mirror of
https://github.com/thomasxm/BOAZ_beta
synced 2026-06-06 16:54:29 +00:00
thomasxm
105 lines
2.4 KiB
C
105 lines
2.4 KiB
C
#pragma once
|
|
#include <windows.h>
|
|
#include <inttypes.h>
|
|
#include <stdio.h>
|
|
|
|
#pragma region Defines
|
|
|
|
#define DBG_MODE 1 // 0 disable, 1 enable
|
|
#define UP -32
|
|
#define DN 32
|
|
#define ARG_LEN 8
|
|
#define ARG_RSP_OFF 0x28
|
|
#define X64_PEB_OFF 0x60
|
|
|
|
#pragma endregion
|
|
|
|
#pragma region Macros
|
|
|
|
#if DBG_MODE == 0
|
|
#define DPNT(...) do {} while (0)
|
|
#else
|
|
#define DPNT(...) do { printf(__VA_ARGS__); } while (0)
|
|
#endif
|
|
|
|
#pragma endregion
|
|
|
|
#pragma region Type Definitions
|
|
|
|
typedef struct _UNICODE_STRING {
|
|
USHORT Length;
|
|
USHORT MaximumLength;
|
|
PWSTR Buffer;
|
|
} UNICODE_STRING, *PUNICODE_STRING;
|
|
|
|
typedef struct _RTL_USER_PROCESS_PARAMETERS {
|
|
BYTE Reserved1[16];
|
|
PVOID Reserved2[10];
|
|
UNICODE_STRING ImagePathName;
|
|
UNICODE_STRING CommandLine;
|
|
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;
|
|
|
|
typedef struct _PEB_LDR_DATA {
|
|
BYTE Reserved1[8];
|
|
PVOID Reserved2[3];
|
|
LIST_ENTRY InMemoryOrderModuleList;
|
|
} PEB_LDR_DATA, *PPEB_LDR_DATA;
|
|
|
|
typedef struct _LDR_DATA_TABLE_ENTRY {
|
|
PVOID Reserved1[2];
|
|
LIST_ENTRY InMemoryOrderLinks;
|
|
PVOID Reserved2[2];
|
|
PVOID DllBase;
|
|
PVOID EntryPoint;
|
|
PVOID Reserved3;
|
|
UNICODE_STRING FullDllName;
|
|
BYTE Reserved4[8];
|
|
PVOID Reserved5[3];
|
|
union {
|
|
ULONG CheckSum;
|
|
PVOID Reserved6;
|
|
};
|
|
ULONG TimeDateStamp;
|
|
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
|
|
|
|
typedef struct _PEB {
|
|
BYTE Reserved1[2];
|
|
BYTE BeingDebugged;
|
|
BYTE Reserved2[21];
|
|
PPEB_LDR_DATA LoaderData;
|
|
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
|
|
BYTE Reserved3[520];
|
|
PVOID PostProcessInitRoutine;
|
|
BYTE Reserved4[136];
|
|
ULONG SessionId;
|
|
} PEB, *PPEB;
|
|
|
|
typedef BOOL(WINAPI* GtThrdCtxt_t)(
|
|
_In_ HANDLE hThread,
|
|
_Inout_ LPCONTEXT lpContext
|
|
);
|
|
|
|
typedef BOOL(WINAPI* StThrdCtxt_t)(
|
|
_In_ HANDLE hThread,
|
|
_In_ CONST CONTEXT* lpContext
|
|
);
|
|
|
|
#pragma endregion
|
|
|
|
#pragma region Function Declarations
|
|
|
|
BOOL CmprMsk(const BYTE* dt, const BYTE* msk, const char* szMsk);
|
|
DWORD_PTR FndPtrn(DWORD_PTR dAddr, DWORD dLen, PBYTE msk, PCHAR szMsk);
|
|
DWORD_PTR FndInMdl(LPCSTR mdlName, PBYTE msk, PCHAR szMsk);
|
|
UINT64 GtMdlAddr(LPWSTR sModuleName);
|
|
UINT64 GtSymbAddr(UINT64 mdlBase, const char* fncName);
|
|
UINT64 PrprSyscl(char* fncName);
|
|
bool StMainBP();
|
|
DWORD64 FndSysclNum(DWORD64 fncAddr);
|
|
DWORD64 FndSysclRtnAddr(DWORD64 fncAddr, WORD sysclNum);
|
|
LONG HWScExHndlr(EXCEPTION_POINTERS* ExInfo);
|
|
bool OpnRICls();
|
|
bool ClsRICls();
|
|
|
|
#pragma endregion
|