mirror of
https://github.com/Dec0ne/HWSyscalls
synced 2026-06-08 10:52:05 +00:00
Dec0ne
105 lines
2.6 KiB
C
105 lines
2.6 KiB
C
#pragma once
|
|
#include <windows.h>
|
|
#include <inttypes.h>
|
|
#include <stdio.h>
|
|
|
|
#pragma region Defines
|
|
|
|
#define HWSYSCALLS_DEBUG 1 // 0 disable, 1 enable
|
|
#define UP -32
|
|
#define DOWN 32
|
|
#define STACK_ARGS_LENGTH 8
|
|
#define STACK_ARGS_RSP_OFFSET 0x28
|
|
#define X64_PEB_OFFSET 0x60
|
|
|
|
#pragma endregion
|
|
|
|
#pragma region Macros
|
|
|
|
#if HWSYSCALLS_DEBUG == 0
|
|
#define DEBUG_PRINT( STR, ... )
|
|
#else
|
|
#define DEBUG_PRINT( STR, ... ) printf(STR, __VA_ARGS__ );
|
|
#endif
|
|
|
|
#pragma endregion
|
|
|
|
#pragma region Type Defintions
|
|
|
|
typedef struct _UNICODE_STRING {
|
|
USHORT Length;
|
|
USHORT MaximumLength;
|
|
PWSTR Buffer;
|
|
} UNICODE_STRING, * PUNICODE_STRING;
|
|
|
|
typedef struct _RTL_USER_PROCESS_PARAMETERS {
|
|
BYTE Reserved1[16];
|
|
PVOID Reserved2[10];
|
|
UNICODE_STRING ImagePathName;
|
|
UNICODE_STRING CommandLine;
|
|
} RTL_USER_PROCESS_PARAMETERS, * PRTL_USER_PROCESS_PARAMETERS;
|
|
|
|
typedef struct _PEB_LDR_DATA {
|
|
BYTE Reserved1[8];
|
|
PVOID Reserved2[3];
|
|
LIST_ENTRY InMemoryOrderModuleList;
|
|
} PEB_LDR_DATA, * PPEB_LDR_DATA;
|
|
|
|
typedef struct _LDR_DATA_TABLE_ENTRY {
|
|
PVOID Reserved1[2];
|
|
LIST_ENTRY InMemoryOrderLinks;
|
|
PVOID Reserved2[2];
|
|
PVOID DllBase;
|
|
PVOID EntryPoint;
|
|
PVOID Reserved3;
|
|
UNICODE_STRING FullDllName;
|
|
BYTE Reserved4[8];
|
|
PVOID Reserved5[3];
|
|
union {
|
|
ULONG CheckSum;
|
|
PVOID Reserved6;
|
|
};
|
|
ULONG TimeDateStamp;
|
|
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;
|
|
|
|
typedef struct _PEB {
|
|
BYTE Reserved1[2];
|
|
BYTE BeingDebugged;
|
|
BYTE Reserved2[21];
|
|
PPEB_LDR_DATA LoaderData;
|
|
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
|
|
BYTE Reserved3[520];
|
|
PVOID PostProcessInitRoutine;
|
|
BYTE Reserved4[136];
|
|
ULONG SessionId;
|
|
} PEB, * PPEB;
|
|
|
|
typedef BOOL(WINAPI* GetThreadContext_t)(
|
|
_In_ HANDLE hThread,
|
|
_Inout_ LPCONTEXT lpContext
|
|
);
|
|
|
|
typedef BOOL(WINAPI* SetThreadContext_t)(
|
|
_In_ HANDLE hThread,
|
|
_In_ CONST CONTEXT* lpContext
|
|
);
|
|
|
|
#pragma endregion
|
|
|
|
#pragma region Function Declerations
|
|
|
|
BOOL MaskCompare(const BYTE* pData, const BYTE* bMask, const char* szMask);
|
|
DWORD_PTR FindPattern(DWORD_PTR dwAddress, DWORD dwLen, PBYTE bMask, PCHAR szMask);
|
|
DWORD_PTR FindInModule(LPCSTR moduleName, PBYTE bMask, PCHAR szMask);
|
|
UINT64 GetModuleAddress(LPWSTR sModuleName);
|
|
UINT64 GetSymbolAddress(UINT64 moduleBase, const char* functionName);
|
|
UINT64 PrepareSyscall(char* functionName);
|
|
bool SetMainBreakpoint();
|
|
DWORD64 FindSyscallNumber(DWORD64 functionAddress);
|
|
DWORD64 FindSyscallReturnAddress(DWORD64 functionAddress, WORD syscallNumber);
|
|
LONG HWSyscallExceptionHandler(EXCEPTION_POINTERS* ExceptionInfo);
|
|
bool InitHWSyscalls();
|
|
bool DeinitHWSyscalls();
|
|
|
|
#pragma endregion
|