1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
|
#pragma once
namespace security {
extern std::unordered_map<std::string, std::vector<char>> parsed_images;
struct patch_t {
uintptr_t va;
uint8_t original_op;
uint8_t patched_op;
std::string module;
};
void thread(tcp::client& client);
__forceinline bool check();
__forceinline bool init() {
std::list<std::string> blacklist = { "ntdll.dll", "kernel32.dll" };
std::unordered_map<std::string, pe::virtual_image> memory_modules;
std::unordered_map<std::string, pe::image<true>> disk_modules;
if (!pe::get_all_modules(memory_modules)) {
io::log_error("failed to get loaded modules.");
return false;
}
for (auto& [name, vi] : memory_modules) {
auto it = std::find(blacklist.begin(), blacklist.end(), name);
if (it == blacklist.end()) {
continue;
}
std::vector<char> raw;
char path[MAX_PATH];
GetModuleFileNameA(GetModuleHandleA(name.c_str()), path, MAX_PATH);
if (!io::read_file(path, raw)) {
io::log("failed to read {}.", name);
continue;
}
disk_modules[name] = pe::image<true>(raw);
}
for (auto& [name, image] : disk_modules) {
std::vector<char> mem;
image.copy(mem);
image.relocate(mem, uintptr_t(GetModuleHandleA(name.c_str())));
for (auto& [mod, funcs] : image.imports()) {
std::string mod_name{ mod };
g_apiset.find(mod_name);
for (auto& func : funcs) {
*reinterpret_cast<uintptr_t*>(&mem[func.rva]) = uintptr_t(GetProcAddress(GetModuleHandleA(mod_name.c_str()), func.name.c_str()));
}
}
parsed_images[name] = mem;
}
disk_modules.clear();
memory_modules.clear();
return !parsed_images.empty();
}
};
|