Mirrors/netero1010-edrsilencer
1
0
Fork 0
mirror of https://github.com/netero1010/EDRSilencer.git synced 2026-06-09 01:17:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Version 1.2

Browse Source
This commit is contained in:
netero1010
2024-01-05 01:34:33 +08:00
parent 2c3a1c5e09
commit fb8f4b43a9
4 changed files with 191 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
utils.c
+13 -13
View File
@@ -1,20 +1,20 @@
#include "utils.h"
BOOL CheckProcessIntegrityLevel() {
HANDLE hToken;
HANDLE hToken = NULL;
DWORD dwLength = 0;
PTOKEN_MANDATORY_LABEL pTIL = NULL;
DWORD dwIntegrityLevel;
DWORD dwIntegrityLevel = 0;
BOOL isHighIntegrity = FALSE;
if (!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY, TRUE, &hToken)) {
if (GetLastError() != ERROR_NO_TOKEN) {
printf("[-] OpenThreadToken failed with error code:0x%x\n", GetLastError());
printf("[-] OpenThreadToken failed with error code: 0x%x\n", GetLastError());
return FALSE;
}
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken)) {
printf("[-] OpenProcessToken failed with error code:0x%x\n", GetLastError());
printf("[-] OpenProcessToken failed with error code: 0x%x\n", GetLastError());
return FALSE;
}
}
@@ -22,20 +22,20 @@ BOOL CheckProcessIntegrityLevel() {
// Get the size of the integrity level information
if (!GetTokenInformation(hToken, TokenIntegrityLevel, NULL, 0, &dwLength) &&
GetLastError() != ERROR_INSUFFICIENT_BUFFER) {
printf("[-] GetTokenInformation failed with error code:0x%x\n", GetLastError());
printf("[-] GetTokenInformation failed with error code: 0x%x\n", GetLastError());
CloseHandle(hToken);
return FALSE;
}
pTIL = (PTOKEN_MANDATORY_LABEL)LocalAlloc(LPTR, dwLength);
if (pTIL == NULL) {
printf("[-] LocalAlloc failed with error code:0x%x\n", GetLastError());
printf("[-] LocalAlloc failed with error code: 0x%x\n", GetLastError());
CloseHandle(hToken);
return FALSE;
}
if (!GetTokenInformation(hToken, TokenIntegrityLevel, pTIL, dwLength, &dwLength)) {
printf("[-] GetTokenInformation failed with error code:0x%x\n", GetLastError());
printf("[-] GetTokenInformation failed with error code: 0x%x\n", GetLastError());
LocalFree(pTIL);
CloseHandle(hToken);
return FALSE;
@@ -57,22 +57,22 @@ BOOL CheckProcessIntegrityLevel() {
// Enable SeDebugPrivilege to obtain full path of running processes
BOOL EnableSeDebugPrivilege() {
HANDLE hToken = NULL;
TOKEN_PRIVILEGES tokenPrivileges = { 0 };
TOKEN_PRIVILEGES tokenPrivileges = {0};
if (!OpenThreadToken(GetCurrentThread(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, TRUE, &hToken)) {
if (GetLastError() != ERROR_NO_TOKEN) {
printf("[-] OpenThreadToken failed with error code:0x%x\n", GetLastError());
printf("[-] OpenThreadToken failed with error code: 0x%x\n", GetLastError());
return FALSE;
}
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken)) {
printf("[-] OpenProcessToken failed with error code:0x%x\n", GetLastError());
printf("[-] OpenProcessToken failed with error code: 0x%x\n", GetLastError());
return FALSE;
}
}
if (!LookupPrivilegeValueA(NULL, "SeDebugPrivilege", &tokenPrivileges.Privileges[0].Luid)){
printf("[-] LookupPrivilegeValueA failed with error code:0x%x\n", GetLastError());
printf("[-] LookupPrivilegeValueA failed with error code: 0x%x\n", GetLastError());
CloseHandle(hToken);
return FALSE;
}
@@ -81,7 +81,7 @@ BOOL EnableSeDebugPrivilege() {
tokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if (!AdjustTokenPrivileges(hToken, FALSE, &tokenPrivileges, sizeof(TOKEN_PRIVILEGES), NULL, NULL)) {
printf("[-] AdjustTokenPrivileges failed with error code:0x%x\n", GetLastError());
printf("[-] AdjustTokenPrivileges failed with error code: 0x%x\n", GetLastError());
CloseHandle(hToken);
return FALSE;
}
@@ -100,7 +100,7 @@ void CharArrayToWCharArray(const char charArray[], WCHAR wCharArray[], size_t wC
int result = MultiByteToWideChar(CP_UTF8, 0, charArray, -1, wCharArray, wCharArraySize);
if (result == 0) {
printf("[-] MultiByteToWideChar failed with error code:0x%x\n", GetLastError());
printf("[-] MultiByteToWideChar failed with error code: 0x%x\n", GetLastError());
wCharArray[0] = L'\0';
}
}