tploadlib.c

/*
 * Copyright 2025 Almond
 *
 * Redistribution and use in source and binary forms, with or without modification, are
 * permitted provided that the following conditions are met:
 *
 * 1. Redistributions of source code must retain the above copyright notice, this list of
 * conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright notice, this list of
 * conditions and the following disclaimer in the documentation and/or other materials provided
 * with the distribution.
 *
 * 3. Neither the name of the copyright holder nor the names of its contributors may be used to
 * endorse or promote products derived from this software without specific prior written
 * permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS” AND ANY EXPRESS
 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
 * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
 * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "tploadlib.h"

// DO_GADGET is defined in Makefile
// #define DO_GADGET 1

WINBASEAPI HMODULE WINAPI KERNEL32$LoadLibraryA     (LPCSTR);
WINBASEAPI HMODULE WINAPI KERNEL32$GetModuleHandleA (LPCSTR);
WINBASEAPI VOID NTAPI NTDLL$TpAllocWork   (PTP_WORK*, PTP_WORK_CALLBACK, PVOID, PTP_CALLBACK_ENVIRON);
WINBASEAPI VOID NTAPI NTDLL$TpPostWork    (PTP_WORK);
WINBASEAPI VOID NTAPI NTDLL$TpWaitForWork (PTP_WORK, BOOL);
WINBASEAPI VOID NTAPI NTDLL$TpReleaseWork (PTP_WORK);

typedef struct _JUMP_LOADLIBRARY_GADGET {
    LPSTR LibraryName;
    PVOID pLoadLibraryAddress;
    PVOID pGadgetAddress;
} JUMP_LOADLIBRARY_GADGET, * PJUMP_LOADLIBRARY_GADGET;

#if DO_GADGET == 1

void __attribute__((naked)) WorkCallback()
{
    __asm__ __volatile__ (
        ".intel_syntax noprefix;"   
        "sub rsp, 0x28;"            // Counteract `add rsp, 28h` in the gadget's epilogue; done in this function's "prologue"
        "mov r10, [rdx + 0x8];"     // Put pLoadLibraryAddress into r10; will be called by the gadget
        "mov r11, [rdx + 0x10];"    // Put pGadgetAddress into r11; will be jumped to
        "mov rcx, [rdx];"           // Put LibraryName into rcx, first agument to LoadLibraryA
        "xor rdx, rdx;"             // Null out rdx (second argument to LoadLibraryExA, already done by LoadLibraryA but to future-proof in case of a switch to LoadLibraryExA)
        "xor r8, r8;"               // Null out r8 (third argument to LoadLibraryExA, already done by LoadLibraryA but to future-proof in case of a switch to LoadLibraryExA)
        "jmp r11;"                  // Jmp to the gadget, will not put this function's address in the call stack
        ".att_syntax prefix;"
    );
}

PVOID GetCallGadgetAddress(
    PVOID pModule
) {

    PBYTE pDsdmo = (PBYTE)(pModule);
    DWORD i = { 0 };

    for (i = 0x1001; i < (0x1000 + 0x25000); i++) {
        if (pDsdmo[i] == 0x41           &&  // call r10
            pDsdmo[i + 1] == 0xFF       &&  // call r10
            pDsdmo[i + 2] == 0xD2       &&  // call r10
            // pDsdmo[ i + 3 ] ==  0x33 &&  // xor eax, eax
            // pDsdmo[ i + 4 ] ==  0xC0 &&  // xor eax, eax
            // pDsdmo[ i + 5 ] ==  0x48 &&  // add rsp,28
            // pDsdmo[ i + 6 ] ==  0x83 &&  // add rsp,28
            // pDsdmo[ i + 7 ] ==  0xC4 &&  // add rsp,28
            pDsdmo[i + 8] == 0x28       &&  // add rsp,*28*
            pDsdmo[i + 9] == 0xC3           // *ret*
            ) {
            return &(pDsdmo[i]);
        }
    }

    return NULL;

}

#else

void __attribute__((naked)) WorkCallback()
{
    __asm__ __volatile__ (
        ".intel_syntax noprefix;"   
        "mov rcx, [rdx];"       // Put LibraryName into rcx, first agument to LoadLibraryA
        "mov rax, [rdx + 0x8];" // Prepare jump target (address to LoadLibraryA)
        "xor rdx, rdx;"         // Null out rdx (second argument to LoadLibraryExA, already done by LoadLibraryA but to future-proof in case of a switch to LoadLibraryExA)
        "xor r8, r8;"           // Null out r8 (third argument to LoadLibraryExA, already done by LoadLibraryA but to future-proof in case of a switch to LoadLibraryExA)
        "jmp rax;"              // Jmp to LoadLibraryA
        ".att_syntax prefix;"
    );
}

#endif


HMODULE TpLoadLib( CHAR* libName ) {

    PTP_WORK WorkReturn = NULL;

    JUMP_LOADLIBRARY_GADGET Params = { 0 };

    Params.LibraryName = libName;
    Params.pLoadLibraryAddress = KERNEL32$LoadLibraryA;

#if DO_GADGET==1

    HMODULE hDsdmo = KERNEL32$LoadLibraryA("C:\\dsdmo_10.0.26100.1882.dll");
    Params.pGadgetAddress = GetCallGadgetAddress(hDsdmo);

#endif

    NTDLL$TpAllocWork(&WorkReturn, (PTP_WORK_CALLBACK)WorkCallback, &Params, NULL);
    NTDLL$TpPostWork(WorkReturn);
    NTDLL$TpWaitForWork(WorkReturn, FALSE);
    NTDLL$TpReleaseWork(WorkReturn);

    return KERNEL32$GetModuleHandleA(libName);

}