xerox
4 years ago
parent
61cfcc870f
commit
5d44a71b7d
@ -1,13 +0,0 @@
|
||||
c:\users\xerox\desktop\voyager\payload (intel)\x64\release\vc142.pdb
|
||||
c:\users\xerox\desktop\voyager\payload (intel)\x64\release\vmexit_handler.obj
|
||||
c:\users\xerox\desktop\voyager\x64\release\payload(intel).dll
|
||||
c:\users\xerox\desktop\voyager\x64\release\payload(intel).lib
|
||||
c:\users\xerox\desktop\voyager\x64\release\payload(intel).exp
|
||||
c:\users\xerox\desktop\voyager\x64\release\payload(intel).pdb
|
||||
c:\users\xerox\desktop\voyager\payload (intel)\x64\release\payload (intel).tlog\cl.command.1.tlog
|
||||
c:\users\xerox\desktop\voyager\payload (intel)\x64\release\payload (intel).tlog\cl.read.1.tlog
|
||||
c:\users\xerox\desktop\voyager\payload (intel)\x64\release\payload (intel).tlog\cl.write.1.tlog
|
||||
c:\users\xerox\desktop\voyager\payload (intel)\x64\release\payload (intel).tlog\link.command.1.tlog
|
||||
c:\users\xerox\desktop\voyager\payload (intel)\x64\release\payload (intel).tlog\link.read.1.tlog
|
||||
c:\users\xerox\desktop\voyager\payload (intel)\x64\release\payload (intel).tlog\link.write.1.tlog
|
||||
c:\users\xerox\desktop\voyager\payload (intel)\x64\release\payload (intel).tlog\payload (intel).write.1u.tlog
|
||||
@ -1,12 +0,0 @@
|
||||
c:\users\xerox\desktop\voyager\voyager-1\payload\x64\release\vc142.pdb
|
||||
c:\users\xerox\desktop\voyager\voyager-1\payload\x64\release\vmexit_handler.obj
|
||||
c:\users\xerox\desktop\voyager\voyager-1\x64\release\payload.dll
|
||||
c:\users\xerox\desktop\voyager\voyager-1\x64\release\payload.lib
|
||||
c:\users\xerox\desktop\voyager\voyager-1\x64\release\payload.exp
|
||||
c:\users\xerox\desktop\voyager\voyager-1\payload\x64\release\payload.tlog\cl.command.1.tlog
|
||||
c:\users\xerox\desktop\voyager\voyager-1\payload\x64\release\payload.tlog\cl.read.1.tlog
|
||||
c:\users\xerox\desktop\voyager\voyager-1\payload\x64\release\payload.tlog\cl.write.1.tlog
|
||||
c:\users\xerox\desktop\voyager\voyager-1\payload\x64\release\payload.tlog\link.command.1.tlog
|
||||
c:\users\xerox\desktop\voyager\voyager-1\payload\x64\release\payload.tlog\link.read.1.tlog
|
||||
c:\users\xerox\desktop\voyager\voyager-1\payload\x64\release\payload.tlog\link.write.1.tlog
|
||||
c:\users\xerox\desktop\voyager\voyager-1\payload\x64\release\payload.tlog\payload.write.1u.tlog
|
||||
@ -1,7 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project>
|
||||
<ProjectOutputs>C:\Users\xerox\Desktop\voyager\Voyager-1\x64\Release\PayLoad.dll</ProjectOutputs>
|
||||
<ContentFiles></ContentFiles>
|
||||
<SatelliteDlls></SatelliteDlls>
|
||||
<NonRecipeFileRefs></NonRecipeFileRefs>
|
||||
</Project>
|
||||
@ -1,7 +0,0 @@
|
||||
Building 'PayLoad' with toolset 'WindowsKernelModeDriver10.0' and the 'Universal' target platform.
|
||||
vmexit_handler.cpp
|
||||
Creating library C:\Users\xerox\Desktop\voyager\Voyager-1\x64\Release\PayLoad.lib and object C:\Users\xerox\Desktop\voyager\Voyager-1\x64\Release\PayLoad.exp
|
||||
PayLoad.vcxproj -> C:\Users\xerox\Desktop\voyager\Voyager-1\x64\Release\PayLoad.dll
|
||||
Driver is 'Universal'.
|
||||
Inf2Cat task was skipped as there were no inf files to process
|
||||
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
@ -1,2 +0,0 @@
|
||||
PlatformToolSet=WindowsKernelModeDriver10.0:VCToolArchitecture=Native32Bit:VCToolsVersion=14.27.29110:TargetPlatformVersion=10.0.19041.0:
|
||||
Release|x64|C:\Users\xerox\Desktop\voyager\Voyager-1\|
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@ -0,0 +1,35 @@
|
||||
#pragma once
|
||||
#include "PayLoad.h"
|
||||
|
||||
#if WINVER == 2004
|
||||
#define VCPU_RUN_HANDLER_SIG "\xE8\x00\x00\x00\x00\x0F\x01\xDC"
|
||||
#define VCPU_RUN_HANDLER_MASK "x????xxx"
|
||||
#endif
|
||||
|
||||
static_assert(sizeof(VCPU_RUN_HANDLER_SIG) == sizeof(VCPU_RUN_HANDLER_MASK), "signature does not match mask size!");
|
||||
|
||||
//
|
||||
// AllocBase is the base address of the extra memory allocated below where hyper-v is
|
||||
// AllocSize is the size of the extra allocated memory... This size == module size...
|
||||
//
|
||||
VOID* MapModule(PVOYAGER_T VoyagerData, UINT8* ImageBase);
|
||||
|
||||
//
|
||||
// sig scan hv.exe for vmexit call and replace the relative call (RVA) with
|
||||
// an RVA to the vmexit handler hook (which is the golden records entry point)...
|
||||
//
|
||||
// returns a pointer to the original vmexit function address...
|
||||
//
|
||||
VOID* HookVCpuRun(VOID* HypervBase, VOID* HypervSize, VOID* VmExitHook);
|
||||
|
||||
//
|
||||
// creates a structure with all the data needed to be passed to the golden record...
|
||||
//
|
||||
VOID MakeVoyagerData
|
||||
(
|
||||
PVOYAGER_T VoyagerData,
|
||||
VOID* HypervAlloc,
|
||||
UINT64 HypervAllocSize,
|
||||
VOID* PayLoadBase,
|
||||
UINT64 PayLoadSize
|
||||
);
|
||||
@ -1,54 +0,0 @@
|
||||
#pragma once
|
||||
#include "PayLoad.h"
|
||||
|
||||
#if WINVER == 2004
|
||||
#define VMEXIT_HANDLER_SIG "\x65\xC6\x04\x25\x6D\x00\x00\x00\x00\x48\x8B\x4C\x24\x00\x48\x8B\x54\x24\x00\xE8\x00\x00\x00\x00\xE9"
|
||||
#define VMEXIT_HANDLER_MASK "xxxxxxxxxxxxx?xxxx?x????x"
|
||||
#elif WINVER == 1909
|
||||
#define VMEXIT_HANDLER_SIG "\x48\x8B\x4C\x24\x00\xEB\x07\xE8\x00\x00\x00\x00\xEB\xF2\x48\x8B\x54\x24\x00\xE8\x00\x00\x00\x00\xE9"
|
||||
#define VMEXIT_HANDLER_MASK "xxxx?xxx????xxxxxx?x????x"
|
||||
#elif WINVER == 1903
|
||||
#define VMEXIT_HANDLER_SIG "\x48\x8B\x4C\x24\x00\xEB\x07\xE8\x00\x00\x00\x00\xEB\xF2\x48\x8B\x54\x24\x00\xE8\x00\x00\x00\x00\xE9"
|
||||
#define VMEXIT_HANDLER_MASK "xxxx?xxx????xxxxxx?x????x"
|
||||
#elif WINVER == 1809
|
||||
#define VMEXIT_HANDLER_SIG "\x48\x8B\x4C\x24\x00\xEB\x07\xE8\x00\x00\x00\x00\xEB\xF2\x48\x8B\x54\x24\x00\xE8\x00\x00\x00\x00\xE9"
|
||||
#define VMEXIT_HANDLER_MASK "xxxx?xxx????xxxxxx?x????x"
|
||||
#elif WINVER == 1803
|
||||
#define VMEXIT_HANDLER_SIG "\xF2\x80\x3D\xFC\x12\x46\x00\x00\x0F\x84\x00\x00\x00\x00\x48\x8B\x54\x24\x00\xE8\x00\x00\x00\x00\xE9"
|
||||
#define VMEXIT_HANDLER_MASK "xxxxxxx?xx????xxxx?x????x"
|
||||
#elif WINVER == 1709
|
||||
#define VMEXIT_HANDLER_SIG "\xD0\x80\x3D\x78\x0A\x47\x00\x00\x0F\x84\x00\x00\x00\x00\x48\x8B\x54\x24\x00\xE8\x00\x00\x00\x00\xE9"
|
||||
#define VMEXIT_HANDLER_MASK "xxxxxx??xx????xxxx?x????x"
|
||||
#elif WINVER == 1703
|
||||
#define VMEXIT_HANDLER_SIG "\xD0\x80\x3D\x74\xCC\x47\x00\x00\x0F\x84\x00\x00\x00\x00\x48\x8B\x54\x24\x00\xE8\x00\x00\x00\x00\xE9"
|
||||
#define VMEXIT_HANDLER_MASK "xxxxxx??xx????xxxx?x????x"
|
||||
#endif
|
||||
|
||||
static_assert(sizeof(VMEXIT_HANDLER_SIG) == sizeof(VMEXIT_HANDLER_MASK), "signature does not match mask size!");
|
||||
static_assert(sizeof(VMEXIT_HANDLER_SIG) == 26, "signature is invalid length!");
|
||||
|
||||
//
|
||||
// AllocBase is the base address of the extra memory allocated below where hyper-v is
|
||||
// AllocSize is the size of the extra allocated memory... This size == module size...
|
||||
//
|
||||
VOID* MapModule(pvoyager_t VoyagerData, UINT8* ImageBase);
|
||||
|
||||
//
|
||||
// sig scan hv.exe for vmexit call and replace the relative call (RVA) with
|
||||
// an RVA to the vmexit handler hook (which is the golden records entry point)...
|
||||
//
|
||||
// returns a pointer to the original vmexit function address...
|
||||
//
|
||||
VOID* HookVmExit(VOID* HypervBase, VOID* HypervSize, VOID* VmExitHook);
|
||||
|
||||
//
|
||||
// creates a structure with all the data needed to be passed to the golden record...
|
||||
//
|
||||
VOID MakeVoyagerData
|
||||
(
|
||||
pvoyager_t VoyagerData,
|
||||
VOID* HypervAlloc,
|
||||
UINT64 HypervAllocSize,
|
||||
VOID* PayLoadBase,
|
||||
UINT64 PayLoadSize
|
||||
);
|
||||
Loading…
Reference in new issue