Add files via upload

constants.py

@@ -0,0 +1,51 @@
+
+
+dataTypes = {
+    "PWSTR":0x4,
+    "PVOID":0x4,
+    "PWCHAR":0x4,
+    "PSIZE_T":0x4,
+    "HANDLE":0x4,
+    "SIZE_T":0x4,
+    "UCHAR":0x1,
+    "USHORT":0x2,
+    "BYTE":0x1,
+    "ULONG":0x4,
+    "ULONG_PTR":0x4,
+    "SIZE_T":0x4,
+    "NTSTATUS":0x4,
+    "DWORD":0x4,
+    "KPRIORITY":0x4,
+    "ACCESS_MASK":0x4}
+
+specialVars = {"GetCurrentProcess()":hex(0xffffffff),
+    "MEM_COMMIT":hex(0x1000),
+    "MEM_RESERVE":hex(0x2000),
+    "MEM_RELEASE":hex(0x8000),
+    "PAGE_EXECUTE_READWRITE":hex(0x40),
+    "PAGE_READWRITE":hex(0x4),
+    "PAGE_READONLY":hex(0x2),
+    "PROCESS_ALL_ACCESS":hex(0x1fffff),
+    "THREAD_ALL_ACCESS":hex(0x001FFFFF),
+    "False":hex(0x0),
+    "True":hex(0x1),
+    "NTSTATUS":"NULL",
+    "NULL":hex(0x0)}
+
+
+sysCalls = {"NtAllocateVirtualMemory":{"10":["0018"],
+                                       "11":["0018"]
+                                       },
+            "NtQuerySystemInformation":{"10":["0036"],
+                                        "11":["0167" ,"0169", "016c", "016c", "016d"]
+                                        },
+            "NtOpenProcess":{"10":["0026"],
+                             "11":["0029"]
+                             },
+            "NtWriteVirtualMemory":{"10":["003A"],
+                                    "11":["0030"]
+                                    },
+            "NtCreateThreadEx":{"10":["00b3","00b4","00b6","00b9","00ba","00bb","00bc","00bd","00bd","00c1","00c1","00c1","00c2","00c2"],
+                                "11":["00c5","00c6","00c7","00c7","00c8"]
+                }
+        }

if.c

@@ -0,0 +1,26 @@
+#include <Windows.h>
+#include <iostream>
+
+// Define necessary structures and types
+
+typedef struct _UNICODE_STRING {
+    USHORT Length;
+    USHORT MaximumLength;
+    PWSTR  Buffer;
+} UNICODE_STRING, *PUNICODE_STRING;
+
+
+
+<MAIN>
+{
+
+	DWORD test = 10;
+	DWORD test2 = 12;
+	while(TRUE){
+	if (test == test2){
+		break;
+	}
+	}
+	
+
+}

nt.c

@@ -0,0 +1,52 @@
+#include <Windows.h>
+#include <stdio.h>
+
+// Define NTDLL function prototypes
+typedef struct _UNICODE_STRING {
+    USHORT Length;
+    USHORT MaximumLength;
+    PWSTR  Buffer;
+} UNICODE_STRING, *PUNICODE_STRING;
+
+typedef struct _OBJECT_ATTRIBUTES {
+  ULONG           Length;
+  HANDLE          RootDirectory;
+  PUNICODE_STRING ObjectName;
+  ULONG           Attributes;
+  PVOID           SecurityDescriptor;
+  PVOID           SecurityQualityOfService;
+} OBJECT_ATTRIBUTES;
+
+typedef struct _CLIENT_ID {
+    HANDLE UniqueProcess;
+    HANDLE UniqueThread;
+} CLIENT_ID;
+
+<MAIN> 
+{
+
+    HANDLE processHandle = GetCurrentProcess();
+	PVOID remoteAddress = NULL;
+	OBJECT_ATTRIBUTES ObjectAttributes = { 0 };
+	CLIENT_ID ClientId;
+	ClientId.UniqueProcess = 8888;
+	NTSTATUS status;
+	HANDLE hProcess = NULL;
+	DWORD DesiredAccess = PROCESS_ALL_ACCESS;
+	DWORD allocationSize = 1024;
+	status = NtOpenProcess(
+			&hProcess,
+			DesiredAccess,
+			&ObjectAttributes,
+			&ClientId
+			);
+
+	status = NtAllocateVirtualMemory(hProcess, 
+			&remoteAddress,
+			0, 
+			&allocationSize,
+			MEM_COMMIT | MEM_RESERVE,
+			PAGE_READWRITE);
+
+    return 0;
+}

ntalloc.c

@@ -0,0 +1,34 @@
+#include <Windows.h>
+#include <stdio.h>
+
+// Define NTDLL function prototypes
+typedef struct _UNICODE_STRING {
+    USHORT Length;
+    USHORT MaximumLength;
+    PWSTR  Buffer;
+} UNICODE_STRING, *PUNICODE_STRING;
+
+typedef struct _OBJECT_ATTRIBUTES {
+  ULONG           Length;
+  HANDLE          RootDirectory;
+  PUNICODE_STRING ObjectName;
+  ULONG           Attributes;
+  PVOID           SecurityDescriptor;
+  PVOID           SecurityQualityOfService;
+} OBJECT_ATTRIBUTES;
+
+typedef struct _CLIENT_ID {
+    HANDLE UniqueProcess;
+    HANDLE UniqueThread;
+} CLIENT_ID;
+
+<MAIN> 
+{
+
+	NTSTATUS status;
+    PVOID address = NULL;
+    SIZE_T size = 4096; 
+    NtAllocateVirtualMemory(GetCurrentProcess(), &address, 0, &size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
+	NtWriteVirtualMemoty(
+    return 0;
+}

ntalloc2.c

@@ -0,0 +1,27 @@
+#include <Windows.h>
+#include <iostream>
+
+// Define necessary structures and types
+
+
+
+
+
+
+
+<MAIN>
+{
+
+	PVOID BaseAddress = NULL;
+	ULONG NumberOfBytesWritten = 0;
+	SIZE_T RegionSize = 0x2000;
+	DWORD ZeroBits = 0;
+	HANDLE hProcess = GetCurrentProcess();
+	NtAllocateVirtualMemory(hProcess, &BaseAddress, ZeroBits, &RegionSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE)
+	PVOID buffer = "Hello";	
+	ULONG NumberOfBytesToWrite = sizeof(buffer);
+	NtWriteVirtualMemory(hProcess, BaseAddress, buffer, NumberOfBytesToWrite, &NumberOfBytesWritten);
+	
+	}
+
+}

ntquery.c

@@ -0,0 +1,25 @@
+#include <Windows.h>
+#include <iostream>
+
+// Define necessary structures and types
+
+typedef struct _UNICODE_STRING {
+    USHORT Length;
+    USHORT MaximumLength;
+    PWSTR  Buffer;
+} UNICODE_STRING, *PUNICODE_STRING;
+
+
+
+<MAIN>
+{
+
+	DWORD test = 10;
+	while(TRUE){
+	if (test <= 12){
+		break;
+	}
+	}
+	
+
+}

ntwritevirtmem.c

@@ -0,0 +1,50 @@
+#include <Windows.h>
+#include <iostream>
+
+// Define necessary structures and types
+
+typedef struct _UNICODE_STRING {
+    USHORT Length;
+    USHORT MaximumLength;
+    PWSTR  Buffer;
+} UNICODE_STRING, *PUNICODE_STRING;
+
+typedef struct _OBJECT_ATTRIBUTES {
+    ULONG Length;
+    HANDLE RootDirectory;
+    PUNICODE_STRING ObjectName;
+    ULONG Attributes;
+    PVOID SecurityDescriptor;
+    PVOID SecurityQualityOfService;
+} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
+
+
+typedef struct _CLIENT_ID {
+    HANDLE UniqueProcess;
+    HANDLE UniqueThread;
+} CLIENT_ID, *PCLIENT_ID;
+
+
+
+<MAIN>
+{
+
+    DWORD targetProcessId = 5244;
+
+    CLIENT_ID clientId = NULL;
+
+	OBJECT_ATTRIBUTES ObjectAttributes = { 0 };
+    clientId.UniqueProcess = targetProcessId;
+    clientId.UniqueThread = NULL;
+
+    HANDLE hProcess = NULL;
+    NtOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &ObjectAttributes, &clientId);
+	PVOID remoteBuffer = NULL;
+    SIZE_T bufferSize = 4096; 
+	ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES)
+	PVOID mystr = "Hello, World!";
+	ULONG numOfBytesWritten = 0;
+	
+    NtAllocateVirtualMemory(hProcess, &remoteBuffer, 0, &bufferSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+	NtWriteVirtualMemory(hProcess, remoteBuffer, dataToWrite, 13, &numOfBytesWritten);
+}

ntwrt.c

@@ -0,0 +1,118 @@
+#include <Windows.h>
+#include <iostream>
+
+// Define necessary structures and types
+
+typedef struct _UNICODE_STRING {
+    USHORT Length;
+    USHORT MaximumLength;
+    PWSTR  Buffer;
+} UNICODE_STRING, *PUNICODE_STRING;
+
+hidden struct _SYSTEM_PROCESS_INFORMATION {
+    ULONG NextEntryOffset;
+    ULONG NumberOfThreads;
+    BYTE Reserved1[48];
+	PUNICODE_STRING ImageName;
+    KPRIORITY BasePriority;
+    HANDLE UniqueProcessId;
+    PVOID Reserved2;
+    ULONG HandleCount;
+    ULONG SessionId;
+    PVOID Reserved3;
+    SIZE_T PeakVirtualSize;
+    SIZE_T VirtualSize;
+    ULONG Reserved4;
+    SIZE_T PeakWorkingSetSize;
+    SIZE_T WorkingSetSize;
+    PVOID Reserved5;
+    SIZE_T QuotaPagedPoolUsage;
+    PVOID Reserved6;
+    SIZE_T QuotaNonPagedPoolUsage;
+    SIZE_T PagefileUsage;
+    SIZE_T PeakPagefileUsage;
+    SIZE_T PrivatePageCount;
+	LARGE_INTEGER Reserved7[6];
+} SYSTEM_PROCESS_INFORMATION;
+
+typedef struct _OBJECT_ATTRIBUTES {
+    ULONG Length;
+    HANDLE RootDirectory;
+    PUNICODE_STRING ObjectName;
+    ULONG Attributes;
+    PVOID SecurityDescriptor;
+    PVOID SecurityQualityOfService;
+} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
+
+
+typedef struct _CLIENT_ID {
+    HANDLE UniqueProcess;
+    HANDLE UniqueThread;
+} CLIENT_ID, *PCLIENT_ID;
+
+
+
+<MAIN>
+{
+
+	UNICODE_STRING NtImagePath;
+    CLIENT_ID clientId = NULL;
+	OBJECT_ATTRIBUTES ObjectAttributes = { 0 };
+    clientId.UniqueThread = NULL;
+	ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES); 
+	PVOID BaseAddress = NULL;
+	ULONG NumberOfBytesWritten = 0;
+	SIZE_T RegionSize = 0x2000;
+	DWORD p = NULL;
+	DWORD ZeroBits = 0;
+	DWORD dwRet = NULL;
+	NTSTATUS dwStatus = NULL;
+	DWORD SystemProcessInformation = 0x5;
+	DWORD nextEntry = 0;
+	DWORD imageName = 0;
+	DWORD newBaseAddress = 0;
+	DWORD processId = 0;
+	while(TRUE){
+	  NtAllocateVirtualMemory(GetCurrentProcess(), &BaseAddress, ZeroBits, &RegionSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)
+	  dwStatus = NtQuerySystemInformation(SystemProcessInformation, BaseAddress, RegionSize, &dwRet);
+	  if (dwStatus == 0)
+	  {
+		break;
+	  }
+	  dwRet += 0x2000;
+	  RegionSize = dwRet;
+	  BaseAddress = 0;
+	}
+	
+	newBaseAddress = BaseAddress;
+	while(TRUE){
+	nextEntry = (SYSTEM_PROCESS_INFORMATION)newBaseAddress->NextEntryOffset;
+	if (nextEntry == 0)
+	{
+		break;
+	}
+	newBaseAddress += nextEntry;
+	imageName = (SYSTEM_PROCESS_INFORMATION)newBaseAddress->ImageName->Buffer;
+    InitUnicodeStr(NtImagePath, "CrypTool.exe");
+	if (imageName == NtImagePath)
+	{
+		processId = (SYSTEM_PROCESS_INFORMATION)newBaseAddress->UniqueProcessId;
+		break;
+	}
+	}
+	HANDLE hProcess = NULL;
+	OBJECT_ATTRIBUTES ObjectAttributes = { 0 };
+	CLIENT_ID ClientId;
+	ClientId.UniqueProcess = processId;
+	NtOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &ObjectAttributes, &ClientId);
+	BaseAddress = 0;
+	NtAllocateVirtualMemory(hProcess, &BaseAddress, ZeroBits, &RegionSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
+	PVOID buffer = "h";
+	ULONG NumberOfBytesToWrite = sizeof(buffer);
+	NtWriteVirtualMemory(hProcess, BaseAddress, buffer, NumberOfBytesToWrite, &NumberOfBytesWritten);
+	HANDLE ThreadHandle = NULL;
+	NtCreateThreadEx(&ThreadHandle, 0x1FFFFF, NULL, hProcess, BaseAddress, NULL, NULL, NULL, NULL, NULL, NULL);
+	
+	}
+
+}

ntwrt.old.c

@@ -0,0 +1,80 @@
+#include <Windows.h>
+#include <iostream>
+
+// Define necessary structures and types
+
+typedef struct _UNICODE_STRING {
+    USHORT Length;
+    USHORT MaximumLength;
+    PWSTR  Buffer;
+} UNICODE_STRING, *PUNICODE_STRING;
+
+hidden struct _SYSTEM_PROCESS_INFORMATION {
+    ULONG NextEntryOffset;
+    ULONG NumberOfThreads;
+    BYTE Reserved1[48];
+	PUNICODE_STRING ImageName;
+    KPRIORITY BasePriority;
+    HANDLE UniqueProcessId;
+    PVOID Reserved2;
+    ULONG HandleCount;
+    ULONG SessionId;
+    PVOID Reserved3;
+    SIZE_T PeakVirtualSize;
+    SIZE_T VirtualSize;
+    ULONG Reserved4;
+    SIZE_T PeakWorkingSetSize;
+    SIZE_T WorkingSetSize;
+    PVOID Reserved5;
+    SIZE_T QuotaPagedPoolUsage;
+    PVOID Reserved6;
+    SIZE_T QuotaNonPagedPoolUsage;
+    SIZE_T PagefileUsage;
+    SIZE_T PeakPagefileUsage;
+    SIZE_T PrivatePageCount;
+	LARGE_INTEGER Reserved7[6];
+} SYSTEM_PROCESS_INFORMATION;
+
+typedef struct _OBJECT_ATTRIBUTES {
+    ULONG Length;
+    HANDLE RootDirectory;
+    PUNICODE_STRING ObjectName;
+    ULONG Attributes;
+    PVOID SecurityDescriptor;
+    PVOID SecurityQualityOfService;
+} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
+
+
+typedef struct _CLIENT_ID {
+    HANDLE UniqueProcess;
+    HANDLE UniqueThread;
+} CLIENT_ID, *PCLIENT_ID;
+
+
+
+<MAIN>
+{
+
+    DWORD targetProcessId = 0x9c0;
+    CLIENT_ID clientId = NULL;
+	OBJECT_ATTRIBUTES ObjectAttributes = { 0 };
+    clientId.UniqueProcess = targetProcessId;
+    clientId.UniqueThread = NULL;
+    HANDLE hProcess = NULL;
+	ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES); 
+	PVOID BaseAddress = NULL;
+	ULONG_PTR ZeroBits = NULL;
+	ULONG NumberOfBytesWritten = 0;
+	SIZE_T RegionSize = 0x1000;
+	DWORD rtn = NULL;
+	DWORD imageName = NULL;
+    NtOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &ObjectAttributes, &clientId);
+
+	rtn = NtAllocateVirtualMemory(hProcess, &BaseAddress, ZeroBits, &RegionSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)
+	imageName = (SYSTEM_PROCESS_INFORMATION)rtn->ImageName->Length;
+	PVOID Buffer = "Hello, World!";
+	ULONG NumberOfBytesToWrite = sizeof(Buffer);
+	NtWriteVirtualMemory(hProcess, BaseAddress, Buffer, NumberOfBytesToWrite, &NumberOfBytesWritten);
+
+
+}

q.c

@@ -0,0 +1,70 @@
+typedef struct _UNICODE_STRING {
+    USHORT Length;
+    USHORT MaximumLength;
+    PWSTR  Buffer;
+} UNICODE_STRING, *PUNICODE_STRING;
+
+
+
+
+hidden struct _SYSTEM_PROCESS_INFORMATION {
+    ULONG NextEntryOffset;
+    ULONG NumberOfThreads;
+    BYTE Reserved1[48];
+	PUNICODE_STRING ImageName;
+    KPRIORITY BasePriority;
+    HANDLE UniqueProcessId;
+    PVOID Reserved2;
+    ULONG HandleCount;
+    ULONG SessionId;
+    PVOID Reserved3;
+    SIZE_T PeakVirtualSize;
+    SIZE_T VirtualSize;
+    ULONG Reserved4;
+    SIZE_T PeakWorkingSetSize;
+    SIZE_T WorkingSetSize;
+    PVOID Reserved5;
+    SIZE_T QuotaPagedPoolUsage;
+    PVOID Reserved6;
+    SIZE_T QuotaNonPagedPoolUsage;
+    SIZE_T PagefileUsage;
+    SIZE_T PeakPagefileUsage;
+    SIZE_T PrivatePageCount;
+	LARGE_INTEGER Reserved7[6];
+} SYSTEM_PROCESS_INFORMATION;
+
+typedef struct _SYSTEM_PROCESS_INFORMATION {
+    ULONG NextEntryOffset;
+    ULONG NumberOfThreads;
+    BYTE Reserved1[48];
+	PUNICODE_STRING ImageName;
+    KPRIORITY BasePriority;
+    HANDLE UniqueProcessId;
+    PVOID Reserved2;
+    ULONG HandleCount;
+    ULONG SessionId;
+    PVOID Reserved3;
+    SIZE_T PeakVirtualSize;
+    SIZE_T VirtualSize;
+    ULONG Reserved4;
+    SIZE_T PeakWorkingSetSize;
+    SIZE_T WorkingSetSize;
+    PVOID Reserved5;
+    SIZE_T QuotaPagedPoolUsage;
+    PVOID Reserved6;
+    SIZE_T QuotaNonPagedPoolUsage;
+    SIZE_T PagefileUsage;
+    SIZE_T PeakPagefileUsage;
+    SIZE_T PrivatePageCount;
+} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
+
+<MAIN>
+{
+
+	DWORD test = NULL;
+	DWORD rtn = NULL;
+	test = (SYSTEM_PROCESS_INFORMATION)rtn->ImageName->Length;
+
+
+return 0;
+}