mirror of
https://github.com/hfiref0x/KDU
synced 2026-06-21 13:53:28 +00:00
hfiref0x
07ec6e6fd3
Added Hilscher wormhole driver as provider 31 Internal rearrange #56 Readme updated
116 lines
2.9 KiB
C
116 lines
2.9 KiB
C
/*******************************************************************************
|
|
*
|
|
* (C) COPYRIGHT AUTHORS, 2020 - 2023
|
|
*
|
|
* TITLE: SHELLCODE.H
|
|
*
|
|
* VERSION: 1.30
|
|
*
|
|
* DATE: 20 Mar 2023
|
|
*
|
|
* Default driver mapping shellcode(s) prototypes and definitions.
|
|
*
|
|
* THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF
|
|
* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED
|
|
* TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A
|
|
* PARTICULAR PURPOSE.
|
|
*
|
|
*******************************************************************************/
|
|
#pragma once
|
|
|
|
typedef struct _PAYLOAD_HEADER_V1 {
|
|
ULONG ImageSize;
|
|
IO_STATUS_BLOCK IoStatus;
|
|
|
|
//
|
|
// Variant specific fields.
|
|
//
|
|
pfnPsCreateSystemThread PsCreateSystemThread;
|
|
pfnZwClose ZwClose;
|
|
|
|
//BYTE Payload[ANYSIZE_ARRAY]; //following header, not a part of this structure
|
|
} PAYLOAD_HEADER_V1, * PPAYLOAD_HEADER_V1;
|
|
|
|
typedef struct _PAYLOAD_HEADER_V2 {
|
|
ULONG ImageSize;
|
|
IO_STATUS_BLOCK IoStatus;
|
|
|
|
//
|
|
// Variant specific fields.
|
|
//
|
|
pfnExQueueWorkItem ExQueueWorkItem;
|
|
|
|
//BYTE Payload[ANYSIZE_ARRAY]; //following header, not a part of this structure
|
|
} PAYLOAD_HEADER_V2, * PPAYLOAD_HEADER_V2;
|
|
|
|
typedef struct _PAYLOAD_HEADER_V3 {
|
|
ULONG ImageSize;
|
|
IO_STATUS_BLOCK IoStatus;
|
|
|
|
//
|
|
// Variant specific fields.
|
|
//
|
|
PVOID IoDriverObjectType;
|
|
pfnObCreateObject ObCreateObject;
|
|
pfnObInsertObject ObInsertObject;
|
|
pfnObMakeTemporaryObject ObMakeTemporaryObject;
|
|
pfnZwMakeTemporaryObject ZwMakeTemporaryObject;
|
|
pfnZwClose ZwClose;
|
|
|
|
FIXED_UNICODE_STRING ObjectName;
|
|
FIXED_UNICODE_STRING RegistryPath;
|
|
|
|
//BYTE Payload[ANYSIZE_ARRAY]; //following header, not a part of this structure
|
|
} PAYLOAD_HEADER_V3, * PPAYLOAD_HEADER_V3;
|
|
|
|
SIZE_T ScGetViewSize(
|
|
_In_ ULONG ScVersion,
|
|
_In_ PVOID ScBuffer);
|
|
|
|
DWORD ScSizeOf(
|
|
_In_ ULONG ScVersion,
|
|
_Out_opt_ PULONG PayloadSize);
|
|
|
|
ULONG ScSizeOfProc(
|
|
_In_ PBYTE FunctionPtr);
|
|
|
|
BOOLEAN ScCreateFixedUnicodeString(
|
|
_Inout_ PFIXED_UNICODE_STRING DestinationString,
|
|
_In_ PCWSTR SourceString);
|
|
|
|
HANDLE ScCreateReadyEvent(
|
|
_In_ ULONG ScVersion,
|
|
_In_ PVOID ScBuffer);
|
|
|
|
BOOLEAN ScStoreVersionSpecificData(
|
|
_In_ PKDU_CONTEXT Context,
|
|
_In_ PVOID PayloadPtr);
|
|
|
|
ULONG_PTR ScResolveFunctionByName(
|
|
_In_ ULONG_PTR KernelBase,
|
|
_In_ ULONG_PTR KernelImage,
|
|
_In_ LPCSTR Function);
|
|
|
|
BOOLEAN ScResolveImportForPayload(
|
|
_In_ ULONG ShellVersion,
|
|
_In_ PVOID PayloadHead,
|
|
_In_ ULONG_PTR KernelImage,
|
|
_In_ ULONG_PTR KernelBase);
|
|
|
|
PVOID ScGetBootstrapLdr(
|
|
_In_ ULONG ShellVersion,
|
|
_Out_opt_ PULONG Size);
|
|
|
|
VOID ScFree(
|
|
_In_ PVOID ScBuffer,
|
|
_In_ ULONG ScSize);
|
|
|
|
PVOID ScAllocate(
|
|
_In_ ULONG ShellVersion,
|
|
_In_ HANDLE SectionHandle,
|
|
_In_ SIZE_T SectionViewSize,
|
|
_In_ ULONG_PTR KernelImage,
|
|
_In_ ULONG_PTR KernelBase,
|
|
_In_ ULONG MemoryTag,
|
|
_Out_ PULONG ShellSize);
|