vxunderground-VX-API/VX-API/MalwareMemoryAddressSpace.h

#pragma once
#include "MalwareHeader.h"

PKUSER_SHARED_DATA GetKUserSharedData(VOID)
{
	return (KUSER_SHARED_DATA*)0x7FFE0000;
}

PPEB GetPeb(VOID)
{
#if defined(_WIN64)
	return (PPEB)__readgsqword(0x60);
#elif define(_WIN32)
	return (PPEB)__readfsdword(0x30);
#endif
}

PPEB GetPebAlt(VOID)
{
	PTEB Teb;
#if defined(_WIN64)
	Teb = (PTEB)__readgsqword(0x30);
#elif define(_WIN32)
	Teb = (PTEB)__readfsdword(0x18);
#endif
	return (PPEB)Teb->ProcessEnvironmentBlock;
}

PRTL_USER_PROCESS_PARAMETERS GetRtlUserProcessParameters(VOID)
{
	return GetPeb()->ProcessParameters;
}

PTEB GetTeb(VOID)
{
#if defined(_WIN64)
	return (PTEB)__readgsqword(0x30);
#elif define(_WIN32)
	return (PTEB)__readfsdword(0x18);
#endif
}

HANDLE GetProcessHeapAlt(VOID)
{
	return GetPeb()->ProcessHeap;
}

BOOL RtlLoadPeHeaders(PIMAGE_DOS_HEADER* Dos, PIMAGE_NT_HEADERS* Nt, PIMAGE_FILE_HEADER* File, PIMAGE_OPTIONAL_HEADER* Optional, PBYTE* ImageBase)
{
	*Dos = (PIMAGE_DOS_HEADER)*ImageBase;
	if ((*Dos)->e_magic != IMAGE_DOS_SIGNATURE)
		return FALSE;

	*Nt = (PIMAGE_NT_HEADERS)((PBYTE)*Dos + (*Dos)->e_lfanew);
	if ((*Nt)->Signature != IMAGE_NT_SIGNATURE)
		return FALSE;

	*File = (PIMAGE_FILE_HEADER)(*ImageBase + (*Dos)->e_lfanew + sizeof(DWORD));
	*Optional = (PIMAGE_OPTIONAL_HEADER)((PBYTE)*File + sizeof(IMAGE_FILE_HEADER));

	return TRUE;
}

DWORD64 __stdcall ImportFunction(DWORD64 ModuleBase, DWORD64 Hash, DWORD Variant)
{
	PBYTE pFunctionName;
	PIMAGE_DOS_HEADER Dos;
	PIMAGE_NT_HEADERS Nt;
	PIMAGE_FILE_HEADER File;
	PIMAGE_OPTIONAL_HEADER Optional;

	RtlLoadPeHeaders(&Dos, &Nt, &File, &Optional, (PBYTE*)&ModuleBase);

	IMAGE_EXPORT_DIRECTORY* ExportTable = (PIMAGE_EXPORT_DIRECTORY)(ModuleBase + Optional->DataDirectory[0].VirtualAddress);
	PDWORD FunctionNameAddressArray = (PDWORD)((LPBYTE)ModuleBase + ExportTable->AddressOfNames);
	PDWORD FunctionAddressArray = (PDWORD)((LPBYTE)ModuleBase + ExportTable->AddressOfFunctions);
	PWORD FunctionOrdinalAddressArray = (PWORD)((LPBYTE)ModuleBase + ExportTable->AddressOfNameOrdinals);
	DWORD dwX;

	for (dwX = 0; dwX < ExportTable->NumberOfNames; dwX++)
	{
		pFunctionName = FunctionNameAddressArray[dwX] + (PBYTE)ModuleBase;
		DWORD dwFunctionHash = HashStringBasedOnVariantA(Variant, (PCHAR)pFunctionName);

		if (Hash == dwFunctionHash)
			return ((DWORD64)ModuleBase + FunctionAddressArray[FunctionOrdinalAddressArray[dwX]]);
	}

	return 0;
}

typedef struct __FUNCTION_HASH_DISPOSABLE_STRUCT {
	DWORD RtlAllocateHeapHash;
	DWORD RtlFreeHeapHash;
	DWORD NtCloseHash;
}HASH_DISPOSABLE_STRUCT, *PHASH_DISPOSABLE_STRUCT;

BOOL SubroutineSetFunctionHash(PHASH_DISPOSABLE_STRUCT Table, INT HashingMethod)
{
	switch (HashingMethod)
	{
		case SH_DJB2:
		{
			Table->RtlAllocateHeapHash = RTLALLOCATEHEAP_DJB2;
			Table->RtlFreeHeapHash = RTLFREEHEAP_DJB2;
			Table->NtCloseHash = NTCLOSE_DJB2;
			break;
		}

		case SH_FNVV1A:
		{
			Table->RtlAllocateHeapHash = RTLALLOCATEHEAP_FNVV1A;
			Table->RtlFreeHeapHash = RTLFREEHEAP_FNVV1A;
			Table->NtCloseHash = NTCLOSE_FNVV1A;
			break;
		}

		case SH_J1AAT_32:
		{
			Table->RtlAllocateHeapHash = RTLALLOCATEHEAP_JOAAT32;
			Table->RtlFreeHeapHash = RTLFREEHEAP_JOAAT32;
			Table->NtCloseHash = NTCLOSE_JOAAT32;
			break;
		}

		case SH_LL:
		{
			Table->RtlAllocateHeapHash = RTLALLOCATEHEAP_LL;
			Table->RtlFreeHeapHash = RTLFREEHEAP_LL;
			Table->NtCloseHash = NTCLOSE_LL;
			break;
		}

		case SH_ROTR_32:
		{
			Table->RtlAllocateHeapHash = RTLALLOCATEHEAP_ROTR32;
			Table->RtlFreeHeapHash = RTLFREEHEAP_ROTR32;
			Table->NtCloseHash = NTCLOSE_ROTR32;
			break;
		}

		case SH_SDBM:
		{
			Table->RtlAllocateHeapHash = RTLALLOCATEHEAP_SDBM;
			Table->RtlFreeHeapHash = RTLFREEHEAP_SDBM;
			Table->NtCloseHash = NTCLOSE_SDBM;
			break;
		}

		case SH_FAST:
		{
			Table->RtlAllocateHeapHash = RTLALLOCATEHEAP_FAST;
			Table->RtlFreeHeapHash = RTLFREEHEAP_FAST;
			Table->NtCloseHash = NTCLOSE_FAST;
			break;
		}

		case SH_UHA1:
		{
			Table->RtlAllocateHeapHash = RTLALLOCATEHEAP_UGH1;
			Table->RtlFreeHeapHash = RTLFREEHEAP_UGH1;
			Table->NtCloseHash = NTCLOSE_UGH1;
			break;
		}

		default:
			return FALSE;
	}

	return TRUE;
}

BOOL RtlInitializeNtdllFunctionsForForwards(BOOL UseAlt, INT HashingMethod)
{
	PPEB Peb = (UseAlt ? GetPebAlt() : GetPeb());
	PLDR_MODULE LoaderModule = (PLDR_MODULE)((PBYTE)Peb->LoaderData->InMemoryOrderModuleList.Flink->Flink - 16);
	HASH_DISPOSABLE_STRUCT Table = { 0 };
	
	if (!SubroutineSetFunctionHash(&Table, HashingMethod))
		return FALSE;
	
	pfnRtlAllocateHeap = (RTLALLOCATEHEAP)ImportFunction((DWORD64)LoaderModule->BaseAddress, Table.RtlAllocateHeapHash, HashingMethod);
	pfnFreeHeap = (RTLFREEHEAP)ImportFunction((DWORD64)LoaderModule->BaseAddress, Table.RtlFreeHeapHash, HashingMethod);
	pfnNtClose = (NTCLOSE)ImportFunction((DWORD64)LoaderModule->BaseAddress, Table.NtCloseHash, HashingMethod);

	if (!pfnRtlAllocateHeap || !pfnFreeHeap || !pfnNtClose)
		return FALSE;
	
	return TRUE;
}