From 661b73df47caae2cc62a9a2f7b85eb925ff1f80b Mon Sep 17 00:00:00 2001 From: auth12 <67507608+auth12@users.noreply.github.com> Date: Sun, 4 Jul 2021 01:15:09 +0100 Subject: initial commit --- sysmap/src/mapper/apiset.h | 41 ++++ sysmap/src/mapper/pe.h | 118 +++++++++++ sysmap/src/mapper/process.h | 458 +++++++++++++++++++++++++++++++++++++++++++ sysmap/src/mapper/syscalls.h | 116 +++++++++++ sysmap/src/mapper/util.h | 52 +++++ 5 files changed, 785 insertions(+) create mode 100644 sysmap/src/mapper/apiset.h create mode 100644 sysmap/src/mapper/pe.h create mode 100644 sysmap/src/mapper/process.h create mode 100644 sysmap/src/mapper/syscalls.h create mode 100644 sysmap/src/mapper/util.h (limited to 'sysmap/src/mapper') diff --git a/sysmap/src/mapper/apiset.h b/sysmap/src/mapper/apiset.h new file mode 100644 index 0000000..2797f8f --- /dev/null +++ b/sysmap/src/mapper/apiset.h @@ -0,0 +1,41 @@ +#pragma once + +struct apiset_t { + std::unordered_map> apiset_map; + + apiset_t() { + auto map = util::get_teb()->ProcessEnvironmentBlock->ApiSetMap; + auto map_ptr = uintptr_t(map); + + for (size_t i = 0; i < map->Count; i++) { + auto hash_entry = reinterpret_cast(map_ptr + map->HashOffset + (i * sizeof(API_SET_HASH_ENTRY))); + + auto namespace_entry = reinterpret_cast(map_ptr + map->EntryOffset + (hash_entry->Index * sizeof(API_SET_NAMESPACE_ENTRY))); + + std::wstring name(reinterpret_cast(map_ptr + namespace_entry->NameOffset), namespace_entry->NameLength / sizeof(wchar_t)); + + auto val_entry = reinterpret_cast(map_ptr + namespace_entry->ValueOffset); + + for (size_t j = 0; j < namespace_entry->ValueCount; j++, val_entry++) { + std::wstring val(reinterpret_cast(map_ptr + val_entry->ValueOffset), val_entry->ValueLength / sizeof(wchar_t)); + if (val.empty()) { + continue; + } + + apiset_map[util::to_multibyte(name)].emplace_back(util::to_multibyte(val)); + } + } + } + + std::string resolve(std::string_view mod) { + for (auto& [api, host] : apiset_map) { + if (mod.find(api) != std::string::npos) { + return host.front().compare(mod.data()) != 0 ? host.front() : host.back(); + } + } + + return mod.data(); + } +}; + +extern apiset_t g_apiset; \ No newline at end of file diff --git a/sysmap/src/mapper/pe.h b/sysmap/src/mapper/pe.h new file mode 100644 index 0000000..9841cb2 --- /dev/null +++ b/sysmap/src/mapper/pe.h @@ -0,0 +1,118 @@ +#pragma once + +#include + +namespace pe { + struct export_data_t { + uintptr_t func_rva; + std::string f_mod; + std::string f_func; + }; + + struct image_t { + uintptr_t base; + std::unordered_map exports; + std::vector sections; + + image_t() : base{ 0 } { } + image_t(uintptr_t b) : base{ b } { + auto image = reinterpret_cast(b); + + auto nt = image->get_nt_headers(); + + for (auto &sec : nt->sections()) { + sections.emplace_back(sec); + } + + auto export_dir = b + nt->optional_header.data_directories.export_directory.rva; + auto export_size = nt->optional_header.data_directories.export_directory.size; + + auto exp = reinterpret_cast(export_dir); + + if (exp->num_functions == 0) return; + + auto names = reinterpret_cast(b + exp->rva_names); + auto funcs = reinterpret_cast(b + exp->rva_functions); + auto ords = reinterpret_cast(b + exp->rva_name_ordinals); + + if (!names || !funcs || !ords) return; + + for (size_t i{}; i < exp->num_names; i++) { + std::string name = reinterpret_cast(b + names[i]); + + export_data_t ret; + + ret.func_rva = funcs[ords[i]]; + + uintptr_t proc_addr = b + funcs[ords[i]]; + if (proc_addr > export_dir && proc_addr < export_dir + export_size) { + std::string forwarded_name = reinterpret_cast(proc_addr); + + size_t delim = forwarded_name.find('.'); + if (delim == std::string::npos) continue; + + ret.f_mod = forwarded_name.substr(0, delim + 1); + ret.f_mod.append("dll"); + + std::transform(ret.f_mod.begin(), ret.f_mod.end(), ret.f_mod.begin(), ::tolower); + + ret.f_func = forwarded_name.substr(delim + 1); + } + + + exports[name] = ret; + } + } + }; + + struct import_data_t { + std::string name; + uintptr_t rva; + }; + + struct raw_image_t { + win::nt_headers_x64_t* nt; + + std::unordered_map> imports; + std::unordered_map> relocs; + std::vector sections; + + raw_image_t(std::vector& buffer) { + auto image = reinterpret_cast(buffer.data()); + + nt = image->get_nt_headers(); + + for (auto& sec : nt->sections()) { + sections.emplace_back(sec); + } + + auto import_rva = nt->optional_header.data_directories.import_directory.rva; + + auto desc = image->rva_to_ptr(import_rva); + + for (uint32_t i = 0; i < desc->rva_name; i = desc->rva_name, ++desc) { + std::string mod = image->rva_to_ptr(desc->rva_name); + + auto thunk = image->rva_to_ptr(desc->rva_original_first_thunk); + + for (uint32_t index = 0; thunk->address; index += sizeof(u64), ++thunk) { + auto named_import = image->rva_to_ptr(thunk->address); + + if (!thunk->is_ordinal) { + std::transform(mod.begin(), mod.end(), mod.begin(), ::tolower); + + imports[mod].emplace_back(import_data_t{ reinterpret_cast(named_import->name), desc->rva_first_thunk + index }); + } + } + } + + auto reloc_dir = image->rva_to_ptr(nt->optional_header.data_directories.basereloc_directory.rva); + + for (auto* block = &reloc_dir->first_block; block->base_rva; block = block->next()) { + for (auto& entry : *block) { + relocs[block->base_rva].emplace_back(entry); + } + } + } + }; +}; \ No newline at end of file diff --git a/sysmap/src/mapper/process.h b/sysmap/src/mapper/process.h new file mode 100644 index 0000000..77f7185 --- /dev/null +++ b/sysmap/src/mapper/process.h @@ -0,0 +1,458 @@ +#pragma once + + +namespace process { + struct process_info_t { + std::string name; + u16 pid; + }; + + struct process_iterator { + void* buf = nullptr; + + void* get_next() { + static ptrdiff_t offset = offsetof(SYSTEM_PROCESS_INFORMATION, NextEntryOffset); + + auto next_entry = *reinterpret_cast(uintptr_t(buf) + offset); + + if (next_entry == 0) { + return nullptr; + } + + buf = reinterpret_cast(uintptr_t(buf) + next_entry); + + return buf; + } + }; + + std::vector get_processes() { + std::vector buf; + std::vector out; + + static auto nt_query = g_syscalls.get("NtQuerySystemInformation"); + + ULONG size; + while (nt_query(SystemProcessInformation, &buf[0], static_cast(buf.size()), &size) == STATUS_INFO_LENGTH_MISMATCH) { + buf.resize(size); + }; + + process_iterator iter{ buf.data() }; + + void* ptr = iter.buf; + while (ptr) { + auto pi = reinterpret_cast(ptr); + + std::wstring s{ pi->ImageName.Buffer, pi->ImageName.Length / sizeof(wchar_t) }; + if (s.empty()) { + ptr = iter.get_next(); + + continue; + } + + out.emplace_back(process_info_t{ util::to_multibyte(s), reinterpret_cast(pi->UniqueProcessId) }); + + ptr = iter.get_next(); + } + + return out; + } + + struct process_x64_t { + process_info_t info; + HANDLE handle; + + std::vector modules; + + NTSTATUS open_handle() { + static auto nt_open = g_syscalls.get("NtOpenProcess"); + CLIENT_ID cid = { HANDLE(info.pid), 0 }; + OBJECT_ATTRIBUTES oa; + oa.Length = sizeof(oa); + oa.Attributes = 0; + oa.RootDirectory = 0; + oa.SecurityDescriptor = 0; + oa.ObjectName = 0; + oa.SecurityQualityOfService = 0; + + auto ret = nt_open(&handle, PROCESS_ALL_ACCESS, &oa, &cid); + + io::log("NtOpenProcess on {}, returned {:x}.", info.pid, ret & 0xFFFFFFFF); + + return ret; + } + + NTSTATUS attach(std::string_view process_name) { + auto processes = get_processes(); + auto it = std::find_if(processes.begin(), processes.end(), [&](process_info_t& info) { + return process_name.compare(info.name) == 0; + }); + + while (it == processes.end()) { + std::this_thread::sleep_for(3s); + + processes = get_processes(); + + it = std::find_if(processes.begin(), processes.end(), [&](process_info_t& info) { + return process_name.compare(info.name) == 0; + }); + } + + info = *it; + + return open_handle(); + } + + NTSTATUS read(uintptr_t addr, void* buf, size_t size) { + static auto nt_read = g_syscalls.get("NtReadVirtualMemory"); + + auto ret = nt_read(handle, reinterpret_cast(addr), buf, size, nullptr); + + //io::log("NtReadVirtualMemory at {:x}, buf {:x}, size {:x}, returned {:x}.", addr, uintptr_t(buf), size, ret & 0xFFFFFFFF); + + return ret; + } + + NTSTATUS write(uintptr_t addr, void* buf, size_t size) { + static auto nt_write = g_syscalls.get("NtWriteVirtualMemory"); + + auto ret = nt_write(handle, reinterpret_cast(addr), buf, size, nullptr); + io::log("NtWriteVirtualMemory at {:x}, buf {:x}, size {:x}, returned {:x}.", addr, uintptr_t(buf), size, ret & 0xFFFFFFFF); + + return ret; + } + + NTSTATUS protect(uintptr_t addr, size_t size, uint32_t new_protection, uint32_t* old_protection) { + static auto nt_protect = g_syscalls.get("NtProtectVirtualMemory"); + + void* addr_cast = reinterpret_cast(addr); + auto ret = nt_protect(handle, &addr_cast, &size, new_protection, (PULONG)old_protection); + + io::log("NtProtectVirtualMemory at {:x}, size {:x}, new_protection {:x}, old_protection {:x}, returned {:x}.", addr, size, new_protection, *old_protection, ret & 0xFFFFFFFF); + + return ret; + } + + NTSTATUS query_info(PROCESSINFOCLASS inf, void* dat, size_t size) { + static auto nt_info = g_syscalls.get("NtQueryInformationProcess"); + + auto ret = nt_info(handle, inf, dat, static_cast(size), nullptr); + + io::log("NtQueryInformationProcess with {:x}, dat {:x}, size {:x}, returned {:x}.", (int)inf, uintptr_t(dat), size, ret & 0xFFFFFFFF); + + return ret; + } + + NTSTATUS alloc(uintptr_t* out, size_t size, uint32_t type, uint32_t protection) { + static auto nt_alloc = g_syscalls.get("NtAllocateVirtualMemory"); + + void* base = nullptr; + auto ret = nt_alloc(handle, &base, 0, &size, type, protection); + *out = uintptr_t(base); + + io::log("NtAllocateVirtualMemory allocated at {:x}, size {:x}, type {:x}, protection {:x}, returned {:x}.", *out, size, type, protection, ret & 0xFFFFFFFF); + + return ret; + } + + NTSTATUS close(HANDLE handle) { + static auto nt_close = g_syscalls.get("NtClose"); + + auto ret = nt_close(handle); + io::log("NtClose on {:x}, returned {:x}.", uintptr_t(handle), ret & 0xFFFFFFFF); + + return ret; + } + + NTSTATUS get_peb(uintptr_t* out) { + PROCESS_BASIC_INFORMATION info; + auto status = query_info(ProcessBasicInformation, &info, sizeof(info)); + + *out = uintptr_t(info.PebBaseAddress); + + return status; + } + + std::vector get_modules() { + uintptr_t peb_ptr{ 0 }; + get_peb(&peb_ptr); + + PEB peb; + read(peb_ptr, &peb, sizeof(peb)); + + uintptr_t head = uintptr_t(peb.Ldr) + offsetof(PEB_LDR_DATA, InLoadOrderModuleList); + + LIST_ENTRY64 entry; + read(head, &entry, sizeof(entry)); + + LDR_DATA_TABLE_ENTRY ldr_entry; + std::vector ret; + + for (auto i = entry.Flink; i != head;) { + read(i, &ldr_entry, sizeof(ldr_entry)); + + i = uintptr_t(ldr_entry.InLoadOrderLinks.Flink); + + std::wstring ws; + ws.resize(ldr_entry.BaseDllName.Length); + + read(uintptr_t(ldr_entry.BaseDllName.Buffer), &ws[0], ws.size()); + + auto name = util::to_multibyte(ws); + + std::transform(name.begin(), name.end(), name.begin(), ::tolower); + + ret.emplace_back(util::module_data_t{ name, uintptr_t(ldr_entry.DllBase), ldr_entry.SizeOfImage }); + } + + return ret; + } + + uintptr_t get_module_export(util::module_data_t* module_info, std::string_view func) { + std::vector mapped_module(module_info->size); + + auto status = read(module_info->base, mapped_module.data(), mapped_module.size()); + if (!NT_SUCCESS(status)) { + return {}; + } + + pe::image_t img(uintptr_t(mapped_module.data())); + + return img.exports[func.data()].func_rva; + } + + auto get_module_exports(util::module_data_t* module_info) -> std::unordered_map { + if (!module_info->base) { + return {}; + } + + std::vector mapped_module(module_info->size); + + auto status = read(module_info->base, mapped_module.data(), mapped_module.size()); + if (!NT_SUCCESS(status)) { + return {}; + } + + pe::image_t img(uintptr_t(mapped_module.data())); + + return img.exports; + } + + util::module_data_t map_module(std::string_view name) { + auto resolved_name = g_apiset.resolve(name); + auto it = std::find_if(modules.begin(), modules.end(), [&](util::module_data_t& data) { + return data.name == resolved_name; + }); + + if (it != modules.end()) { + return *it; + } + + auto file = io::read_file(g_ctx.win_path.append(resolved_name)); + if (file.empty()) { + io::log("failed to read {}", resolved_name); + return {}; + } + + pe::raw_image_t image(file); + auto nt = image.nt; + + std::vector mapped_image(nt->optional_header.size_image); + + std::memcpy(&mapped_image[0], &file[0], nt->optional_header.size_headers); + for (auto& sec : image.sections) { + std::memcpy(&mapped_image[sec.virtual_address], &file[sec.ptr_raw_data], sec.size_raw_data); + } + + uintptr_t allocation_base{ 0 }; + auto status = alloc(&allocation_base, mapped_image.size(), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); + + if (!NT_SUCCESS(status)) { + io::log("failed to allocate memory for {}", resolved_name); + return {}; + } + + io::log("mapping {} to {:x}", resolved_name, allocation_base); + + io::log("fixing {} relocations...", resolved_name); + + auto delta = allocation_base - nt->optional_header.image_base; + if (delta > 0) { + for (auto& [block_rva, entries] : image.relocs) { + for (auto& e : entries) { + if (e.type == win::rel_based_high_low || e.type == win::rel_based_dir64) { + *reinterpret_cast(&mapped_image[block_rva + e.offset]) += delta; + } + } + } + } + + io::log("resolving {} imports...", resolved_name); + for (auto& [mod, funcs] : image.imports) { + auto mod_data = map_module(mod); + auto exports = get_module_exports(&mod_data); + + for (auto& f : funcs) { + auto exp_data = exports[f.name]; + + uintptr_t proc_addr{ 0 }; + if (!exp_data.f_mod.empty()) { + auto f_mod_data = map_module(exp_data.f_mod); + + proc_addr = f_mod_data.base + get_module_export(&f_mod_data, exp_data.f_func); + + io::log("{}!{}->{}!{}->{:x}", mod, f.name, exp_data.f_mod, exp_data.f_func, proc_addr); + + *reinterpret_cast(&mapped_image[f.rva]) = proc_addr; + + continue; + } + + proc_addr = mod_data.base + exports[f.name].func_rva; + + io::log("{}!{}->{:x}", mod, f.name, proc_addr); + + *reinterpret_cast(&mapped_image[f.rva]) = proc_addr; + } + } + + + io::log("writing {} image...", resolved_name); + status = write(allocation_base, mapped_image.data(), mapped_image.size()); + if (!NT_SUCCESS(status)) { + io::log("failed to write mapped image for {}", resolved_name); + return {}; + } + + io::log("fixing {} section permissions...", resolved_name); + for (auto& sec : image.sections) { + uintptr_t addr = allocation_base + sec.virtual_address; + uint32_t prot; + if (sec.characteristics.mem_execute) { + prot = PAGE_EXECUTE; + + if (sec.characteristics.mem_read) { + prot = PAGE_EXECUTE_READ; + } + + if (sec.characteristics.mem_write) { + prot = PAGE_EXECUTE_READWRITE; + } + } + else { + prot = PAGE_NOACCESS; + if (sec.characteristics.mem_read) { + prot = PAGE_READONLY; + } + + if (sec.characteristics.mem_write) { + prot = PAGE_READWRITE; + } + } + + uint32_t old_protection; + status = protect(addr, sec.size_raw_data, prot, &old_protection); + if (!NT_SUCCESS(status)) { + io::log("failed to set section permissions on {} for {}", sec.name.to_string(), resolved_name); + continue; + } + } + + io::log("successfully mapped {}", resolved_name); + + return util::module_data_t{ resolved_name, allocation_base, mapped_image.size() }; + } + + util::module_data_t map(std::vector file) { + pe::raw_image_t image(file); + auto nt = image.nt; + + std::vector mapped_image(nt->optional_header.size_image); + + for (auto& sec : image.sections) { + std::memcpy(&mapped_image[sec.virtual_address], &file[sec.ptr_raw_data], sec.size_raw_data); + } + + uintptr_t allocation_base{ 0 }; + auto status = alloc(&allocation_base, mapped_image.size(), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); + + if (!NT_SUCCESS(status)) { + io::log("failed to allocate memory for target image"); + return {}; + } + + io::log("mapping target image to {:x}", allocation_base); + + const u16 headers_size = 4096; + + io::log("fixing target image relocations..."); + + auto delta = allocation_base - nt->optional_header.image_base; + if (delta > 0) { + for (auto& [block_rva, entries] : image.relocs) { + for (auto& e : entries) { + if (e.type == win::rel_based_high_low || e.type == win::rel_based_dir64) { + *reinterpret_cast(&mapped_image[block_rva + e.offset]) += delta - headers_size; + } + } + } + } + + io::log("resolving target image imports..."); + for (auto& [mod, funcs] : image.imports) { + auto mod_data = map_module(mod); + auto exports = get_module_exports(&mod_data); + + for (auto& f : funcs) { + auto exp_data = exports[f.name]; + + uintptr_t proc_addr{ 0 }; + if (!exp_data.f_mod.empty()) { + auto f_mod_data = map_module(exp_data.f_mod); + + proc_addr = f_mod_data.base + get_module_export(&f_mod_data, exp_data.f_func); + + io::log("{}!{}->{}!{}->{:x}", mod, f.name, exp_data.f_mod, exp_data.f_func, proc_addr); + + *reinterpret_cast(&mapped_image[f.rva]) = proc_addr; + + continue; + } + + proc_addr = mod_data.base + exports[f.name].func_rva; + + io::log("{}!{}->{:x}", mod, f.name, proc_addr); + + *reinterpret_cast(&mapped_image[f.rva]) = proc_addr; + } + } + + + io::log("writing target image..."); + status = write(allocation_base, mapped_image.data() + headers_size, mapped_image.size() - headers_size); + if (!NT_SUCCESS(status)) { + io::log("failed to write mapped image"); + return {}; + } + + static std::vector shellcode = { 0x48, 0x83, 0xEC, 0x28, 0x48, 0xB9, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x48, 0xC7, 0xC2,0x01, 0x00, 0x00, 0x00, 0x4D, 0x31, 0xC0, + 0x48, 0xB8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xD0, 0x48, 0x83, 0xC4, 0x28, 0xC3 }; + + *reinterpret_cast(&shellcode[6]) = allocation_base; + *reinterpret_cast(&shellcode[26]) = allocation_base + nt->optional_header.entry_point - headers_size; + + uintptr_t shellcode_base; + alloc(&shellcode_base, shellcode.size(), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); + + io::log("writing shellcode at {:x}...", shellcode_base); + + write(shellcode_base, shellcode.data(), shellcode.size()); + + CreateRemoteThread(handle, 0, 0, (LPTHREAD_START_ROUTINE)shellcode_base, 0, 0, 0); + + io::log("mapped target image"); + + return util::module_data_t{ "", allocation_base, mapped_image.size() }; + } + }; +} \ No newline at end of file diff --git a/sysmap/src/mapper/syscalls.h b/sysmap/src/mapper/syscalls.h new file mode 100644 index 0000000..d7b917d --- /dev/null +++ b/sysmap/src/mapper/syscalls.h @@ -0,0 +1,116 @@ +#pragma once + +struct syscalls_t { + void* call_table; + std::vector stub; + + std::unordered_map syscalls; + + syscalls_t() : call_table{nullptr} {} + + void init() { + auto ntdll_base = g_ctx.local_modules[1].base; + auto ntdll = pe::image_t(ntdll_base); + + u32 max_index = 0; + for (auto& [name, exp_data] : ntdll.exports) { + auto fn = reinterpret_cast(ntdll_base + exp_data.func_rva); + auto size = get_size(fn); + + if (!is_valid(fn, size)) { + continue; + } + + if (stub.empty()) { + for (size_t i = 0; i < size; i++) { + if (fn[i] == x64::test_imm8) { // skip and + i += 9; + continue; + } + + stub.emplace_back(fn[i]); + } + } + + u32 idx = get_idx(fn, size); + + if (idx > max_index) + max_index = idx; + + syscalls[name] = idx; + } + + size_t table_size = stub.size() * (max_index + 1); + + call_table = VirtualAlloc(0, table_size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); + + if (!call_table) { + io::log("failed to allocated syscall call table."); + return; + } + + io::log("syscall call table allocated at {:x}.", uintptr_t(call_table)); + + std::memset(call_table, x64::nop, table_size); + + for (auto& [hash, index] : syscalls) { + uintptr_t func_dest = uintptr_t(call_table) + (index * stub.size()); + std::memcpy(reinterpret_cast(func_dest), stub.data(), stub.size()); + + *reinterpret_cast(func_dest + 4) = index; + } + + DWORD old; + VirtualProtect(call_table, table_size, PAGE_EXECUTE, &old); + } + + template< typename T = void* > + __forceinline T get(std::string_view fn) { + return reinterpret_cast(uintptr_t(call_table) + (syscalls[fn.data()] * stub.size())); + } + + + uint16_t get_idx(u8 *fn, size_t size) { + for (size_t i = 0; i < size; i++) { + auto op = fn[i]; + if (op == x64::mov_imm16) { + return *reinterpret_cast(&fn[i + 1]); + } + } + + return 0; + } + + size_t get_size(const u8* func) { + for (size_t i = 0; i < 64; i++) { + auto op = func[i]; + if (op == x64::retn) { + return i + 1; + } + } + + return 0; + } + + bool is_valid(u8* func, size_t size) { + // mov r10, rcx + u32 a = func[0] + func[1] + func[2]; + if (a != 0x1a8) { + return false; + } + + for (size_t i = 0; i < size; i++) { + auto cur = func[i]; + auto next = func[i + 1]; + + // syscall + if (cur == 0x0f && next == 0x05) { + return true; + } + } + + return false; + } +}; + +extern syscalls_t g_syscalls; \ No newline at end of file diff --git a/sysmap/src/mapper/util.h b/sysmap/src/mapper/util.h new file mode 100644 index 0000000..f50192b --- /dev/null +++ b/sysmap/src/mapper/util.h @@ -0,0 +1,52 @@ +#pragma once + +namespace util { + struct module_data_t { + std::string name; + uintptr_t base; + size_t size; + std::string full_path; + }; + + std::string to_multibyte(std::wstring_view str) { + return std::filesystem::path(str.data()).string(); + } + + std::wstring to_wide(std::string_view str) { + return std::filesystem::path(str.data()).wstring(); + } + + TEB* get_teb() { + return reinterpret_cast(__readgsqword(0x30)); + } + + std::vector get_modules() { + std::vector ret{}; + + auto* list = &get_teb()->ProcessEnvironmentBlock->Ldr->InMemoryOrderModuleList; + + for (auto i = list->Flink; i != list; i = i->Flink) { + auto entry = CONTAINING_RECORD(i, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks); + if (!entry) + continue; + + auto name = util::to_multibyte(entry->BaseDllName.Buffer); + std::transform(name.begin(), name.end(), name.begin(), tolower); + + auto full_path = util::to_multibyte(entry->FullDllName.Buffer); + + ret.emplace_back(module_data_t{name, uintptr_t(entry->DllBase), entry->SizeOfImage, full_path}); + } + + return ret; + } +}; + +namespace x64 { + enum inst : uint8_t { + retn = 0xC3, + mov_imm16 = 0xB8, + nop = 0x90, + test_imm8 = 0xF6 + }; +}; \ No newline at end of file -- cgit v1.2.3