Hostile ^92% javascript Download

cortico-world-pvz 0.1.2

Process injection and code patching

“Cortico World: the original PopCap Plants vs. Zombies as a semantic, event-driven World — x86 implant, named-pipe bridge, task queue with r…”

Source allocates and writes remote memory before starting a remote threadSource code for remote LoadLibrary injection

SHA-256ada0f9884ea8a262ba5b7ef9240ae0478b0781898603def4afd5ffe34c7c1ca9

URLhttps://registry.npmjs.org/cortico-world-pvz/-/cortico-world-pvz-0.1.2.tgz

MaleculeO₆(Er₅As₂C₄ISXe₂)H₁₁(Cm₁₀Cr₃Db₂₅DsF₁₄Hf₄Mg₆Os₉Po₂₉Ti₃U₄)Md₄(In₈Pa₁₁)

Evidence

WriteProcessMemory API reference in source lines 443–452

47… t address, const void* source,
                    size_t bytes, const wchar_t* operation) {
  SIZE_T written = 0;
  if (!WriteProcessMemory(process, reinterpret_cast<void*>(address), source, bytes, &written) ||
      written != bytes) {
      Fail(std::wstring(L"cannot write remote ") + operation, GetLastError());
⋯4 lines

CreateRemoteThread API reference lines 681–687

17… HANDLE process, LPTHREAD_START_ROUTINE routine, void* argument,
              const wchar_t* operation) {
  HANDLE thread = CreateRemoteThread(process, nullptr, 0, routine, argument, 0, nullptr);
  if (!thread) Fail(std::wstring(L"cannot start remote ") + operation, GetLastError());
  const DWORD wait = WaitForSingleObject(thread, 15000);
  if (wait != WAIT_OBJECT_0) {
      const DWORD error = wait == WAIT_FAILE …

Remote-process VirtualAllocEx allocation lines 738–745

738:2…    }
739}
740
741void* CopyRemote(HANDLE process, const void* source, size_t bytes) {
742    void* remote = VirtualAllocEx(process, nullptr, bytes, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
743    if (!remote) Fail(L"cannot allocate target memory", GetLastError());
744    SIZE_T written = 0;
745    if (!WriteProcessMemor …

References LoadLibraryW in source lines 881–889

881:71… ;
882    HMODULE kernel = GetModuleHandleW(L"kernel32.dll");
883    const FARPROC localLoadLibrary = kernel ? GetProcAddress(kernel, "LoadLibraryW") : nullptr;
884    if (!localLoadLibrary) Fail(L"cannot resolve LoadLibraryW");
885
⋯4 lines

Open process handle lines 1286–1292

63… UERY_INFORMATION |
                           PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ;
  HANDLE process = OpenProcess(access, FALSE, options.pid);
  if (!process) Fail(L"cannot open target process", GetLastError());
  if (Utf8(options.creationTime) != ProcessCreationTime(process)) {
      Fail(L"target process creation identity does not match --creation-time");
  …

Showing the top 5 files — 7 more files (80 regions) not shown.

No evidence locations were recorded for this file. Raw result