添加项目文件。
This commit is contained in:
Huoji's
51
CowInject.sln
Normal file
51
CowInject.sln
Normal file
@@ -0,0 +1,51 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio Version 16
|
||||
VisualStudioVersion = 16.0.29613.14
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CowInject", "CowInject\CowInject.vcxproj", "{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|ARM = Debug|ARM
|
||||
Debug|ARM64 = Debug|ARM64
|
||||
Debug|x64 = Debug|x64
|
||||
Debug|x86 = Debug|x86
|
||||
Release|ARM = Release|ARM
|
||||
Release|ARM64 = Release|ARM64
|
||||
Release|x64 = Release|x64
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Debug|ARM.ActiveCfg = Debug|ARM
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Debug|ARM.Build.0 = Debug|ARM
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Debug|ARM.Deploy.0 = Debug|ARM
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Debug|ARM64.ActiveCfg = Debug|ARM64
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Debug|ARM64.Build.0 = Debug|ARM64
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Debug|ARM64.Deploy.0 = Debug|ARM64
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Debug|x64.Build.0 = Debug|x64
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Debug|x64.Deploy.0 = Debug|x64
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Debug|x86.ActiveCfg = Debug|Win32
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Debug|x86.Build.0 = Debug|Win32
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Debug|x86.Deploy.0 = Debug|Win32
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Release|ARM.ActiveCfg = Release|ARM
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Release|ARM.Build.0 = Release|ARM
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Release|ARM.Deploy.0 = Release|ARM
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Release|ARM64.ActiveCfg = Release|ARM64
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Release|ARM64.Build.0 = Release|ARM64
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Release|ARM64.Deploy.0 = Release|ARM64
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Release|x64.ActiveCfg = Release|x64
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Release|x64.Build.0 = Release|x64
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Release|x64.Deploy.0 = Release|x64
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Release|x86.ActiveCfg = Release|Win32
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Release|x86.Build.0 = Release|Win32
|
||||
{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}.Release|x86.Deploy.0 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||
SolutionGuid = {8B54FB70-B3D2-4C49-87D4-AED93842E605}
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
32
CowInject/CowInject.inf
Normal file
32
CowInject/CowInject.inf
Normal file
@@ -0,0 +1,32 @@
|
||||
;
|
||||
; CowInject.inf
|
||||
;
|
||||
|
||||
[Version]
|
||||
Signature="$WINDOWS NT$"
|
||||
Class=System
|
||||
ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318}
|
||||
Provider=%ManufacturerName%
|
||||
DriverVer=
|
||||
CatalogFile=CowInject.cat
|
||||
|
||||
[DestinationDirs]
|
||||
DefaultDestDir = 12
|
||||
|
||||
|
||||
[SourceDisksNames]
|
||||
1 = %DiskName%,,,""
|
||||
|
||||
[SourceDisksFiles]
|
||||
|
||||
|
||||
[Manufacturer]
|
||||
%ManufacturerName%=Standard,NT$ARCH$
|
||||
|
||||
[Standard.NT$ARCH$]
|
||||
|
||||
|
||||
[Strings]
|
||||
ManufacturerName="<Your manufacturer name>" ;TODO: Replace with your manufacturer name
|
||||
ClassName=""
|
||||
DiskName="CowInject Source Disk"
|
||||
166
CowInject/CowInject.vcxproj
Normal file
166
CowInject/CowInject.vcxproj
Normal file
@@ -0,0 +1,166 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|ARM">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>ARM</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|ARM">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>ARM</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|ARM64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>ARM64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|ARM64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>ARM64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<ProjectGuid>{8E8EC6B8-E5C6-4B06-A8F2-9F0F5EA685BB}</ProjectGuid>
|
||||
<TemplateGuid>{dd38f7fc-d7bd-488b-9242-7d8754cde80d}</TemplateGuid>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform Condition="'$(Platform)' == ''">Win32</Platform>
|
||||
<RootNamespace>CowInject</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>WDM</DriverType>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>WDM</DriverType>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>WDM</DriverType>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<TargetVersion>Windows7</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>WDM</DriverType>
|
||||
<SpectreMitigation>false</SpectreMitigation>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>WDM</DriverType>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>WDM</DriverType>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>WDM</DriverType>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>WDM</DriverType>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
<EnableInf2cat>false</EnableInf2cat>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<ClCompile>
|
||||
<TreatWarningAsError>false</TreatWarningAsError>
|
||||
<BufferSecurityCheck>false</BufferSecurityCheck>
|
||||
<Optimization>MinSpace</Optimization>
|
||||
<FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<WholeProgramOptimization>false</WholeProgramOptimization>
|
||||
</ClCompile>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<Inf Include="CowInject.inf" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<FilesToPackage Include="$(TargetPath)" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="helper.cpp" />
|
||||
<ClCompile Include="main.cpp" />
|
||||
<ClCompile Include="shell_code_end.cpp" />
|
||||
<ClCompile Include="shell_code_start.cpp" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="head.h" />
|
||||
<ClInclude Include="main.h" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
54
CowInject/CowInject.vcxproj.filters
Normal file
54
CowInject/CowInject.vcxproj.filters
Normal file
@@ -0,0 +1,54 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Source Files">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Header Files">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Resource Files">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Driver Files">
|
||||
<UniqueIdentifier>{8E41214B-6785-4CFE-B992-037D68949A14}</UniqueIdentifier>
|
||||
<Extensions>inf;inv;inx;mof;mc;</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Source Files\Shellcode">
|
||||
<UniqueIdentifier>{41db35f4-72e8-49d7-81ea-9a18fea3e160}</UniqueIdentifier>
|
||||
</Filter>
|
||||
<Filter Include="Source Files\ThirdParty">
|
||||
<UniqueIdentifier>{9e17b26d-f5cd-4288-962a-5943271da071}</UniqueIdentifier>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Inf Include="CowInject.inf">
|
||||
<Filter>Driver Files</Filter>
|
||||
</Inf>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="head.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="main.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="main.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="shell_code_start.cpp">
|
||||
<Filter>Source Files\Shellcode</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="shell_code_end.cpp">
|
||||
<Filter>Source Files\Shellcode</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="helper.cpp">
|
||||
<Filter>Source Files\ThirdParty</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
232
CowInject/head.h
Normal file
232
CowInject/head.h
Normal file
@@ -0,0 +1,232 @@
|
||||
#pragma once
|
||||
#include <ntifs.h>
|
||||
#include <ntstrsafe.h>
|
||||
#include <ntimage.h>
|
||||
#include <WinDef.h>
|
||||
#include <intrin.h>
|
||||
#define DebugPrintA(...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL,__VA_ARGS__)
|
||||
#define HUOJI_POOL_TAG 'huoJ'
|
||||
#define CALCSIZE(n,f) (ULONG_PTR)f - (ULONG_PTR)n
|
||||
#define PAGE_ALIGN(Va) ((PVOID)((ULONG_PTR)(Va) & ~(PAGE_SIZE - 1)))
|
||||
#define DEREF( name )*(UINT_PTR *)(name)
|
||||
#define DEREF_64( name )*(unsigned __int64 *)(name)
|
||||
#define DEREF_32( name )*(unsigned long *)(name)
|
||||
#define DEREF_16( name )*(unsigned short *)(name)
|
||||
#define DEREF_8( name )*(UCHAR *)(name)
|
||||
typedef HMODULE(WINAPI* LOADLIBRARYA)(LPCSTR);
|
||||
typedef FARPROC(WINAPI* GETPROCADDRESS)(HMODULE, LPCSTR);
|
||||
typedef LPVOID(WINAPI* VIRTUALALLOC)(LPVOID, SIZE_T, DWORD, DWORD);
|
||||
typedef DWORD(NTAPI* NTFLUSHINSTRUCTIONCACHE)(HANDLE, PVOID, ULONG);
|
||||
|
||||
typedef BOOL(WINAPI* ReadFileT)(HANDLE, LPVOID, DWORD, LPDWORD, PVOID);
|
||||
typedef DWORD(WINAPI* GetFileSizeT)(HANDLE, LPDWORD);
|
||||
typedef BOOL(WINAPI* CloseHandleT)(HANDLE);
|
||||
|
||||
#define KERNEL32DLL_HASH 0x6A4ABC5B
|
||||
#define NTDLLDLL_HASH 0x3CFA685D
|
||||
#define LOADLIBRARYA_HASH 0xEC0E4E8E
|
||||
#define GETPROCADDRESS_HASH 0x7C0DFCAA
|
||||
#define VIRTUALALLOC_HASH 0x91AFCA54
|
||||
#define NTFLUSHINSTRUCTIONCACHE_HASH 0x534C0AB8
|
||||
#define HASH_KEY 13
|
||||
#define DLL_PROCESS_ATTACH 1
|
||||
#define DLL_THREAD_ATTACH 2
|
||||
#define DLL_THREAD_DETACH 3
|
||||
#define DLL_PROCESS_DETACH 0
|
||||
|
||||
typedef enum _SYSTEM_INFORMATION_CLASS
|
||||
{
|
||||
SystemBasicInformation, // 0x00 SYSTEM_BASIC_INFORMATION
|
||||
SystemProcessorInformation, // 0x01 SYSTEM_PROCESSOR_INFORMATION
|
||||
SystemPerformanceInformation, // 0x02
|
||||
SystemTimeOfDayInformation, // 0x03
|
||||
SystemPathInformation, // 0x04
|
||||
SystemProcessInformation, // 0x05
|
||||
SystemCallCountInformation, // 0x06
|
||||
SystemDeviceInformation, // 0x07
|
||||
SystemProcessorPerformanceInformation, // 0x08
|
||||
SystemFlagsInformation, // 0x09
|
||||
SystemCallTimeInformation, // 0x0A
|
||||
SystemModuleInformation, // 0x0B SYSTEM_MODULE_INFORMATION
|
||||
SystemLocksInformation, // 0x0C
|
||||
SystemStackTraceInformation, // 0x0D
|
||||
SystemPagedPoolInformation, // 0x0E
|
||||
SystemNonPagedPoolInformation, // 0x0F
|
||||
SystemHandleInformation, // 0x10
|
||||
SystemObjectInformation, // 0x11
|
||||
SystemPageFileInformation, // 0x12
|
||||
SystemVdmInstemulInformation, // 0x13
|
||||
SystemVdmBopInformation, // 0x14
|
||||
SystemFileCacheInformation, // 0x15
|
||||
SystemPoolTagInformation, // 0x16
|
||||
SystemInterruptInformation, // 0x17
|
||||
SystemDpcBehaviorInformation, // 0x18
|
||||
SystemFullMemoryInformation, // 0x19
|
||||
SystemLoadGdiDriverInformation, // 0x1A
|
||||
SystemUnloadGdiDriverInformation, // 0x1B
|
||||
SystemTimeAdjustmentInformation, // 0x1C
|
||||
SystemSummaryMemoryInformation, // 0x1D
|
||||
SystemNextEventIdInformation, // 0x1E
|
||||
SystemEventIdsInformation, // 0x1F
|
||||
SystemCrashDumpInformation, // 0x20
|
||||
SystemExceptionInformation, // 0x21
|
||||
SystemCrashDumpStateInformation, // 0x22
|
||||
SystemKernelDebuggerInformation, // 0x23
|
||||
SystemContextSwitchInformation, // 0x24
|
||||
SystemRegistryQuotaInformation, // 0x25
|
||||
SystemExtendServiceTableInformation, // 0x26
|
||||
SystemPrioritySeperation, // 0x27
|
||||
SystemPlugPlayBusInformation, // 0x28
|
||||
SystemDockInformation, // 0x29
|
||||
//SystemPowerInformation, // 0x2A
|
||||
//SystemProcessorSpeedInformation, // 0x2B
|
||||
//SystemCurrentTimeZoneInformation, // 0x2C
|
||||
//SystemLookasideInformation // 0x2D
|
||||
|
||||
} SYSTEM_INFORMATION_CLASS, * PSYSTEM_INFORMATION_CLASS;
|
||||
|
||||
typedef BOOL(WINAPI* DLLMAIN)(HINSTANCE, DWORD, LPVOID);
|
||||
typedef struct _LDR_DATA_TABLE_ENTRY {
|
||||
LIST_ENTRY InLoadOrderLinks;
|
||||
LIST_ENTRY InMemoryOrderLinks;
|
||||
LIST_ENTRY InInitializationOrderLinks;
|
||||
PVOID DllBase;
|
||||
PVOID EntryPoint;
|
||||
ULONG SizeOfImages;
|
||||
UNICODE_STRING FullDllName;
|
||||
UNICODE_STRING BaseDllName;
|
||||
ULONG Flags;
|
||||
USHORT LoadCount;
|
||||
USHORT TlsIndex;
|
||||
union {
|
||||
LIST_ENTRY HashLinks;
|
||||
struct {
|
||||
PVOID SectionPointer;
|
||||
ULONG CheckSum;
|
||||
};
|
||||
};
|
||||
union {
|
||||
struct {
|
||||
ULONG TimeDateStamp;
|
||||
};
|
||||
struct {
|
||||
PVOID LoadedImports;
|
||||
};
|
||||
};
|
||||
}LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
WORD offset : 12;
|
||||
WORD type : 4;
|
||||
} IMAGE_RELOC, * PIMAGE_RELOC;
|
||||
typedef struct _NT_PROC_THREAD_ATTRIBUTE_ENTRY
|
||||
{
|
||||
ULONG Attribute; // PROC_THREAD_ATTRIBUTE_XXX
|
||||
SIZE_T Size;
|
||||
ULONG_PTR Value;
|
||||
ULONG Unknown;
|
||||
} NT_PROC_THREAD_ATTRIBUTE_ENTRY, * NT_PPROC_THREAD_ATTRIBUTE_ENTRY;
|
||||
typedef struct _NT_PROC_THREAD_ATTRIBUTE_LIST
|
||||
{
|
||||
ULONG Length;
|
||||
NT_PROC_THREAD_ATTRIBUTE_ENTRY Entry[1];
|
||||
} NT_PROC_THREAD_ATTRIBUTE_LIST, * PNT_PROC_THREAD_ATTRIBUTE_LIST;
|
||||
|
||||
typedef struct _SECURITY_ATTRIBUTES {
|
||||
DWORD nLength;
|
||||
LPVOID lpSecurityDescriptor;
|
||||
BOOL bInheritHandle;
|
||||
} SECURITY_ATTRIBUTES, * PSECURITY_ATTRIBUTES, * LPSECURITY_ATTRIBUTES;
|
||||
typedef HANDLE(WINAPI* CreateFileWT)(
|
||||
_In_ LPCWSTR lpFileName,
|
||||
_In_ DWORD dwDesiredAccess,
|
||||
_In_ DWORD dwShareMode,
|
||||
_In_opt_ LPSECURITY_ATTRIBUTES lpSecurityAttributes,
|
||||
_In_ DWORD dwCreationDisposition,
|
||||
_In_ DWORD dwFlagsAndAttributes,
|
||||
_In_opt_ HANDLE hTemplateFile
|
||||
);
|
||||
typedef DWORD(WINAPI* GetModuleFileNameWT)(HMODULE hModule, LPCWSTR lpFilename, DWORD nSize);
|
||||
typedef wchar_t* (WINAPI* wcsstrAt)(wchar_t const* _String1, wchar_t const* _String);
|
||||
typedef HMODULE(WINAPI* LoadLibraryWT)(_In_ LPCWSTR lpLibFileName);
|
||||
#ifdef __cplusplus
|
||||
extern "C"
|
||||
{
|
||||
#endif
|
||||
#include <NTDDK.h>
|
||||
NTSYSAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
ZwQuerySystemInformation(
|
||||
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
|
||||
OUT PVOID SystemInformation,
|
||||
IN ULONG SystemInformationLength,
|
||||
OUT PULONG ReturnLength OPTIONAL
|
||||
);
|
||||
NTKERNELAPI
|
||||
NTSTATUS
|
||||
ObReferenceObjectByName(
|
||||
IN PUNICODE_STRING ObjectName,
|
||||
IN ULONG Attributes,
|
||||
IN PACCESS_STATE PassedAccessState,
|
||||
IN ACCESS_MASK DesiredAccess,
|
||||
IN POBJECT_TYPE ObjectType,
|
||||
IN KPROCESSOR_MODE AccessMode,
|
||||
IN OUT PVOID ParseContext,
|
||||
OUT PVOID* Object
|
||||
);
|
||||
extern POBJECT_TYPE* IoDriverObjectType;
|
||||
|
||||
ULONG
|
||||
NTAPI
|
||||
KeCapturePersistentThreadState(
|
||||
IN PCONTEXT Context,
|
||||
IN PKTHREAD Thread,
|
||||
IN ULONG BugCheckCode,
|
||||
IN ULONG BugCheckParameter1,
|
||||
IN ULONG BugCheckParameter2,
|
||||
IN ULONG BugCheckParameter3,
|
||||
IN ULONG BugCheckParameter4,
|
||||
OUT PVOID VirtualAddress
|
||||
);
|
||||
NTSYSAPI
|
||||
PVOID
|
||||
NTAPI
|
||||
RtlImageDirectoryEntryToData(
|
||||
PVOID ImageBase,
|
||||
BOOLEAN MappedAsImage,
|
||||
USHORT DirectoryEntry,
|
||||
PULONG Size
|
||||
);
|
||||
NTKERNELAPI
|
||||
PPEB
|
||||
NTAPI
|
||||
PsGetProcessPeb(IN PEPROCESS Process);
|
||||
NTKERNELAPI PVOID NTAPI PsGetProcessWow64Process(IN PEPROCESS Process);
|
||||
NTSYSAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
ZwProtectVirtualMemory(
|
||||
IN HANDLE ProcessHandle,
|
||||
IN OUT PVOID* BaseAddress,
|
||||
IN OUT SIZE_T* NumberOfBytesToProtect,
|
||||
IN ULONG NewAccessProtection,
|
||||
OUT PULONG OldAccessProtection
|
||||
);
|
||||
|
||||
NTSYSAPI
|
||||
NTSTATUS
|
||||
NTAPI
|
||||
ZwQueryInformationThread(
|
||||
IN HANDLE ThreadHandle,
|
||||
IN THREADINFOCLASS ThreadInformationClass,
|
||||
OUT PVOID ThreadInformation,
|
||||
IN ULONG ThreadInformationLength,
|
||||
OUT PULONG ReturnLength OPTIONAL
|
||||
);
|
||||
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
143
CowInject/helper.cpp
Normal file
143
CowInject/helper.cpp
Normal file
@@ -0,0 +1,143 @@
|
||||
#include "head.h"
|
||||
/*
|
||||
from google
|
||||
*/
|
||||
ULONG_PTR GetProcAddressR(ULONG_PTR hModule, const char* lpProcName, BOOL x64Module)
|
||||
{
|
||||
UINT_PTR uiLibraryAddress = 0;
|
||||
ULONG_PTR fpResult = NULL;
|
||||
if (hModule == NULL)
|
||||
return NULL;
|
||||
// a module handle is really its base address
|
||||
uiLibraryAddress = (UINT_PTR)hModule;
|
||||
__try
|
||||
{
|
||||
UINT_PTR uiAddressArray = 0;
|
||||
UINT_PTR uiNameArray = 0;
|
||||
UINT_PTR uiNameOrdinals = 0;
|
||||
PIMAGE_NT_HEADERS32 pNtHeaders32 = NULL;
|
||||
PIMAGE_NT_HEADERS64 pNtHeaders64 = NULL;
|
||||
PIMAGE_DATA_DIRECTORY pDataDirectory = NULL;
|
||||
PIMAGE_EXPORT_DIRECTORY pExportDirectory = NULL;
|
||||
|
||||
// get the VA of the modules NT Header
|
||||
pNtHeaders32 = (PIMAGE_NT_HEADERS32)(uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew);
|
||||
pNtHeaders64 = (PIMAGE_NT_HEADERS64)(uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew);
|
||||
if (x64Module)
|
||||
{
|
||||
pDataDirectory = (PIMAGE_DATA_DIRECTORY)&pNtHeaders64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
|
||||
}
|
||||
else
|
||||
{
|
||||
pDataDirectory = (PIMAGE_DATA_DIRECTORY)&pNtHeaders32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
|
||||
}
|
||||
|
||||
|
||||
// get the VA of the export directory
|
||||
pExportDirectory = (PIMAGE_EXPORT_DIRECTORY)(uiLibraryAddress + pDataDirectory->VirtualAddress);
|
||||
|
||||
// get the VA for the array of addresses
|
||||
uiAddressArray = (uiLibraryAddress + pExportDirectory->AddressOfFunctions);
|
||||
|
||||
// get the VA for the array of name pointers
|
||||
uiNameArray = (uiLibraryAddress + pExportDirectory->AddressOfNames);
|
||||
|
||||
// get the VA for the array of name ordinals
|
||||
uiNameOrdinals = (uiLibraryAddress + pExportDirectory->AddressOfNameOrdinals);
|
||||
|
||||
// test if we are importing by name or by ordinal...
|
||||
if ((PtrToUlong(lpProcName) & 0xFFFF0000) == 0x00000000)
|
||||
{
|
||||
// import by ordinal...
|
||||
|
||||
// use the import ordinal (- export ordinal base) as an index into the array of addresses
|
||||
uiAddressArray += ((IMAGE_ORDINAL(PtrToUlong(lpProcName)) - pExportDirectory->Base) * sizeof(unsigned long));
|
||||
|
||||
// resolve the address for this imported function
|
||||
fpResult = (ULONG_PTR)(uiLibraryAddress + DEREF_32(uiAddressArray));
|
||||
}
|
||||
else
|
||||
{
|
||||
// import by name...
|
||||
unsigned long dwCounter = pExportDirectory->NumberOfNames;
|
||||
while (dwCounter--)
|
||||
{
|
||||
char* cpExportedFunctionName = (char*)(uiLibraryAddress + DEREF_32(uiNameArray));
|
||||
|
||||
// test if we have a match...
|
||||
if (strcmp(cpExportedFunctionName, lpProcName) == 0)
|
||||
{
|
||||
// use the functions name ordinal as an index into the array of name pointers
|
||||
uiAddressArray += (DEREF_16(uiNameOrdinals) * sizeof(unsigned long));
|
||||
|
||||
// calculate the virtual address for the function
|
||||
fpResult = (ULONG_PTR)(uiLibraryAddress + DEREF_32(uiAddressArray));
|
||||
|
||||
// finish...
|
||||
break;
|
||||
}
|
||||
|
||||
// get the next exported function name
|
||||
uiNameArray += sizeof(unsigned long);
|
||||
|
||||
// get the next exported function name ordinal
|
||||
uiNameOrdinals += sizeof(unsigned short);
|
||||
}
|
||||
}
|
||||
}
|
||||
__except (EXCEPTION_EXECUTE_HANDLER)
|
||||
{
|
||||
fpResult = NULL;
|
||||
}
|
||||
return fpResult;
|
||||
}
|
||||
/*
|
||||
from blackbone
|
||||
*/
|
||||
LONG BlackBoneSafeSearchString(IN PUNICODE_STRING source, IN PUNICODE_STRING target, IN BOOLEAN CaseInSensitive)
|
||||
{
|
||||
ASSERT(source != NULL && target != NULL);
|
||||
if (source == NULL || target == NULL || source->Buffer == NULL || target->Buffer == NULL)
|
||||
return STATUS_INVALID_PARAMETER;
|
||||
|
||||
// Size mismatch
|
||||
if (source->Length < target->Length)
|
||||
return -1;
|
||||
|
||||
USHORT diff = source->Length - target->Length;
|
||||
for (USHORT i = 0; i <= (diff / sizeof(WCHAR)); i++)
|
||||
{
|
||||
if (RtlCompareUnicodeStrings(
|
||||
source->Buffer + i,
|
||||
target->Length / sizeof(WCHAR),
|
||||
target->Buffer,
|
||||
target->Length / sizeof(WCHAR),
|
||||
CaseInSensitive
|
||||
) == 0)
|
||||
{
|
||||
return i;
|
||||
}
|
||||
}
|
||||
|
||||
return -1;
|
||||
}
|
||||
/*
|
||||
from windows explorer
|
||||
*/
|
||||
bool _memcpy(PVOID address, PVOID target_address, ULONG length)
|
||||
{
|
||||
bool result = false;
|
||||
PHYSICAL_ADDRESS physicial_address;
|
||||
physicial_address = MmGetPhysicalAddress(address);
|
||||
if (physicial_address.QuadPart)
|
||||
{
|
||||
PVOID maped_mem = MmMapIoSpace(physicial_address, length, MmNonCached);
|
||||
if (maped_mem)
|
||||
{
|
||||
memcpy(maped_mem, target_address, length);
|
||||
MmUnmapIoSpace(maped_mem, length);
|
||||
result = true;
|
||||
}
|
||||
}
|
||||
return result;
|
||||
}
|
||||
240
CowInject/main.cpp
Normal file
240
CowInject/main.cpp
Normal file
@@ -0,0 +1,240 @@
|
||||
#include "head.h"
|
||||
#include "main.h"
|
||||
struct moudle_info
|
||||
{
|
||||
uintptr_t bsae;
|
||||
uintptr_t size;
|
||||
};
|
||||
bool get_moudle_base(PEPROCESS process, moudle_info* kernel32, moudle_info* ntdll, moudle_info* kernelbase) {
|
||||
PPEB peb = PsGetProcessPeb(process);
|
||||
bool result = false;
|
||||
if (peb == NULL)
|
||||
return result;
|
||||
DebugPrintA("process peb: %p \n", peb);
|
||||
//PEB + 0x18 = PEB.Ldr
|
||||
auto peb_ldr = *(PDWORD64)((PUCHAR)peb + 0x18);
|
||||
//Pebldr + 0x10 = InLoadOrderModuleList
|
||||
PLIST_ENTRY module_list_head = (PLIST_ENTRY)((PUCHAR)peb_ldr + 0x10);
|
||||
PLIST_ENTRY moudle = module_list_head->Flink;
|
||||
/*
|
||||
win7: kernel32.dll
|
||||
win10: KERNEL32.DLL
|
||||
*/
|
||||
wchar_t moudle_list[][15] = {
|
||||
{L"kernel32.dll"},
|
||||
{L"ntdll.dll"},
|
||||
{L"kernelbase.dll"},
|
||||
};
|
||||
while (module_list_head != moudle)
|
||||
{
|
||||
PLDR_DATA_TABLE_ENTRY info = (PLDR_DATA_TABLE_ENTRY)moudle;
|
||||
UNICODE_STRING str_moudle_name;
|
||||
for (size_t i = 0; i < sizeof(moudle_list); i++)
|
||||
{
|
||||
RtlInitUnicodeString(&str_moudle_name, moudle_list[i]);
|
||||
if (BlackBoneSafeSearchString(&info->BaseDllName, &str_moudle_name, true) != -1)
|
||||
{
|
||||
DebugPrintA("MoudleBase %p Size %p Name %wZ\n", info->DllBase, info->SizeOfImages, info->BaseDllName);
|
||||
if (i == 0) {
|
||||
kernel32->bsae = (uintptr_t)info->DllBase;
|
||||
kernel32->size = (uintptr_t)info->SizeOfImages;
|
||||
}
|
||||
if (i == 1) {
|
||||
ntdll->bsae = (uintptr_t)info->DllBase;
|
||||
ntdll->size = (uintptr_t)info->SizeOfImages;
|
||||
}
|
||||
if (i == 2) {
|
||||
kernelbase->bsae = (uintptr_t)info->DllBase;
|
||||
kernelbase->size = (uintptr_t)info->SizeOfImages;
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (kernel32->bsae && ntdll->bsae && kernelbase->bsae)
|
||||
break;
|
||||
moudle = moudle->Flink;
|
||||
}
|
||||
result = kernel32->bsae != NULL && ntdll->bsae != NULL && kernelbase->bsae != NULL;
|
||||
DebugPrintA("kernel32->bsae %p sizeof:%p ntdll->bsae %p kernelbase->bsae %p result: %d \n", kernel32->bsae, kernel32->size, ntdll->bsae, kernelbase->bsae, result);
|
||||
|
||||
return result;
|
||||
}
|
||||
uintptr_t get_free_speace(uintptr_t base, size_t size, size_t need_size) {
|
||||
size_t return_length;
|
||||
|
||||
for (uintptr_t address = (uintptr_t)base; address <= (uintptr_t)base + size; address += sizeof(uintptr_t)) {
|
||||
__try
|
||||
{
|
||||
ProbeForRead((void*)address, need_size, 0x1);
|
||||
if (*(uintptr_t*)address == 0x00 || *(uintptr_t*)address == 0x90)
|
||||
{
|
||||
MEMORY_BASIC_INFORMATION memory_information = { 0 };
|
||||
NTSTATUS status = ZwQueryVirtualMemory(NtCurrentProcess(), (PVOID)address, (MEMORY_INFORMATION_CLASS)0, &memory_information, need_size, &return_length);
|
||||
if (NT_SUCCESS(status)) {
|
||||
if ((memory_information.Protect == PAGE_EXECUTE || memory_information.Protect == PAGE_EXECUTE_READ || memory_information.Protect == PAGE_EXECUTE_READWRITE || memory_information.Protect == PAGE_EXECUTE_WRITECOPY) == false) {
|
||||
continue;
|
||||
}
|
||||
}
|
||||
DebugPrintA("address : %p \n", address);
|
||||
uintptr_t count = 0;
|
||||
bool is_good = true;
|
||||
uintptr_t max_count = 0;
|
||||
for (; count < need_size && is_good; count += sizeof(uintptr_t))
|
||||
{
|
||||
max_count++;
|
||||
auto check_ptr = (uintptr_t*)((PUCHAR)address + count);
|
||||
if (*check_ptr != 0x0 && *check_ptr != 0x90)
|
||||
{
|
||||
is_good = false;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (is_good) {
|
||||
DebugPrintA("location Cow virtual address : %p \n", address);
|
||||
return address;
|
||||
}
|
||||
}
|
||||
}
|
||||
__except (EXCEPTION_EXECUTE_HANDLER)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
|
||||
|
||||
VOID DriverUnload(PDRIVER_OBJECT driver)
|
||||
{
|
||||
DebugPrintA("[DebugMessage] Unload Driver");
|
||||
}
|
||||
|
||||
extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING reg_path)
|
||||
{
|
||||
DebugPrintA("init Driver \n");
|
||||
/*
|
||||
<09><>ʼ<EFBFBD><CABC>shellcode
|
||||
*/
|
||||
//uintptr_t size_of_shellcode = CALCSIZE(HkCreateFileW, ShellCodeEnd);
|
||||
uintptr_t size_of_shellcode = sizeof(HookCode);
|
||||
DebugPrintA("shell code size: %p \n", size_of_shellcode);
|
||||
/*
|
||||
get a x64 process
|
||||
*/
|
||||
for (uintptr_t i = 8; i < 100000000; i = i + 4)
|
||||
{
|
||||
PEPROCESS _eprocess = NULL;
|
||||
NTSTATUS nt_status = PsLookupProcessByProcessId((HANDLE)i, &_eprocess);
|
||||
if (NT_SUCCESS(nt_status) && _eprocess != NULL)
|
||||
{
|
||||
ObDereferenceObject(_eprocess);
|
||||
bool is_x64_process = PsGetProcessWow64Process(_eprocess) == NULL;
|
||||
if (is_x64_process) {
|
||||
KAPC_STATE apc;
|
||||
KeStackAttachProcess(_eprocess, &apc);
|
||||
moudle_info kernel32 = {0};
|
||||
moudle_info ntdll = { 0 };
|
||||
moudle_info kernelbase = { 0 };
|
||||
/*
|
||||
is x64 process, get kernel32.dll and kernelbase.dll and ntdll.dll base
|
||||
*/
|
||||
if (get_moudle_base(_eprocess, &kernel32, &ntdll, &kernelbase)) {
|
||||
uintptr_t kernel32_loadlibrary = GetProcAddressR(kernel32.bsae, "LoadLibraryW", TRUE);
|
||||
uintptr_t ntdll_wcsstr = GetProcAddressR(ntdll.bsae, "wcsstr", TRUE);
|
||||
uintptr_t kernelbase_GetModuleFileNameW = GetProcAddressR(kernelbase.bsae, "GetModuleFileNameW", TRUE);
|
||||
uintptr_t kernelbase_CreateFileW = GetProcAddressR(kernelbase.bsae, "CreateFileW", TRUE);
|
||||
|
||||
if (kernel32_loadlibrary && ntdll_wcsstr && kernelbase_GetModuleFileNameW && kernelbase_CreateFileW) {
|
||||
uintptr_t hook_function = get_free_speace(kernel32.bsae, kernel32.size, size_of_shellcode + sizeof(void*) + sizeof(CreateFileWT));
|
||||
if (hook_function) {
|
||||
/*
|
||||
Copy shellcode to freespeace
|
||||
*/
|
||||
_memcpy((PVOID)hook_function, (PVOID)HookCode, size_of_shellcode);
|
||||
/*
|
||||
hook
|
||||
*/
|
||||
BYTE _mov_rax[] = {
|
||||
0x48, 0xB8 // mov rax, [xxx]
|
||||
};
|
||||
BYTE _jmp_rax[] = {
|
||||
0xFF, 0xE0, // jmp rax
|
||||
};
|
||||
BYTE shell_code_jmp_back[] = {
|
||||
0xCC, 0xCC, //mov rax
|
||||
0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, //void*
|
||||
0xCC, 0xCC, //jmp rax
|
||||
};
|
||||
uintptr_t function_offset = kernelbase_CreateFileW;
|
||||
//backup
|
||||
_memcpy(shell_code_jmp_back, (void*)function_offset, sizeof(shell_code_jmp_back));
|
||||
/*
|
||||
hook_function -> origin_code
|
||||
*/
|
||||
function_offset = hook_function + size_of_shellcode;
|
||||
uintptr_t jmp_back = function_offset;
|
||||
_memcpy((void*)function_offset, shell_code_jmp_back, sizeof(shell_code_jmp_back));
|
||||
function_offset += sizeof(shell_code_jmp_back);
|
||||
/*
|
||||
origin_code -> jmp CreateFileW
|
||||
*/
|
||||
uintptr_t jmp_offset = kernelbase_CreateFileW + sizeof(_mov_rax) + sizeof(_jmp_rax) + sizeof(void*);
|
||||
_memcpy((void*)function_offset, _mov_rax, sizeof(_mov_rax));
|
||||
function_offset += sizeof(_mov_rax);
|
||||
_memcpy((void*)function_offset, &jmp_offset, sizeof(void*));
|
||||
function_offset += sizeof(void*);
|
||||
_memcpy((void*)function_offset, _jmp_rax, sizeof(_jmp_rax));
|
||||
/*
|
||||
location shellcode function
|
||||
*/
|
||||
for (int i = 0; i < size_of_shellcode; i++)
|
||||
{
|
||||
auto write_ptr = (uintptr_t*)((PUCHAR)hook_function + i);
|
||||
if (*write_ptr == 0x1234567812345678)
|
||||
{
|
||||
_memcpy((void*)write_ptr, (void*)&jmp_back, sizeof(uintptr_t));
|
||||
DebugPrintA("[jmp_back]Fix KernelBase.CreateFileW %p \n", jmp_back);
|
||||
}
|
||||
if (*write_ptr == 0x1234567891ABCDEF)
|
||||
{
|
||||
_memcpy((void*)write_ptr, (void*)&ntdll_wcsstr, sizeof(uintptr_t));
|
||||
DebugPrintA("Fix Ntdll.wcsstr %p \n", ntdll_wcsstr);
|
||||
}
|
||||
if (*write_ptr == 0x1337567891ABCDEF)
|
||||
{
|
||||
_memcpy((void*)write_ptr, (void*)&kernelbase_GetModuleFileNameW, sizeof(uintptr_t));
|
||||
DebugPrintA("Fix KernelBase.GetModuleFileNameW %p \n", kernelbase_GetModuleFileNameW);
|
||||
}
|
||||
if (*write_ptr == 0x1234567891AB1337)
|
||||
{
|
||||
_memcpy((void*)write_ptr, (void*)&kernel32_loadlibrary, sizeof(uintptr_t));
|
||||
DebugPrintA("Fix kernel32.loadlibrary %p \n", kernel32_loadlibrary);
|
||||
}
|
||||
}
|
||||
/*
|
||||
CreateFileW -> hook_function
|
||||
*/
|
||||
function_offset = kernelbase_CreateFileW;
|
||||
_memcpy((void*)function_offset, _mov_rax, sizeof(_mov_rax));
|
||||
function_offset += sizeof(_mov_rax);
|
||||
_memcpy((void*)function_offset, &hook_function, sizeof(void*));
|
||||
function_offset += sizeof(void*);
|
||||
_memcpy((void*)function_offset, _jmp_rax, sizeof(_jmp_rax));
|
||||
DebugPrintA("success hooked at: %p \n", hook_function);
|
||||
|
||||
} else {
|
||||
DebugPrintA("can not get free speace for shellcode \n");
|
||||
}
|
||||
}
|
||||
else {
|
||||
DebugPrintA("can not get export function\n");
|
||||
}
|
||||
}
|
||||
KeUnstackDetachProcess(&apc);
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
driver->DriverUnload = DriverUnload;
|
||||
return STATUS_UNSUCCESSFUL;
|
||||
}
|
||||
11
CowInject/main.h
Normal file
11
CowInject/main.h
Normal file
@@ -0,0 +1,11 @@
|
||||
#pragma once
|
||||
|
||||
extern HANDLE __stdcall HkCreateFileW(LPCWSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile);
|
||||
extern int __stdcall ShellCodeEnd();
|
||||
extern ULONG_PTR GetProcAddressR(ULONG_PTR hModule, const char* lpProcName, BOOL x64Module);
|
||||
extern LONG BlackBoneSafeSearchString(IN PUNICODE_STRING source, IN PUNICODE_STRING target, IN BOOLEAN CaseInSensitive);
|
||||
extern bool _memcpy(PVOID address, PVOID target_address, ULONG length);
|
||||
//see shell_code_start ,fuck gcc, aways broken shellcode
|
||||
static BYTE HookCode[] = {
|
||||
0x48,0x8B,0xC4,0x48,0x89,0x58,0x08,0x48,0x89,0x70,0x10,0x48,0x89,0x78,0x18,0x55,0x41,0x54,0x41,0x55,0x41,0x56,0x41,0x57,0x48,0x8D,0xA8,0xF8,0xFD,0xFF,0xFF,0x48,0x81,0xEC,0xE0,0x02,0x00,0x00,0x45,0x33,0xED,0xC7,0x44,0x24,0x40,0x43,0x00,0x3A,0x00,0x41,0x8B,0xF0,0x66,0x44,0x89,0x6C,0x24,0x58,0x44,0x8B,0xF2,0x66,0x44,0x89,0x6C,0x24,0x78,0x48,0x8B,0xD9,0x66,0x44,0x89,0x6D,0xC0,0x41,0xB8,0x04,0x01,0x00,0x00,0xC7,0x44,0x24,0x44,0x5C,0x00,0x68,0x00,0x48,0x8D,0x55,0xD0,0xC7,0x44,0x24,0x48,0x75,0x00,0x6F,0x00,0x33,0xC9,0xC7,0x44,0x24,0x4C,0x6A,0x00,0x69,0x00,0x48,0xB8,0xEF,0xCD,0xAB,0x91,0x78,0x56,0x37,0x13,0xC7,0x44,0x24,0x50,0x2E,0x00,0x64,0x00,0x49,0x8B,0xF9,0xC7,0x44,0x24,0x54,0x6C,0x00,0x6C,0x00,0xC7,0x44,0x24,0x60,0x43,0x00,0x3A,0x00,0xC7,0x44,0x24,0x64,0x5C,0x00,0x6E,0x00,0xC7,0x44,0x24,0x68,0x74,0x00,0x64,0x00,0xC7,0x44,0x24,0x6C,0x6C,0x00,0x6C,0x00,0xC7,0x44,0x24,0x70,0x2E,0x00,0x64,0x00,0xC7,0x44,0x24,0x74,0x6C,0x00,0x6C,0x00,0xC7,0x45,0xA0,0x43,0x00,0x6F,0x00,0xC7,0x45,0xA4,0x6E,0x00,0x61,0x00,0xC7,0x45,0xA8,0x6E,0x00,0x53,0x00,0xC7,0x45,0xAC,0x61,0x00,0x6E,0x00,0xC7,0x45,0xB0,0x64,0x00,0x62,0x00,0xC7,0x45,0xB4,0x6F,0x00,0x78,0x00,0xC7,0x45,0xB8,0x2E,0x00,0x65,0x00,0xC7,0x45,0xBC,0x78,0x00,0x65,0x00,0xC7,0x45,0x80,0x42,0x00,0x45,0x00,0xC7,0x45,0x84,0x53,0x00,0x65,0x00,0xC7,0x45,0x88,0x72,0x00,0x76,0x00,0xC7,0x45,0x8C,0x69,0x00,0x63,0x00,0xC7,0x45,0x90,0x65,0x00,0x2E,0x00,0xC7,0x45,0x94,0x65,0x00,0x78,0x00,0xC7,0x45,0x98,0x65,0x00,0x00,0x00,0xFF,0xD0,0x48,0x8D,0x55,0xA0,0x49,0xBF,0xEF,0xCD,0xAB,0x91,0x78,0x56,0x34,0x12,0x48,0x8D,0x4D,0xD0,0x41,0xFF,0xD7,0x48,0x85,0xC0,0x74,0x11,0x48,0x8D,0x4C,0x24,0x40,0x48,0xB8,0x37,0x13,0xAB,0x91,0x78,0x56,0x34,0x12,0xFF,0xD0,0x48,0x8D,0x55,0x80,0x48,0x8D,0x4D,0xD0,0x41,0xFF,0xD7,0x48,0x8B,0xCB,0x48,0x85,0xC0,0x74,0x14,0x48,0x8D,0x54,0x24,0x40,0x41,0xFF,0xD7,0x48,0x85,0xC0,0x48,0x8D,0x4C,0x24,0x60,0x48,0x0F,0x44,0xCB,0x48,0x8B,0x85,0x40,0x02,0x00,0x00,0x4C,0x8B,0xCF,0x48,0x89,0x44,0x24,0x30,0x44,0x8B,0xC6,0x8B,0x85,0x38,0x02,0x00,0x00,0x41,0x8B,0xD6,0x89,0x44,0x24,0x28,0x8B,0x85,0x30,0x02,0x00,0x00,0x89,0x44,0x24,0x20,0x48,0xB8,0x78,0x56,0x34,0x12,0x78,0x56,0x34,0x12,0xFF,0xD0,0x4C,0x8D,0x9C,0x24,0xE0,0x02,0x00,0x00,0x49,0x8B,0x5B,0x30,0x49,0x8B,0x73,0x38,0x49,0x8B,0x7B,0x40,0x49,0x8B,0xE3,0x41,0x5F,0x41,0x5E,0x41,0x5D,0x41,0x5C,0x5D,0xC3,0xCC,
|
||||
};
|
||||
1
CowInject/shell_code_end.cpp
Normal file
1
CowInject/shell_code_end.cpp
Normal file
@@ -0,0 +1 @@
|
||||
#include "head.h"
|
||||
28
CowInject/shell_code_start.cpp
Normal file
28
CowInject/shell_code_start.cpp
Normal file
@@ -0,0 +1,28 @@
|
||||
#include "head.h"
|
||||
|
||||
//shellcode just like:
|
||||
/*
|
||||
HANDLE __stdcall HookCreateFileW(LPCWSTR lpFileName,DWORD dwDesiredAccess,DWORD dwShareMode,LPSECURITY_ATTRIBUTES lpSecurityAttributes,DWORD dwCreationDisposition,DWORD dwFlagsAndAttributes,HANDLE hTemplateFile) {
|
||||
CreateFileWT oCreateFileW = (CreateFileWT)0x1234567812345678;
|
||||
wcsstrAt oWcsstr = (wcsstrAt)0x1234567891ABCDEF;
|
||||
GetModuleFileNameWT oGetModuleFileNameW = (GetModuleFileNameWT)0x1337567891ABCDEF;
|
||||
LoadLibraryWT oLoadLibraryW = (LoadLibraryWT)0x1234567891AB1337;
|
||||
wchar_t CheatPath[] = { 'C',':','\\','h','u','o','j','i','.','d','l','l','\0' };
|
||||
wchar_t NtdllName[] = { 'C',':','\\','n','t','d','l','l','.','d','l','l','\0' };
|
||||
//RainbowSix.exe
|
||||
wchar_t GameName[] = { 'C','o','n','a','n','S','a','n','d','b','o','x','.','e','x','e','\0' };
|
||||
//BEService.exe
|
||||
wchar_t AntiCheatName[] = { 'B','E','S','e','r','v','i','c','e','.','e','x','e','\0' };
|
||||
wchar_t ExeFile[MAX_PATH];
|
||||
oGetModuleFileNameW(NULL, ExeFile, MAX_PATH);
|
||||
if (oWcsstr(ExeFile, GameName) != NULL) {
|
||||
oLoadLibraryW(CheatPath);
|
||||
}
|
||||
if (oWcsstr(ExeFile, AntiCheatName) != NULL) {
|
||||
return oCreateFileW(oWcsstr(lpFileName, CheatPath) != NULL ? NtdllName : lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
|
||||
}
|
||||
return oCreateFileW(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
|
||||
}
|
||||
int __stdcall ShellCodeEnd() {
|
||||
return 0x1337;
|
||||
}*/
|
||||
Reference in New Issue
Block a user