_xeroxz
/
xtils
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

added clang format file and image_size

Browse Source
master
_xeroxz 3 years ago
parent 7c32517322
commit 99a1fc74e1
2 changed files with 518 additions and 535 deletions
Show Stats Download Patch File Download Diff File

18
.clang-format
Unescape View File

@ -0,0 +1,18 @@
---
BasedOnStyle: Microsoft
AlignAfterOpenBracket: Align
AllowAllArgumentsOnNextLine: 'true'
AllowAllParametersOfDeclarationOnNextLine: 'true'
AllowShortIfStatementsOnASingleLine: Never
BreakBeforeBraces: Allman
IndentWidth: '4'
Language: Cpp
NamespaceIndentation: All
SpacesInAngles: 'true'
SpacesInCStyleCastParentheses: 'true'
SpacesInContainerLiterals: 'true'
SpacesInParentheses: 'true'
SpacesInSquareBrackets: 'true'
UseTab: Never
...

243
xtils.hpp
Unescape View File

@ -2,19 +2,19 @@
#define _CRT_SECURE_NO_WARNINGS
#pragma comment( lib, "ntdll.lib" )
#include <algorithm>
#include <cstdint>
#include <string>
#include <fstream>
#include <functional>
#include <map>
#include <memory>
#include <algorithm>
#include <functional>
#include <fstream>
#include <string>
#include <Windows.h>
#include <tlhelp32.h>
#include <ntstatus.h>
#include <psapi.h>
#include <tlhelp32.h>
#include <winternl.h>
#include <ntstatus.h>
#define LOG_SIG "[xtils]"
#define LOG( ... ) \
@ -24,8 +24,8 @@
OutputDebugStringA( buff ); \
}
#define NT_HEADER(x) reinterpret_cast<PIMAGE_NT_HEADERS>( \
uint64_t(x) + reinterpret_cast<PIMAGE_DOS_HEADER>(x)->e_lfanew )
#define NT_HEADER( x ) \
reinterpret_cast< PIMAGE_NT_HEADERS >( uint64_t( x ) + reinterpret_cast< PIMAGE_DOS_HEADER >( x )->e_lfanew )
#define PAGE_4K 0x1000
#define PAGE_2MB PAGE_4K * 512
@ -51,7 +51,6 @@ typedef struct _RTL_PROCESS_MODULES
RTL_PROCESS_MODULE_INFORMATION Modules[ 1 ];
} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;
namespace xtils
{
using uq_handle = std::unique_ptr< void, decltype( &CloseHandle ) >;
@ -62,7 +61,11 @@ namespace xtils
using module_map_t = std::map< std::wstring, std::uintptr_t >;
public:
static auto get_instance() -> um_t* { static um_t obj; return &obj; }
static auto get_instance() -> um_t *
{
static um_t obj;
return &obj;
}
auto image_base( const char *image_path ) -> std::uintptr_t
{
@ -74,11 +77,19 @@ namespace xtils
return NT_HEADER( image_header )->OptionalHeader.ImageBase;
}
auto sigscan(void* base, std::uint32_t size, const char* pattern, const char* mask) -> void*
auto image_size(const char* image_path) -> std::uintptr_t
{
static const auto check_mask =
[&](const char* base, const char* pattern, const char* mask) -> bool
char image_header[ PAGE_4K ];
std::ifstream file( image_path, std::ios::binary );
file.read( image_header, PAGE_4K );
file.close();
return NT_HEADER( image_header )->OptionalHeader.SizeOfImage;
}
auto sigscan( void *base, std::uint32_t size, const char *pattern, const char *mask ) -> void *
{
static const auto check_mask = [ & ]( const char *base, const char *pattern, const char *mask ) -> bool {
for ( ; *mask; ++base, ++pattern, ++mask )
if ( *mask == 'x' && *base != *pattern )
return false;
@ -107,8 +118,7 @@ namespace xtils
Module32First( snapshot.get(), &module_info );
// lowercase the module name...
std::for_each(module_info.szModule,
module_info.szModule + wcslen(module_info.szModule) * 2,
std::for_each( module_info.szModule, module_info.szModule + wcslen( module_info.szModule ) * 2,
[]( wchar_t &c ) { c = ::towlower( c ); } );
module_map[ module_info.szModule ] = reinterpret_cast< std::uintptr_t >( module_info.modBaseAddr );
@ -116,12 +126,10 @@ namespace xtils
for ( Module32First( snapshot.get(), &module_info ); Module32Next( snapshot.get(), &module_info ); )
{
// lowercase the module name...
std::for_each(module_info.szModule,
module_info.szModule + wcslen(module_info.szModule) * 2,
std::for_each( module_info.szModule, module_info.szModule + wcslen( module_info.szModule ) * 2,
[]( wchar_t &c ) { c = ::towlower( c ); } );
module_map[module_info.szModule] =
reinterpret_cast<std::uintptr_t>(module_info.modBaseAddr);
module_map[ module_info.szModule ] = reinterpret_cast< std::uintptr_t >( module_info.modBaseAddr );
}
return true;
@ -184,33 +192,26 @@ namespace xtils
auto get_handle( std::uint32_t pid, DWORD access = PROCESS_ALL_ACCESS ) -> uq_handle
{
if (!pid) return { NULL, &CloseHandle };
if ( !pid )
return { NULL, &CloseHandle };
return { OpenProcess( access, FALSE, pid ), &CloseHandle };
}
auto load_lib( HANDLE proc_handle, const char *dll_path ) -> std::uintptr_t
{
const auto dll_path_page =
VirtualAllocEx(
proc_handle,
nullptr,
0x1000,
MEM_COMMIT | MEM_RESERVE,
PAGE_READWRITE
);
VirtualAllocEx( proc_handle, nullptr, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE );
if ( !dll_path_page )
return {};
SIZE_T handled_bytes;
if (!WriteProcessMemory(proc_handle, dll_path_page,
dll_path, strlen(dll_path), &handled_bytes))
if ( !WriteProcessMemory( proc_handle, dll_path_page, dll_path, strlen( dll_path ), &handled_bytes ) )
return {};
// +6 for string address
// +16 for LoadLibrary address...
unsigned char jmp_code[] =
{
unsigned char jmp_code[] = {
0x48, 0x83, 0xEC, 0x28, // sub rsp, 0x28
0x48, 0xB9, 0x88, 0x77, 0x66, 0x55, 0x44, 0x33, 0x22, 0x11, // mov rcx, &dllpath
0x48, 0xB8, 0x88, 0x77, 0x66, 0x55, 0x44, 0x33, 0x22, 0x11, // mov rax, &LoadLibraryA
@ -227,24 +228,17 @@ namespace xtils
reinterpret_cast< std::uintptr_t >( &LoadLibraryA );
const auto jmp_code_page =
VirtualAllocEx(
proc_handle,
nullptr,
0x1000,
MEM_COMMIT | MEM_RESERVE,
PAGE_EXECUTE_READWRITE
);
VirtualAllocEx( proc_handle, nullptr, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE );
if ( !jmp_code_page )
return {};
if (!WriteProcessMemory(proc_handle,
jmp_code_page, jmp_code, sizeof jmp_code, &handled_bytes))
if ( !WriteProcessMemory( proc_handle, jmp_code_page, jmp_code, sizeof jmp_code, &handled_bytes ) )
return {};
DWORD tid = 0u;
auto thandle = CreateRemoteThread(proc_handle, nullptr,
NULL, (LPTHREAD_START_ROUTINE)jmp_code_page, nullptr, NULL, &tid);
auto thandle = CreateRemoteThread( proc_handle, nullptr, NULL, ( LPTHREAD_START_ROUTINE )jmp_code_page,
nullptr, NULL, &tid );
if ( thandle == INVALID_HANDLE_VALUE )
return {};
@ -253,25 +247,24 @@ namespace xtils
// read the base address out of the shellcode...
std::uintptr_t module_base = 0u;
if (!ReadProcessMemory(proc_handle, reinterpret_cast<void*>(
reinterpret_cast<std::uintptr_t>(jmp_code_page) + sizeof jmp_code),
if ( !ReadProcessMemory( proc_handle,
reinterpret_cast< void * >( reinterpret_cast< std::uintptr_t >( jmp_code_page ) +
sizeof jmp_code ),
&module_base, sizeof module_base, &handled_bytes ) )
return {};
return module_base;
}
auto start_exec(const char* image_path, char* cmdline = nullptr,
bool suspend = false) -> std::tuple<HANDLE, std::uint32_t, std::uintptr_t>
auto start_exec( const char *image_path, char *cmdline = nullptr, bool suspend = false )
-> std::tuple< HANDLE, std::uint32_t, std::uintptr_t >
{
STARTUPINFOA info = { sizeof info };
PROCESS_INFORMATION proc_info;
if (!CreateProcessA(image_path, cmdline, nullptr,
nullptr, false,
suspend ? CREATE_SUSPENDED | CREATE_NEW_CONSOLE : CREATE_NEW_CONSOLE,
nullptr, nullptr, &info, &proc_info
))
if ( !CreateProcessA( image_path, cmdline, nullptr, nullptr, false,
suspend ? CREATE_SUSPENDED | CREATE_NEW_CONSOLE : CREATE_NEW_CONSOLE, nullptr,
nullptr, &info, &proc_info ) )
return { {}, {}, {} };
Sleep( 1 ); // sleep just for a tiny amount of time so that get_process_base works...
@ -280,9 +273,7 @@ namespace xtils
std::uintptr_t scan( std::uintptr_t base, std::uint32_t size, const char *pattern, const char *mask )
{
static const auto check_mask =
[&](const char* base, const char* pattern, const char* mask) -> bool
{
static const auto check_mask = [ & ]( const char *base, const char *pattern, const char *mask ) -> bool {
for ( ; *mask; ++base, ++pattern, ++mask )
if ( *mask == 'x' && *base != *pattern )
return false;
@ -300,30 +291,35 @@ namespace xtils
}
private:
explicit um_t() {}
explicit um_t()
{
}
};
class km_t
{
using kmodule_callback_t = std::function< bool( PRTL_PROCESS_MODULE_INFORMATION, const char * ) >;
public:
static auto get_instance() -> km_t* { static km_t obj; return &obj; };
static auto get_instance() -> km_t *
{
static km_t obj;
return &obj;
};
auto get_base( const char *drv_name ) -> std::uintptr_t
{
void *buffer = nullptr;
DWORD buffer_size = NULL;
auto status = NtQuerySystemInformation(
static_cast<SYSTEM_INFORMATION_CLASS>(0xB),
buffer, buffer_size, &buffer_size);
auto status = NtQuerySystemInformation( static_cast< SYSTEM_INFORMATION_CLASS >( 0xB ), buffer, buffer_size,
&buffer_size );
while ( status == STATUS_INFO_LENGTH_MISMATCH )
{
VirtualFree( buffer, NULL, MEM_RELEASE );
buffer = VirtualAlloc( nullptr, buffer_size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE );
status = NtQuerySystemInformation(
static_cast<SYSTEM_INFORMATION_CLASS>(0xB),
buffer, buffer_size, &buffer_size);
status = NtQuerySystemInformation( static_cast< SYSTEM_INFORMATION_CLASS >( 0xB ), buffer, buffer_size,
&buffer_size );
}
if ( !NT_SUCCESS( status ) )
@ -336,15 +332,12 @@ namespace xtils
for ( auto idx = 0u; idx < modules->NumberOfModules; ++idx )
{
const auto current_module_name =
std::string(reinterpret_cast<char*>(
modules->Modules[idx].FullPathName) +
std::string( reinterpret_cast< char * >( modules->Modules[ idx ].FullPathName ) +
modules->Modules[ idx ].OffsetToFileName );
if ( !_stricmp( current_module_name.c_str(), drv_name ) )
{
const auto result =
reinterpret_cast<std::uint64_t>(
modules->Modules[idx].ImageBase);
const auto result = reinterpret_cast< std::uint64_t >( modules->Modules[ idx ].ImageBase );
VirtualFree( buffer, NULL, MEM_RELEASE );
return result;
@ -353,7 +346,6 @@ namespace xtils
VirtualFree( buffer, NULL, MEM_RELEASE );
return NULL;
}
void each_module( kmodule_callback_t callback )
@ -361,17 +353,15 @@ namespace xtils
void *buffer = nullptr;
DWORD buffer_size = NULL;
auto status = NtQuerySystemInformation(
static_cast<SYSTEM_INFORMATION_CLASS>(0xB),
buffer, buffer_size, &buffer_size);
auto status = NtQuerySystemInformation( static_cast< SYSTEM_INFORMATION_CLASS >( 0xB ), buffer, buffer_size,
&buffer_size );
while ( status == STATUS_INFO_LENGTH_MISMATCH )
{
VirtualFree( buffer, NULL, MEM_RELEASE );
buffer = VirtualAlloc( nullptr, buffer_size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE );
status = NtQuerySystemInformation(
static_cast<SYSTEM_INFORMATION_CLASS>(0xB),
buffer, buffer_size, &buffer_size);
status = NtQuerySystemInformation( static_cast< SYSTEM_INFORMATION_CLASS >( 0xB ), buffer, buffer_size,
&buffer_size );
}
if ( !NT_SUCCESS( status ) )
@ -383,17 +373,14 @@ namespace xtils
const auto modules = static_cast< PRTL_PROCESS_MODULES >( buffer );
for ( auto idx = 0u; idx < modules->NumberOfModules; ++idx )
{
auto full_path = std::string(
reinterpret_cast<char*>(
modules->Modules[idx].FullPathName));
auto full_path = std::string( reinterpret_cast< char * >( modules->Modules[ idx ].FullPathName ) );
if ( full_path.find( "\\SystemRoot\\" ) != std::string::npos )
full_path.replace(full_path.find("\\SystemRoot\\"),
sizeof("\\SystemRoot\\") - 1, std::string(getenv("SYSTEMROOT")).append("\\"));
full_path.replace( full_path.find( "\\SystemRoot\\" ), sizeof( "\\SystemRoot\\" ) - 1,
std::string( getenv( "SYSTEMROOT" ) ).append( "\\" ) );
else if ( full_path.find( "\\??\\" ) != std::string::npos )
full_path.replace(full_path.find("\\??\\"),
sizeof("\\??\\") - 1, "");
full_path.replace( full_path.find( "\\??\\" ), sizeof( "\\??\\" ) - 1, "" );
if ( !callback( &modules->Modules[ idx ], full_path.c_str() ) )
{
@ -406,29 +393,20 @@ namespace xtils
return;
}
auto get_export( const char *drv_name, const char *export_name ) -> std::uintptr_t
{
void *buffer = nullptr;
DWORD buffer_size = NULL;
NTSTATUS status = NtQuerySystemInformation(
static_cast<SYSTEM_INFORMATION_CLASS>(0xB),
buffer,
buffer_size,
&buffer_size
);
NTSTATUS status = NtQuerySystemInformation( static_cast< SYSTEM_INFORMATION_CLASS >( 0xB ), buffer,
buffer_size, &buffer_size );
while ( status == STATUS_INFO_LENGTH_MISMATCH )
{
VirtualFree( buffer, 0, MEM_RELEASE );
buffer = VirtualAlloc( nullptr, buffer_size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE );
status = NtQuerySystemInformation(
static_cast<SYSTEM_INFORMATION_CLASS>(0xB),
buffer,
buffer_size,
&buffer_size
);
status = NtQuerySystemInformation( static_cast< SYSTEM_INFORMATION_CLASS >( 0xB ), buffer, buffer_size,
&buffer_size );
}
if ( !NT_SUCCESS( status ) )
@ -442,37 +420,24 @@ namespace xtils
{
// find module and then load library it
const std::string current_module_name =
std::string(reinterpret_cast<char*>(
modules->Modules[idx].FullPathName) +
modules->Modules[idx].OffsetToFileName
);
std::string( reinterpret_cast< char * >( modules->Modules[ idx ].FullPathName ) +
modules->Modules[ idx ].OffsetToFileName );
if ( !_stricmp( current_module_name.c_str(), drv_name ) )
{
auto full_path = std::string(
reinterpret_cast<char*>(
modules->Modules[idx].FullPathName));
auto full_path = std::string( reinterpret_cast< char * >( modules->Modules[ idx ].FullPathName ) );
full_path.replace(full_path.find("\\SystemRoot\\"),
sizeof("\\SystemRoot\\") - 1, std::string(getenv("SYSTEMROOT")).append("\\"));
full_path.replace( full_path.find( "\\SystemRoot\\" ), sizeof( "\\SystemRoot\\" ) - 1,
std::string( getenv( "SYSTEMROOT" ) ).append( "\\" ) );
const auto module_base =
LoadLibraryExA(
full_path.c_str(),
NULL,
DONT_RESOLVE_DLL_REFERENCES
);
const auto module_base = LoadLibraryExA( full_path.c_str(), NULL, DONT_RESOLVE_DLL_REFERENCES );
const auto image_base =
reinterpret_cast<std::uintptr_t>(
modules->Modules[idx].ImageBase);
const auto image_base = reinterpret_cast< std::uintptr_t >( modules->Modules[ idx ].ImageBase );
// free the RTL_PROCESS_MODULES buffer...
VirtualFree( buffer, NULL, MEM_RELEASE );
const auto rva =
reinterpret_cast<std::uintptr_t>(
GetProcAddress(module_base, export_name)) -
const auto rva = reinterpret_cast< std::uintptr_t >( GetProcAddress( module_base, export_name ) ) -
reinterpret_cast< std::uintptr_t >( module_base );
return image_base + rva;
@ -481,47 +446,49 @@ namespace xtils
VirtualFree( buffer, NULL, MEM_RELEASE );
return NULL;
}
private:
explicit km_t() {}
explicit km_t()
{
}
};
class pe_t
{
using section_callback_t = std::function< bool( PIMAGE_SECTION_HEADER, std::uintptr_t ) >;
public:
static auto get_instance() -> pe_t* { static pe_t obj; return &obj; }
static auto get_instance() -> pe_t *
{
static pe_t obj;
return &obj;
}
// returns an std::vector containing all of the bytes of the section
// and also the RVA from the image base to the beginning of the section...
auto get_section(std::uintptr_t module_base,
const char* section_name) -> std::pair<std::vector<std::uint8_t>, std::uint32_t>
auto get_section( std::uintptr_t module_base, const char *section_name )
-> std::pair< std::vector< std::uint8_t >, std::uint32_t >
{
const auto nt_headers = reinterpret_cast< PIMAGE_NT_HEADERS >(
reinterpret_cast< PIMAGE_DOS_HEADER >( module_base )->e_lfanew + module_base );
const auto section_header =
reinterpret_cast<PIMAGE_SECTION_HEADER>(
reinterpret_cast<std::uintptr_t>(nt_headers) + sizeof(DWORD)
+ sizeof(IMAGE_FILE_HEADER) + nt_headers->FileHeader.SizeOfOptionalHeader);
const auto section_header = reinterpret_cast< PIMAGE_SECTION_HEADER >(
reinterpret_cast< std::uintptr_t >( nt_headers ) + sizeof( DWORD ) + sizeof( IMAGE_FILE_HEADER ) +
nt_headers->FileHeader.SizeOfOptionalHeader );
for ( auto idx = 0u; idx < nt_headers->FileHeader.NumberOfSections; ++idx )
{
const auto _section_name =
reinterpret_cast<char*>(
section_header[idx].Name);
const auto _section_name = reinterpret_cast< char * >( section_header[ idx ].Name );
// sometimes section names are not null terminated...
if ( !strncmp( _section_name, section_name, strlen( section_name ) - 1 ) )
{
const auto section_base =
reinterpret_cast<std::uint8_t*>(
module_base + section_header[idx].VirtualAddress);
reinterpret_cast< std::uint8_t * >( module_base + section_header[ idx ].VirtualAddress );
const auto section_end =
reinterpret_cast<std::uint8_t*>(
section_base + section_header[idx].Misc.VirtualSize);
reinterpret_cast< std::uint8_t * >( section_base + section_header[ idx ].Misc.VirtualSize );
std::vector< std::uint8_t > section_bin( section_base, section_end );
return { section_bin, section_header[ idx ].VirtualAddress };
@ -539,23 +506,21 @@ namespace xtils
const auto nt_headers = reinterpret_cast< PIMAGE_NT_HEADERS >(
reinterpret_cast< PIMAGE_DOS_HEADER >( module_base )->e_lfanew + module_base );
const auto section_header =
reinterpret_cast<PIMAGE_SECTION_HEADER>(
reinterpret_cast<std::uintptr_t>(nt_headers) + sizeof(DWORD)
+ sizeof(IMAGE_FILE_HEADER) + nt_headers->FileHeader.SizeOfOptionalHeader);
const auto section_header = reinterpret_cast< PIMAGE_SECTION_HEADER >(
reinterpret_cast< std::uintptr_t >( nt_headers ) + sizeof( DWORD ) + sizeof( IMAGE_FILE_HEADER ) +
nt_headers->FileHeader.SizeOfOptionalHeader );
for ( auto idx = 0u; idx < nt_headers->FileHeader.NumberOfSections; ++idx )
{
const auto _section_name =
reinterpret_cast<char*>(
section_header[idx].Name);
const auto _section_name = reinterpret_cast< char * >( section_header[ idx ].Name );
// keep looping until the callback returns false...
if ( !callback( &section_header[ idx ], module_base ) )
return;
}
}
private:
explicit pe_t(){};
};
}
} // namespace xtils
Write Preview
Loading…
Cancel
Save