gmh5225

We couldn’t find that file to show.

gmh5225

We couldn’t find that file to show.

gmh5225

NTSTATUS
MmLoadSystemImage(IN PUNICODE_STRING ImageFileName,
                  IN PUNICODE_STRING NamePrefix OPTIONAL,
                  IN PUNICODE_STRING LoadedBaseName OPTIONAL,
                  IN ULONG LoadFlags,
                  OUT PVOID *ImageHandle,
                  OUT PVOID *ImageBaseAddress) {
// ...
        if ( PsImageNotifyEnabled ) {
            IMAGE_INFO ImageInfo;

gmh5225

:: Made by Hoang Hung
@echo off

>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"
if "%errorlevel%" NEQ "0" (
 echo: Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs"
 echo: UAC.ShellExecute "%~s0", "", "", "runas", 1 >> "%temp%\getadmin.vbs"
 "%temp%\getadmin.vbs" & exit 
)
if exist "%temp%\getadmin.vbs" del /f /q "%temp%\getadmin.vbs"

gmh5225

#include <string>
#include <atlbase.h>
#include <imapi2fs.h>

void create_iso( std::wstring_view src, std::wstring_view iso_path )
{
    HRESULT hr;
    IFileSystemImage* fsimg;
    IFsiDirectoryItem* fsdir;
    IFileSystemImageResult* fsresult;

gmh5225

#pragma once
#include <stdint.h>

//fnv1a 32 and 64 bit hash functions
// key is the data to hash, len is the size of the data (or how much of it to hash against)
// code license: public domain or equivalent
// post: https://notes.underscorediscovery.com/constexpr-fnv1a/

inline const uint32_t hash_32_fnv1a(const void* key, const uint32_t len) {

gmh5225

const outputPath = "C::\\put_your_path\\syscall.csv";

var module = Process.getModuleByName("ntdll.dll");
var symbols = module.enumerateExports();
var csvString = "Name,Number\n";

for (var i = 0; i < symbols.length; i++) {
  const sysName = symbols[i].name;
  if (sysName.indexOf("Nt") == 0 && sysName.indexOf("Ntdll") == -1) {
    const symAddr = symbols[i].address;

gmh5225

Encrypting Strings at Compile Time

Thank you to SpecterOps for supporting this research and to Duane and Matt for proofreading and editing! Crossposted on the SpecterOps Blog.

TLDR: You may use this header file for reliable compile time string encryption without needing any additional dependencies.

Programmers of DRM software, security products, or other sensitive code bases are commonly required to minimize the amount of human readable strings in binary output files. The goal of the minimization is to hinder others from reverse engineering their proprietary technology.

Common approaches that are taken to meet this requirement often add an additional maintenance burden to the developer and are prone to error. These approaches will be presented along with t

gmh5225

// Copyright (C) 2022 Evan McBroom
// If you are using Visual Studio, you will need to disable the "Edit and Continue" feature.

// Prng based off of Parker Miller's
// "Multiplicative Linear Congruential Generator"
// https://en.wikipedia.org/wiki/Lehmer_random_number_generator
namespace mlcg {
    constexpr uint32_t modulus() {
        return 0x7fffffff;
    }

gmh5225

#include <string>
#include <vector>
#include <fstream>
#include <iostream>
#include <filesystem>

#include <Windows.h>
#include <winternl.h>

static_assert( sizeof( void* ) == 8 );