Initial commit for public version

Co-authored-by: Thomas Diot <thomas.diot@wavestone.com>
2026-06-11 01:41:20 +00:00 · 2021-11-08 09:54:05 +01:00
commit 4bff81986b
42 changed files with 8490 additions and 0 deletions
@@ -0,0 +1,64 @@
+#pragma once
+#include <Windows.h>
+#include "Undoc.h"
+#include "PEParser.h"
+#include "PEBBrowse.h"
+#include <stdio.h>
+#include <TlHelp32.h>
+#include <DbgHelp.h>
+#include <pathcch.h>
+
+typedef struct diff_t {
+	PVOID disk_ptr;
+	PVOID mem_ptr;
+	size_t size;
+} diff;
+
+typedef struct hook_t {
+	PVOID disk_function;
+	PVOID mem_function;
+	LPCSTR functionName;
+	diff* list_patches;
+} hook;
+
+typedef NTSTATUS(NTAPI* pNtProtectVirtualMemory) (
+	IN HANDLE               ProcessHandle,
+	IN OUT PVOID* BaseAddress,
+	IN OUT PSIZE_T           NumberOfBytesToProtect,
+	IN ULONG                NewAccessProtection,
+	OUT PULONG              OldAccessProtection);
+
+typedef NTSTATUS(NTAPI* pRtlGetVersion)(
+	OUT LPOSVERSIONINFOEXW lpVersionInformation);
+
+enum unhook_method_e {
+	UNHOOK_NONE,
+
+	// Uses the (probably monitored) NtProtectVirtualMemory function in ntdll to remove all detected hooks
+	UNHOOK_WITH_NTPROTECTVIRTUALMEMORY,
+
+	// Constructs an "unhooked" (i.e. unmonitored) version of NtProtectVirtualMemory, by allocating an executable trampoling jumping over the hook, and remove all detected hooks
+	UNHOOK_WITH_INHOUSE_NTPROTECTVIRTUALMEMORY_TRAMPOLINE,
+
+	// Search for an existing trampoline allocated by the EDR itself, to get an "unhooked" (i.e. unmonitored) version of NtProtectVirtualMemory, and remove all detected hooks
+	UNHOOK_WITH_EDR_NTPROTECTVIRTUALMEMORY_TRAMPOLINE,
+
+	// Loads an additionnal version of ntdll library into memory, and use the (hopefully unmonitored) version of NtProtectVirtualMemory present in this library to remove all detected hooks
+	UNHOOK_WITH_DUPLICATE_NTPROTECTVIRTUALMEMORY,
+
+	// Allocates a shellcode that uses a direct syscall to call NtProtectVirtualMemory, and uses it to remove all detected hooks
+	UNHOOK_WITH_DIRECT_SYSCALL
+};
+
+hook* searchHooks(const char* csvFileName);
+PVOID hookResolver(PBYTE hookAddr);
+pNtProtectVirtualMemory getSafeVirtualProtectUsingTrampoline(DWORD unhook_method);
+VOID unhook(hook* hook, DWORD unhook_method);
+
+
+/*
+* Cache for NTDLL PE (accessed often)
+*/
+PE* ntdllDiskPe_g;
+PE* ntdllMemPe_g;
+void getNtdllPEs(PE** ntdllPE_mem, PE** ntdllPE_disk);