Structured project, Go through PEB to get function names

.gitignore

@@ -0,0 +1 @@
+*.exe

README.md

@@ -0,0 +1,3 @@
+# SuperdEye
+
+

SuperdEye.go

@@ -0,0 +1 @@
+package superdeye

examples/getSSN.go

@@ -0,0 +1,16 @@
+package main
+
+import (
+	"SuperdEye/internal/manalocator"
+	"SuperdEye/internal/utils/superdwindows"
+
+	"golang.org/x/sys/windows"
+)
+
+
+func main()  {
+
+    ntdllHandle := windows.NewLazyDLL("ntdll.dll").Handle()
+    manalocator.LookupSSN("NtCreateThread", superdwindows.HANDLE(ntdllHandle))
+    
+}

go.mod

@@ -0,0 +1,5 @@
+module SuperdEye
+
+go 1.23.1
+
+require golang.org/x/sys v0.27.0

go.sum

@@ -0,0 +1,2 @@
+golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
+golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=

go_windows.env

@@ -0,0 +1,6 @@
+export GOOS=windows
+export GOARCH=amd64
+export CGO_ENABLED=1
+export CXX=i686-w64-mingw32-g++
+export CC=i686-w64-mingw32-gcc
+export GO111MODULE=on

internal/manalocator/locator.go

@@ -0,0 +1,24 @@
+package manalocator
+
+import (
+	"fmt"
+	"unsafe"
+
+	"SuperdEye/internal/utils/superdwindows"
+)
+
+func LookupSSN(syscallName string, hModule superdwindows.HANDLE) (ssn int, err error) {
+	pBase := unsafe.Pointer(hModule)
+	pImgExportDir := superdwindows.GetImageExportDirectory(hModule)
+	numFunction := pImgExportDir.NumberOfFunctions
+
+	//	AddressOfFuntionArray := unsafe.Slice((*superdwindows.DWORD)(unsafe.Pointer(uintptr(pBase)+uintptr(pImgExportDir.AddressOfFunctions))), pImgExportDir.NumberOfFunctions)
+	AddressOfNamesArray := unsafe.Slice((*superdwindows.DWORD)(unsafe.Pointer(uintptr(pBase)+uintptr(pImgExportDir.AddressOfNames))), pImgExportDir.NumberOfFunctions)
+
+	for i := superdwindows.DWORD(0); i < numFunction; i++ {
+		functionNameRVA := AddressOfNamesArray[i]
+        s := superdwindows.NameRvaToString(uintptr(pBase), functionNameRVA)
+        fmt.Print(s)
+	}
+	return 0, nil
+}

internal/utils/hash/hash.go

@@ -0,0 +1,11 @@
+package hash
+
+func djb2(s string) int64 {
+	var hash int64 = 5381
+
+	for _, c := range s {
+		hash = ((hash << 5) + hash) + int64(c)
+	}
+
+	return hash
+}

internal/utils/superdwindows/getpeb.s

@@ -0,0 +1,10 @@
+// +build !noasm
+#include "textflag.h"
+
+// func GetPEB() uintptr
+TEXT ·GetPEB(SB),NOSPLIT|NOFRAME,$0-8
+    MOVQ 0x60(GS), CX   // Read the value at offset 0x60 from the GS segment into CX
+    MOVQ CX, ret+0(FP)  // Store the value in the return slot (CX -> return)
+    RET
+
+

internal/utils/superdwindows/misc.go

@@ -0,0 +1,51 @@
+package superdwindows
+
+import (
+	"fmt"
+	"unsafe"
+)
+
+func GetPEB() uintptr
+
+func GetImageExportDirectory(hModule HANDLE) PIMAGE_EXPORT_DIRECTORY {
+	pBase := unsafe.Pointer(hModule)
+	pImgDosHeader := PIMAGE_DOS_HEADER(pBase)
+	if pImgDosHeader.E_magic != IMAGE_DOS_SIGNATURE {
+		fmt.Println("Messed Up Getting the DosHeader")
+	}
+
+	pImgNtHdrs := PIMAGE_NT_HEADERS32(unsafe.Pointer(uintptr(pBase) + uintptr(pImgDosHeader.E_lfanew)))
+	if pImgNtHdrs.Signature != IMAGE_NT_SIGNATURE {
+		fmt.Println("Messed Up getting NTHeader")
+	}
+
+	if pImgNtHdrs.FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64 {
+		pImgNtHdrs64 := PIMAGE_NT_HEADERS64(unsafe.Pointer(pImgNtHdrs))
+		ImgOptHdr := pImgNtHdrs64.OptionalHeader
+		if ImgOptHdr.Magic != IMAGE_NT_OPTIONAL_HDR64_MAGIC {
+			fmt.Println("Messed Up getting Image Optional Header for x64 arch")
+		}
+		pImgExportDir := PIMAGE_EXPORT_DIRECTORY(unsafe.Pointer(uintptr(pBase) + uintptr(ImgOptHdr.DataDirectory.VirtualAddress)))
+
+		return pImgExportDir
+	}
+	ImgOptHdr := pImgNtHdrs.OptionalHeader
+	if ImgOptHdr.Magic != IMAGE_NT_OPTIONAL_HDR32_MAGIC {
+		fmt.Println("Messed Up getting Image Optional Header for x64 arch")
+	}
+	pImgExportDir := PIMAGE_EXPORT_DIRECTORY(unsafe.Pointer(uintptr(pBase) + uintptr(ImgOptHdr.DataDirectory.VirtualAddress)))
+	return pImgExportDir
+}
+
+func NameRvaToString(pBase uintptr, rva DWORD) (string) {
+	addr := uintptr(pBase + uintptr(rva))
+
+    var res []byte
+	for i := uintptr(0); ; i++ {
+		char := *(*byte)(unsafe.Pointer(addr + i))
+        res = append(res, char)
+        if char == 0 {
+            return string(res)
+        }
+	}
+}

internal/utils/superdwindows/types.go

@@ -0,0 +1,238 @@
+package superdwindows
+
+const (
+	IMAGE_DOS_SIGNATURE           = 0x5a4d
+	IMAGE_NT_SIGNATURE            = 0x00004550
+	IMAGE_FILE_MACHINE_AMD64      = 0x8664
+	IMAGE_NT_OPTIONAL_HDR64_MAGIC = 0x20b
+	IMAGE_NT_OPTIONAL_HDR32_MAGIC = 0x10b
+)
+
+type (
+	DWORD     uint32
+	WORD      uint16
+	PWORD     *uint16
+	HANDLE    uintptr
+	LPCSTR    *uint8
+	PBYTE     *uint8
+	LONG      int32
+	BYTE      uint8
+	ULONGLONG uint64
+	ULONG     uint32
+	CHAR      byte
+	PVOID     uintptr
+)
+
+type IMAGE_EXPORT_DIRECTORY struct {
+	Characteristics       DWORD
+	TimeDateStamp         DWORD
+	MajorVersion          WORD
+	MinorVersion          WORD
+	Name                  DWORD
+	Base                  DWORD
+	NumberOfFunctions     DWORD
+	NumberOfNames         DWORD
+	AddressOfFunctions    DWORD
+	AddressOfNames        DWORD
+	AddressOfNameOrdinals DWORD
+}
+type PIMAGE_EXPORT_DIRECTORY *IMAGE_EXPORT_DIRECTORY
+
+type IMAGE_DOS_HEADER struct {
+	E_magic    WORD
+	E_cblp     WORD
+	E_cp       WORD
+	E_crlc     WORD
+	E_cparhdr  WORD
+	E_minalloc WORD
+	E_maxalloc WORD
+	E_ss       WORD
+	E_sp       WORD
+	E_csum     WORD
+	E_ip       WORD
+	E_cs       WORD
+	E_lfarlc   WORD
+	E_ovno     WORD
+	E_res      [4]WORD
+	E_oemid    WORD
+	E_oeminfo  WORD
+	E_res2     [10]WORD
+	E_lfanew   LONG
+}
+type PIMAGE_DOS_HEADER *IMAGE_DOS_HEADER
+
+type IMAGE_FILE_HEADER struct {
+	Machine              WORD
+	NumberOfSections     WORD
+	TimeDateStamp        DWORD
+	PointerToSymbolTable DWORD
+	NumberOfSymbols      DWORD
+	SizeOfOptionalHeader WORD
+	Characteristics      WORD
+}
+type PIMAGE_FILE_HEADER *IMAGE_FILE_HEADER
+
+type IMAGE_DATA_DIRECTORY struct {
+	VirtualAddress DWORD
+	Size           DWORD
+}
+type PIMAGE_DATA_DIRECTORY *IMAGE_DATA_DIRECTORY
+
+type IMAGE_OPTIONAL_HEADER32 struct {
+	Magic                       WORD
+	MajorLinkerVersion          BYTE
+	MinorLinkerVersion          BYTE
+	SizeOfCode                  DWORD
+	SizeOfInitializedData       DWORD
+	SizeOfUninitializedData     DWORD
+	AddressOfEntryPoint         DWORD
+	BaseOfCode                  DWORD
+	BaseOfData                  DWORD
+	ImageBase                   DWORD
+	SectionAlignment            DWORD
+	FileAlignment               DWORD
+	MajorOperatingSystemVersion WORD
+	MinorOperatingSystemVersion WORD
+	MajorImageVersion           WORD
+	MinorImageVersion           WORD
+	MajorSubsystemVersion       WORD
+	MinorSubsystemVersion       WORD
+	Win32VersionValue           DWORD
+	SizeOfImage                 DWORD
+	SizeOfHeaders               DWORD
+	CheckSum                    DWORD
+	Subsystem                   WORD
+	DllCharacteristics          WORD
+	SizeOfStackReserve          DWORD
+	SizeOfStackCommit           DWORD
+	SizeOfHeapReserve           DWORD
+	SizeOfHeapCommit            DWORD
+	LoaderFlags                 DWORD
+	NumberOfRvaAndSizes         DWORD
+	DataDirectory               IMAGE_DATA_DIRECTORY
+}
+
+type IMAGE_NT_HEADERS32 struct {
+	Signature      DWORD
+	FileHeader     IMAGE_FILE_HEADER
+	OptionalHeader IMAGE_OPTIONAL_HEADER32
+}
+type PIMAGE_NT_HEADERS32 *IMAGE_NT_HEADERS32
+
+type IMAGE_OPTIONAL_HEADER64 struct {
+	Magic                       WORD
+	MajorLinkerVersion          BYTE
+	MinorLinkerVersion          BYTE
+	SizeOfCode                  DWORD
+	SizeOfInitializedData       DWORD
+	SizeOfUninitializedData     DWORD
+	AddressOfEntryPoint         DWORD
+	BaseOfCode                  DWORD
+	ImageBase                   ULONGLONG
+	SectionAlignment            DWORD
+	FileAlignment               DWORD
+	MajorOperatingSystemVersion WORD
+	MinorOperatingSystemVersion WORD
+	MajorImageVersion           WORD
+	MinorImageVersion           WORD
+	MajorSubsystemVersion       WORD
+	MinorSubsystemVersion       WORD
+	Win32VersionValue           DWORD
+	SizeOfImage                 DWORD
+	SizeOfHeaders               DWORD
+	CheckSum                    DWORD
+	Subsystem                   WORD
+	DllCharacteristics          WORD
+	SizeOfStackReserve          ULONGLONG
+	SizeOfStackCommit           ULONGLONG
+	SizeOfHeapReserve           ULONGLONG
+	SizeOfHeapCommit            ULONGLONG
+	LoaderFlags                 DWORD
+	NumberOfRvaAndSizes         DWORD
+	DataDirectory               IMAGE_DATA_DIRECTORY
+}
+type IMAGE_NT_HEADERS64 struct {
+	Signature      DWORD
+	FileHeader     IMAGE_FILE_HEADER
+	OptionalHeader IMAGE_OPTIONAL_HEADER64
+}
+type PIMAGE_NT_HEADERS64 *IMAGE_NT_HEADERS64
+
+type UNICODE_STRING struct {
+	Length        WORD
+	MaximumLength WORD
+	Buffer        PWORD
+}
+
+type RTL_USER_PROCESS_PARAMETERS struct {
+	Reserved1     [16]BYTE
+	Reserved2     [10]PVOID
+	ImagePathName UNICODE_STRING
+	CommandLine   UNICODE_STRING
+}
+type PRTL_USER_PROCESS_PARAMETERS *RTL_USER_PROCESS_PARAMETERS
+
+type LIST_ENTRY struct {
+	Flink *LIST_ENTRY
+	Blink *LIST_ENTRY
+}
+
+type PEB_LDR_DATA struct {
+	reserved1               [8]BYTE
+	reserved2               [3]PVOID
+	InMemoryOrderModuleList LIST_ENTRY
+}
+type PPEB_LDR_DATA *PEB_LDR_DATA
+
+type PEB32 struct {
+	reserved1              [2]BYTE
+	BeingDebugged          BYTE
+	BitField               BYTE
+	reserved3              PVOID
+	ImageBaseAddress       PVOID
+	Ldr                    PPEB_LDR_DATA
+	ProcessParameters      PRTL_USER_PROCESS_PARAMETERS
+	reserved4              [3]PVOID
+	AtlThunkSListPtr       PVOID
+	reserved5              PVOID
+	reserved6              ULONG
+	reserved7              PVOID
+	reserved8              ULONG
+	AtlThunkSListPtr32     ULONG
+	reserved9              [45]PVOID
+	reserved10             [96]BYTE
+	PostProcessInitRoutine PVOID
+	reserved11             [128]BYTE
+	reserved12             [1]PVOID
+	SessionId              ULONG
+}
+type PPEB32 *PEB32
+
+type PEB64 struct {
+	Reserved1              [2]BYTE
+	BeingDebugged          BYTE
+	Reserved2              [21]BYTE
+	LoaderData             PPEB_LDR_DATA
+	ProcessParameters      PRTL_USER_PROCESS_PARAMETERS
+	Reserved3              [520]BYTE
+	PostProcessInitRoutine PVOID
+	Reserved4              [136]BYTE
+	SessionId              ULONG
+}
+type PPEB64 *PEB64
+
+type LDR_DATA_TABLE_ENTRY struct {
+	Reserved1                  [2]PVOID
+	InMemoryOrderLinks         LIST_ENTRY
+	InInitializationOrderLinks LIST_ENTRY
+	DllBase                    PVOID
+	EntryPoint                 PVOID
+	Reserved3                  PVOID
+	FullDllName                UNICODE_STRING
+	Reserved4                  [8]BYTE
+	Reserved5                  [3]PVOID
+	Reserved6                  PVOID
+	TimeDateStamp              ULONG
+}
+type PLDR_DATA_TABLE_ENTRY *LDR_DATA_TABLE_ENTRY
+