admin/Kudaes-DInvoke_rs
1
0
Fork 0
mirror of https://github.com/Kudaes/DInvoke_rs synced 2026-06-08 11:32:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

New primitives

Browse Source
This commit is contained in:
Kudaes
2024-07-22 22:50:29 +02:00
parent a73a8af22d
commit ba286cf511
2 changed files with 116 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data/src/lib.rs
+6
View File
@@ -8,6 +8,9 @@ pub type PVOID = *mut c_void;
pub type DWORD = u32;
pub type EAT = BTreeMap<usize,String>;
pub type EntryPoint = extern "system" fn (HINSTANCE, u32, *mut c_void) -> BOOL;
pub type QueryInterface = unsafe extern "system" fn (*mut c_void, *const GUID, *mut *mut c_void) -> u32;
pub type AddRef = unsafe extern "system" fn(*mut c_void) -> u32;
pub type Release = unsafe extern "system" fn(*mut c_void) -> u32;
pub type ImpersonateLoggedOnUser = unsafe extern "system" fn (HANDLE) -> bool;
pub type RevertToSelf = unsafe extern "system" fn () -> bool;
pub type LoadLibraryA = unsafe extern "system" fn (*mut u8) -> usize;
@@ -68,6 +71,7 @@ pub type BCryptCloseAlgorithmProvider = unsafe extern "system" fn (HANDLE, u32)
pub type CryptSignHashW = unsafe extern "system" fn (usize, u32, *mut u16, u32, *mut u8, *mut u32) -> bool;
pub type CreateEventW = unsafe extern "system" fn (*const SECURITY_ATTRIBUTES, i32, i32, *const u16) -> HANDLE;
pub type LdrGetProcedureAddress = unsafe extern "system" fn (PVOID, *mut String, u32, *mut PVOID) -> i32;
pub type NtCreateTransaction = unsafe extern "system" fn (*mut HANDLE, u32, *mut OBJECT_ATTRIBUTES, *mut GUID, HANDLE, u32, u32, u32, *mut LARGE_INTEGER, *mut UNICODE_STRING) -> i32;
pub type NtWriteVirtualMemory = unsafe extern "system" fn (HANDLE, PVOID, PVOID, usize, *mut usize) -> i32;
pub type NtProtectVirtualMemory = unsafe extern "system" fn (HANDLE, *mut PVOID, *mut usize, u32, *mut u32) -> i32;
pub type NtAllocateVirtualMemory = unsafe extern "system" fn (HANDLE, *mut PVOID, usize, *mut usize, u32, u32) -> i32;
@@ -88,6 +92,7 @@ pub type NtRemoveProcessDebug = unsafe extern "system" fn (HANDLE, HANDLE) -> i3
pub type NtWaitForDebugEvent = unsafe extern "system" fn (HANDLE, u8, *mut LARGE_INTEGER, PVOID) -> i32;
pub type NtTerminateProcess = unsafe extern "system" fn (HANDLE, i32) -> i32;
pub type NtOpenKey = unsafe extern "system" fn (*mut HANDLE, u32, *mut OBJECT_ATTRIBUTES) -> i32;
pub type NtSaveKey = unsafe extern "system" fn (HANDLE, HANDLE) -> i32;
pub type NtOpenProcessToken = unsafe extern "system" fn (HANDLE, u32, *mut HANDLE) -> i32;
pub type NtDuplicateToken = unsafe extern "system" fn (HANDLE, u32, *mut OBJECT_ATTRIBUTES, bool, u32, *mut HANDLE) -> i32;
pub type NtCreateKey = unsafe extern "system" fn (*mut HANDLE, u32, *mut OBJECT_ATTRIBUTES, u32, *mut UNICODE_STRING, u32, *mut u32) -> i32;
@@ -97,6 +102,7 @@ pub type RtlInitUnicodeString = unsafe extern "system" fn (*mut UNICODE_STRING,
pub type RtlZeroMemory = unsafe extern "system" fn (PVOID, usize) -> ();
pub type RtlQueueWorkItem = unsafe extern "system" fn (usize, PVOID, u32) -> i32;
pub type RtlAddFunctionTable = unsafe extern "system" fn (usize, i32, usize) -> bool;
pub type NtCommitTransaction = unsafe extern "system" fn (HANDLE, bool) -> i32;
pub const JMP_RBX: u16 = 9215;
pub const ADD_RSP: u32 = 1489273672;// add rsp,0x58 -> up to 11 parameters
dinvoke/src/lib.rs
+110
View File
@@ -9,6 +9,7 @@ use std::{collections::HashMap, ptr};
use std::ffi::CString;
#[cfg(target_arch = "x86_64")]
use nanorand::{WyRand, Rng};
use windows::Win32::Security::SECURITY_ATTRIBUTES;
#[cfg(target_arch = "x86_64")]
use windows::Win32::System::Diagnostics::Debug::{GetThreadContext,SetThreadContext};
use windows::Win32::System::Memory::MEMORY_BASIC_INFORMATION;
@@ -1287,6 +1288,115 @@ pub fn free_library(module_handle: isize) -> usize {
}
}
}
/// Dynamically calls CreateFileA.
/// On success, it returns a valid handle to the specified file. Otherwise, a null handle is returned.
pub fn create_file_a(name: *mut u8, access: u32, mode: u32, attributes: *const SECURITY_ATTRIBUTES, disposition: u32, flags: u32, template: HANDLE) -> HANDLE {
unsafe
{
let ret: Option<HANDLE>;
let func_ptr: data::CreateFileA;
let kernel32 = get_module_base_address(&lc!("kernel32.dll"));
dynamic_invoke!(kernel32,&lc!("CreateFileA"),func_ptr,ret,name,access,mode,attributes,disposition,flags,template);
match ret {
Some(x) => return x,
None => return HANDLE { 0: 0 } ,
}
}
}
/// Dynamically calls GetFileSize.
/// It returns either the specified file size (success) or 0 (an error ocurred).
pub fn get_file_size(handle: HANDLE, size: *mut u32) -> u32 {
unsafe
{
let ret: Option<u32>;
let func_ptr: data::GetFileSize;
let kernel32 = get_module_base_address(&lc!("kernel32.dll"));
dynamic_invoke!(kernel32,&lc!("GetFileSize"),func_ptr,ret,handle,size);
match ret {
Some(x) => return x,
None => return 0,
}
}
}
/// Dynamically calls CreateFileMappingW.
///
pub fn create_file_mapping_w(file: HANDLE, attributes: *const SECURITY_ATTRIBUTES, protect: u32, max_size_high: u32, max_size_low: u32, name: *mut u8) -> HANDLE {
unsafe
{
let ret: Option<HANDLE>;
let func_ptr: data::CreateFileMapping;
let kernel32 = get_module_base_address(&lc!("kernel32.dll"));
dynamic_invoke!(kernel32,&lc!("CreateFileMappingW"),func_ptr,ret,file,attributes,protect,max_size_high,max_size_low,name);
match ret {
Some(x) => return x,
None => return HANDLE { 0: 0 } ,
}
}
}
/// Dynamically calls MapViewOfFile.
///
pub fn map_view_of_file (file: HANDLE, access: u32, off_high: u32, off_low: u32, bytes: usize) -> PVOID {
unsafe
{
let ret: Option<PVOID>;
let func_ptr: data::MapViewOfFile;
let kernel32 = get_module_base_address(&lc!("kernel32.dll"));
dynamic_invoke!(kernel32,&lc!("MapViewOfFile"),func_ptr,ret,file,access,off_high,off_low,bytes);
match ret {
Some(x) => return x,
None => return ptr::null_mut() ,
}
}
}
/// Dynamically calls UnmapViewOfFile.
///
pub fn unmap_view_of_file (base_address: PVOID) -> bool {
unsafe
{
let ret: Option<BOOL>;
let func_ptr: data::UnmapViewOfFile;
let kernel32 = get_module_base_address(&lc!("kernel32.dll"));
dynamic_invoke!(kernel32,&lc!("UnmapViewOfFile"),func_ptr,ret,base_address);
match ret {
Some(x) => return x.as_bool(),
None => return false ,
}
}
}
/// Dynamically calls RollbackTransaction.
///
pub fn rollback_transaction(transaction: HANDLE) -> bool {
unsafe
{
let ret: Option<BOOL>;
let func_ptr: data::RollbackTransaction;
let ktmv = load_library_a(&lc!("KtmW32.dll"));
dynamic_invoke!(ktmv,&lc!("RollbackTransaction"),func_ptr,ret,transaction);
match ret {
Some(x) => return x.as_bool(),
None => return false ,
}
}
}
/// Opens a HANDLE to a process.
///
/// If the function fails, it will return a null HANDLE.