admin/trustedsec-COFFLoader
1
0
Fork 0
mirror of https://github.com/trustedsec/COFFLoader synced 2026-06-08 17:55:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3 from trustedsec/internal_functions

Browse Source 
Compatibility update
This commit is contained in:
kev169
2022-05-20 10:40:45 -05:00
committed by GitHub
parent e83c8892c9 eb4057570b
commit 540970ae55
3 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
COFFLoader.c
+5 -2
View File
@@ -118,13 +118,15 @@ void* process_symbol(char* symbolstring) {
#endif
memcpy(localcopy, symbolstring, strlen(symbolstring));
if (strncmp(symbolstring, PREPENDSYMBOLVALUE"Beacon", strlen(PREPENDSYMBOLVALUE"Beacon")) == 0 || strncmp(symbolstring, PREPENDSYMBOLVALUE"toWideChar", strlen(PREPENDSYMBOLVALUE"toWideChar")) == 0) {
if (strncmp(symbolstring, PREPENDSYMBOLVALUE"Beacon", strlen(PREPENDSYMBOLVALUE"Beacon")) == 0 || strncmp(symbolstring, PREPENDSYMBOLVALUE"toWideChar", strlen(PREPENDSYMBOLVALUE"toWideChar")) == 0 ||
strncmp(symbolstring, PREPENDSYMBOLVALUE"GetProcAddress", strlen(PREPENDSYMBOLVALUE"GetProcAddress")) == 0 || strncmp(symbolstring, PREPENDSYMBOLVALUE"LoadLibraryA", strlen(PREPENDSYMBOLVALUE"LoadLibraryA")) == 0 ||
strncmp(symbolstring, PREPENDSYMBOLVALUE"GetModuleHandle", strlen(PREPENDSYMBOLVALUE"GetModuleHandle")) == 0 || strncmp(symbolstring, PREPENDSYMBOLVALUE"FreeLibrary", strlen(PREPENDSYMBOLVALUE"FreeLibrary")) == 0) {
localfunc = symbolstring + strlen(PREPENDSYMBOLVALUE);
DEBUG_PRINT("\t\tInternalFunction: %s\n", localfunc);
/* TODO: Get internal symbol here and set to functionaddress, then
* return the pointer to the internal function*/
#if defined(_WIN32)
for (tempcounter = 0; tempcounter < 25; tempcounter++) {
for (tempcounter = 0; tempcounter < 29; tempcounter++) {
if (InternalFunctions[tempcounter][0] != NULL) {
if (strcmp(localfunc, (char*)(InternalFunctions[tempcounter][0])) == 0) {
functionaddress = (void*)InternalFunctions[tempcounter][1];
@@ -464,6 +466,7 @@ int main(int argc, char* argv[]) {
printf("Ran/parsed the coff\n");
outdata = BeaconGetOutputData(&outdataSize);
if (outdata != NULL) {
printf("Outdata Below:\n\n%s\n", outdata);
}
#endif
beacon_compatibility.c
+7 -3
View File
@@ -26,7 +26,7 @@
/* Data Parsing */
unsigned char* InternalFunctions[25][2] = {
unsigned char* InternalFunctions[29][2] = {
{(unsigned char*)"BeaconDataParse", (unsigned char*)BeaconDataParse},
{(unsigned char*)"BeaconDataInt", (unsigned char*)BeaconDataInt},
{(unsigned char*)"BeaconDataShort", (unsigned char*)BeaconDataShort},
@@ -49,7 +49,11 @@ unsigned char* InternalFunctions[25][2] = {
{(unsigned char*)"BeaconInjectProcess", (unsigned char*)BeaconInjectProcess},
{(unsigned char*)"BeaconInjectTemporaryProcess", (unsigned char*)BeaconInjectTemporaryProcess},
{(unsigned char*)"BeaconCleanupProcess", (unsigned char*)BeaconCleanupProcess},
{(unsigned char*)"toWideChar", (unsigned char*)toWideChar}
{(unsigned char*)"toWideChar", (unsigned char*)toWideChar},
{(unsigned char*)"LoadLibraryA", (unsigned char*)LoadLibraryA},
{(unsigned char*)"GetProcAddress", (unsigned char*)GetProcAddress},
{(unsigned char*)"GetModuleHandle", (unsigned char*)GetModuleHandleA},
{(unsigned char*)"FreeLibrary", (unsigned char*)FreeLibrary}
};
uint32_t swap_endianess(uint32_t indata) {
@@ -230,7 +234,7 @@ void BeaconPrintf(int type, char* fmt, ...) {
beacon_compatibility_output = tempptr;
memset(beacon_compatibility_output + beacon_compatibility_offset, 0, length + 1);
va_start(args, fmt);
length = vsnprintf(beacon_compatibility_output + beacon_compatibility_offset, length, fmt, args);
length = vsnprintf(beacon_compatibility_output + beacon_compatibility_offset, length +1, fmt, args);
beacon_compatibility_size += length;
beacon_compatibility_offset += length;
va_end(args);
beacon_compatibility.h
+1 -1
View File
@@ -8,7 +8,7 @@
*/
#ifndef BEACON_COMPATIBILITY_H_
/* Structures as is in beacon.h */
extern unsigned char* InternalFunctions[25][2];
extern unsigned char* InternalFunctions[29][2];
typedef struct {
char * original; /* the original buffer [so we can free it] */
char * buffer; /* current pointer into our buffer */