amacocian/Daybreak
1
0
Fork 0
mirror of https://github.com/gwdevhub/Daybreak.git synced 2026-07-15 15:19:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove reloaded dependency (use native bytecode) (#1514)

Browse Source
This commit is contained in:
Alexandru Victor Macocian
2026-04-20 10:26:48 +02:00
parent 8eba2b92dd
commit d5c8e7ad03
3 changed files with 20 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Daybreak.Injector/Daybreak.Injector.csproj
-4
View File
@@ -18,10 +18,6 @@
<DebugSymbols>false</DebugSymbols>
</PropertyGroup>
<ItemGroup>
<PackageReference Include="Reloaded.Assembler" />
</ItemGroup>
<ItemGroup>
<ProjectReference Include="..\Daybreak.Shared\Daybreak.Shared.csproj" />
</ItemGroup>
Daybreak.Injector/StubInjector.cs
+20 -32
View File
@@ -1,5 +1,4 @@
using Daybreak.Shared.Models;
using Reloaded.Assembler;
using System.Diagnostics;
using System.Text;
@@ -8,36 +7,26 @@ namespace Daybreak.Injector;
public static class StubInjector
{
/// <summary>
/// ebp+8 is the dll path pointer
/// 0xDEADBEEF is a placeholder to be patched later for LoadLibraryA
/// 0xFEEDF00D is a placeholder to be patched later for GetProcAddress
/// Pre-assembled x86 stub bytecode.
/// 0xDEADBEEF is a placeholder to be patched later for LoadLibraryA.
/// 0xFEEDF00D is a placeholder to be patched later for GetProcAddress.
/// </summary>
const string Asm = @"
use32
push ebp
mov ebp, esp
mov esi, [ebp+8] ; ESI = &INJECT_DATA (kept unchanged)
; -------- LoadLibraryA(dllPath) ------------------------------
push dword [esi] ; dllPath
mov eax, 0xDEADBEEF ; patched → LoadLibraryA
call eax ; EAX = hModule
; -------- GetProcAddress(hModule, funcName) ------------------
push dword [esi+4] ; funcName
push eax ; hModule (still in EAX)
mov eax, 0xFEEDF00D ; patched → GetProcAddress
call eax ; EAX = exported EntryPoint
; -------- call EntryPoint() ----------------------------------
call eax ; calls EntryPoint
; xor eax, eax ; thread exit-code 0
; -------- return EntryPoint() response -----------------------
leave ; = mov esp, ebp / pop ebp
ret 4 ; stdcall: pop lpParameter
";
private static readonly byte[] StubTemplate =
[
0x55, // push ebp
0x89, 0xE5, // mov ebp, esp
0x8B, 0x75, 0x08, // mov esi, [ebp+8]
0xFF, 0x36, // push dword [esi] ; dllPath
0xB8, 0xEF, 0xBE, 0xAD, 0xDE, // mov eax, 0xDEADBEEF ; -> LoadLibraryA
0xFF, 0xD0, // call eax
0xFF, 0x76, 0x04, // push dword [esi+4] ; funcName
0x50, // push eax ; hModule
0xB8, 0x0D, 0xF0, 0xED, 0xFE, // mov eax, 0xFEEDF00D ; -> GetProcAddress
0xFF, 0xD0, // call eax
0xFF, 0xD0, // call eax ; EntryPoint()
0xC9, // leave
0xC2, 0x04, 0x00, // ret 4 ; stdcall cleanup
];
public static InjectorResponses.InjectResult Inject(Process target, string dllPath, string entryPoint, out int exitCode)
{
@@ -51,8 +40,7 @@ ret 4 ; stdcall: pop lpParameter
return InjectorResponses.InjectResult.InvalidProcess;
}
using var assembler = new Assembler();
var stubBytes = assembler.Assemble(Asm);
var stubBytes = (byte[])StubTemplate.Clone();
// patch placeholders
var hKernel = NativeMethods.GetModuleHandle("kernel32.dll");
Directory.Packages.props
-1
View File
@@ -43,7 +43,6 @@
<PackageVersion Include="PeNet" Version="6.0.0" />
<PackageVersion Include="Photino.Blazor" Version="4.0.13" />
<PackageVersion Include="Plumsy" Version="1.2.0" />
<PackageVersion Include="Reloaded.Assembler" Version="1.0.16" />
<PackageVersion Include="securifybv.ShellLink" Version="0.1.0" />
<PackageVersion Include="Serilog" Version="4.3.1" />
<PackageVersion Include="Serilog.Enrichers.Environment" Version="3.0.1" />