shellcode.hpp

Go to the documentation of this file.

 
#ifndef SHELLCODE_HPP
#define SHELLCODE_HPP
 
// The includes.
#include <Windows.h>
#include <winternl.h>
#include <intrin.h>
 
// No inline macros.
#ifdef _MSC_VER
#define no_inline __declspec(noinline)
#else
#define no_inline __attribute__((noinline))
#endif
 
// Resolving a function internally.
#define sh_resolve(base, funs, fun) (decltype(fun)*)((PBYTE)base + \
    funs[shellcode_fun_##fun])
 
// Utility class represents the shellcode builder.
class shellcode
{
    // To access the internals.
    friend class cobf;
private:
 
    // Union of the symbol hash and ordinal.
    typedef union {
        DWORD   sym_hash;   
        WORD    sym_ord;    
    } u_sym_info;
 
    // Struct of an obfuscated API.
    typedef struct {
        DWORD       dll_name;   
        BOOL        by_name;    
        u_sym_info  sym_info;   
        DWORD       sym_thnk;   
    } obfuscated_sym, * p_obfuscated_sym;
 
    // Api set schema version 3.
    typedef struct _ApiSetHeader63 {
        DWORD Version;          
        DWORD Size;             
        DWORD Sealed;           
        DWORD NumberOfApisets;  
        DWORD NamesOffset;      
        DWORD TableOffset;      
        DWORD Multiplier;       
    } ApiSetHeader63, * PApiSetHeader63;
 
    // Api set schema name entry.
    typedef struct _ApisetNameEntry {
        DWORD Sealed;           
        DWORD Offset;           
        DWORD Ignored;          
        DWORD Size;             
        DWORD HostOffset;       
        DWORD NumberOfHosts;    
    } ApisetNameEntry, * PApisetNameEntry;
 
    // Api set schema value entry.
    typedef struct _ApisetValueEntry {
        DWORD Ignored;          
        DWORD NameOffset;       
        DWORD NameLength;       
        DWORD ValueOffset;      
        DWORD ValueLength;      
    } ApisetValueEntry, * PApisetValueEntry;
 
    // Api set schema version 6.
    typedef struct _ApiSetHeader6 {
        DWORD Version;          
        DWORD Count;            
    } ApiSetHeader6, * PApiSetHeader6;
 
    // Api set schema another version name entry.
    typedef struct _ApisetNameEntry2 {
        DWORD NameOffset;       
        DWORD NameLength;       
        DWORD DataOffset;       
    } ApisetNameEntry2, * PApisetNameEntry2;
 
    // Api set schema another version value entry.
    typedef struct _ValuesArray2 {
        DWORD Count;            
        DWORD NameLength;       
        DWORD DataOffset;       
    } ValuesArray2, * PValuesArray2;
 
    // Api set schema another version values entry.
    typedef struct _ValuesEntry2 {
        DWORD NameOffset;       
        DWORD NameLength;       
        DWORD ValueOffset;      
        DWORD ValueLength;      
    } ValuesEntry2, * PValuesEntry2;
 
    // For LdrLoadDll.
    typedef NTSTATUS (WINAPI* pLdrLoadDll)(
        PCWSTR              PathToFile,     
        DWORD               Flags,          
        PUNICODE_STRING     ModuleFileName, 
        PVOID*              ModuleHandle);  
    static no_inline VOID exit();
 
    static no_inline size_t wstr_len(PWSTR str);
 
    static no_inline DWORD hash_string(PCHAR str);
 
    static no_inline VOID str_cpy(PCHAR out, PSTR in);
 
    static no_inline DWORD str_toi(PSTR str);
 
    static no_inline PCHAR str_chr(PSTR str, CHAR chr);
 
    static no_inline VOID ansi_to_wide(PCHAR str, PWCHAR out, size_t size);
 
    static no_inline VOID wstr_cpy(PWSTR str1, PCWSTR str2, size_t length);
 
    static no_inline INT wstr_i_cmp(PWSTR str1, PCWSTR str2, size_t length);
 
    static no_inline HANDLE get_dll_handle(HANDLE pe_base, PDWORD sh_funs, PWSTR dll_name);
 
    static no_inline HANDLE load_dll(HANDLE pe_base, PDWORD sh_funs, PCHAR dll_name);
 
    static no_inline BOOL resolve_api_set(HANDLE pe_base, PDWORD sh_funs, PVOID schema_map,
        PCWSTR virtual_dll, PWCHAR real_dll);
 
    static no_inline PVOID get_symbol_ptr(HANDLE pe_base, PDWORD sh_funs, HANDLE dll_handle,
        u_sym_info sym_info, BOOL by_name);
 
    static no_inline VOID WINAPI load_syms(HANDLE pe_base, DWORD sh_funs_rva, DWORD syms_rva);
 
    static no_inline VOID funs_end();
 
    // Enum of the functions used at the shellcode.
    typedef enum {
        shellcode_fun_exit = 0,         
        shellcode_fun_wstr_len,         
        shellcode_fun_hash_string,      
        shellcode_fun_str_cpy,          
        shellcode_fun_str_toi,          
        shellcode_fun_str_chr,          
        shellcode_fun_ansi_to_wide,     
        shellcode_fun_wstr_cpy,         
        shellcode_fun_wstr_i_cmp,       
        shellcode_fun_get_dll_handle,   
        shellcode_fun_load_dll,         
        shellcode_fun_resolve_api_set,  
        shellcode_fun_get_symbol_ptr,   
        shellcode_fun_load_syms,        
        shellcode_number_of_functions   
    } t_shellcode_funs;
 
public:
 
    static PVOID shellcode_start;   
    static DWORD shellcode_entry;   
    static DWORD shellcode_size;    
    static DWORD shellcodes_funs[shellcode_number_of_functions];
};
 
#endif // !SHELLCODE_HPP.