From 7b6964eb1bcf30a0ae7ed3391adce30565b262b4 Mon Sep 17 00:00:00 2001 From: ladevieq Date: Sun, 12 Jul 2026 00:47:54 +0200 Subject: Load functions by hand --- include/cvinfo.h | 6 +- include/events.h | 18 +-- include/funcs.h | 35 +++++ include/hashmap.h | 2 +- include/module.h | 2 +- include/utils.h | 3 +- include/win_funcs.h | 401 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 7 files changed, 452 insertions(+), 15 deletions(-) create mode 100644 include/funcs.h create mode 100644 include/win_funcs.h (limited to 'include') diff --git a/include/cvinfo.h b/include/cvinfo.h index efbf706..0f55ead 100644 --- a/include/cvinfo.h +++ b/include/cvinfo.h @@ -1173,7 +1173,7 @@ typedef struct TYPTYPE { unsigned char data[CV_ZEROLEN]; } TYPTYPE; // general types record -__INLINE char *NextType ( _In_ char * pType) { +__INLINE char *NextType ( char * pType) { return (pType + ((TYPTYPE *)pType)->len + sizeof(unsigned short)); } @@ -4389,7 +4389,7 @@ typedef struct POGOINFO { unsigned short rectyp; // S_POGODATA unsigned long invocations; // Number of times function was called - __int64 dynCount; // Dynamic instruction count + i64 dynCount; // Dynamic instruction count unsigned long numInstrs; // Static instruction count unsigned long staInstLive; // Final static instruction count (post inlining) } POGOINFO; @@ -4568,7 +4568,7 @@ typedef struct PDBMAP { // V7 line number data types // -enum DEBUG_S_SUBSECTION_TYPE { +enum DEBUG_S_SUBSECTION_TYPE : i64 { DEBUG_S_IGNORE = 0x80000000, // if this bit is set in a subsection type then ignore the subsection contents DEBUG_S_SYMBOLS = 0xf1, diff --git a/include/events.h b/include/events.h index 65131c6..1055f84 100644 --- a/include/events.h +++ b/include/events.h @@ -1,19 +1,19 @@ #pragma once -extern void handle_create_process(); +extern void handle_create_process(void); -extern void handle_create_thread(); +extern void handle_create_thread(void); -extern void handle_exception(); +extern void handle_exception(void); -extern void handle_exit_process(); +extern void handle_exit_process(void); -extern void handle_exit_thread(); +extern void handle_exit_thread(void); -extern void handle_load_dll(); +extern void handle_load_dll(void); -extern void handle_unload_dll(); +extern void handle_unload_dll(void); -extern void handle_output_debug_string(); +extern void handle_output_debug_string(void); -extern void handle_rip(); +extern void handle_rip(void); diff --git a/include/funcs.h b/include/funcs.h new file mode 100644 index 0000000..7661539 --- /dev/null +++ b/include/funcs.h @@ -0,0 +1,35 @@ +KERNEL_BASE(VirtualAlloc) +KERNEL_BASE(VirtualFree) + +KERNEL32(CreateProcessA) +KERNEL32(OpenProcess) +KERNEL32(TerminateProcess) + +KERNEL32(OpenThread) +KERNEL32(GetThreadContext) +KERNEL32(SetThreadContext) + +KERNEL32(CreateFileA) +KERNEL32(ReadFile) +KERNEL32(WriteFile) +KERNEL32(SetFilePointer) +KERNEL32(GetStdHandle) +KERNEL32(GetLastError) + +KERNEL32(SetConsoleMode) +KERNEL32(ReadConsoleA) +KERNEL32(WriteConsoleA) + +KERNEL32(ReadProcessMemory) +KERNEL32(OutputDebugStringA) +KERNEL32(ContinueDebugEvent) +KERNEL32(WaitForDebugEventEx) + +KERNEL32(WideCharToMultiByte) +KERNEL32(GetFinalPathNameByHandleA) +KERNEL32(CompareStringA) + +KERNEL32(CloseHandle) + +KERNEL32(memset) +KERNEL32(memcpy) diff --git a/include/hashmap.h b/include/hashmap.h index 88490e7..7053419 100644 --- a/include/hashmap.h +++ b/include/hashmap.h @@ -17,7 +17,7 @@ struct hashmap { struct element* arr; }; -extern struct hashmap create_unordered_flat(); +extern struct hashmap create_unordered_flat(void); extern struct element* insert_elem(struct hashmap* map, u32 start, u32 end, u64 name); diff --git a/include/module.h b/include/module.h index 89a2d8c..f61437e 100644 --- a/include/module.h +++ b/include/module.h @@ -141,7 +141,7 @@ struct module { extern struct module modules[64U]; extern u64 modules_list; -extern u8 add_module(); +extern u8 add_module(void); extern void remove_module(u8 index); diff --git a/include/utils.h b/include/utils.h index d93d2bb..24083cf 100644 --- a/include/utils.h +++ b/include/utils.h @@ -5,9 +5,10 @@ #if defined (_DEBUG) #define assert(x) if (!(x)) __debugbreak(); #else -#define assert(x) (x) +#define assert(x) ((void)((x) ? 1 : 0)) #endif +#define NULL 0 #define TRUE 1 #define FALSE 0 diff --git a/include/win_funcs.h b/include/win_funcs.h new file mode 100644 index 0000000..9ea4510 --- /dev/null +++ b/include/win_funcs.h @@ -0,0 +1,401 @@ +#pragma once + +#include "types.h" + +typedef u32 (*PTHREAD_START_ROUTINE)(void* lpThreadParameter); +typedef PTHREAD_START_ROUTINE LPTHREAD_START_ROUTINE; + +#define EXCEPTION_MAXIMUM_PARAMETERS 15 // maximum number of exception parameters + +// +// Exception record definition. +// + +typedef struct _EXCEPTION_RECORD { + u32 ExceptionCode; + u32 ExceptionFlags; + struct _EXCEPTION_RECORD *ExceptionRecord; + void* ExceptionAddress; + u32 NumberParameters; + u64* ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; + } EXCEPTION_RECORD; + +typedef EXCEPTION_RECORD *PEXCEPTION_RECORD; + +typedef struct _EXCEPTION_DEBUG_INFO { + EXCEPTION_RECORD ExceptionRecord; + u32 dwFirstChance; +} EXCEPTION_DEBUG_INFO, *LPEXCEPTION_DEBUG_INFO; + +typedef struct _CREATE_THREAD_DEBUG_INFO { + void* hThread; + void* lpThreadLocalBase; + LPTHREAD_START_ROUTINE lpStartAddress; +} CREATE_THREAD_DEBUG_INFO, *LPCREATE_THREAD_DEBUG_INFO; + +typedef struct _CREATE_PROCESS_DEBUG_INFO { + void* hFile; + void* hProcess; + void* hThread; + void* lpBaseOfImage; + u32 dwDebugInfoFileOffset; + u32 nDebugInfoSize; + void* lpThreadLocalBase; + LPTHREAD_START_ROUTINE lpStartAddress; + void* lpImageName; + u16 fUnicode; +} CREATE_PROCESS_DEBUG_INFO, *LPCREATE_PROCESS_DEBUG_INFO; + +typedef struct _EXIT_THREAD_DEBUG_INFO { + u32 dwExitCode; +} EXIT_THREAD_DEBUG_INFO, *LPEXIT_THREAD_DEBUG_INFO; + +typedef struct _EXIT_PROCESS_DEBUG_INFO { + u32 dwExitCode; +} EXIT_PROCESS_DEBUG_INFO, *LPEXIT_PROCESS_DEBUG_INFO; + +typedef struct _LOAD_DLL_DEBUG_INFO { + void* hFile; + void* lpBaseOfDll; + u32 dwDebugInfoFileOffset; + u32 nDebugInfoSize; + void* lpImageName; + u16 fUnicode; +} LOAD_DLL_DEBUG_INFO, *LPLOAD_DLL_DEBUG_INFO; + +typedef struct _UNLOAD_DLL_DEBUG_INFO { + void* lpBaseOfDll; +} UNLOAD_DLL_DEBUG_INFO, *LPUNLOAD_DLL_DEBUG_INFO; + +typedef struct _OUTPUT_DEBUG_STRING_INFO { + char* lpDebugStringData; + u16 fUnicode; + u16 nDebugStringLength; +} OUTPUT_DEBUG_STRING_INFO, *LPOUTPUT_DEBUG_STRING_INFO; + +typedef struct _RIP_INFO { + u32 dwError; + u32 dwType; +} RIP_INFO, *LPRIP_INFO; + +typedef struct _DEBUG_EVENT { + u32 dwDebugEventCode; + u32 dwProcessId; + u32 dwThreadId; + union { + EXCEPTION_DEBUG_INFO Exception; + CREATE_THREAD_DEBUG_INFO CreateThread; + CREATE_PROCESS_DEBUG_INFO CreateProcessInfo; + EXIT_THREAD_DEBUG_INFO ExitThread; + EXIT_PROCESS_DEBUG_INFO ExitProcess; + LOAD_DLL_DEBUG_INFO LoadDll; + UNLOAD_DLL_DEBUG_INFO UnloadDll; + OUTPUT_DEBUG_STRING_INFO DebugString; + RIP_INFO RipInfo; + } u; +} DEBUG_EVENT, *LPDEBUG_EVENT; + + +typedef struct _CONSOLE_READCONSOLE_CONTROL { + u32 nLength; + u32 nInitialChars; + u32 dwCtrlWakeupMask; + u32 dwControlKeyState; +} CONSOLE_READCONSOLE_CONTROL, *PCONSOLE_READCONSOLE_CONTROL; + +typedef struct _STARTUPINFOA { + u32 cb; + i8* lpReserved; + i8* lpDesktop; + i8* lpTitle; + u32 dwX; + u32 dwY; + u32 dwXSize; + u32 dwYSize; + u32 dwXCountChars; + u32 dwYCountChars; + u32 dwFillAttribute; + u32 dwFlags; + u16 wShowWindow; + u16 cbReserved2; + u8* lpReserved2; + void* hStdInput; + void* hStdOutput; + void* hStdError; +} STARTUPINFOA, *LPSTARTUPINFOA; + +typedef struct _SECURITY_ATTRIBUTES { + u32 nLength; + void* lpSecurityDescriptor; + i32 bInheritHandle; +} SECURITY_ATTRIBUTES, *PSECURITY_ATTRIBUTES, *LPSECURITY_ATTRIBUTES; + +typedef struct _PROCESS_INFORMATION { + void* hProcess; + void* hThread; + u32 dwProcessId; + u32 dwThreadId; +} PROCESS_INFORMATION, *PPROCESS_INFORMATION, *LPPROCESS_INFORMATION; + +typedef struct _OVERLAPPED { + u32* Internal; + u32* InternalHigh; + union { + struct { + u32 Offset; + u32 OffsetHigh; + } DUMMYSTRUCTNAME; + void* Pointer; + } DUMMYUNIONNAME; + + void* hEvent; +} OVERLAPPED, *LPOVERLAPPED; + +// +// Define 128-bit 16-byte aligned xmm register type. +// + +typedef struct __declspec(align(16)) _M128A { + u64 Low; + i64 High; +} M128A, *PM128A; + +// +// Format of data for (F)XSAVE/(F)XRSTOR instruction +// + +typedef struct __declspec(align(16)) _XSAVE_FORMAT { + u16 ControlWord; + u16 StatusWord; + u8 TagWord; + u8 Reserved1; + u16 ErrorOpcode; + u32 ErrorOffset; + u16 ErrorSelector; + u16 Reserved2; + u32 DataOffset; + u16 DataSelector; + u16 Reserved3; + u32 MxCsr; + u32 MxCsr_Mask; + M128A FloatRegisters[8]; + +#if defined(_WIN64) + + M128A XmmRegisters[16]; + u8 Reserved4[96]; + +#else + + M128A XmmRegisters[8]; + BYTE Reserved4[224]; + +#endif + +} XSAVE_FORMAT, *PXSAVE_FORMAT; +typedef XSAVE_FORMAT XMM_SAVE_AREA32, *PXMM_SAVE_AREA32; + +// +// Context Frame +// +// This frame has a several purposes: 1) it is used as an argument to +// NtContinue, 2) it is used to constuct a call frame for APC delivery, +// and 3) it is used in the user level thread creation routines. +// +// +// The flags field within this record controls the contents of a CONTEXT +// record. +// +// If the context record is used as an input parameter, then for each +// portion of the context record controlled by a flag whose value is +// set, it is assumed that that portion of the context record contains +// valid context. If the context record is being used to modify a threads +// context, then only that portion of the threads context is modified. +// +// If the context record is used as an output parameter to capture the +// context of a thread, then only those portions of the thread's context +// corresponding to set flags will be returned. +// +// CONTEXT_CONTROL specifies SegSs, Rsp, SegCs, Rip, and EFlags. +// +// CONTEXT_INTEGER specifies Rax, Rcx, Rdx, Rbx, Rbp, Rsi, Rdi, and R8-R15. +// +// CONTEXT_SEGMENTS specifies SegDs, SegEs, SegFs, and SegGs. +// +// CONTEXT_FLOATING_POINT specifies Xmm0-Xmm15. +// +// CONTEXT_DEBUG_REGISTERS specifies Dr0-Dr3 and Dr6-Dr7. +// + +typedef struct __declspec(align(16)) _CONTEXT { + + // + // Register parameter home addresses. + // + // N.B. These fields are for convience - they could be used to extend the + // context record in the future. + // + + u64 P1Home; + u64 P2Home; + u64 P3Home; + u64 P4Home; + u64 P5Home; + u64 P6Home; + + // + // Control flags. + // + + u32 ContextFlags; + u32 MxCsr; + + // + // Segment Registers and processor flags. + // + + u16 SegCs; + u16 SegDs; + u16 SegEs; + u16 SegFs; + u16 SegGs; + u16 SegSs; + u32 EFlags; + + // + // Debug registers + // + + u64 Dr0; + u64 Dr1; + u64 Dr2; + u64 Dr3; + u64 Dr6; + u64 Dr7; + + // + // Integer registers. + // + + u64 Rax; + u64 Rcx; + u64 Rdx; + u64 Rbx; + u64 Rsp; + u64 Rbp; + u64 Rsi; + u64 Rdi; + u64 R8; + u64 R9; + u64 R10; + u64 R11; + u64 R12; + u64 R13; + u64 R14; + u64 R15; + + // + // Program counter. + // + + u64 Rip; + + // + // Floating point state. + // + + union { + XMM_SAVE_AREA32 FltSave; + struct { + M128A Header[2]; + M128A Legacy[8]; + M128A Xmm0; + M128A Xmm1; + M128A Xmm2; + M128A Xmm3; + M128A Xmm4; + M128A Xmm5; + M128A Xmm6; + M128A Xmm7; + M128A Xmm8; + M128A Xmm9; + M128A Xmm10; + M128A Xmm11; + M128A Xmm12; + M128A Xmm13; + M128A Xmm14; + M128A Xmm15; + }; + }; + + // + // Vector registers. + // + + M128A VectorRegister[26]; + u64 VectorControl; + + // + // Special debug control registers. + // + + u64 DebugControl; + u64 LastBranchToRip; + u64 LastBranchFromRip; + u64 LastExceptionToRip; + u64 LastExceptionFromRip; +} CONTEXT, *PCONTEXT; +typedef PCONTEXT LPCONTEXT; + +// ======================= +// ====== Funcs PFN ====== +// ======================= +typedef void*(*PFN_VirtualAlloc)(void*, u64, u32, u32); +typedef i32(*PFN_VirtualFree)(void*, size_t, u32); + +typedef i32(*PFN_CreateProcessA)(const i8*, i8*, LPSECURITY_ATTRIBUTES, LPSECURITY_ATTRIBUTES, i32, u32, void*, const i8*, LPSTARTUPINFOA, LPPROCESS_INFORMATION); +typedef void*(*PFN_OpenProcess)(u32, i32, u32); +typedef i32(*PFN_TerminateProcess)(void*, u32); + +typedef void*(*PFN_OpenThread)(u32, i32, u32); +typedef i32(*PFN_GetThreadContext)(void*, LPCONTEXT); +typedef i32(*PFN_SetThreadContext)(void*, const CONTEXT*); + +typedef void*(*PFN_CreateFileA)(const i8*, u32, u32, LPSECURITY_ATTRIBUTES, u32, u32, void*); +typedef i32(*PFN_ReadFile)(void*, void*, u32, u32*, LPOVERLAPPED); +typedef u32(*PFN_SetFilePointer)(void*, i32, i32*, u32); +typedef i32(*PFN_WriteFile)(void*, const void*, u32, u32*, LPOVERLAPPED); +typedef void*(*PFN_GetStdHandle)(u32); +typedef u32(*PFN_GetLastError)(void); + +typedef i32(*PFN_SetConsoleMode)(void*, u32); +typedef i32(*PFN_ReadConsoleA)(void*, void*, u32, u32*, PCONSOLE_READCONSOLE_CONTROL); +typedef i32(*PFN_WriteConsoleA)(void*, const void*, u32, u32*, void*); + +typedef i32(*PFN_ReadProcessMemory)(void*, const void*, void*, size_t, size_t*); +typedef i32(*PFN_OutputDebugStringA)(const char*); +typedef i32(*PFN_ContinueDebugEvent)(u32, u32, u32); +typedef i32(*PFN_WaitForDebugEventEx)(LPDEBUG_EVENT, u32); + + +typedef i32(*PFN_CompareStringA)(u32, u32, const i8*, i32, const i8*, i32); +typedef i32(*PFN_WideCharToMultiByte)(u32, u32, const u16*, i32, i8*, i32, i8*, i32*); +typedef u32(*PFN_GetFinalPathNameByHandleA)(void*, i8*, u32, u32); + +typedef i32(*PFN_CloseHandle)(void*); + +typedef i32(*PFN_memset)(void*, void*, size_t, char); +typedef i32(*PFN_memcpy)(void*, void*, size_t); + +// ========================== +// ====== Funcs extern ====== +// ========================== +#define KERNEL32(name) \ + extern PFN_##name name; +#define KERNEL_BASE(name) \ + extern PFN_##name name; + +#include "funcs.h" + +#undef KERNEL_BASE +#undef KERNEL32 -- cgit v1.3