Skip to content

Multiple improvements for Bootstrapper.#7

Open
AntonDevil wants to merge 1 commit intoStackOverflowExcept1on:masterfrom
AntonDevil:user/AntonDevil/BootstrapperAdditions
Open

Multiple improvements for Bootstrapper.#7
AntonDevil wants to merge 1 commit intoStackOverflowExcept1on:masterfrom
AntonDevil:user/AntonDevil/BootstrapperAdditions

Conversation

@AntonDevil
Copy link
Contributor

Hi @StackOverflowExcept1on

I have a number of additions for you bootstrapper.
Mainly I replace frida with VERSION.dll for code injection for windows.
Not sure what can be used on linux though...

Anyways, here is the list of changes.
I'm not saying to merge all of them.
This is just an invitation for discussion.
Do you like some of these new features?
I can separate the PR and keep just some of them.

  • library.cpp renamed to bootstrapper.cpp.
  • Added DllMain for bootstrapper.cpp for windows.
  • Added RUNTIME_CONFIG_PATH, ASSEMBLY_PATH, TYPE_NAME, METHOD_NAME to call a specific patcher.
  • Added wait_for_hostfxr function to wait for hostfxr to load first before proceeding. Not sure it is required, but it is nice to have if the app takes long to initialize.
  • Extracted HOSTFXR_TIMEOUT_MS, HOSTFXR_POLL_INTERVAL_MS, HOSTFXR_LIBRARY_NAME macros.
  • Added InitializeResult::HostFxrFptrLoadError if function pointers from hostfxr were not loaded.
  • Added exit_hooks hooks to prevent the app from closing.
  • Added logging to a file and console for debugging. Added log_printf where makes sense to debug bootstrapping.
  • Added module_dir to get the directory of running process to load the patcher from and store logs in its folder. Usefull if runing target app from other directory.
  • Added process_args functions to extract command line, get its arguments and check for specific args.
  • Added -LogBootstrapper and -HookExitProcess flags to force enable logging and exit hook. Disabled from CMake side by default. Set -DDEFAULT_LOGGING_ENABLED=ON, -DDEFAULT_EXIT_HOOKS_ENABLED=OFF in build.bat.
  • Added VERSION.dll as injection entry point for windows. Proxies system version.dll (c:\Windows\System32\version.dll) Calls Bootstrapper.dll on DllMain.

* Added `DllMain` for `bootstrapper.cpp` for windows.
* Added `RUNTIME_CONFIG_PATH`, `ASSEMBLY_PATH`, `TYPE_NAME`, `METHOD_NAME` to call a specific patcher.
* Added `wait_for_hostfxr` function to wait for `hostfxr` to load first before proceeding.
  Not sure it is required, but it is nice to have if the app takes long to initialize.
* Extracted `HOSTFXR_TIMEOUT_MS`, `HOSTFXR_POLL_INTERVAL_MS`, `HOSTFXR_LIBRARY_NAME` macros.
* Added `InitializeResult::HostFxrFptrLoadError` if function pointers from `hostfxr` were not loaded.
* Added `exit_hooks` hooks to prevent the app from closing.
* Added `logging` to a file and console for debugging.
  Added `log_printf` where makes sense to debug bootstrapping.
* Added `module_dir` to get the directory of running process to load the patcher from and store logs in its folder.
  Usefull if runing target app from other directory.
* Added `process_args` functions to extract command line, get its arguments and check for specific args.
* Added `-LogBootstrapper` and `-HookExitProcess` flags to force enable logging and exit hook.
  Disabled from CMake side by default.
  Set `-DDEFAULT_LOGGING_ENABLED=ON`, `-DDEFAULT_EXIT_HOOKS_ENABLED=OFF` in `build.bat`.
* Added `VERSION.dll` as injection entry point for windows.
  Proxies system `version.dll` (`c:\Windows\System32\version.dll`)
  Calls `Bootstrapper.dll` on `DllMain`.
@StackOverflowExcept1on
Copy link
Owner

Thanks, I thought about this. I'll review in my free time.

Not sure what can be used on linux though...

https://github.com/kubo/injector

@AntonDevil
Copy link
Contributor Author

BTW, I recently discovered DOTNET_STARTUP_HOOKS trick 😊. There are ways to disable StartupHookSupport but I rarely see people doing it, so it can be another attack vector and very simple one.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants