admin/maxDcb-C2Core
1
0
Fork 0
mirror of https://github.com/maxDcb/C2Core synced 2026-06-08 15:48:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Normalize C++ indentation to four spaces

Browse Source
This commit is contained in:
Maxime dcb
2025-10-14 16:05:39 +02:00
parent 46975f58dc
commit 2f6652ddbb
117 changed files with 11326 additions and 11326 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/ModuleCmd/C2Message.hpp
+537 -537
View File
File diff suppressed because it is too large Load Diff
modules/ModuleCmd/Common.hpp
+21 -21
View File
@@ -162,15 +162,15 @@ inline constexpr std::array<char, N> compileTimeXOR(const std::string_view data,
void static inline XOR(std::string& data, const std::string& key)
{
int j = 0;
for (int i = 0; i < data.size(); i++)
{
if (j == key.size())
j = 0;
int j = 0;
for (int i = 0; i < data.size(); i++)
{
if (j == key.size())
j = 0;
data[i] = data[i] ^ key[j];
j++;
}
data[i] = data[i] ^ key[j];
j++;
}
}
@@ -194,24 +194,24 @@ std::string static inline random_string(std::size_t length)
bool static inline isNumber(const std::string& str)
{
for (char const& c : str) {
if (std::isdigit(c) == 0) return false;
}
return true;
for (char const& c : str) {
if (std::isdigit(c) == 0) return false;
}
return true;
}
void static inline splitList(std::string list, const std::string& delimiter, std::vector<std::string>& splitedList)
{
size_t pos = 0;
std::string token;
while ((pos = list.find(delimiter)) != std::string::npos)
{
token = list.substr(0, pos);
splitedList.push_back(token);
list.erase(0, pos + delimiter.length());
}
splitedList.push_back(list);
size_t pos = 0;
std::string token;
while ((pos = list.find(delimiter)) != std::string::npos)
{
token = list.substr(0, pos);
splitedList.push_back(token);
list.erase(0, pos + delimiter.length());
}
splitedList.push_back(list);
}
modules/ModuleCmd/CommonCommand.hpp
+302 -302
View File
@@ -60,333 +60,333 @@ const std::string StopInstruction = "stop";
class CommonCommands
{
public:
CommonCommands()
{
m_commonCommands.push_back(EndInstruction);
m_commonCommands.push_back(ListenerInstruction);
m_commonCommands.push_back(LoadModuleInstruction);
m_commonCommands.push_back(UnloadModuleInstruction);
m_commonCommands.push_back(SleepInstruction);
}
public:
CommonCommands()
{
m_commonCommands.push_back(EndInstruction);
m_commonCommands.push_back(ListenerInstruction);
m_commonCommands.push_back(LoadModuleInstruction);
m_commonCommands.push_back(UnloadModuleInstruction);
m_commonCommands.push_back(SleepInstruction);
}
int getNumberOfCommand()
{
return m_commonCommands.size();
}
int getNumberOfCommand()
{
return m_commonCommands.size();
}
std::string getCommand(int idx)
{
if(idx<m_commonCommands.size())
return m_commonCommands[idx];
else
return "";
}
std::string getCommand(int idx)
{
if(idx<m_commonCommands.size())
return m_commonCommands[idx];
else
return "";
}
std::string translateCmdToInstruction(const std::string& cmd)
{
std::string output;
std::string translateCmdToInstruction(const std::string& cmd)
{
std::string output;
if(cmd==SleepCmd)
return SleepInstruction;
else if(cmd==EndCmd)
return EndInstruction;
else if(cmd==ListenerCmd)
return ListenerInstruction;
else if(cmd==LoadC2ModuleCmd)
return LoadModuleInstruction;
else if(cmd==UnloadC2ModuleCmd)
return UnloadModuleInstruction;
return "";
}
if(cmd==SleepCmd)
return SleepInstruction;
else if(cmd==EndCmd)
return EndInstruction;
else if(cmd==ListenerCmd)
return ListenerInstruction;
else if(cmd==LoadC2ModuleCmd)
return LoadModuleInstruction;
else if(cmd==UnloadC2ModuleCmd)
return UnloadModuleInstruction;
return "";
}
std::string getHelp(std::string cmd)
std::string getHelp(std::string cmd)
{
std::string output;
std::string output;
if (cmd == SleepCmd)
{
output = "sleep:\n";
output += " Set the sleep interval (in seconds) for the beacon.\n";
output += " Example:\n";
output += " - sleep 0.5\n";
}
else if (cmd == EndCmd)
{
output = "end:\n";
output += " Terminates the beacon process.\n";
output += " Example:\n";
output += " - end\n";
}
else if (cmd == ListenerCmd)
{
output = "listener:\n";
output += " Starts a TCP or SMB listener on the beacon.\n";
output += " The IP or hostname given to the listener is only in case of dropper use, to know where to connect to. It will show in the GUI.\n";
output += " Examples:\n";
output += " - listener start tcp <IP> <port>\n";
output += " - listener start tcp 10.2.4.8 4444\n";
output += " - listener start smb <IP/hostname> <pipename>\n";
output += " - listener start smb pipename\n";
}
else if (cmd == LoadC2ModuleCmd)
{
output = "loadModule:\n";
output += " Loads a module DLL into the beacon's memory, extending its capabilities.\n";
output += " Attempts to load from the specified path; if not found, falls back to the default '../Modules/' directory.\n";
output += " Example:\n";
output += " - loadModule assemblyexec\n";
output += " - loadModule /tools/PrintWorkingDirectory.dll\n";
}
else if (cmd == UnloadC2ModuleCmd)
{
output = "unloadModule:\n";
output += " Unloads a module DLL that was previously loaded via loadModule.\n";
output += " Example:\n";
output += " - unloadModule assemblyExec\n";
}
if (cmd == SleepCmd)
{
output = "sleep:\n";
output += " Set the sleep interval (in seconds) for the beacon.\n";
output += " Example:\n";
output += " - sleep 0.5\n";
}
else if (cmd == EndCmd)
{
output = "end:\n";
output += " Terminates the beacon process.\n";
output += " Example:\n";
output += " - end\n";
}
else if (cmd == ListenerCmd)
{
output = "listener:\n";
output += " Starts a TCP or SMB listener on the beacon.\n";
output += " The IP or hostname given to the listener is only in case of dropper use, to know where to connect to. It will show in the GUI.\n";
output += " Examples:\n";
output += " - listener start tcp <IP> <port>\n";
output += " - listener start tcp 10.2.4.8 4444\n";
output += " - listener start smb <IP/hostname> <pipename>\n";
output += " - listener start smb pipename\n";
}
else if (cmd == LoadC2ModuleCmd)
{
output = "loadModule:\n";
output += " Loads a module DLL into the beacon's memory, extending its capabilities.\n";
output += " Attempts to load from the specified path; if not found, falls back to the default '../Modules/' directory.\n";
output += " Example:\n";
output += " - loadModule assemblyexec\n";
output += " - loadModule /tools/PrintWorkingDirectory.dll\n";
}
else if (cmd == UnloadC2ModuleCmd)
{
output = "unloadModule:\n";
output += " Unloads a module DLL that was previously loaded via loadModule.\n";
output += " Example:\n";
output += " - unloadModule assemblyExec\n";
}
return output;
return output;
}
// if an error ocurre:
// set_returnvalue(errorMsg) && return -1
int init(std::vector<std::string> &splitedCmd, C2Message &c2Message, bool isWindows=true)
{
std::string instruction = splitedCmd[0];
// if an error ocurre:
// set_returnvalue(errorMsg) && return -1
int init(std::vector<std::string> &splitedCmd, C2Message &c2Message, bool isWindows=true)
{
std::string instruction = splitedCmd[0];
//
// Sleep
//
if(instruction==SleepInstruction)
{
if(splitedCmd.size()==2)
{
float sleepTimeSec=5;
try
{
sleepTimeSec = atof(splitedCmd[1].c_str());
}
catch (const std::invalid_argument& ia)
{
std::cerr << "Invalid argument: " << ia.what() << '\n';
return -1;
}
c2Message.set_instruction(SleepCmd);
c2Message.set_cmd(std::to_string(sleepTimeSec));
}
else
{
std::string errorMsg = getHelp(SleepCmd);
c2Message.set_returnvalue(errorMsg);
return -1;
}
}
//
// End
//
else if(instruction==EndInstruction)
{
c2Message.set_instruction(EndCmd);
c2Message.set_cmd("");
}
//
// Listener
//
else if(instruction==ListenerInstruction)
{
if(splitedCmd.size()>=3)
{
if(splitedCmd[1]==StartInstruction && splitedCmd[2]==ListenerTcpType)
{
if(splitedCmd.size()>=5)
{
std::string host = splitedCmd[3];
int port=-1;
try
{
port = std::atoi(splitedCmd[4].c_str());
}
catch (const std::invalid_argument& ia)
{
std::cerr << "Invalid argument: " << ia.what() << '\n';
return -1;
}
//
// Sleep
//
if(instruction==SleepInstruction)
{
if(splitedCmd.size()==2)
{
float sleepTimeSec=5;
try
{
sleepTimeSec = atof(splitedCmd[1].c_str());
}
catch (const std::invalid_argument& ia)
{
std::cerr << "Invalid argument: " << ia.what() << '\n';
return -1;
}
c2Message.set_instruction(SleepCmd);
c2Message.set_cmd(std::to_string(sleepTimeSec));
}
else
{
std::string errorMsg = getHelp(SleepCmd);
c2Message.set_returnvalue(errorMsg);
return -1;
}
}
//
// End
//
else if(instruction==EndInstruction)
{
c2Message.set_instruction(EndCmd);
c2Message.set_cmd("");
}
//
// Listener
//
else if(instruction==ListenerInstruction)
{
if(splitedCmd.size()>=3)
{
if(splitedCmd[1]==StartInstruction && splitedCmd[2]==ListenerTcpType)
{
if(splitedCmd.size()>=5)
{
std::string host = splitedCmd[3];
int port=-1;
try
{
port = std::atoi(splitedCmd[4].c_str());
}
catch (const std::invalid_argument& ia)
{
std::cerr << "Invalid argument: " << ia.what() << '\n';
return -1;
}
std::string cmd = StartCmd;
cmd+=" ";
cmd+=ListenerTcpType;
cmd+=" ";
cmd+=host;
cmd+=" ";
cmd+=std::to_string(port);
c2Message.set_instruction(ListenerCmd);
c2Message.set_cmd(cmd);
}
else
{
std::string errorMsg = "listener tcp start: not enough arguments";
c2Message.set_returnvalue(errorMsg);
return -1;
}
}
else if(splitedCmd[1]==StartInstruction && splitedCmd[2]==ListenerSmbType)
{
if(splitedCmd.size()==5)
{
std::string host = splitedCmd[3];
std::string pipeName = splitedCmd[4];
std::string cmd = StartCmd;
cmd+=" ";
cmd+=ListenerSmbType;
cmd+=" ";
cmd+=host;
cmd+=" ";
cmd+=pipeName;
c2Message.set_instruction(ListenerCmd);
c2Message.set_cmd(cmd);
}
else
{
std::string errorMsg = "listener smb start: not enough arguments";
c2Message.set_returnvalue(errorMsg);
return -1;
}
}
else if(splitedCmd[1]==StopInstruction)
{
std::string hash = splitedCmd[2];
std::string cmd = StopCmd;
cmd+=" ";
cmd+=hash;
c2Message.set_instruction(ListenerCmd);
c2Message.set_cmd(cmd);
}
}
else
{
std::string errorMsg = getHelp(ListenerCmd);
c2Message.set_returnvalue(errorMsg);
return -1;
}
}
//
// Load Memory Module
//
else if(instruction==LoadModuleInstruction)
{
if (splitedCmd.size() == 2)
{
std::string inputFile = splitedCmd[1];
std::string cmd = StartCmd;
cmd+=" ";
cmd+=ListenerTcpType;
cmd+=" ";
cmd+=host;
cmd+=" ";
cmd+=std::to_string(port);
c2Message.set_instruction(ListenerCmd);
c2Message.set_cmd(cmd);
}
else
{
std::string errorMsg = "listener tcp start: not enough arguments";
c2Message.set_returnvalue(errorMsg);
return -1;
}
}
else if(splitedCmd[1]==StartInstruction && splitedCmd[2]==ListenerSmbType)
{
if(splitedCmd.size()==5)
{
std::string host = splitedCmd[3];
std::string pipeName = splitedCmd[4];
std::string cmd = StartCmd;
cmd+=" ";
cmd+=ListenerSmbType;
cmd+=" ";
cmd+=host;
cmd+=" ";
cmd+=pipeName;
c2Message.set_instruction(ListenerCmd);
c2Message.set_cmd(cmd);
}
else
{
std::string errorMsg = "listener smb start: not enough arguments";
c2Message.set_returnvalue(errorMsg);
return -1;
}
}
else if(splitedCmd[1]==StopInstruction)
{
std::string hash = splitedCmd[2];
std::string cmd = StopCmd;
cmd+=" ";
cmd+=hash;
c2Message.set_instruction(ListenerCmd);
c2Message.set_cmd(cmd);
}
}
else
{
std::string errorMsg = getHelp(ListenerCmd);
c2Message.set_returnvalue(errorMsg);
return -1;
}
}
//
// Load Memory Module
//
else if(instruction==LoadModuleInstruction)
{
if (splitedCmd.size() == 2)
{
std::string inputFile = splitedCmd[1];
// check if it's a Path
std::ifstream input;
input.open(inputFile, std::ios::binary);
// check if it's a Path
std::ifstream input;
input.open(inputFile, std::ios::binary);
// if not check if it's a filename present in the linux or windows directory
if(!input && !isWindows)
{
std::string newInputFile = m_linuxModulesDirectoryPath;
newInputFile+=inputFile;
input.open(newInputFile, std::ios::binary);
}
else if(!input && isWindows)
{
std::string newInputFile = m_windowsModulesDirectoryPath;
newInputFile+=inputFile;
input.open(newInputFile, std::ios::binary);
}
// if not check if it's a filename present in the linux or windows directory
if(!input && !isWindows)
{
std::string newInputFile = m_linuxModulesDirectoryPath;
newInputFile+=inputFile;
input.open(newInputFile, std::ios::binary);
}
else if(!input && isWindows)
{
std::string newInputFile = m_windowsModulesDirectoryPath;
newInputFile+=inputFile;
input.open(newInputFile, std::ios::binary);
}
if( input )
{
std::string buffer(std::istreambuf_iterator<char>(input), {});
if( input )
{
std::string buffer(std::istreambuf_iterator<char>(input), {});
c2Message.set_instruction(LoadC2ModuleCmd);
c2Message.set_inputfile(inputFile);
c2Message.set_data(buffer.data(), buffer.size());
}
else
{
c2Message.set_returnvalue("Failed: Couldn't open file.");
return -1;
}
}
else
{
std::string errorMsg = getHelp(LoadC2ModuleCmd);
c2Message.set_returnvalue(errorMsg);
return -1;
}
}
else if(instruction==UnloadModuleInstruction)
{
if (splitedCmd.size() == 2)
{
std::string moduleName = splitedCmd[1];
c2Message.set_instruction(LoadC2ModuleCmd);
c2Message.set_inputfile(inputFile);
c2Message.set_data(buffer.data(), buffer.size());
}
else
{
c2Message.set_returnvalue("Failed: Couldn't open file.");
return -1;
}
}
else
{
std::string errorMsg = getHelp(LoadC2ModuleCmd);
c2Message.set_returnvalue(errorMsg);
return -1;
}
}
else if(instruction==UnloadModuleInstruction)
{
if (splitedCmd.size() == 2)
{
std::string moduleName = splitedCmd[1];
c2Message.set_instruction(UnloadC2ModuleCmd);
c2Message.set_cmd(moduleName);
}
else
{
std::string errorMsg = getHelp(UnloadC2ModuleCmd);
c2Message.set_returnvalue(errorMsg);
return -1;
}
}
return 0;
}
c2Message.set_instruction(UnloadC2ModuleCmd);
c2Message.set_cmd(moduleName);
}
else
{
std::string errorMsg = getHelp(UnloadC2ModuleCmd);
c2Message.set_returnvalue(errorMsg);
return -1;
}
}
return 0;
}
int errorCodeToMsg(const C2Message &c2RetMessage, std::string& errorMsg)
{
int errorCode = c2RetMessage.errorCode();
if(errorCode>0)
{
if(errorCode==ERROR_GENERIC)
errorMsg = "Error";
else if(errorCode==ERROR_LISTENER_EXIST)
errorMsg = "Error: Listener already exist";
else if(errorCode==ERROR_PORT_FORMAT)
errorMsg = "Error: Port format";
else if(errorCode==ERROR_HASH_NOT_FOUND)
errorMsg = "Error: Hash not found";
else if(errorCode==ERROR_LOAD_LIBRARY)
errorMsg = "Error: MemoryLoadLibrary";
else if(errorCode==ERROR_GET_PROC_ADDRESS)
errorMsg = "Error: MemoryGetProcAddress";
else if(errorCode==ERROR_MODULE_NOT_FOUND)
errorMsg = "Error: Module not found";
else if(errorCode==ERROR_MODULE_ALREADY_LOADED)
errorMsg = "Error: Module already loaded";
}
return 0;
}
int errorCodeToMsg(const C2Message &c2RetMessage, std::string& errorMsg)
{
int errorCode = c2RetMessage.errorCode();
if(errorCode>0)
{
if(errorCode==ERROR_GENERIC)
errorMsg = "Error";
else if(errorCode==ERROR_LISTENER_EXIST)
errorMsg = "Error: Listener already exist";
else if(errorCode==ERROR_PORT_FORMAT)
errorMsg = "Error: Port format";
else if(errorCode==ERROR_HASH_NOT_FOUND)
errorMsg = "Error: Hash not found";
else if(errorCode==ERROR_LOAD_LIBRARY)
errorMsg = "Error: MemoryLoadLibrary";
else if(errorCode==ERROR_GET_PROC_ADDRESS)
errorMsg = "Error: MemoryGetProcAddress";
else if(errorCode==ERROR_MODULE_NOT_FOUND)
errorMsg = "Error: Module not found";
else if(errorCode==ERROR_MODULE_ALREADY_LOADED)
errorMsg = "Error: Module already loaded";
}
return 0;
}
int setDirectories( const std::string& teamServerModulesDirectoryPath,
const std::string& linuxModulesDirectoryPath,
const std::string& windowsModulesDirectoryPath,
const std::string& linuxBeaconsDirectoryPath,
const std::string& windowsBeaconsDirectoryPath,
const std::string& toolsDirectoryPath,
const std::string& scriptsDirectoryPath)
{
m_teamServerModulesDirectoryPath=teamServerModulesDirectoryPath;
m_linuxModulesDirectoryPath=linuxModulesDirectoryPath;
m_windowsModulesDirectoryPath=windowsModulesDirectoryPath;
m_linuxBeaconsDirectoryPath=linuxBeaconsDirectoryPath;
m_windowsBeaconsDirectoryPath=windowsBeaconsDirectoryPath;
m_toolsDirectoryPath=toolsDirectoryPath;
m_scriptsDirectoryPath=scriptsDirectoryPath;
int setDirectories( const std::string& teamServerModulesDirectoryPath,
const std::string& linuxModulesDirectoryPath,
const std::string& windowsModulesDirectoryPath,
const std::string& linuxBeaconsDirectoryPath,
const std::string& windowsBeaconsDirectoryPath,
const std::string& toolsDirectoryPath,
const std::string& scriptsDirectoryPath)
{
m_teamServerModulesDirectoryPath=teamServerModulesDirectoryPath;
m_linuxModulesDirectoryPath=linuxModulesDirectoryPath;
m_windowsModulesDirectoryPath=windowsModulesDirectoryPath;
m_linuxBeaconsDirectoryPath=linuxBeaconsDirectoryPath;
m_windowsBeaconsDirectoryPath=windowsBeaconsDirectoryPath;
m_toolsDirectoryPath=toolsDirectoryPath;
m_scriptsDirectoryPath=scriptsDirectoryPath;
return 0;
};
return 0;
};
private:
std::vector<std::string> m_commonCommands;
std::vector<std::string> m_commonCommands;
std::string m_teamServerModulesDirectoryPath;
std::string m_teamServerModulesDirectoryPath;
std::string m_linuxModulesDirectoryPath;
std::string m_windowsModulesDirectoryPath;
std::string m_linuxBeaconsDirectoryPath;
modules/ModuleCmd/ModuleCmd.hpp
+48 -48
View File
@@ -25,65 +25,65 @@ enum OSCompatibility {
//
class ModuleCmd
{
public:
ModuleCmd(const std::string& name, unsigned long long hash=0)
{
m_name=name;
m_hash=hash;
}
ModuleCmd(const std::string& name, unsigned long long hash=0)
{
m_name=name;
m_hash=hash;
}
~ModuleCmd()
{
~ModuleCmd()
{
}
}
std::string getName()
{
return m_name;
}
std::string getName()
{
return m_name;
}
unsigned long long getHash()
{
return m_hash;
}
unsigned long long getHash()
{
return m_hash;
}
int setDirectories( const std::string& teamServerModulesDirectoryPath,
const std::string& linuxModulesDirectoryPath,
const std::string& windowsModulesDirectoryPath,
const std::string& linuxBeaconsDirectoryPath,
const std::string& windowsBeaconsDirectoryPath,
const std::string& toolsDirectoryPath,
const std::string& scriptsDirectoryPath)
{
m_teamServerModulesDirectoryPath=teamServerModulesDirectoryPath;
m_linuxModulesDirectoryPath=linuxModulesDirectoryPath;
m_windowsModulesDirectoryPath=windowsModulesDirectoryPath;
m_linuxBeaconsDirectoryPath=linuxBeaconsDirectoryPath;
m_windowsBeaconsDirectoryPath=windowsBeaconsDirectoryPath;
m_toolsDirectoryPath=toolsDirectoryPath;
m_scriptsDirectoryPath=scriptsDirectoryPath;
int setDirectories( const std::string& teamServerModulesDirectoryPath,
const std::string& linuxModulesDirectoryPath,
const std::string& windowsModulesDirectoryPath,
const std::string& linuxBeaconsDirectoryPath,
const std::string& windowsBeaconsDirectoryPath,
const std::string& toolsDirectoryPath,
const std::string& scriptsDirectoryPath)
{
m_teamServerModulesDirectoryPath=teamServerModulesDirectoryPath;
m_linuxModulesDirectoryPath=linuxModulesDirectoryPath;
m_windowsModulesDirectoryPath=windowsModulesDirectoryPath;
m_linuxBeaconsDirectoryPath=linuxBeaconsDirectoryPath;
m_windowsBeaconsDirectoryPath=windowsBeaconsDirectoryPath;
m_toolsDirectoryPath=toolsDirectoryPath;
m_scriptsDirectoryPath=scriptsDirectoryPath;
return 0;
};
return 0;
};
virtual std::string getInfo() = 0;
virtual std::string getInfo() = 0;
// if an error ocurre:
// set_returnvalue(errorMsg) && return -1
virtual int init(std::vector<std::string>& splitedCmd, C2Message& c2Message) = 0;
virtual int initConfig(const nlohmann::json &config) {return 0;};
virtual int process(C2Message& c2Message, C2Message& c2RetMessage) = 0;
virtual int followUp(const C2Message &c2RetMessage) {return 0;};
virtual int errorCodeToMsg(const C2Message &c2RetMessage, std::string& errorMsg) {return 0;};
virtual int recurringExec (C2Message& c2RetMessage) {return 0;};
virtual int osCompatibility () {return OS_NONE;};
// if an error ocurre:
// set_returnvalue(errorMsg) && return -1
virtual int init(std::vector<std::string>& splitedCmd, C2Message& c2Message) = 0;
virtual int initConfig(const nlohmann::json &config) {return 0;};
virtual int process(C2Message& c2Message, C2Message& c2RetMessage) = 0;
virtual int followUp(const C2Message &c2RetMessage) {return 0;};
virtual int errorCodeToMsg(const C2Message &c2RetMessage, std::string& errorMsg) {return 0;};
virtual int recurringExec (C2Message& c2RetMessage) {return 0;};
virtual int osCompatibility () {return OS_NONE;};
protected:
std::string m_name;
unsigned long long m_hash;
std::string m_name;
unsigned long long m_hash;
std::string m_teamServerModulesDirectoryPath;
std::string m_teamServerModulesDirectoryPath;
std::string m_linuxModulesDirectoryPath;
std::string m_windowsModulesDirectoryPath;
std::string m_linuxBeaconsDirectoryPath;
@@ -92,5 +92,5 @@ protected:
std::string m_scriptsDirectoryPath;
private:
};
modules/ModuleCmd/Tools.hpp
+545 -545
View File
File diff suppressed because it is too large Load Diff
modules/ModuleCmd/include.hpp
+50 -50
View File
@@ -7,91 +7,91 @@
#define SW3_RVA2VA(Type, DllBase, Rva) (Type)((ULONG_PTR) DllBase + Rva)
typedef struct _SW3_PEB_LDR_DATA {
BYTE Reserved1[8];
PVOID Reserved2[3];
LIST_ENTRY InMemoryOrderModuleList;
BYTE Reserved1[8];
PVOID Reserved2[3];
LIST_ENTRY InMemoryOrderModuleList;
} SW3_PEB_LDR_DATA, *PSW3_PEB_LDR_DATA;
typedef struct _SW3_LDR_DATA_TABLE_ENTRY {
PVOID Reserved1[2];
LIST_ENTRY InMemoryOrderLinks;
PVOID Reserved2[2];
PVOID DllBase;
PVOID Reserved1[2];
LIST_ENTRY InMemoryOrderLinks;
PVOID Reserved2[2];
PVOID DllBase;
} SW3_LDR_DATA_TABLE_ENTRY, *PSW3_LDR_DATA_TABLE_ENTRY;
typedef struct _SW3_PEB {
BYTE Reserved1[2];
BYTE BeingDebugged;
BYTE Reserved2[1];
PVOID Reserved3[2];
PSW3_PEB_LDR_DATA Ldr;
BYTE Reserved1[2];
BYTE BeingDebugged;
BYTE Reserved2[1];
PVOID Reserved3[2];
PSW3_PEB_LDR_DATA Ldr;
} SW3_PEB, *PSW3_PEB;
typedef struct _PS_ATTRIBUTE
{
ULONG Attribute;
SIZE_T Size;
union
{
ULONG Value;
PVOID ValuePtr;
} u1;
PSIZE_T ReturnLength;
ULONG Attribute;
SIZE_T Size;
union
{
ULONG Value;
PVOID ValuePtr;
} u1;
PSIZE_T ReturnLength;
} PS_ATTRIBUTE, *PPS_ATTRIBUTE;
// typedef struct _UNICODE_STRING
// {
// USHORT Length;
// USHORT MaximumLength;
// PWSTR Buffer;
// USHORT Length;
// USHORT MaximumLength;
// PWSTR Buffer;
// } UNICODE_STRING, *PUNICODE_STRING;
// typedef struct _OBJECT_ATTRIBUTES
// {
// ULONG Length;
// HANDLE RootDirectory;
// PUNICODE_STRING ObjectName;
// ULONG Attributes;
// PVOID SecurityDescriptor;
// PVOID SecurityQualityOfService;
// ULONG Length;
// HANDLE RootDirectory;
// PUNICODE_STRING ObjectName;
// ULONG Attributes;
// PVOID SecurityDescriptor;
// PVOID SecurityQualityOfService;
// } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
// typedef struct _CLIENT_ID
// {
// HANDLE UniqueProcess;
// HANDLE UniqueThread;
// HANDLE UniqueProcess;
// HANDLE UniqueThread;
// } CLIENT_ID, *PCLIENT_ID;
typedef struct _PS_ATTRIBUTE_LIST
{
SIZE_T TotalLength;
PS_ATTRIBUTE Attributes[1];
SIZE_T TotalLength;
PS_ATTRIBUTE Attributes[1];
} PS_ATTRIBUTE_LIST, *PPS_ATTRIBUTE_LIST;
typedef enum _MEMORY_INFORMATION_CLASS
{
MemoryBasicInformation,
MemoryWorkingSetInformation,
MemoryMappedFilenameInformation,
MemoryRegionInformation,
MemoryWorkingSetExInformation,
MemorySharedCommitInformation,
MemoryImageInformation,
MemoryRegionInformationEx,
MemoryPrivilegedBasicInformation,
MemoryEnclaveImageInformation,
MemoryBasicInformationCapped
MemoryBasicInformation,
MemoryWorkingSetInformation,
MemoryMappedFilenameInformation,
MemoryRegionInformation,
MemoryWorkingSetExInformation,
MemorySharedCommitInformation,
MemoryImageInformation,
MemoryRegionInformationEx,
MemoryPrivilegedBasicInformation,
MemoryEnclaveImageInformation,
MemoryBasicInformationCapped
} MEMORY_INFORMATION_CLASS, *PMEMORY_INFORMATION_CLASS;
#ifndef InitializeObjectAttributes
#define InitializeObjectAttributes( p, n, a, r, s ) { \
(p)->Length = sizeof( OBJECT_ATTRIBUTES ); \
(p)->RootDirectory = r; \
(p)->Attributes = a; \
(p)->ObjectName = n; \
(p)->SecurityDescriptor = s; \
(p)->SecurityQualityOfService = NULL; \
(p)->Length = sizeof( OBJECT_ATTRIBUTES ); \
(p)->RootDirectory = r; \
(p)->Attributes = a; \
(p)->ObjectName = n; \
(p)->SecurityDescriptor = s; \
(p)->SecurityQualityOfService = NULL; \
}
#endif
modules/ModuleCmd/peb.hpp
+2 -2
View File
@@ -630,8 +630,8 @@ typedef struct _INVERTED_FUNCTION_TABLE_KERNEL_MODE
typedef enum _SECTION_INHERIT
{
ViewShare = 1,
ViewUnmap = 2
ViewShare = 1,
ViewUnmap = 2
} SECTION_INHERIT, *PSECTION_INHERIT;
modules/ModuleCmd/syscall.cpp
+57 -57
View File
@@ -1,57 +1,57 @@
#include "syscall.hpp"
DWORD GlobalHash = 0x0;
EXTERN_C DWORD getGlobalHash()
{
return GlobalHash;
}
DWORD SW3_HashSyscall(const char *FunctionName)
{
DWORD Hash = 0x811C9DC5; // FNV offset basis
DWORD FNV_prime = 0x01000193; // FNV prime
int c;
while (c = *FunctionName++)
{
Hash ^= c; // XOR the byte into the lowest byte of the hash
Hash *= FNV_prime; // Multiply by FNV prime
}
return Hash & 0xFFFFFFFF; // Ensure the result is a 32-bit hash
}
bool compareEntry(Entry i1, Entry i2)
{
return (i1.getAddress() < i2.getAddress());
}
SyscallList* SyscallList::singleton_= nullptr;
SyscallList *SyscallList::GetInstance()
{
if(singleton_==nullptr){
singleton_ = new SyscallList();
}
return singleton_;
}
EXTERN_C DWORD SW3_GetSyscallNumber(DWORD FunctionHash)
{
SyscallList* singleton = SyscallList::GetInstance();
return singleton->getSyscallNumber(FunctionHash);
}
EXTERN_C PVOID SW3_GetSyscallAddress(DWORD FunctionHash)
{
SyscallList* singleton = SyscallList::GetInstance();
return singleton->getSyscallAddress(FunctionHash);
}
#include "syscall.hpp"
DWORD GlobalHash = 0x0;
EXTERN_C DWORD getGlobalHash()
{
return GlobalHash;
}
DWORD SW3_HashSyscall(const char *FunctionName)
{
DWORD Hash = 0x811C9DC5; // FNV offset basis
DWORD FNV_prime = 0x01000193; // FNV prime
int c;
while (c = *FunctionName++)
{
Hash ^= c; // XOR the byte into the lowest byte of the hash
Hash *= FNV_prime; // Multiply by FNV prime
}
return Hash & 0xFFFFFFFF; // Ensure the result is a 32-bit hash
}
bool compareEntry(Entry i1, Entry i2)
{
return (i1.getAddress() < i2.getAddress());
}
SyscallList* SyscallList::singleton_= nullptr;
SyscallList *SyscallList::GetInstance()
{
if(singleton_==nullptr){
singleton_ = new SyscallList();
}
return singleton_;
}
EXTERN_C DWORD SW3_GetSyscallNumber(DWORD FunctionHash)
{
SyscallList* singleton = SyscallList::GetInstance();
return singleton->getSyscallNumber(FunctionHash);
}
EXTERN_C PVOID SW3_GetSyscallAddress(DWORD FunctionHash)
{
SyscallList* singleton = SyscallList::GetInstance();
return singleton->getSyscallAddress(FunctionHash);
}
modules/ModuleCmd/syscall.hpp
+633 -633
View File
File diff suppressed because it is too large Load Diff
modules/ModuleCmd/tests/testsHwbp.cpp
+11 -11
View File
@@ -6,17 +6,17 @@
LONG WINAPI hanlderToTrigger(EXCEPTION_POINTERS * ExceptionInfo)
{
if (ExceptionInfo->ExceptionRecord->ExceptionCode == EXCEPTION_SINGLE_STEP)
{
BYTE* baseAddress = (BYTE*)xGetProcAddress(xGetLibAddress((PCHAR)"Kernel32", TRUE, NULL), (PCHAR)"GetProcessVersion", 0);
if (ExceptionInfo->ContextRecord->Rip == (DWORD64) baseAddress)
{
if (ExceptionInfo->ExceptionRecord->ExceptionCode == EXCEPTION_SINGLE_STEP)
{
BYTE* baseAddress = (BYTE*)xGetProcAddress(xGetLibAddress((PCHAR)"Kernel32", TRUE, NULL), (PCHAR)"GetProcessVersion", 0);
if (ExceptionInfo->ContextRecord->Rip == (DWORD64) baseAddress)
{
std::cout << "Hello from GetProcessVersion " << std::endl;
ExceptionInfo->ContextRecord->Rip++; // or skip the breakpoint via instruction pointer
}
return EXCEPTION_CONTINUE_EXECUTION;
}
return EXCEPTION_CONTINUE_SEARCH;
ExceptionInfo->ContextRecord->Rip++; // or skip the breakpoint via instruction pointer
}
return EXCEPTION_CONTINUE_EXECUTION;
}
return EXCEPTION_CONTINUE_SEARCH;
}
@@ -29,7 +29,7 @@ int main()
int indexHWBP = 0;
HANDLE bp;
set_hwbp(GetCurrentThread(), baseAddress, hanlderToTrigger, indexHWBP, &bp);
set_hwbp(GetCurrentThread(), baseAddress, hanlderToTrigger, indexHWBP, &bp);
std::cout << "bp " << bp << std::endl;
modules/ModuleCmd/tests/testsModuleCmd.cpp
+440 -440
View File
File diff suppressed because it is too large Load Diff
modules/ModuleCmd/tests/testsSyscall.cpp
+2 -2
View File
@@ -39,7 +39,7 @@ int main()
return -1;
}
std::string destinationBuffer = "test";
std::string payload = "test";
@@ -98,7 +98,7 @@ int main()
static OBJECT_ATTRIBUTES zoa = { sizeof(zoa) };
CLIENT_ID pid;
pid.UniqueProcess = (HANDLE)dwPid;
pid.UniqueThread = 0;
pid.UniqueThread = 0;
status = Sw3NtOpenProcess_(&handle, PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE, &zoa, (CLIENT_ID*)&pid);
if(status!=0)
{