,string,(TEXTLEN-1)); hDebugee = (HANDLE)Plugingetvalue(VAL_HPROCESS); thread = Findthread(Getcputhreadid()); eip = thread->reg.ip; esp = thread->reg.r[REG_ESP]; totallen = 0; if(GetVersion() > 0x80000000) { hMem = (CHAR *)VirtualAlloc(NULL,1000,MEM_COMMIT|MEM_RESERVE|MEM_SHARED,PAGE_EXECUTE_READWRITE); } else { hMem = (CHAR *)VirtualAllocEx(hDebugee,NULL,1000,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE); } WriteProcessMemory(hDebugee, (LPVOID)(hMem), copy, strlen(copy), 0); snprintf(buffer,(TEXTLEN-1),"%s","pushad"); len = Assemble(buffer, (ULONG_PTR)(hMem+500 + totallen), &model, 0, 0, error); WriteProcessMemory(hDebugee, (LPVOID)(hMem+500 + totallen), model.code, len, 0); totallen += len; snprintf(buffer,(TEXTLEN-1),"%s","pushfd"); len = Assemble(buffer, (ULONG_PTR)(hMem+500 + totallen), &model, 0, 0, error); WriteProcessMemory(hDebugee, (LPVOID)(hMem+500 + totallen), model.code, len, 0); totallen += len; snprintf(buffer,(TEXTLEN-1),"push 0x%lx",*(ulong *)&hMem); len = Assemble(buffer, (ULONG_PTR)(hMem+500 + totallen), &model, 0, 0, error); WriteProcessMemory(hDebugee, (LPVOID)(hMem+500 + totallen), model.code, len, 0); totallen += len; snprintf(buffer,(TEXTLEN-1),"call %s","LoadLibraryA"); len = Assemble(buffer, (ULONG_PTR)(hMem+500 + totallen), &model, 0, 0, error); WriteProcessMemory(hDebugee, (LPVOID)(hMem+500 + totallen), model.code, len, 0); totallen += len; snprintf(buffer,(TEXTLEN-1),"%s","popfd"); len = Assemble(buffer, (ULONG_PTR)(hMem+500 + totallen), &model, 0, 0, error); WriteProcessMemory(hDebugee, (LPVOID)(hMem+500 + totallen), model.code, len, 0); totallen += len; snprintf(buffer,(TEXTLEN-1),"%s","popad"); len = Assemble(buffer, (ULONG_PTR)(hMem+500 + totallen), &model, 0, 0, error); WriteProcessMemory(hDebugee, (LPVOID)(hMem+500 + totallen), model.code, len, 0); totallen += len; snprintf(buffer,(TEXTLEN-1),"jmp 0x%lx",eip); len = Assemble(buffer, (ULONG_PTR)(hMem+500 + totallen), &model, 0, 0, error); WriteProcessMemory(hDebugee, (LPVOID)(hMem+500 + totallen), model.code, len, 0); thread->reg.ip = (ULONG_PTR)hMem+500; thread->reg.modified = 1; thread->regvalid = 1; Broadcast(WM_USER_CHREG, 0, 0); Go(Getcputhreadid(), eip, STEP_RUN, 0, 1); return 0; } int Load(char *answer,ulong parm) { if(Getstatus() == STAT_NONE) { MessageBox(NULL,"I Cant Load Dlls On Thin Air Start Some Process First","LoadDll Function",NULL); return 0; } else if(Getstatus() == STAT_RUNNING) { status = 1; Suspendprocess(1); magic(); return 0; } else if(Getstatus() == STAT_STOPPED) { status = -1; magic(); return 0; } else { return 0; } } #pragma argsused extc int _export cdecl ODBG_Pausedex(int reason, int extdata, t_reg *reg, DEBUG_EVENT *debugevent) { DWORD Exceptcode; DEBUG_EVENT debev; ulong newesp; t_thread *newthread; if (reg != 0) { if(debugevent !=0) { debev = *debugevent; Exceptcode = debev.u.Exception.ExceptionRecord.ExceptionCode; if((Exceptcode != EXCEPTION_BREAKPOINT) && (Exceptcode != EXCEPTION_SINGLE_STEP)) { return 0; } if (debev.u.Exception.ExceptionRecord.ExceptionAddress == (PVOID)(eip)) { if(GetVersion() > 0x80000000) { Addtolist(0,1,"Loaded %s ",copy); VirtualFree(hMem,0,MEM_RELEASE); if(status == 1) Go(Getcputhreadid(), 0, STEP_RUN, 0, 1); eip = esp = status = *copy = 0; return 0; } else { newthread = Findthread(Getcputhreadid()); newesp = newthread->reg.r[REG_ESP]; if(esp == newesp) { Addtolist(0,1,"Loaded %s ",copy); VirtualFreeEx(hDebugee,hMem,0,MEM_RELEASE); if(status == 1) Go(Getcputhreadid(), 0, STEP_RUN, 0, 1); eip = esp = status = *copy = 0; return 0; } Go(Getcputhreadid(), eip, STEP_RUN, 0, 1); return 0; } } } } return 0; };
There are 31,316 total registered users.
[+] expand
![[+] expand](/imagery/files/soysauce_blueprint.gif){kind=link}