Skip to content

Commit fb4e58d

Browse files
DarthTonDarthTon
committed
One time global initialization
1 parent 5c62846 commit fb4e58d

File tree

15 files changed

+143
-105
lines changed

15 files changed

+143
-105
lines changed

‎src/BlackBone/BlackBone.vcxproj

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -567,6 +567,7 @@
567567
<ClCompile Include="ManualMap\MMap.cpp" />
568568
<ClCompile Include="ManualMap\Native\NtLoader.cpp" />
569569
<ClCompile Include="Misc\DynImport.cpp" />
570+
<ClCompile Include="Misc\InitOnce.cpp" />
570571
<ClCompile Include="Misc\NameResolve.cpp" />
571572
<ClCompile Include="Misc\Utils.cpp" />
572573
<ClCompile Include="Patterns\PatternSearch.cpp" />
@@ -661,6 +662,7 @@
661662
<ClInclude Include="ManualMap\MMap.h" />
662663
<ClInclude Include="ManualMap\Native\NtLoader.h" />
663664
<ClInclude Include="Misc\DynImport.h" />
665+
<ClInclude Include="Misc\InitOnce.h" />
664666
<ClInclude Include="Misc\NameResolve.h" />
665667
<ClInclude Include="Misc\Thunk.hpp" />
666668
<ClInclude Include="Misc\Trace.hpp" />

‎src/BlackBone/BlackBone.vcxproj.filters

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,9 @@
192192
<ClCompile Include="Process\RPC\RemoteLocalHook.cpp">
193193
<Filter>Process\Remote</Filter>
194194
</ClCompile>
195+
<ClCompile Include="Misc\InitOnce.cpp">
196+
<Filter>Misc</Filter>
197+
</ClCompile>
195198
</ItemGroup>
196199
<ItemGroup>
197200
<ClInclude Include="Config.h" />
@@ -441,5 +444,8 @@
441444
<ClInclude Include="Process\MultPtr.hpp">
442445
<Filter>Process</Filter>
443446
</ClInclude>
447+
<ClInclude Include="Misc\InitOnce.h">
448+
<Filter>Misc</Filter>
449+
</ClInclude>
444450
</ItemGroup>
445451
</Project>

‎src/BlackBone/DriverControl/DriverControl.cpp

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,16 +12,8 @@ namespace blackbone
1212

1313
DriverControl::DriverControl()
1414
{
15-
HMODULE ntdll = GetModuleHandleW( L"ntdll.dll" );
16-
17-
LOAD_IMPORT( "NtLoadDriver", ntdll );
18-
LOAD_IMPORT( "NtUnloadDriver", ntdll );
19-
LOAD_IMPORT( "RtlDosPathNameToNtPathName_U", ntdll );
20-
LOAD_IMPORT( "RtlInitUnicodeString", ntdll );
21-
LOAD_IMPORT( "RtlFreeUnicodeString", ntdll );
2215
}
2316

24-
2517
DriverControl::~DriverControl()
2618
{
2719
//Unload();

‎src/BlackBone/ManualMap/Native/NtLoader.cpp

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,6 @@ namespace blackbone
1414
NtLdr::NtLdr( Process& proc )
1515
: _process( proc )
1616
{
17-
HMODULE hNtdll = GetModuleHandleW( L"ntdll.dll" );
18-
19-
LOAD_IMPORT( "RtlInitUnicodeString", hNtdll );
20-
LOAD_IMPORT( "RtlHashUnicodeString", hNtdll );
21-
LOAD_IMPORT( "RtlUpcaseUnicodeChar", hNtdll );
22-
LOAD_IMPORT( "RtlEncodeSystemPointer", hNtdll );
2317
}
2418

2519
NtLdr::~NtLdr(void)

‎src/BlackBone/Misc/InitOnce.cpp

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
#include "InitOnce.h"
2+
#include "../Include/Winheaders.h"
3+
#include "../Include/Macro.h"
4+
#include "DynImport.h"
5+
6+
#include <string>
7+
#include <cassert>
8+
9+
namespace blackbone
10+
{
11+
12+
class InitOnce
13+
{
14+
public:
15+
static bool Exec()
16+
{
17+
if(!_done)
18+
{
19+
GrantPriviledge( SE_DEBUG_NAME );
20+
GrantPriviledge( SE_LOAD_DRIVER_NAME );
21+
LoadFuncs();
22+
_done = true;
23+
}
24+
25+
return _done;
26+
}
27+
28+
private:
29+
InitOnce() = delete;
30+
InitOnce( const InitOnce& ) = delete;
31+
InitOnce& operator=( const InitOnce& ) = delete;
32+
33+
/// <summary>
34+
/// Grant current process arbitrary privilege
35+
/// </summary>
36+
/// <param name="name">Privilege name</param>
37+
/// <returns>Status</returns>
38+
static NTSTATUS GrantPriviledge( const std::wstring& name )
39+
{
40+
TOKEN_PRIVILEGES Priv, PrivOld;
41+
DWORD cbPriv = sizeof( PrivOld );
42+
HANDLE hToken;
43+
44+
if (!OpenThreadToken( GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, FALSE, &hToken ))
45+
{
46+
if (GetLastError() != ERROR_NO_TOKEN)
47+
return LastNtStatus();
48+
49+
if (!OpenProcessToken( GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken ))
50+
return LastNtStatus();
51+
}
52+
53+
Priv.PrivilegeCount = 1;
54+
Priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
55+
LookupPrivilegeValueW( NULL, name.c_str(), &Priv.Privileges[0].Luid );
56+
57+
if (!AdjustTokenPrivileges( hToken, FALSE, &Priv, sizeof( Priv ), &PrivOld, &cbPriv ))
58+
{
59+
CloseHandle( hToken );
60+
return LastNtStatus();
61+
}
62+
63+
if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)
64+
{
65+
CloseHandle( hToken );
66+
return LastNtStatus();
67+
}
68+
69+
CloseHandle( hToken );
70+
return STATUS_SUCCESS;
71+
}
72+
73+
static void LoadFuncs()
74+
{
75+
HMODULE hNtdll = GetModuleHandleW( L"ntdll.dll" );
76+
HMODULE hKernel32 = GetModuleHandleW( L"kernel32.dll" );
77+
78+
LOAD_IMPORT( "NtQuerySystemInformation", hNtdll );
79+
LOAD_IMPORT( "RtlDosApplyFileIsolationRedirection_Ustr", hNtdll );
80+
LOAD_IMPORT( "RtlInitUnicodeString", hNtdll );
81+
LOAD_IMPORT( "RtlFreeUnicodeString", hNtdll );
82+
LOAD_IMPORT( "RtlHashUnicodeString", hNtdll );
83+
LOAD_IMPORT( "RtlUpcaseUnicodeChar", hNtdll );
84+
LOAD_IMPORT( "NtQueryInformationProcess", hNtdll );
85+
LOAD_IMPORT( "NtSetInformationProcess", hNtdll );
86+
LOAD_IMPORT( "NtQueryInformationThread", hNtdll );
87+
LOAD_IMPORT( "NtDuplicateObject", hNtdll );
88+
LOAD_IMPORT( "NtQueryObject", hNtdll );
89+
LOAD_IMPORT( "NtQuerySection", hNtdll );
90+
LOAD_IMPORT( "RtlCreateActivationContext", hNtdll );
91+
LOAD_IMPORT( "NtQueryVirtualMemory", hNtdll );
92+
LOAD_IMPORT( "NtCreateThreadEx", hNtdll );
93+
LOAD_IMPORT( "NtLockVirtualMemory", hNtdll );
94+
LOAD_IMPORT( "NtSuspendProcess", hNtdll );
95+
LOAD_IMPORT( "NtResumeProcess", hNtdll );
96+
LOAD_IMPORT( "RtlImageNtHeader", hNtdll );
97+
LOAD_IMPORT( "NtLoadDriver", hNtdll );
98+
LOAD_IMPORT( "NtUnloadDriver", hNtdll );
99+
LOAD_IMPORT( "RtlDosPathNameToNtPathName_U", hNtdll );
100+
LOAD_IMPORT( "NtOpenEvent", hNtdll );
101+
LOAD_IMPORT( "NtCreateEvent", hNtdll );
102+
LOAD_IMPORT( "NtQueueApcThread", hNtdll );
103+
LOAD_IMPORT( "RtlEncodeSystemPointer", hNtdll );
104+
LOAD_IMPORT( "NtWow64QueryInformationProcess64", hNtdll );
105+
LOAD_IMPORT( "NtWow64ReadVirtualMemory64", hNtdll );
106+
LOAD_IMPORT( "NtWow64WriteVirtualMemory64", hNtdll );
107+
LOAD_IMPORT( "Wow64GetThreadContext", hKernel32 );
108+
LOAD_IMPORT( "Wow64SetThreadContext", hKernel32 );
109+
LOAD_IMPORT( "Wow64SuspendThread", hKernel32 );
110+
LOAD_IMPORT( "GetProcessDEPPolicy", hKernel32 );
111+
LOAD_IMPORT( "QueryFullProcessImageNameW", hKernel32 );
112+
}
113+
114+
private:
115+
static bool _done;
116+
};
117+
118+
bool InitOnce::_done = false;
119+
const bool g_Initialized = InitOnce::Exec();
120+
121+
}

‎src/BlackBone/Misc/InitOnce.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#pragma once
2+
namespace blackbone
3+
{
4+
extern const bool g_Initialized;
5+
}

‎src/BlackBone/Misc/NameResolve.cpp

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,6 @@ namespace blackbone
1313

1414
NameResolve::NameResolve()
1515
{
16-
HMODULE ntdll = GetModuleHandleW( L"ntdll.dll" );
17-
18-
LOAD_IMPORT( "NtQuerySystemInformation", ntdll );
19-
LOAD_IMPORT( "RtlDosApplyFileIsolationRedirection_Ustr", ntdll );
20-
LOAD_IMPORT( "RtlInitUnicodeString", ntdll );
21-
LOAD_IMPORT( "RtlFreeUnicodeString", ntdll );
2216
}
2317

2418
NameResolve::~NameResolve()

‎src/BlackBone/Misc/Utils.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ std::wstring Utils::GetExeDirectory()
122122
wchar_t imgName[MAX_PATH] = { 0 };
123123
DWORD len = ARRAYSIZE(imgName);
124124

125-
auto pFunc = reinterpret_cast<fnQueryFullProcessImageNameW>(LOAD_IMPORT( "QueryFullProcessImageNameW", L"kernel32.dll" ));
125+
auto pFunc = GET_IMPORT( QueryFullProcessImageNameW );
126126
if (pFunc != nullptr)
127127
pFunc( GetCurrentProcess(), 0, imgName, &len );
128128
else

‎src/BlackBone/Process/Process.cpp

Lines changed: 4 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,11 @@ Process::Process()
2020
, _mmap( *this )
2121
, _nativeLdr( *this )
2222
{
23-
GrantPriviledge( SE_DEBUG_NAME );
24-
GrantPriviledge( SE_LOAD_DRIVER_NAME );
23+
// Ensure InitOnce is called
24+
auto i = g_Initialized;
25+
UNREFERENCED_PARAMETER( i );
2526

26-
NameResolve::Instance().Initialize();
27+
NameResolve::Instance().Initialize();
2728
}
2829

2930
Process::~Process(void)
@@ -340,47 +341,6 @@ NTSTATUS Process::EnumHandles( std::vector<HandleInfo>& handles )
340341
return status;
341342
}
342343

343-
344-
/// <summary>
345-
/// Grant current process arbitrary privilege
346-
/// </summary>
347-
/// <param name="name">Privilege name</param>
348-
/// <returns>Status</returns>
349-
NTSTATUS Process::GrantPriviledge( const std::basic_string<TCHAR>& name )
350-
{
351-
TOKEN_PRIVILEGES Priv, PrivOld;
352-
DWORD cbPriv = sizeof(PrivOld);
353-
HANDLE hToken;
354-
355-
if (!OpenThreadToken( GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, FALSE, &hToken ))
356-
{
357-
if (GetLastError() != ERROR_NO_TOKEN)
358-
return LastNtStatus();
359-
360-
if (!OpenProcessToken( GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken ))
361-
return LastNtStatus();
362-
}
363-
364-
Priv.PrivilegeCount = 1;
365-
Priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
366-
LookupPrivilegeValue( NULL, name.c_str(), &Priv.Privileges[0].Luid );
367-
368-
if (!AdjustTokenPrivileges( hToken, FALSE, &Priv, sizeof(Priv), &PrivOld, &cbPriv ))
369-
{
370-
CloseHandle( hToken );
371-
return LastNtStatus();
372-
}
373-
374-
if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)
375-
{
376-
CloseHandle( hToken );
377-
return LastNtStatus();
378-
}
379-
380-
CloseHandle( hToken );
381-
return STATUS_SUCCESS;
382-
}
383-
384344
/// <summary>
385345
/// Search for process by executable name
386346
/// </summary>

‎src/BlackBone/Process/Process.h

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
#include "../ManualMap/MMap.h"
1212

1313
#include "../Include/NativeStructures.h"
14+
#include "../Misc/InitOnce.h"
1415

1516
#include <string>
1617
#include <list>
@@ -212,15 +213,9 @@ class Process
212213
BLACKBONE_API inline NtLdr& nativeLdr() { return _nativeLdr; } // Native loader routines
213214

214215
private:
215-
/// <summary>
216-
/// Grant current process arbitrary privilege
217-
/// </summary>
218-
/// <param name="name">Privilege name</param>
219-
/// <returns>Status</returns>
220-
NTSTATUS GrantPriviledge( const std::basic_string<TCHAR>& name );
221-
222216
Process(const Process&) = delete;
223217
Process& operator =(const Process&) = delete;
218+
224219
private:
225220
ProcessCore _core; // Core routines and native subsystem
226221
ProcessModules _modules; // Module management

‎src/BlackBone/Process/ProcessCore.cpp

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ namespace blackbone
1414
ProcessCore::ProcessCore()
1515
: _native( nullptr )
1616
{
17-
LOAD_IMPORT( "GetProcessDEPPolicy", L"kernel32.dll" );
1817
}
1918

2019
ProcessCore::~ProcessCore()

‎src/BlackBone/Process/RPC/RemoteExec.cpp

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,6 @@ RemoteExec::RemoteExec( Process& proc )
1919
, _hWaitEvent( NULL )
2020
, _apcPatched( false )
2121
{
22-
LOAD_IMPORT( "NtOpenEvent", L"ntdll.dll" );
23-
LOAD_IMPORT( "NtCreateEvent", L"ntdll.dll" );
24-
LOAD_IMPORT( "NtQueueApcThread", L"ntdll.dll" );
2522
}
2623

2724
RemoteExec::~RemoteExec()

‎src/BlackBone/Process/RPC/RemoteMemory.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,7 @@ class RemoteMemory
156156
PageContext* _pSharedData = nullptr; // Hook related data, shared between processes
157157
ptr_t _targetShare = 0; // Address of shared in data in target process
158158
bool _active = false; // Hook thread activity flag
159-
bool _hooked[4]; // Hook state
159+
bool _hooked[4] = { 0 }; // Hook state
160160
};
161161

162162
}

‎src/BlackBone/Subsystem/NativeSubsystem.cpp

Lines changed: 1 addition & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -41,27 +41,7 @@ Native::Native( HANDLE hProcess, bool x86OS /*= false*/ )
4141
_wowBarrier.type = wow_32_64;
4242
else
4343
_wowBarrier.type = wow_64_32;
44-
}
45-
46-
HMODULE hNtdll = GetModuleHandleW( L"ntdll.dll" );
47-
HMODULE hKernel32 = GetModuleHandleW( L"kernel32.dll" );
48-
49-
LOAD_IMPORT( "NtQueryInformationProcess", hNtdll );
50-
LOAD_IMPORT( "NtSetInformationProcess", hNtdll );
51-
LOAD_IMPORT( "NtQueryInformationThread", hNtdll );
52-
LOAD_IMPORT( "NtDuplicateObject", hNtdll );
53-
LOAD_IMPORT( "NtQueryObject", hNtdll );
54-
LOAD_IMPORT( "NtQuerySection", hNtdll );
55-
LOAD_IMPORT( "RtlCreateActivationContext", hNtdll );
56-
LOAD_IMPORT( "NtQueryVirtualMemory", hNtdll );
57-
LOAD_IMPORT( "NtCreateThreadEx", hNtdll );
58-
LOAD_IMPORT( "NtLockVirtualMemory", hNtdll );
59-
LOAD_IMPORT( "NtSuspendProcess", hNtdll );
60-
LOAD_IMPORT( "NtResumeProcess", hNtdll );
61-
LOAD_IMPORT( "RtlImageNtHeader", hNtdll );
62-
LOAD_IMPORT( "Wow64GetThreadContext", hKernel32 );
63-
LOAD_IMPORT( "Wow64SetThreadContext", hKernel32 );
64-
LOAD_IMPORT( "Wow64SuspendThread", hKernel32 );
44+
}
6545
}
6646

6747
/*

‎src/BlackBone/Subsystem/Wow64Subsystem.cpp

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,6 @@ namespace blackbone
88
NativeWow64::NativeWow64( HANDLE hProcess )
99
: Native( hProcess )
1010
{
11-
HMODULE ntdll32 = GetModuleHandleW( L"Ntdll.dll" );
12-
13-
LOAD_IMPORT( "NtWow64QueryInformationProcess64", ntdll32 );
14-
LOAD_IMPORT( "NtWow64AllocateVirtualMemory64", ntdll32 );
15-
LOAD_IMPORT( "NtWow64QueryVirtualMemory64", ntdll32 );
16-
LOAD_IMPORT( "NtWow64ReadVirtualMemory64", ntdll32 );
17-
LOAD_IMPORT( "NtWow64WriteVirtualMemory64", ntdll32 );
1811
}
1912

2013
NativeWow64::~NativeWow64()

0 commit comments

Comments
 (0)