hakril
|
28eb4df2d0
|
Testing of project tree rewriting
|
2015-12-30 22:49:34 +01:00 |
|
hakril
|
c8bf7d04f8
|
Add injected python dll presence verification
|
2015-12-29 18:13:16 +01:00 |
|
Clement Rouault
|
3ed7c651da
|
Fix GetContext 32<->64 + Thread.start_address 32<->64
|
2015-12-22 17:23:38 +01:00 |
|
Clement Rouault
|
5a29c59b3e
|
execute_python is now safe + test
|
2015-12-22 16:17:30 +01:00 |
|
Clement Rouault
|
dea58c8c77
|
winproxy lazy load the DLL
|
2015-12-22 16:12:40 +01:00 |
|
Clement Rouault
|
718df2ba95
|
Fix a bug in WMI for 64b process
|
2015-12-14 15:13:17 +01:00 |
|
Clement Rouault
|
b5d0a513fe
|
add simple_com / fix alignement issu in syswow64 stub
|
2015-12-11 18:44:18 +01:00 |
|
Clement Rouault
|
d767ae5b8b
|
Add And/Or + Fix Sub in simple_x[86|64]
|
2015-12-11 18:42:31 +01:00 |
|
Clement Rouault
|
e99e3aa39d
|
syswow 64bits stub are now generated :)
|
2015-12-11 11:41:14 +01:00 |
|
Clement Rouault
|
59621034f5
|
Add some play-code for wintrust/registry/wmi
|
2015-12-11 09:54:43 +01:00 |
|
Clement Rouault
|
62f7ee674f
|
Add a network object to windows.system
|
2015-12-11 09:54:11 +01:00 |
|
Clement Rouault
|
46d0a45e17
|
Get PEB of other process without injection
|
2015-12-11 09:53:13 +01:00 |
|
Clement Rouault
|
419e65324f
|
Add 32bits register support in simple_x64
|
2015-12-11 09:51:34 +01:00 |
|
Clement Rouault
|
ea78f81468
|
Add 64->32 bits pe/peb parsing + stuff in simple_x86/64
|
2015-11-13 09:25:05 +01:00 |
|
Clement Rouault
|
2523c8e63e
|
Add CreateFileW to winproxy + add GENERIC_READ as default dwDesiredAccess
|
2015-09-24 10:15:11 +02:00 |
|
Clement Rouault
|
694f10c095
|
Fix a bug introduced in the 64b hook stub
|
2015-09-23 15:58:10 +02:00 |
|
Clement Rouault
|
c884122b29
|
Fix remote peb64 moodule parsing fail
|
2015-09-23 14:40:49 +02:00 |
|
Clement Rouault
|
f5b0c0294f
|
cosmetic: fucking linter :(
|
2015-09-23 14:32:27 +02:00 |
|
Clement Rouault
|
663de130b5
|
renamed k32testing.py -> winproxy.py
|
2015-09-23 10:29:24 +02:00 |
|
Clement Rouault
|
b1d4f23bb7
|
widows.utils is now a directory
|
2015-09-23 09:47:58 +02:00 |
|
Clement Rouault
|
da521908ed
|
MultipleInst now know how to handle Prefix
|
2015-09-22 10:24:41 +02:00 |
|
Clement Rouault
|
32b12daa8f
|
Add Movsb | Movsd to simple_x86
|
2015-09-22 10:19:26 +02:00 |
|
Clement Rouault
|
e38084eefc
|
Add jbe jnb to simple_x86
|
2015-09-22 10:00:36 +02:00 |
|
Clement Rouault
|
da31cc204b
|
add deref(x) to simply create displacement only mem_access
|
2015-09-22 09:32:17 +02:00 |
|
Clement Rouault
|
c94a09d6bd
|
Add inc rm/32
|
2015-09-21 17:45:54 +02:00 |
|
Clement Rouault
|
600ac6dffd
|
New ntstatus.py with ntstatus definition for NtDllProxy
|
2015-09-21 17:13:56 +02:00 |
|
Clement Rouault
|
21ccc8094d
|
First unittest + fix in x64 iat hook stub
|
2015-09-21 14:03:37 +02:00 |
|
Clement Rouault
|
6d37b9d6fa
|
Add helper before writing test
|
2015-09-21 14:01:29 +02:00 |
|
Clement Rouault
|
cecc6477fc
|
Add better error report for function returning an NTSTATUS
|
2015-09-18 15:42:10 +02:00 |
|
Clement Rouault
|
f7684913f4
|
Adapte get_peb code to use simple_x86/64 with new prefix feature
|
2015-09-18 15:41:12 +02:00 |
|
Clement Rouault
|
a7cc77dece
|
simple_x86/64 now handle prefix and prefixed mem_access
|
2015-09-18 15:34:55 +02:00 |
|
Clement Rouault
|
9c89ddce1a
|
Add PESection : IMAGE_SECTION_HEADER with a name easy to read
|
2015-09-17 16:08:14 +02:00 |
|
Clement Rouault
|
5be7b185c2
|
Add pe sections parsing + kernel module by NtQuery by w4kfu + small fixes
|
2015-09-17 15:58:58 +02:00 |
|
Clement Rouault
|
7fe3e9e8be
|
remove a debug print
|
2015-09-17 14:29:47 +02:00 |
|
Clement Rouault
|
3c8966aa4b
|
Add some simple Cpuid wrapper in native_exec
|
2015-09-17 11:10:27 +02:00 |
|
Clement Rouault
|
8ec269bef6
|
Add Cpuid instruction + test in assembler
|
2015-09-17 11:10:01 +02:00 |
|
Clement Rouault
|
8330027b8b
|
Add struct SYSTEM_MODULE_INFORMATION
|
2015-09-16 17:49:30 +02:00 |
|
Clement Rouault
|
a758753839
|
Fix error handler of Registry functions
|
2015-09-16 17:42:05 +02:00 |
|
Clement Rouault
|
c05be85eb4
|
Add special error handling for NtQuerySystemInformation
|
2015-09-16 17:40:35 +02:00 |
|
Clement Rouault
|
09a5724ea0
|
Add NtQuerySystemInformation to k32testing
|
2015-09-16 16:56:09 +02:00 |
|
Clement Rouault
|
e02bf24e8c
|
Add def for NtQuerySystem + fix in CustomAllocator
|
2015-09-16 16:42:21 +02:00 |
|
Clement Rouault
|
9f70a58170
|
Add defintions/structs/functions for token/registry
|
2015-09-16 16:24:17 +02:00 |
|
Clement Rouault
|
4384f40bb7
|
Fix return value of JmpImm in 64bits
|
2015-09-16 15:23:31 +02:00 |
|
Clement Rouault
|
8a718c6e06
|
Fix bug + remove debug print
|
2015-09-16 14:47:23 +02:00 |
|
Clement Rouault
|
b4ebffb55c
|
[Test] Using dbgprint.py
|
2015-09-16 10:13:39 +02:00 |
|
Clement Rouault
|
7532172813
|
Rewrite 32->64 CreateThread (parse own 64ntdll + shellcode in simple_x64)
|
2015-09-16 10:13:18 +02:00 |
|
Clement Rouault
|
59a0c933f9
|
Use OptionalExport for ntreadsyswow + add some function
|
2015-09-16 10:10:49 +02:00 |
|
Clement Rouault
|
0fc55b24fd
|
Clean X64 hook stub
|
2015-09-15 10:20:05 +02:00 |
|
Clement Rouault
|
c74447ec23
|
Add call [mem] and xchg REG,[RE]AX
|
2015-09-15 10:05:49 +02:00 |
|
Clement Rouault
|
03aa598514
|
Rewrite x64 SIB/Immediat logic to match x86 + fixes + test_x64
|
2015-09-15 09:17:25 +02:00 |
|