mirror of
https://github.com/thefLink/DeepSleep
synced 2026-06-06 16:54:28 +00:00
adding code and screens
This commit is contained in:
thefLink
Binary file not shown.
Binary file not shown.
|
After Width: | Height: | Size: 83 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 35 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 52 KiB |
@@ -0,0 +1,255 @@
|
||||
#include "ApiResolve.h"
|
||||
|
||||
static uint64_t getDllBase(unsigned long);
|
||||
static uint64_t loadDll(unsigned long);
|
||||
static uint64_t loadDll_byName(char*);
|
||||
static uint64_t parseHdrForPtr(uint64_t, unsigned long);
|
||||
static uint64_t followExport(char*, unsigned long);
|
||||
|
||||
static unsigned long djb2(unsigned char*);
|
||||
static unsigned long unicode_djb2(const wchar_t* str);
|
||||
static unsigned long xor_hash(unsigned long);
|
||||
static WCHAR* toLower(WCHAR* str);
|
||||
|
||||
uint64_t
|
||||
getFunctionPtr(unsigned long crypted_dll_hash, unsigned long crypted_function_hash) {
|
||||
|
||||
uint64_t dll_base = 0x00;
|
||||
uint64_t ptr_function = 0x00;
|
||||
|
||||
dll_base = getDllBase(crypted_dll_hash);
|
||||
if (dll_base == 0) {
|
||||
dll_base = loadDll(crypted_dll_hash);
|
||||
if (dll_base == 0)
|
||||
return FAIL;
|
||||
}
|
||||
|
||||
ptr_function = parseHdrForPtr(dll_base, crypted_function_hash);
|
||||
|
||||
return ptr_function;
|
||||
|
||||
}
|
||||
|
||||
static uint64_t
|
||||
loadDll(unsigned long crypted_dll_hash) {
|
||||
|
||||
uint64_t kernel32_base = 0x00;
|
||||
uint64_t fptr_loadLibary = 0x00;
|
||||
uint64_t ptr_loaded_dll = 0x00;
|
||||
|
||||
kernel32_base = getDllBase(CRYPTED_HASH_KERNEL32);
|
||||
if (kernel32_base == 0x00)
|
||||
return FAIL;
|
||||
|
||||
fptr_loadLibary = parseHdrForPtr(kernel32_base, CRYPTED_HASH_LOADLIBRARYA);
|
||||
if (fptr_loadLibary == 0x00)
|
||||
return FAIL;
|
||||
|
||||
if (crypted_dll_hash == CRYPTED_HASH_USER32) {
|
||||
char dll_name[] = { 'U', 's', 'e', 'r', '3' ,'2' ,'.', 'd', 'l', 'l', 0x00 };
|
||||
ptr_loaded_dll = (uint64_t)((LOADLIBRARYA)fptr_loadLibary)(dll_name);
|
||||
} else if (crypted_dll_hash == CRYPTED_HASH_SHLWAPI) {
|
||||
char dll_name[] = { 'S', 'h', 'l', 'w', 'a', 'p', 'i', '.', 'd','l','l',0x00 };
|
||||
ptr_loaded_dll = (uint64_t)((LOADLIBRARYA)fptr_loadLibary)(dll_name);
|
||||
}
|
||||
|
||||
return ptr_loaded_dll;
|
||||
|
||||
}
|
||||
|
||||
static uint64_t
|
||||
loadDll_byName(char* dll_name) {
|
||||
|
||||
uint64_t kernel32_base = 0x00;
|
||||
uint64_t fptr_loadLibary = 0x00;
|
||||
uint64_t ptr_loaded_dll = 0x00;
|
||||
|
||||
kernel32_base = getDllBase(CRYPTED_HASH_KERNEL32);
|
||||
if (kernel32_base == 0x00)
|
||||
return FAIL;
|
||||
|
||||
fptr_loadLibary = parseHdrForPtr(kernel32_base, CRYPTED_HASH_LOADLIBRARYA);
|
||||
if (fptr_loadLibary == 0x00)
|
||||
return FAIL;
|
||||
|
||||
ptr_loaded_dll = (uint64_t)((LOADLIBRARYA)fptr_loadLibary)(dll_name);
|
||||
|
||||
return ptr_loaded_dll;
|
||||
|
||||
}
|
||||
|
||||
|
||||
static uint64_t
|
||||
parseHdrForPtr(uint64_t dll_base, unsigned long crypted_function_hash) {
|
||||
|
||||
PIMAGE_NT_HEADERS nt_hdrs = NULL;
|
||||
PIMAGE_DATA_DIRECTORY data_dir = NULL;
|
||||
PIMAGE_EXPORT_DIRECTORY export_dir = NULL;
|
||||
|
||||
uint32_t* ptr_exportadrtable = 0x00;
|
||||
uint32_t* ptr_namepointertable = 0x00;
|
||||
uint16_t* ptr_ordinaltable = 0x00;
|
||||
|
||||
uint32_t idx_functions = 0x00;
|
||||
|
||||
unsigned char* ptr_function_name = NULL;
|
||||
|
||||
|
||||
nt_hdrs = (PIMAGE_NT_HEADERS)(dll_base + (uint64_t)((PIMAGE_DOS_HEADER)(size_t)dll_base)->e_lfanew);
|
||||
data_dir = (PIMAGE_DATA_DIRECTORY)&nt_hdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
|
||||
export_dir = (PIMAGE_EXPORT_DIRECTORY)(dll_base + (uint64_t)data_dir->VirtualAddress);
|
||||
|
||||
ptr_exportadrtable = (uint32_t*)(dll_base + (uint64_t)export_dir->AddressOfFunctions);
|
||||
ptr_namepointertable = (uint32_t*)(dll_base + (uint64_t)export_dir->AddressOfNames);
|
||||
ptr_ordinaltable = (uint16_t*)(dll_base + (uint64_t)export_dir->AddressOfNameOrdinals);
|
||||
|
||||
for (idx_functions = 0; idx_functions < export_dir->NumberOfNames; idx_functions++) {
|
||||
|
||||
ptr_function_name = (unsigned char*)dll_base + (ptr_namepointertable[idx_functions]);
|
||||
if (djb2(ptr_function_name) == xor_hash(crypted_function_hash)) {
|
||||
|
||||
WORD nameord = ptr_ordinaltable[idx_functions];
|
||||
DWORD rva = ptr_exportadrtable[nameord];
|
||||
|
||||
|
||||
if (dll_base + rva >= dll_base + data_dir->VirtualAddress && dll_base + rva <= dll_base + data_dir->VirtualAddress + (uint64_t)data_dir->Size) {
|
||||
// This is a forwarded export
|
||||
|
||||
char* ptr_forward = (char*)(dll_base + rva);
|
||||
return followExport(ptr_forward, crypted_function_hash);
|
||||
|
||||
}
|
||||
|
||||
|
||||
return dll_base + rva;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
return FAIL;
|
||||
}
|
||||
|
||||
static uint64_t followExport(char* ptr_forward, unsigned long crypted_function_hash) {
|
||||
|
||||
STRSTRA _StrStrA = (STRSTRA)getFunctionPtr(CRYPTED_HASH_SHLWAPI, CRYPTED_HASH_STRSTRA);
|
||||
|
||||
if (_StrStrA == 0x00)
|
||||
return FAIL;
|
||||
|
||||
char del[] = { '.', 0x00 };
|
||||
char* pos_del = 0x00;
|
||||
char forward_dll[MAX_PATH] = { 0 };
|
||||
char forward_export[MAX_PATH] = { 0 };
|
||||
unsigned long forward_export_hash = 0x00;
|
||||
uint8_t i = 0;
|
||||
uint64_t fwd_dll_base = 0x00, forwarded_export = 0x00;
|
||||
|
||||
while (*ptr_forward)
|
||||
forward_dll[i++] = *ptr_forward++;
|
||||
|
||||
pos_del = (char*)_StrStrA(forward_dll, del);
|
||||
if (pos_del == 0)
|
||||
return FAIL;
|
||||
|
||||
*(char*)(pos_del++) = 0x00;
|
||||
i = 0;
|
||||
while (*pos_del)
|
||||
forward_export[i++] = *pos_del++;
|
||||
|
||||
forward_export_hash = xor_hash(djb2((unsigned char*)forward_export));
|
||||
|
||||
fwd_dll_base = getDllBase(xor_hash(djb2((unsigned char*)forward_dll)));
|
||||
if (fwd_dll_base == 0x00) {
|
||||
fwd_dll_base = loadDll_byName(forward_dll);
|
||||
if (fwd_dll_base == 0x00)
|
||||
return FAIL;
|
||||
}
|
||||
|
||||
forwarded_export = parseHdrForPtr(fwd_dll_base, forward_export_hash);
|
||||
|
||||
return forwarded_export;
|
||||
|
||||
}
|
||||
|
||||
static uint64_t
|
||||
getDllBase(unsigned long crypted_dll_hash) {
|
||||
|
||||
_PPEB ptr_peb = NULL;
|
||||
PPEB_LDR_DATA ptr_ldr_data = NULL;
|
||||
PLDR_DATA_TABLE_ENTRY ptr_module_entry = NULL, ptr_start_module = NULL;
|
||||
PUNICODE_STR dll_name = NULL;
|
||||
|
||||
ptr_peb = (_PEB*)__readgsqword(0x60);
|
||||
ptr_ldr_data = ptr_peb->pLdr;
|
||||
ptr_module_entry = ptr_start_module = (PLDR_DATA_TABLE_ENTRY)ptr_ldr_data->InMemoryOrderModuleList.Flink;
|
||||
|
||||
do {
|
||||
|
||||
dll_name = &ptr_module_entry->BaseDllName;
|
||||
|
||||
if (dll_name->pBuffer == NULL)
|
||||
return FAIL;
|
||||
|
||||
if (unicode_djb2(toLower(dll_name->pBuffer)) == xor_hash(crypted_dll_hash))
|
||||
return (uint64_t)ptr_module_entry->DllBase;
|
||||
|
||||
ptr_module_entry = (PLDR_DATA_TABLE_ENTRY)ptr_module_entry->InMemoryOrderModuleList.Flink;
|
||||
|
||||
} while (ptr_module_entry != ptr_start_module);
|
||||
|
||||
return FAIL;
|
||||
|
||||
}
|
||||
|
||||
static unsigned long
|
||||
djb2(unsigned char* str)
|
||||
{
|
||||
unsigned long hash = 5381;
|
||||
int c;
|
||||
|
||||
while ((c = *str++))
|
||||
hash = ((hash << 5) + hash) + c;
|
||||
|
||||
return hash;
|
||||
}
|
||||
|
||||
unsigned long
|
||||
unicode_djb2(const wchar_t* str)
|
||||
{
|
||||
|
||||
unsigned long hash = 5381;
|
||||
DWORD val;
|
||||
|
||||
while (*str != 0) {
|
||||
val = (DWORD)*str++;
|
||||
hash = ((hash << 5) + hash) + val;
|
||||
}
|
||||
|
||||
return hash;
|
||||
|
||||
}
|
||||
|
||||
unsigned long
|
||||
xor_hash(unsigned long hash) {
|
||||
return hash ^ CRYPT_KEY;
|
||||
}
|
||||
|
||||
static WCHAR*
|
||||
toLower(WCHAR* str)
|
||||
{
|
||||
|
||||
WCHAR* start = str;
|
||||
|
||||
while (*str) {
|
||||
|
||||
if (*str <= L'Z' && *str >= 'A') {
|
||||
*str += 32;
|
||||
}
|
||||
|
||||
str += 1;
|
||||
|
||||
}
|
||||
|
||||
return start;
|
||||
|
||||
}
|
||||
@@ -0,0 +1,164 @@
|
||||
#pragma once
|
||||
|
||||
#include <stdint.h>
|
||||
#include "windows.h"
|
||||
|
||||
#define FAIL 0
|
||||
#define SUCCESS 1
|
||||
|
||||
#define CRYPT_KEY 0x41424344
|
||||
|
||||
uint64_t getFunctionPtr(unsigned long, unsigned long);
|
||||
|
||||
// ---- KERNEL32 ----
|
||||
#define CRYPTED_HASH_KERNEL32 0x3102ad31
|
||||
#define CRYPTED_HASH_LOADLIBRARYA 0x1efdb3bf
|
||||
#define CRYTPED_HASH_VIRTUALALLOC 0x796e4cd3
|
||||
#define CRYPTED_HASH_VIRTUALFREE 0x27cd8c6a
|
||||
#define CRYPTED_HASH_COPYMEMORY 0x14d8cfcf
|
||||
#define CRYPTED_HASH_GETSYSTEMINFO 0xc24aacb2
|
||||
#define CRYPTED_HASH_VIRTUALQUERYEX 0x96d1a8db
|
||||
#define CRYPTED_HASH_ADDVECTOREDEXCEPTIONHANDLER 0x7693b393
|
||||
#define CRYPTED_HASH_GETTHREADCONTEXT 0xaae08c86
|
||||
#define CRYPTED_HASH_SETTHREADCONTEXT 0x3f62d50a
|
||||
#define CRYPTED_HASH_GETMODULEHANDLEA 0x1b577c1c
|
||||
#define CRYPTED_HASH_GETCURRENTPROCESS 0x8bcf3663
|
||||
#define CRYPTED_HASH_VIRTUALPROTECT 0xc50db2c9
|
||||
#define CRYPTED_HASH_SLEEP 0x4f5ba6ba
|
||||
#define CRYPTED_HASH_LSTRCMPA 0x93fd9eaf
|
||||
|
||||
typedef HMODULE(WINAPI* LOADLIBRARYA)(LPCSTR);
|
||||
typedef LPVOID(WINAPI* VIRTUALALLOC)(LPVOID, SIZE_T, DWORD, DWORD);
|
||||
typedef BOOL(WINAPI* VIRTUALFREE)(LPVOID, SIZE_T, DWORD);
|
||||
typedef void(WINAPI* SLEEP)();
|
||||
typedef BOOL(WINAPI* VIRTUALFREE)(LPVOID, SIZE_T, DWORD);
|
||||
typedef void(WINAPI* COPYMEMORY)(PVOID, void*, SIZE_T);
|
||||
typedef HANDLE(WINAPI* GETCURRENTPROCESS)(void);
|
||||
typedef void(WINAPI* GETSYSTEMINFO)(LPSYSTEM_INFO);
|
||||
typedef SIZE_T(WINAPI* VIRTUALQUERYEX)(HANDLE, LPCVOID, PMEMORY_BASIC_INFORMATION, SIZE_T);
|
||||
typedef PVOID(WINAPI* ADDVECTOREDEXCEPTIONHANDLER)(ULONG, PVECTORED_EXCEPTION_HANDLER);
|
||||
typedef BOOL(WINAPI* GETTHREADCONTEXT)(HANDLE, LPCONTEXT);
|
||||
typedef BOOL(WINAPI* SETTHREADCONTEXT)(HANDLE, LPCONTEXT);
|
||||
typedef HMODULE(WINAPI* GETMODULEHANDLE)(LPCSTR);
|
||||
typedef BOOL(WINAPI* VIRTUALPROTECT)(LPVOID, SIZE_T, DWORD, PDWORD);
|
||||
typedef int (WINAPI* LSTRCMPA)(LPCSTR, LPCSTR);
|
||||
|
||||
// ---- USER32 ----
|
||||
#define CRYPTED_HASH_USER32 0x985bec97
|
||||
#define CRYPTED_HASH_MESSAGEBOXA 0x790d57f0
|
||||
|
||||
typedef int(WINAPI* MESSAGEBOXA)(HWND, LPCSTR, LPCSTR, UINT);
|
||||
|
||||
// ---- shlwapi.dll ----
|
||||
#define CRYPTED_HASH_SHLWAPI 0xe64fd763
|
||||
#define CRYPTED_HASH_STRSTRA 0x4ef4617c
|
||||
|
||||
typedef PCSTR(WINAPI* STRSTRA)(PCSTR, PCSTR);
|
||||
|
||||
typedef struct _UNICODE_STR {
|
||||
USHORT Length;
|
||||
USHORT MaximumLength;
|
||||
PWSTR pBuffer;
|
||||
} UNICODE_STR, * PUNICODE_STR;
|
||||
|
||||
typedef struct _PEB_LDR_DATA
|
||||
{
|
||||
DWORD dwLength;
|
||||
DWORD dwInitialized;
|
||||
LPVOID lpSsHandle;
|
||||
LIST_ENTRY InLoadOrderModuleList;
|
||||
LIST_ENTRY InMemoryOrderModuleList;
|
||||
LIST_ENTRY InInitializationOrderModuleList;
|
||||
LPVOID lpEntryInProgress;
|
||||
} PEB_LDR_DATA, * PPEB_LDR_DATA;
|
||||
|
||||
typedef struct _LDR_DATA_TABLE_ENTRY
|
||||
{
|
||||
LIST_ENTRY InMemoryOrderModuleList;
|
||||
LIST_ENTRY InInitializationOrderModuleList;
|
||||
PVOID DllBase;
|
||||
PVOID EntryPoint;
|
||||
ULONG SizeOfImage;
|
||||
UNICODE_STR FullDllName;
|
||||
UNICODE_STR BaseDllName;
|
||||
ULONG Flags;
|
||||
SHORT LoadCount;
|
||||
SHORT TlsIndex;
|
||||
LIST_ENTRY HashTableEntry;
|
||||
ULONG TimeDateStamp;
|
||||
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;
|
||||
|
||||
typedef struct _PEB_FREE_BLOCK
|
||||
{
|
||||
struct _PEB_FREE_BLOCK* pNext;
|
||||
DWORD dwSize;
|
||||
} PEB_FREE_BLOCK, * PPEB_FREE_BLOCK;
|
||||
|
||||
typedef struct __PEB
|
||||
{
|
||||
BYTE bInheritedAddressSpace;
|
||||
BYTE bReadImageFileExecOptions;
|
||||
BYTE bBeingDebugged;
|
||||
BYTE bSpareBool;
|
||||
LPVOID lpMutant;
|
||||
LPVOID lpImageBaseAddress;
|
||||
PPEB_LDR_DATA pLdr;
|
||||
LPVOID lpProcessParameters;
|
||||
LPVOID lpSubSystemData;
|
||||
LPVOID lpProcessHeap;
|
||||
PRTL_CRITICAL_SECTION pFastPebLock;
|
||||
LPVOID lpFastPebLockRoutine;
|
||||
LPVOID lpFastPebUnlockRoutine;
|
||||
DWORD dwEnvironmentUpdateCount;
|
||||
LPVOID lpKernelCallbackTable;
|
||||
DWORD dwSystemReserved;
|
||||
DWORD dwAtlThunkSListPtr32;
|
||||
PPEB_FREE_BLOCK pFreeList;
|
||||
DWORD dwTlsExpansionCounter;
|
||||
LPVOID lpTlsBitmap;
|
||||
DWORD dwTlsBitmapBits[2];
|
||||
LPVOID lpReadOnlySharedMemoryBase;
|
||||
LPVOID lpReadOnlySharedMemoryHeap;
|
||||
LPVOID lpReadOnlyStaticServerData;
|
||||
LPVOID lpAnsiCodePageData;
|
||||
LPVOID lpOemCodePageData;
|
||||
LPVOID lpUnicodeCaseTableData;
|
||||
DWORD dwNumberOfProcessors;
|
||||
DWORD dwNtGlobalFlag;
|
||||
LARGE_INTEGER liCriticalSectionTimeout;
|
||||
DWORD dwHeapSegmentReserve;
|
||||
DWORD dwHeapSegmentCommit;
|
||||
DWORD dwHeapDeCommitTotalFreeThreshold;
|
||||
DWORD dwHeapDeCommitFreeBlockThreshold;
|
||||
DWORD dwNumberOfHeaps;
|
||||
DWORD dwMaximumNumberOfHeaps;
|
||||
LPVOID lpProcessHeaps;
|
||||
LPVOID lpGdiSharedHandleTable;
|
||||
LPVOID lpProcessStarterHelper;
|
||||
DWORD dwGdiDCAttributeList;
|
||||
LPVOID lpLoaderLock;
|
||||
DWORD dwOSMajorVersion;
|
||||
DWORD dwOSMinorVersion;
|
||||
WORD wOSBuildNumber;
|
||||
WORD wOSCSDVersion;
|
||||
DWORD dwOSPlatformId;
|
||||
DWORD dwImageSubsystem;
|
||||
DWORD dwImageSubsystemMajorVersion;
|
||||
DWORD dwImageSubsystemMinorVersion;
|
||||
DWORD dwImageProcessAffinityMask;
|
||||
DWORD dwGdiHandleBuffer[34];
|
||||
LPVOID lpPostProcessInitRoutine;
|
||||
LPVOID lpTlsExpansionBitmap;
|
||||
DWORD dwTlsExpansionBitmapBits[32];
|
||||
DWORD dwSessionId;
|
||||
ULARGE_INTEGER liAppCompatFlags;
|
||||
ULARGE_INTEGER liAppCompatFlagsUser;
|
||||
LPVOID lppShimData;
|
||||
LPVOID lpAppCompatInfo;
|
||||
UNICODE_STR usCSDVersion;
|
||||
LPVOID lpActivationContextData;
|
||||
LPVOID lpProcessAssemblyStorageMap;
|
||||
LPVOID lpSystemDefaultActivationContextData;
|
||||
LPVOID lpSystemAssemblyStorageMap;
|
||||
DWORD dwMinimumStackCommit;
|
||||
} _PEB, * _PPEB;
|
||||
@@ -0,0 +1,31 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio Version 16
|
||||
VisualStudioVersion = 16.0.32413.511
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "DeepSleep", "DeepSleep.vcxproj", "{39492B36-397C-46B0-9B84-9CDCCEF21130}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|x64 = Debug|x64
|
||||
Debug|x86 = Debug|x86
|
||||
Release|x64 = Release|x64
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{39492B36-397C-46B0-9B84-9CDCCEF21130}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{39492B36-397C-46B0-9B84-9CDCCEF21130}.Debug|x64.Build.0 = Debug|x64
|
||||
{39492B36-397C-46B0-9B84-9CDCCEF21130}.Debug|x86.ActiveCfg = Debug|Win32
|
||||
{39492B36-397C-46B0-9B84-9CDCCEF21130}.Debug|x86.Build.0 = Debug|Win32
|
||||
{39492B36-397C-46B0-9B84-9CDCCEF21130}.Release|x64.ActiveCfg = Release|x64
|
||||
{39492B36-397C-46B0-9B84-9CDCCEF21130}.Release|x64.Build.0 = Release|x64
|
||||
{39492B36-397C-46B0-9B84-9CDCCEF21130}.Release|x86.ActiveCfg = Release|Win32
|
||||
{39492B36-397C-46B0-9B84-9CDCCEF21130}.Release|x86.Build.0 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||
SolutionGuid = {17C2B31B-8016-4028-84E6-80106F4FAC23}
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
@@ -0,0 +1,159 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<VCProjectVersion>16.0</VCProjectVersion>
|
||||
<Keyword>Win32Proj</Keyword>
|
||||
<ProjectGuid>{39492b36-397c-46b0-9b84-9cdccef21130}</ProjectGuid>
|
||||
<RootNamespace>DeepSleep</RootNamespace>
|
||||
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v142</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v142</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v142</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v142</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.props" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="Shared">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<LinkIncremental>true</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<LinkIncremental>false</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<LinkIncremental>true</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<LinkIncremental>false</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="ApiResolve.h" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="ApiResolve.c" />
|
||||
<ClCompile Include="Main.c" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<MASM Include="asmStubs.asm">
|
||||
<FileType>Document</FileType>
|
||||
</MASM>
|
||||
<None Include="asmStubs.nasm" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" />
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,40 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Source Files">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Header Files">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Resource Files">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="ApiResolve.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="ApiResolve.c">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="Main.c">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<None Include="asmStubs.nasm">
|
||||
<Filter>Source Files</Filter>
|
||||
</None>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<MASM Include="asmStubs.asm">
|
||||
<Filter>Source Files</Filter>
|
||||
</MASM>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,4 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<PropertyGroup />
|
||||
</Project>
|
||||
+170
@@ -0,0 +1,170 @@
|
||||
#include <windows.h>
|
||||
#include "stdio.h"
|
||||
|
||||
#include "ApiResolve.h"
|
||||
|
||||
#define FAIL 0
|
||||
#define SUCCESS 1
|
||||
|
||||
BOOL findGadget(byte pattern[], DWORD dwLenPattern, PVOID* ppGadgetAddress);
|
||||
|
||||
extern DWORD64 GetRIP(void);
|
||||
extern BOOL DeepSleep(LPVOID, SIZE_T, DWORD, PDWORD, PVOID, PVOID, PVOID, PVOID, DWORD);
|
||||
|
||||
#ifdef _DEBUG
|
||||
int main(int argc, char** argv) {
|
||||
#else
|
||||
int go(void){
|
||||
#endif
|
||||
|
||||
GETSYSTEMINFO _GetSystemInfo = (GETSYSTEMINFO)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYPTED_HASH_GETSYSTEMINFO);
|
||||
VIRTUALQUERYEX _VirtualQueryEx = (VIRTUALQUERYEX)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYPTED_HASH_VIRTUALQUERYEX);
|
||||
GETCURRENTPROCESS _GetCurrentProcess = (GETCURRENTPROCESS)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYPTED_HASH_GETCURRENTPROCESS);
|
||||
MESSAGEBOXA _messageBoxA = (MESSAGEBOXA)getFunctionPtr(CRYPTED_HASH_USER32, CRYPTED_HASH_MESSAGEBOXA);
|
||||
VIRTUALPROTECT _VirtualProtect = (VIRTUALPROTECT)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYPTED_HASH_VIRTUALPROTECT);
|
||||
SLEEP _Sleep = (SLEEP)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYPTED_HASH_SLEEP);
|
||||
|
||||
DWORD dwSuccess = FAIL, dwOldProtect = 0;
|
||||
PVOID rip = NULL, gAddRsp32 = NULL, gSuper = NULL;
|
||||
|
||||
PVOID myPage = NULL;
|
||||
DWORD myPageLength = 0;
|
||||
|
||||
MEMORY_BASIC_INFORMATION mbi = { 0x00 };
|
||||
SYSTEM_INFO si = { 0x00 };
|
||||
BOOL bFound = FALSE;
|
||||
|
||||
byte patternSuperGadget[] = { 0x5A, 0x59, 0x41, 0x58, 0x41, 0x59, 0x41, 0x5A, 0x41, 0x5B, 0xC3 };
|
||||
byte patternAddRsp32Pop[] = { 0x48, 0x83, 0xC4, 0x20, 0x41, 0x5E, 0xC3 };
|
||||
|
||||
bFound = findGadget(patternSuperGadget, 11, &gSuper);
|
||||
if (bFound == FALSE)
|
||||
goto exit;
|
||||
|
||||
bFound = findGadget(patternAddRsp32Pop, 5, &gAddRsp32);
|
||||
if (bFound == FALSE)
|
||||
goto exit;
|
||||
|
||||
rip = (PVOID)GetRIP();
|
||||
_GetSystemInfo(&si);
|
||||
|
||||
LPVOID lpMem = 0;
|
||||
|
||||
while (lpMem < si.lpMaximumApplicationAddress) {
|
||||
|
||||
_VirtualQueryEx(_GetCurrentProcess(), lpMem, &mbi, sizeof(MEMORY_BASIC_INFORMATION));
|
||||
|
||||
if (rip >= mbi.BaseAddress && (DWORD64)rip <= (DWORD64)mbi.BaseAddress + mbi.RegionSize) {
|
||||
|
||||
myPage = mbi.BaseAddress;
|
||||
myPageLength = mbi.RegionSize;
|
||||
|
||||
break;
|
||||
}
|
||||
|
||||
lpMem = (LPVOID)((DWORD64)mbi.BaseAddress + mbi.RegionSize);
|
||||
|
||||
}
|
||||
|
||||
while (1) {
|
||||
|
||||
DeepSleep(myPage, myPageLength, PAGE_NOACCESS, &dwOldProtect,
|
||||
_VirtualProtect,
|
||||
_Sleep,
|
||||
gSuper,
|
||||
gAddRsp32,
|
||||
5000
|
||||
);
|
||||
|
||||
char foo[] = { '1', 0x00 };
|
||||
_messageBoxA(0, foo, foo, 1);
|
||||
|
||||
}
|
||||
|
||||
dwSuccess = SUCCESS;
|
||||
|
||||
exit:
|
||||
|
||||
return dwSuccess;
|
||||
|
||||
}
|
||||
|
||||
BOOL findGadget(byte pattern[], DWORD dwLenPattern, PVOID* ppGadgetAddress) {
|
||||
|
||||
VIRTUALALLOC _VirtualAlloc = (VIRTUALALLOC)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYTPED_HASH_VIRTUALALLOC);
|
||||
VIRTUALFREE _VirtualFree = (VIRTUALFREE)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYPTED_HASH_VIRTUALFREE);
|
||||
COPYMEMORY _CopyMemory = (COPYMEMORY)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYPTED_HASH_COPYMEMORY);
|
||||
GETMODULEHANDLE _GetModuleHandle = (GETMODULEHANDLE)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYPTED_HASH_GETMODULEHANDLEA);
|
||||
LSTRCMPA _lstrcmpA = (LSTRCMPA)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYPTED_HASH_LSTRCMPA);
|
||||
|
||||
BOOL bSuccess = FALSE;
|
||||
PVOID pBufTextMemory = NULL;
|
||||
DWORD sizeText = 0;
|
||||
|
||||
PIMAGE_DOS_HEADER pDosHdr = NULL;
|
||||
PIMAGE_NT_HEADERS pNtHdrs = NULL;
|
||||
PIMAGE_SECTION_HEADER pSectionHdr = NULL;
|
||||
HMODULE hNtdll = NULL;
|
||||
|
||||
char ntdll[] = { 'n', 't', 'd','l','l','.', 'd','l','l', 0x00 };
|
||||
char text[] = { '.', 't','e','x','t', 0x00 };
|
||||
|
||||
hNtdll = _GetModuleHandle(ntdll);
|
||||
if (hNtdll == NULL)
|
||||
goto exit;
|
||||
|
||||
pDosHdr = (PIMAGE_DOS_HEADER)hNtdll;
|
||||
pNtHdrs = (PIMAGE_NT_HEADERS)((byte*)hNtdll + pDosHdr->e_lfanew);
|
||||
pSectionHdr = (PIMAGE_SECTION_HEADER)((byte*)&pNtHdrs->OptionalHeader + sizeof(IMAGE_OPTIONAL_HEADER));
|
||||
|
||||
for (int i = 0; i < pNtHdrs->FileHeader.NumberOfSections; i++) {
|
||||
|
||||
if (_lstrcmpA((char*)pSectionHdr->Name, text) == 0) {
|
||||
|
||||
pBufTextMemory = _VirtualAlloc(0, pSectionHdr->Misc.VirtualSize, MEM_COMMIT, PAGE_READWRITE);
|
||||
if (pBufTextMemory == NULL)
|
||||
goto exit;
|
||||
|
||||
_CopyMemory(pBufTextMemory, (byte*)((byte*)hNtdll + pSectionHdr->VirtualAddress), pSectionHdr->Misc.VirtualSize);
|
||||
|
||||
sizeText = pSectionHdr->Misc.VirtualSize;
|
||||
|
||||
break;
|
||||
|
||||
}
|
||||
|
||||
pSectionHdr = (PIMAGE_SECTION_HEADER)((byte*)pSectionHdr + sizeof(IMAGE_SECTION_HEADER));
|
||||
|
||||
}
|
||||
|
||||
if (pBufTextMemory == NULL)
|
||||
goto exit;
|
||||
|
||||
BOOL bFound = FALSE;
|
||||
int i = 0;
|
||||
for (i = 0; i < sizeText && bFound == FALSE; i++) {
|
||||
for (int j = 0; j < dwLenPattern; j++) {
|
||||
if (* ((byte*)pBufTextMemory + i + j) != pattern[j]) {
|
||||
bFound = FALSE;
|
||||
break;
|
||||
} else {
|
||||
bFound = TRUE;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (bFound == FALSE)
|
||||
goto exit;
|
||||
|
||||
*ppGadgetAddress = (byte*)hNtdll + pSectionHdr->VirtualAddress + i - 1;
|
||||
|
||||
bSuccess = TRUE;
|
||||
|
||||
exit:
|
||||
|
||||
if (pBufTextMemory)
|
||||
_VirtualFree(pBufTextMemory, 0, MEM_RELEASE);
|
||||
|
||||
return bSuccess;
|
||||
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
extern go
|
||||
global alignstack
|
||||
|
||||
segment .text
|
||||
|
||||
alignstack:
|
||||
push rsi
|
||||
mov rsi, rsp
|
||||
and rsp, 0FFFFFFFFFFFFFFF0h
|
||||
sub rsp, 020h
|
||||
call go
|
||||
mov rsp, rsi
|
||||
pop rsi
|
||||
ret
|
||||
@@ -0,0 +1,98 @@
|
||||
.code
|
||||
|
||||
GetRIP PROC
|
||||
jmp FakeStub
|
||||
ret
|
||||
GetRIP ENDP
|
||||
|
||||
FakeStub PROC
|
||||
pop rax
|
||||
jmp rax
|
||||
FakeStub ENDP
|
||||
|
||||
RopThis PROC
|
||||
|
||||
push 2
|
||||
push 1
|
||||
push 1
|
||||
push 1
|
||||
push 1
|
||||
push QWORD PTR [rbp + 48h] ; addRsp32Popr14
|
||||
|
||||
push QWORD PTR [rbp + 30h] ; VirtualProtect
|
||||
push 1
|
||||
push 1
|
||||
push r9
|
||||
push 20h ; PAGE_EXECUTE_READ
|
||||
push rcx
|
||||
push rdx
|
||||
push QWORD PTR [rbp + 40h] ; SuperPop
|
||||
|
||||
push 2
|
||||
push 1
|
||||
push 1
|
||||
push 1
|
||||
push 1
|
||||
push QWORD PTR [rbp + 48h] ; addRsp32Popr14
|
||||
|
||||
; Sleep
|
||||
push QWORD PTR [rbp + 38h] ; Sleep
|
||||
push 41h
|
||||
push 41h
|
||||
push 41h
|
||||
push 41h
|
||||
push QWORD PTR [rbp + 50h] ; Sleeptime here
|
||||
push 41h
|
||||
push QWORD PTR [rbp + 40h] ; SuperPop
|
||||
|
||||
push 2
|
||||
push 1
|
||||
push 1
|
||||
push 1
|
||||
push 1
|
||||
push QWORD PTR [rbp + 48h] ; addRsp32Popr14
|
||||
|
||||
push QWORD PTR [rbp + 30h] ; VirtualProtect
|
||||
push 1
|
||||
push 1
|
||||
push r9
|
||||
push r8
|
||||
push rcx
|
||||
push rdx
|
||||
push QWORD PTR [rbp + 40h] ; SuperPop
|
||||
|
||||
ret
|
||||
|
||||
RopThis ENDP
|
||||
|
||||
DeepSleep PROC
|
||||
|
||||
push rbp
|
||||
mov rbp, rsp
|
||||
|
||||
push rbx
|
||||
push rsi
|
||||
push rdi
|
||||
push r12
|
||||
push r13
|
||||
push r14
|
||||
push r15
|
||||
|
||||
call RopThis
|
||||
|
||||
pop r15
|
||||
pop r14
|
||||
pop r13
|
||||
pop r12
|
||||
pop rdi
|
||||
pop rsi
|
||||
pop rbx
|
||||
|
||||
mov rsp, rbp
|
||||
pop rbp
|
||||
ret
|
||||
|
||||
DeepSleep ENDP
|
||||
|
||||
|
||||
end
|
||||
@@ -0,0 +1,92 @@
|
||||
segment .text
|
||||
|
||||
global GetRIP
|
||||
global DeepSleep
|
||||
|
||||
GetRIP:
|
||||
jmp FakeStub
|
||||
ret
|
||||
|
||||
FakeStub:
|
||||
pop rax
|
||||
jmp rax
|
||||
|
||||
RopThis:
|
||||
|
||||
push 2
|
||||
push 1
|
||||
push 1
|
||||
push 1
|
||||
push 1
|
||||
push QWORD [rbp + 48h] ; addRsp32Popr14
|
||||
|
||||
push QWORD [rbp + 30h] ; VirtualProtect
|
||||
push 1
|
||||
push 1
|
||||
push r9
|
||||
push 20h ; PAGE_EXECUTE_READ
|
||||
push rcx
|
||||
push rdx
|
||||
push QWORD [rbp + 40h] ; SuperPop
|
||||
|
||||
push 2
|
||||
push 1
|
||||
push 1
|
||||
push 1
|
||||
push 1
|
||||
push QWORD [rbp + 48h] ; addRsp32Popr14
|
||||
|
||||
; Sleep
|
||||
push QWORD [rbp + 38h] ; Sleep
|
||||
push 41h
|
||||
push 41h
|
||||
push 41h
|
||||
push 41h
|
||||
push QWORD [rbp + 50h] ; Sleeptime here
|
||||
push 41h
|
||||
push QWORD [rbp + 40h] ; SuperPop
|
||||
|
||||
push 2
|
||||
push 1
|
||||
push 1
|
||||
push 1
|
||||
push 1
|
||||
push QWORD [rbp + 48h] ; addRsp32Popr14
|
||||
|
||||
push QWORD [rbp + 30h] ; VirtualProtect
|
||||
push 1
|
||||
push 1
|
||||
push r9
|
||||
push r8
|
||||
push rcx
|
||||
push rdx
|
||||
push QWORD [rbp + 40h] ; SuperPop
|
||||
|
||||
ret
|
||||
|
||||
DeepSleep:
|
||||
|
||||
push rbp
|
||||
mov rbp, rsp
|
||||
|
||||
push rbx
|
||||
push rsi
|
||||
push rdi
|
||||
push r12
|
||||
push r13
|
||||
push r14
|
||||
push r15
|
||||
|
||||
call RopThis
|
||||
|
||||
pop r15
|
||||
pop r14
|
||||
pop r13
|
||||
pop r12
|
||||
pop rdi
|
||||
pop rsi
|
||||
pop rbx
|
||||
|
||||
mov rsp, rbp
|
||||
pop rbp
|
||||
ret
|
||||
@@ -0,0 +1,9 @@
|
||||
ENTRY(alignstack)
|
||||
SECTIONS
|
||||
{
|
||||
.text :
|
||||
{
|
||||
*(.text.alignstack)
|
||||
*(.text.go)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
make:
|
||||
nasm -f win64 adjuststack.asm -o adjuststack.o
|
||||
nasm -f win64 asmStubs.nasm -o asmStubs.o
|
||||
x86_64-w64-mingw32-gcc ApiResolve.c -Wall -m64 -ffunction-sections -fno-asynchronous-unwind-tables -nostdlib -fno-ident -O2 -c -o ApiResolve.o -Wl,--no-seh
|
||||
x86_64-w64-mingw32-gcc Main.c -Wall -m64 -masm=intel -ffunction-sections -fno-asynchronous-unwind-tables -nostdlib -fno-ident -O2 -c -o Main.o -Wl,--no-seh
|
||||
x86_64-w64-mingw32-ld -s adjuststack.o asmStubs.o ApiResolve.o Main.o -o DeepSleep.exe
|
||||
|
||||
objcopy -O binary DeepSleep.exe DeepSleep.bin
|
||||
Reference in New Issue
Block a user