mirror of
https://github.com/wavestone-cdt/EDRSandblast.git
synced 2026-06-08 16:37:12 +00:00
Qazeer
121 lines
3.5 KiB
C
121 lines
3.5 KiB
C
#pragma once
|
|
|
|
// Code below is adapted from @modexpblog. Read linked article for more details.
|
|
// https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams
|
|
|
|
#ifndef SW2_HEADER_H_
|
|
#define SW2_HEADER_H_
|
|
|
|
#include <windows.h>
|
|
|
|
#include "Undoc.h"
|
|
|
|
#define SW2_SEED 0xE14B0D06
|
|
#define SW2_ROL8(v) (v << 8 | v >> 24)
|
|
#define SW2_ROR8(v) (v >> 8 | v << 24)
|
|
#define SW2_ROX8(v) ((SW2_SEED % 2) ? SW2_ROL8(v) : SW2_ROR8(v))
|
|
#define SW2_MAX_ENTRIES 500
|
|
#define SW2_RVA2VA(Type, DllBase, Rva) (Type)((ULONG_PTR) DllBase + Rva)
|
|
|
|
// Typedefs are prefixed to avoid pollution.
|
|
|
|
typedef struct _SW2_SYSCALL_ENTRY
|
|
{
|
|
DWORD Hash;
|
|
DWORD RVA;
|
|
DWORD SyscallNumber;
|
|
} SW2_SYSCALL_ENTRY, * PSW2_SYSCALL_ENTRY;
|
|
|
|
typedef struct _SW2_SYSCALL_LIST
|
|
{
|
|
DWORD Count;
|
|
SW2_SYSCALL_ENTRY Entries[SW2_MAX_ENTRIES];
|
|
} SW2_SYSCALL_LIST, * PSW2_SYSCALL_LIST;
|
|
|
|
|
|
DWORD SW2_HashSyscall(PCSTR FunctionName);
|
|
BOOL SW2_PopulateSyscallList(void);
|
|
EXTERN_C DWORD SW2_GetSyscallNumber(DWORD FunctionHash);
|
|
|
|
#ifndef InitializeObjectAttributes
|
|
#define InitializeObjectAttributes( p, n, a, r, s ) { \
|
|
(p)->Length = sizeof( OBJECT_ATTRIBUTES ); \
|
|
(p)->RootDirectory = r; \
|
|
(p)->Attributes = a; \
|
|
(p)->ObjectName = n; \
|
|
(p)->SecurityDescriptor = s; \
|
|
(p)->SecurityQualityOfService = NULL; \
|
|
}
|
|
#endif
|
|
|
|
EXTERN_C NTSTATUS NtGetNextProcess(
|
|
IN HANDLE ProcessHandle,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN ULONG HandleAttributes,
|
|
IN ULONG Flags,
|
|
OUT PHANDLE NewProcessHandle);
|
|
|
|
EXTERN_C NTSTATUS NtQueryInformationProcess(
|
|
IN HANDLE ProcessHandle,
|
|
IN PROCESSINFOCLASS ProcessInformationClass,
|
|
OUT PVOID ProcessInformation,
|
|
IN ULONG ProcessInformationLength,
|
|
OUT PULONG ReturnLength OPTIONAL);
|
|
|
|
EXTERN_C NTSTATUS NtClose(
|
|
IN HANDLE Handle);
|
|
|
|
EXTERN_C NTSTATUS NtAllocateVirtualMemory(
|
|
IN HANDLE ProcessHandle,
|
|
IN OUT PVOID* BaseAddress,
|
|
IN ULONG ZeroBits,
|
|
IN OUT PSIZE_T RegionSize,
|
|
IN ULONG AllocationType,
|
|
IN ULONG Protect);
|
|
|
|
EXTERN_C NTSTATUS NtOpenProcess(
|
|
OUT PHANDLE ProcessHandle,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes,
|
|
IN PCLIENT_ID ClientId OPTIONAL);
|
|
|
|
EXTERN_C NTSTATUS NtQueryVirtualMemory(
|
|
IN HANDLE ProcessHandle,
|
|
IN PVOID BaseAddress,
|
|
IN MEMORY_INFORMATION_CLASS MemoryInformationClass,
|
|
OUT PVOID MemoryInformation,
|
|
IN SIZE_T MemoryInformationLength,
|
|
OUT PSIZE_T ReturnLength OPTIONAL);
|
|
|
|
EXTERN_C NTSTATUS NtReadVirtualMemory(
|
|
IN HANDLE ProcessHandle,
|
|
IN PVOID BaseAddress OPTIONAL,
|
|
OUT PVOID Buffer,
|
|
IN SIZE_T BufferSize,
|
|
OUT PSIZE_T NumberOfBytesRead OPTIONAL);
|
|
|
|
EXTERN_C NTSTATUS NtCreateFile(
|
|
OUT PHANDLE FileHandle,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN PLARGE_INTEGER AllocationSize OPTIONAL,
|
|
IN ULONG FileAttributes,
|
|
IN ULONG ShareAccess,
|
|
IN ULONG CreateDisposition,
|
|
IN ULONG CreateOptions,
|
|
IN PVOID EaBuffer OPTIONAL,
|
|
IN ULONG EaLength);
|
|
|
|
EXTERN_C NTSTATUS NtWriteFile(
|
|
IN HANDLE FileHandle,
|
|
IN HANDLE Event OPTIONAL,
|
|
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
|
|
IN PVOID ApcContext OPTIONAL,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN PVOID Buffer,
|
|
IN ULONG Length,
|
|
IN PLARGE_INTEGER ByteOffset OPTIONAL,
|
|
IN PULONG Key OPTIONAL);
|
|
|
|
#endif |