ntapi | Rust FFI bindings for Native API | Wrapper library

First - I had to compile in x64. Second - had to allocate memory for pBuffer

Below is a working example

As noted by Micheal Petch, the shellcode was wrong. I only missed one byte (0x0C) that should be 0xC0.

If anyone will ever attempt something so stupid and useless like I did, double-check your shellcode first!

_WIN32_WINNT comes from the include file , so in order to fix the error you are seeing:

In the file throwing the error, change this:

Since your actual problem is to hide from anti-virus, I would suggest to use a static buffer.

Specify Project->Properties->Linker->Specify Section Attributes.

uninitialized is still zero initialized

/* global or static*/ char buf[20000];

specify .bss,RWE

(which is probably what you need)

/* global or static*/ char buf[20000]{1};

specify .data,RWE

specify Linker->Command Line->Additional Options as /SECTION:.bss,RWE /SECTION:.data,RWE

I want to allocate some memory inside a specific module

You cannot do this, when a module is mapped it's memory is allocated. You can't allocate memory inside the module, the module exists inside it's allocated pages and no where else. Any allocated pages will be outside of the module.

Alternatively if you want to use memory which is already allocated but is not used, this called a code cave. It's typically an area of memory inside a module which is filled with zeros. So you can scan for a code cave by finding a certain length of redundant zeros inside the module and then you can write to that memory.

This is done frequently and is especially useful if the page has the execute bit set as you won't have to change any permissions which could be deemed risky.

This is also done frequently in injectors which use "scatter mapping" where it only uses these code caves to inject code.

And your currentitem_InMemoryOrderModuleList is just a pointer to LIST_ENTRY. And this LIST_ENTRY is a InMemoryOrderLinks field in LDR_DATA_TABLE_ENTRY. You can adjust pointer to point to enclosing structure before using.

Refer to "PEB (Process Environment Block) invalid DllBase address", "CONTAINING_RECORD" (Which returns the base address of an instance of a structure given the type of the structure and the address of a field within the containing structure.).

The following code works for me. You can have a try:

First of all, the 3rd parameter is a pointer to the OBJECT_ATTRIBUTES:

Simple: Your DLL is loaded only into process that load user32.dll. Some process do. Other don't. The one you speak of doesn't:

It's not that the hooking doesn't work. Your DLL isn't even loaded.

Also, hooking in thread attach is probably not what you want, and unhooking in thread detach is almost certainly not what you want.