From d2cb88a75b21be6cab646169e708e96f6119025a Mon Sep 17 00:00:00 2001 From: maxdcb <40819564+maxDcb@users.noreply.github.com> Date: Fri, 1 May 2026 14:38:13 +0200 Subject: [PATCH] arch for modules that need it --- modules/AssemblyExec/AssemblyExec.cpp | 16 +-------- .../AssemblyExec/tests/testsAssemblyExec.cpp | 4 +++ modules/Chisel/Chisel.cpp | 16 +-------- modules/Chisel/tests/testsChisel.cpp | 2 ++ modules/Inject/Inject.cpp | 17 +-------- modules/Inject/tests/testsInject.cpp | 2 ++ modules/ModuleCmd/ModuleCmd.hpp | 35 +++++++++++++++++++ modules/tests/TestHelpers.hpp | 11 ++++++ 8 files changed, 57 insertions(+), 46 deletions(-) diff --git a/modules/AssemblyExec/AssemblyExec.cpp b/modules/AssemblyExec/AssemblyExec.cpp index 163cc5e..d6b0197 100644 --- a/modules/AssemblyExec/AssemblyExec.cpp +++ b/modules/AssemblyExec/AssemblyExec.cpp @@ -79,7 +79,6 @@ AssemblyExec::~AssemblyExec() } -// TODO add arch std::string AssemblyExec::getInfo() { std::string info; @@ -220,20 +219,7 @@ int AssemblyExec::init(std::vector &splitedCmd, C2Message &c2Messag { // if we create a process we need to exite process with donut shellcode // Otherwise we exite the threadd - std::string arch = "x64"; - -// for tests -#ifdef _WIN32 - #if defined(_M_X64) || defined(__x86_64__) - arch = "x64"; - #elif defined(_M_IX86) || defined(__i386__) - arch = "x86"; - #elif defined(_M_ARM64) || defined(__aarch64__) - arch = "arm64"; - #endif -#endif - - creatShellCodeDonut(inputFile, method, args, payload, true, false, arch); + creatShellCodeDonut(inputFile, method, args, payload, true, false, m_windowsArch); } else { diff --git a/modules/AssemblyExec/tests/testsAssemblyExec.cpp b/modules/AssemblyExec/tests/testsAssemblyExec.cpp index b79d384..abaab6a 100644 --- a/modules/AssemblyExec/tests/testsAssemblyExec.cpp +++ b/modules/AssemblyExec/tests/testsAssemblyExec.cpp @@ -40,6 +40,7 @@ int main() { bool ok = true; const std::string dummyExe = dummyExePath(); + const std::string currentArch = buildWindowsArch(); { AssemblyExec module; @@ -150,6 +151,7 @@ int main() { AssemblyExec module; + module.setWindowsArch(currentArch); std::vector cmd = {"assemblyExec", "-e", dummyPath.string()}; C2Message message; @@ -159,6 +161,7 @@ int main() { AssemblyExec module; + module.setWindowsArch(currentArch); C2Message modeMessage; std::vector modeCmd = {"assemblyExec", "thread"}; ok &= expect(module.init(modeCmd, modeMessage) == -1, "thread mode should be configurable before Donut EXE mode"); @@ -173,6 +176,7 @@ int main() { AssemblyExec module; + module.setWindowsArch(currentArch); C2Message modeMessage; std::vector modeCmd = {"assemblyExec", "processWithSpoofedParent"}; ok &= expect(module.init(modeCmd, modeMessage) == -1, "spoofed-parent mode should be configurable before Donut EXE mode"); diff --git a/modules/Chisel/Chisel.cpp b/modules/Chisel/Chisel.cpp index e89de09..0d40ff2 100644 --- a/modules/Chisel/Chisel.cpp +++ b/modules/Chisel/Chisel.cpp @@ -47,7 +47,6 @@ Chisel::~Chisel() { } -// TODO add arch std::string Chisel::getInfo() { std::string info; @@ -158,20 +157,7 @@ int Chisel::init(std::vector &splitedCmd, C2Message &c2Message) std::string method; std::string payload; - std::string arch = "x64"; - -// for tests -#ifdef _WIN32 - #if defined(_M_X64) || defined(__x86_64__) - arch = "x64"; - #elif defined(_M_IX86) || defined(__i386__) - arch = "x86"; - #elif defined(_M_ARM64) || defined(__aarch64__) - arch = "arm64"; - #endif -#endif - - creatShellCodeDonut(inputFile, method, args, payload, true, false, arch); + creatShellCodeDonut(inputFile, method, args, payload, true, false, m_windowsArch); if(payload.size()==0) { diff --git a/modules/Chisel/tests/testsChisel.cpp b/modules/Chisel/tests/testsChisel.cpp index 4e1802c..5235ba5 100644 --- a/modules/Chisel/tests/testsChisel.cpp +++ b/modules/Chisel/tests/testsChisel.cpp @@ -9,6 +9,7 @@ using namespace test_helpers; int main() { bool ok = true; + const std::string currentArch = buildWindowsArch(); { Chisel module; @@ -59,6 +60,7 @@ int main() { Chisel module; + module.setWindowsArch(currentArch); std::vector cmd = {"chisel", "missing.exe", "client", "host:8000", "R:socks"}; C2Message message; diff --git a/modules/Inject/Inject.cpp b/modules/Inject/Inject.cpp index 060c90b..f65b31d 100644 --- a/modules/Inject/Inject.cpp +++ b/modules/Inject/Inject.cpp @@ -67,7 +67,6 @@ int Inject::initConfig(const nlohmann::json &config) return 0; } -// TODO add arch std::string Inject::getInfo() { std::string info; @@ -183,20 +182,7 @@ int Inject::init(std::vector &splitedCmd, C2Message &c2Message) std::string payload; if(donut) { - std::string arch = "x64"; - -// for tests -#ifdef _WIN32 - #if defined(_M_X64) || defined(__x86_64__) - arch = "x64"; - #elif defined(_M_IX86) || defined(__i386__) - arch = "x86"; - #elif defined(_M_ARM64) || defined(__aarch64__) - arch = "arm64"; - #endif -#endif - - creatShellCodeDonut(inputFile, method, args, payload, true, false, arch); + creatShellCodeDonut(inputFile, method, args, payload, true, false, m_windowsArch); } else { @@ -468,4 +454,3 @@ int Inject::errorCodeToMsg(const C2Message &c2RetMessage, std::string &errorMsg) #endif return 0; } - diff --git a/modules/Inject/tests/testsInject.cpp b/modules/Inject/tests/testsInject.cpp index 51096c5..175d086 100644 --- a/modules/Inject/tests/testsInject.cpp +++ b/modules/Inject/tests/testsInject.cpp @@ -132,6 +132,7 @@ int main() { bool ok = true; const std::string dummyExe = dummyExePath(); + const std::string currentArch = buildWindowsArch(); { Inject module; @@ -224,6 +225,7 @@ int main() { Inject module; + module.setWindowsArch(currentArch); std::vector cmd = {"inject", "-e", dummyPath.string(), "1234", "alpha", "beta gamma"}; C2Message message; diff --git a/modules/ModuleCmd/ModuleCmd.hpp b/modules/ModuleCmd/ModuleCmd.hpp index c8ff053..6733b05 100644 --- a/modules/ModuleCmd/ModuleCmd.hpp +++ b/modules/ModuleCmd/ModuleCmd.hpp @@ -1,5 +1,9 @@ #pragma once +#if defined(BUILD_TEAMSERVER) || defined(C2CORE_BUILD_TESTS) || defined(C2CORE_BUILD_FUNCTIONAL_TESTS) + #include + #include +#endif #include #include #include @@ -31,6 +35,9 @@ public: { m_name=name; m_hash=hash; +#if defined(BUILD_TEAMSERVER) || defined(C2CORE_BUILD_TESTS) || defined(C2CORE_BUILD_FUNCTIONAL_TESTS) + m_windowsArch="x64"; +#endif } ~ModuleCmd() @@ -69,6 +76,31 @@ public: virtual std::string getInfo() = 0; +#if defined(BUILD_TEAMSERVER) || defined(C2CORE_BUILD_TESTS) || defined(C2CORE_BUILD_FUNCTIONAL_TESTS) + virtual int setWindowsArch(const std::string& windowsArch) + { + std::string normalizedArch = windowsArch; + std::transform(normalizedArch.begin(), normalizedArch.end(), normalizedArch.begin(), [](unsigned char c) + { + return static_cast(std::tolower(c)); + }); + + if(normalizedArch=="amd64" || normalizedArch=="x86_64") + normalizedArch="x64"; + else if(normalizedArch=="i386" || normalizedArch=="i686") + normalizedArch="x86"; + else if(normalizedArch=="aarch64") + normalizedArch="arm64"; + + if(normalizedArch=="x64" || normalizedArch=="x86" || normalizedArch=="arm64") + m_windowsArch=normalizedArch; + else + m_windowsArch="x64"; + + return 0; + } +#endif + // if an error ocurre: // set_returnvalue(errorMsg) && return -1 virtual int init(std::vector& splitedCmd, C2Message& c2Message) = 0; @@ -90,6 +122,9 @@ protected: std::string m_windowsBeaconsDirectoryPath; std::string m_toolsDirectoryPath; std::string m_scriptsDirectoryPath; +#if defined(BUILD_TEAMSERVER) || defined(C2CORE_BUILD_TESTS) || defined(C2CORE_BUILD_FUNCTIONAL_TESTS) + std::string m_windowsArch; +#endif private: diff --git a/modules/tests/TestHelpers.hpp b/modules/tests/TestHelpers.hpp index 03a51e2..a35de90 100644 --- a/modules/tests/TestHelpers.hpp +++ b/modules/tests/TestHelpers.hpp @@ -60,4 +60,15 @@ namespace test_helpers out << content; return path; } + + inline std::string buildWindowsArch() + { +#if defined(_M_ARM64) || defined(__aarch64__) + return "arm64"; +#elif defined(_M_IX86) || defined(__i386__) + return "x86"; +#else + return "x64"; +#endif + } }