admin/Kudaes-DInvoke_rs
1
0
Fork 0
mirror of https://github.com/Kudaes/DInvoke_rs synced 2026-06-08 11:32:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Indirect syscalls - fix

Browse Source
This commit is contained in:
Kudaes
2023-07-04 14:51:55 +02:00
parent 8d5d036498
commit 8edadffbfa
2 changed files with 13 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dinvoke_rs/data/src/lib.rs
+1
View File
@@ -9,6 +9,7 @@ pub type EntryPoint = extern "system" fn (HINSTANCE, u32, *mut c_void) -> BOOL;
pub type RtlAddFunctionTable = unsafe extern "system" fn (usize, i32, isize) -> bool;
pub type LoadLibraryA = unsafe extern "system" fn (PSTR) -> HINSTANCE;
pub type OpenProcess = unsafe extern "system" fn (u32, i32, u32) -> HANDLE;
pub type QueueUserWorkItem = unsafe extern "system" fn (*mut c_void, *mut c_void, u32) -> bool;
pub type QueryFullProcessImageNameW = unsafe extern "system" fn (HANDLE, u32, *mut u16, *mut u32) -> i32;
pub type MiniDumpWriteDump = unsafe extern "system" fn (HANDLE, u32, HANDLE, u32, *mut MINIDUMP_EXCEPTION_INFORMATION,
*mut MINIDUMP_USER_STREAM_INFORMATION, *mut MINIDUMP_CALLBACK_INFORMATION) -> i32;
dinvoke_rs/dinvoke/src/lib.rs
+12 -8
View File
@@ -10,7 +10,7 @@ use bindings::Windows::Win32::System::Diagnostics::Debug::{GetThreadContext,SetT
use bindings::Windows::Win32::System::Kernel::UNICODE_STRING;
use bindings::Windows::Win32::System::Threading::PROCESS_BASIC_INFORMATION;
use bindings::Windows::Win32::System::WindowsProgramming::{OBJECT_ATTRIBUTES, IO_STATUS_BLOCK};
use bindings::Windows::Win32::{Foundation::{HANDLE, HINSTANCE, PSTR}, {System::Threading::{GetCurrentProcess,GetCurrentThread}}};
use bindings::Windows::Win32::{Foundation::{HANDLE, HINSTANCE}, {System::Threading::{GetCurrentProcess,GetCurrentThread}}};
use data::{ApiSetNamespace, ApiSetNamespaceEntry, ApiSetValueEntry, DLL_PROCESS_ATTACH, EAT, EntryPoint, MEM_COMMIT, MEM_RESERVE, PAGE_EXECUTE_READ, PAGE_READWRITE,
PVOID, PeMetadata, CONTEXT, NtAllocateVirtualMemoryArgs, EXCEPTION_POINTERS, NtOpenProcessArgs, CLIENT_ID, PROCESS_QUERY_LIMITED_INFORMATION, NtProtectVirtualMemoryArgs,
PAGE_READONLY, NtWriteVirtualMemoryArgs, ExceptionHandleFunction, PS_ATTRIBUTE_LIST, NtCreateThreadExArgs, LptopLevelExceptionFilter};
@@ -679,10 +679,13 @@ pub fn prepare_syscall(id: u32, eat: EAT) -> isize {
}
let handle = GetCurrentProcess();
let base_address: *mut PVOID = std::mem::transmute(&usize::default());
let b = usize::default();
let base_address: *mut PVOID = std::mem::transmute(&b);
let nsize: usize = sh.len() as usize;
let size: *mut usize = std::mem::transmute(&(nsize+1));
let old_protection: *mut u32 = std::mem::transmute(&u32::default());
let s = nsize + 1;
let size: *mut usize = std::mem::transmute(&s);
let o = u32::default();
let old_protection: *mut u32 = std::mem::transmute(&o);
let ret = nt_allocate_virtual_memory(handle, base_address, 0, size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
if ret != 0
@@ -691,7 +694,8 @@ pub fn prepare_syscall(id: u32, eat: EAT) -> isize {
}
let buffer: *mut c_void = std::mem::transmute(sh.as_ptr());
let bytes_written: *mut usize = std::mem::transmute(&usize::default());
let b = usize::default();
let bytes_written: *mut usize = std::mem::transmute(&b);
let ret = nt_write_virtual_memory(handle, *base_address, buffer, nsize, bytes_written);
if ret != 0
@@ -997,8 +1001,8 @@ pub fn virtual_free(address: PVOID, size: usize, free_type: u32) -> bool {
{
let ret: Option<bool>;
let func_ptr: data::VirtualFree;
let ntdll = get_module_base_address(&lc!("kernel32.dll"));
dynamic_invoke!(ntdll,&lc!("VirtualFree"),func_ptr,ret,address,size,free_type);
let k32 = get_module_base_address(&lc!("kernel32.dll"));
dynamic_invoke!(k32,&lc!("VirtualFree"),func_ptr,ret,address,size,free_type);
match ret {
Some(x) =>
@@ -1452,7 +1456,7 @@ macro_rules! execute_syscall {
{
$c = None;
}
let ptr: PVOID = std::mem::transmute(function_ptr);
let ptr = std::mem::transmute(function_ptr);
$crate::virtual_free(ptr, 0, 0x00008000);
}
else