147 lines
4.3 KiB
C++
147 lines
4.3 KiB
C++
#include "utils.h"
|
|
|
|
auto utils::GetKernelModule(const std::string& module_name) -> uint64_t
|
|
{
|
|
void* buffer = nullptr;
|
|
DWORD buffer_size = 0;
|
|
|
|
NTSTATUS status = NtQuerySystemInformation(static_cast<SYSTEM_INFORMATION_CLASS>(nt::SystemModuleInformation), buffer, buffer_size, &buffer_size);
|
|
|
|
while (status == nt::STATUS_INFO_LENGTH_MISMATCH) {
|
|
if (buffer != nullptr)
|
|
VirtualFree(buffer, 0, MEM_RELEASE);
|
|
|
|
buffer = VirtualAlloc(nullptr, buffer_size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
|
|
status = NtQuerySystemInformation(static_cast<SYSTEM_INFORMATION_CLASS>(nt::SystemModuleInformation), buffer, buffer_size, &buffer_size);
|
|
}
|
|
|
|
if (!NT_SUCCESS(status)) {
|
|
if (buffer != nullptr)
|
|
VirtualFree(buffer, 0, MEM_RELEASE);
|
|
return 0;
|
|
}
|
|
|
|
const auto modules = static_cast<PRTL_PROCESS_MODULES>(buffer);
|
|
if (!modules)
|
|
return 0;
|
|
|
|
for (auto i = 0u; i < modules->NumberOfModules; ++i) {
|
|
const std::string current_module_name = std::string(reinterpret_cast<char*>(modules->Modules[i].FullPathName) + modules->Modules[i].OffsetToFileName);
|
|
|
|
if (!_stricmp(current_module_name.c_str(), module_name.c_str()))
|
|
{
|
|
const uint64_t result = reinterpret_cast<uint64_t>(modules->Modules[i].ImageBase);
|
|
VirtualFree(buffer, 0, MEM_RELEASE);
|
|
return result;
|
|
}
|
|
}
|
|
|
|
VirtualFree(buffer, 0, MEM_RELEASE);
|
|
return 0;
|
|
}
|
|
|
|
|
|
BOOLEAN utils::bDataCompare(const BYTE* pData, const BYTE* bMask, const char* szMask) {
|
|
for (; *szMask; ++szMask, ++pData, ++bMask)
|
|
if (*szMask == 'x' && *pData != *bMask)
|
|
return 0;
|
|
return (*szMask) == 0;
|
|
}
|
|
uintptr_t utils::FindPattern(uintptr_t dwAddress, uintptr_t dwLen, BYTE* bMask, const char* szMask)
|
|
{
|
|
size_t max_len = dwLen - strlen(szMask);
|
|
for (uintptr_t i = 0; i < max_len; i++)
|
|
if (bDataCompare((BYTE*)(dwAddress + i), bMask, szMask))
|
|
return (uintptr_t)(dwAddress + i);
|
|
return 0;
|
|
}
|
|
|
|
PVOID utils::FindSection(const char* sectionName, uintptr_t modulePtr, PULONG size) {
|
|
size_t namelength = strlen(sectionName);
|
|
PIMAGE_NT_HEADERS headers = (PIMAGE_NT_HEADERS)(modulePtr + ((PIMAGE_DOS_HEADER)modulePtr)->e_lfanew);
|
|
PIMAGE_SECTION_HEADER sections = IMAGE_FIRST_SECTION(headers);
|
|
for (DWORD i = 0; i < headers->FileHeader.NumberOfSections; ++i) {
|
|
PIMAGE_SECTION_HEADER section = §ions[i];
|
|
if (memcmp(section->Name, sectionName, namelength) == 0 &&
|
|
namelength == strlen((char*)section->Name)) {
|
|
if (!section->VirtualAddress) {
|
|
return 0;
|
|
}
|
|
if (size) {
|
|
*size = section->Misc.VirtualSize;
|
|
}
|
|
return (PVOID)(modulePtr + section->VirtualAddress);
|
|
}
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
|
|
std::wstring utils::GetFullTempPath() {
|
|
wchar_t temp_directory[MAX_PATH + 1] = { 0 };
|
|
const uint32_t get_temp_path_ret = GetTempPathW(sizeof(temp_directory) / 2, temp_directory);
|
|
if (!get_temp_path_ret || get_temp_path_ret > MAX_PATH + 1) {
|
|
Log(L"[-] Failed to get temp path" << std::endl);
|
|
return L"";
|
|
}
|
|
if (temp_directory[wcslen(temp_directory) - 1] == L'\\')
|
|
temp_directory[wcslen(temp_directory) - 1] = 0x0;
|
|
|
|
return std::wstring(temp_directory);
|
|
}
|
|
|
|
bool utils::CreateFileFromMemory(const std::wstring& desired_file_path, const char* address, size_t size) {
|
|
std::ofstream file_ofstream(desired_file_path.c_str(), std::ios_base::out | std::ios_base::binary);
|
|
|
|
if (!file_ofstream.write(address, size)) {
|
|
file_ofstream.close();
|
|
return false;
|
|
}
|
|
|
|
file_ofstream.close();
|
|
return true;
|
|
}
|
|
|
|
auto utils::calc_comm_verify_check(int a, int b, int c, int d)->ULONG64
|
|
{
|
|
int aaaa = c * b;
|
|
aaaa = aaaa + a * b + 15561;
|
|
int bbb = aaaa + c * a;
|
|
bbb = bbb * d - b;
|
|
int ddddd = bbb + d * c;
|
|
ddddd = ddddd + d * a + 974534;
|
|
ddddd = ddddd * d + 21373;
|
|
ddddd = ddddd << d;
|
|
int ccccc = ddddd | 2335464;
|
|
ccccc = ccccc ^ 211424;
|
|
ccccc = ccccc ^ a;
|
|
int eeeee = ccccc / 835347;
|
|
auto calc_verify_val = eeeee;
|
|
|
|
return calc_verify_val;
|
|
}
|
|
|
|
auto utils::get_random_val(ULONG64 a, ULONG64 b) -> ULONG64
|
|
{
|
|
ULONG64 t1 = __rdtsc();
|
|
ULONG64 v = (((((t1 * (a ^ t1) + t1 * (b * a)) * 0x17) / 7) % (b - a + 1)) + a);
|
|
return v;
|
|
}
|
|
|
|
auto utils::GetVersion() -> OSVERSIONINFOW
|
|
{
|
|
OSVERSIONINFOW os{ 0 };
|
|
typedef NTSTATUS(WINAPI* PFNRtlGetVersion)(PRTL_OSVERSIONINFOW);
|
|
static PFNRtlGetVersion RtlGetVersion = nullptr;
|
|
if (RtlGetVersion == nullptr)
|
|
{
|
|
HMODULE hNtdll = GetModuleHandleW(L"ntdll.dll");
|
|
if (hNtdll != NULL)
|
|
{
|
|
RtlGetVersion = (PFNRtlGetVersion)GetProcAddress(hNtdll, "RtlGetVersion");
|
|
}
|
|
}
|
|
|
|
RtlGetVersion(&os);
|
|
return os;
|
|
} |