general enhancements

VX-API/AdfOpenProcessOnCsrss.cpp

@@ -7,7 +7,7 @@ BOOL AdfOpenProcessOnCsrss(VOID)
 	CSRGETPROCESSID CsrGetProcessId = NULL;
 	HANDLE hCsrHandle = NULL;
 
-	hNtdll = GetModuleHandleExW(L"ntdll.dll");
+	hNtdll = GetModuleHandleEx2W(L"ntdll.dll");
 	if (hNtdll == NULL)
 		return FALSE;
 

VX-API/CheckRemoteDebuggerPresentEx.cpp

@@ -20,7 +20,7 @@ BOOL CheckRemoteDebuggerPresentEx(HANDLE hHandle, PBOOL pbDebuggerPresent)
 	if (hHandle == NULL)
 		return FALSE;
 
-	HMODULE hModule = GetModuleHandleExW(L"ntdll.dll");
+	HMODULE hModule = GetModuleHandleEx2W(L"ntdll.dll");
 	if (hModule == NULL)
 		return FALSE;
 

VX-API/CreateProcessFromShellExecuteInExplorerProcess.cpp

@@ -3,8 +3,6 @@
 #include <shlwapi.h>
 #include <shlobj.h>
 
-#pragma comment(lib, "shlwapi.lib")
-
 HRESULT UnusedSubroutineGetShellDispatchFromView(IShellView* ShellView, REFIID Riid, PVOID* Dispatch2)
 {
 	HRESULT Result = S_OK;
@@ -49,6 +47,9 @@ EXIT_ROUTINE:
 
 HRESULT UnusedSubroutineGetShellViewForDesktop(REFIID Riid, PVOID* ShellView)
 {
+	typedef HRESULT(WINAPI* IUNKNOWN_QUERYSERVICE)(IUnknown*, REFGUID, REFIID, PVOID*);
+	IUNKNOWN_QUERYSERVICE QueryServiceUsingIUnknown = NULL;
+	HMODULE hModule = NULL;
 	HRESULT Result = S_OK;
 	IShellWindows* Windows = NULL;
 	HWND hWnd;
@@ -58,6 +59,14 @@ HRESULT UnusedSubroutineGetShellViewForDesktop(REFIID Riid, PVOID* ShellView)
 	IShellView* View = NULL;
 	*ShellView = NULL;
 
+	hModule = LoadLibraryW(L"Shlwapi.dll");
+	if (hModule == NULL)
+		return E_FAIL;
+
+	QueryServiceUsingIUnknown = (IUNKNOWN_QUERYSERVICE)GetProcAddressA((DWORD64)hModule, (PCHAR)"IUnknown_QueryService");
+	if(QueryServiceUsingIUnknown == NULL)
+		return E_FAIL;
+	
 	Result = CoCreateInstance(CLSID_ShellWindows, NULL, CLSCTX_LOCAL_SERVER, IID_PPV_ARGS(&Windows));
 	if (!SUCCEEDED(Result))
 		return Result;
@@ -66,7 +75,7 @@ HRESULT UnusedSubroutineGetShellViewForDesktop(REFIID Riid, PVOID* ShellView)
 	if (!SUCCEEDED(Result))
 		goto EXIT_ROUTINE;
 
-	Result = IUnknown_QueryService(Dispatch, SID_STopLevelBrowser, IID_PPV_ARGS(&Browser));
+	Result = QueryServiceUsingIUnknown(Dispatch, SID_STopLevelBrowser, IID_PPV_ARGS(&Browser));
 	if (!SUCCEEDED(Result))
 		goto EXIT_ROUTINE;
 
@@ -81,6 +90,9 @@ HRESULT UnusedSubroutineGetShellViewForDesktop(REFIID Riid, PVOID* ShellView)
 
 EXIT_ROUTINE:
 
+	if (hModule)
+		FreeLibrary(hModule);
+
 #pragma warning( push )
 #pragma warning( disable : 6001)
 	if (Windows)

VX-API/CreateProcessViaNtCreateUserProcess.cpp

@@ -174,7 +174,7 @@ DWORD CreateProcessViaNtCreateUserProcessA(PCHAR BinaryPath)
 	CreateInfo.Size = sizeof(CreateInfo);
 	CreateInfo.State = PsCreateInitialState;
 
-	hModule = GetModuleHandleExW(L"ntdll.dll");
+	hModule = GetModuleHandleEx2W(L"ntdll.dll");
 	if (hModule == NULL)
 		return GetLastErrorEx();
 
@@ -268,7 +268,7 @@ DWORD CreateProcessViaNtCreateUserProcessW(PWCHAR BinaryPath)
 	CreateInfo.Size = sizeof(CreateInfo);
 	CreateInfo.State = PsCreateInitialState;
 
-	hModule = GetModuleHandleExW(L"ntdll.dll");
+	hModule = GetModuleHandleEx2W(L"ntdll.dll");
 	if (hModule == NULL)
 		return GetLastErrorEx();
 

VX-API/GetModuleHandleEx.cpp

@@ -1,6 +1,6 @@
 #include "Win32Helper.h"
 
-HMODULE GetModuleHandleExA(LPCSTR lpModuleName)
+HMODULE GetModuleHandleEx2A(LPCSTR lpModuleName)
 {
 	PPEB Peb = GetPeb();
 	PLDR_MODULE Module = NULL;
@@ -24,7 +24,7 @@ HMODULE GetModuleHandleExA(LPCSTR lpModuleName)
 	return NULL;
 }
 
-HMODULE GetModuleHandleExW(LPCWSTR lpModuleName)
+HMODULE GetModuleHandleEx2W(LPCWSTR lpModuleName)
 {
 	PPEB Peb = GetPeb();
 	PLDR_MODULE Module = NULL;

VX-API/Main.cpp

@@ -7,16 +7,22 @@
 /*
 TODO:
 	- Ping with 'IcmpSendEcho2Ex'
+	- PID stuff: https://www.mdsec.co.uk/2022/08/fourteen-ways-to-read-the-pid-for-the-local-security-authority-subsystem-service-lsass/
+	- Run PE in memory https://papers.vx-underground.org/papers/Windows/Evasion%20-%20Systems%20Call%20and%20Memory%20Evasion/Executing%20a%20PE%20File%20in%20Memory.zip
+	- Download file options: https://www.x86matthew.com/view_post?id=ntsockets
+	- ???
+	- Profit!!!!11
 
 KNOWN ISSUES
-	- Dynamically resolve IUnknown_QueryService in UnusedSubroutineGetShellViewForDesktop in CreateProcessFromShellExecuteInExplorerProcess
+	- Implement RtlNtStatusToDosError
+	- Work on In / Out / Inout in function calls
+	- Various logic improvements
 */
 
 
-
 int main(VOID)
 {
 	DWORD dwError = ERROR_SUCCESS;
+	return dwError;
+}
 
-	return ERROR_SUCCESS;
-}

VX-API/MasqueradePebAsExplorerEx.cpp

@@ -14,7 +14,7 @@ BOOL MasqueradePebAsExplorerEx(VOID)
 
 	Module = (PLDR_MODULE)((PBYTE)Peb->LoaderData->InMemoryOrderModuleList.Flink - 16);
 
-	hModule = GetModuleHandleExW(L"ntdll.dll");
+	hModule = GetModuleHandleEx2W(L"ntdll.dll");
 	if (hModule == NULL)
 		return FALSE;
 

VX-API/RecursiveFindFile.cpp

@@ -90,7 +90,7 @@ BOOL RecursiveFindFileA(LPCSTR Path, LPCSTR Pattern)
 	BOOL bIsNewlyLoaded = FALSE;
 	BOOL bFlag = FALSE;
 
-	hShlwapi = GetModuleHandleExW(L"Shlwapi.dll");
+	hShlwapi = GetModuleHandleEx2W(L"Shlwapi.dll");
 	if (hShlwapi == NULL)
 	{
 		bIsNewlyLoaded = TRUE;
@@ -202,7 +202,7 @@ BOOL RecursiveFindFileW(LPCWSTR Path, LPCWSTR Pattern)
 	BOOL bIsNewlyLoaded = FALSE;
 	BOOL bFlag = FALSE;
 
-	hShlwapi = GetModuleHandleExW(L"Shlwapi.dll");
+	hShlwapi = GetModuleHandleEx2W(L"Shlwapi.dll");
 	if (hShlwapi == NULL)
 	{
 		bIsNewlyLoaded = TRUE;

VX-API/Win32Helper.h

@@ -58,8 +58,8 @@ DWORD64 __stdcall GetProcAddressUnknownGenericHash1(DWORD64 ModuleBase, DWORD64
 DWORD64 __stdcall GetProcAddressA(DWORD64 ModuleBase, LPCSTR lpProcName);
 DWORD64 __stdcall GetProcAddressW(DWORD64 ModuleBase, LPCWSTR lpProcName);
 BOOL RtlLoadPeHeaders(PIMAGE_DOS_HEADER* Dos, PIMAGE_NT_HEADERS* Nt, PIMAGE_FILE_HEADER* File, PIMAGE_OPTIONAL_HEADER* Optional, PBYTE* ImageBase);
-HMODULE GetModuleHandleExA(LPCSTR lpModuleName);
-HMODULE GetModuleHandleExW(LPCWSTR lpModuleName);
+HMODULE GetModuleHandleEx2A(LPCSTR lpModuleName);
+HMODULE GetModuleHandleEx2W(LPCWSTR lpModuleName);
 
 //helper functions
 BOOL IsPathValidA(PCHAR FilePath);