{"action":"created","issue":{"url":"https://api.github.com/repos/DarthTon/Blackbone/issues/262","repository_url":"https://api.github.com/repos/DarthTon/Blackbone","labels_url":"https://api.github.com/repos/DarthTon/Blackbone/issues/262/labels{/name}","comments_url":"https://api.github.com/repos/DarthTon/Blackbone/issues/262/comments","events_url":"https://api.github.com/repos/DarthTon/Blackbone/issues/262/events","html_url":"https://github.com/DarthTon/Blackbone/issues/262","id":326848805,"number":262,"title":"Kernel MMap not working while APC working.","user":{"login":"tarekwiz","id":5272589,"avatar_url":"https://avatars3.githubusercontent.com/u/5272589?v=4","gravatar_id":"","url":"https://api.github.com/users/tarekwiz","html_url":"https://github.com/tarekwiz","followers_url":"https://api.github.com/users/tarekwiz/followers","following_url":"https://api.github.com/users/tarekwiz/following{/other_user}","gists_url":"https://api.github.com/users/tarekwiz/gists{/gist_id}","starred_url":"https://api.github.com/users/tarekwiz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tarekwiz/subscriptions","organizations_url":"https://api.github.com/users/tarekwiz/orgs","repos_url":"https://api.github.com/users/tarekwiz/repos","events_url":"https://api.github.com/users/tarekwiz/events{/privacy}","received_events_url":"https://api.github.com/users/tarekwiz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-05-27T20:42:15Z","updated_at":"2018-05-27T21:13:41Z","closed_at":null,"author_association":"NONE","body":"I found out that this part in Inject.c (Driver) Works\r\n```cpp\r\n // Call init routine\r\n            if (NT_SUCCESS( status ))\r\n            {\r\n                if (pUserBuf->module != 0)\r\n                {\r\n                    if(initRVA != 0)\r\n                    {\r\n                        RtlCopyMemory( (PUCHAR)pUserBuf->buffer, InitArg, sizeof( pUserBuf->buffer ) );\r\n                        BBQueueUserApc( pThread, (PUCHAR)pUserBuf->module + initRVA, pUserBuf->buffer, NULL, NULL, TRUE );\r\n\r\n                        // Wait some time for routine to finish\r\n                        interval.QuadPart = -(100LL * 10 * 1000);\r\n                        KeDelayExecutionThread( KernelMode, FALSE, &interval );\r\n                    }\r\n                }\r\n                else\r\n                    DPRINT( \"BlackBone: %s: APC injection failed with unknown status\\n\", __FUNCTION__ );\r\n```\r\nwhile here in MMap.c doesnt work because the Anti-Cheat is blocking it.\r\n```cpp\r\n status = BBCallRoutine( FALSE, pContext, entrypoint, 3, pEntry->baseAddress, (PVOID)1, NULL );\r\n```\r\nwhich calls \r\n```cpp\r\nKeResetEvent( pContext->pSync );\r\n        status = BBQueueUserApc( pContext->pWorker, pContext->userMem->code, NULL, NULL, NULL, FALSE );\r\n        if (NT_SUCCESS( status ))\r\n        {\r\n            LARGE_INTEGER timeout = { 0 };\r\n            timeout.QuadPart = -(10ll * 10 * 1000 * 1000);  // 10s\r\n\r\n            status = KeWaitForSingleObject( pContext->pSync, Executive, UserMode, TRUE, &timeout );\r\n\r\n            timeout.QuadPart = -(1ll * 10 * 1000);          // 1ms\r\n            KeDelayExecutionThread( KernelMode, TRUE, &timeout );\r\n        }\r\n```\r\nIs there anyway to call the manually mapped dll entry point using the same way InjectAPC calls LdrLoadDll? I also tried using the bForce in BBQueueUserApc but it crashes the target process instead\r\n"},"comment":{"url":"https://api.github.com/repos/DarthTon/Blackbone/issues/comments/392371341","html_url":"https://github.com/DarthTon/Blackbone/issues/262#issuecomment-392371341","issue_url":"https://api.github.com/repos/DarthTon/Blackbone/issues/262","id":392371341,"user":{"login":"tarekwiz","id":5272589,"avatar_url":"https://avatars3.githubusercontent.com/u/5272589?v=4","gravatar_id":"","url":"https://api.github.com/users/tarekwiz","html_url":"https://github.com/tarekwiz","followers_url":"https://api.github.com/users/tarekwiz/followers","following_url":"https://api.github.com/users/tarekwiz/following{/other_user}","gists_url":"https://api.github.com/users/tarekwiz/gists{/gist_id}","starred_url":"https://api.github.com/users/tarekwiz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tarekwiz/subscriptions","organizations_url":"https://api.github.com/users/tarekwiz/orgs","repos_url":"https://api.github.com/users/tarekwiz/repos","events_url":"https://api.github.com/users/tarekwiz/events{/privacy}","received_events_url":"https://api.github.com/users/tarekwiz/received_events","type":"User","site_admin":false},"created_at":"2018-05-27T21:13:41Z","updated_at":"2018-05-27T21:13:41Z","author_association":"NONE","body":"No this is not EAC, it's another AC which is only usermode. if the problem is that the entrypoint is allocated by me then maybe i can do a jmp in memory of the main module but i doubt this is the reason because as i said the InjectAPC function works perfectly."}}
{"actor":{"display_login":"tarekwiz"}}