mirror of
https://github.com/maxDcb/DreamWalkers
synced 2026-06-08 15:49:24 +00:00
maxdcb
136 lines
3.9 KiB
C
136 lines
3.9 KiB
C
#ifndef INSTANCE_H
|
|
#define INSTANCE_H
|
|
|
|
#include <windows.h>
|
|
#include <wincrypt.h>
|
|
#include <oleauto.h>
|
|
#include <objbase.h>
|
|
#include <wininet.h>
|
|
#include <shlwapi.h>
|
|
#include <stdint.h>
|
|
|
|
#pragma comment(lib, "wininet.lib")
|
|
#pragma comment(lib, "advapi32.lib")
|
|
#pragma comment(lib, "crypt32.lib")
|
|
#pragma comment(lib, "ole32.lib")
|
|
#pragma comment(lib, "shlwapi.lib")
|
|
#pragma comment(lib, "shell32.lib")
|
|
|
|
#include "peb.h"
|
|
#include "winapi.h"
|
|
|
|
#pragma pack(push, 1)
|
|
|
|
typedef struct _EXIT_VEH_CONTEXT
|
|
{
|
|
void* vehHandle;
|
|
LPBYTE k32ExitProcess;
|
|
LPBYTE ntdllExitUserProcess;
|
|
void* previousArbitraryUserPointer;
|
|
uint8_t savedK32Byte;
|
|
uint8_t savedNtdllByte;
|
|
uint8_t hasPreviousArbitraryUserPointer;
|
|
uint8_t reserved;
|
|
} EXIT_VEH_CONTEXT;
|
|
|
|
typedef struct _INSTANCE
|
|
{
|
|
uint32_t lenTest;
|
|
|
|
// Could be encrypted to avoid detection
|
|
uint8_t sKernel32DLL[32];
|
|
uint8_t sNtDLL[32];
|
|
uint16_t wsKernel32DLL[32];
|
|
uint8_t sKernelBaseDLL[32]; // cmdline
|
|
|
|
uint8_t sGetProcAddress[32];
|
|
uint8_t sGetModuleHandleA[32];
|
|
uint8_t sLoadLibraryA[32];
|
|
uint8_t sVirtualAlloc[32];
|
|
uint8_t sVirtualFree[32];
|
|
uint8_t sVirtualProtect[32];
|
|
uint8_t sGetNativeSystemInfo[32];
|
|
#if DW_HAS_STACK_SPOOFING
|
|
uint8_t sRtlLookupFunctionEntry[32]; // stack spoofing
|
|
uint8_t sBaseThreadInitThunk[32]; // stack spoofing
|
|
uint8_t sRtlUserThreadStart[32]; // stack spoofing
|
|
#endif
|
|
uint8_t sGetCommandLineA[32]; // cmdline
|
|
#if DW_HAS_RUNTIME_FUNCTION_TABLE
|
|
uint8_t sRtlAddFunctionTable[32]; // runtime unwind table
|
|
#endif
|
|
uint8_t sSleep[32];
|
|
uint8_t sAddVectoredExceptionHandler[32];
|
|
uint8_t sRemoveVectoredExceptionHandler[64];
|
|
uint8_t sExitThread[32];
|
|
uint8_t sExitProcess[32];
|
|
uint8_t sFlushInstructionCache[32];
|
|
uint8_t sGetCurrentProcess[32];
|
|
uint8_t sRtlExitUserProcess[32];
|
|
|
|
struct
|
|
{
|
|
LoadLibraryA_t LoadLibraryA;
|
|
GetProcAddress_t GetProcAddress;
|
|
GetModuleHandleA_t GetModuleHandleA;
|
|
VirtualAlloc_t VirtualAlloc;
|
|
VirtualFree_t VirtualFree;
|
|
VirtualProtect_t VirtualProtect;
|
|
GetCommandLineA_t GetCommandLineA; // cmdline
|
|
GetNativeSystemInfo_t GetNativeSystemInfo;
|
|
#if DW_HAS_STACK_SPOOFING
|
|
RtlLookupFunctionEntry_t RtlLookupFunctionEntry; // stack spoofing
|
|
BaseThreadInitThunk_t BaseThreadInitThunk; // stack spoofing
|
|
RtlUserThreadStart_t RtlUserThreadStart; // stack spoofing
|
|
#endif
|
|
#if DW_HAS_RUNTIME_FUNCTION_TABLE
|
|
RtlAddFunctionTable_t RtlAddFunctionTable; // runtime unwind table
|
|
#endif
|
|
Sleep_t Sleep;
|
|
AddVectoredExceptionHandler_t AddVectoredExceptionHandler;
|
|
RemoveVectoredExceptionHandler_t RemoveVectoredExceptionHandler;
|
|
ExitThread_t ExitThread;
|
|
ExitProcess_t ExitProcess;
|
|
FlushInstructionCache_t FlushInstructionCache;
|
|
GetCurrentProcess_t GetCurrentProcess;
|
|
} api;
|
|
|
|
uint32_t moduleSize;
|
|
|
|
// option for module stomping
|
|
uint8_t isModuleStompingUsed;
|
|
uint8_t sModuleToStomp[32];
|
|
|
|
// find the module that follow the loader
|
|
uint32_t instanceSize;
|
|
uint32_t loaderSize;
|
|
uint8_t sMagicBytes[8];
|
|
|
|
uint8_t sDataSec[8]; // cmdline
|
|
uint8_t sCmdLine[2048]; // cmdline
|
|
uint8_t exitMode;
|
|
|
|
EXIT_VEH_CONTEXT exitVehContext;
|
|
|
|
#if DW_HAS_RUNTIME_FUNCTION_TABLE
|
|
uint8_t sPDataSec[8]; // runtime unwind table
|
|
#endif
|
|
#if DW_HAS_STACK_SPOOFING
|
|
uint8_t sGadget[8]; // stack spoofing
|
|
#endif
|
|
|
|
uint8_t isDll;
|
|
uint8_t sdllMethode[256];
|
|
|
|
uint8_t isDotNet;
|
|
uint32_t dotnetLoaderSize;
|
|
uint32_t dotnetModuleSize;
|
|
|
|
void* ptrModuleTst; // LoaderTest
|
|
void* ptrDotNetModuleTst; // LoaderTest
|
|
|
|
} INSTANCE;
|
|
#pragma pack(pop)
|
|
|
|
#endif
|