krypteria / atlasldr Goto Github PK

Atlas is a reflective x64 loader that has the following features:

• Retrieve of DLL and PE from a remote server
• Manual Mapping on a remote process
• Erase of the DOS Header and NTHeader Magic bytes
• Position independent code
• Use of indirect Syscalls
  • ZwOpenProcess
  • ZwAllocateVirtualMemory
  • ZwProtectVirtualMemory
  • ZwQuerySystemInformation
  • ZwFreeVirtualMemory
  • ZwCreateThreadEx
• Single stub for all Syscalls
  • Dynamic SSN retrieve
  • Dynamic Syscall address resolution
• Atlas also uses
  • LdrLoadDll
  • NtWriteVirtualMemory
• Custom implementations of
  • GetProcAddress
  • GetModuleHandle
• API hashing
• Cleanup on error
• Optional cleanup on finish
• Variable EntryPoint

Atlas requires the following parameters to work properly:

Usage: atlas_x64.exe [Process name / PID] [Cleanup] [Server] [Port] [AtlasPatcher DLL] [DLL/PE to inject] <Entrypoint>

The conventional approach to a loader usually involves having an injector responsible for injecting a DLL containing the loader into the remote process we are targeting. Once injected, execution is passed to the loader, which is responsible for mapping the malicious DLL. In contrast, Atlas takes a slightly different approach by performing the entire mapping process within its own context, except for the Import Address Table (IAT) patching, which is deferred.

Once the malicious DLL has been mapped into the Atlas context, it is copied into memory previously reserved in the remote process. At this point, the malicious DLL is mapped into the remote process, but the IAT has not been patched. To fix this, AtlasLdr injects a DLL (atlas_patcher.dll) into the malicious process with minimal dependencies, which takes care of patching the IAT of the malicious DLL and then transfers the execution context to it.

This approach helps reduce the size and complexity of the loader DLL to be injected into the remote process and minimises the chances of the injector being detected, as we can load the DLL with the loader itself.

Atlas needs to be compiled using x86_64-w64-mingw32-g++, once you have it on your system, just execute make (or mingw32-make.exe) on the project folder