Merge pull request #9 from es3n1n/ife-fix

fix(inject): fix compability with process-hacker replaced taskmgr

cxx-shared/cxx-shared.vcxitems

@@ -18,6 +18,7 @@
     <ClInclude Include="$(MSBuildThisFileDirectory)shared\defer.hpp" />
     <ClInclude Include="$(MSBuildThisFileDirectory)shared\ipc.hpp" />
     <ClInclude Include="$(MSBuildThisFileDirectory)shared\names.hpp" />
+    <ClInclude Include="$(MSBuildThisFileDirectory)shared\native.hpp" />
     <ClInclude Include="$(MSBuildThisFileDirectory)shared\util.hpp" />
   </ItemGroup>
 </Project>

cxx-shared/shared/native.hpp

@@ -0,0 +1,51 @@
+#pragma once
+#include <format>
+#include <stdexcept>
+#include <Windows.h>
+
+#pragma pack(push, 1)
+namespace native {
+    class PEB {
+    public:
+        std::uint8_t inherited_address_space;
+        std::uint8_t read_image_file_exec_options;
+        /// - we don't need other fields
+    };
+
+    static_assert(offsetof(PEB, read_image_file_exec_options) == 1);
+
+    template <typename Ty>
+    inline Ty get_system_routine(const std::string_view module_name, const std::string_view function_name) {
+        const auto mod = GetModuleHandleA(module_name.data());
+        if (mod == nullptr) {
+            throw std::runtime_error(std::format("unable to find module {}", module_name));
+        }
+
+        auto function = reinterpret_cast<Ty>(GetProcAddress(mod, function_name.data()));
+        if (function == nullptr) {
+            throw std::runtime_error(std::format("unable to obtain {} from {}", module_name, function_name));
+        }
+        return function;
+    }
+
+    inline PEB* get_peb() {
+        static auto function = get_system_routine<PEB*(__stdcall*)()>("ntdll.dll", "RtlGetCurrentPeb");
+        static auto result = function();
+        if (result == nullptr) [[unlikely]] {
+            throw std::runtime_error("no peb");
+        }
+
+        return result;
+    }
+
+    inline bool debug_set_process_kill_on_exit(const bool value) {
+        static auto function = get_system_routine<BOOL(__stdcall*)(BOOL)>("kernel32.dll", "DebugSetProcessKillOnExit");
+        return static_cast<bool>(function(static_cast<BOOL>(value)));
+    }
+
+    inline bool debug_active_process_stop(const std::uint32_t process_id) {
+        static auto function = get_system_routine<BOOL(__stdcall*)(DWORD)>("kernel32.dll", "DebugActiveProcessStop");
+        return static_cast<bool>(function(process_id));
+    }
+} // namespace native
+#pragma pack(pop)

defendnot-loader/core/inject.cpp

@@ -1,6 +1,8 @@
 #include "core/core.hpp"
 
 #include "shared/defer.hpp"
+#include "shared/native.hpp"
+
 #include <print>
 #include <stdexcept>
 
@@ -19,11 +21,20 @@ namespace loader {
             .bInheritHandle = TRUE,
         };
 
+        /// By setting ReadImageFileExecOptions to FALSE and attaching ourselves as a debugger we can skip the IFEO
+        /// \xref: https://github.com/es3n1n/defendnot/issues/7#issuecomment-2874903650
+        native::get_peb()->read_image_file_exec_options = 0;
+
         std::println("** booting {}", proc_name);
-        if (!CreateProcessA(nullptr, const_cast<char*>(proc_name.data()), &sa, &sa, FALSE, CREATE_SUSPENDED, nullptr, nullptr, &si, &pi)) {
+        const auto process_flags = CREATE_SUSPENDED | DEBUG_PROCESS | DEBUG_ONLY_THIS_PROCESS;
+        if (!CreateProcessA(nullptr, const_cast<char*>(proc_name.data()), &sa, &sa, FALSE, process_flags, nullptr, nullptr, &si, &pi)) {
             throw std::runtime_error(std::format("unable to create process: {}", GetLastError()));
         }
 
+        /// Detach
+        native::debug_set_process_kill_on_exit(false);
+        native::debug_active_process_stop(pi.dwProcessId);
+
         defer->void {
             CloseHandle(pi.hThread);
             /// Not closing hProcess because we return it