From cf0c3cc1c25ab64c56288028c047c71f54a70f7a Mon Sep 17 00:00:00 2001 From: vxunderground <57078196+vxunderground@users.noreply.github.com> Date: Sat, 10 Sep 2022 18:40:21 -0500 Subject: [PATCH] Updates CreateMd5HashFromFilePath --- VX-API/ByteArrayToCharArray.cpp | 17 ++++ VX-API/CreateMd5HashFromFilePath.cpp | 130 +++++++++++++++++++++++++++ VX-API/Main.cpp | 5 +- VX-API/StringManipulation.h | 4 +- VX-API/VX-API.vcxproj | 2 + VX-API/VX-API.vcxproj.filters | 6 ++ VX-API/Win32Helper.h | 2 + 7 files changed, 164 insertions(+), 2 deletions(-) create mode 100644 VX-API/ByteArrayToCharArray.cpp create mode 100644 VX-API/CreateMd5HashFromFilePath.cpp diff --git a/VX-API/ByteArrayToCharArray.cpp b/VX-API/ByteArrayToCharArray.cpp new file mode 100644 index 0000000..e24946c --- /dev/null +++ b/VX-API/ByteArrayToCharArray.cpp @@ -0,0 +1,17 @@ +#include "StringManipulation.h" + +VOID ByteArrayToCharArrayA(PCHAR Destination, PBYTE Source, DWORD Length) +{ + for (DWORD dwX = 0; dwX < Length; dwX++) + { + Destination[dwX] = (BYTE)Source[dwX]; + } +} + +VOID ByteArrayToCharArrayW(PWCHAR Destination, PBYTE Source, DWORD Length) +{ + for (DWORD dwX = 0; dwX < Length; dwX++) + { + Destination[dwX] = (BYTE)Source[dwX]; + } +} \ No newline at end of file diff --git a/VX-API/CreateMd5HashFromFilePath.cpp b/VX-API/CreateMd5HashFromFilePath.cpp new file mode 100644 index 0000000..02fda11 --- /dev/null +++ b/VX-API/CreateMd5HashFromFilePath.cpp @@ -0,0 +1,130 @@ +#include "Win32Helper.h" +#include + +BOOL CreateMd5HashFromFilePathW(_In_ PWCHAR FilePath, _Inout_ PWCHAR Md5Hash) +{ + HANDLE hHandle = INVALID_HANDLE_VALUE; + HCRYPTPROV hProvider = NULL; + HCRYPTHASH hHash = NULL; + BYTE FileBuffer[1024] = { 0 }; + BYTE Md5HashBuffer[32] = { 0 }; + DWORD dwRead = 0; + BOOL bFlag = FALSE; + DWORD dwHashData = 16; + CHAR Md5Digits[] = "0123456789abcdef"; + CHAR Md5CharBufferTemp[32] = { 0 }; + + if (!IsPathValidW(FilePath)) + return FALSE; + + hHandle = CreateFileW(FilePath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_FLAG_SEQUENTIAL_SCAN, NULL); + if (hHandle == INVALID_HANDLE_VALUE) + return FALSE; + + if (!CryptAcquireContextW(&hProvider, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT)) + goto EXIT_ROUTINE; + + if (!CryptCreateHash(hProvider, CALG_MD5, 0, 0, &hHash)) + goto EXIT_ROUTINE; + + while (ReadFile(hHandle, FileBuffer, 1024, &dwRead, NULL)) + { + if (dwRead == 0) + break; + + if (!CryptHashData(hHash, FileBuffer, dwRead, 0)) + goto EXIT_ROUTINE; + } + + if (!CryptGetHashParam(hHash, HP_HASHVAL, Md5HashBuffer, &dwHashData, 0)) + goto EXIT_ROUTINE; + + for (DWORD dwX = 0, dwOffset = 0; dwX < dwHashData; dwX++) + { + Md5CharBufferTemp[dwOffset] = Md5Digits[Md5HashBuffer[dwX] >> 4]; + dwOffset++; + Md5CharBufferTemp[dwOffset] = Md5Digits[Md5HashBuffer[dwX] & 0xf]; + dwOffset++; + } + + CharStringToWCharString(Md5Hash, Md5CharBufferTemp, 32); + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (hProvider) + CryptReleaseContext(hProvider, 0); + + if (hHash) + CryptDestroyHash(hHash); + + if (hHandle) + CloseHandle(hHandle); + + return bFlag; +} + +BOOL CreateMd5HashFromFilePathA(_In_ PCHAR FilePath, _Inout_ PCHAR Md5Hash) +{ + HANDLE hHandle = INVALID_HANDLE_VALUE; + HCRYPTPROV hProvider = NULL; + HCRYPTHASH hHash = NULL; + BYTE FileBuffer[1024] = { 0 }; + BYTE Md5HashBuffer[32] = { 0 }; + DWORD dwRead = 0; + BOOL bFlag = FALSE; + DWORD dwHashData = 16; + CHAR Md5Digits[] = "0123456789abcdef"; + CHAR Md5CharBufferTemp[32] = { 0 }; + + if (!IsPathValidA(FilePath)) + return FALSE; + + hHandle = CreateFileA(FilePath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_FLAG_SEQUENTIAL_SCAN, NULL); + if (hHandle == INVALID_HANDLE_VALUE) + return FALSE; + + if (!CryptAcquireContextA(&hProvider, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT)) + goto EXIT_ROUTINE; + + if (!CryptCreateHash(hProvider, CALG_MD5, 0, 0, &hHash)) + goto EXIT_ROUTINE; + + while (ReadFile(hHandle, FileBuffer, 1024, &dwRead, NULL)) + { + if (dwRead == 0) + break; + + if (!CryptHashData(hHash, FileBuffer, dwRead, 0)) + goto EXIT_ROUTINE; + } + + if (!CryptGetHashParam(hHash, HP_HASHVAL, Md5HashBuffer, &dwHashData, 0)) + goto EXIT_ROUTINE; + + for (DWORD dwX = 0, dwOffset = 0; dwX < dwHashData; dwX++) + { + Md5CharBufferTemp[dwOffset] = Md5Digits[Md5HashBuffer[dwX] >> 4]; + dwOffset++; + Md5CharBufferTemp[dwOffset] = Md5Digits[Md5HashBuffer[dwX] & 0xf]; + dwOffset++; + } + + StringCopyA(Md5Hash, Md5CharBufferTemp); + + bFlag = TRUE; + +EXIT_ROUTINE: + + if (hProvider) + CryptReleaseContext(hProvider, 0); + + if (hHash) + CryptDestroyHash(hHash); + + if (hHandle) + CloseHandle(hHandle); + + return bFlag; +} \ No newline at end of file diff --git a/VX-API/Main.cpp b/VX-API/Main.cpp index a6806d4..6dbe490 100644 --- a/VX-API/Main.cpp +++ b/VX-API/Main.cpp @@ -2,6 +2,8 @@ #include "Internal.h" #include "StringManipulation.h" #include "Win32Helper.h" +#include + /* TODO: @@ -15,4 +17,5 @@ int main(VOID) { DWORD dwError = ERROR_SUCCESS; return ERROR_SUCCESS; -} \ No newline at end of file +} + diff --git a/VX-API/StringManipulation.h b/VX-API/StringManipulation.h index 5dc1b69..2a68fa7 100644 --- a/VX-API/StringManipulation.h +++ b/VX-API/StringManipulation.h @@ -30,4 +30,6 @@ VOID CharArrayToByteArrayW(PWCHAR Char, PBYTE Byte, DWORD Length); VOID RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString); VOID RtlInitEmptyUnicodeString(PUNICODE_STRING UnicodeString, PWCHAR Buffer, USHORT BufferSize); SIZE_T CharStringToWCharString(PWCHAR Destination, PCHAR Source, SIZE_T MaximumAllowed); -SIZE_T WCharStringToCharString(PCHAR Destination, PWCHAR Source, SIZE_T MaximumAllowed); \ No newline at end of file +SIZE_T WCharStringToCharString(PCHAR Destination, PWCHAR Source, SIZE_T MaximumAllowed); +VOID ByteArrayToCharArrayA(PCHAR Destination, PBYTE Source, DWORD Length); +VOID ByteArrayToCharArrayW(PWCHAR Destination, PBYTE Source, DWORD Length); \ No newline at end of file diff --git a/VX-API/VX-API.vcxproj b/VX-API/VX-API.vcxproj index 1d7c741..c4fd3ff 100644 --- a/VX-API/VX-API.vcxproj +++ b/VX-API/VX-API.vcxproj @@ -130,6 +130,7 @@ + @@ -137,6 +138,7 @@ + diff --git a/VX-API/VX-API.vcxproj.filters b/VX-API/VX-API.vcxproj.filters index 201754b..800c3c4 100644 --- a/VX-API/VX-API.vcxproj.filters +++ b/VX-API/VX-API.vcxproj.filters @@ -324,6 +324,12 @@ Source Files\Windows API Helper Functions\Evasion + + Source Files\String Manipulation + + + Source Files\Windows API Helper Functions\Cryptography Related + diff --git a/VX-API/Win32Helper.h b/VX-API/Win32Helper.h index 186e803..84e5668 100644 --- a/VX-API/Win32Helper.h +++ b/VX-API/Win32Helper.h @@ -38,6 +38,8 @@ PWCHAR CreatePseudoRandomStringW(SIZE_T dwLength, ULONG Seed); PCHAR CreatePseudoRandomStringA(SIZE_T dwLength, ULONG Seed); BOOL HashFileByMsiFileHashTableW(PWCHAR Path, PULONG FileHash); BOOL HashFileByMsiFileHashTableA(PCHAR Path, PULONG FileHash); +BOOL CreateMd5HashFromFilePathW(_In_ PWCHAR FilePath, _Inout_ PWCHAR Md5Hash); +BOOL CreateMd5HashFromFilePathA(_In_ PCHAR FilePath, _Inout_ PCHAR Md5Hash); //library loading PTEB GetTeb(VOID);