Commit Graph

Select branches

Hide Pull Requests

master

mpclient_new_apis

x86_64

#1

#105

#105

#11

#11

#111

#117

#117

#119

#119

#122

#26

#27

#29

#41

#61

#62

#7

#78

#78

#83

#87

#88

#89

#94

#97

Mono Color

• 8aa1558a2a QueryInformationJobObject impl x86_64 buherator 2025-04-10 11:18:33 +00:00
• b47218f797 Bugfix for ENV expansion and additional values buherator 2025-04-05 15:42:36 +00:00
• 92ea68d1dd Resolve every module handle to something buherator 2025-04-05 15:41:58 +00:00
• 75497f7c44 RtlUnwind for x64 buherator 2025-04-05 15:40:41 +00:00
• ee47c16cb7 WINAPI fixed buherator 2025-04-05 10:04:37 +00:00
• bf926eb330 added missing WINAPI mpclient_new_apis Alessandro De Vito 2025-04-01 18:19:00 +03:00
• 37866a4563 messy in heaven b 2025-03-28 17:28:26 +01:00
• cb7e96045d Additional tips for Ghidra debugging b 2025-03-28 10:40:41 +01:00
• 7c5ae0595f Added GHIDRA.md b 2025-03-26 17:13:26 +01:00
• ea73b88266 Updated README with build instructions b 2025-03-25 08:43:31 +01:00
• cf46b958a2 Merge remote-tracking branch 'waffle/master' into x64_waffle b 2025-03-25 08:35:34 +01:00
• c739d23395 Added new APIs mpengine.dll requires. WaffleSec 2025-03-24 16:04:36 -05:00
• c40033b12f Merge pull request #111 from CertainLach/patch-1 master Tavis Ormandy 2022-01-23 10:34:48 -08:00
• e3af2aa1f3 fix: reset num_pe_exports on export dir parsing Yaroslav Bolyukin 2022-01-23 21:19:19 +03:00
• 5c344a03c5 Removed NASM dependency Cube 2021-07-28 15:37:32 -04:00
• d4acd2b9ec both mpclient and mpclient_x64 compile Cube 2021-07-27 04:27:32 -04:00
• 04cda3f9a2 Removed a __debugbreak() in the wrong place and freed FunctionEntry after handler has been executed Cube 2021-07-19 06:19:00 -04:00
• 9675382b17 Added x64 SEH support Cube 2021-07-16 15:27:42 -04:00
• c827d747d7 Added -maccumulate-outgoing-args to compile mpclient_x64, since it also uses WINAPI functions. Cube 2021-05-30 05:18:55 -04:00
• 5c65a4f013 Implemented remove_function_redirect function Cube 2021-05-30 03:57:09 -04:00
• 3a0edb76d7 x64 NASM dispatchers are not useful anymore :( re-written the libhook.a which now supports both HOOK_DEFAULT and HOOK_REPLACE_FUNCTION mode. Cube 2021-05-29 13:02:59 -04:00
• 020b7a7c11 It looks like __attribute__((ms_abi)) can spawn deamons, resurrect the dead and make a good coffee (and eventually it changes the calling convention of a function to Windows x86_64 as well...) Cube 2021-05-29 08:15:19 -04:00
• 8ecacf93a8 Added check on setup_call_to_dispatcher return value. Integrated log.c as logging utility for all the project. Cube 2021-05-29 04:35:21 -04:00
• 188676cbe0 The jmp from the fixup area to the x86_64 dispatcher is made by subhook. We can't rely on a jmp near immediate in this case. Cube 2021-05-23 15:03:08 -04:00
• 105e1e4046 attempt to fix #98 Tavis Ormandy 2021-05-18 11:50:58 -07:00
• 97d3becf60 No redzone for mpclient_x64 and peloader. The subhook hooks were pushing addresses on the stack and overwriting some useful value on the redzone. For now, the redzone has been disabled (-mno-red-zone). Cube 2021-05-14 09:43:30 -04:00
• 844c5fe69f Fixed bug on stack alignment for x64 dispatchers and added priority for zydis decoder constructor. Cube 2021-05-12 05:14:49 -04:00
• 56f4b3e6ac Added x86_64_call_exported_function wrapper to call DLL exports. Cube 2021-05-11 07:50:15 -04:00
• cb17618787 x86_64 WINAPIs are correctly dispatched and mpclient boots up and scan eicar.com successfully Cube 2021-05-09 16:16:14 -04:00
• bc565fea09 Added x86_64 support for libhook and added assembly dispatchers to redirect functions and switch calling convention Cube 2021-04-09 04:00:14 -04:00
• 4d8d7b06c5 Removed libdisasm and imported zydis as submodule. libdisasm has been replaced by zydis, so now we've got a x86/x86_64 disassembler. hook.c now uses zydis to patch functions (only x86 for now) Cube 2021-03-22 10:37:54 -04:00
• 77497a9273 Created skeleton for x64 APIs loading. Cube 2021-03-03 12:19:10 -05:00
• de07f73c75 a x64 PE is mapped and linked. Cube 2021-02-26 06:38:13 -05:00
• 15ad102f6c Modified test target. Cube 2021-02-26 06:01:21 -05:00
• 9a2ee403b3 Added ARCH target flag for the peloader library. Added first test which successfully check a PE (x64) header. Cube 2021-02-17 13:52:43 -05:00
• 8bf7233706 Added "debug" target in Makefile Cube 2021-02-15 13:37:12 -05:00
• 19c781901c mising stub for FileTimeToSystemTime Tavis Ormandy 2021-02-03 07:50:18 -08:00
• 890a53efd1 put EventTracing code in the right place Tavis Ormandy 2021-02-03 07:50:01 -08:00
• cae8b63d6b add stub for EventActivityIdControl Tavis Ormandy 2021-02-03 07:43:42 -08:00
• 76a60119c6 fix #92, mpengine doesnt check QPC return code. Tavis Ormandy 2021-02-03 07:42:55 -08:00
• fc38e30214 fix #90, incorrect format specifiers Tavis Ormandy 2021-01-17 22:23:01 -08:00
• 7511a8adff missing newline Tavis Ormandy 2021-01-17 22:19:37 -08:00
• 32f4c36e12 Merge pull request #89 from cube0x8/isdebugpresent_conflict Tavis Ormandy 2021-01-17 22:17:28 -08:00
• e53fc8b68a Added IsDebuggerPresent Win API Cube 2021-01-13 14:33:58 -05:00
• 827eaae276 IsDebuggerPresent -> IsGdbPresent, since it conflicts with IsDebuggerPresent Win API Cube 2021-01-11 11:28:03 -05:00
• bdedcb0b67 stub GetLocaleInfoEx, required for some samples. Tavis Ormandy 2021-01-12 13:55:29 -08:00
• 3602f39622 cleanup some compiler warnings Tavis Ormandy 2021-01-12 13:49:23 -08:00
• 16ddcd4d17 Merge pull request #88 from cube0x8/additional_apis Tavis Ormandy 2021-01-12 13:43:04 -08:00
• 8585b6352e Fixed GetLongPathNameW Cube 2021-01-10 15:25:23 -05:00
• 829b960b50 Forgot to free() Cube 2021-01-07 04:55:38 -05:00
• faa5d9da18 Fixed some winnt type and added additional information for LdrLoadDll debug log Cube 2021-01-07 02:26:21 -05:00
• 8df9845779 LdrLoadDll return the HANDLE in the ModuleHandle ptr passed as argument. Cube 2021-01-06 15:02:45 -05:00
• 33dac1dfc9 Added GetLongPathName APIs, which basically return the short path passed as argument. Cube 2021-01-06 14:37:59 -05:00
• de5bda0d19 Added RtlFreeHeap and RtlSetHeapInformation APIs Cube 2021-01-06 14:37:10 -05:00
• 95c74311f2 Fixed LdrLoadDll and added LdrUnloadDll. Improved LdrGetProcedureAddress. Cube 2021-01-06 14:35:55 -05:00
• 4da63119a5 Added new files to host Process and Wer related APIs. Added NtSetInformationProcess and WerRegisterMemoryBlock APIs Cube 2021-01-06 14:32:39 -05:00
• a478b03cfd Added new NT types for Process and string related functions Cube 2021-01-06 14:31:38 -05:00
• 9910ceda2e silence warning from missing include Tavis Ormandy 2021-01-03 16:38:58 -08:00
• b5ea40a014 Merge pull request #87 from cube0x8/LdrLoadDll_api Tavis Ormandy 2021-01-03 16:35:30 -08:00
• 2a6e10f99f Removed Wide to Ansi conversion for ModuleFilename unicode string Cube 2021-01-03 07:24:40 -05:00
• 8357dfcf4b Added new API ntdll.LdrLoadDll Cube 2021-01-02 09:02:50 -05:00
• 6d4970bd4a add new imports to fix #84 Tavis Ormandy 2020-09-07 08:04:12 -07:00
• 5b671d6ae4 Merge pull request #83 from gertdreyer/master Tavis Ormandy 2020-08-04 07:01:42 -07:00
• 207f56a17c Added GlobalAlloc metods to mirror LocalAlloc Gert Dreyer 2020-08-04 09:17:43 +02:00
• d74abc85f8 attempt to fix #82, add basic fls support. Tavis Ormandy 2020-08-02 18:10:13 -07:00
• 3cb541e025 Update README.md Tavis Ormandy 2020-03-10 07:52:49 -07:00
• 3d52865c58 remove old files Tavis Ormandy 2020-03-09 09:39:45 -07:00
• e949a2a733 warn if selinux will block stub creation Tavis Ormandy 2020-03-03 11:01:03 -08:00
• 3650f51f6f reduce optimization while debugging Tavis Ormandy 2020-03-01 21:50:41 -08:00
• 3b76c18a14 testing support for more engines Tavis Ormandy 2020-03-01 21:06:28 -08:00
• a4379b27b4 fix #75, we need to provide a valid certificate Tavis Ormandy 2020-03-01 10:20:21 -08:00
• 316ad6329f fake support for SHA-256, this fixes #73 Tavis Ormandy 2019-11-07 12:52:30 -08:00
• f517d284f0 I don't think we need MAP_SHARED Tavis Ormandy 2019-08-20 16:12:43 -07:00
• 165a9657cb no longer need codealloc in pe_linker Tavis Ormandy 2019-08-20 16:08:41 -07:00
• c4e905f729 Merge pull request #62 from chrisnew/master Tavis Ormandy 2019-08-20 14:59:43 -07:00
• e364b4c705 define DosDateTimeToFileTime Tavis Ormandy 2019-08-20 14:28:43 -07:00
• cbe8dc034e hide some compiler warnings. Tavis Ormandy 2019-08-20 14:28:27 -07:00
• eb7b94e36f add some stubs for vista threadpools Tavis Ormandy 2019-08-20 14:09:22 -07:00
• 4e2655ae85 add GetDiskFreeSpaceExW Tavis Ormandy 2019-08-20 14:08:58 -07:00
• f937692709 reset lasterror on CreateEvent Tavis Ormandy 2019-08-20 14:07:36 -07:00
• e14ffb3ec8 First attempt at fixing #65 Tavis Ormandy 2019-08-20 12:00:08 -07:00
• bcef398300 make tls slots accessible via teb Tavis Ormandy 2019-06-19 14:02:27 -07:00
• 2f1ac6b3a2 fix #64 - crash on startup Tavis Ormandy 2019-04-09 13:14:24 -07:00
• 2bd384c063 fix_pe_image: replaced code_malloc with mmap to preserve image base Christian 2019-02-13 20:57:39 +01:00
• f7adbda5f4 Merge pull request #61 from chrisnew/master Tavis Ormandy 2019-02-08 07:00:14 -08:00
• 3fbcc2f8ce read_exports: lookup addresses using ordinal table Christian 2019-02-08 11:40:47 +01:00
• 4f26ce65d4 fix incorrect calling convention Tavis Ormandy 2018-09-26 11:26:01 -07:00
• d463ea4cc8 add definition for UuidCreate, fixes #52 Tavis Ormandy 2018-09-26 11:25:07 -07:00
• 643a6a0da4 Update README.md Tavis Ormandy 2018-05-24 20:40:46 -07:00
• bccf60b879 Update README.md Tavis Ormandy 2018-03-04 18:25:13 -08:00
• dba8a73258 Merge pull request #41 from RichardWithnell/feature/update_api_stubs Tavis Ormandy 2018-01-15 17:16:18 -08:00
• 0755674d0e Fix memory leak richard 2018-01-16 01:09:17 +00:00
• 00e8678f84 Fix cast warning richard 2018-01-16 00:31:32 +00:00
• 40cea3bbb4 Add CreateFileA stub richard 2018-01-16 00:25:41 +00:00
• cb44e53dd3 Add export for SetFilePointer richard 2018-01-16 00:21:11 +00:00
• ecdd54c4d7 Add SetFilePointer richard 2018-01-16 00:20:09 +00:00
• 1b7b5a8048 Add GetStringTypeA richard 2018-01-16 00:19:31 +00:00
• 18a0d3a36e Add SetHandleCount richard 2018-01-16 00:14:16 +00:00
• b9491d7285 Add GetStartupInfoA richard 2018-01-16 00:13:30 +00:00
• 899ff6e9af Fix WideCharToMultiByte return richard 2018-01-16 00:08:00 +00:00