#pragma once #include "Internal.h" #include "StringManipulation.h" #include "FunctionDeclaration.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #pragma comment(lib, "Dnsapi.lib") #pragma comment(lib, "Iphlpapi.lib") #pragma comment(lib, "Crypt32.lib") #pragma comment(lib, "Dbghelp.lib") #pragma comment(lib, "Wtsapi32.lib") #pragma comment(lib, "Urlmon.lib") #pragma comment(lib, "PowrProf.lib") #pragma comment(lib, "Ws2_32.lib") #pragma comment(lib, "Imm32.lib") #pragma comment(lib, "Comctl32.lib") #pragma comment(lib, "Wevtapi.lib") #ifndef NT_SUCCESS #define NT_SUCCESS(x) ((x)>=0) #define STATUS_SUCCESS ((NTSTATUS)0) #endif #define Get16Bits(d) ((((UINT32)(((CONST UINT8*)(d))[1])) << 8) +(UINT32)(((CONST UINT8*)(d))[0])) #define InlineGetCurrentThread ((HANDLE)(LONG_PTR)-2) #define InlineGetCurrentProcess (HANDLE)((HANDLE)-1) /******************************************* RAD HARDWARE BREAKPOINT HOOKING ENGINE DATA *******************************************/ typedef struct __HARDWARE_ENGINE_INIT_SETTINGS_GLOBAL { PVOID HandlerObject; BOOL IsInit; }HARDWARE_ENGINE_INIT_SETTINGS_GLOBAL, * PHARDWARE_ENGINE_INIT_SETTINGS_GLOBAL; typedef uintptr_t PUINT_VAR_T; typedef void (WINAPI* EXCEPTION_CALLBACK)(PEXCEPTION_POINTERS); typedef struct DESCRIPTOR_ENTRY { struct DESCRIPTOR_ENTRY* Next; struct DESCRIPTOR_ENTRY* Previous; PUINT_VAR_T Address; DWORD Position; DWORD Tid; BOOL Dis; EXCEPTION_CALLBACK CallbackRoutine; }DESCRIPTOR_ENTRY, *PDESCRIPTOR_ENTRY; inline CRITICAL_SECTION CriticalSection = { 0 }; inline DESCRIPTOR_ENTRY* Head = NULL; inline HARDWARE_ENGINE_INIT_SETTINGS_GLOBAL GlobalHardwareBreakpointObject; /******************************************* ERROR HANDLING *******************************************/ DWORD GetLastErrorFromTeb(VOID); NTSTATUS GetLastNtStatusFromTeb(VOID); VOID SetLastErrorInTeb(_In_ DWORD ErrorCode); VOID SetLastNtStatusInTeb(_In_ NTSTATUS Status); DWORD Win32FromHResult(_In_ HRESULT Result); DWORD RtlNtStatusToDosErrorViaImport(_In_ NTSTATUS Status); /******************************************* CRYPTOGRAPHY RELATED *******************************************/ DWORD HashStringDjb2A(_In_ LPCSTR String); DWORD HashStringDjb2W(_In_ LPCWSTR String); ULONG HashStringFowlerNollVoVariant1aA(_In_ LPCSTR String); ULONG HashStringFowlerNollVoVariant1aW(_In_ LPCWSTR String); UINT32 HashStringJenkinsOneAtATime32BitA(_In_ LPCSTR String); UINT32 HashStringJenkinsOneAtATime32BitW(_In_ LPCWSTR String); DWORD HashStringLoseLoseA(_In_ LPCSTR String); DWORD HashStringLoseLoseW(_In_ LPCWSTR String); INT HashStringRotr32A(_In_ LPCSTR String); INT HashStringRotr32W(_In_ LPCWSTR String); DWORD HashStringSdbmA(_In_ LPCSTR String); DWORD HashStringSdbmW(_In_ LPCWSTR String); UINT32 HashStringSuperFastHashA(_In_ LPCSTR String); UINT32 HashStringSuperFastHashW(_In_ LPCWSTR String); INT HashStringUnknownGenericHash1A(_In_ LPCSTR String); INT HashStringUnknownGenericHash1W(_In_ LPCWSTR String); INT32 HashStringSipHashA(_In_ LPCSTR String); INT32 HashStringSipHashW(_In_ LPCWSTR String); INT32 HashStringMurmurA(_In_ LPCSTR String); INT32 HashStringMurmurW(_In_ LPCWSTR String); BOOL CreateMd5HashFromFilePathW(_In_ LPCWSTR FilePath, _Inout_ PWCHAR Md5Hash); BOOL CreateMd5HashFromFilePathA(_In_ LPCSTR FilePath, _Inout_ PCHAR Md5Hash); INT CreatePseudoRandomInteger(_In_ ULONG Seed); PWCHAR CreatePseudoRandomStringW(_In_ SIZE_T dwLength, _In_ ULONG Seed); PCHAR CreatePseudoRandomStringA(_In_ SIZE_T dwLength, _In_ ULONG Seed); BOOL HashFileByMsiFileHashTableW(_In_ LPCWSTR Path, _Inout_ PULONG FileHash); BOOL HashFileByMsiFileHashTableA(_In_ LPCSTR Path, _Inout_ PULONG FileHash); ULONG CreatePseudoRandomIntegerFromNtdll(_In_ ULONG Seed); /******************************************* LIBRARY LOADING *******************************************/ PTEB GetTeb(VOID); PPEB GetPeb(VOID); PPEB GetPebFromTeb(VOID); PKUSER_SHARED_DATA GetKUserSharedData(VOID); PRTL_USER_PROCESS_PARAMETERS GetRtlUserProcessParameters(VOID); DWORD64 GetProcAddressDjb2(_In_ DWORD64 ModuleBase, _In_ DWORD64 Hash); DWORD64 GetProcAddressFowlerNollVoVariant1a(_In_ DWORD64 ModuleBase, _In_ DWORD64 Hash); DWORD64 GetProcAddressJenkinsOneAtATime32Bit(_In_ DWORD64 ModuleBase, _In_ DWORD64 Hash); DWORD64 GetProcAddressLoseLose(_In_ DWORD64 ModuleBase, _In_ DWORD64 Hash); DWORD64 GetProcAddressRotr32(_In_ DWORD64 ModuleBase, _In_ DWORD64 Hash); DWORD64 GetProcAddressSdbm(_In_ DWORD64 ModuleBase, _In_ DWORD64 Hash); DWORD64 GetProcAddressSuperFastHash(_In_ DWORD64 ModuleBase, _In_ DWORD64 Hash); DWORD64 GetProcAddressUnknownGenericHash1(_In_ DWORD64 ModuleBase, _In_ DWORD64 Hash); DWORD64 GetProcAddressSipHash(_In_ DWORD64 ModuleBase, _In_ DWORD64 Hash); DWORD64 GetProcAddressMurmur(_In_ DWORD64 ModuleBase, _In_ DWORD64 Hash); DWORD64 GetProcAddressA(_In_ DWORD64 ModuleBase, _In_ LPCSTR lpProcName); DWORD64 GetProcAddressW(_In_ DWORD64 ModuleBase, _In_ LPCWSTR lpProcName); BOOL RtlLoadPeHeaders(_Inout_ PIMAGE_DOS_HEADER* Dos, _Inout_ PIMAGE_NT_HEADERS* Nt, _Inout_ PIMAGE_FILE_HEADER* File, _Inout_ PIMAGE_OPTIONAL_HEADER* Optional, _Inout_ PBYTE* ImageBase); HMODULE GetModuleHandleEx2A(_In_ LPCSTR lpModuleName); HMODULE GetModuleHandleEx2W(_In_ LPCWSTR lpModuleName); HMODULE ProxyWorkItemLoadLibraryW(_In_ LPCWSTR lpModuleName); HMODULE ProxyWorkItemLoadLibraryA(_In_ LPCSTR lpModuleName); HMODULE ProxyRegisterWaitLoadLibraryW(_In_ LPCWSTR lpModuleName); HMODULE ProxyRegisterWaitLoadLibraryA(_In_ LPCSTR lpModuleName); /******************************************* HELPER FUNCTIONS *******************************************/ BOOL IsPathValidA(_In_ LPCSTR FilePath); BOOL IsPathValidW(_In_ LPCWSTR FilePath); BOOL CreateLocalAppDataObjectPathW(_Inout_ PWCHAR pBuffer, _In_ LPCWSTR Path, _In_ DWORD Size, _In_ BOOL bDoesObjectExist); BOOL CreateLocalAppDataObjectPathA(_Inout_ PCHAR pBuffer, _In_ LPCSTR Path, _In_ DWORD Size, _In_ BOOL bDoesObjectExist); BOOL GetSystemWindowsDirectoryA(_In_ DWORD nBufferLength, _Inout_ PCHAR lpBuffer); BOOL GetSystemWindowsDirectoryW(_In_ DWORD nBufferLength, _Inout_ PWCHAR lpBuffer); BOOL CreateWindowsObjectPathW(_Inout_ PWCHAR pBuffer, _In_ PWCHAR Path, _In_ DWORD Size, _In_ BOOL bDoesObjectExist); BOOL CreateWindowsObjectPathA(_Inout_ PCHAR pBuffer, _In_ PCHAR Path, _In_ DWORD Size, _In_ BOOL bDoesObjectExist); HANDLE GetProcessHeapFromTeb(VOID); LPWSTR GetCurrentUserSidW(VOID); LPSTR GetCurrentUserSidA(VOID); DWORD GetProcessPathFromLoaderLoadModuleA(_In_ DWORD nBufferLength, _Inout_ PCHAR lpBuffer); DWORD GetProcessPathFromLoaderLoadModuleW(_In_ DWORD nBufferLength, _Inout_ PWCHAR lpBuffer); DWORD GetProcessPathFromUserProcessParametersA(_In_ DWORD nBufferLength, _Inout_ PCHAR lpBuffer); DWORD GetProcessPathFromUserProcessParametersW(_In_ DWORD nBufferLength, _Inout_ PWCHAR lpBuffer); BOOL RecursiveFindFileA(_In_ LPCSTR Path, _In_ LPCSTR Pattern); BOOL RecursiveFindFileW(_In_ LPCWSTR Path, _In_ LPCWSTR Pattern); BOOL DeleteFileWithCreateFileFlagA(_In_ PCHAR Path); BOOL DeleteFileWithCreateFileFlagW(_In_ PWCHAR Path); DWORD GetCurrentDirectoryFromUserProcessParametersA(_In_ DWORD nBufferLength, _Inout_ PCHAR lpBuffer); DWORD GetCurrentDirectoryFromUserProcessParametersW(_In_ DWORD nBufferLength, _Inout_ PWCHAR lpBuffer); DWORD GetCurrentProcessIdFromTeb(VOID); DWORD GetCurrentWindowTextFromUserProcessParametersA(_In_ DWORD nBufferLength, _Inout_ PCHAR lpBuffer); DWORD GetCurrentWindowTextFromUserProcessParametersW(_In_ DWORD nBufferLength, _Inout_ PWCHAR lpBuffer); LONGLONG GetFileSizeFromPathW(_In_ PWCHAR Path, _In_ DWORD dwFlagsAndAttributes); LONGLONG GetFileSizeFromPathA(_In_ PCHAR Path, _In_ DWORD dwFlagsAndAttributes); BOOL SetProcessPrivilegeToken(_In_ DWORD PrivilegeEnum); BOOL IsDllLoadedW(_In_ LPCWSTR DllName); BOOL IsDllLoadedA(_In_ LPCSTR DllName); HMODULE TryLoadDllMultiMethodW(_In_ PWCHAR DllName); HMODULE TryLoadDllMultiMethodA(_In_ PCHAR DllName); DWORD CreateThreadAndWaitForCompletion(_In_ LPTHREAD_START_ROUTINE StartAddress, _In_ LPVOID Parameters, _In_ DWORD dwMilliseconds); BOOL GetProcessBinaryNameFromHwndW(_In_ HWND ProcessHwnd, _Inout_ PWCHAR BinaryName, _In_ DWORD BufferSize); BOOL GetProcessBinaryNameFromHwndA(_In_ HWND ProcessHwnd, _Inout_ PCHAR BinaryName, _In_ DWORD BufferSize); BOOL GetByteArrayFromFileW(_Inout_ PBYTE Buffer, _In_ PWCHAR Path, _In_ ULONGLONG BytesToRead); BOOL GetByteArrayFromFileA(_Inout_ PBYTE Buffer, _In_ PCHAR Path, _In_ ULONGLONG BytesToRead); BOOL Ex_GetHandleOnDeviceHttpCommunication(_Out_ PHANDLE Handle); DWORD IsRegistryKeyValidW(_In_ HKEY PredefinedKey, _In_ PWCHAR Path); BOOL FastcallExecuteBinaryShellExecuteExW(_In_ PWCHAR FullPathToBinary, _In_ PWCHAR OptionalParameters); BOOL FastcallExecuteBinaryShellExecuteExA(_In_ PCHAR FullPathToBinary, _In_ PCHAR OptionalParameters); DWORD GetCurrentProcessIdFromOffset(VOID); HMODULE GetPeFileBaseAddress(VOID); DWORD64 LdrLoadGetProcedureAddress(VOID); BOOL IsPeSectionW(_In_ LPCWSTR PathToBinary, _In_ LPCWSTR PeSectionName); BOOL IsPeSectionA(_In_ LPCSTR PathToBinary, _In_ LPCSTR PeSectionName); BOOL AddSectionToPeFileW(_In_ LPCWSTR Path, _In_ LPCWSTR SectionName, _In_ DWORD SectionSizeInBytes); BOOL AddSectionToPeFileA(_In_ LPCSTR Path, _In_ LPCSTR SectionName, _In_ DWORD SectionSizeInBytes); BOOL WriteDataToPeSectionW(_In_ LPCWSTR Path, _In_ LPCWSTR SectionName, _In_ PBYTE DataToWrite, _In_ DWORD DataToWriteInBytes); BOOL WriteDataToPeSectionA(_In_ LPCSTR Path, _In_ LPCSTR SectionName, _In_ PBYTE DataToWrite, _In_ DWORD DataToWriteInBytes); DWORD GetPeSectionSizeInBytesW(_In_ LPCWSTR Path, _In_ LPCWSTR SectionName); DWORD GetPeSectionSizeInBytesA(_In_ LPCSTR Path, _In_ LPCSTR SectionName); BOOL ReadDataFromPeSectionW(_In_ LPCWSTR Path, _In_ LPCWSTR SectionName, _Inout_ PBYTE ReadData, _Inout_opt_ PDWORD DataReadInBytes); BOOL ReadDataFromPeSectionA(_In_ LPCSTR Path, _In_ LPCSTR SectionName, _Inout_ PBYTE ReadData, _Inout_opt_ PDWORD DataReadInBytes); /******************************************* FINGERPRINTING *******************************************/ LCID GetCurrentLocaleFromTeb(VOID); DWORD GetNumberOfLinkedDlls(VOID); BOOL IsNvidiaGraphicsCardPresentA(VOID); BOOL IsNvidiaGraphicsCardPresentW(VOID); BOOL IsProcessRunningA(_In_ LPCSTR ProcessNameWithExtension); BOOL IsProcessRunningW(_In_ LPCWSTR ProcessNameWithExtension); BOOL IsProcessRunningAsAdmin(VOID); ULONG GetOsMajorVersionFromPeb(VOID); ULONG GetOsMinorVersionFromPeb(VOID); ULONG GetOsBuildNumberFromPeb(VOID); ULONG GetOsPlatformIdFromPeb(VOID); DWORD GetPidFromNtQuerySystemInformationW(_In_ PWCHAR BinaryNameWithFileExtension); DWORD GetPidFromNtQuerySystemInformationA(_In_ PCHAR BinaryNameWithFileExtension); DWORD GetPidFromWindowsTerminalServiceW(_In_ PWCHAR BinaryNameWithFileExtension); DWORD GetPidFromWindowsTerminalServiceA(_In_ PCHAR BinaryNameWithFileExtension); DWORD GetPidFromWmiComInterfaceW(_In_ PWCHAR BinaryNameWithFileExtension); DWORD GetPidFromWmiComInterfaceA(_In_ PCHAR BinaryNameWithFileExtension); DWORD GetPidFromEnumProcessesW(_In_ PWCHAR ProcessNameWithExtension); DWORD GetPidFromEnumProcessesA(_In_ PCHAR ProcessNameWithExtension); DWORD GetPidFromPidBruteForcingW(_In_ PWCHAR ProcessNameWithExtension); DWORD GetPidFromPidBruteForcingA(_In_ PCHAR ProcessNameWithExtension); DWORD GetPidFromNtQueryFileInformationW(_In_ PWCHAR FullBinaryPath); DWORD GetPidFromNtQueryFileInformationA(_In_ PCHAR FullBinaryPath); DWORD GetPidFromPidBruteForcingExW(_In_ PWCHAR ProcessNameWithExtension); DWORD GetPidFromPidBruteForcingExA(_In_ PCHAR ProcessNameWithExtension); /******************************************* MALICIOUS CAPABILITIES *******************************************/ DWORD OleGetClipboardDataA(_Inout_ PCHAR Buffer); DWORD OleGetClipboardDataW(_Inout_ PWCHAR Buffer); DWORD MpfComVssDeleteShadowVolumeBackups(_In_ BOOL CoUninitializeAfterCompletion); BOOL MpfComModifyShortcutTargetW(_In_ PWCHAR LnkPath, _In_ PWCHAR LnkExecutionProperty); BOOL MpfComModifyShortcutTargetA(_In_ PCHAR LnkPath, _In_ PCHAR LnkExecutionProperty); BOOL UacBypassFodHelperMethodA(_In_ PCHAR PathToBinaryToExecute, _Inout_ PPROCESS_INFORMATION Pi); BOOL UacBypassFodHelperMethodW(_In_ PWCHAR PathToBinaryToExecute, _Inout_ PPROCESS_INFORMATION Pi); DWORD MpfGetLsaPidFromRegistry(VOID); DWORD MpfGetLsaPidFromServiceManager(VOID); DWORD MpfGetLsaPidFromNamedPipe(VOID); DWORD MpfComMonitorChromeSessionOnce(VOID); DWORD MpfExecute64bitPeBinaryInMemoryFromByteArrayNoReloc(_In_ PBYTE BinaryImage); BOOL __unstable__preview__MpfSilentInstallGoogleChromePluginW(_In_ PWCHAR ExtensionIdentifier); BOOL __unstable__preview__MpfSilentInstallGoogleChromePluginA(_In_ PCHAR ExtensionIdentifier); BOOL MpfLolExecuteRemoteBinaryByAppInstallerW(_In_ PWCHAR RemoteUrlTextFile, _In_ DWORD RemoteUrlLengthInBytes); BOOL MpfLolExecuteRemoteBinaryByAppInstallerA(_In_ PCHAR RemoteUrlTextFile, _In_ DWORD RemoteUrlLengthInBytes); BOOL MpfProcessInjectionViaProcessReflection(_In_ PBYTE Shellcode, _In_ DWORD dwSizeOfShellcodeInBytes, _In_ DWORD TargetPid); BOOL MpfExtractMaliciousPayloadFromZipFileNoPasswordW(_In_ PWCHAR FullPathToZip, _In_ PWCHAR FullPathToExtractionDirectory); BOOL MpfExtractMaliciousPayloadFromZipFileNoPasswordA(_In_ PCHAR FullPathToZip, _In_ PCHAR FullPathToExtractionDirectory); BOOL MpfPiWriteProcessMemoryCreateRemoteThread(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes, _In_ DWORD TargetProcessId); BOOL MpfPiQueueUserAPCViaAtomBomb(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes, _In_ DWORD TargetThreadId); BOOL MpfPiControlInjection(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes, _In_ DWORD TargetProcessId); BOOL MpfSceViaEnumChildWindows(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaCDefFolderMenu_Create2(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaCertEnumSystemStore(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaCertEnumSystemStoreLocation(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumDateFormatsW(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumDesktopWindows(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumDesktopsW(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumDirTreeW(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumDisplayMonitors(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumFontFamiliesExW(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumFontsW(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumLanguageGroupLocalesW(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumObjects(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumResourceTypesExW(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumSystemCodePagesW(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumSystemGeoID(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumSystemLanguageGroupsW(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumSystemLocalesEx(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumThreadWindows(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumTimeFormatsEx(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumUILanguagesW(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumWindowStationsW(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumWindows(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumerateLoadedModules64(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaK32EnumPageFilesW(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaEnumPwrSchemes(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaMessageBoxIndirectW(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); //Unstable, only triggers on certain button presses, prone to crashing BOOL MpfSceViaImmEnumInputContext(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaCertFindChainInStore(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); //Not working? BOOL MpfSceViaEnumPropsExW(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaCreateThreadpoolWait(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); //Unstable, some shellcode crashes application, requires improved testing BOOL MpfSceViaCryptEnumOIDInfo(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaDSA_EnumCallback(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaCreateTimerQueueTimer(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); //Unstable, some shellcode crashes application, requires improved testing BOOL MpfSceViaEvtSubscribe(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); //Unstable, some shellcode crashes application, requires improved testing BOOL MpfSceViaFlsAlloc(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); BOOL MpfSceViaInitOnceExecuteOnce(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes); /******************************************* EVASION *******************************************/ BOOL CreateProcessWithCfGuardW(_Inout_ PPROCESS_INFORMATION Pi, _In_ PWCHAR Path); BOOL CreateProcessWithCfGuardA(_Inout_ PPROCESS_INFORMATION Pi, _In_ PCHAR Path); HRESULT CreateProcessFromIHxInteractiveUserW(_In_ PWCHAR UriFile); HRESULT CreateProcessFromIHxInteractiveUserA(_In_ PCHAR UriFile); HRESULT CreateProcessFromIHxHelpPaneServerW(_In_ PWCHAR UriFile); HRESULT CreateProcessFromIHxHelpPaneServerA(_In_ PCHAR UriFile); BOOL MasqueradePebAsExplorer(VOID); BOOL CreateFileFromDsCopyFromSharedFileW(_In_ PWCHAR NewFileName, _In_ PWCHAR FileToClone); BOOL CreateFileFromDsCopyFromSharedFileA(_In_ PCHAR NewFileName, _In_ PCHAR FileToClone); BOOL DelayedExecutionExecuteOnDisplayOff(VOID); DWORD CreateProcessFromShellExecuteInExplorerProcessW(_In_ PWCHAR BinaryPath); DWORD CreateProcessFromShellExecuteInExplorerProcessA(_In_ PCHAR BinaryPath); DWORD CreateProcessFromIShellDispatchInvokeW(_In_ PWCHAR BinaryPath); DWORD CreateProcessFromIShellDispatchInvokeA(_In_ PCHAR BinaryPath); DWORD CreateProcessViaNtCreateUserProcessW(PWCHAR FullBinaryPath); DWORD CreateProcessViaNtCreateUserProcessA(PCHAR FullBinaryPath); BOOL RemoveDllFromPebA(_In_ LPCSTR lpModuleName); BOOL RemoveDllFromPebW(_In_ LPCWSTR lpModuleName); BOOL HookEngineUnhookHeapFree(_In_ BOOL StartEngine); BOOL HookEngineRestoreHeapFree(_In_ BOOL ShutdownEngine); BOOL SleepObfuscationViaVirtualProtect(_In_ DWORD dwSleepTimeInMilliseconds, _In_ PUCHAR Key); BOOL RemoveRegisterDllNotification(VOID); DWORD CreateProcessByWindowsRHotKeyW(_In_ PWCHAR FullPathToBinary); DWORD CreateProcessByWindowsRHotKeyA(_In_ PCHAR FullPathToBinary); DWORD CreateProcessByWindowsRHotKeyExW(_In_ PWCHAR FullPathToBinary); DWORD CreateProcessByWindowsRHotKeyExA(_In_ PCHAR FullPathToBinary); /******************************************* ANTI-DEBUGGING *******************************************/ BOOL AdfCloseHandleOnInvalidAddress(VOID); BOOL AdfIsCreateProcessDebugEventCodeSet(VOID); BOOL AdfOpenProcessOnCsrss(VOID); BOOL IsIntelHardwareBreakpointPresent(VOID); BOOL CheckRemoteDebuggerPresent2(_In_ HANDLE hHandle, _Inout_ PBOOL pbDebuggerPresent); BOOL IsDebuggerPresentEx(VOID); /******************************************* NETWORK CONNECTIVITY *******************************************/ DWORD UrlDownloadToFileSynchronousW(_In_ PWCHAR Url, _In_ PWCHAR SavePath); DWORD UrlDownloadToFileSynchronousA(_In_ PCHAR Url, _In_ PCHAR SavePath); BOOL SendIcmpEchoMessageToIPv4HostW(_In_ PWCHAR IpAddress, _Inout_ PDWORD Status, _Inout_ PDWORD RoundTripTime, _Inout_ PWCHAR EchoReplyAddress); BOOL SendIcmpEchoMessageToIPv4HostA(_In_ PCHAR IpAddress, _Inout_ PDWORD Status, _Inout_ PDWORD RoundTripTime, _Inout_ PCHAR EchoReplyAddress); ULONG ConvertIPv4StringToUnsignedLongW(_In_ PWCHAR IpAddress); ULONG ConvertIPv4StringToUnsignedLongA(_In_ PCHAR IpAddress); BOOL ConvertIPv4IpAddressStructureToStringW(_In_ PIN_ADDR Address, _Out_ PWCHAR Buffer); BOOL ConvertIPv4IpAddressStructureToStringA(_In_ PIN_ADDR Address, _Out_ PCHAR Buffer); BOOL ConvertIPv4IpAddressUnsignedLongToStringW(_In_ ULONG Address, _Out_ PWCHAR Buffer); BOOL ConvertIPv4IpAddressUnsignedLongToStringA(_In_ ULONG Address, _Out_ PCHAR Buffer); DWORD DnsGetDomainNameIPv4AddressAsStringW(_In_ PWCHAR DomainName, _Inout_ PWCHAR IPv4IPAddress); DWORD DnsGetDomainNameIPv4AddressAsStringA(_In_ PCHAR DomainName, _Inout_ PCHAR IPv4IPAddress); ULONG DnsGetDomainNameIPv4AddressUnsignedLongW(_In_ PWCHAR DomainName); ULONG DnsGetDomainNameIPv4AddressUnsignedLongA(_In_ PCHAR DomainName); BOOL GetDomainNameFromUnsignedLongIPV4AddressW(_In_ ULONG IpAddress, _Inout_ PWCHAR DomainName); BOOL GetDomainNameFromUnsignedLongIPV4AddressA(_In_ ULONG IpAddress, _Inout_ PCHAR DomainName); BOOL GetDomainNameFromIPV4AddressAsStringW(_In_ PWCHAR IpAddress, _Inout_ PWCHAR DomainName); BOOL GetDomainNameFromIPV4AddressAsStringA(_In_ PCHAR IpAddress, _Inout_ PCHAR DomainName); /******************************************* RAD HARDWARE BREAKPOINT HOOKING ENGINE FUNCTIONS *******************************************/ BOOL InitHardwareBreakpointEngine(VOID); BOOL ShutdownHardwareBreakpointEngine(VOID); LONG ExceptionHandlerCallbackRoutine(_In_ PEXCEPTION_POINTERS ExceptionInfo); BOOL SetHardwareBreakpoint(_In_ DWORD ThreadId, _In_ PUINT_VAR_T Address, _In_ UINT Position, _In_ BOOL Init); BOOL InsertDescriptorEntry(_In_ PUINT_VAR_T Address, _In_ DWORD Position, _In_ EXCEPTION_CALLBACK CallbackRoutine, _In_ DWORD Tid, _In_ BOOL Dis); BOOL RemoveDescriptorEntry(_In_ PUINT_VAR_T Address, _In_ DWORD Tid); BOOL SnapshotInsertHardwareBreakpointHookIntoTargetThread(_In_ PUINT_VAR_T Address, _In_ DWORD Position, _In_ BOOL Init, _In_ DWORD Tid); INT __demonstration_WinMain(VOID); //hook sleep /******************************************* GENERIC SHELLCODE PAYLOADS FOR TESTINGS *******************************************/ PCHAR GenericShellcodeHelloWorldMessageBoxA(_Out_ PDWORD SizeOfShellcodeInBytes); PCHAR GenericShellcodeOpenCalcExitThread(_Out_ PDWORD SizeOfShellcodeInBytes); PCHAR GenericShellcodeHelloWorldMessageBoxAEbFbLoop(_Out_ PDWORD SizeOfShellcodeInBytes);