The process handle `pHandle` is never closed resulting in a leaked handle.

[JohnLaTwC]

The process handle pHandle is never closed resulting in a leaked handle.

    NTSTATUS status = pNtOpenProcess(&pHandle, PROCESS_ALL_ACCESS, &ObjectAttributes, &ClientId);
...

    // Locate memory hole for shellcode to reside in.
    UINT_PTR loaderAddress = findMemoryHole(pHandle, exportAddress, sizeof(shellcodeLoader) + shellcodeSize);
    if (loaderAddress == 0)
    {
        BeaconPrintf(CALLBACK_ERROR, "Unable to locate memory hole within 2G of export address");
+       CloseHandle(pHandle);   <<< add a call to closehandle here
        return;
    }

pHandle should also be closed in a cleanup routine or at any of these function return points.

ThreadlessInject-BOF/entry.c

Line 194 in 9cdc0db

BeaconPrintf(CALLBACK_ERROR, "Unable to locate memory hole within 2G of export address");

ThreadlessInject-BOF/entry.c

Line 213 in 9cdc0db

BeaconPrintf(CALLBACK_ERROR, "Unable to change page protections @ 0x%llx, status: 0x%llx", targetRegion, status);

ThreadlessInject-BOF/entry.c

Line 228 in 9cdc0db

BeaconPrintf(CALLBACK_ERROR, "Unable to write call opcode @ 0x%llx, status: 0x%llx", exportAddress, status);

ThreadlessInject-BOF/entry.c

Line 238 in 9cdc0db

BeaconPrintf(CALLBACK_ERROR, "Unable to change page protections @ 0x%llx, status: 0x%llx", loaderAddress, status);

ThreadlessInject-BOF/entry.c

Line 246 in 9cdc0db

BeaconPrintf(CALLBACK_ERROR, "Unable to write loader stub @ 0x%llx, status: 0x%llx", loaderAddress, status);

ThreadlessInject-BOF/entry.c

Line 253 in 9cdc0db

BeaconPrintf(CALLBACK_ERROR, "Unable to write payload @ 0x%llx, status: 0x%llx", loaderAddress + shellcodeSize, status);

ThreadlessInject-BOF/entry.c

Line 261 in 9cdc0db

BeaconPrintf(CALLBACK_ERROR, "Unable to change page protections @ 0x%llx, status: 0x%llx", loaderAddress, status);

ThreadlessInject-BOF/entry.c

Line 265 in 9cdc0db

BeaconOutput(CALLBACK_OUTPUT, "Injection complete. Payload will execute when the targeted process calls the export", 84);

[iilegacyyii]

Hi John, I've added a fix in the locations you mentioned. Thanks for raising this :)