diff --git a/Voyager (1703-1511)/BootMgfw.h b/Voyager (1703-1511)/BootMgfw.h index 88cf111..1a1f19d 100644 --- a/Voyager (1703-1511)/BootMgfw.h +++ b/Voyager (1703-1511)/BootMgfw.h @@ -13,10 +13,8 @@ #include #include "WinLoad.h" -#if WINVER >= 1607 #define START_BOOT_APPLICATION_SIG "\xE8\x00\x00\x00\x00\x48\x8B\xCE\x8B\xD8\xE8\x00\x00\x00\x00\x41\x8B\xCF" #define START_BOOT_APPLICATION_MASK "x????xxxxxx????xxx" -#endif static_assert(sizeof(START_BOOT_APPLICATION_SIG) == sizeof(START_BOOT_APPLICATION_MASK), "signature and mask size's dont match..."); #define WINDOWS_BOOTMGR_PATH L"\\efi\\microsoft\\boot\\bootmgfw.efi" diff --git a/Voyager (1703-1511)/HvLoader.c b/Voyager (1703-1511)/HvLoader.c index bf6cb59..ea4b77b 100644 --- a/Voyager (1703-1511)/HvLoader.c +++ b/Voyager (1703-1511)/HvLoader.c @@ -1,17 +1,86 @@ #include "HvLoader.h" SHITHOOK HvLoadImageHook; +SHITHOOK HvLoadImageBufferHook; SHITHOOK HvLoadAllocImageHook; BOOLEAN ExtendedAllocation = FALSE; BOOLEAN HookedHyperV = FALSE; +CHAR8 ModulePathCString[0x100]; EFI_STATUS EFIAPI HvBlImgLoadPEImageFromSourceBuffer(VOID* a1, VOID* a2, VOID* a3, VOID* a4, UINT64* ImageBase, UINT32* ImageSize, VOID* a7, VOID* a8, VOID* a9, VOID* a10, VOID* a11, VOID* a12, VOID* a13, VOID* a14, VOID* a15) { - DisableShitHook(&HvLoadImageHook); - EFI_STATUS Result = ((HV_LDR_LOAD_IMAGE)HvLoadImageHook.Address)(a1, a2, a3, a4, ImageBase, ImageSize, a7, a8, + DisableShitHook(&HvLoadImageBufferHook); + EFI_STATUS Result = ((HV_LDR_LOAD_IMAGE_BUFFER)HvLoadImageBufferHook.Address)(a1, a2, a3, a4, ImageBase, ImageSize, a7, a8, a9, a10, a11, a12, a13, a14, a15); - EnableShitHook(&HvLoadImageHook); + if(!ExtendedAllocation && !HookedHyperV) + EnableShitHook(&HvLoadImageBufferHook); + + if (ExtendedAllocation && !HookedHyperV) + { + HookedHyperV = TRUE; + EFI_IMAGE_DOS_HEADER* HypervDosHeader = *ImageBase; + if (HypervDosHeader->e_magic != EFI_IMAGE_DOS_SIGNATURE) + return NULL; + + EFI_IMAGE_NT_HEADERS64* HypervNtHeader = (UINT64)HypervDosHeader + HypervDosHeader->e_lfanew; + if (HypervNtHeader->Signature != EFI_IMAGE_NT_SIGNATURE) + return NULL; + + EFI_IMAGE_SECTION_HEADER* pSection = ((UINT64)&HypervNtHeader->OptionalHeader) + + HypervNtHeader->FileHeader.SizeOfOptionalHeader; + + for (UINT16 i = 0; i < HypervNtHeader->FileHeader.NumberOfSections; i += 1, pSection += 1) + { + if (!AsciiStrCmp(&pSection->Name, ".reloc")) + { + VOYAGER_DATA_T VoyagerData; + MakeVoyagerData + ( + &VoyagerData, + *ImageBase, + *ImageSize, + *ImageBase + pSection->VirtualAddress + pSection->Misc.VirtualSize, + PayLoadSize() + ); + + DBG_PRINT(".reloc section base address -> 0x%p\n", *ImageBase + pSection->VirtualAddress); + DBG_PRINT(".reloc section end (aka golden record base address) -> 0x%p\n", *ImageBase + pSection->VirtualAddress + pSection->Misc.VirtualSize); + + VOID* VmExitHook = MapModule(&VoyagerData, PayLoad); + VOID* VmExitFunction = HookVmExit + ( + VoyagerData.HypervModuleBase, + VoyagerData.HypervModuleSize, + VmExitHook + ); + + pSection->Characteristics = SECTION_RWX; + pSection->Misc.VirtualSize += PayLoadSize(); + DBG_PRINT("VmExitHook (PayLoad Entry Point) -> 0x%p\n", VmExitHook); + } + } + + HypervNtHeader->OptionalHeader.SizeOfImage += PayLoadSize(); + *ImageSize += PayLoadSize(); + } + + DBG_PRINT("[HvLoader (Load Image)] ImageBase -> 0x%p, ImageSize -> 0x%p\n", *ImageBase, *ImageSize); + return Result; +} + +EFI_STATUS EFIAPI HvBlImgLoadPEImageEx(VOID* DeviceId, VOID* MemoryType, CHAR16* Path, UINT64* ImageBase, UINT32* ImageSize, + VOID* Hash, VOID* Flags, VOID* a8, VOID* a9, VOID* a10, VOID* a11, VOID* a12, VOID* a13) +{ + UnicodeStrToAsciiStr(Path, ModulePathCString); + DBG_PRINT("LOADING FROM HVLOADER: "); + DBG_PRINT(ModulePathCString); + + DisableShitHook(&HvLoadImageHook); + EFI_STATUS Result = ((HV_LDR_LOAD_IMAGE)HvLoadImageHook.Address)(DeviceId, MemoryType, Path, ImageBase, ImageSize, Hash, Flags, a8, + a9, a10, a11, a12, a13); + if(!ExtendedAllocation && !HookedHyperV) + EnableShitHook(&HvLoadImageHook); if (ExtendedAllocation && !HookedHyperV) { @@ -68,7 +137,7 @@ EFI_STATUS EFIAPI HvBlImgLoadPEImageFromSourceBuffer(VOID* a1, VOID* a2, VOID* a UINT64 EFIAPI HvLoaderBlImgAllocateImageBuffer(VOID** imageBuffer, UINTN imageSize, UINT32 memoryType, UINT32 attributes, VOID* unused, UINT32 flags) { - if (imageSize == HV_ALLOC_SIZE && !ExtendedAllocation) + if (imageSize >= HV_ALLOC_SIZE && !ExtendedAllocation) { ExtendedAllocation = TRUE; imageSize += PayLoadSize(); diff --git a/Voyager (1703-1511)/HvLoader.h b/Voyager (1703-1511)/HvLoader.h index 19d6631..8f3a0e9 100644 --- a/Voyager (1703-1511)/HvLoader.h +++ b/Voyager (1703-1511)/HvLoader.h @@ -6,25 +6,33 @@ #if WINVER >= 1607 #define ALLOCATE_IMAGE_BUFFER_SIG "\xE8\x00\x00\x00\x00\x4C\x8B\x65\x60" #define ALLOCATE_IMAGE_BUFFER_MASK "x????xxxx" +#elif WINVER == 1511 +#define ALLOCATE_IMAGE_BUFFER_SIG "\xE8\x00\x00\x00\x00\x4C\x8B\x75\xC0" +#define ALLOCATE_IMAGE_BUFFER_MASK "x????xxxx" #endif #if WINVER == 1703 #define HV_LOAD_PE_IMG_SIG "\xE8\x00\x00\x00\x00\x44\x8B\xAD" #define HV_LOAD_PE_IMG_MASK "x????xxx" -#elif WINVER == 1607 -#define HV_LOAD_PE_IMG_SIG "\xE8\x00\x00\x00\x00\x48\x8B\x4D\x80\x41\x8B\xD4" -#define HV_LOAD_PE_IMG_MASK "x????xxxxxxx" +#elif WINVER <= 1607 // same for 1511 +#define HV_LOAD_PE_IMG_SIG "\xE8\x00\x00\x00\x00\x48\x8B\x7D\xF7" +#define HV_LOAD_PE_IMG_MASK "x????xxxx" #endif static_assert(sizeof(HV_LOAD_PE_IMG_SIG) == sizeof(HV_LOAD_PE_IMG_MASK), "signature and mask do not match size..."); static_assert(sizeof(ALLOCATE_IMAGE_BUFFER_SIG) == sizeof(ALLOCATE_IMAGE_BUFFER_MASK), "signature and mask do not match size!"); typedef EFI_STATUS(EFIAPI* ALLOCATE_IMAGE_BUFFER)(VOID** imageBuffer, UINTN imageSize, UINT32 memoryType, UINT32 attributes, VOID* unused, UINT32 flags); -typedef EFI_STATUS(EFIAPI* HV_LDR_LOAD_IMAGE)(VOID* a1, VOID* a2, VOID* a3, VOID* a4, UINT64* ImageBase, +typedef EFI_STATUS(EFIAPI* HV_LDR_LOAD_IMAGE_BUFFER)(VOID* a1, VOID* a2, VOID* a3, VOID* a4, UINT64* ImageBase, UINT32* ImageSize, VOID* a7, VOID* a8, VOID* a9, VOID* a10, VOID* a11, VOID* a12, VOID* a13, VOID* a14, VOID* a15); +typedef EFI_STATUS(EFIAPI* HV_LDR_LOAD_IMAGE)(VOID* DeviceId, VOID* MemoryType, CHAR16* Path, VOID** ImageBase, UINT32* ImageSize, + VOID* Hash, VOID* Flags, VOID* a8, VOID* a9, VOID* a10, VOID* a11, VOID* a12, VOID* a13); UINT64 EFIAPI HvLoaderBlImgAllocateImageBuffer(VOID** imageBuffer, UINTN imageSize, UINT32 memoryType, UINT32 attributes, VOID* unused, UINT32 flags); +EFI_STATUS EFIAPI HvBlImgLoadPEImageEx(VOID* DeviceId, VOID* MemoryType, CHAR16* Path, UINT64* ImageBase, UINT32* ImageSize, + VOID* Hash, VOID* Flags, VOID* a8, VOID* a9, VOID* a10, VOID* a11, VOID* a12, VOID* a13); EFI_STATUS EFIAPI HvBlImgLoadPEImageFromSourceBuffer(VOID* a1, VOID* a2, VOID* a3, VOID* a4, UINT64* ImageBase, UINT32* ImageSize, VOID* a7, VOID* a8, VOID* a9, VOID* a10, VOID* a11, VOID* a12, VOID* a13, VOID* a14, VOID* a15); extern SHITHOOK HvLoadImageHook; -extern SHITHOOK HvLoadAllocImageHook; \ No newline at end of file +extern SHITHOOK HvLoadAllocImageHook; +extern SHITHOOK HvLoadImageBufferHook; \ No newline at end of file diff --git a/Voyager (1703-1511)/Hvix64.h b/Voyager (1703-1511)/Hvix64.h index cfd1f5e..f7a39a4 100644 --- a/Voyager (1703-1511)/Hvix64.h +++ b/Voyager (1703-1511)/Hvix64.h @@ -1,14 +1,8 @@ #pragma once #include "PayLoad.h" - #define HV_ALLOC_SIZE 0x1400000 -#if WINVER == 1703 -#define VMEXIT_HANDLER_SIG "\xD0\x80\x3D\x74\xCC\x47\x00\x00\x0F\x84\x00\x00\x00\x00\x48\x8B\x54\x24\x00\xE8\x00\x00\x00\x00\xE9" -#define VMEXIT_HANDLER_MASK "xxxxxx??xx????xxxx?x????x" -#elif WINVER == 1607 -#define VMEXIT_HANDLER_SIG "\xD0\x80\x3D\xB4\x9F\x49\x00\x00\x0F\x84\x00\x00\x00\x00\x48\x8B\x54\x24\x00\xE8\x00\x00\x00\x00\xE9" -#define VMEXIT_HANDLER_MASK "xxxxxx??xx????xxxx?x????x" -#endif +#define VMEXIT_HANDLER_SIG "\xD0\x80\x00\x00\x00\x00\x00\x00\x0F\x84\x00\x00\x00\x00\x48\x8B\x54\x24\x00\xE8\x00\x00\x00\x00\xE9" +#define VMEXIT_HANDLER_MASK "xx????x?xx????xxxx?x????x" static_assert(sizeof(VMEXIT_HANDLER_SIG) == sizeof(VMEXIT_HANDLER_MASK), "signature does not match mask size!"); static_assert(sizeof(VMEXIT_HANDLER_SIG) == 26, "signature is invalid length!"); diff --git a/Voyager (1703-1511)/Utils.h b/Voyager (1703-1511)/Utils.h index bb5b36c..28851f6 100644 --- a/Voyager (1703-1511)/Utils.h +++ b/Voyager (1703-1511)/Utils.h @@ -1,6 +1,6 @@ #pragma once #include "ShitHook.h" -#define WINVER 1703 +#define WINVER 1511 #define PORT_NUM 0x2F8 #define BL_MEMORY_ATTRIBUTE_RWX 0x424000 #define SECTION_RWX (EFI_IMAGE_SCN_MEM_READ | EFI_IMAGE_SCN_MEM_WRITE | EFI_IMAGE_SCN_MEM_EXECUTE) diff --git a/Voyager (1703-1511)/WinLoad.c b/Voyager (1703-1511)/WinLoad.c index b81cf4a..a717e40 100644 --- a/Voyager (1703-1511)/WinLoad.c +++ b/Voyager (1703-1511)/WinLoad.c @@ -2,17 +2,20 @@ SHITHOOK WinLoadImageShitHook; CHAR8 ModulePathCStr[0x100]; +BOOLEAN InstalledHvLoaderHook = FALSE; EFI_STATUS EFIAPI BlImgLoadPEImageEx(VOID* a1, VOID* a2, CHAR16* ImagePath, UINT64* ImageBasePtr, UINT32* ImageSize, VOID* a6, VOID* a7, VOID* a8, VOID* a9, VOID* a10, VOID* a11, VOID* a12, VOID* a13, VOID* a14) { UnicodeStrToAsciiStr(ImagePath, ModulePathCStr); + DBG_PRINT("LOADING FROM WINLOAD: "); DBG_PRINT(ModulePathCStr); DisableShitHook(&WinLoadImageShitHook); EFI_STATUS Result = ((LDR_LOAD_IMAGE)WinLoadImageShitHook.Address)(a1, a2, ImagePath, ImageBasePtr, ImageSize, a6, a7, a8, a9, a10, a11, a12, a13, a14); - EnableShitHook(&WinLoadImageShitHook); + if(!InstalledHvLoaderHook) + EnableShitHook(&WinLoadImageShitHook); if (StrStr(ImagePath, L"hvloader.efi")) { @@ -32,10 +35,22 @@ EFI_STATUS EFIAPI BlImgLoadPEImageEx(VOID* a1, VOID* a2, CHAR16* ImagePath, UINT ALLOCATE_IMAGE_BUFFER_MASK ); - MakeShitHook(&HvLoadImageHook, RESOLVE_RVA(LoadImage, 5, 1), &HvBlImgLoadPEImageFromSourceBuffer, TRUE); + if (!LoadImage || !AllocImage) + { + DBG_PRINT("Signatures FAILED!\n"); + return Result; + } + +#if WINVER == 1703 + MakeShitHook(&HvLoadImageBufferHook, RESOLVE_RVA(LoadImage, 5, 1), &HvBlImgLoadPEImageFromSourceBuffer, TRUE); +#elif WINVER <= 1607 // 1511 is the same... + MakeShitHook(&HvLoadImageHook, RESOLVE_RVA(LoadImage, 5, 1), &HvBlImgLoadPEImageEx, TRUE); +#endif + MakeShitHook(&HvLoadAllocImageHook, RESOLVE_RVA(AllocImage, 5, 1), &HvLoaderBlImgAllocateImageBuffer, TRUE); DBG_PRINT("LoadImageHook -> 0x%p\n", RESOLVE_RVA(LoadImage, 5, 1)); DBG_PRINT("AllocImage -> 0x%p\n", RESOLVE_RVA(AllocImage, 5, 1)); + InstalledHvLoaderHook = TRUE; } DBG_PRINT("[%s] Image Base -> 0x%p, Image Size -> 0x%p\n", __FUNCTION__, *ImageBasePtr, *ImageSize); diff --git a/Voyager (1703-1511)/WinLoad.h b/Voyager (1703-1511)/WinLoad.h index 1d6a60c..54ac515 100644 --- a/Voyager (1703-1511)/WinLoad.h +++ b/Voyager (1703-1511)/WinLoad.h @@ -8,7 +8,7 @@ extern SHITHOOK WinLoadImageShitHook; #if WINVER == 1703 #define LOAD_PE_IMG_SIG "\xE8\x00\x00\x00\x00\x85\xC0\x79\x45" #define LOAD_PE_IMG_MASK "x????xxxx" -#elif WINVER == 1607 +#elif WINVER <= 1607 // works for 1511 #define LOAD_PE_IMG_SIG "\xE8\x00\x00\x00\x00\x48\x8B\x7D\xF7" #define LOAD_PE_IMG_MASK "x????xxxx" #endif