commit bcb1117fe7d78b2a044fc2c80427ea1f10b82765 Author: thefLink Date: Tue May 24 23:48:11 2022 +0200 adding code and screens diff --git a/DeepSleep.bin b/DeepSleep.bin new file mode 100644 index 0000000..011392e Binary files /dev/null and b/DeepSleep.bin differ diff --git a/Screens/MonetaFound.png b/Screens/MonetaFound.png new file mode 100644 index 0000000..5ef21d0 Binary files /dev/null and b/Screens/MonetaFound.png differ diff --git a/Screens/MonetaNotFound.png b/Screens/MonetaNotFound.png new file mode 100644 index 0000000..283a6a3 Binary files /dev/null and b/Screens/MonetaNotFound.png differ diff --git a/Screens/WeirdTrace.png b/Screens/WeirdTrace.png new file mode 100644 index 0000000..9eba471 Binary files /dev/null and b/Screens/WeirdTrace.png differ diff --git a/src/ApiResolve.c b/src/ApiResolve.c new file mode 100644 index 0000000..5e61498 --- /dev/null +++ b/src/ApiResolve.c @@ -0,0 +1,255 @@ +#include "ApiResolve.h" + +static uint64_t getDllBase(unsigned long); +static uint64_t loadDll(unsigned long); +static uint64_t loadDll_byName(char*); +static uint64_t parseHdrForPtr(uint64_t, unsigned long); +static uint64_t followExport(char*, unsigned long); + +static unsigned long djb2(unsigned char*); +static unsigned long unicode_djb2(const wchar_t* str); +static unsigned long xor_hash(unsigned long); +static WCHAR* toLower(WCHAR* str); + +uint64_t +getFunctionPtr(unsigned long crypted_dll_hash, unsigned long crypted_function_hash) { + + uint64_t dll_base = 0x00; + uint64_t ptr_function = 0x00; + + dll_base = getDllBase(crypted_dll_hash); + if (dll_base == 0) { + dll_base = loadDll(crypted_dll_hash); + if (dll_base == 0) + return FAIL; + } + + ptr_function = parseHdrForPtr(dll_base, crypted_function_hash); + + return ptr_function; + +} + +static uint64_t +loadDll(unsigned long crypted_dll_hash) { + + uint64_t kernel32_base = 0x00; + uint64_t fptr_loadLibary = 0x00; + uint64_t ptr_loaded_dll = 0x00; + + kernel32_base = getDllBase(CRYPTED_HASH_KERNEL32); + if (kernel32_base == 0x00) + return FAIL; + + fptr_loadLibary = parseHdrForPtr(kernel32_base, CRYPTED_HASH_LOADLIBRARYA); + if (fptr_loadLibary == 0x00) + return FAIL; + + if (crypted_dll_hash == CRYPTED_HASH_USER32) { + char dll_name[] = { 'U', 's', 'e', 'r', '3' ,'2' ,'.', 'd', 'l', 'l', 0x00 }; + ptr_loaded_dll = (uint64_t)((LOADLIBRARYA)fptr_loadLibary)(dll_name); + } else if (crypted_dll_hash == CRYPTED_HASH_SHLWAPI) { + char dll_name[] = { 'S', 'h', 'l', 'w', 'a', 'p', 'i', '.', 'd','l','l',0x00 }; + ptr_loaded_dll = (uint64_t)((LOADLIBRARYA)fptr_loadLibary)(dll_name); + } + + return ptr_loaded_dll; + +} + +static uint64_t +loadDll_byName(char* dll_name) { + + uint64_t kernel32_base = 0x00; + uint64_t fptr_loadLibary = 0x00; + uint64_t ptr_loaded_dll = 0x00; + + kernel32_base = getDllBase(CRYPTED_HASH_KERNEL32); + if (kernel32_base == 0x00) + return FAIL; + + fptr_loadLibary = parseHdrForPtr(kernel32_base, CRYPTED_HASH_LOADLIBRARYA); + if (fptr_loadLibary == 0x00) + return FAIL; + + ptr_loaded_dll = (uint64_t)((LOADLIBRARYA)fptr_loadLibary)(dll_name); + + return ptr_loaded_dll; + +} + + +static uint64_t +parseHdrForPtr(uint64_t dll_base, unsigned long crypted_function_hash) { + + PIMAGE_NT_HEADERS nt_hdrs = NULL; + PIMAGE_DATA_DIRECTORY data_dir = NULL; + PIMAGE_EXPORT_DIRECTORY export_dir = NULL; + + uint32_t* ptr_exportadrtable = 0x00; + uint32_t* ptr_namepointertable = 0x00; + uint16_t* ptr_ordinaltable = 0x00; + + uint32_t idx_functions = 0x00; + + unsigned char* ptr_function_name = NULL; + + + nt_hdrs = (PIMAGE_NT_HEADERS)(dll_base + (uint64_t)((PIMAGE_DOS_HEADER)(size_t)dll_base)->e_lfanew); + data_dir = (PIMAGE_DATA_DIRECTORY)&nt_hdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]; + export_dir = (PIMAGE_EXPORT_DIRECTORY)(dll_base + (uint64_t)data_dir->VirtualAddress); + + ptr_exportadrtable = (uint32_t*)(dll_base + (uint64_t)export_dir->AddressOfFunctions); + ptr_namepointertable = (uint32_t*)(dll_base + (uint64_t)export_dir->AddressOfNames); + ptr_ordinaltable = (uint16_t*)(dll_base + (uint64_t)export_dir->AddressOfNameOrdinals); + + for (idx_functions = 0; idx_functions < export_dir->NumberOfNames; idx_functions++) { + + ptr_function_name = (unsigned char*)dll_base + (ptr_namepointertable[idx_functions]); + if (djb2(ptr_function_name) == xor_hash(crypted_function_hash)) { + + WORD nameord = ptr_ordinaltable[idx_functions]; + DWORD rva = ptr_exportadrtable[nameord]; + + + if (dll_base + rva >= dll_base + data_dir->VirtualAddress && dll_base + rva <= dll_base + data_dir->VirtualAddress + (uint64_t)data_dir->Size) { + // This is a forwarded export + + char* ptr_forward = (char*)(dll_base + rva); + return followExport(ptr_forward, crypted_function_hash); + + } + + + return dll_base + rva; + } + + } + + return FAIL; +} + +static uint64_t followExport(char* ptr_forward, unsigned long crypted_function_hash) { + + STRSTRA _StrStrA = (STRSTRA)getFunctionPtr(CRYPTED_HASH_SHLWAPI, CRYPTED_HASH_STRSTRA); + + if (_StrStrA == 0x00) + return FAIL; + + char del[] = { '.', 0x00 }; + char* pos_del = 0x00; + char forward_dll[MAX_PATH] = { 0 }; + char forward_export[MAX_PATH] = { 0 }; + unsigned long forward_export_hash = 0x00; + uint8_t i = 0; + uint64_t fwd_dll_base = 0x00, forwarded_export = 0x00; + + while (*ptr_forward) + forward_dll[i++] = *ptr_forward++; + + pos_del = (char*)_StrStrA(forward_dll, del); + if (pos_del == 0) + return FAIL; + + *(char*)(pos_del++) = 0x00; + i = 0; + while (*pos_del) + forward_export[i++] = *pos_del++; + + forward_export_hash = xor_hash(djb2((unsigned char*)forward_export)); + + fwd_dll_base = getDllBase(xor_hash(djb2((unsigned char*)forward_dll))); + if (fwd_dll_base == 0x00) { + fwd_dll_base = loadDll_byName(forward_dll); + if (fwd_dll_base == 0x00) + return FAIL; + } + + forwarded_export = parseHdrForPtr(fwd_dll_base, forward_export_hash); + + return forwarded_export; + +} + +static uint64_t +getDllBase(unsigned long crypted_dll_hash) { + + _PPEB ptr_peb = NULL; + PPEB_LDR_DATA ptr_ldr_data = NULL; + PLDR_DATA_TABLE_ENTRY ptr_module_entry = NULL, ptr_start_module = NULL; + PUNICODE_STR dll_name = NULL; + + ptr_peb = (_PEB*)__readgsqword(0x60); + ptr_ldr_data = ptr_peb->pLdr; + ptr_module_entry = ptr_start_module = (PLDR_DATA_TABLE_ENTRY)ptr_ldr_data->InMemoryOrderModuleList.Flink; + + do { + + dll_name = &ptr_module_entry->BaseDllName; + + if (dll_name->pBuffer == NULL) + return FAIL; + + if (unicode_djb2(toLower(dll_name->pBuffer)) == xor_hash(crypted_dll_hash)) + return (uint64_t)ptr_module_entry->DllBase; + + ptr_module_entry = (PLDR_DATA_TABLE_ENTRY)ptr_module_entry->InMemoryOrderModuleList.Flink; + + } while (ptr_module_entry != ptr_start_module); + + return FAIL; + +} + +static unsigned long +djb2(unsigned char* str) +{ + unsigned long hash = 5381; + int c; + + while ((c = *str++)) + hash = ((hash << 5) + hash) + c; + + return hash; +} + +unsigned long +unicode_djb2(const wchar_t* str) +{ + + unsigned long hash = 5381; + DWORD val; + + while (*str != 0) { + val = (DWORD)*str++; + hash = ((hash << 5) + hash) + val; + } + + return hash; + +} + +unsigned long +xor_hash(unsigned long hash) { + return hash ^ CRYPT_KEY; +} + +static WCHAR* +toLower(WCHAR* str) +{ + + WCHAR* start = str; + + while (*str) { + + if (*str <= L'Z' && *str >= 'A') { + *str += 32; + } + + str += 1; + + } + + return start; + +} diff --git a/src/ApiResolve.h b/src/ApiResolve.h new file mode 100644 index 0000000..4a23189 --- /dev/null +++ b/src/ApiResolve.h @@ -0,0 +1,164 @@ +#pragma once + +#include +#include "windows.h" + +#define FAIL 0 +#define SUCCESS 1 + +#define CRYPT_KEY 0x41424344 + +uint64_t getFunctionPtr(unsigned long, unsigned long); + +// ---- KERNEL32 ---- +#define CRYPTED_HASH_KERNEL32 0x3102ad31 +#define CRYPTED_HASH_LOADLIBRARYA 0x1efdb3bf +#define CRYTPED_HASH_VIRTUALALLOC 0x796e4cd3 +#define CRYPTED_HASH_VIRTUALFREE 0x27cd8c6a +#define CRYPTED_HASH_COPYMEMORY 0x14d8cfcf +#define CRYPTED_HASH_GETSYSTEMINFO 0xc24aacb2 +#define CRYPTED_HASH_VIRTUALQUERYEX 0x96d1a8db +#define CRYPTED_HASH_ADDVECTOREDEXCEPTIONHANDLER 0x7693b393 +#define CRYPTED_HASH_GETTHREADCONTEXT 0xaae08c86 +#define CRYPTED_HASH_SETTHREADCONTEXT 0x3f62d50a +#define CRYPTED_HASH_GETMODULEHANDLEA 0x1b577c1c +#define CRYPTED_HASH_GETCURRENTPROCESS 0x8bcf3663 +#define CRYPTED_HASH_VIRTUALPROTECT 0xc50db2c9 +#define CRYPTED_HASH_SLEEP 0x4f5ba6ba +#define CRYPTED_HASH_LSTRCMPA 0x93fd9eaf + +typedef HMODULE(WINAPI* LOADLIBRARYA)(LPCSTR); +typedef LPVOID(WINAPI* VIRTUALALLOC)(LPVOID, SIZE_T, DWORD, DWORD); +typedef BOOL(WINAPI* VIRTUALFREE)(LPVOID, SIZE_T, DWORD); +typedef void(WINAPI* SLEEP)(); +typedef BOOL(WINAPI* VIRTUALFREE)(LPVOID, SIZE_T, DWORD); +typedef void(WINAPI* COPYMEMORY)(PVOID, void*, SIZE_T); +typedef HANDLE(WINAPI* GETCURRENTPROCESS)(void); +typedef void(WINAPI* GETSYSTEMINFO)(LPSYSTEM_INFO); +typedef SIZE_T(WINAPI* VIRTUALQUERYEX)(HANDLE, LPCVOID, PMEMORY_BASIC_INFORMATION, SIZE_T); +typedef PVOID(WINAPI* ADDVECTOREDEXCEPTIONHANDLER)(ULONG, PVECTORED_EXCEPTION_HANDLER); +typedef BOOL(WINAPI* GETTHREADCONTEXT)(HANDLE, LPCONTEXT); +typedef BOOL(WINAPI* SETTHREADCONTEXT)(HANDLE, LPCONTEXT); +typedef HMODULE(WINAPI* GETMODULEHANDLE)(LPCSTR); +typedef BOOL(WINAPI* VIRTUALPROTECT)(LPVOID, SIZE_T, DWORD, PDWORD); +typedef int (WINAPI* LSTRCMPA)(LPCSTR, LPCSTR); + +// ---- USER32 ---- +#define CRYPTED_HASH_USER32 0x985bec97 +#define CRYPTED_HASH_MESSAGEBOXA 0x790d57f0 + +typedef int(WINAPI* MESSAGEBOXA)(HWND, LPCSTR, LPCSTR, UINT); + +// ---- shlwapi.dll ---- +#define CRYPTED_HASH_SHLWAPI 0xe64fd763 +#define CRYPTED_HASH_STRSTRA 0x4ef4617c + +typedef PCSTR(WINAPI* STRSTRA)(PCSTR, PCSTR); + +typedef struct _UNICODE_STR { + USHORT Length; + USHORT MaximumLength; + PWSTR pBuffer; +} UNICODE_STR, * PUNICODE_STR; + +typedef struct _PEB_LDR_DATA +{ + DWORD dwLength; + DWORD dwInitialized; + LPVOID lpSsHandle; + LIST_ENTRY InLoadOrderModuleList; + LIST_ENTRY InMemoryOrderModuleList; + LIST_ENTRY InInitializationOrderModuleList; + LPVOID lpEntryInProgress; +} PEB_LDR_DATA, * PPEB_LDR_DATA; + +typedef struct _LDR_DATA_TABLE_ENTRY +{ + LIST_ENTRY InMemoryOrderModuleList; + LIST_ENTRY InInitializationOrderModuleList; + PVOID DllBase; + PVOID EntryPoint; + ULONG SizeOfImage; + UNICODE_STR FullDllName; + UNICODE_STR BaseDllName; + ULONG Flags; + SHORT LoadCount; + SHORT TlsIndex; + LIST_ENTRY HashTableEntry; + ULONG TimeDateStamp; +} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY; + +typedef struct _PEB_FREE_BLOCK +{ + struct _PEB_FREE_BLOCK* pNext; + DWORD dwSize; +} PEB_FREE_BLOCK, * PPEB_FREE_BLOCK; + +typedef struct __PEB +{ + BYTE bInheritedAddressSpace; + BYTE bReadImageFileExecOptions; + BYTE bBeingDebugged; + BYTE bSpareBool; + LPVOID lpMutant; + LPVOID lpImageBaseAddress; + PPEB_LDR_DATA pLdr; + LPVOID lpProcessParameters; + LPVOID lpSubSystemData; + LPVOID lpProcessHeap; + PRTL_CRITICAL_SECTION pFastPebLock; + LPVOID lpFastPebLockRoutine; + LPVOID lpFastPebUnlockRoutine; + DWORD dwEnvironmentUpdateCount; + LPVOID lpKernelCallbackTable; + DWORD dwSystemReserved; + DWORD dwAtlThunkSListPtr32; + PPEB_FREE_BLOCK pFreeList; + DWORD dwTlsExpansionCounter; + LPVOID lpTlsBitmap; + DWORD dwTlsBitmapBits[2]; + LPVOID lpReadOnlySharedMemoryBase; + LPVOID lpReadOnlySharedMemoryHeap; + LPVOID lpReadOnlyStaticServerData; + LPVOID lpAnsiCodePageData; + LPVOID lpOemCodePageData; + LPVOID lpUnicodeCaseTableData; + DWORD dwNumberOfProcessors; + DWORD dwNtGlobalFlag; + LARGE_INTEGER liCriticalSectionTimeout; + DWORD dwHeapSegmentReserve; + DWORD dwHeapSegmentCommit; + DWORD dwHeapDeCommitTotalFreeThreshold; + DWORD dwHeapDeCommitFreeBlockThreshold; + DWORD dwNumberOfHeaps; + DWORD dwMaximumNumberOfHeaps; + LPVOID lpProcessHeaps; + LPVOID lpGdiSharedHandleTable; + LPVOID lpProcessStarterHelper; + DWORD dwGdiDCAttributeList; + LPVOID lpLoaderLock; + DWORD dwOSMajorVersion; + DWORD dwOSMinorVersion; + WORD wOSBuildNumber; + WORD wOSCSDVersion; + DWORD dwOSPlatformId; + DWORD dwImageSubsystem; + DWORD dwImageSubsystemMajorVersion; + DWORD dwImageSubsystemMinorVersion; + DWORD dwImageProcessAffinityMask; + DWORD dwGdiHandleBuffer[34]; + LPVOID lpPostProcessInitRoutine; + LPVOID lpTlsExpansionBitmap; + DWORD dwTlsExpansionBitmapBits[32]; + DWORD dwSessionId; + ULARGE_INTEGER liAppCompatFlags; + ULARGE_INTEGER liAppCompatFlagsUser; + LPVOID lppShimData; + LPVOID lpAppCompatInfo; + UNICODE_STR usCSDVersion; + LPVOID lpActivationContextData; + LPVOID lpProcessAssemblyStorageMap; + LPVOID lpSystemDefaultActivationContextData; + LPVOID lpSystemAssemblyStorageMap; + DWORD dwMinimumStackCommit; +} _PEB, * _PPEB; \ No newline at end of file diff --git a/src/DeepSleep.sln b/src/DeepSleep.sln new file mode 100644 index 0000000..b747452 --- /dev/null +++ b/src/DeepSleep.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 16 +VisualStudioVersion = 16.0.32413.511 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "DeepSleep", "DeepSleep.vcxproj", "{39492B36-397C-46B0-9B84-9CDCCEF21130}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {39492B36-397C-46B0-9B84-9CDCCEF21130}.Debug|x64.ActiveCfg = Debug|x64 + {39492B36-397C-46B0-9B84-9CDCCEF21130}.Debug|x64.Build.0 = Debug|x64 + {39492B36-397C-46B0-9B84-9CDCCEF21130}.Debug|x86.ActiveCfg = Debug|Win32 + {39492B36-397C-46B0-9B84-9CDCCEF21130}.Debug|x86.Build.0 = Debug|Win32 + {39492B36-397C-46B0-9B84-9CDCCEF21130}.Release|x64.ActiveCfg = Release|x64 + {39492B36-397C-46B0-9B84-9CDCCEF21130}.Release|x64.Build.0 = Release|x64 + {39492B36-397C-46B0-9B84-9CDCCEF21130}.Release|x86.ActiveCfg = Release|Win32 + {39492B36-397C-46B0-9B84-9CDCCEF21130}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {17C2B31B-8016-4028-84E6-80106F4FAC23} + EndGlobalSection +EndGlobal diff --git a/src/DeepSleep.vcxproj b/src/DeepSleep.vcxproj new file mode 100644 index 0000000..9fcdedd --- /dev/null +++ b/src/DeepSleep.vcxproj @@ -0,0 +1,159 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {39492b36-397c-46b0-9b84-9cdccef21130} + DeepSleep + 10.0 + + + + Application + true + v142 + Unicode + + + Application + false + v142 + true + Unicode + + + Application + true + v142 + Unicode + + + Application + false + v142 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + + + + Document + + + + + + + + \ No newline at end of file diff --git a/src/DeepSleep.vcxproj.filters b/src/DeepSleep.vcxproj.filters new file mode 100644 index 0000000..bcb2f86 --- /dev/null +++ b/src/DeepSleep.vcxproj.filters @@ -0,0 +1,40 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Header Files + + + + + Source Files + + + Source Files + + + + + Source Files + + + + + Source Files + + + \ No newline at end of file diff --git a/src/DeepSleep.vcxproj.user b/src/DeepSleep.vcxproj.user new file mode 100644 index 0000000..88a5509 --- /dev/null +++ b/src/DeepSleep.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/src/Main.c b/src/Main.c new file mode 100644 index 0000000..4852efd --- /dev/null +++ b/src/Main.c @@ -0,0 +1,170 @@ +#include +#include "stdio.h" + +#include "ApiResolve.h" + +#define FAIL 0 +#define SUCCESS 1 + +BOOL findGadget(byte pattern[], DWORD dwLenPattern, PVOID* ppGadgetAddress); + +extern DWORD64 GetRIP(void); +extern BOOL DeepSleep(LPVOID, SIZE_T, DWORD, PDWORD, PVOID, PVOID, PVOID, PVOID, DWORD); + +#ifdef _DEBUG +int main(int argc, char** argv) { +#else +int go(void){ +#endif + + GETSYSTEMINFO _GetSystemInfo = (GETSYSTEMINFO)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYPTED_HASH_GETSYSTEMINFO); + VIRTUALQUERYEX _VirtualQueryEx = (VIRTUALQUERYEX)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYPTED_HASH_VIRTUALQUERYEX); + GETCURRENTPROCESS _GetCurrentProcess = (GETCURRENTPROCESS)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYPTED_HASH_GETCURRENTPROCESS); + MESSAGEBOXA _messageBoxA = (MESSAGEBOXA)getFunctionPtr(CRYPTED_HASH_USER32, CRYPTED_HASH_MESSAGEBOXA); + VIRTUALPROTECT _VirtualProtect = (VIRTUALPROTECT)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYPTED_HASH_VIRTUALPROTECT); + SLEEP _Sleep = (SLEEP)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYPTED_HASH_SLEEP); + + DWORD dwSuccess = FAIL, dwOldProtect = 0; + PVOID rip = NULL, gAddRsp32 = NULL, gSuper = NULL; + + PVOID myPage = NULL; + DWORD myPageLength = 0; + + MEMORY_BASIC_INFORMATION mbi = { 0x00 }; + SYSTEM_INFO si = { 0x00 }; + BOOL bFound = FALSE; + + byte patternSuperGadget[] = { 0x5A, 0x59, 0x41, 0x58, 0x41, 0x59, 0x41, 0x5A, 0x41, 0x5B, 0xC3 }; + byte patternAddRsp32Pop[] = { 0x48, 0x83, 0xC4, 0x20, 0x41, 0x5E, 0xC3 }; + + bFound = findGadget(patternSuperGadget, 11, &gSuper); + if (bFound == FALSE) + goto exit; + + bFound = findGadget(patternAddRsp32Pop, 5, &gAddRsp32); + if (bFound == FALSE) + goto exit; + + rip = (PVOID)GetRIP(); + _GetSystemInfo(&si); + + LPVOID lpMem = 0; + + while (lpMem < si.lpMaximumApplicationAddress) { + + _VirtualQueryEx(_GetCurrentProcess(), lpMem, &mbi, sizeof(MEMORY_BASIC_INFORMATION)); + + if (rip >= mbi.BaseAddress && (DWORD64)rip <= (DWORD64)mbi.BaseAddress + mbi.RegionSize) { + + myPage = mbi.BaseAddress; + myPageLength = mbi.RegionSize; + + break; + } + + lpMem = (LPVOID)((DWORD64)mbi.BaseAddress + mbi.RegionSize); + + } + + while (1) { + + DeepSleep(myPage, myPageLength, PAGE_NOACCESS, &dwOldProtect, + _VirtualProtect, + _Sleep, + gSuper, + gAddRsp32, + 5000 + ); + + char foo[] = { '1', 0x00 }; + _messageBoxA(0, foo, foo, 1); + + } + + dwSuccess = SUCCESS; + +exit: + + return dwSuccess; + +} + +BOOL findGadget(byte pattern[], DWORD dwLenPattern, PVOID* ppGadgetAddress) { + + VIRTUALALLOC _VirtualAlloc = (VIRTUALALLOC)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYTPED_HASH_VIRTUALALLOC); + VIRTUALFREE _VirtualFree = (VIRTUALFREE)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYPTED_HASH_VIRTUALFREE); + COPYMEMORY _CopyMemory = (COPYMEMORY)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYPTED_HASH_COPYMEMORY); + GETMODULEHANDLE _GetModuleHandle = (GETMODULEHANDLE)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYPTED_HASH_GETMODULEHANDLEA); + LSTRCMPA _lstrcmpA = (LSTRCMPA)getFunctionPtr(CRYPTED_HASH_KERNEL32, CRYPTED_HASH_LSTRCMPA); + + BOOL bSuccess = FALSE; + PVOID pBufTextMemory = NULL; + DWORD sizeText = 0; + + PIMAGE_DOS_HEADER pDosHdr = NULL; + PIMAGE_NT_HEADERS pNtHdrs = NULL; + PIMAGE_SECTION_HEADER pSectionHdr = NULL; + HMODULE hNtdll = NULL; + + char ntdll[] = { 'n', 't', 'd','l','l','.', 'd','l','l', 0x00 }; + char text[] = { '.', 't','e','x','t', 0x00 }; + + hNtdll = _GetModuleHandle(ntdll); + if (hNtdll == NULL) + goto exit; + + pDosHdr = (PIMAGE_DOS_HEADER)hNtdll; + pNtHdrs = (PIMAGE_NT_HEADERS)((byte*)hNtdll + pDosHdr->e_lfanew); + pSectionHdr = (PIMAGE_SECTION_HEADER)((byte*)&pNtHdrs->OptionalHeader + sizeof(IMAGE_OPTIONAL_HEADER)); + + for (int i = 0; i < pNtHdrs->FileHeader.NumberOfSections; i++) { + + if (_lstrcmpA((char*)pSectionHdr->Name, text) == 0) { + + pBufTextMemory = _VirtualAlloc(0, pSectionHdr->Misc.VirtualSize, MEM_COMMIT, PAGE_READWRITE); + if (pBufTextMemory == NULL) + goto exit; + + _CopyMemory(pBufTextMemory, (byte*)((byte*)hNtdll + pSectionHdr->VirtualAddress), pSectionHdr->Misc.VirtualSize); + + sizeText = pSectionHdr->Misc.VirtualSize; + + break; + + } + + pSectionHdr = (PIMAGE_SECTION_HEADER)((byte*)pSectionHdr + sizeof(IMAGE_SECTION_HEADER)); + + } + + if (pBufTextMemory == NULL) + goto exit; + + BOOL bFound = FALSE; + int i = 0; + for (i = 0; i < sizeText && bFound == FALSE; i++) { + for (int j = 0; j < dwLenPattern; j++) { + if (* ((byte*)pBufTextMemory + i + j) != pattern[j]) { + bFound = FALSE; + break; + } else { + bFound = TRUE; + } + } + } + + if (bFound == FALSE) + goto exit; + + *ppGadgetAddress = (byte*)hNtdll + pSectionHdr->VirtualAddress + i - 1; + + bSuccess = TRUE; + +exit: + + if (pBufTextMemory) + _VirtualFree(pBufTextMemory, 0, MEM_RELEASE); + + return bSuccess; + +} diff --git a/src/adjuststack.asm b/src/adjuststack.asm new file mode 100644 index 0000000..3cb27cd --- /dev/null +++ b/src/adjuststack.asm @@ -0,0 +1,14 @@ +extern go +global alignstack + +segment .text + +alignstack: + push rsi + mov rsi, rsp + and rsp, 0FFFFFFFFFFFFFFF0h + sub rsp, 020h + call go + mov rsp, rsi + pop rsi + ret diff --git a/src/asmStubs.asm b/src/asmStubs.asm new file mode 100644 index 0000000..a240376 --- /dev/null +++ b/src/asmStubs.asm @@ -0,0 +1,98 @@ +.code + +GetRIP PROC + jmp FakeStub + ret +GetRIP ENDP + +FakeStub PROC + pop rax + jmp rax +FakeStub ENDP + +RopThis PROC + + push 2 + push 1 + push 1 + push 1 + push 1 + push QWORD PTR [rbp + 48h] ; addRsp32Popr14 + + push QWORD PTR [rbp + 30h] ; VirtualProtect + push 1 + push 1 + push r9 + push 20h ; PAGE_EXECUTE_READ + push rcx + push rdx + push QWORD PTR [rbp + 40h] ; SuperPop + + push 2 + push 1 + push 1 + push 1 + push 1 + push QWORD PTR [rbp + 48h] ; addRsp32Popr14 + + ; Sleep + push QWORD PTR [rbp + 38h] ; Sleep + push 41h + push 41h + push 41h + push 41h + push QWORD PTR [rbp + 50h] ; Sleeptime here + push 41h + push QWORD PTR [rbp + 40h] ; SuperPop + + push 2 + push 1 + push 1 + push 1 + push 1 + push QWORD PTR [rbp + 48h] ; addRsp32Popr14 + + push QWORD PTR [rbp + 30h] ; VirtualProtect + push 1 + push 1 + push r9 + push r8 + push rcx + push rdx + push QWORD PTR [rbp + 40h] ; SuperPop + + ret + +RopThis ENDP + +DeepSleep PROC + + push rbp + mov rbp, rsp + + push rbx + push rsi + push rdi + push r12 + push r13 + push r14 + push r15 + + call RopThis + + pop r15 + pop r14 + pop r13 + pop r12 + pop rdi + pop rsi + pop rbx + + mov rsp, rbp + pop rbp + ret + +DeepSleep ENDP + + +end \ No newline at end of file diff --git a/src/asmStubs.nasm b/src/asmStubs.nasm new file mode 100644 index 0000000..f9ad47d --- /dev/null +++ b/src/asmStubs.nasm @@ -0,0 +1,92 @@ +segment .text + +global GetRIP +global DeepSleep + +GetRIP: + jmp FakeStub + ret + +FakeStub: + pop rax + jmp rax + +RopThis: + + push 2 + push 1 + push 1 + push 1 + push 1 + push QWORD [rbp + 48h] ; addRsp32Popr14 + + push QWORD [rbp + 30h] ; VirtualProtect + push 1 + push 1 + push r9 + push 20h ; PAGE_EXECUTE_READ + push rcx + push rdx + push QWORD [rbp + 40h] ; SuperPop + + push 2 + push 1 + push 1 + push 1 + push 1 + push QWORD [rbp + 48h] ; addRsp32Popr14 + + ; Sleep + push QWORD [rbp + 38h] ; Sleep + push 41h + push 41h + push 41h + push 41h + push QWORD [rbp + 50h] ; Sleeptime here + push 41h + push QWORD [rbp + 40h] ; SuperPop + + push 2 + push 1 + push 1 + push 1 + push 1 + push QWORD [rbp + 48h] ; addRsp32Popr14 + + push QWORD [rbp + 30h] ; VirtualProtect + push 1 + push 1 + push r9 + push r8 + push rcx + push rdx + push QWORD [rbp + 40h] ; SuperPop + + ret + +DeepSleep: + + push rbp + mov rbp, rsp + + push rbx + push rsi + push rdi + push r12 + push r13 + push r14 + push r15 + + call RopThis + + pop r15 + pop r14 + pop r13 + pop r12 + pop rdi + pop rsi + pop rbx + + mov rsp, rbp + pop rbp + ret diff --git a/src/linker.ld b/src/linker.ld new file mode 100644 index 0000000..4567d38 --- /dev/null +++ b/src/linker.ld @@ -0,0 +1,9 @@ +ENTRY(alignstack) +SECTIONS +{ + .text : + { + *(.text.alignstack) + *(.text.go) + } +} diff --git a/src/makefile b/src/makefile new file mode 100644 index 0000000..565a53c --- /dev/null +++ b/src/makefile @@ -0,0 +1,8 @@ +make: + nasm -f win64 adjuststack.asm -o adjuststack.o + nasm -f win64 asmStubs.nasm -o asmStubs.o + x86_64-w64-mingw32-gcc ApiResolve.c -Wall -m64 -ffunction-sections -fno-asynchronous-unwind-tables -nostdlib -fno-ident -O2 -c -o ApiResolve.o -Wl,--no-seh + x86_64-w64-mingw32-gcc Main.c -Wall -m64 -masm=intel -ffunction-sections -fno-asynchronous-unwind-tables -nostdlib -fno-ident -O2 -c -o Main.o -Wl,--no-seh + x86_64-w64-mingw32-ld -s adjuststack.o asmStubs.o ApiResolve.o Main.o -o DeepSleep.exe + + objcopy -O binary DeepSleep.exe DeepSleep.bin