init

2026-07-28 15:11:47 +08:00
parent 9b00c5f6eb
commit e91e372b19
80 changed files with 246075 additions and 0 deletions
@@ -0,0 +1,147 @@
+#include "utils.h"
+
+auto utils::GetKernelModule(const std::string& module_name) -> uint64_t
+{
+	void* buffer = nullptr;
+	DWORD buffer_size = 0;
+
+	NTSTATUS status = NtQuerySystemInformation(static_cast<SYSTEM_INFORMATION_CLASS>(nt::SystemModuleInformation), buffer, buffer_size, &buffer_size);
+
+	while (status == nt::STATUS_INFO_LENGTH_MISMATCH) {
+		if (buffer != nullptr)
+			VirtualFree(buffer, 0, MEM_RELEASE);
+
+		buffer = VirtualAlloc(nullptr, buffer_size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+		status = NtQuerySystemInformation(static_cast<SYSTEM_INFORMATION_CLASS>(nt::SystemModuleInformation), buffer, buffer_size, &buffer_size);
+	}
+
+	if (!NT_SUCCESS(status)) {
+		if (buffer != nullptr)
+			VirtualFree(buffer, 0, MEM_RELEASE);
+		return 0;
+	}
+
+	const auto modules = static_cast<PRTL_PROCESS_MODULES>(buffer);
+	if (!modules)
+		return 0;
+
+	for (auto i = 0u; i < modules->NumberOfModules; ++i) {
+		const std::string current_module_name = std::string(reinterpret_cast<char*>(modules->Modules[i].FullPathName) + modules->Modules[i].OffsetToFileName);
+
+		if (!_stricmp(current_module_name.c_str(), module_name.c_str()))
+		{
+			const uint64_t result = reinterpret_cast<uint64_t>(modules->Modules[i].ImageBase);
+			VirtualFree(buffer, 0, MEM_RELEASE);
+			return result;
+		}
+	}
+
+	VirtualFree(buffer, 0, MEM_RELEASE);
+	return 0;
+}
+
+
+BOOLEAN utils::bDataCompare(const BYTE* pData, const BYTE* bMask, const char* szMask) {
+	for (; *szMask; ++szMask, ++pData, ++bMask)
+		if (*szMask == 'x' && *pData != *bMask)
+			return 0;
+	return (*szMask) == 0;
+}
+uintptr_t utils::FindPattern(uintptr_t dwAddress, uintptr_t dwLen, BYTE* bMask, const char* szMask)
+{
+	size_t max_len = dwLen - strlen(szMask);
+	for (uintptr_t i = 0; i < max_len; i++)
+		if (bDataCompare((BYTE*)(dwAddress + i), bMask, szMask))
+			return (uintptr_t)(dwAddress + i);
+	return 0;
+}
+
+PVOID utils::FindSection(const char* sectionName, uintptr_t modulePtr, PULONG size) {
+	size_t namelength = strlen(sectionName);
+	PIMAGE_NT_HEADERS headers = (PIMAGE_NT_HEADERS)(modulePtr + ((PIMAGE_DOS_HEADER)modulePtr)->e_lfanew);
+	PIMAGE_SECTION_HEADER sections = IMAGE_FIRST_SECTION(headers);
+	for (DWORD i = 0; i < headers->FileHeader.NumberOfSections; ++i) {
+		PIMAGE_SECTION_HEADER section = &sections[i];
+		if (memcmp(section->Name, sectionName, namelength) == 0 &&
+			namelength == strlen((char*)section->Name)) {
+			if (!section->VirtualAddress) {
+				return 0;
+			}
+			if (size) {
+				*size = section->Misc.VirtualSize;
+			}
+			return (PVOID)(modulePtr + section->VirtualAddress);
+		}
+	}
+	return 0;
+}
+
+
+std::wstring utils::GetFullTempPath() {
+	wchar_t temp_directory[MAX_PATH + 1] = { 0 };
+	const uint32_t get_temp_path_ret = GetTempPathW(sizeof(temp_directory) / 2, temp_directory);
+	if (!get_temp_path_ret || get_temp_path_ret > MAX_PATH + 1) {
+		Log(L"[-] Failed to get temp path" << std::endl);
+		return L"";
+	}
+	if (temp_directory[wcslen(temp_directory) - 1] == L'\\')
+		temp_directory[wcslen(temp_directory) - 1] = 0x0;
+
+	return std::wstring(temp_directory);
+}
+
+bool utils::CreateFileFromMemory(const std::wstring& desired_file_path, const char* address, size_t size) {
+	std::ofstream file_ofstream(desired_file_path.c_str(), std::ios_base::out | std::ios_base::binary);
+
+	if (!file_ofstream.write(address, size)) {
+		file_ofstream.close();
+		return false;
+	}
+
+	file_ofstream.close();
+	return true;
+}
+
+auto utils::calc_comm_verify_check(int a, int b, int c, int d)->ULONG64
+{
+	int aaaa = c * b;
+	aaaa = aaaa + a * b + 15561;
+	int bbb = aaaa + c * a;
+	bbb = bbb * d - b;
+	int ddddd = bbb + d * c;
+	ddddd = ddddd + d * a + 974534;
+	ddddd = ddddd * d + 21373;
+	ddddd = ddddd << d;
+	int ccccc = ddddd | 2335464;
+	ccccc = ccccc ^ 211424;
+	ccccc = ccccc ^ a;
+	int eeeee = ccccc / 835347;
+	auto calc_verify_val = eeeee;
+
+	return calc_verify_val;
+}
+
+auto utils::get_random_val(ULONG64  a, ULONG64  b) -> ULONG64
+{
+	ULONG64 t1 = __rdtsc();
+	ULONG64  v = (((((t1 * (a ^ t1) + t1 * (b * a)) * 0x17) / 7) % (b - a + 1)) + a);
+	return v;
+}
+
+auto utils::GetVersion() -> OSVERSIONINFOW
+{
+	OSVERSIONINFOW os{ 0 };
+	typedef NTSTATUS(WINAPI* PFNRtlGetVersion)(PRTL_OSVERSIONINFOW);
+	static PFNRtlGetVersion RtlGetVersion = nullptr;
+	if (RtlGetVersion == nullptr)
+	{
+		HMODULE hNtdll = GetModuleHandleW(L"ntdll.dll");
+		if (hNtdll != NULL)
+		{
+			RtlGetVersion = (PFNRtlGetVersion)GetProcAddress(hNtdll, "RtlGetVersion");
+		}
+	}
+
+	RtlGetVersion(&os);
+	return os;
+}