mirror of
https://github.com/thomasxm/BOAZ_beta
synced 2026-06-06 16:54:29 +00:00
thomasxm
94765033d7
New features: DefWindowProcA is used as stack function as it has a long winded stack frame. use VEH and VCH to set up a hardware breakpoint on the syscall opcode when the breakpoint is hit, we emulate the syscall using the context of the thread VEH is used to do nothing and detect the HW breakpoint set up by security solutions as an anti-emulation measure. VCH is used to set up a hardware breakpoint on the syscall and ret code. VEH and VCH are removed manually by clearing the CrossProcessFlag from PEB to avoid forensic traces.
439 lines
25 KiB
C++
439 lines
25 KiB
C++
/*
|
|
|
|
Copied from https://github.com/WKL-Sec/LayeredSyscall
|
|
Credit to The White Knight Lab
|
|
|
|
*/
|
|
|
|
#include <windows.h>
|
|
#include <stdio.h>
|
|
#include "FuncWrappers.h"
|
|
#include "HookModule.h"
|
|
#include "imports.h"
|
|
|
|
FARPROC RetrieveSyscallAddress(const char* FuncName) {
|
|
return GetProcAddress(GetModuleHandleA("ntdll.dll"), FuncName);
|
|
}
|
|
|
|
// TODO: add more function prototypes.
|
|
///////////////////////////////////////////////
|
|
// Function Prototypes //
|
|
/////////////////////////////////////////////
|
|
|
|
typedef NTSTATUS(NTAPI* orgNtCreateProcess)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, HANDLE, BOOLEAN, HANDLE, HANDLE, HANDLE);
|
|
typedef NTSTATUS(NTAPI* orgNtCreateThreadEx)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, HANDLE, PVOID, PVOID, ULONG, SIZE_T, SIZE_T, SIZE_T, PPS_ATTRIBUTE_LIST);
|
|
typedef NTSTATUS(NTAPI* orgNtOpenProcess)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID);
|
|
typedef NTSTATUS(NTAPI* orgNtOpenProcessToken)(HANDLE, ACCESS_MASK, PHANDLE);
|
|
typedef NTSTATUS(NTAPI* orgNtOpenThread)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID);
|
|
typedef NTSTATUS(NTAPI* orgNtSuspendProcess)(HANDLE);
|
|
typedef NTSTATUS(NTAPI* orgNtSuspendThread)(HANDLE, PULONG);
|
|
typedef NTSTATUS(NTAPI* orgNtResumeProcess)(HANDLE);
|
|
typedef NTSTATUS(NTAPI* orgNtResumeThread)(HANDLE, PULONG);
|
|
typedef NTSTATUS(NTAPI* orgNtGetContextThread)(HANDLE, PCONTEXT);
|
|
typedef NTSTATUS(NTAPI* orgNtSetContextThread)(HANDLE, PCONTEXT);
|
|
typedef NTSTATUS(NTAPI* orgNtClose)(HANDLE);
|
|
typedef NTSTATUS(NTAPI* orgNtReadVirtualMemory)(HANDLE, PVOID, PVOID, SIZE_T, PSIZE_T);
|
|
typedef NTSTATUS(NTAPI* orgNtWriteVirtualMemory)(HANDLE, PVOID, PVOID, SIZE_T, PSIZE_T);
|
|
typedef NTSTATUS(NTAPI* orgNtAllocateVirtualMemory)(HANDLE, PVOID*, ULONG, PSIZE_T, ULONG, ULONG);
|
|
typedef NTSTATUS(NTAPI* orgNtProtectVirtualMemory)(HANDLE, PVOID*, PSIZE_T, ULONG, PULONG);
|
|
typedef NTSTATUS(NTAPI* orgNtFreeVirtualMemory)(HANDLE, PVOID*, PSIZE_T, ULONG);
|
|
typedef NTSTATUS(NTAPI* orgNtQuerySystemInformation)(SYSTEM_INFORMATION_CLASS, PVOID, ULONG, PULONG);
|
|
typedef NTSTATUS(NTAPI* orgNtQueryDirectoryFile)(HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID, PIO_STATUS_BLOCK, PVOID, ULONG, FILE_INFORMATION_CLASS, BOOLEAN, PUNICODE_STRING, BOOLEAN);
|
|
typedef NTSTATUS(NTAPI* orgNtQueryInformationFile)(HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG, FILE_INFORMATION_CLASS);
|
|
typedef NTSTATUS(NTAPI* orgNtQueryInformationProcess)(HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG);
|
|
typedef NTSTATUS(NTAPI* orgNtQueryInformationThread)(HANDLE, THREADINFOCLASS, PVOID, ULONG, PULONG);
|
|
typedef NTSTATUS(NTAPI* orgNtCreateSection)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PLARGE_INTEGER, ULONG, ULONG, HANDLE);
|
|
typedef NTSTATUS(NTAPI* orgNtOpenSection)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
|
|
typedef NTSTATUS(NTAPI* orgNtMapViewOfSection)(HANDLE, HANDLE, PVOID, ULONG, SIZE_T, PLARGE_INTEGER, PSIZE_T, SECTION_INHERIT, ULONG, ULONG);
|
|
typedef NTSTATUS(NTAPI* orgNtUnmapViewOfSection)(HANDLE, PVOID);
|
|
typedef NTSTATUS(NTAPI* orgNtAdjustPrivilegesToken)(HANDLE, BOOLEAN, PTOKEN_PRIVILEGES, ULONG, PTOKEN_PRIVILEGES, PULONG);
|
|
typedef NTSTATUS(NTAPI* orgNtDeviceIoControlFile)(HANDLE, HANDLE, PIO_APC_ROUTINE, PVOID, PIO_STATUS_BLOCK, ULONG, PVOID, ULONG, PVOID, ULONG);
|
|
typedef NTSTATUS(NTAPI* orgNtQueueApcThread)(HANDLE, PVOID, PVOID, PVOID, PVOID);
|
|
typedef NTSTATUS(NTAPI* orgNtWaitForMultipleObjects)(ULONG, PHANDLE, WAIT_TYPE, BOOLEAN, PLARGE_INTEGER);
|
|
typedef NTSTATUS(NTAPI* orgNtCreateUserProcess)(PHANDLE, PHANDLE, ACCESS_MASK, ACCESS_MASK, POBJECT_ATTRIBUTES, POBJECT_ATTRIBUTES, ULONG, ULONG, PRTL_USER_PROCESS_PARAMETERS, PPS_CREATE_INFO, PPS_ATTRIBUTE_LIST);
|
|
typedef NTSTATUS(NTAPI* orgNtAlertResumeThread)(HANDLE, PULONG);
|
|
|
|
ULONG wrpNtCreateProcess(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, HANDLE ParentProcess, BOOLEAN InheritObjectTable, HANDLE SectionHandle, HANDLE DebugPort, HANDLE ExceptionPort) {
|
|
orgNtCreateProcess pNtCreateProcess = (orgNtCreateProcess)RetrieveSyscallAddress("NtCreateProcess");
|
|
if (pNtCreateProcess == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtCreateProcess\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtCreateProcess\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtCreateProcess");
|
|
SetHwBp((ULONG_PTR)pNtCreateProcess, TRUE, ssn);
|
|
return pNtCreateProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ParentProcess, InheritObjectTable, SectionHandle, DebugPort, ExceptionPort);
|
|
}
|
|
|
|
ULONG wrpNtCreateThreadEx(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, HANDLE ProcessHandle, PVOID StartRoutine, PVOID Argument, ULONG CreateFlags, SIZE_T ZeroBits, SIZE_T StackSize, SIZE_T MaximumStackSize, PPS_ATTRIBUTE_LIST AttributeList) {
|
|
orgNtCreateThreadEx pNtCreateThreadEx = (orgNtCreateThreadEx)RetrieveSyscallAddress("NtCreateThreadEx");
|
|
if (pNtCreateThreadEx == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtCreateThreadEx\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtCreateThreadEx\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtCreateThreadEx");
|
|
SetHwBp((ULONG_PTR)pNtCreateThreadEx, TRUE, ssn);
|
|
return pNtCreateThreadEx(ThreadHandle, DesiredAccess, ObjectAttributes, ProcessHandle, StartRoutine, Argument, CreateFlags, ZeroBits, StackSize, MaximumStackSize, AttributeList);
|
|
}
|
|
|
|
ULONG wrpNtOpenProcess(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId) {
|
|
orgNtOpenProcess pNtOpenProcess = (orgNtOpenProcess)RetrieveSyscallAddress("NtOpenProcess");
|
|
if (pNtOpenProcess == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtOpenProcess\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtOpenProcess\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtOpenProcess");
|
|
SetHwBp((ULONG_PTR)pNtOpenProcess, TRUE, ssn);
|
|
return pNtOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId);
|
|
}
|
|
|
|
ULONG wrpNtOpenProcessToken(HANDLE ProcessHandle, ACCESS_MASK DesiredAccess, PHANDLE TokenHandle) {
|
|
orgNtOpenProcessToken pNtOpenProcessToken = (orgNtOpenProcessToken)RetrieveSyscallAddress("NtOpenProcessToken");
|
|
if (pNtOpenProcessToken == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtOpenProcessToken\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtOpenProcessToken\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtOpenProcessToken");
|
|
SetHwBp((ULONG_PTR)pNtOpenProcessToken, TRUE, ssn);
|
|
return pNtOpenProcessToken(ProcessHandle, DesiredAccess, TokenHandle);
|
|
}
|
|
|
|
ULONG wrpNtOpenThread(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId) {
|
|
orgNtOpenThread pNtOpenThread = (orgNtOpenThread)RetrieveSyscallAddress("NtOpenThread");
|
|
if (pNtOpenThread == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtOpenThread\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtOpenThread\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtOpenThread");
|
|
SetHwBp((ULONG_PTR)pNtOpenThread, TRUE, ssn);
|
|
return pNtOpenThread(ThreadHandle, DesiredAccess, ObjectAttributes, ClientId);
|
|
}
|
|
|
|
ULONG wrpNtSuspendProcess(HANDLE ProcessHandle) {
|
|
orgNtSuspendProcess pNtSuspendProcess = (orgNtSuspendProcess)RetrieveSyscallAddress("NtSuspendProcess");
|
|
if (pNtSuspendProcess == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtSuspendProcess\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtSuspendProcess\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtSuspendProcess");
|
|
SetHwBp((ULONG_PTR)pNtSuspendProcess, TRUE, ssn);
|
|
return pNtSuspendProcess(ProcessHandle);
|
|
}
|
|
|
|
ULONG wrpNtSuspendThread(HANDLE ThreadHandle, PULONG PreviousSuspendCount) {
|
|
orgNtSuspendThread pNtSuspendThread = (orgNtSuspendThread)RetrieveSyscallAddress("NtSuspendThread");
|
|
if (pNtSuspendThread == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtSuspendThread\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtSuspendThread\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtSuspendThread");
|
|
SetHwBp((ULONG_PTR)pNtSuspendThread, TRUE, ssn);
|
|
return pNtSuspendThread(ThreadHandle, PreviousSuspendCount);
|
|
}
|
|
|
|
ULONG wrpNtResumeProcess(HANDLE ProcessHandle) {
|
|
orgNtResumeProcess pNtResumeProcess = (orgNtResumeProcess)RetrieveSyscallAddress("NtResumeProcess");
|
|
if (pNtResumeProcess == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtResumeProcess\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtResumeProcess\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtResumeProcess");
|
|
SetHwBp((ULONG_PTR)pNtResumeProcess, TRUE, ssn);
|
|
return pNtResumeProcess(ProcessHandle);
|
|
}
|
|
|
|
ULONG wrpNtResumeThread(HANDLE ThreadHandle, PULONG PreviousSuspendCount) {
|
|
orgNtResumeThread pNtResumeThread = (orgNtResumeThread)RetrieveSyscallAddress("NtResumeThread");
|
|
if (pNtResumeThread == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtResumeThread\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtResumeThread\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtResumeThread");
|
|
SetHwBp((ULONG_PTR)pNtResumeThread, TRUE, ssn);
|
|
return pNtResumeThread(ThreadHandle, PreviousSuspendCount);
|
|
}
|
|
|
|
ULONG wrpNtGetContextThread(HANDLE ThreadHandle, PCONTEXT ThreadContext) {
|
|
orgNtGetContextThread pNtGetContextThread = (orgNtGetContextThread)RetrieveSyscallAddress("NtGetContextThread");
|
|
if (pNtGetContextThread == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtGetContextThread\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtGetContextThread\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtGetContextThread");
|
|
SetHwBp((ULONG_PTR)pNtGetContextThread, TRUE, ssn);
|
|
return pNtGetContextThread(ThreadHandle, ThreadContext);
|
|
}
|
|
|
|
ULONG wrpNtSetContextThread(HANDLE ThreadHandle, PCONTEXT Context) {
|
|
orgNtSetContextThread pNtSetContextThread = (orgNtSetContextThread)RetrieveSyscallAddress("NtSetContextThread");
|
|
if (pNtSetContextThread == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtSetContextThread\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtSetContextThread\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtSetContextThread");
|
|
SetHwBp((ULONG_PTR)pNtSetContextThread, TRUE, ssn);
|
|
return pNtSetContextThread(ThreadHandle, Context);
|
|
}
|
|
|
|
ULONG wrpNtClose(HANDLE Handle) {
|
|
orgNtClose pNtClose = (orgNtClose)RetrieveSyscallAddress("NtClose");
|
|
if (pNtClose == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtClose\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtClose\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtClose");
|
|
SetHwBp((ULONG_PTR)pNtClose, TRUE, ssn);
|
|
return pNtClose(Handle);
|
|
}
|
|
|
|
ULONG wrpNtReadVirtualMemory(HANDLE ProcessHandle, PVOID BaseAddress, PVOID Buffer, SIZE_T BufferSize, PSIZE_T NumberOfBytesRead) {
|
|
orgNtReadVirtualMemory pNtReadVirtualMemory = (orgNtReadVirtualMemory)RetrieveSyscallAddress("NtReadVirtualMemory");
|
|
if (pNtReadVirtualMemory == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtReadVirtualMemory\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtReadVirtualMemory\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtReadVirtualMemory");
|
|
SetHwBp((ULONG_PTR)pNtReadVirtualMemory, TRUE, ssn);
|
|
return pNtReadVirtualMemory(ProcessHandle, BaseAddress, Buffer, BufferSize, NumberOfBytesRead);
|
|
}
|
|
|
|
ULONG wrpNtWriteVirtualMemory(HANDLE ProcessHandle, PVOID BaseAddress, PVOID Buffer, SIZE_T NumberOfBytesToWrite, PSIZE_T NumberOfBytesWritten) {
|
|
orgNtWriteVirtualMemory pNtWriteVirtualMemory = (orgNtWriteVirtualMemory)RetrieveSyscallAddress("NtWriteVirtualMemory");
|
|
if (pNtWriteVirtualMemory == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtWriteVirtualMemory\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtWriteVirtualMemory\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtWriteVirtualMemory");
|
|
SetHwBp((ULONG_PTR)pNtWriteVirtualMemory, TRUE, ssn);
|
|
return pNtWriteVirtualMemory(ProcessHandle, BaseAddress, Buffer, NumberOfBytesToWrite, NumberOfBytesWritten);
|
|
}
|
|
|
|
ULONG wrpNtAllocateVirtualMemory(HANDLE ProcessHandle, PVOID* BaseAddress, ULONG ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect) {
|
|
orgNtAllocateVirtualMemory pNtAllocateVirtualMemory = (orgNtAllocateVirtualMemory)RetrieveSyscallAddress("NtAllocateVirtualMemory");
|
|
if (pNtAllocateVirtualMemory == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtAllocateVirtualMemory\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtAllocateVirtualMemory\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtAllocateVirtualMemory");
|
|
SetHwBp((ULONG_PTR)pNtAllocateVirtualMemory, TRUE, ssn);
|
|
return pNtAllocateVirtualMemory(ProcessHandle, BaseAddress, ZeroBits, RegionSize, AllocationType, Protect);
|
|
}
|
|
|
|
ULONG wrpNtProtectVirtualMemory(HANDLE ProcessHandle, PVOID* BaseAddress, PSIZE_T RegionSize, ULONG NewProtect, PULONG OldProtect) {
|
|
orgNtProtectVirtualMemory pNtProtectVirtualMemory = (orgNtProtectVirtualMemory)RetrieveSyscallAddress("NtProtectVirtualMemory");
|
|
if (pNtProtectVirtualMemory == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtProtectVirtualMemory\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtProtectVirtualMemory\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtProtectVirtualMemory");
|
|
SetHwBp((ULONG_PTR)pNtProtectVirtualMemory, TRUE, ssn);
|
|
return pNtProtectVirtualMemory(ProcessHandle, BaseAddress, RegionSize, NewProtect, OldProtect);
|
|
}
|
|
|
|
ULONG wrpNtFreeVirtualMemory(HANDLE ProcessHandle, PVOID* BaseAddress, PSIZE_T RegionSize, ULONG FreeType) {
|
|
orgNtFreeVirtualMemory pNtFreeVirtualMemory = (orgNtFreeVirtualMemory)RetrieveSyscallAddress("NtFreeVirtualMemory");
|
|
if (pNtFreeVirtualMemory == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtFreeVirtualMemory\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtFreeVirtualMemory\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtFreeVirtualMemory");
|
|
SetHwBp((ULONG_PTR)pNtFreeVirtualMemory, TRUE, ssn);
|
|
return pNtFreeVirtualMemory(ProcessHandle, BaseAddress, RegionSize, FreeType);
|
|
}
|
|
|
|
ULONG wrpNtQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength) {
|
|
orgNtQuerySystemInformation pNtQuerySystemInformation = (orgNtQuerySystemInformation)RetrieveSyscallAddress("NtQuerySystemInformation");
|
|
if (pNtQuerySystemInformation == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtQuerySystemInformation\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtQuerySystemInformation\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtQuerySystemInformation");
|
|
SetHwBp((ULONG_PTR)pNtQuerySystemInformation, TRUE, ssn);
|
|
return pNtQuerySystemInformation(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength);
|
|
}
|
|
|
|
ULONG wrpNtQueryDirectoryFile(HANDLE FileHandle, HANDLE Event, PIO_APC_ROUTINE ApcRoutine, PVOID ApcContext, PIO_STATUS_BLOCK IoStatusBlock, PVOID FileInformation, ULONG Length, FILE_INFORMATION_CLASS FileInformationClass, BOOLEAN ReturnSingleEntry, PUNICODE_STRING FileName, BOOLEAN RestartScan) {
|
|
orgNtQueryDirectoryFile pNtQueryDirectoryFile = (orgNtQueryDirectoryFile)RetrieveSyscallAddress("NtQueryDirectoryFile");
|
|
if (pNtQueryDirectoryFile == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtQueryDirectoryFile\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtQueryDirectoryFile\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtQueryDirectoryFile");
|
|
SetHwBp((ULONG_PTR)pNtQueryDirectoryFile, TRUE, ssn);
|
|
return pNtQueryDirectoryFile(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, FileInformation, Length, FileInformationClass, ReturnSingleEntry, FileName, RestartScan);
|
|
}
|
|
|
|
ULONG wrpNtQueryInformationFile(HANDLE FileHandle, PIO_STATUS_BLOCK IoStatusBlock, PVOID FileInformation, ULONG Length, FILE_INFORMATION_CLASS FileInformationClass) {
|
|
orgNtQueryInformationFile pNtQueryInformationFile = (orgNtQueryInformationFile)RetrieveSyscallAddress("NtQueryInformationFile");
|
|
if (pNtQueryInformationFile == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtQueryInformationFile\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtQueryInformationFile\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtQueryInformationFile");
|
|
SetHwBp((ULONG_PTR)pNtQueryInformationFile, TRUE, ssn);
|
|
return pNtQueryInformationFile(FileHandle, IoStatusBlock, FileInformation, Length, FileInformationClass);
|
|
}
|
|
|
|
ULONG wrpNtQueryInformationProcess(HANDLE ProcessHandle, PROCESSINFOCLASS ProcessInformationClass, PVOID ProcessInformation, ULONG ProcessInformationLength, PULONG ReturnLength) {
|
|
orgNtQueryInformationProcess pNtQueryInformationProcess = (orgNtQueryInformationProcess)RetrieveSyscallAddress("NtQueryInformationProcess");
|
|
if (pNtQueryInformationProcess == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtQueryInformationProcess\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtQueryInformationProcess\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtQueryInformationProcess");
|
|
SetHwBp((ULONG_PTR)pNtQueryInformationProcess, TRUE, ssn);
|
|
return pNtQueryInformationProcess(ProcessHandle, ProcessInformationClass, ProcessInformation, ProcessInformationLength, ReturnLength);
|
|
}
|
|
|
|
ULONG wrpNtQueryInformationThread(HANDLE ThreadHandle, THREADINFOCLASS ThreadInformationClass, PVOID ThreadInformation, ULONG ThreadInformationLength, PULONG ReturnLength) {
|
|
orgNtQueryInformationThread pNtQueryInformationThread = (orgNtQueryInformationThread)RetrieveSyscallAddress("NtQueryInformationThread");
|
|
if (pNtQueryInformationThread == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtQueryInformationThread\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtQueryInformationThread\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtQueryInformationThread");
|
|
SetHwBp((ULONG_PTR)pNtQueryInformationThread, TRUE, ssn);
|
|
return pNtQueryInformationThread(ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength, ReturnLength);
|
|
}
|
|
|
|
ULONG wrpNtCreateSection(PHANDLE SectionHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PLARGE_INTEGER MaximumSize, ULONG SectionPageProtection, ULONG AllocationAttributes, HANDLE FileHandle) {
|
|
orgNtCreateSection pNtCreateSection = (orgNtCreateSection)RetrieveSyscallAddress("NtCreateSection");
|
|
if (pNtCreateSection == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtCreateSection\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtCreateSection\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtCreateSection");
|
|
SetHwBp((ULONG_PTR)pNtCreateSection, TRUE, ssn);
|
|
return pNtCreateSection(SectionHandle, DesiredAccess, ObjectAttributes, MaximumSize, SectionPageProtection, AllocationAttributes, FileHandle);
|
|
}
|
|
|
|
ULONG wrpNtOpenSection(PHANDLE SectionHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes) {
|
|
orgNtOpenSection pNtOpenSection = (orgNtOpenSection)RetrieveSyscallAddress("NtOpenSection");
|
|
if (pNtOpenSection == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtOpenSection\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtOpenSection\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtOpenSection");
|
|
SetHwBp((ULONG_PTR)pNtOpenSection, TRUE, ssn);
|
|
return pNtOpenSection(SectionHandle, DesiredAccess, ObjectAttributes);
|
|
}
|
|
|
|
ULONG wrpNtMapViewOfSection(HANDLE SectionHandle, HANDLE ProcessHandle, PVOID BaseAddress, ULONG ZeroBits, SIZE_T CommitSize, PLARGE_INTEGER SectionOffset, PSIZE_T ViewSize, SECTION_INHERIT InheritDisposition, ULONG AllocationType, ULONG Win32Protect) {
|
|
orgNtMapViewOfSection pNtMapViewOfSection = (orgNtMapViewOfSection)RetrieveSyscallAddress("NtMapViewOfSection");
|
|
if (pNtMapViewOfSection == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtMapViewOfSection\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtMapViewOfSection\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtMapViewOfSection");
|
|
SetHwBp((ULONG_PTR)pNtMapViewOfSection, TRUE, ssn);
|
|
return pNtMapViewOfSection(SectionHandle, ProcessHandle, BaseAddress, ZeroBits, CommitSize, SectionOffset, ViewSize, InheritDisposition, AllocationType, Win32Protect);
|
|
}
|
|
|
|
ULONG wrpNtUnmapViewOfSection(HANDLE ProcessHandle, PVOID BaseAddress) {
|
|
orgNtUnmapViewOfSection pNtUnmapViewOfSection = (orgNtUnmapViewOfSection)RetrieveSyscallAddress("NtUnmapViewOfSection");
|
|
if (pNtUnmapViewOfSection == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtUnmapViewOfSection\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtUnmapViewOfSection\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtUnmapViewOfSection");
|
|
SetHwBp((ULONG_PTR)pNtUnmapViewOfSection, TRUE, ssn);
|
|
return pNtUnmapViewOfSection(ProcessHandle, BaseAddress);
|
|
}
|
|
|
|
ULONG wrpNtAdjustPrivilegesToken(HANDLE TokenHandle, BOOLEAN DisableAllPrivileges, PTOKEN_PRIVILEGES NewState, ULONG BufferLength, PTOKEN_PRIVILEGES PreviousState, PULONG ReturnLength) {
|
|
orgNtAdjustPrivilegesToken pNtAdjustPrivilegesToken = (orgNtAdjustPrivilegesToken)RetrieveSyscallAddress("NtAdjustPrivilegesToken");
|
|
if (pNtAdjustPrivilegesToken == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtAdjustPrivilegesToken\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtAdjustPrivilegesToken\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtAdjustPrivilegesToken");
|
|
SetHwBp((ULONG_PTR)pNtAdjustPrivilegesToken, TRUE, ssn);
|
|
return pNtAdjustPrivilegesToken(TokenHandle, DisableAllPrivileges, NewState, BufferLength, PreviousState, ReturnLength);
|
|
}
|
|
|
|
ULONG wrpNtDeviceIoControlFile(HANDLE FileHandle, HANDLE Event, PIO_APC_ROUTINE ApcRoutine, PVOID ApcContext, PIO_STATUS_BLOCK IoStatusBlock, ULONG IoControlCode, PVOID InputBuffer, ULONG InputBufferLength, PVOID OutputBuffer, ULONG OutputBufferLength) {
|
|
orgNtDeviceIoControlFile pNtDeviceIoControlFile = (orgNtDeviceIoControlFile)RetrieveSyscallAddress("NtDeviceIoControlFile");
|
|
if (pNtDeviceIoControlFile == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtDeviceIoControlFile\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtDeviceIoControlFile\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtDeviceIoControlFile");
|
|
SetHwBp((ULONG_PTR)pNtDeviceIoControlFile, TRUE, ssn);
|
|
return pNtDeviceIoControlFile(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, IoControlCode, InputBuffer, InputBufferLength, OutputBuffer, OutputBufferLength);
|
|
}
|
|
|
|
ULONG wrpNtQueueApcThread(HANDLE ThreadHandle, PVOID ApcRoutine, PVOID ApcArgument1, PVOID ApcArgument2, PVOID ApcArgument3) {
|
|
orgNtQueueApcThread pNtQueueApcThread = (orgNtQueueApcThread)RetrieveSyscallAddress("NtQueueApcThread");
|
|
if (pNtQueueApcThread == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtQueueApcThread\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtQueueApcThread\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtQueueApcThread");
|
|
SetHwBp((ULONG_PTR)pNtQueueApcThread, TRUE, ssn);
|
|
return pNtQueueApcThread(ThreadHandle, ApcRoutine, ApcArgument1, ApcArgument2, ApcArgument3);
|
|
}
|
|
|
|
ULONG wrpNtWaitForMultipleObjects(ULONG Count, PHANDLE Handles, WAIT_TYPE WaitType, BOOLEAN Alertable, PLARGE_INTEGER Timeout) {
|
|
orgNtWaitForMultipleObjects pNtWaitForMultipleObjects = (orgNtWaitForMultipleObjects)RetrieveSyscallAddress("NtWaitForMultipleObjects");
|
|
if (pNtWaitForMultipleObjects == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtWaitForMultipleObjects\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtWaitForMultipleObjects\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtWaitForMultipleObjects");
|
|
SetHwBp((ULONG_PTR)pNtWaitForMultipleObjects, TRUE, ssn);
|
|
return pNtWaitForMultipleObjects(Count, Handles, WaitType, Alertable, Timeout);
|
|
}
|
|
|
|
ULONG wrpNtCreateUserProcess(PHANDLE ProcessHandle, PHANDLE ThreadHandle, ACCESS_MASK ProcessDesiredAccess, ACCESS_MASK ThreadDesiredAccess, POBJECT_ATTRIBUTES ProcessObjectAttributes, POBJECT_ATTRIBUTES ThreadObjectAttributes, ULONG ProcessFlags, ULONG ThreadFlags, PRTL_USER_PROCESS_PARAMETERS ProcessParameters, PPS_CREATE_INFO CreateInfo, PPS_ATTRIBUTE_LIST AttributeList) {
|
|
orgNtCreateUserProcess pNtCreateUserProcess = (orgNtCreateUserProcess)RetrieveSyscallAddress("NtCreateUserProcess");
|
|
if (pNtCreateUserProcess == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtCreateUserProcess\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtCreateUserProcess\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtCreateUserProcess");
|
|
SetHwBp((ULONG_PTR)pNtCreateUserProcess, TRUE, ssn);
|
|
return pNtCreateUserProcess(ProcessHandle, ThreadHandle, ProcessDesiredAccess, ThreadDesiredAccess, ProcessObjectAttributes, ThreadObjectAttributes, ProcessFlags, ThreadFlags, ProcessParameters, CreateInfo, AttributeList);
|
|
}
|
|
|
|
ULONG wrpNtAlertResumeThread(HANDLE ThreadHandle, PULONG PreviousSuspendCount) {
|
|
orgNtAlertResumeThread pNtAlertResumeThread = (orgNtAlertResumeThread)RetrieveSyscallAddress("NtAlertResumeThread");
|
|
if (pNtAlertResumeThread == NULL) {
|
|
printf("[!] Unable to resolve ntdll.dll!NtAlertResumeThread\n");
|
|
return -1;
|
|
}
|
|
printf("[*] Calling function ntdll.dll!NtAlertResumeThread\n");
|
|
int ssn = GetSsnByName((PCHAR)"NtAlertResumeThread");
|
|
SetHwBp((ULONG_PTR)pNtAlertResumeThread, TRUE, ssn);
|
|
return pNtAlertResumeThread(ThreadHandle, PreviousSuspendCount);
|
|
}
|