469,307 Members | 2,288 Online
Bytes | Developer Community
New Post

Home Posts Topics Members FAQ

Post your question to a community of 469,307 developers. It's quick & easy.

calling shfileoperation with code injection

i want to call shfileoperation from shel32.dll to copy a file with delphi
but my code dosen't work and the reason is the format of paths,I didn't find any solution for the problem.any one can help me? here is my code and the image of RemoteInfo value while debugging
here is link of the image
http://www.freeimagehosting.net/uploads/219d79fc30.jpg

Expand|Select|Wrap|Line Numbers
  1.  
  2. program InjectCode;
  3. uses
  4.   Windows,
  5.   shellapi, injectmemory,dialogs, strutils, sysutils, classes;
  6. type
  7.   LPSHFILEOPSTRUCT = ^SHFILEOPSTRUCT;
  8.   SHFILEOPSTRUCT = packed record
  9.     Wnd: HWND;
  10.     wFunc: UINT;
  11.     pFrom: PAnsiChar;
  12.     pTo: PAnsiChar;
  13.     fFlags: FILEOP_FLAGS;
  14.     fAnyOperationsAborted: BOOL;
  15.     hNameMappings: Pointer;
  16.     lpszProgressTitle: PAnsiChar;
  17.   end;
  18.  
  19. type
  20.   TRemoteInfo = record
  21.     LoadLibrary: function(lpLibFileName: PChar): HMODULE; stdcall;
  22.     GetProcAddress: function(hModule: HMODULE;
  23.       lpProcName: LPCSTR): FARPROC; stdcall;
  24.     shf: SHFILEOPSTRUCT;
  25.     Kernel32: array[0..20] of Char;
  26.     shell32: array[0..20] of Char;
  27.     SHFileOperationA: array[0..20] of Char;
  28.     Fromlpbuff: array[0..20] of char; //Source path
  29.     Tolpbuff: array[0..20] of Char;   //Des Path
  30.  
  31.   end;
  32.  
  33. procedure RemoteThread(RemoteInfo: pointer); stdcall;
  34. var
  35.   SHFileOperation: function(lpFileOp: LPSHFILEOPSTRUCT): Integer; stdcall;
  36. begin
  37.   with TRemoteInfo(Remoteinfo^) do
  38.   begin
  39.     @SHFileOperation := GetProcAddress(LoadLibrary(shell32), SHFileOperationA);
  40.     SHFileOperation(@shf);
  41.   end;
  42.  
  43. end;
  44. procedure RemoteThreadEnd;
  45. begin
  46. end;
  47. var
  48.   RemoteInfo: TRemoteInfo;
  49.   s2: string;
  50.   s1: string;
  51.   i: integer;
  52.   pInfo, CodeAdr: pointer;
  53.   TID: dword;
  54.   Process: dword;
  55.   StartInfo: TStartupInfo;
  56.   ProcInfo: TProcessInformation;
  57.  
  58. begin
  59.   ZeroMemory(@StartInfo, SizeOf(TStartupInfo));
  60.   StartInfo.cb := SizeOf(TStartupInfo);
  61.   CreateProcess(nil, 'calc.exe', nil, nil, False, 0,
  62.     nil, nil, StartInfo, ProcInfo);
  63.   Process := ProcInfo.hProcess;
  64.   ZeroMemory(@RemoteInfo.fromlpbuff, sizeof(RemoteInfo.fromlpbuff));
  65.   ZeroMemory(@RemoteInfo.Tolpbuff, sizeof(RemoteInfo.Tolpbuff));
  66.   ZeroMemory(@RemoteInfo, SizeOf(RemoteInfo));
  67.   lstrcpy(RemoteInfo.shell32, 'shell32.dll');
  68.   lstrcpy(RemoteInfo.Kernel32, 'kernel32.dll');
  69.   lstrcpy(RemoteInfo.SHFileOperationA, 'SHFileOperationA');
  70.   RemoteInfo.shf.Wnd := 0;
  71.   RemoteInfo.shf.wFunc := FO_COPY;
  72.   RemoteInfo.shf.pFrom := @remoteInfo.Fromlpbuff;
  73.   RemoteInfo.shf.pto := @remoteInfo.tolpbuff;
  74.   lstrcpy(RemoteInfo.shf.pFrom, 'e:\1.jpg' + #0#0);
  75.   lstrcpy(RemoteInfo.shf.pto, 'f:\1.jpg' + #0#0);
  76.   RemoteInfo.shf.fFlags := FOF_ALLOWUNDO;
  77.   RemoteInfo.shf.fAnyOperationsAborted := false;
  78.   @RemoteInfo.LoadLibrary := GetProcAddress(GetModuleHandle('kernel32.dll'),
  79.     'LoadLibraryA');
  80.   @RemoteInfo.GetProcAddress := GetProcAddress(GetModuleHandle('kernel32.dll'),
  81.     'GetProcAddress');
  82.   pInfo := InjectMemory(Process, @RemoteInfo, SizeOf(TRemoteInfo));
  83.   CodeAdr := InjectMemory(Process, @RemoteThread,
  84.     dword(@RemoteThreadEnd) - dword(@RemoteThread));
  85.   Sleep(2000);
  86.   CreateRemoteThread(Process, nil, 0, CodeAdr, pInfo, 0, TID);
  87. end.
  88.  
Attached Images
File Type: jpg image.jpg (6.1 KB, 87 views)
Jul 13 '10 #1
0 938

Post your reply

Sign in to post your reply or Sign up for a free account.

Similar topics

1 post views Thread by Raja | last post: by
4 posts views Thread by James L. Brown | last post: by
2 posts views Thread by Peter Schmitz | last post: by
1 post views Thread by Jesse McGrew | last post: by
1 post views Thread by Bill Soudan | last post: by
6 posts views Thread by Sati | last post: by
1 post views Thread by sati | last post: by
1 post views Thread by CARIGAR | last post: by
reply views Thread by zhoujie | last post: by
reply views Thread by suresh191 | last post: by
reply views Thread by harlem98 | last post: by
reply views Thread by harlem98 | last post: by
By using this site, you agree to our Privacy Policy and Terms of Use.