Skip to content

Instantly share code, notes, and snippets.

@0x410c
Created March 31, 2022 07:38
Show Gist options
  • Save 0x410c/3b55ecff6cd00d75a2f291fe8d4bdf46 to your computer and use it in GitHub Desktop.
Save 0x410c/3b55ecff6cd00d75a2f291fe8d4bdf46 to your computer and use it in GitHub Desktop.
Call winapis from chai script
#include <string>
#include<vector>
#include <chaiscript/chaiscript.hpp>
#include<windows.h>
unsigned int proxy_LoadLibraryA(unsigned int libName)
{
return (unsigned int)LoadLibraryA((char*)libName);
}
unsigned int proxy_GetProcAddress(unsigned int module,unsigned int procName)
{
return (unsigned int)GetProcAddress((HMODULE)module, (char*)procName);
}
unsigned int ExecMem4(unsigned int mem, unsigned int a, unsigned int b, unsigned int c, unsigned int d)
{
_asm {
push a
push b
push c
push d
call [mem]
}
}
unsigned int CSTR(const std::string& text)
{
return (unsigned int)text.c_str();
}
int WINAPI WinMain(HINSTANCE hInst, HINSTANCE hPrev, LPSTR cmd, int n) {
chaiscript::ChaiScript chai;
chai.add(chaiscript::fun(&proxy_LoadLibraryA), "LoadLibraryA");
chai.add(chaiscript::fun(&proxy_GetProcAddress), "GetProcAddress");
chai.add(chaiscript::fun(&ExecMem4), "ExecMem4");
chai.add(chaiscript::fun(&CSTR), "CSTR");
try {
chai.eval(R"(
def CallWinApi(lib, name, args)
{
var mod = LoadLibraryA(CSTR(lib));
var proc = GetProcAddress(mod, CSTR(name));
switch(args.size())
{
case (4){
ExecMem4(proc, args[0],args[1],args[2],args[3]);
}
default {
//not implemented yet
}
}
}
CallWinApi("user32.dll","MessageBoxA", [0, CSTR("hi"),CSTR("chai"),0]);
)");
}
catch (const chaiscript::exception::eval_error& e) {
MessageBoxA(NULL,e.pretty_print().c_str(),"error",0);
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment