Necropolis v1 release
This commit is contained in:
@@ -0,0 +1,201 @@
|
||||
// PEB-based module and function resolution. No static imports — everything resolved at runtime.
|
||||
// 1. Loader structs — LIST_ENTRY → PEB_LDR_DATA → LDR_DATA_TABLE_ENTRY (DllBase, name, size).
|
||||
// 2. PEB (GS:[0x60]) + hash_ror13 — case-insensitive, same algo as Hell's Gate manual-map tooling.
|
||||
// 3. get_peb() — inline asm to read GS:[0x60], returns PEB pointer.
|
||||
// 4. get_module_by_hash — walk InMemoryOrderModuleList, match by ror13 hash.
|
||||
// 5. resolve_forward_string — chase "DLL.func" forwarded exports through chain of modules.
|
||||
// 6. get_func_by_hash — parse IMAGE_EXPORT_DIRECTORY, handle forwarded exports.
|
||||
// 7. resolve_api — three-tier: specific module → kernel32 cache → ntdll cache → full PEB walk.
|
||||
const std = @import("std");
|
||||
const win = @import("win32.zig");
|
||||
const pe = @import("pe.zig");
|
||||
|
||||
// Doubly-linked list node used by Windows loader structures.
|
||||
// PEB_LDR_DATA chains these to track loaded modules in three orderings.
|
||||
pub const LIST_ENTRY = extern struct {
|
||||
Flink: *LIST_ENTRY,
|
||||
Blink: *LIST_ENTRY,
|
||||
};
|
||||
|
||||
// Loader data block hung off the PEB. Each module list is a circular linked list
|
||||
// of LDR_DATA_TABLE_ENTRY nodes. InMemoryOrder is the safest to walk — InLoadOrder
|
||||
// can race during DLL load/unload on other threads.
|
||||
pub const PEB_LDR_DATA = extern struct {
|
||||
Length: win.ULONG,
|
||||
Initialized: win.BYTE,
|
||||
Padding: [3]win.BYTE,
|
||||
SsHandle: win.LPVOID,
|
||||
InLoadOrderModuleList: LIST_ENTRY,
|
||||
InMemoryOrderModuleList: LIST_ENTRY,
|
||||
InInitializationOrderModuleList: LIST_ENTRY,
|
||||
};
|
||||
|
||||
// One entry per loaded module. Contains the DLL base, image size, and its name.
|
||||
// The InMemoryOrderLinks list_entry is embedded at a known offset from the struct start —
|
||||
// we subtract that offset to get back to the full LDR_DATA_TABLE_ENTRY.
|
||||
pub const LDR_DATA_TABLE_ENTRY = extern struct {
|
||||
InLoadOrderLinks: LIST_ENTRY,
|
||||
InMemoryOrderLinks: LIST_ENTRY,
|
||||
InInitializationOrderLinks: LIST_ENTRY,
|
||||
DllBase: win.LPVOID,
|
||||
EntryPoint: win.LPVOID,
|
||||
SizeOfImage: win.ULONG,
|
||||
FullDllName: win.UNICODE_STRING,
|
||||
BaseDllName: win.UNICODE_STRING,
|
||||
};
|
||||
|
||||
// The Process Environment Block lives at GS:0x60 on x64.
|
||||
// Only the fields we actually touch are defined — the real struct is much larger.
|
||||
pub const PEB = extern struct {
|
||||
Reserved1: [2]win.BYTE,
|
||||
BeingDebugged: win.BYTE,
|
||||
Reserved2: [1]win.BYTE,
|
||||
Reserved3: [2]win.LPVOID,
|
||||
Ldr: *PEB_LDR_DATA,
|
||||
};
|
||||
|
||||
// ror13 hash of a module or function name. Case-insensitive — uppercases each byte before mixing.
|
||||
// Same algorithm used by Hell's Gate and other manual-map tooling for consistency.
|
||||
pub fn hash_ror13(input: []const u8) u32 {
|
||||
var hash: u32 = 0;
|
||||
for (input) |c| {
|
||||
var c_upper = c;
|
||||
if (c_upper >= 'a' and c_upper <= 'z') c_upper -= 32;
|
||||
hash = (hash >> 13) | (hash << 19);
|
||||
hash +%= c_upper;
|
||||
}
|
||||
return hash;
|
||||
}
|
||||
|
||||
// Reads GS:[0x60] to return the PEB pointer.
|
||||
pub fn get_peb() *PEB {
|
||||
const ptr: usize = asm volatile ("mov %%gs:0x60, %[ptr]"
|
||||
: [ptr] "=r" (-> usize),
|
||||
);
|
||||
return @as(*PEB, @ptrFromInt(ptr));
|
||||
}
|
||||
|
||||
// Walks InMemoryOrderModuleList looking for a DLL whose ror13-hashed BaseDllName matches.
|
||||
// Returns the module's base address or null if not found.
|
||||
pub fn get_module_by_hash(hash: u32) ?*anyopaque {
|
||||
const peb_ptr = get_peb();
|
||||
const ldr = peb_ptr.Ldr;
|
||||
// Walk the circular linked list starting from InMemoryOrderModuleList
|
||||
const head = @as(*LIST_ENTRY, @ptrCast(&ldr.InMemoryOrderModuleList));
|
||||
var entry = head.Flink;
|
||||
|
||||
while (entry != head) : (entry = entry.Flink) {
|
||||
// Subtract the offset of InMemoryOrderLinks to get back to the LDR_DATA_TABLE_ENTRY
|
||||
const le: *LDR_DATA_TABLE_ENTRY = @ptrCast(@alignCast(@as(*anyopaque, @ptrFromInt(@intFromPtr(entry) - @offsetOf(LDR_DATA_TABLE_ENTRY, "InMemoryOrderLinks")))));
|
||||
|
||||
if (le.BaseDllName.Length == 0) continue;
|
||||
|
||||
const buf = le.BaseDllName.Buffer;
|
||||
const len = le.BaseDllName.Length / 2;
|
||||
var mod_hash: u32 = 0;
|
||||
var i: usize = 0;
|
||||
while (i < len) : (i += 1) {
|
||||
var c = buf[i];
|
||||
if (c >= 'a' and c <= 'z') c -= 32;
|
||||
mod_hash = (mod_hash >> 13) | (mod_hash << 19);
|
||||
mod_hash +%= @as(u32, c);
|
||||
}
|
||||
|
||||
if (mod_hash == hash) return le.DllBase;
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
// Follows a forwarded export string ("module.function") to resolve the real target.
|
||||
// Splits on the dot, hashes both halves, looks up the module, then the function within it.
|
||||
fn resolve_forward_string(base_bytes: [*]u8, forward_rva: u32) ?*anyopaque {
|
||||
const forward_str = @as([*:0]u8, @ptrCast(@alignCast(base_bytes + @as(usize, @intCast(forward_rva)))));
|
||||
const str = std.mem.sliceTo(forward_str, 0);
|
||||
const dot_pos = std.mem.indexOfScalar(u8, str, '.') orelse return null;
|
||||
const dll_hash = hash_ror13(str[0..dot_pos]);
|
||||
const func_hash = hash_ror13(str[dot_pos + 1 ..]);
|
||||
const dll_base = get_module_by_hash(dll_hash) orelse return null;
|
||||
return get_func_by_hash(dll_base, func_hash);
|
||||
}
|
||||
|
||||
// Parses a module's export directory, hashes each exported name, and returns the matching
|
||||
// function address. Handles forwarded exports (looking-glass exports that redirect to another DLL).
|
||||
pub fn get_func_by_hash(base: *anyopaque, func_hash: u32) ?*anyopaque {
|
||||
const base_bytes = @as([*]u8, @ptrCast(base));
|
||||
const dos = @as(*pe.IMAGE_DOS_HEADER, @ptrCast(@alignCast(base_bytes)));
|
||||
if (dos.e_magic != 0x5A4D) return null;
|
||||
|
||||
const nt = @as(*pe.IMAGE_NT_HEADERS64, @ptrCast(@alignCast(base_bytes + @as(usize, @intCast(dos.e_lfanew)))));
|
||||
if (nt.Signature != 0x00004550) return null;
|
||||
|
||||
const export_dir = nt.OptionalHeader.DataDirectory[0];
|
||||
if (export_dir.VirtualAddress == 0 or export_dir.Size == 0) return null;
|
||||
|
||||
const exp = @as(*pe.IMAGE_EXPORT_DIRECTORY, @ptrCast(@alignCast(base_bytes + @as(usize, @intCast(export_dir.VirtualAddress)))));
|
||||
|
||||
if (exp.NumberOfNames == 0 or exp.AddressOfFunctions == 0 or exp.AddressOfNames == 0 or exp.AddressOfNameOrdinals == 0) return null;
|
||||
|
||||
const names = @as([*]u32, @ptrCast(@alignCast(base_bytes + @as(usize, @intCast(exp.AddressOfNames)))));
|
||||
const funcs = @as([*]u32, @ptrCast(@alignCast(base_bytes + @as(usize, @intCast(exp.AddressOfFunctions)))));
|
||||
const ords = @as([*]u16, @ptrCast(@alignCast(base_bytes + @as(usize, @intCast(exp.AddressOfNameOrdinals)))));
|
||||
|
||||
var i: u32 = 0;
|
||||
while (i < exp.NumberOfNames) : (i += 1) {
|
||||
if (names[i] == 0) continue;
|
||||
|
||||
const name_ptr = @as([*:0]u8, @ptrCast(@alignCast(base_bytes + @as(usize, @intCast(names[i])))));
|
||||
const name = std.mem.sliceTo(name_ptr, 0);
|
||||
|
||||
if (hash_ror13(name) == func_hash) {
|
||||
const ordinal = ords[i];
|
||||
if (ordinal >= exp.NumberOfFunctions) continue;
|
||||
const rva = funcs[ordinal];
|
||||
if (rva >= export_dir.VirtualAddress and rva < export_dir.VirtualAddress + export_dir.Size) {
|
||||
return resolve_forward_string(base_bytes, rva);
|
||||
}
|
||||
return @as(*anyopaque, @ptrCast(base_bytes + @as(usize, @intCast(rva))));
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
var cached_kernel32: ?*anyopaque = null;
|
||||
var cached_ntdll: ?*anyopaque = null;
|
||||
|
||||
// Three-tier lookup: specific module by hash → kernel32 → ntdll → full PEB module walk.
|
||||
// Falls back to scanning every loaded module if the requested module isn't found or isn't loaded.
|
||||
pub fn resolve_api(module_hash: u32, func_hash: u32) ?*anyopaque {
|
||||
if (module_hash != 0) {
|
||||
if (get_module_by_hash(module_hash)) |base| {
|
||||
if (get_func_by_hash(base, func_hash)) |f| return f;
|
||||
}
|
||||
}
|
||||
|
||||
if (cached_kernel32 == null) cached_kernel32 = get_module_by_hash(hash_ror13("kernel32.dll"));
|
||||
if (cached_kernel32) |base| {
|
||||
if (get_func_by_hash(base, func_hash)) |f| return f;
|
||||
}
|
||||
|
||||
if (cached_ntdll == null) cached_ntdll = get_module_by_hash(hash_ror13("ntdll.dll"));
|
||||
if (cached_ntdll) |base| {
|
||||
if (get_func_by_hash(base, func_hash)) |f| return f;
|
||||
}
|
||||
|
||||
const peb_ptr = get_peb();
|
||||
const ldr = peb_ptr.Ldr;
|
||||
const head = @as(*LIST_ENTRY, @ptrCast(&ldr.InMemoryOrderModuleList));
|
||||
var entry = head.Flink;
|
||||
|
||||
while (entry != head) : (entry = entry.Flink) {
|
||||
const le: *LDR_DATA_TABLE_ENTRY = @ptrCast(@alignCast(@as(*anyopaque, @ptrFromInt(@intFromPtr(entry) - @offsetOf(LDR_DATA_TABLE_ENTRY, "InMemoryOrderLinks")))));
|
||||
|
||||
if (cached_kernel32) |ck| if (le.DllBase == ck) continue;
|
||||
if (cached_ntdll) |cn| if (le.DllBase == cn) continue;
|
||||
|
||||
if (get_func_by_hash(le.DllBase, func_hash)) |f| return f;
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
Reference in New Issue
Block a user