Skip to content

Commit d9db402

Browse files
brosckbrosck
authored
Add files via upload
1 parent 053b4cf commit d9db402

File tree

4 files changed

+255
-0
lines changed

4 files changed

+255
-0
lines changed

‎Detector/Detector.cpp

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
#include <stdio.h>
2+
#include <windows.h>
3+
#include <winternl.h>
4+
5+
BOOL DetectHook(LPVOID hookedfuncaddr) {
6+
BYTE realbytes[] = "\x4C\x8B\xD1\xB8";
7+
if (memcmp(realbytes, hookedfuncaddr, 4) == 0) {
8+
return true;
9+
}
10+
else {
11+
return false;
12+
}
13+
}
14+
15+
void Banner() {
16+
printf(R"EOF(
17+
18+
_ ___ ___ _ _ _ _ ___ _ _
19+
/_\ | _ \_ _| | || |___ ___| |_(_)_ _ __ _ | \ ___| |_ ___ __| |_ ___ _ _
20+
/ _ \| _/| | | __ / _ \/ _ \ / / | ' \/ _` | | |) / -_) _/ -_) _| _/ _ \ '_|
21+
/_/ \_\_| |___| |_||_\___/\___/_\_\_|_||_\__, | |___/\___|\__\___\__|\__\___/_|
22+
|___/
23+
24+
[Coded by MrEmpy]
25+
26+
)EOF");
27+
}
28+
29+
void Help(char* progname) {
30+
printf(R"EOF(usage: %s OUTPUT
31+
options:
32+
OUTPUT, output file
33+
)EOF", progname);
34+
}
35+
36+
int main(int argc, char* argv[]) {
37+
HMODULE ntdll = LoadLibraryA("ntdll.dll");
38+
if (ntdll == NULL) {
39+
printf("[-] Error loading ntdll.dll\n");
40+
return 1;
41+
}
42+
43+
if (argv[1] == NULL) {
44+
Banner();
45+
Help(argv[0]);
46+
return 1;
47+
}
48+
49+
PIMAGE_DOS_HEADER dos_header = (PIMAGE_DOS_HEADER)ntdll;
50+
PIMAGE_NT_HEADERS nt_headers = (PIMAGE_NT_HEADERS)((char*)dos_header + dos_header->e_lfanew);
51+
PIMAGE_EXPORT_DIRECTORY exports = (PIMAGE_EXPORT_DIRECTORY)((char*)ntdll + nt_headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
52+
53+
DWORD* function_addresses = (DWORD*)((char*)ntdll + exports->AddressOfFunctions);
54+
WORD* function_ordinals = (WORD*)((char*)ntdll + exports->AddressOfNameOrdinals);
55+
DWORD* function_names = (DWORD*)((char*)ntdll + exports->AddressOfNames);
56+
57+
int outputfname = strlen(argv[1]) + 1;
58+
int wlen = MultiByteToWideChar(CP_UTF8, 0, argv[1], outputfname, NULL, 0);
59+
wchar_t* wdmpout = (wchar_t*)malloc(wlen * sizeof(wchar_t));
60+
MultiByteToWideChar(CP_UTF8, 0, argv[1], outputfname, wdmpout, wlen);
61+
HANDLE outputf = CreateFileW(wdmpout, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
62+
char breakline[] = "\n";
63+
64+
Banner();
65+
puts("[*] NT API being hooked:");
66+
puts("=========================================================================================");
67+
for (int i = 0; i < exports->NumberOfFunctions; i++) {
68+
//printf("%s\n", (char*)ntdll + function_names[i]);
69+
if (strncmp((char*)ntdll + function_names[i], "Nt", 2) == 0) {
70+
FARPROC procaddr = GetProcAddress(ntdll, (LPCSTR)(char*)ntdll + function_names[i]);
71+
if (procaddr == NULL) {
72+
printf("[-] Error finding function %s\n", (char*)ntdll + function_names[i]);
73+
return 1;
74+
}
75+
LPBYTE lpprocaddr = (LPBYTE)procaddr;
76+
DWORD dwprocaddr = *(DWORD*)lpprocaddr;
77+
78+
char realbytes[] = "0xB8D18B4C";
79+
DWORD Written;
80+
if (DetectHook(procaddr) == false) {
81+
printf("[-] %s [%s != 0x%02X]\n", (char*)ntdll + function_names[i], realbytes, dwprocaddr);
82+
WriteFile(outputf, (char*)ntdll + function_names[i], strlen((char*)ntdll + function_names[i]), &Written, NULL);
83+
WriteFile(outputf, breakline, strlen(breakline), &Written, NULL);
84+
}
85+
}
86+
}
87+
puts("=========================================================================================");
88+
89+
CloseHandle(outputf);
90+
FreeLibrary(ntdll);
91+
return 0;
92+
}

‎Detector/Detector.vcxproj

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Release|Win32">
9+
<Configuration>Release</Configuration>
10+
<Platform>Win32</Platform>
11+
</ProjectConfiguration>
12+
<ProjectConfiguration Include="Debug|x64">
13+
<Configuration>Debug</Configuration>
14+
<Platform>x64</Platform>
15+
</ProjectConfiguration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
18+
<Platform>x64</Platform>
19+
</ProjectConfiguration>
20+
</ItemGroup>
21+
<PropertyGroup Label="Globals">
22+
<VCProjectVersion>16.0</VCProjectVersion>
23+
<Keyword>Win32Proj</Keyword>
24+
<ProjectGuid>{53afde73-5251-4fd0-b877-dbfb4f359128}</ProjectGuid>
25+
<RootNamespace>Detector</RootNamespace>
26+
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
27+
</PropertyGroup>
28+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
29+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
30+
<ConfigurationType>Application</ConfigurationType>
31+
<UseDebugLibraries>true</UseDebugLibraries>
32+
<PlatformToolset>v143</PlatformToolset>
33+
<CharacterSet>Unicode</CharacterSet>
34+
</PropertyGroup>
35+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
36+
<ConfigurationType>Application</ConfigurationType>
37+
<UseDebugLibraries>false</UseDebugLibraries>
38+
<PlatformToolset>v143</PlatformToolset>
39+
<WholeProgramOptimization>true</WholeProgramOptimization>
40+
<CharacterSet>Unicode</CharacterSet>
41+
</PropertyGroup>
42+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
43+
<ConfigurationType>Application</ConfigurationType>
44+
<UseDebugLibraries>true</UseDebugLibraries>
45+
<PlatformToolset>v143</PlatformToolset>
46+
<CharacterSet>Unicode</CharacterSet>
47+
</PropertyGroup>
48+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
49+
<ConfigurationType>Application</ConfigurationType>
50+
<UseDebugLibraries>false</UseDebugLibraries>
51+
<PlatformToolset>v143</PlatformToolset>
52+
<WholeProgramOptimization>true</WholeProgramOptimization>
53+
<CharacterSet>Unicode</CharacterSet>
54+
</PropertyGroup>
55+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
56+
<ImportGroup Label="ExtensionSettings">
57+
</ImportGroup>
58+
<ImportGroup Label="Shared">
59+
</ImportGroup>
60+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
61+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
62+
</ImportGroup>
63+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
64+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
65+
</ImportGroup>
66+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
67+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
68+
</ImportGroup>
69+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
70+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
71+
</ImportGroup>
72+
<PropertyGroup Label="UserMacros" />
73+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
74+
<ClCompile>
75+
<WarningLevel>Level3</WarningLevel>
76+
<SDLCheck>true</SDLCheck>
77+
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
78+
<ConformanceMode>true</ConformanceMode>
79+
</ClCompile>
80+
<Link>
81+
<SubSystem>Console</SubSystem>
82+
<GenerateDebugInformation>true</GenerateDebugInformation>
83+
</Link>
84+
</ItemDefinitionGroup>
85+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
86+
<ClCompile>
87+
<WarningLevel>Level3</WarningLevel>
88+
<FunctionLevelLinking>true</FunctionLevelLinking>
89+
<IntrinsicFunctions>true</IntrinsicFunctions>
90+
<SDLCheck>true</SDLCheck>
91+
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
92+
<ConformanceMode>true</ConformanceMode>
93+
</ClCompile>
94+
<Link>
95+
<SubSystem>Console</SubSystem>
96+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
97+
<OptimizeReferences>true</OptimizeReferences>
98+
<GenerateDebugInformation>true</GenerateDebugInformation>
99+
</Link>
100+
</ItemDefinitionGroup>
101+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
102+
<ClCompile>
103+
<WarningLevel>Level3</WarningLevel>
104+
<SDLCheck>true</SDLCheck>
105+
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
106+
<ConformanceMode>true</ConformanceMode>
107+
</ClCompile>
108+
<Link>
109+
<SubSystem>Console</SubSystem>
110+
<GenerateDebugInformation>true</GenerateDebugInformation>
111+
</Link>
112+
</ItemDefinitionGroup>
113+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
114+
<ClCompile>
115+
<WarningLevel>Level3</WarningLevel>
116+
<FunctionLevelLinking>true</FunctionLevelLinking>
117+
<IntrinsicFunctions>true</IntrinsicFunctions>
118+
<SDLCheck>true</SDLCheck>
119+
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
120+
<ConformanceMode>true</ConformanceMode>
121+
</ClCompile>
122+
<Link>
123+
<SubSystem>Console</SubSystem>
124+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
125+
<OptimizeReferences>true</OptimizeReferences>
126+
<GenerateDebugInformation>true</GenerateDebugInformation>
127+
</Link>
128+
</ItemDefinitionGroup>
129+
<ItemGroup>
130+
<ClCompile Include="Detector.cpp">
131+
<RuntimeLibrary Condition="'$(Configuration)|$(Platform)'=='Release|x64'">MultiThreaded</RuntimeLibrary>
132+
</ClCompile>
133+
</ItemGroup>
134+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
135+
<ImportGroup Label="ExtensionTargets">
136+
</ImportGroup>
137+
</Project>

‎Detector/Detector.vcxproj.filters

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup>
4+
<Filter Include="Arquivos de Origem">
5+
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
6+
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
7+
</Filter>
8+
<Filter Include="Arquivos de Cabeçalho">
9+
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10+
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
11+
</Filter>
12+
<Filter Include="Arquivos de Recurso">
13+
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14+
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15+
</Filter>
16+
</ItemGroup>
17+
<ItemGroup>
18+
<ClCompile Include="Detector.cpp">
19+
<Filter>Arquivos de Origem</Filter>
20+
</ClCompile>
21+
</ItemGroup>
22+
</Project>

‎Detector/Detector.vcxproj.user

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<PropertyGroup />
4+
</Project>

0 commit comments

Comments
 (0)