diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..d106ec0 --- /dev/null +++ b/.gitignore @@ -0,0 +1,6 @@ +*.exe +*.pdb +*.obj +*.o +out.txt +err.txt diff --git a/err.txt b/err.txt deleted file mode 100644 index da4b4c2..0000000 --- a/err.txt +++ /dev/null @@ -1,37 +0,0 @@ -[*] Omegon Framework Test -[+] CoInitializeEx (main): 0x0 -[+] CoRegisterPSClsid (main): 0x0 -[+] CoRegisterClassObject (main): 0x0 -[PSF] CreateStub: fake_stub=0x2EA2B46F9D0, returning vtbl_ptr at 0x2EA2B46F9D8 -[PSF] fake_stub hex: - +0x00: 30 0E 47 2B EA 02 00 00 - +0x08: 10 3E 47 2B EA 02 00 00 - +0x10: 01 00 00 00 00 00 00 00 - +0x18: 30 0E 47 2B EA 02 00 00 - +0x20: 00 00 00 00 00 00 00 00 - +0x28: 00 00 00 00 00 00 00 00 - +0x30: 00 00 00 00 00 00 00 00 - +0x38: 00 00 00 00 00 00 00 00 - +0x40: F0 3D 47 2B EA 02 00 00 -[PSF] stub vtbl[0..5]: 0x7FF9E01D9D00 0x7FF9E01D8C40 0x7FF9E01D8C40 0x7FF9E0236970 0x7FF9E01D75D0 -[+] STA ready, stream=0x2EA2B491110 -[+] Calling CoGetInterfaceAndReleaseStream... -[PSF] CreateProxy called! -[RPB] Connect called! pChannel=0x2EA2B4A36F0 -[+] Unmarshal returned: 0x0 -[+] Omegon initialized -[+] State: ready -[*] Testing sleep mode: queue(NtDelay 2s) + execute()... -[MTA-sleep] Worker started, posting 3 calls -[MTA-sleep] GetBuffer OK method=7 -[MTA-sleep] PostCall OK method=7 hr=0x0 -[MTA-sleep] GetBuffer OK method=8 -[MTA-sleep] PostCall OK method=8 hr=0x0 -[MTA-sleep] GetBuffer OK method=9 -[MTA-sleep] PostCall OK method=9 hr=0x0 -[MTA-sleep] All done -[STA] Switching to pump fiber... -[STA] Returned from pump! -[STA] Pump cycle complete. -[+] Sleep mode complete! (total elapsed=4032ms) -[+] Omegon test complete diff --git a/initial-pocs/err.txt b/initial-pocs/err.txt deleted file mode 100644 index 9f05be9..0000000 --- a/initial-pocs/err.txt +++ /dev/null @@ -1,72 +0,0 @@ -[*] Async COM Sleep Chain PoC -[*] Zero user code on ANY callstack during sleep - -[+] CStdStubBuffer_Invoke: 0x7FF9DED9DC20 -[+] NdrStubCall2: 0x7FF9E01871B0 -[+] CoRegisterPSClsid (main): 0x0 -[+] CoRegisterClassObject (main): 0x0 -[+] NtProtect: 0x7FF9E0CC0A60 -[+] SF032: 0x7FF9DD3DAA30 -[+] NtDelay: 0x7FF9E0CC06E0 -[+] MIDL structures built -[+] NtDelayExecution: 0x7FF9E0CC06E0 -[+] STA thread: TID=127976 -[STA] Thread started -[PSF] CreateStub called! -[PSF] fake_stub hex: - +0x00: 50 C6 4C BD F6 7F 00 00 - +0x08: 28 C5 4C BD F6 7F 00 00 - +0x10: 01 00 00 00 00 00 00 00 - +0x18: 50 C6 4C BD F6 7F 00 00 - +0x20: 00 00 00 00 00 00 00 00 - +0x28: 00 00 00 00 00 00 00 00 - +0x30: 00 00 00 00 00 00 00 00 - +0x38: 00 00 00 00 00 00 00 00 - +0x40: 08 C5 4C BD F6 7F 00 00 -[PSF] stub vtbl[0..5]: 0x7FF9E01D9D00 0x7FF9E01D8C40 0x7FF9E01D8C40 0x7FF9E0236970 0x7FF9E01D75D0 -[STA] Waiting for unmarshal... -[+] STA ready -[+] Unmarshalling proxy... -[+] Calling CoGetInterfaceAndReleaseStream... -[PSF] CreateProxy called! -[RPB] Connect called! pChannel=0x1DE70FB0190 -[+] Unmarshal returned: 0x0 -[+] Proxy channel: 0x1DE70FB0190 -[STA] Setting up BlockFn fiber pump... -[STA] CCliModalLoop constructed (fCoWaitCalled=0) -[STA] Main fiber: 0x1DE70FB0250 -[STA] Pump fiber: 0x1DE70FB0790 (proc=combase!BlockFn @ 0x7FF9DEDA7F98) -[STA] Waiting for pump signal... -[+] STA fiber ready -[+] MTA worker: TID=127960 -[MTA] SOleTlsData+0x14 = 0x41 (before GetBuffer) -[MTA] Call object at 0x1DE70FB18E0, vtable at 0x7FF9DEF84508 -[MTA] vtable[11] (Send) = 0x7FF9DEE979B0 (RVA 0x1879B0) -[MTA] vtable[0] (QI) = 0x7FF9DEE33030 (RVA 0x123030) -[MTA] CSyncClientCall+0x40 (OXIDEntry) = 0x1DE70F9C6E0 -[MTA] CSyncClientCall+0xC0 (transport) = 0x1DE70FB1A10 -[MTA] CSyncClientCall+0xC8 (ServerCall) = 0x1DE70FB1CF0 -[MTA] OXIDEntry: dwFlags=0x4000001 hServerSTA=0x27D1352 -[MTA] OXIDEntry+0xE8 (CComApartment) = 0x1DE70F82C90 -[MTA] PostCall OK B1 (method 9) -[MTA] PostCall OK B2 (method 13) -[MTA] All 2 messages posted via PostCall. Thread exiting. -[+] MTA worker done posting messages -[+] MTA worker thread exited -[+] Signaling STA to pump... -[*] Waiting for chain completion (2s NtDelay)... -[STA] SOleTlsData = 0x1DE70F82A40 -[STA] CAptCallCtrl = 0x1DE70F9AF50 -[STA] _pTopCML = 0x51541FFB48 (should point to cml_buf @ 0x51541FFB48) -[STA] fake_client_call @ 0x51541FFA28, inner_obj @ 0x51541FF818 -[STA] fake_client_call+0xC0 = 0x51541FF818 -[STA] fake_client_call+0x108 = 0x244 -[STA] DEBUG: Attempting direct ModalLoop call to isolate crash... -[STA] CFG target = 0x7FF9DEDA9180 (NoOpReturn0 @ 0x7FF9DEDA9180) -[STA] Switching to pump fiber (ModalLoop wrapper in combase.dll)... -[STA] Returned from pump! Chain complete. -[STA] Switching back to pump fiber to let ModalLoop exit cleanly... -[+] STA thread completed -[+] DONE — NtDelay dispatched through COM pump successfully! - -[*] Done. diff --git a/initial-pocs/o1err.txt b/initial-pocs/o1err.txt deleted file mode 100644 index 53cd2fe..0000000 --- a/initial-pocs/o1err.txt +++ /dev/null @@ -1,72 +0,0 @@ -[*] Async COM Sleep Chain PoC -[*] Zero user code on ANY callstack during sleep - -[+] CStdStubBuffer_Invoke: 0x7FF9DED9DC20 -[+] NdrStubCall2: 0x7FF9E01871B0 -[+] CoRegisterPSClsid (main): 0x0 -[+] CoRegisterClassObject (main): 0x0 -[+] NtProtect: 0x7FF9E0CC0A60 -[+] SF032: 0x7FF9DD3DAA30 -[+] NtDelay: 0x7FF9E0CC06E0 -[+] MIDL structures built -[+] NtDelayExecution: 0x7FF9E0CC06E0 -[+] STA thread: TID=124076 -[STA] Thread started -[PSF] CreateStub called! -[PSF] fake_stub hex: - +0x00: 50 C6 20 0E F7 7F 00 00 - +0x08: 28 C5 20 0E F7 7F 00 00 - +0x10: 01 00 00 00 00 00 00 00 - +0x18: 50 C6 20 0E F7 7F 00 00 - +0x20: 00 00 00 00 00 00 00 00 - +0x28: 00 00 00 00 00 00 00 00 - +0x30: 00 00 00 00 00 00 00 00 - +0x38: 00 00 00 00 00 00 00 00 - +0x40: 08 C5 20 0E F7 7F 00 00 -[PSF] stub vtbl[0..5]: 0x7FF9E01D9D00 0x7FF9E01D8C40 0x7FF9E01D8C40 0x7FF9E0236970 0x7FF9E01D75D0 -[STA] Waiting for unmarshal... -[+] STA ready -[+] Unmarshalling proxy... -[+] Calling CoGetInterfaceAndReleaseStream... -[PSF] CreateProxy called! -[RPB] Connect called! pChannel=0x1B457321EF0 -[+] Unmarshal returned: 0x0 -[+] Proxy channel: 0x1B457321EF0 -[STA] Setting up BlockFn fiber pump... -[STA] CCliModalLoop constructed (fCoWaitCalled=0) -[STA] Main fiber: 0x1B457321FB0 -[STA] Pump fiber: 0x1B4573224F0 (proc=combase!BlockFn @ 0x7FF9DEDA7F98) -[STA] Waiting for pump signal... -[+] STA fiber ready -[+] MTA worker: TID=88896 -[MTA] SOleTlsData+0x14 = 0x41 (before GetBuffer) -[MTA] Call object at 0x1B4573237A0, vtable at 0x7FF9DEF84508 -[MTA] vtable[11] (Send) = 0x7FF9DEE979B0 (RVA 0x1879B0) -[MTA] vtable[0] (QI) = 0x7FF9DEE33030 (RVA 0x123030) -[MTA] CSyncClientCall+0x40 (OXIDEntry) = 0x1B45730D770 -[MTA] CSyncClientCall+0xC0 (transport) = 0x1B4573238D0 -[MTA] CSyncClientCall+0xC8 (ServerCall) = 0x1B457323BB0 -[MTA] OXIDEntry: dwFlags=0x4000001 hServerSTA=0x1400C28 -[MTA] OXIDEntry+0xE8 (CComApartment) = 0x1B4572F2CA0 -[MTA] PostCall OK B1 (method 9) -[MTA] PostCall OK B2 (method 13) -[MTA] All 2 messages posted via PostCall. Thread exiting. -[+] MTA worker done posting messages -[+] MTA worker thread exited -[+] Signaling STA to pump... -[*] Waiting for chain completion (2s NtDelay)... -[STA] SOleTlsData = 0x1B4572F2A50 -[STA] CAptCallCtrl = 0x1B45730AB00 -[STA] _pTopCML = 0x9E07FFF718 (should point to cml_buf @ 0x9E07FFF718) -[STA] fake_client_call @ 0x9E07FFF5F8, inner_obj @ 0x9E07FFF3E8 -[STA] fake_client_call+0xC0 = 0x9E07FFF3E8 -[STA] fake_client_call+0x108 = 0x244 -[STA] DEBUG: Attempting direct ModalLoop call to isolate crash... -[STA] CFG target = 0x7FF9DEDA9180 (NoOpReturn0 @ 0x7FF9DEDA9180) -[STA] Switching to pump fiber (ModalLoop wrapper in combase.dll)... -[STA] Returned from pump! Chain complete. -[STA] Switching back to pump fiber to let ModalLoop exit cleanly... -[+] STA thread completed -[+] DONE — NtDelay dispatched through COM pump successfully! - -[*] Done. diff --git a/initial-pocs/o1out.txt b/initial-pocs/o1out.txt deleted file mode 100644 index e69de29..0000000 diff --git a/initial-pocs/omega1_cmp.exe b/initial-pocs/omega1_cmp.exe deleted file mode 100644 index 9247d4c..0000000 Binary files a/initial-pocs/omega1_cmp.exe and /dev/null differ diff --git a/initial-pocs/omega1_cmp.pdb b/initial-pocs/omega1_cmp.pdb deleted file mode 100644 index 5c93c62..0000000 Binary files a/initial-pocs/omega1_cmp.pdb and /dev/null differ diff --git a/initial-pocs/omega1_err.txt b/initial-pocs/omega1_err.txt deleted file mode 100644 index e34babc..0000000 --- a/initial-pocs/omega1_err.txt +++ /dev/null @@ -1,67 +0,0 @@ -[*] Async COM Sleep Chain PoC -[*] Zero user code on ANY callstack during sleep - -[+] CStdStubBuffer_Invoke: 0x7FF9DED9DC20 -[+] NdrStubCall2: 0x7FF9E01871B0 -[+] CoRegisterPSClsid (main): 0x0 -[+] CoRegisterClassObject (main): 0x0 -[+] NtProtect: 0x7FF9E0CC0A60 -[+] SF032: 0x7FF9DD3DAA30 -[+] NtDelay: 0x7FF9E0CC06E0 -[+] MIDL structures built -[+] MessageBoxA: 0x7FF9DEBCEBC0 -[+] STA thread: TID=125204 -[STA] Thread started -[PSF] CreateStub called! -[PSF] fake_stub hex: - +0x00: 50 F6 05 74 F7 7F 00 00 - +0x08: 28 F5 05 74 F7 7F 00 00 - +0x10: 01 00 00 00 00 00 00 00 - +0x18: 50 F6 05 74 F7 7F 00 00 - +0x20: 00 00 00 00 00 00 00 00 - +0x28: 00 00 00 00 00 00 00 00 - +0x30: 00 00 00 00 00 00 00 00 - +0x38: 00 00 00 00 00 00 00 00 - +0x40: 08 F5 05 74 F7 7F 00 00 -[PSF] stub vtbl[0..5]: 0x7FF9E01D9D00 0x7FF9E01D8C40 0x7FF9E01D8C40 0x7FF9E0236970 0x7FF9E01D75D0 -[STA] Waiting for unmarshal... -[+] STA ready -[+] Unmarshalling proxy... -[+] Calling CoGetInterfaceAndReleaseStream... -[PSF] CreateProxy called! -[RPB] Connect called! pChannel=0x24EB08EEC90 -[+] Unmarshal returned: 0x0 -[+] Proxy channel: 0x24EB08EEC90 -[STA] Setting up BlockFn fiber pump... -[STA] CCliModalLoop constructed (fCoWaitCalled=0) -[STA] Main fiber: 0x24EB08EED50 -[STA] Pump fiber: 0x24EB08EF290 (proc=combase!BlockFn @ 0x7FF9DEDA7F98) -[STA] Waiting for pump signal... -[+] STA fiber ready -[+] .text at 0x7FF773F61000, size 0xB4516 -[+] .text first 16 bytes (before): 55 48 81 EC 20 02 00 00 48 8D AC 24 80 00 00 00 -[+] MTA worker: TID=42344 -[MTA] SOleTlsData+0x14 = 0x41 (before GetBuffer) -[MTA] Call object at 0x24EB08F2550, vtable at 0x7FF9DEF84508 -[MTA] vtable[11] (Send) = 0x7FF9DEE979B0 (RVA 0x1879B0) -[MTA] vtable[0] (QI) = 0x7FF9DEE33030 (RVA 0x123030) -[MTA] CSyncClientCall+0x40 (OXIDEntry) = 0x24EB08DC4B0 -[MTA] CSyncClientCall+0xC0 (transport) = 0x24EB08F2680 -[MTA] CSyncClientCall+0xC8 (ServerCall) = 0x24EB08F2960 -[MTA] OXIDEntry: dwFlags=0x4000001 hServerSTA=0x22141C -[MTA] OXIDEntry+0xE8 (CComApartment) = 0x24EB08E9490 -[MTA] PostCall OK B1 (method 12) -[MTA] All 1 messages posted via PostCall. Thread exiting. -[+] MTA worker done posting messages -[+] MTA worker thread exited — ZERO .text frames on any stack -[+] Signaling STA to pump... -[*] Waiting for chain completion (3s NtDelay while .text encrypted)... -[STA] SOleTlsData = 0x24EB08C26A0 -[STA] CAptCallCtrl = 0x24EB08DA030 -[STA] _pTopCML = 0x54501FF568 (should point to cml_buf @ 0x54501FF568) -[STA] fake_client_call @ 0x54501FF448, inner_obj @ 0x54501FF238 -[STA] fake_client_call+0xC0 = 0x54501FF238 -[STA] fake_client_call+0x108 = 0x24C -[STA] DEBUG: Attempting direct ModalLoop call to isolate crash... -[STA] CFG target = 0x7FF9DEDA9180 (NoOpReturn0 @ 0x7FF9DEDA9180) -[STA] Switching to pump fiber (ModalLoop wrapper in combase.dll)... diff --git a/initial-pocs/omega1_ntd.exe b/initial-pocs/omega1_ntd.exe deleted file mode 100644 index 0eda2ac..0000000 Binary files a/initial-pocs/omega1_ntd.exe and /dev/null differ diff --git a/initial-pocs/omega1_ntd.pdb b/initial-pocs/omega1_ntd.pdb deleted file mode 100644 index b961344..0000000 Binary files a/initial-pocs/omega1_ntd.pdb and /dev/null differ diff --git a/initial-pocs/omega1_out.txt b/initial-pocs/omega1_out.txt deleted file mode 100644 index e69de29..0000000 diff --git a/initial-pocs/omega1_test.exe b/initial-pocs/omega1_test.exe deleted file mode 100644 index 1cc338a..0000000 Binary files a/initial-pocs/omega1_test.exe and /dev/null differ diff --git a/initial-pocs/omega1_test.pdb b/initial-pocs/omega1_test.pdb deleted file mode 100644 index bf9d5cc..0000000 Binary files a/initial-pocs/omega1_test.pdb and /dev/null differ diff --git a/initial-pocs/out.txt b/initial-pocs/out.txt deleted file mode 100644 index e69de29..0000000 diff --git a/omega1_test.exe b/omega1_test.exe deleted file mode 100644 index c9e0c8c..0000000 Binary files a/omega1_test.exe and /dev/null differ diff --git a/omega1_test.pdb b/omega1_test.pdb deleted file mode 100644 index 39cf303..0000000 Binary files a/omega1_test.pdb and /dev/null differ diff --git a/omegon_test.exe b/omegon_test.exe deleted file mode 100644 index 1a2dce9..0000000 Binary files a/omegon_test.exe and /dev/null differ diff --git a/omegon_test.pdb b/omegon_test.pdb deleted file mode 100644 index 6554809..0000000 Binary files a/omegon_test.pdb and /dev/null differ diff --git a/out.txt b/out.txt deleted file mode 100644 index e69de29..0000000