mirror of
https://github.com/mathisvickie/sign-expired
synced 2026-06-06 16:04:38 +00:00
Segy
70 lines
2.7 KiB
C++
70 lines
2.7 KiB
C++
#include <Windows.h>
|
|
|
|
//we are hijacking dll XmlLite so define where original one is located
|
|
#define ORIG_DLL ("C:\\Windows\\System32\\XmlLite.dll")
|
|
|
|
typedef void(*fnDummy)(); //return value or parameters are unimportant, we just want it to jump
|
|
fnDummy gCreateXmlReader;
|
|
fnDummy gCreateXmlReaderInputWithEncodingCodePage;
|
|
fnDummy gCreateXmlReaderInputWithEncodingName;
|
|
fnDummy gCreateXmlWriter;
|
|
fnDummy gCreateXmlWriterOutputWithEncodingCodePage;
|
|
fnDummy gCreateXmlWriterOutputWithEncodingName;
|
|
|
|
extern "C" __declspec(dllexport) void CreateXmlReader() //these all should compile as only single instruction functions: jmp qword ptr[...]
|
|
{
|
|
gCreateXmlReader();
|
|
}
|
|
extern "C" __declspec(dllexport) void CreateXmlReaderInputWithEncodingCodePage()
|
|
{
|
|
gCreateXmlReaderInputWithEncodingCodePage();
|
|
}
|
|
extern "C" __declspec(dllexport) void CreateXmlReaderInputWithEncodingName()
|
|
{
|
|
gCreateXmlReaderInputWithEncodingName();
|
|
}
|
|
extern "C" __declspec(dllexport) void CreateXmlWriter()
|
|
{
|
|
gCreateXmlWriter();
|
|
}
|
|
extern "C" __declspec(dllexport) void CreateXmlWriterOutputWithEncodingCodePage()
|
|
{
|
|
gCreateXmlWriterOutputWithEncodingCodePage();
|
|
}
|
|
extern "C" __declspec(dllexport) void CreateXmlWriterOutputWithEncodingName()
|
|
{
|
|
gCreateXmlWriterOutputWithEncodingName();
|
|
}
|
|
|
|
fnDummy GetDllExport(LPCSTR DllName, LPCSTR ExportName)
|
|
{
|
|
return (fnDummy)GetProcAddress(LoadLibraryA(DllName), ExportName);
|
|
}
|
|
BOOL WriteToReadOnly(PVOID Address, PVOID Buffer, SIZE_T Size)
|
|
{
|
|
return WriteProcessMemory(GetCurrentProcess(), Address, Buffer, Size, 0);
|
|
}
|
|
|
|
BYTE fixCertVerifyTimeValidity[] = {0x48, 0x31, 0xC0, 0xC3}; //xor rax,rax | ret
|
|
BYTE fixGetSystemTimeAsFileTime[] = {0x48, 0x83, 0x21, 0x00, 0xC3}; //and qword ptr[rcx],0x00 | ret
|
|
|
|
BOOL APIENTRY entry(HMODULE hModule, DWORD dwReason, LPVOID lpReserved)
|
|
{
|
|
if (dwReason != DLL_PROCESS_ATTACH)
|
|
return TRUE;
|
|
|
|
DisableThreadLibraryCalls(hModule);
|
|
|
|
if ((gCreateXmlReader = GetDllExport(ORIG_DLL, "CreateXmlReader")) &&
|
|
(gCreateXmlReaderInputWithEncodingCodePage = GetDllExport(ORIG_DLL, "CreateXmlReaderInputWithEncodingCodePage")) &&
|
|
(gCreateXmlReaderInputWithEncodingName = GetDllExport(ORIG_DLL, "CreateXmlReaderInputWithEncodingName")) &&
|
|
(gCreateXmlWriter = GetDllExport(ORIG_DLL, "CreateXmlWriter")) &&
|
|
(gCreateXmlWriterOutputWithEncodingCodePage = GetDllExport(ORIG_DLL, "CreateXmlWriterOutputWithEncodingCodePage")) &&
|
|
(gCreateXmlWriterOutputWithEncodingName = GetDllExport(ORIG_DLL, "CreateXmlWriterOutputWithEncodingName")))
|
|
{
|
|
return WriteToReadOnly(GetDllExport("crypt32.dll", "CertVerifyTimeValidity"), fixCertVerifyTimeValidity, sizeof fixCertVerifyTimeValidity) &&
|
|
WriteToReadOnly(GetDllExport("KernelBase.dll", "GetSystemTimeAsFileTime"), fixGetSystemTimeAsFileTime, sizeof fixGetSystemTimeAsFileTime);
|
|
}
|
|
return FALSE;
|
|
}
|