1+ /**
2+ * MIT License
3+ *
4+ * Copyright (c) 2025 Serkan Aksoy
5+ *
6+ * Permission is hereby granted, free of charge, to any person obtaining a copy
7+ * of this software and associated documentation files (the "Software"), to deal
8+ * in the Software without restriction, including without limitation the rights
9+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10+ * copies of the Software, and to permit persons to whom the Software is
11+ * furnished to do so, subject to the following conditions:
12+ *
13+ * The above copyright notice and this permission notice shall be included in all
14+ * copies or substantial portions of the Software.
15+ *
16+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22+ * SOFTWARE.
23+ */
24+
25+ #include <stdio.h>
26+ #include <stdlib.h>
27+ #include <string.h>
28+ #include <windows.h>
29+
30+ #include "nerror.h"
31+ #include "ntosutils.h"
32+ #include "ntmem.h"
33+ #include "ntosutilswin.h"
34+
35+ void print_usage () {
36+ printf ("GhostInjector - DLL Injection tool for Windows processes\n\n" );
37+ printf ("Examples:\n" );
38+ printf (" ghostinjector.exe 1234 mydll.dll\n" );
39+ printf (" ghostinjector.exe 5678 first.dll second.dll third.dll\n\n" );
40+ printf ("Usage:\n" );
41+ printf (" ghostinjector.exe <process_id> <dll_path> [dll_path2 ...]\n" );
42+ printf (" ghostinjector.exe -h | --help\n" );
43+ }
44+
45+ int main (int argc , char * argv [])
46+ {
47+ if (HAS_ERR (neptune_init ()))
48+ return EXIT_FAILURE ;
49+
50+ if (argc < 3 || strcmp (argv [1 ], "-h" ) == 0 || strcmp (argv [1 ], "--help" ) == 0 ) {
51+ print_usage ();
52+ neptune_destroy ();
53+ return EXIT_SUCCESS ;
54+ }
55+
56+ uint32_t id = atoi (argv [1 ]);
57+
58+ #ifdef LOG_LEVEL_1
59+ LOG_INFO ("Neptune initialized!" );
60+ LOG_INFO ("ID: %u" , id );
61+ LOG_INFO ("Number of DLLs to inject: %d" , argc - 2 );
62+ #endif
63+
64+ if (id == 0 ) {
65+ #ifdef LOG_LEVEL_1
66+ LOG_ERROR ("Invalid id: must be greater than 0" );
67+ #endif
68+ neptune_destroy ();
69+ return 0x11 ;
70+ }
71+
72+ HMODULE kernel32 = GetModuleHandleA ("kernel32" );
73+ if (kernel32 == NULL ) {
74+ #ifdef LOG_LEVEL_1
75+ LOG_ERROR ("GetModuleHandleA failed" );
76+ #endif
77+ neptune_destroy ();
78+ return 0x20 ;
79+ }
80+
81+ FARPROC load_library_func = GetProcAddress (kernel32 , "LoadLibraryA" );
82+ if (load_library_func == NULL ) {
83+ #ifdef LOG_LEVEL_1
84+ LOG_ERROR ("GetProcAddress failed" );
85+ #endif
86+ neptune_destroy ();
87+ return 0x21 ;
88+ }
89+
90+ #ifdef LOG_LEVEL_1
91+ LOG_INFO ("LoadLibraryA=%p" , (void * )load_library_func );
92+ #endif
93+
94+ if (HAS_ERR (nosu_attach (id ))) {
95+ #ifdef LOG_LEVEL_1
96+ LOG_WARN ("nosu_attach failed" );
97+ #endif
98+
99+ if (HAS_ERR (nosu_find_thread_and_upgrade (id ))) {
100+ #ifdef LOG_LEVEL_1
101+ LOG_ERROR ("nosu_find_thread_and_upgrade failed" );
102+ #endif
103+ neptune_destroy ();
104+ return 0x06 ;
105+ }
106+ }
107+
108+ for (int i = 2 ; i < argc ; i ++ ) {
109+ const char * dll_path = argv [i ];
110+
111+ #ifdef LOG_LEVEL_1
112+ LOG_INFO ("Injecting DLL [%d/%d]: %s" , i - 1 , argc - 2 , dll_path );
113+ #endif
114+
115+ size_t dll_path_len = strlen (dll_path );
116+ size_t dll_path_size = dll_path_len + 1 ;
117+
118+ ntmem_t * ntmem = ntm_create_with_alloc_ex (dll_path_size + 1 );
119+ if (ntmem == NULL ) {
120+ #ifdef LOG_LEVEL_1
121+ LOG_ERROR ("ntm_create failed for %s" , dll_path );
122+ #endif
123+ continue ;
124+ }
125+
126+ void * local = NTM_LOCAL (ntmem );
127+ memcpy (local , dll_path , dll_path_size );
128+
129+ void * dll_path_addr = ntm_push (ntmem );
130+ if (dll_path_addr == NULL ) {
131+ #ifdef LOG_LEVEL_1
132+ LOG_ERROR ("ntm_push failed for %s" , dll_path );
133+ #endif
134+ ntm_delete (ntmem );
135+ continue ;
136+ }
137+
138+ #ifdef LOG_LEVEL_1
139+ LOG_INFO ("DLL Path Address(%p)" , dll_path_addr );
140+ #endif
141+
142+ void * load_library_ret = ntu_ucall ((void * )load_library_func , dll_path_addr );
143+
144+ #ifdef LOG_LEVEL_1
145+ LOG_INFO ("LoadLibrary returned: %p" , load_library_ret );
146+ if (load_library_ret != NULL ) {
147+ LOG_INFO ("Successfully injected: %s" , dll_path );
148+ } else {
149+ LOG_ERROR ("Failed to inject: %s" , dll_path );
150+ }
151+ #endif
152+
153+ ntm_delete (ntmem );
154+ }
155+ ntu_destroy ();
156+ neptune_destroy ();
157+ return EXIT_SUCCESS ;
158+ }
0 commit comments