parent
32c2b17fcf
commit
979bb6c2a1
@ -1,8 +1,36 @@
|
||||
#include "Theodosius.h"
|
||||
#include "Types.h"
|
||||
|
||||
MutateRoutine extern "C" void drv_entry()
|
||||
// this routine is not obfuscated...
|
||||
void PrintCR3()
|
||||
{
|
||||
ULONG_PTR Cr3Value =
|
||||
*reinterpret_cast<ULONG_PTR*>(
|
||||
IoGetCurrentProcess() + CR3_OFFSET);
|
||||
|
||||
DbgPrint("> Current CR3 = 0x%p\n", Cr3Value);
|
||||
}
|
||||
|
||||
ObfuscateRoutine void LoopDemo()
|
||||
{
|
||||
// JCC's work! :)
|
||||
for (auto idx = 0u; idx < 10; ++idx)
|
||||
DbgPrint("> Loop Demo: %d\n", idx);
|
||||
}
|
||||
|
||||
// entry point must be named "DrvEntry" for this example...
|
||||
MutateRoutine extern "C" void DrvEntry()
|
||||
{
|
||||
DbgPrint("> Hello World!\n");
|
||||
|
||||
// non-exported symbols being resolved by jit linker...
|
||||
DbgPrint("> PiDDBCacheTable = 0x%p\n", &PiDDBCacheTable);
|
||||
DbgPrint("> win32kfull!NtUserRegisterShellPTPListener = 0x%p\n", &NtUserRegisterShellPTPListener);
|
||||
|
||||
// example of referencing itself...
|
||||
DbgPrint("> DrvEntry = 0x%p\n", &DrvEntry);
|
||||
|
||||
// example of calling other obfuscated/non obfuscated routines...
|
||||
PrintCR3();
|
||||
LoopDemo();
|
||||
}
|
@ -1,11 +1,3 @@
|
||||
#pragma once
|
||||
#include <intrin.h>
|
||||
#define ObfuscateRoutine __declspec(code_seg(".theo"), noinline)
|
||||
#define MutateRoutine __declspec(code_seg(".theo1"), noinline)
|
||||
|
||||
// win32kfull.sys export example...
|
||||
extern "C" void NtUserRegisterShellPTPListener();
|
||||
extern "C" void* PiDDBCacheTable;
|
||||
|
||||
extern "C" unsigned long DbgPrint(const char* format, ...);
|
||||
extern "C" unsigned long long IoGetCurrentProcess();
|
||||
#define MutateRoutine __declspec(code_seg(".theo1"), noinline)
|
@ -0,0 +1,24 @@
|
||||
#pragma once
|
||||
#define NT_SUCCESS(x) ((x) >= 0)
|
||||
#define STATUS_INFO_LENGTH_MISMATCH 0xc0000004
|
||||
#define CR3_OFFSET 0x28
|
||||
|
||||
using NTSTATUS = unsigned long;
|
||||
using PVOID = void*;
|
||||
|
||||
using HANDLE = unsigned long;
|
||||
using UCHAR = unsigned char;
|
||||
using USHORT = unsigned short;
|
||||
using ULONG = unsigned long;
|
||||
using PULONG = unsigned long*;
|
||||
typedef unsigned long long ULONG_PTR;
|
||||
|
||||
// this is a demo of resolving non-exported symbols...
|
||||
// win32kfull.sys export example...
|
||||
extern "C" void NtUserRegisterShellPTPListener();
|
||||
extern "C" void* PiDDBCacheTable;
|
||||
|
||||
extern "C" unsigned char* IoGetCurrentProcess();
|
||||
extern "C" unsigned long DbgPrint(const char* format, ...);
|
||||
extern "C" PVOID ExAllocatePool(ULONG, ULONG);
|
||||
extern "C" void ExFreePool(PVOID);
|
Loading…
Reference in new issue