This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
NTSTATUS | |
MmLoadSystemImage(IN PUNICODE_STRING ImageFileName, | |
IN PUNICODE_STRING NamePrefix OPTIONAL, | |
IN PUNICODE_STRING LoadedBaseName OPTIONAL, | |
IN ULONG LoadFlags, | |
OUT PVOID *ImageHandle, | |
OUT PVOID *ImageBaseAddress) { | |
// ... | |
if ( PsImageNotifyEnabled ) { | |
IMAGE_INFO ImageInfo; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
:: Made by Hoang Hung | |
@echo off | |
>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system" | |
if "%errorlevel%" NEQ "0" ( | |
echo: Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs" | |
echo: UAC.ShellExecute "%~s0", "", "", "runas", 1 >> "%temp%\getadmin.vbs" | |
"%temp%\getadmin.vbs" & exit | |
) | |
if exist "%temp%\getadmin.vbs" del /f /q "%temp%\getadmin.vbs" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <string> | |
#include <atlbase.h> | |
#include <imapi2fs.h> | |
void create_iso( std::wstring_view src, std::wstring_view iso_path ) | |
{ | |
HRESULT hr; | |
IFileSystemImage* fsimg; | |
IFsiDirectoryItem* fsdir; | |
IFileSystemImageResult* fsresult; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#pragma once | |
#include <stdint.h> | |
//fnv1a 32 and 64 bit hash functions | |
// key is the data to hash, len is the size of the data (or how much of it to hash against) | |
// code license: public domain or equivalent | |
// post: https://notes.underscorediscovery.com/constexpr-fnv1a/ | |
inline const uint32_t hash_32_fnv1a(const void* key, const uint32_t len) { |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
const outputPath = "C::\\put_your_path\\syscall.csv"; | |
var module = Process.getModuleByName("ntdll.dll"); | |
var symbols = module.enumerateExports(); | |
var csvString = "Name,Number\n"; | |
for (var i = 0; i < symbols.length; i++) { | |
const sysName = symbols[i].name; | |
if (sysName.indexOf("Nt") == 0 && sysName.indexOf("Ntdll") == -1) { | |
const symAddr = symbols[i].address; |
Thank you to SpecterOps for supporting this research and to Duane and Matt for proofreading and editing! Crossposted on the SpecterOps Blog.
TLDR: You may use this header file for reliable compile time string encryption without needing any additional dependencies.
Programmers of DRM software, security products, or other sensitive code bases are commonly required to minimize the amount of human readable strings in binary output files. The goal of the minimization is to hinder others from reverse engineering their proprietary technology.
Common approaches that are taken to meet this requirement often add an additional maintenance burden to the developer and are prone to error. These approaches will be presented along with t
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// Copyright (C) 2022 Evan McBroom | |
// If you are using Visual Studio, you will need to disable the "Edit and Continue" feature. | |
// Prng based off of Parker Miller's | |
// "Multiplicative Linear Congruential Generator" | |
// https://en.wikipedia.org/wiki/Lehmer_random_number_generator | |
namespace mlcg { | |
constexpr uint32_t modulus() { | |
return 0x7fffffff; | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <string> | |
#include <vector> | |
#include <fstream> | |
#include <iostream> | |
#include <filesystem> | |
#include <Windows.h> | |
#include <winternl.h> | |
static_assert( sizeof( void* ) == 8 ); |
OlderNewer