Участник
- Статус
- Оффлайн
- Регистрация
- 10 Окт 2020
- Сообщения
- 535
- Реакции
- 508
Достаточно удобный в использовании враппер сискола.
мой первый (но не последний) гитхаб репо:
в будущем будет обновляться.
буду рад адекватному фидбэку и советам.
мой первый (но не последний) гитхаб репо:
Пожалуйста, авторизуйтесь для просмотра ссылки.
в будущем будет обновляться.
буду рад адекватному фидбэку и советам.
C++:
// Execute "NtTerminateProcess" syscall
shadowsyscall<NTSTATUS>( "NtTerminateProcess", reinterpret_cast< HANDLE >( -1 ), -6932 );
// Since version 1.2, the return type may not be specified
shadowsyscall( "NtTerminateProcess", reinterpret_cast< HANDLE >( -1 ), -6932 );
// Execute any export at runtime
// Since version 1.2, the return type may not be specified
shadowcall<int>( "MessageBoxA", nullptr, "string 1", "string 2", MB_OK );
C++:
#include <iostream>
#include <string>
#include "shadowsyscall.hpp"
int main() {
// Enumerate every dll loaded to current process
for ( const auto& dll : shadow::dlls() )
std::cout << dll.filepath().string() << " : " << dll.native_handle() << "\n";
std::cout.put( '\n' );
// Find exactly known dll loaded to current process
// "ntdll.dll" doesn't leave string in executable, it
// being hashed on compile-time with consteval guarantee
// The implementation doesn't care about the ".dll" suffix.
auto ntdll = shadow::dll( "ntdll" /* after compilation it will become 384989384324938 */ );
auto current_module = shadow::current_module();
std::cout << "Current .exe filepath: " << current_module.filepath().string() << "\n";
std::cout << "Current .text section checksum: " << current_module.section_checksum<std::size_t>( ".text" ) << "\n\n";
std::cout << ntdll.base_address().ptr() << '\n'; // .base_address() returns address_t
std::cout << ntdll.native_handle() << '\n'; // .native_handle() returns void*
std::cout << ntdll.entry_point() << '\n'; // .entry_point() returns address_t, if presented
std::cout << ntdll.name().string() << '\n'; // .name() returns win::unicode_string
std::cout << ntdll.filepath().to_path().extension() << '\n'; // .filepath() returns win::unicode_string
std::cout << ntdll.image()->get_nt_headers()->signature << '\n'; // returns uint32_t, NT magic value
std::cout << ntdll.image()->get_optional_header()->size_image << "\n\n"; // returns uint32_t, loaded NTDLL image size
std::cout << "5 exports of ntdll.dll:\n";
for ( const auto& [name, address] : ntdll.exports() | std::views::take( 5 ) )
std::cout << name << " : " << address.raw() << '\n';
std::cout.put( '\n' );
auto it = ntdll.exports().find_if( []( auto export_data ) -> bool {
const auto& [name, address] = export_data;
constexpr auto compiletime_hash = shadow::hash64_t{ "NtQuerySystemInformation" }; // after compilation it will become 384989384324938
const auto runtime_hash = shadow::hash64_t{}( name ); // accepts any range that have access by index
return compiletime_hash == runtime_hash;
} );
const auto& [name, address] = *it;
std::cout << "Found target export:\n" << name << " : " << address << "\n\n";
// "location" returns a DLL struct that contains this export
std::cout << "DLL that contains Sleep export is: " << shadow::dll_export( "Sleep" ).location().name().to_path() << "\n\n";
// shared_data parses KUSER_SHARED_DATA
// The class is a high-level wrapper for parsing,
// which will save you from direct work with raw addresses
auto shared = shadow::shared_data();
std::cout << shared.safe_boot_enabled() << '\n';
std::cout << shared.boot_id() << '\n';
std::cout << shared.physical_pages_num() << '\n';
std::cout << shared.kernel_debugger_present() << '\n';
std::wcout << shared.system_root().to_path() << '\n';
std::cout << shared.system().is_windows_11() << '\n';
std::cout << shared.system().is_windows_10() << '\n';
std::cout << shared.system().is_windows_7() << '\n';
std::cout << shared.system().build_number() << '\n';
std::cout << shared.system().formatted() << '\n';
std::cout << shared.unix_epoch_timestamp().utc().time_since_epoch() << '\n';
std::cout << shared.unix_epoch_timestamp().utc().format_iso8601() << '\n';
std::cout << shared.unix_epoch_timestamp().local().time_since_epoch() << '\n';
std::cout << shared.unix_epoch_timestamp().local().format_iso8601() << '\n';
std::cout << shared.timezone_offset<std::chrono::seconds>() << "\n\n";
// Iterators are compatible with the ranges library
static_assert( std::bidirectional_iterator<shadow::detail::export_enumerator::iterator> );
static_assert( std::bidirectional_iterator<shadow::detail::module_enumerator::iterator> );
}
Последнее редактирование:
