odzhan

//
// Every new thread starts with ntdll!RtlUserThreadStart and it typically calls kernel32!BaseThreadInitThunk
//
// Some applications like Mozilla Firefox and Microsoft Edge will replace this with their own function for hooking purposes.
// The following code shows how to find it without using debugging symbols.
//
// @modexpblog
//

#define PHNT_VERSION PHNT_VISTA

odzhan

/**
    Compile with MSVC : cl /EHsc ark.cpp /I <path_to_libarchive>
*/

#include <cstdio>
#include <cstdint>
#include <cstdlib>
#include <cstring>

odzhan

/**
    Compile with MSVC : cl /EHsc d3dpack.cpp


    C:\d3dpack e C:\windows\system32\cmd.exe cmd.packed

    Direct 3D Compression Example.
    SHA256("C:\windows\system32\cmd.exe") : b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
    Compressing "C:\windows\system32\cmd.exe" -> "cmd.packed"

odzhan

    area .drectve, drectve
    
    export call_api
    
; The following are 64-Bit offsets.
TEB_ProcessEnvironmentBlock                  equ 0x00000060
TEB_LastErrorValue                           equ 0x00000068

PEB_Ldr                                      equ 0x00000018
PEB_LDR_DATA_InLoadOrderModuleList           equ 0x00000010

odzhan

//
// Base-N encoding based on assembly code by Qkumba
//
#include <stdint.h>

#define ROTR32(v,n)(((v)>>(n))|((v)<<(32-(n))))
#define ROTL32(v,n)(((v)<<(n))|((v)>>(32-(n))))

#define ROTR64(v,n)(((v)>>(n))|((v)<<(64-(n))))
#define ROTL64(v,n)(((v)<<(n))|((v)>>(64-(n))))

odzhan

//
// adapted from : https://gist.github.com/daaximus/a48b0a991b31e8841b68dbbc480a0a5a
//
#define UNICODE

#include <windows.h>
#include <imapi2fs.h>
#include <shlwapi.h>
#include <objbase.h>
#include <oleauto.h>

odzhan

// Compiles with Visual Studio 2008 for Windows

// This C example is designed as more of a guide than a library to be plugged into an application
// That module required a couple of major re-writes and is available upon request
// The Basic example has tips to the direction you should take
// This will work with connections on port 587 that upgrade a plain text session to an encrypted session with STARTTLS as covered here.

// TLSclient.c - SSPI Schannel gmail TLS connection example

#define SECURITY_WIN32

odzhan

//
// Charm 256-bit hash ripped from: https://github.com/jedisct1/charm
//
#include <stdint.h>
#include <stdlib.h>
#include <string.h>

#define XOODOO_ROUNDS 12

odzhan




An Automation Object for Dynamic DLL Calls
Here's an OLE automation object for dynamically declaring and accessing functions in external DLLs 


November 01, 1998
URL:http://www.drdobbs.com/windows/an-automation-object-for-dynamic-dll-cal/210200078 

Jeff Stong has been developing DOS, Windows, and Windows NT based applications for 10 years. Jeff can be contacted at Jeff_V_Stong@msn.com.

You can access external DLLs from Visual Basic by using the Declare statement to declare the name of the function you want to call and the DLL that it resides in. VBScript, however, doesn't support the Declare statement. This article presents an OLE automation object that lets VBScript (or any other environment that can access automation objects) dynamically declare and access functions in external DLLs.

Using the DynamicWrapper Object

odzhan

The following is a list of user-mode API that can sometimes be hooked by an EDR. It's not an extensive list by any means.

ntdll!NtAllocateVirtualMemory
ntdll!ZwFreeVirtualMemory
ntdll!NtMapViewOfSection
ntdll!NtOpenProcess
ntdll!NtUnmapViewOfSection
ntdll!NtWriteVirtualMemory
ntdll!NtProtectVirtualMemory
ntdll!NtLoadDriver