mirror of
https://github.com/d35ha/CallObfuscator
synced 2026-06-08 13:42:37 +00:00
d35ha
613 lines
74 KiB
HTML
613 lines
74 KiB
HTML
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "https://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/xhtml;charset=UTF-8"/>
|
|
<meta http-equiv="X-UA-Compatible" content="IE=9"/>
|
|
<meta name="generator" content="Doxygen 1.8.20"/>
|
|
<meta name="viewport" content="width=device-width, initial-scale=1"/>
|
|
<title>cobf: src/shellcode.cpp Source File</title>
|
|
<link href="tabs.css" rel="stylesheet" type="text/css"/>
|
|
<script type="text/javascript" src="jquery.js"></script>
|
|
<script type="text/javascript" src="dynsections.js"></script>
|
|
<link href="navtree.css" rel="stylesheet" type="text/css"/>
|
|
<script type="text/javascript" src="resize.js"></script>
|
|
<script type="text/javascript" src="navtreedata.js"></script>
|
|
<script type="text/javascript" src="navtree.js"></script>
|
|
<link href="search/search.css" rel="stylesheet" type="text/css"/>
|
|
<script type="text/javascript" src="search/searchdata.js"></script>
|
|
<script type="text/javascript" src="search/search.js"></script>
|
|
<link href="doxygen.css" rel="stylesheet" type="text/css" />
|
|
</head>
|
|
<body>
|
|
<div id="top"><!-- do not remove this div, it is closed by doxygen! -->
|
|
<div id="titlearea">
|
|
<table cellspacing="0" cellpadding="0">
|
|
<tbody>
|
|
<tr style="height: 56px;">
|
|
<td id="projectalign" style="padding-left: 0.5em;">
|
|
<div id="projectname">cobf
|
|
</div>
|
|
<div id="projectbrief">PE imports obfuscator</div>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
<!-- end header part -->
|
|
<!-- Generated by Doxygen 1.8.20 -->
|
|
<script type="text/javascript">
|
|
/* @license magnet:?xt=urn:btih:cf05388f2679ee054f2beb29a391d25f4e673ac3&dn=gpl-2.0.txt GPL-v2 */
|
|
var searchBox = new SearchBox("searchBox", "search",false,'Search');
|
|
/* @license-end */
|
|
</script>
|
|
<script type="text/javascript" src="menudata.js"></script>
|
|
<script type="text/javascript" src="menu.js"></script>
|
|
<script type="text/javascript">
|
|
/* @license magnet:?xt=urn:btih:cf05388f2679ee054f2beb29a391d25f4e673ac3&dn=gpl-2.0.txt GPL-v2 */
|
|
$(function() {
|
|
initMenu('',true,false,'search.php','Search');
|
|
$(document).ready(function() { init_search(); });
|
|
});
|
|
/* @license-end */</script>
|
|
<div id="main-nav"></div>
|
|
</div><!-- top -->
|
|
<div id="side-nav" class="ui-resizable side-nav-resizable">
|
|
<div id="nav-tree">
|
|
<div id="nav-tree-contents">
|
|
<div id="nav-sync" class="sync"></div>
|
|
</div>
|
|
</div>
|
|
<div id="splitbar" style="-moz-user-select:none;"
|
|
class="ui-resizable-handle">
|
|
</div>
|
|
</div>
|
|
<script type="text/javascript">
|
|
/* @license magnet:?xt=urn:btih:cf05388f2679ee054f2beb29a391d25f4e673ac3&dn=gpl-2.0.txt GPL-v2 */
|
|
$(document).ready(function(){initNavTree('shellcode_8cpp_source.html',''); initResizable(); });
|
|
/* @license-end */
|
|
</script>
|
|
<div id="doc-content">
|
|
<!-- window showing the filter options -->
|
|
<div id="MSearchSelectWindow"
|
|
onmouseover="return searchBox.OnSearchSelectShow()"
|
|
onmouseout="return searchBox.OnSearchSelectHide()"
|
|
onkeydown="return searchBox.OnSearchSelectKey(event)">
|
|
</div>
|
|
|
|
<!-- iframe showing the search results (closed by default) -->
|
|
<div id="MSearchResultsWindow">
|
|
<iframe src="javascript:void(0)" frameborder="0"
|
|
name="MSearchResults" id="MSearchResults">
|
|
</iframe>
|
|
</div>
|
|
|
|
<div class="header">
|
|
<div class="headertitle">
|
|
<div class="title">shellcode.cpp</div> </div>
|
|
</div><!--header-->
|
|
<div class="contents">
|
|
<a href="shellcode_8cpp.html">Go to the documentation of this file.</a><div class="fragment"><div class="line"><a name="l00001"></a><span class="lineno"> 1</span>  </div>
|
|
<div class="line"><a name="l00008"></a><span class="lineno"> 8</span> <span class="preprocessor">#ifndef SHELLCODE_CPP</span></div>
|
|
<div class="line"><a name="l00009"></a><span class="lineno"><a class="line" href="shellcode_8cpp.html#ac9f0180dd635ef1d75e7b97225827b39"> 9</a></span> <span class="preprocessor">#define SHELLCODE_CPP</span></div>
|
|
<div class="line"><a name="l00010"></a><span class="lineno"> 10</span>  </div>
|
|
<div class="line"><a name="l00011"></a><span class="lineno"> 11</span>  <span class="comment">// The includes.</span></div>
|
|
<div class="line"><a name="l00012"></a><span class="lineno"> 12</span> <span class="preprocessor">#include <<a class="code" href="shellcode_8hpp.html">shellcode.hpp</a>></span></div>
|
|
<div class="line"><a name="l00013"></a><span class="lineno"> 13</span> <span class="preprocessor">#include <winternl.h></span></div>
|
|
<div class="line"><a name="l00014"></a><span class="lineno"> 14</span>  </div>
|
|
<div class="line"><a name="l00015"></a><span class="lineno"> 15</span> <span class="comment">// Needed variables.</span></div>
|
|
<div class="line"><a name="l00016"></a><span class="lineno"> 16</span> PVOID <a class="code" href="classshellcode.html#a57220d662e7f75e3aefa71eaa144d243">shellcode::shellcode_start</a> = exit;</div>
|
|
<div class="line"><a name="l00017"></a><span class="lineno"> 17</span> DWORD <a class="code" href="classshellcode.html#aaa82db40cd8ad288803b70bbb278bff4">shellcode::shellcode_entry</a> = (DWORD)((PBYTE)load_syms - (PBYTE)shellcode_start);</div>
|
|
<div class="line"><a name="l00018"></a><span class="lineno"> 18</span> DWORD <a class="code" href="classshellcode.html#a724cccee30273c81a1a865b3ca20c829">shellcode::shellcode_size</a> = (DWORD)((PBYTE)funs_end - (PBYTE)shellcode_start);</div>
|
|
<div class="line"><a name="l00019"></a><span class="lineno"> 19</span>  </div>
|
|
<div class="line"><a name="l00020"></a><span class="lineno"> 20</span> <span class="comment">// Table holding the pointers and the sizes of the shellcode functions.</span></div>
|
|
<div class="line"><a name="l00021"></a><span class="lineno"> 21</span> DWORD <a class="code" href="classshellcode.html#af54e7ad1b1d215703f5487389040d687">shellcode::shellcodes_funs</a>[] =</div>
|
|
<div class="line"><a name="l00022"></a><span class="lineno"> 22</span> {</div>
|
|
<div class="line"><a name="l00023"></a><span class="lineno"> 23</span>  (DWORD)((PBYTE)exit - (PBYTE)shellcode_start),</div>
|
|
<div class="line"><a name="l00024"></a><span class="lineno"> 24</span>  (DWORD)((PBYTE)wstr_len - (PBYTE)shellcode_start),</div>
|
|
<div class="line"><a name="l00025"></a><span class="lineno"> 25</span>  (DWORD)((PBYTE)hash_string - (PBYTE)shellcode_start),</div>
|
|
<div class="line"><a name="l00026"></a><span class="lineno"> 26</span>  (DWORD)((PBYTE)str_cpy - (PBYTE)shellcode_start),</div>
|
|
<div class="line"><a name="l00027"></a><span class="lineno"> 27</span>  (DWORD)((PBYTE)str_toi - (PBYTE)shellcode_start),</div>
|
|
<div class="line"><a name="l00028"></a><span class="lineno"> 28</span>  (DWORD)((PBYTE)str_chr - (PBYTE)shellcode_start),</div>
|
|
<div class="line"><a name="l00029"></a><span class="lineno"> 29</span>  (DWORD)((PBYTE)ansi_to_wide - (PBYTE)shellcode_start),</div>
|
|
<div class="line"><a name="l00030"></a><span class="lineno"> 30</span>  (DWORD)((PBYTE)wstr_cpy - (PBYTE)shellcode_start),</div>
|
|
<div class="line"><a name="l00031"></a><span class="lineno"> 31</span>  (DWORD)((PBYTE)wstr_i_cmp - (PBYTE)shellcode_start),</div>
|
|
<div class="line"><a name="l00032"></a><span class="lineno"> 32</span>  (DWORD)((PBYTE)get_dll_handle - (PBYTE)shellcode_start),</div>
|
|
<div class="line"><a name="l00033"></a><span class="lineno"> 33</span>  (DWORD)((PBYTE)load_dll - (PBYTE)shellcode_start),</div>
|
|
<div class="line"><a name="l00034"></a><span class="lineno"> 34</span>  (DWORD)((PBYTE)resolve_api_set - (PBYTE)shellcode_start),</div>
|
|
<div class="line"><a name="l00035"></a><span class="lineno"> 35</span>  (DWORD)((PBYTE)get_symbol_ptr - (PBYTE)shellcode_start),</div>
|
|
<div class="line"><a name="l00036"></a><span class="lineno"> 36</span>  (DWORD)((PBYTE)load_syms - (PBYTE)shellcode_start)</div>
|
|
<div class="line"><a name="l00037"></a><span class="lineno"> 37</span> };</div>
|
|
<div class="line"><a name="l00038"></a><span class="lineno"> 38</span>  </div>
|
|
<div class="line"><a name="l00039"></a><span class="lineno"> 39</span> <span class="comment">// Disable the runtime checks.</span></div>
|
|
<div class="line"><a name="l00040"></a><span class="lineno"> 40</span> <span class="preprocessor">#pragma runtime_checks("", off)</span></div>
|
|
<div class="line"><a name="l00041"></a><span class="lineno"> 41</span>  </div>
|
|
<div class="line"><a name="l00042"></a><span class="lineno"> 42</span> <span class="comment">// Stop the execution of the shellcode.</span></div>
|
|
<div class="line"><a name="l00043"></a><span class="lineno"> 43</span> VOID shellcode::exit() </div>
|
|
<div class="line"><a name="l00044"></a><span class="lineno"> 44</span> {</div>
|
|
<div class="line"><a name="l00045"></a><span class="lineno"> 45</span>  <span class="comment">// Just break.</span></div>
|
|
<div class="line"><a name="l00046"></a><span class="lineno"> 46</span>  __debugbreak();</div>
|
|
<div class="line"><a name="l00047"></a><span class="lineno"> 47</span> };</div>
|
|
<div class="line"><a name="l00048"></a><span class="lineno"> 48</span>  </div>
|
|
<div class="line"><a name="l00049"></a><span class="lineno"> 49</span> <span class="comment">// Length of wide string</span></div>
|
|
<div class="line"><a name="l00050"></a><span class="lineno"> 50</span> <span class="keywordtype">size_t</span> shellcode::wstr_len(PWSTR str)</div>
|
|
<div class="line"><a name="l00051"></a><span class="lineno"> 51</span> {</div>
|
|
<div class="line"><a name="l00052"></a><span class="lineno"> 52</span>  PWCHAR s = (PWCHAR)str;</div>
|
|
<div class="line"><a name="l00053"></a><span class="lineno"> 53</span>  <span class="keywordflow">for</span> (; *s; ++s);</div>
|
|
<div class="line"><a name="l00054"></a><span class="lineno"> 54</span>  <span class="keywordflow">return</span>(s - str);</div>
|
|
<div class="line"><a name="l00055"></a><span class="lineno"> 55</span> };</div>
|
|
<div class="line"><a name="l00056"></a><span class="lineno"> 56</span>  </div>
|
|
<div class="line"><a name="l00057"></a><span class="lineno"> 57</span> <span class="comment">// Compile time string hashing.</span></div>
|
|
<div class="line"><a name="l00058"></a><span class="lineno"> 58</span> DWORD shellcode::hash_string(PCHAR str)</div>
|
|
<div class="line"><a name="l00059"></a><span class="lineno"> 59</span> {</div>
|
|
<div class="line"><a name="l00060"></a><span class="lineno"> 60</span>  <span class="comment">// Init value.</span></div>
|
|
<div class="line"><a name="l00061"></a><span class="lineno"> 61</span>  DWORD hash = 0;</div>
|
|
<div class="line"><a name="l00062"></a><span class="lineno"> 62</span>  </div>
|
|
<div class="line"><a name="l00063"></a><span class="lineno"> 63</span>  <span class="comment">// Loop on the chars.</span></div>
|
|
<div class="line"><a name="l00064"></a><span class="lineno"> 64</span>  <span class="keywordflow">while</span> (*str)</div>
|
|
<div class="line"><a name="l00065"></a><span class="lineno"> 65</span>  {</div>
|
|
<div class="line"><a name="l00066"></a><span class="lineno"> 66</span>  <span class="comment">// Build it.</span></div>
|
|
<div class="line"><a name="l00067"></a><span class="lineno"> 67</span>  hash += *str++;</div>
|
|
<div class="line"><a name="l00068"></a><span class="lineno"> 68</span>  hash += hash << 10;</div>
|
|
<div class="line"><a name="l00069"></a><span class="lineno"> 69</span>  hash ^= hash >> 6;</div>
|
|
<div class="line"><a name="l00070"></a><span class="lineno"> 70</span>  };</div>
|
|
<div class="line"><a name="l00071"></a><span class="lineno"> 71</span>  </div>
|
|
<div class="line"><a name="l00072"></a><span class="lineno"> 72</span>  <span class="comment">// Finish.</span></div>
|
|
<div class="line"><a name="l00073"></a><span class="lineno"> 73</span>  hash += hash << 3;</div>
|
|
<div class="line"><a name="l00074"></a><span class="lineno"> 74</span>  hash ^= hash >> 11;</div>
|
|
<div class="line"><a name="l00075"></a><span class="lineno"> 75</span>  hash += hash << 15;</div>
|
|
<div class="line"><a name="l00076"></a><span class="lineno"> 76</span>  <span class="keywordflow">return</span> hash;</div>
|
|
<div class="line"><a name="l00077"></a><span class="lineno"> 77</span> };</div>
|
|
<div class="line"><a name="l00078"></a><span class="lineno"> 78</span>  </div>
|
|
<div class="line"><a name="l00079"></a><span class="lineno"> 79</span> <span class="comment">// Copy string to a buffer.</span></div>
|
|
<div class="line"><a name="l00080"></a><span class="lineno"> 80</span> VOID shellcode::str_cpy(PCHAR out, PSTR in)</div>
|
|
<div class="line"><a name="l00081"></a><span class="lineno"> 81</span> {</div>
|
|
<div class="line"><a name="l00082"></a><span class="lineno"> 82</span>  <span class="keywordflow">while</span> (*in) *out++ = *in++;</div>
|
|
<div class="line"><a name="l00083"></a><span class="lineno"> 83</span>  *out = 0;</div>
|
|
<div class="line"><a name="l00084"></a><span class="lineno"> 84</span> };</div>
|
|
<div class="line"><a name="l00085"></a><span class="lineno"> 85</span>  </div>
|
|
<div class="line"><a name="l00086"></a><span class="lineno"> 86</span> <span class="comment">// Convert a string into integer.</span></div>
|
|
<div class="line"><a name="l00087"></a><span class="lineno"> 87</span> DWORD shellcode::str_toi(PSTR str)</div>
|
|
<div class="line"><a name="l00088"></a><span class="lineno"> 88</span> {</div>
|
|
<div class="line"><a name="l00089"></a><span class="lineno"> 89</span>  <span class="comment">// Init.</span></div>
|
|
<div class="line"><a name="l00090"></a><span class="lineno"> 90</span>  DWORD result = 0;</div>
|
|
<div class="line"><a name="l00091"></a><span class="lineno"> 91</span>  BYTE digit;</div>
|
|
<div class="line"><a name="l00092"></a><span class="lineno"> 92</span>  </div>
|
|
<div class="line"><a name="l00093"></a><span class="lineno"> 93</span>  <span class="comment">// Convert.</span></div>
|
|
<div class="line"><a name="l00094"></a><span class="lineno"> 94</span>  <span class="keywordflow">for</span> (; ; str += 1) {</div>
|
|
<div class="line"><a name="l00095"></a><span class="lineno"> 95</span>  digit = *str - <span class="charliteral">'0'</span>;</div>
|
|
<div class="line"><a name="l00096"></a><span class="lineno"> 96</span>  <span class="keywordflow">if</span> (digit > 9)</div>
|
|
<div class="line"><a name="l00097"></a><span class="lineno"> 97</span>  <span class="keywordflow">break</span>;</div>
|
|
<div class="line"><a name="l00098"></a><span class="lineno"> 98</span>  result = (10 * result) + digit;</div>
|
|
<div class="line"><a name="l00099"></a><span class="lineno"> 99</span>  };</div>
|
|
<div class="line"><a name="l00100"></a><span class="lineno"> 100</span>  </div>
|
|
<div class="line"><a name="l00101"></a><span class="lineno"> 101</span>  <span class="comment">// Return.</span></div>
|
|
<div class="line"><a name="l00102"></a><span class="lineno"> 102</span>  <span class="keywordflow">return</span> result;</div>
|
|
<div class="line"><a name="l00103"></a><span class="lineno"> 103</span> };</div>
|
|
<div class="line"><a name="l00104"></a><span class="lineno"> 104</span>  </div>
|
|
<div class="line"><a name="l00105"></a><span class="lineno"> 105</span> <span class="comment">// Search for a char inside a string.</span></div>
|
|
<div class="line"><a name="l00106"></a><span class="lineno"> 106</span> PCHAR shellcode::str_chr(PSTR str, CHAR chr)</div>
|
|
<div class="line"><a name="l00107"></a><span class="lineno"> 107</span> {</div>
|
|
<div class="line"><a name="l00108"></a><span class="lineno"> 108</span>  <span class="comment">// Search for it.</span></div>
|
|
<div class="line"><a name="l00109"></a><span class="lineno"> 109</span>  <span class="keywordflow">do</span> {</div>
|
|
<div class="line"><a name="l00110"></a><span class="lineno"> 110</span>  <span class="keywordflow">if</span> (*str == chr) { <span class="keywordflow">return</span> str; };</div>
|
|
<div class="line"><a name="l00111"></a><span class="lineno"> 111</span>  } <span class="keywordflow">while</span> (*str++);</div>
|
|
<div class="line"><a name="l00112"></a><span class="lineno"> 112</span>  <span class="keywordflow">return</span> (0);</div>
|
|
<div class="line"><a name="l00113"></a><span class="lineno"> 113</span> };</div>
|
|
<div class="line"><a name="l00114"></a><span class="lineno"> 114</span>  </div>
|
|
<div class="line"><a name="l00115"></a><span class="lineno"> 115</span> <span class="comment">// Convert ansi to wide chars.</span></div>
|
|
<div class="line"><a name="l00116"></a><span class="lineno"> 116</span> VOID shellcode::ansi_to_wide(PCHAR str, PWCHAR out, <span class="keywordtype">size_t</span> size)</div>
|
|
<div class="line"><a name="l00117"></a><span class="lineno"> 117</span> {</div>
|
|
<div class="line"><a name="l00118"></a><span class="lineno"> 118</span>  <span class="comment">// Test if the buffer is zero-length.</span></div>
|
|
<div class="line"><a name="l00119"></a><span class="lineno"> 119</span>  size /= <span class="keyword">sizeof</span>(WCHAR);</div>
|
|
<div class="line"><a name="l00120"></a><span class="lineno"> 120</span>  <span class="keywordflow">if</span> (!size) <span class="keywordflow">return</span>;</div>
|
|
<div class="line"><a name="l00121"></a><span class="lineno"> 121</span>  </div>
|
|
<div class="line"><a name="l00122"></a><span class="lineno"> 122</span>  <span class="comment">// Copy the chars.</span></div>
|
|
<div class="line"><a name="l00123"></a><span class="lineno"> 123</span>  <span class="keywordflow">while</span> (--size && *str) {</div>
|
|
<div class="line"><a name="l00124"></a><span class="lineno"> 124</span>  *out++ = (WCHAR)*str++;</div>
|
|
<div class="line"><a name="l00125"></a><span class="lineno"> 125</span>  };</div>
|
|
<div class="line"><a name="l00126"></a><span class="lineno"> 126</span>  </div>
|
|
<div class="line"><a name="l00127"></a><span class="lineno"> 127</span>  <span class="comment">// Append NULL.</span></div>
|
|
<div class="line"><a name="l00128"></a><span class="lineno"> 128</span>  *out = 0;</div>
|
|
<div class="line"><a name="l00129"></a><span class="lineno"> 129</span> };</div>
|
|
<div class="line"><a name="l00130"></a><span class="lineno"> 130</span>  </div>
|
|
<div class="line"><a name="l00131"></a><span class="lineno"> 131</span> <span class="comment">// Copy string between to buffers.</span></div>
|
|
<div class="line"><a name="l00132"></a><span class="lineno"> 132</span> VOID shellcode::wstr_cpy(PWSTR str1, PCWSTR str2, <span class="keywordtype">size_t</span> length)</div>
|
|
<div class="line"><a name="l00133"></a><span class="lineno"> 133</span> {</div>
|
|
<div class="line"><a name="l00134"></a><span class="lineno"> 134</span>  <span class="comment">// Char by char.</span></div>
|
|
<div class="line"><a name="l00135"></a><span class="lineno"> 135</span>  <span class="keywordflow">while</span> (length--) *str1++ = *str2++;</div>
|
|
<div class="line"><a name="l00136"></a><span class="lineno"> 136</span>  *str1 = 0;</div>
|
|
<div class="line"><a name="l00137"></a><span class="lineno"> 137</span> };</div>
|
|
<div class="line"><a name="l00138"></a><span class="lineno"> 138</span>  </div>
|
|
<div class="line"><a name="l00139"></a><span class="lineno"> 139</span>  </div>
|
|
<div class="line"><a name="l00140"></a><span class="lineno"> 140</span> <span class="comment">// Compare two wide strings.</span></div>
|
|
<div class="line"><a name="l00141"></a><span class="lineno"> 141</span> INT shellcode::wstr_i_cmp(PWSTR str1, PCWSTR str2, <span class="keywordtype">size_t</span> length)</div>
|
|
<div class="line"><a name="l00142"></a><span class="lineno"> 142</span> {</div>
|
|
<div class="line"><a name="l00143"></a><span class="lineno"> 143</span>  <span class="comment">// Init.</span></div>
|
|
<div class="line"><a name="l00144"></a><span class="lineno"> 144</span>  WCHAR c1, c2;</div>
|
|
<div class="line"><a name="l00145"></a><span class="lineno"> 145</span>  <span class="keywordflow">do</span></div>
|
|
<div class="line"><a name="l00146"></a><span class="lineno"> 146</span>  {</div>
|
|
<div class="line"><a name="l00147"></a><span class="lineno"> 147</span>  <span class="comment">// Make the check.</span></div>
|
|
<div class="line"><a name="l00148"></a><span class="lineno"> 148</span>  c1 = *str1++;</div>
|
|
<div class="line"><a name="l00149"></a><span class="lineno"> 149</span>  c2 = *str2++;</div>
|
|
<div class="line"><a name="l00150"></a><span class="lineno"> 150</span>  <span class="keywordflow">if</span> (c1 == L<span class="charliteral">'\0'</span>) {</div>
|
|
<div class="line"><a name="l00151"></a><span class="lineno"> 151</span>  <span class="keywordflow">return</span> c2 - c1;</div>
|
|
<div class="line"><a name="l00152"></a><span class="lineno"> 152</span>  };</div>
|
|
<div class="line"><a name="l00153"></a><span class="lineno"> 153</span>  </div>
|
|
<div class="line"><a name="l00154"></a><span class="lineno"> 154</span>  <span class="comment">// Move to the next iteration.</span></div>
|
|
<div class="line"><a name="l00155"></a><span class="lineno"> 155</span>  } <span class="keywordflow">while</span> (((c1 == c2) || (c1 - c2 == 32) ||</div>
|
|
<div class="line"><a name="l00156"></a><span class="lineno"> 156</span>  (c2 - c1 == 32)) && --length);</div>
|
|
<div class="line"><a name="l00157"></a><span class="lineno"> 157</span>  </div>
|
|
<div class="line"><a name="l00158"></a><span class="lineno"> 158</span>  <span class="comment">// Final compare.</span></div>
|
|
<div class="line"><a name="l00159"></a><span class="lineno"> 159</span>  <span class="keywordflow">return</span> c2 - c1;</div>
|
|
<div class="line"><a name="l00160"></a><span class="lineno"> 160</span> };</div>
|
|
<div class="line"><a name="l00161"></a><span class="lineno"> 161</span>  </div>
|
|
<div class="line"><a name="l00162"></a><span class="lineno"> 162</span> <span class="comment">// Get the dll base by name.</span></div>
|
|
<div class="line"><a name="l00163"></a><span class="lineno"> 163</span> HANDLE shellcode::get_dll_handle(HANDLE pe_base, PDWORD sh_funs, PWSTR dll_name)</div>
|
|
<div class="line"><a name="l00164"></a><span class="lineno"> 164</span> {</div>
|
|
<div class="line"><a name="l00165"></a><span class="lineno"> 165</span>  <span class="comment">// Resolving the needed functions.</span></div>
|
|
<div class="line"><a name="l00166"></a><span class="lineno"> 166</span>  <span class="keyword">auto</span> fun_wstr_i_cmp = <a class="code" href="shellcode_8hpp.html#a0b990d3b5c511aeb8899c7c40c7371bb">sh_resolve</a>(pe_base, sh_funs, wstr_i_cmp);</div>
|
|
<div class="line"><a name="l00167"></a><span class="lineno"> 167</span>  <span class="keyword">auto</span> fun_resolve_api_set = <a class="code" href="shellcode_8hpp.html#a0b990d3b5c511aeb8899c7c40c7371bb">sh_resolve</a>(pe_base, sh_funs, resolve_api_set);</div>
|
|
<div class="line"><a name="l00168"></a><span class="lineno"> 168</span>  </div>
|
|
<div class="line"><a name="l00169"></a><span class="lineno"> 169</span>  <span class="comment">// Needed local variables.</span></div>
|
|
<div class="line"><a name="l00170"></a><span class="lineno"> 170</span>  PPEB pPeb = NtCurrentTeb()->ProcessEnvironmentBlock;</div>
|
|
<div class="line"><a name="l00171"></a><span class="lineno"> 171</span>  PLIST_ENTRY head = &pPeb->Ldr->InMemoryOrderModuleList;</div>
|
|
<div class="line"><a name="l00172"></a><span class="lineno"> 172</span>  </div>
|
|
<div class="line"><a name="l00173"></a><span class="lineno"> 173</span> QUERY_LDR:</div>
|
|
<div class="line"><a name="l00174"></a><span class="lineno"> 174</span>  </div>
|
|
<div class="line"><a name="l00175"></a><span class="lineno"> 175</span>  <span class="comment">// Looping on the LDR modules (ordered as in memory).</span></div>
|
|
<div class="line"><a name="l00176"></a><span class="lineno"> 176</span>  PLIST_ENTRY current = head;</div>
|
|
<div class="line"><a name="l00177"></a><span class="lineno"> 177</span>  <span class="keywordflow">while</span> ((current = current->Flink) != head)</div>
|
|
<div class="line"><a name="l00178"></a><span class="lineno"> 178</span>  {</div>
|
|
<div class="line"><a name="l00179"></a><span class="lineno"> 179</span>  <span class="comment">// Get and test the current module.</span></div>
|
|
<div class="line"><a name="l00180"></a><span class="lineno"> 180</span>  PLDR_DATA_TABLE_ENTRY data_table = CONTAINING_RECORD(current, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);</div>
|
|
<div class="line"><a name="l00181"></a><span class="lineno"> 181</span>  </div>
|
|
<div class="line"><a name="l00182"></a><span class="lineno"> 182</span>  <span class="comment">// If the current module is the needed one.</span></div>
|
|
<div class="line"><a name="l00183"></a><span class="lineno"> 183</span>  <span class="keywordflow">if</span> (!fun_wstr_i_cmp(((PUNICODE_STRING)(&data_table->Reserved4))->Buffer,</div>
|
|
<div class="line"><a name="l00184"></a><span class="lineno"> 184</span>  dll_name, 0))</div>
|
|
<div class="line"><a name="l00185"></a><span class="lineno"> 185</span>  {</div>
|
|
<div class="line"><a name="l00186"></a><span class="lineno"> 186</span>  <span class="comment">// Return the module base.</span></div>
|
|
<div class="line"><a name="l00187"></a><span class="lineno"> 187</span>  <span class="keywordflow">return</span> data_table->DllBase;</div>
|
|
<div class="line"><a name="l00188"></a><span class="lineno"> 188</span>  };</div>
|
|
<div class="line"><a name="l00189"></a><span class="lineno"> 189</span>  };</div>
|
|
<div class="line"><a name="l00190"></a><span class="lineno"> 190</span>  </div>
|
|
<div class="line"><a name="l00191"></a><span class="lineno"> 191</span>  <span class="comment">// Check if api set schema.</span></div>
|
|
<div class="line"><a name="l00192"></a><span class="lineno"> 192</span>  WCHAR api_schema[] = { L<span class="charliteral">'a'</span>, L<span class="charliteral">'p'</span>, L<span class="charliteral">'i'</span>, L<span class="charliteral">'-'</span>, L<span class="charliteral">'\0'</span> };</div>
|
|
<div class="line"><a name="l00193"></a><span class="lineno"> 193</span>  WCHAR ext_schema[] = { L<span class="charliteral">'e'</span>, L<span class="charliteral">'x'</span>, L<span class="charliteral">'t'</span>, L<span class="charliteral">'-'</span>, L<span class="charliteral">'\0'</span> };</div>
|
|
<div class="line"><a name="l00194"></a><span class="lineno"> 194</span>  <span class="keywordflow">if</span> (!fun_wstr_i_cmp(dll_name, api_schema, <span class="keyword">sizeof</span>(<span class="stringliteral">"api"</span>)) ||</div>
|
|
<div class="line"><a name="l00195"></a><span class="lineno"> 195</span>  !fun_wstr_i_cmp(dll_name, ext_schema, <span class="keyword">sizeof</span>(<span class="stringliteral">"ext"</span>)))</div>
|
|
<div class="line"><a name="l00196"></a><span class="lineno"> 196</span>  {</div>
|
|
<div class="line"><a name="l00197"></a><span class="lineno"> 197</span>  <span class="comment">// The length of the dll name is more than the api set dll name.</span></div>
|
|
<div class="line"><a name="l00198"></a><span class="lineno"> 198</span>  <span class="keywordflow">if</span> (fun_resolve_api_set(pe_base, sh_funs, pPeb->Reserved9[0], dll_name, dll_name)) {</div>
|
|
<div class="line"><a name="l00199"></a><span class="lineno"> 199</span>  <span class="keywordflow">goto</span> QUERY_LDR;</div>
|
|
<div class="line"><a name="l00200"></a><span class="lineno"> 200</span>  };</div>
|
|
<div class="line"><a name="l00201"></a><span class="lineno"> 201</span>  };</div>
|
|
<div class="line"><a name="l00202"></a><span class="lineno"> 202</span>  </div>
|
|
<div class="line"><a name="l00203"></a><span class="lineno"> 203</span>  <span class="comment">// Not found.</span></div>
|
|
<div class="line"><a name="l00204"></a><span class="lineno"> 204</span>  <span class="keywordflow">return</span> NULL;</div>
|
|
<div class="line"><a name="l00205"></a><span class="lineno"> 205</span> };</div>
|
|
<div class="line"><a name="l00206"></a><span class="lineno"> 206</span>  </div>
|
|
<div class="line"><a name="l00207"></a><span class="lineno"> 207</span> <span class="comment">// Load the dll base by name.</span></div>
|
|
<div class="line"><a name="l00208"></a><span class="lineno"> 208</span> HANDLE shellcode::load_dll(HANDLE pe_base, PDWORD sh_funs, PCHAR dll_name)</div>
|
|
<div class="line"><a name="l00209"></a><span class="lineno"> 209</span> {</div>
|
|
<div class="line"><a name="l00210"></a><span class="lineno"> 210</span>  <span class="comment">// Resolving the needed functions.</span></div>
|
|
<div class="line"><a name="l00211"></a><span class="lineno"> 211</span>  <span class="keyword">auto</span> fun_ansi_to_wide = <a class="code" href="shellcode_8hpp.html#a0b990d3b5c511aeb8899c7c40c7371bb">sh_resolve</a>(pe_base, sh_funs, ansi_to_wide);</div>
|
|
<div class="line"><a name="l00212"></a><span class="lineno"> 212</span>  <span class="keyword">auto</span> fun_get_dll_handle = <a class="code" href="shellcode_8hpp.html#a0b990d3b5c511aeb8899c7c40c7371bb">sh_resolve</a>(pe_base, sh_funs, get_dll_handle);</div>
|
|
<div class="line"><a name="l00213"></a><span class="lineno"> 213</span>  <span class="keyword">auto</span> fun_get_symbol_ptr = <a class="code" href="shellcode_8hpp.html#a0b990d3b5c511aeb8899c7c40c7371bb">sh_resolve</a>(pe_base, sh_funs, get_symbol_ptr);</div>
|
|
<div class="line"><a name="l00214"></a><span class="lineno"> 214</span>  <span class="keyword">auto</span> fun_wstr_len = <a class="code" href="shellcode_8hpp.html#a0b990d3b5c511aeb8899c7c40c7371bb">sh_resolve</a>(pe_base, sh_funs, wstr_len);</div>
|
|
<div class="line"><a name="l00215"></a><span class="lineno"> 215</span>  <span class="keyword">auto</span> fun_hash_string = <a class="code" href="shellcode_8hpp.html#a0b990d3b5c511aeb8899c7c40c7371bb">sh_resolve</a>(pe_base, sh_funs, hash_string);</div>
|
|
<div class="line"><a name="l00216"></a><span class="lineno"> 216</span>  </div>
|
|
<div class="line"><a name="l00217"></a><span class="lineno"> 217</span>  <span class="comment">// Converting the dll name.</span></div>
|
|
<div class="line"><a name="l00218"></a><span class="lineno"> 218</span>  WCHAR dll_buffer[MAX_PATH];</div>
|
|
<div class="line"><a name="l00219"></a><span class="lineno"> 219</span>  fun_ansi_to_wide(dll_name, dll_buffer, <span class="keyword">sizeof</span>(dll_buffer));</div>
|
|
<div class="line"><a name="l00220"></a><span class="lineno"> 220</span>  </div>
|
|
<div class="line"><a name="l00221"></a><span class="lineno"> 221</span>  <span class="comment">// Quering the ldr first.</span></div>
|
|
<div class="line"><a name="l00222"></a><span class="lineno"> 222</span>  HANDLE h_dll = fun_get_dll_handle(pe_base, sh_funs, dll_buffer);</div>
|
|
<div class="line"><a name="l00223"></a><span class="lineno"> 223</span>  <span class="keywordflow">if</span> (h_dll) <span class="keywordflow">return</span> h_dll;</div>
|
|
<div class="line"><a name="l00224"></a><span class="lineno"> 224</span>  </div>
|
|
<div class="line"><a name="l00225"></a><span class="lineno"> 225</span>  <span class="comment">// Getting the base of the ntdll.</span></div>
|
|
<div class="line"><a name="l00226"></a><span class="lineno"> 226</span>  WCHAR ntdll_name[] = { L<span class="charliteral">'n'</span>, L<span class="charliteral">'t'</span>, L<span class="charliteral">'d'</span>, L<span class="charliteral">'l'</span>, L<span class="charliteral">'l'</span>, L<span class="charliteral">'.'</span>, L<span class="charliteral">'d'</span>, L<span class="charliteral">'l'</span>, L<span class="charliteral">'l'</span>, L<span class="charliteral">'\0'</span> };</div>
|
|
<div class="line"><a name="l00227"></a><span class="lineno"> 227</span>  HANDLE h_ntdll = fun_get_dll_handle(pe_base, sh_funs, ntdll_name);</div>
|
|
<div class="line"><a name="l00228"></a><span class="lineno"> 228</span>  <span class="keywordflow">if</span> (!h_ntdll) <span class="keywordflow">return</span> NULL;</div>
|
|
<div class="line"><a name="l00229"></a><span class="lineno"> 229</span>  </div>
|
|
<div class="line"><a name="l00230"></a><span class="lineno"> 230</span>  <span class="comment">// Resolving `LdrLoadDll` to load the new dll.</span></div>
|
|
<div class="line"><a name="l00231"></a><span class="lineno"> 231</span>  u_sym_info ldr_load_dll_info;</div>
|
|
<div class="line"><a name="l00232"></a><span class="lineno"> 232</span>  CHAR ldrloaddll_name[] = { <span class="charliteral">'L'</span>, <span class="charliteral">'d'</span>, <span class="charliteral">'r'</span>, <span class="charliteral">'L'</span>, <span class="charliteral">'o'</span>, <span class="charliteral">'a'</span>, <span class="charliteral">'d'</span>, <span class="charliteral">'D'</span>, <span class="charliteral">'l'</span>, <span class="charliteral">'l'</span>, <span class="charliteral">'\0'</span> };</div>
|
|
<div class="line"><a name="l00233"></a><span class="lineno"> 233</span>  ldr_load_dll_info.sym_hash = fun_hash_string(ldrloaddll_name);</div>
|
|
<div class="line"><a name="l00234"></a><span class="lineno"> 234</span>  pLdrLoadDll fLdrLoadDll = (pLdrLoadDll)fun_get_symbol_ptr(pe_base, sh_funs, h_ntdll, ldr_load_dll_info, TRUE);</div>
|
|
<div class="line"><a name="l00235"></a><span class="lineno"> 235</span>  <span class="keywordflow">if</span> (fLdrLoadDll == NULL) {</div>
|
|
<div class="line"><a name="l00236"></a><span class="lineno"> 236</span>  <span class="keywordflow">return</span> NULL;</div>
|
|
<div class="line"><a name="l00237"></a><span class="lineno"> 237</span>  };</div>
|
|
<div class="line"><a name="l00238"></a><span class="lineno"> 238</span>  </div>
|
|
<div class="line"><a name="l00239"></a><span class="lineno"> 239</span>  <span class="comment">// Loading the required dll using `LdrLoadDll`.</span></div>
|
|
<div class="line"><a name="l00240"></a><span class="lineno"> 240</span>  UNICODE_STRING u_module = {</div>
|
|
<div class="line"><a name="l00241"></a><span class="lineno"> 241</span>  (USHORT)(fun_wstr_len(dll_buffer) * 2),</div>
|
|
<div class="line"><a name="l00242"></a><span class="lineno"> 242</span>  (USHORT)(fun_wstr_len(dll_buffer) * 2 + 2),</div>
|
|
<div class="line"><a name="l00243"></a><span class="lineno"> 243</span>  (PWCHAR)dll_buffer</div>
|
|
<div class="line"><a name="l00244"></a><span class="lineno"> 244</span>  };</div>
|
|
<div class="line"><a name="l00245"></a><span class="lineno"> 245</span>  </div>
|
|
<div class="line"><a name="l00246"></a><span class="lineno"> 246</span>  <span class="comment">// Loading the dll.</span></div>
|
|
<div class="line"><a name="l00247"></a><span class="lineno"> 247</span>  <span class="keywordflow">if</span> (!NT_SUCCESS(fLdrLoadDll(</div>
|
|
<div class="line"><a name="l00248"></a><span class="lineno"> 248</span>  NULL, 0,</div>
|
|
<div class="line"><a name="l00249"></a><span class="lineno"> 249</span>  &u_module,</div>
|
|
<div class="line"><a name="l00250"></a><span class="lineno"> 250</span>  &h_dll</div>
|
|
<div class="line"><a name="l00251"></a><span class="lineno"> 251</span>  ))) <span class="keywordflow">return</span> NULL;</div>
|
|
<div class="line"><a name="l00252"></a><span class="lineno"> 252</span>  </div>
|
|
<div class="line"><a name="l00253"></a><span class="lineno"> 253</span>  <span class="comment">// Return the loaded module base.</span></div>
|
|
<div class="line"><a name="l00254"></a><span class="lineno"> 254</span>  <span class="keywordflow">return</span> h_dll;</div>
|
|
<div class="line"><a name="l00255"></a><span class="lineno"> 255</span> };</div>
|
|
<div class="line"><a name="l00256"></a><span class="lineno"> 256</span>  </div>
|
|
<div class="line"><a name="l00257"></a><span class="lineno"> 257</span> <span class="comment">// Resolve the api set schema for the dll name.</span></div>
|
|
<div class="line"><a name="l00258"></a><span class="lineno"> 258</span> BOOL shellcode::resolve_api_set(HANDLE pe_base, PDWORD sh_funs, PVOID schema_map, PCWSTR virtual_dll, PWCHAR real_dll)</div>
|
|
<div class="line"><a name="l00259"></a><span class="lineno"> 259</span> {</div>
|
|
<div class="line"><a name="l00260"></a><span class="lineno"> 260</span>  <span class="comment">// Resolving the needed functions.</span></div>
|
|
<div class="line"><a name="l00261"></a><span class="lineno"> 261</span>  <span class="keyword">auto</span> fun_wstr_cpy = <a class="code" href="shellcode_8hpp.html#a0b990d3b5c511aeb8899c7c40c7371bb">sh_resolve</a>(pe_base, sh_funs, wstr_cpy);</div>
|
|
<div class="line"><a name="l00262"></a><span class="lineno"> 262</span>  <span class="keyword">auto</span> fun_wstr_i_cmp = <a class="code" href="shellcode_8hpp.html#a0b990d3b5c511aeb8899c7c40c7371bb">sh_resolve</a>(pe_base, sh_funs, wstr_i_cmp);</div>
|
|
<div class="line"><a name="l00263"></a><span class="lineno"> 263</span>  </div>
|
|
<div class="line"><a name="l00264"></a><span class="lineno"> 264</span>  <span class="comment">// Reading the version.</span></div>
|
|
<div class="line"><a name="l00265"></a><span class="lineno"> 265</span>  DWORD Version = *(DWORD*)schema_map;</div>
|
|
<div class="line"><a name="l00266"></a><span class="lineno"> 266</span>  </div>
|
|
<div class="line"><a name="l00267"></a><span class="lineno"> 267</span>  <span class="comment">// Two versions with two methods.</span></div>
|
|
<div class="line"><a name="l00268"></a><span class="lineno"> 268</span>  <span class="keywordflow">if</span> (Version >= 3) {</div>
|
|
<div class="line"><a name="l00269"></a><span class="lineno"> 269</span>  </div>
|
|
<div class="line"><a name="l00270"></a><span class="lineno"> 270</span>  <span class="comment">// Use the proper structures.</span></div>
|
|
<div class="line"><a name="l00271"></a><span class="lineno"> 271</span>  PApiSetHeader63 pHeader = (PApiSetHeader63)schema_map;</div>
|
|
<div class="line"><a name="l00272"></a><span class="lineno"> 272</span>  PApisetNameEntry pApiSets = (PApisetNameEntry)((PBYTE)schema_map + pHeader->NamesOffset);</div>
|
|
<div class="line"><a name="l00273"></a><span class="lineno"> 273</span>  </div>
|
|
<div class="line"><a name="l00274"></a><span class="lineno"> 274</span>  <span class="comment">// Use binary search to enumerate the dlls.</span></div>
|
|
<div class="line"><a name="l00275"></a><span class="lineno"> 275</span>  INT Start, End, Next, CmpResult;</div>
|
|
<div class="line"><a name="l00276"></a><span class="lineno"> 276</span>  Start = Next = 0;</div>
|
|
<div class="line"><a name="l00277"></a><span class="lineno"> 277</span>  End = (DWORD)pHeader->NumberOfApisets - 1;</div>
|
|
<div class="line"><a name="l00278"></a><span class="lineno"> 278</span>  </div>
|
|
<div class="line"><a name="l00279"></a><span class="lineno"> 279</span>  <span class="comment">// Binary search loop.</span></div>
|
|
<div class="line"><a name="l00280"></a><span class="lineno"> 280</span>  while (End >= Start) {</div>
|
|
<div class="line"><a name="l00281"></a><span class="lineno"> 281</span>  </div>
|
|
<div class="line"><a name="l00282"></a><span class="lineno"> 282</span>  Next = (Start + End) >> 1;</div>
|
|
<div class="line"><a name="l00283"></a><span class="lineno"> 283</span>  PWCHAR VirtualDll = (PWCHAR)((PBYTE)schema_map + pApiSets[Next].Offset);</div>
|
|
<div class="line"><a name="l00284"></a><span class="lineno"> 284</span>  </div>
|
|
<div class="line"><a name="l00285"></a><span class="lineno"> 285</span>  <span class="comment">// Compare and conditions.</span></div>
|
|
<div class="line"><a name="l00286"></a><span class="lineno"> 286</span>  CmpResult = fun_wstr_i_cmp(VirtualDll, virtual_dll, pApiSets[Next].Size / 2);</div>
|
|
<div class="line"><a name="l00287"></a><span class="lineno"> 287</span>  <span class="keywordflow">if</span> (CmpResult < 0)</div>
|
|
<div class="line"><a name="l00288"></a><span class="lineno"> 288</span>  End = Next - 1;</div>
|
|
<div class="line"><a name="l00289"></a><span class="lineno"> 289</span>  <span class="keywordflow">else</span> <span class="keywordflow">if</span> (CmpResult > 0)</div>
|
|
<div class="line"><a name="l00290"></a><span class="lineno"> 290</span>  Start = Next + 1;</div>
|
|
<div class="line"><a name="l00291"></a><span class="lineno"> 291</span>  <span class="keywordflow">else</span> <span class="keywordflow">break</span>;</div>
|
|
<div class="line"><a name="l00292"></a><span class="lineno"> 292</span>  };</div>
|
|
<div class="line"><a name="l00293"></a><span class="lineno"> 293</span>  </div>
|
|
<div class="line"><a name="l00294"></a><span class="lineno"> 294</span>  <span class="comment">// We've found the right entry.</span></div>
|
|
<div class="line"><a name="l00295"></a><span class="lineno"> 295</span>  <span class="keywordflow">if</span> (End >= Start && pApiSets[Next].NumberOfHosts) {</div>
|
|
<div class="line"><a name="l00296"></a><span class="lineno"> 296</span>  </div>
|
|
<div class="line"><a name="l00297"></a><span class="lineno"> 297</span>  <span class="comment">// Get the value.</span></div>
|
|
<div class="line"><a name="l00298"></a><span class="lineno"> 298</span>  PApisetValueEntry pValue = (PApisetValueEntry)((PBYTE)schema_map + pApiSets[Next].HostOffset);</div>
|
|
<div class="line"><a name="l00299"></a><span class="lineno"> 299</span>  pValue += pApiSets[Next].NumberOfHosts - 1;</div>
|
|
<div class="line"><a name="l00300"></a><span class="lineno"> 300</span>  </div>
|
|
<div class="line"><a name="l00301"></a><span class="lineno"> 301</span>  <span class="comment">// Fill the buffer address and return true.</span></div>
|
|
<div class="line"><a name="l00302"></a><span class="lineno"> 302</span>  fun_wstr_cpy(real_dll, (PWCHAR)((PBYTE)schema_map + pValue->ValueOffset),</div>
|
|
<div class="line"><a name="l00303"></a><span class="lineno"> 303</span>  pValue->ValueLength / 2);</div>
|
|
<div class="line"><a name="l00304"></a><span class="lineno"> 304</span>  <span class="keywordflow">return</span> TRUE;</div>
|
|
<div class="line"><a name="l00305"></a><span class="lineno"> 305</span>  };</div>
|
|
<div class="line"><a name="l00306"></a><span class="lineno"> 306</span>  }</div>
|
|
<div class="line"><a name="l00307"></a><span class="lineno"> 307</span>  <span class="keywordflow">else</span> {</div>
|
|
<div class="line"><a name="l00308"></a><span class="lineno"> 308</span>  </div>
|
|
<div class="line"><a name="l00309"></a><span class="lineno"> 309</span>  <span class="comment">// Use the proper structures.</span></div>
|
|
<div class="line"><a name="l00310"></a><span class="lineno"> 310</span>  PApiSetHeader6 pHeader = (PApiSetHeader6)schema_map;</div>
|
|
<div class="line"><a name="l00311"></a><span class="lineno"> 311</span>  PApisetNameEntry2 pApiSets = (PApisetNameEntry2)((PBYTE)schema_map + <span class="keyword">sizeof</span>(ApiSetHeader6));</div>
|
|
<div class="line"><a name="l00312"></a><span class="lineno"> 312</span>  </div>
|
|
<div class="line"><a name="l00313"></a><span class="lineno"> 313</span>  <span class="comment">// Use binary search to enumerate the dlls.</span></div>
|
|
<div class="line"><a name="l00314"></a><span class="lineno"> 314</span>  <span class="keywordtype">int</span> Start, End, Next, CmpResult;</div>
|
|
<div class="line"><a name="l00315"></a><span class="lineno"> 315</span>  Start = Next = 0;</div>
|
|
<div class="line"><a name="l00316"></a><span class="lineno"> 316</span>  End = (DWORD)pHeader->Count - 1;</div>
|
|
<div class="line"><a name="l00317"></a><span class="lineno"> 317</span>  </div>
|
|
<div class="line"><a name="l00318"></a><span class="lineno"> 318</span>  <span class="comment">// Binary search loop.</span></div>
|
|
<div class="line"><a name="l00319"></a><span class="lineno"> 319</span>  while (End >= Start) {</div>
|
|
<div class="line"><a name="l00320"></a><span class="lineno"> 320</span>  </div>
|
|
<div class="line"><a name="l00321"></a><span class="lineno"> 321</span>  Next = (Start + End) >> 1;</div>
|
|
<div class="line"><a name="l00322"></a><span class="lineno"> 322</span>  PWCHAR VirtualDll = (PWCHAR)((PBYTE)schema_map + pApiSets[Next].NameOffset);</div>
|
|
<div class="line"><a name="l00323"></a><span class="lineno"> 323</span>  </div>
|
|
<div class="line"><a name="l00324"></a><span class="lineno"> 324</span>  <span class="comment">// Compare and conditions.</span></div>
|
|
<div class="line"><a name="l00325"></a><span class="lineno"> 325</span>  CmpResult = fun_wstr_i_cmp(VirtualDll, virtual_dll, pApiSets[Next].NameLength / 2);</div>
|
|
<div class="line"><a name="l00326"></a><span class="lineno"> 326</span>  <span class="keywordflow">if</span> (CmpResult < 0)</div>
|
|
<div class="line"><a name="l00327"></a><span class="lineno"> 327</span>  End = Next - 1;</div>
|
|
<div class="line"><a name="l00328"></a><span class="lineno"> 328</span>  <span class="keywordflow">else</span> <span class="keywordflow">if</span> (CmpResult > 0)</div>
|
|
<div class="line"><a name="l00329"></a><span class="lineno"> 329</span>  Start = Next + 1;</div>
|
|
<div class="line"><a name="l00330"></a><span class="lineno"> 330</span>  <span class="keywordflow">else</span> <span class="keywordflow">break</span>;</div>
|
|
<div class="line"><a name="l00331"></a><span class="lineno"> 331</span>  };</div>
|
|
<div class="line"><a name="l00332"></a><span class="lineno"> 332</span>  </div>
|
|
<div class="line"><a name="l00333"></a><span class="lineno"> 333</span>  <span class="comment">// We've found the right entry and if there are any availible values.</span></div>
|
|
<div class="line"><a name="l00334"></a><span class="lineno"> 334</span>  DWORD ValuesCount;</div>
|
|
<div class="line"><a name="l00335"></a><span class="lineno"> 335</span>  <span class="keywordflow">if</span> (End >= Start && (ValuesCount = *(DWORD*)((PBYTE)schema_map + pApiSets[Next].DataOffset))) {</div>
|
|
<div class="line"><a name="l00336"></a><span class="lineno"> 336</span>  </div>
|
|
<div class="line"><a name="l00337"></a><span class="lineno"> 337</span>  <span class="comment">// Get the value.</span></div>
|
|
<div class="line"><a name="l00338"></a><span class="lineno"> 338</span>  PValuesEntry2 pValue = (PValuesEntry2)((PBYTE)schema_map + pApiSets[Next].DataOffset);</div>
|
|
<div class="line"><a name="l00339"></a><span class="lineno"> 339</span>  pValue += ValuesCount - 1;</div>
|
|
<div class="line"><a name="l00340"></a><span class="lineno"> 340</span>  </div>
|
|
<div class="line"><a name="l00341"></a><span class="lineno"> 341</span>  <span class="comment">// Fill the buffer address and return True.</span></div>
|
|
<div class="line"><a name="l00342"></a><span class="lineno"> 342</span>  fun_wstr_cpy(real_dll, (PWCHAR)((PBYTE)schema_map + pValue->ValueOffset),</div>
|
|
<div class="line"><a name="l00343"></a><span class="lineno"> 343</span>  pValue->ValueLength / 2);</div>
|
|
<div class="line"><a name="l00344"></a><span class="lineno"> 344</span>  <span class="keywordflow">return</span> TRUE;</div>
|
|
<div class="line"><a name="l00345"></a><span class="lineno"> 345</span>  };</div>
|
|
<div class="line"><a name="l00346"></a><span class="lineno"> 346</span>  };</div>
|
|
<div class="line"><a name="l00347"></a><span class="lineno"> 347</span>  </div>
|
|
<div class="line"><a name="l00348"></a><span class="lineno"> 348</span>  <span class="comment">// Not found.</span></div>
|
|
<div class="line"><a name="l00349"></a><span class="lineno"> 349</span>  <span class="keywordflow">return</span> FALSE;</div>
|
|
<div class="line"><a name="l00350"></a><span class="lineno"> 350</span> };</div>
|
|
<div class="line"><a name="l00351"></a><span class="lineno"> 351</span>  </div>
|
|
<div class="line"><a name="l00352"></a><span class="lineno"> 352</span> <span class="comment">// Get the dll base by name.</span></div>
|
|
<div class="line"><a name="l00353"></a><span class="lineno"> 353</span> PVOID shellcode::get_symbol_ptr(HANDLE pe_base, PDWORD sh_funs, HANDLE dll_handle, u_sym_info sym_info, BOOL by_name)</div>
|
|
<div class="line"><a name="l00354"></a><span class="lineno"> 354</span> {</div>
|
|
<div class="line"><a name="l00355"></a><span class="lineno"> 355</span>  <span class="comment">// Resolving the needed functions.</span></div>
|
|
<div class="line"><a name="l00356"></a><span class="lineno"> 356</span>  <span class="keyword">auto</span> fun_hash_string = <a class="code" href="shellcode_8hpp.html#a0b990d3b5c511aeb8899c7c40c7371bb">sh_resolve</a>(pe_base, sh_funs, hash_string);</div>
|
|
<div class="line"><a name="l00357"></a><span class="lineno"> 357</span>  <span class="keyword">auto</span> fun_str_cpy = <a class="code" href="shellcode_8hpp.html#a0b990d3b5c511aeb8899c7c40c7371bb">sh_resolve</a>(pe_base, sh_funs, str_cpy);</div>
|
|
<div class="line"><a name="l00358"></a><span class="lineno"> 358</span>  <span class="keyword">auto</span> fun_str_chr = <a class="code" href="shellcode_8hpp.html#a0b990d3b5c511aeb8899c7c40c7371bb">sh_resolve</a>(pe_base, sh_funs, str_chr);</div>
|
|
<div class="line"><a name="l00359"></a><span class="lineno"> 359</span>  <span class="keyword">auto</span> fun_load_dll = <a class="code" href="shellcode_8hpp.html#a0b990d3b5c511aeb8899c7c40c7371bb">sh_resolve</a>(pe_base, sh_funs, load_dll);</div>
|
|
<div class="line"><a name="l00360"></a><span class="lineno"> 360</span>  <span class="keyword">auto</span> fun_get_symbol_ptr = <a class="code" href="shellcode_8hpp.html#a0b990d3b5c511aeb8899c7c40c7371bb">sh_resolve</a>(pe_base, sh_funs, get_symbol_ptr);</div>
|
|
<div class="line"><a name="l00361"></a><span class="lineno"> 361</span>  <span class="keyword">auto</span> fun_str_toi = <a class="code" href="shellcode_8hpp.html#a0b990d3b5c511aeb8899c7c40c7371bb">sh_resolve</a>(pe_base, sh_funs, str_toi);</div>
|
|
<div class="line"><a name="l00362"></a><span class="lineno"> 362</span>  </div>
|
|
<div class="line"><a name="l00363"></a><span class="lineno"> 363</span>  <span class="comment">// Dereferencing the headers.</span></div>
|
|
<div class="line"><a name="l00364"></a><span class="lineno"> 364</span>  PIMAGE_DOS_HEADER dos_hdr = (PIMAGE_DOS_HEADER)dll_handle;</div>
|
|
<div class="line"><a name="l00365"></a><span class="lineno"> 365</span>  PIMAGE_NT_HEADERS nt_hdrs = (PIMAGE_NT_HEADERS)((PBYTE)dll_handle + dos_hdr->e_lfanew);</div>
|
|
<div class="line"><a name="l00366"></a><span class="lineno"> 366</span>  PIMAGE_OPTIONAL_HEADER opt_hdr = &nt_hdrs->OptionalHeader;</div>
|
|
<div class="line"><a name="l00367"></a><span class="lineno"> 367</span>  </div>
|
|
<div class="line"><a name="l00368"></a><span class="lineno"> 368</span>  <span class="comment">// Dereferencing the export table data directory.</span></div>
|
|
<div class="line"><a name="l00369"></a><span class="lineno"> 369</span>  PIMAGE_DATA_DIRECTORY data_dir = &opt_hdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];</div>
|
|
<div class="line"><a name="l00370"></a><span class="lineno"> 370</span>  </div>
|
|
<div class="line"><a name="l00371"></a><span class="lineno"> 371</span>  <span class="comment">// Check if exists.</span></div>
|
|
<div class="line"><a name="l00372"></a><span class="lineno"> 372</span>  <span class="keywordflow">if</span> (!data_dir->VirtualAddress || !data_dir->Size) {</div>
|
|
<div class="line"><a name="l00373"></a><span class="lineno"> 373</span>  <span class="keywordflow">return</span> NULL;</div>
|
|
<div class="line"><a name="l00374"></a><span class="lineno"> 374</span>  };</div>
|
|
<div class="line"><a name="l00375"></a><span class="lineno"> 375</span>  </div>
|
|
<div class="line"><a name="l00376"></a><span class="lineno"> 376</span>  <span class="comment">// Get the export table pointer.</span></div>
|
|
<div class="line"><a name="l00377"></a><span class="lineno"> 377</span>  PIMAGE_EXPORT_DIRECTORY export_table = (PIMAGE_EXPORT_DIRECTORY)((PBYTE)dll_handle +</div>
|
|
<div class="line"><a name="l00378"></a><span class="lineno"> 378</span>  data_dir->VirtualAddress);</div>
|
|
<div class="line"><a name="l00379"></a><span class="lineno"> 379</span>  </div>
|
|
<div class="line"><a name="l00380"></a><span class="lineno"> 380</span>  <span class="comment">// In case an ordinal is resolved.</span></div>
|
|
<div class="line"><a name="l00381"></a><span class="lineno"> 381</span>  DWORD f_address;</div>
|
|
<div class="line"><a name="l00382"></a><span class="lineno"> 382</span>  <span class="keywordflow">if</span> (!by_name)</div>
|
|
<div class="line"><a name="l00383"></a><span class="lineno"> 383</span>  {</div>
|
|
<div class="line"><a name="l00384"></a><span class="lineno"> 384</span>  <span class="comment">// Invalid ordinal.</span></div>
|
|
<div class="line"><a name="l00385"></a><span class="lineno"> 385</span>  <span class="keywordflow">if</span> (sym_info.sym_ord < export_table->Base ||</div>
|
|
<div class="line"><a name="l00386"></a><span class="lineno"> 386</span>  sym_info.sym_ord >= export_table->Base + export_table->NumberOfFunctions)</div>
|
|
<div class="line"><a name="l00387"></a><span class="lineno"> 387</span>  <span class="keywordflow">return</span> NULL;</div>
|
|
<div class="line"><a name="l00388"></a><span class="lineno"> 388</span>  </div>
|
|
<div class="line"><a name="l00389"></a><span class="lineno"> 389</span>  <span class="comment">// Getting the address directly.</span></div>
|
|
<div class="line"><a name="l00390"></a><span class="lineno"> 390</span>  f_address = ((DWORD*)((PBYTE)dll_handle + export_table->AddressOfFunctions))</div>
|
|
<div class="line"><a name="l00391"></a><span class="lineno"> 391</span>  [sym_info.sym_ord - export_table->Base];</div>
|
|
<div class="line"><a name="l00392"></a><span class="lineno"> 392</span>  }</div>
|
|
<div class="line"><a name="l00393"></a><span class="lineno"> 393</span>  <span class="keywordflow">else</span></div>
|
|
<div class="line"><a name="l00394"></a><span class="lineno"> 394</span>  {</div>
|
|
<div class="line"><a name="l00395"></a><span class="lineno"> 395</span>  <span class="comment">// My be no names exported.</span></div>
|
|
<div class="line"><a name="l00396"></a><span class="lineno"> 396</span>  <span class="keywordflow">if</span> (!export_table->AddressOfNames) {</div>
|
|
<div class="line"><a name="l00397"></a><span class="lineno"> 397</span>  <span class="keywordflow">return</span> NULL;</div>
|
|
<div class="line"><a name="l00398"></a><span class="lineno"> 398</span>  };</div>
|
|
<div class="line"><a name="l00399"></a><span class="lineno"> 399</span>  </div>
|
|
<div class="line"><a name="l00400"></a><span class="lineno"> 400</span>  <span class="comment">// Resolve by name.</span></div>
|
|
<div class="line"><a name="l00401"></a><span class="lineno"> 401</span>  <span class="keywordtype">size_t</span> idx = 0;</div>
|
|
<div class="line"><a name="l00402"></a><span class="lineno"> 402</span>  DWORD* p_names = (DWORD*)((PBYTE)dll_handle +</div>
|
|
<div class="line"><a name="l00403"></a><span class="lineno"> 403</span>  export_table->AddressOfNames);</div>
|
|
<div class="line"><a name="l00404"></a><span class="lineno"> 404</span>  <span class="keywordflow">for</span> (; idx < export_table->NumberOfNames; idx++)</div>
|
|
<div class="line"><a name="l00405"></a><span class="lineno"> 405</span>  {</div>
|
|
<div class="line"><a name="l00406"></a><span class="lineno"> 406</span>  <span class="comment">// Get the name.</span></div>
|
|
<div class="line"><a name="l00407"></a><span class="lineno"> 407</span>  PCHAR sym_name = (PCHAR)dll_handle + p_names[idx];</div>
|
|
<div class="line"><a name="l00408"></a><span class="lineno"> 408</span>  <span class="keywordflow">if</span> (fun_hash_string(sym_name) != sym_info.sym_hash)</div>
|
|
<div class="line"><a name="l00409"></a><span class="lineno"> 409</span>  <span class="keywordflow">continue</span>;</div>
|
|
<div class="line"><a name="l00410"></a><span class="lineno"> 410</span>  </div>
|
|
<div class="line"><a name="l00411"></a><span class="lineno"> 411</span>  <span class="comment">// Found.</span></div>
|
|
<div class="line"><a name="l00412"></a><span class="lineno"> 412</span>  f_address = ((DWORD*)((PBYTE)dll_handle + export_table->AddressOfFunctions))[</div>
|
|
<div class="line"><a name="l00413"></a><span class="lineno"> 413</span>  ((PWORD)((PBYTE)dll_handle + export_table->AddressOfNameOrdinals))[idx]</div>
|
|
<div class="line"><a name="l00414"></a><span class="lineno"> 414</span>  ];</div>
|
|
<div class="line"><a name="l00415"></a><span class="lineno"> 415</span>  <span class="keywordflow">break</span>;</div>
|
|
<div class="line"><a name="l00416"></a><span class="lineno"> 416</span>  };</div>
|
|
<div class="line"><a name="l00417"></a><span class="lineno"> 417</span>  </div>
|
|
<div class="line"><a name="l00418"></a><span class="lineno"> 418</span>  <span class="comment">// Test if not found.</span></div>
|
|
<div class="line"><a name="l00419"></a><span class="lineno"> 419</span>  <span class="keywordflow">if</span> (idx == export_table->NumberOfNames)</div>
|
|
<div class="line"><a name="l00420"></a><span class="lineno"> 420</span>  {</div>
|
|
<div class="line"><a name="l00421"></a><span class="lineno"> 421</span>  <span class="comment">// Not found.</span></div>
|
|
<div class="line"><a name="l00422"></a><span class="lineno"> 422</span>  <span class="keywordflow">return</span> NULL;</div>
|
|
<div class="line"><a name="l00423"></a><span class="lineno"> 423</span>  };</div>
|
|
<div class="line"><a name="l00424"></a><span class="lineno"> 424</span>  };</div>
|
|
<div class="line"><a name="l00425"></a><span class="lineno"> 425</span>  </div>
|
|
<div class="line"><a name="l00426"></a><span class="lineno"> 426</span>  <span class="comment">// Test if the symbol is forwarded.</span></div>
|
|
<div class="line"><a name="l00427"></a><span class="lineno"> 427</span>  PVOID p_address = (PBYTE)dll_handle + f_address;</div>
|
|
<div class="line"><a name="l00428"></a><span class="lineno"> 428</span>  <span class="keywordflow">if</span> (f_address >= data_dir->VirtualAddress &&</div>
|
|
<div class="line"><a name="l00429"></a><span class="lineno"> 429</span>  f_address < data_dir->VirtualAddress + data_dir->Size)</div>
|
|
<div class="line"><a name="l00430"></a><span class="lineno"> 430</span>  {</div>
|
|
<div class="line"><a name="l00431"></a><span class="lineno"> 431</span>  <span class="comment">// Reading the dll name and the function name.</span></div>
|
|
<div class="line"><a name="l00432"></a><span class="lineno"> 432</span>  CHAR dll_name[MAX_PATH], sym_name[MAX_PATH];</div>
|
|
<div class="line"><a name="l00433"></a><span class="lineno"> 433</span>  fun_str_cpy(dll_name, (PCHAR)p_address);</div>
|
|
<div class="line"><a name="l00434"></a><span class="lineno"> 434</span>  </div>
|
|
<div class="line"><a name="l00435"></a><span class="lineno"> 435</span>  <span class="comment">// Appending ".dll".</span></div>
|
|
<div class="line"><a name="l00436"></a><span class="lineno"> 436</span>  PCHAR dot_loc = fun_str_chr(dll_name, <span class="charliteral">'.'</span>);</div>
|
|
<div class="line"><a name="l00437"></a><span class="lineno"> 437</span>  fun_str_cpy(sym_name, ++dot_loc);</div>
|
|
<div class="line"><a name="l00438"></a><span class="lineno"> 438</span>  *dot_loc++ = <span class="charliteral">'d'</span>;</div>
|
|
<div class="line"><a name="l00439"></a><span class="lineno"> 439</span>  *dot_loc++ = <span class="charliteral">'l'</span>;</div>
|
|
<div class="line"><a name="l00440"></a><span class="lineno"> 440</span>  *dot_loc++ = <span class="charliteral">'l'</span>;</div>
|
|
<div class="line"><a name="l00441"></a><span class="lineno"> 441</span>  *dot_loc++ = <span class="charliteral">'\0'</span>;</div>
|
|
<div class="line"><a name="l00442"></a><span class="lineno"> 442</span>  </div>
|
|
<div class="line"><a name="l00443"></a><span class="lineno"> 443</span>  <span class="comment">// Load the dll.</span></div>
|
|
<div class="line"><a name="l00444"></a><span class="lineno"> 444</span>  HANDLE h_forward = fun_load_dll(pe_base, sh_funs, dll_name);</div>
|
|
<div class="line"><a name="l00445"></a><span class="lineno"> 445</span>  <span class="keywordflow">if</span> (!h_forward) <span class="keywordflow">return</span> NULL;</div>
|
|
<div class="line"><a name="l00446"></a><span class="lineno"> 446</span>  </div>
|
|
<div class="line"><a name="l00447"></a><span class="lineno"> 447</span>  <span class="comment">// Re make the resolve.</span></div>
|
|
<div class="line"><a name="l00448"></a><span class="lineno"> 448</span>  u_sym_info sym_data;</div>
|
|
<div class="line"><a name="l00449"></a><span class="lineno"> 449</span>  <span class="keywordflow">if</span> (*sym_name == <span class="charliteral">'#'</span>) {</div>
|
|
<div class="line"><a name="l00450"></a><span class="lineno"> 450</span>  <span class="comment">// By ordinal.</span></div>
|
|
<div class="line"><a name="l00451"></a><span class="lineno"> 451</span>  sym_data.sym_ord = (WORD)fun_str_toi(&sym_name[1]);</div>
|
|
<div class="line"><a name="l00452"></a><span class="lineno"> 452</span>  p_address = fun_get_symbol_ptr(pe_base, sh_funs, h_forward, sym_data, FALSE);</div>
|
|
<div class="line"><a name="l00453"></a><span class="lineno"> 453</span>  }</div>
|
|
<div class="line"><a name="l00454"></a><span class="lineno"> 454</span>  <span class="keywordflow">else</span></div>
|
|
<div class="line"><a name="l00455"></a><span class="lineno"> 455</span>  {</div>
|
|
<div class="line"><a name="l00456"></a><span class="lineno"> 456</span>  <span class="comment">// By name.</span></div>
|
|
<div class="line"><a name="l00457"></a><span class="lineno"> 457</span>  sym_data.sym_hash = fun_hash_string(sym_name);</div>
|
|
<div class="line"><a name="l00458"></a><span class="lineno"> 458</span>  p_address = fun_get_symbol_ptr(pe_base, sh_funs, h_forward, sym_data, TRUE);</div>
|
|
<div class="line"><a name="l00459"></a><span class="lineno"> 459</span>  };</div>
|
|
<div class="line"><a name="l00460"></a><span class="lineno"> 460</span>  };</div>
|
|
<div class="line"><a name="l00461"></a><span class="lineno"> 461</span>  </div>
|
|
<div class="line"><a name="l00462"></a><span class="lineno"> 462</span>  <span class="comment">// Resolved.</span></div>
|
|
<div class="line"><a name="l00463"></a><span class="lineno"> 463</span>  <span class="keywordflow">return</span> p_address;</div>
|
|
<div class="line"><a name="l00464"></a><span class="lineno"> 464</span> };</div>
|
|
<div class="line"><a name="l00465"></a><span class="lineno"> 465</span>  </div>
|
|
<div class="line"><a name="l00466"></a><span class="lineno"> 466</span> <span class="comment">// Load the obfuscated symbols at runtime.</span></div>
|
|
<div class="line"><a name="l00467"></a><span class="lineno"> 467</span> VOID shellcode::load_syms(HANDLE pe_base, DWORD sh_funs_rva, DWORD syms_rva)</div>
|
|
<div class="line"><a name="l00468"></a><span class="lineno"> 468</span> {</div>
|
|
<div class="line"><a name="l00469"></a><span class="lineno"> 469</span>  <span class="comment">// Calculate the pointers.</span></div>
|
|
<div class="line"><a name="l00470"></a><span class="lineno"> 470</span>  PDWORD sh_funs = (PDWORD)((PBYTE)pe_base + sh_funs_rva);</div>
|
|
<div class="line"><a name="l00471"></a><span class="lineno"> 471</span>  p_obfuscated_sym syms = (p_obfuscated_sym)((PBYTE)pe_base + syms_rva);</div>
|
|
<div class="line"><a name="l00472"></a><span class="lineno"> 472</span>  </div>
|
|
<div class="line"><a name="l00473"></a><span class="lineno"> 473</span>  <span class="comment">// Resolving the needed functions.</span></div>
|
|
<div class="line"><a name="l00474"></a><span class="lineno"> 474</span>  <span class="keyword">auto</span> fun_load_dll = <a class="code" href="shellcode_8hpp.html#a0b990d3b5c511aeb8899c7c40c7371bb">sh_resolve</a>(pe_base, sh_funs, load_dll);</div>
|
|
<div class="line"><a name="l00475"></a><span class="lineno"> 475</span>  <span class="keyword">auto</span> fun_get_symbol_ptr = <a class="code" href="shellcode_8hpp.html#a0b990d3b5c511aeb8899c7c40c7371bb">sh_resolve</a>(pe_base, sh_funs, get_symbol_ptr);</div>
|
|
<div class="line"><a name="l00476"></a><span class="lineno"> 476</span>  <span class="keyword">auto</span> fun_load_halt = <a class="code" href="shellcode_8hpp.html#a0b990d3b5c511aeb8899c7c40c7371bb">sh_resolve</a>(pe_base, sh_funs, exit);</div>
|
|
<div class="line"><a name="l00477"></a><span class="lineno"> 477</span>  </div>
|
|
<div class="line"><a name="l00478"></a><span class="lineno"> 478</span>  <span class="comment">// Looping on the entries.</span></div>
|
|
<div class="line"><a name="l00479"></a><span class="lineno"> 479</span>  <span class="keywordflow">while</span> (syms->dll_name)</div>
|
|
<div class="line"><a name="l00480"></a><span class="lineno"> 480</span>  {</div>
|
|
<div class="line"><a name="l00481"></a><span class="lineno"> 481</span>  <span class="comment">// Calculate the pointers.</span></div>
|
|
<div class="line"><a name="l00482"></a><span class="lineno"> 482</span>  p_obfuscated_sym p_sym = syms++;</div>
|
|
<div class="line"><a name="l00483"></a><span class="lineno"> 483</span>  PCHAR c_dll_name = (PCHAR)pe_base + p_sym->dll_name;</div>
|
|
<div class="line"><a name="l00484"></a><span class="lineno"> 484</span>  PVOID* p_thunk = (PVOID*)((PBYTE)pe_base + p_sym->sym_thnk);</div>
|
|
<div class="line"><a name="l00485"></a><span class="lineno"> 485</span>  </div>
|
|
<div class="line"><a name="l00486"></a><span class="lineno"> 486</span>  <span class="comment">// Get the loaded dll handle.</span></div>
|
|
<div class="line"><a name="l00487"></a><span class="lineno"> 487</span>  HANDLE dll_handle = fun_load_dll(pe_base, sh_funs, c_dll_name);</div>
|
|
<div class="line"><a name="l00488"></a><span class="lineno"> 488</span>  <span class="keywordflow">if</span> (!dll_handle)</div>
|
|
<div class="line"><a name="l00489"></a><span class="lineno"> 489</span>  {</div>
|
|
<div class="line"><a name="l00490"></a><span class="lineno"> 490</span>  <span class="comment">// The dll is not loaded.</span></div>
|
|
<div class="line"><a name="l00491"></a><span class="lineno"> 491</span>  <span class="keywordflow">return</span> fun_load_halt();</div>
|
|
<div class="line"><a name="l00492"></a><span class="lineno"> 492</span>  };</div>
|
|
<div class="line"><a name="l00493"></a><span class="lineno"> 493</span>  </div>
|
|
<div class="line"><a name="l00494"></a><span class="lineno"> 494</span>  <span class="comment">// Get the symbol address.</span></div>
|
|
<div class="line"><a name="l00495"></a><span class="lineno"> 495</span>  PVOID sym_ptr = fun_get_symbol_ptr(pe_base, sh_funs, dll_handle, p_sym->sym_info, p_sym->by_name);</div>
|
|
<div class="line"><a name="l00496"></a><span class="lineno"> 496</span>  <span class="keywordflow">if</span> (!dll_handle)</div>
|
|
<div class="line"><a name="l00497"></a><span class="lineno"> 497</span>  {</div>
|
|
<div class="line"><a name="l00498"></a><span class="lineno"> 498</span>  <span class="comment">// The symbol is not found.</span></div>
|
|
<div class="line"><a name="l00499"></a><span class="lineno"> 499</span>  <span class="keywordflow">return</span> fun_load_halt();</div>
|
|
<div class="line"><a name="l00500"></a><span class="lineno"> 500</span>  };</div>
|
|
<div class="line"><a name="l00501"></a><span class="lineno"> 501</span>  </div>
|
|
<div class="line"><a name="l00502"></a><span class="lineno"> 502</span>  <span class="comment">// Replace the symbol thunk.</span></div>
|
|
<div class="line"><a name="l00503"></a><span class="lineno"> 503</span>  *p_thunk = sym_ptr;</div>
|
|
<div class="line"><a name="l00504"></a><span class="lineno"> 504</span>  };</div>
|
|
<div class="line"><a name="l00505"></a><span class="lineno"> 505</span> };</div>
|
|
<div class="line"><a name="l00506"></a><span class="lineno"> 506</span>  </div>
|
|
<div class="line"><a name="l00507"></a><span class="lineno"> 507</span> <span class="comment">// Used to flag the end of the functions.</span></div>
|
|
<div class="line"><a name="l00508"></a><span class="lineno"> 508</span> VOID shellcode::funs_end() {};</div>
|
|
<div class="line"><a name="l00509"></a><span class="lineno"> 509</span>  </div>
|
|
<div class="line"><a name="l00510"></a><span class="lineno"> 510</span> <span class="comment">// Renable the runtime checks.</span></div>
|
|
<div class="line"><a name="l00511"></a><span class="lineno"> 511</span> <span class="preprocessor">#pragma runtime_checks("", restore)</span></div>
|
|
<div class="line"><a name="l00512"></a><span class="lineno"> 512</span>  </div>
|
|
<div class="line"><a name="l00513"></a><span class="lineno"> 513</span> <span class="preprocessor">#endif // !SHELLCODE_CPP.</span></div>
|
|
</div><!-- fragment --></div><!-- contents -->
|
|
</div><!-- doc-content -->
|
|
<div class="ttc" id="aclassshellcode_html_a724cccee30273c81a1a865b3ca20c829"><div class="ttname"><a href="classshellcode.html#a724cccee30273c81a1a865b3ca20c829">shellcode::shellcode_size</a></div><div class="ttdeci">static DWORD shellcode_size</div><div class="ttdef"><b>Definition:</b> <a href="shellcode_8hpp_source.html#l00250">shellcode.hpp:250</a></div></div>
|
|
<div class="ttc" id="aclassshellcode_html_a57220d662e7f75e3aefa71eaa144d243"><div class="ttname"><a href="classshellcode.html#a57220d662e7f75e3aefa71eaa144d243">shellcode::shellcode_start</a></div><div class="ttdeci">static PVOID shellcode_start</div><div class="ttdef"><b>Definition:</b> <a href="shellcode_8hpp_source.html#l00248">shellcode.hpp:248</a></div></div>
|
|
<div class="ttc" id="aclassshellcode_html_aaa82db40cd8ad288803b70bbb278bff4"><div class="ttname"><a href="classshellcode.html#aaa82db40cd8ad288803b70bbb278bff4">shellcode::shellcode_entry</a></div><div class="ttdeci">static DWORD shellcode_entry</div><div class="ttdef"><b>Definition:</b> <a href="shellcode_8hpp_source.html#l00249">shellcode.hpp:249</a></div></div>
|
|
<div class="ttc" id="ashellcode_8hpp_html_a0b990d3b5c511aeb8899c7c40c7371bb"><div class="ttname"><a href="shellcode_8hpp.html#a0b990d3b5c511aeb8899c7c40c7371bb">sh_resolve</a></div><div class="ttdeci">#define sh_resolve(base, funs, fun)</div><div class="ttdef"><b>Definition:</b> <a href="shellcode_8hpp_source.html#l00025">shellcode.hpp:25</a></div></div>
|
|
<div class="ttc" id="ashellcode_8hpp_html"><div class="ttname"><a href="shellcode_8hpp.html">shellcode.hpp</a></div></div>
|
|
<div class="ttc" id="aclassshellcode_html_af54e7ad1b1d215703f5487389040d687"><div class="ttname"><a href="classshellcode.html#af54e7ad1b1d215703f5487389040d687">shellcode::shellcodes_funs</a></div><div class="ttdeci">static DWORD shellcodes_funs[shellcode_number_of_functions]</div><div class="ttdef"><b>Definition:</b> <a href="shellcode_8hpp_source.html#l00253">shellcode.hpp:253</a></div></div>
|
|
<!-- start footer part -->
|
|
<div id="nav-path" class="navpath"><!-- id is needed for treeview function! -->
|
|
<ul>
|
|
<li class="navelem"><a class="el" href="dir_68267d1309a1af8e8297ef4c3efbcdba.html">src</a></li><li class="navelem"><a class="el" href="shellcode_8cpp.html">shellcode.cpp</a></li>
|
|
<li class="footer">Generated by <a href="http://www.doxygen.org/index.html"><img class="footer" src="doxygen.svg" width="104" height="31" alt="doxygen"/></a> 1.8.20 </li>
|
|
</ul>
|
|
</div>
|
|
</body>
|
|
</html>
|