mirror of
https://github.com/whokilleddb/lordran.polymorphic.shellcode
synced 2026-06-06 16:59:23 +00:00
DB
74 lines
1.6 KiB
C
74 lines
1.6 KiB
C
#pragma once
|
|
#include <windows.h>
|
|
#include <stdlib.h>
|
|
#include <stdio.h>
|
|
#include <time.h>
|
|
#include <stdint.h>
|
|
|
|
#define FUNC_SIZE 4096
|
|
#define DUMP_SIZE 32
|
|
|
|
#ifndef RVA2VA
|
|
#define RVA2VA(TYPE, BASE, RVA) (TYPE)((ULONG_PTR)BASE + RVA)
|
|
#endif
|
|
|
|
#ifndef __NTDLL_H__
|
|
|
|
#ifndef TO_LOWERCASE
|
|
#define TO_LOWERCASE(out, c1) (out = (c1 <= 'Z' && c1 >= 'A') ? c1 = (c1 - 'A') + 'a': c1)
|
|
#endif
|
|
|
|
|
|
typedef struct _UNICODE_STRING
|
|
{
|
|
USHORT Length;
|
|
USHORT MaximumLength;
|
|
PWSTR Buffer;
|
|
|
|
} UNICODE_STRING, * PUNICODE_STRING;
|
|
|
|
typedef struct _PEB_LDR_DATA
|
|
{
|
|
ULONG Length;
|
|
BOOLEAN Initialized;
|
|
HANDLE SsHandle;
|
|
LIST_ENTRY InLoadOrderModuleList;
|
|
LIST_ENTRY InMemoryOrderModuleList;
|
|
LIST_ENTRY InInitializationOrderModuleList;
|
|
PVOID EntryInProgress;
|
|
|
|
} PEB_LDR_DATA, * PPEB_LDR_DATA;
|
|
|
|
//here we don't want to use any functions imported form external modules
|
|
typedef struct _LDR_DATA_TABLE_ENTRY {
|
|
LIST_ENTRY InLoadOrderModuleList;
|
|
LIST_ENTRY InMemoryOrderModuleList;
|
|
LIST_ENTRY InInitializationOrderModuleList;
|
|
void* BaseAddress;
|
|
void* EntryPoint;
|
|
ULONG SizeOfImage;
|
|
UNICODE_STRING FullDllName;
|
|
UNICODE_STRING BaseDllName;
|
|
ULONG Flags;
|
|
SHORT LoadCount;
|
|
SHORT TlsIndex;
|
|
HANDLE SectionHandle;
|
|
ULONG CheckSum;
|
|
ULONG TimeDateStamp;
|
|
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;
|
|
|
|
typedef struct _PEB
|
|
{
|
|
BOOLEAN InheritedAddressSpace;
|
|
BOOLEAN ReadImageFileExecOptions;
|
|
BOOLEAN BeingDebugged;
|
|
BOOLEAN SpareBool;
|
|
HANDLE Mutant;
|
|
|
|
PVOID ImageBaseAddress;
|
|
PPEB_LDR_DATA Ldr;
|
|
|
|
} PEB, * PPEB;
|
|
|
|
#endif //__NTDLL_H__
|