This repository has been archived by the owner on Sep 10, 2024. It is now read-only.
-
-
Notifications
You must be signed in to change notification settings - Fork 61
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Change Capstone to Zydis, Improve JS Hooking, Improve SEH Handle x32 (x64 soon), partial support for API Forword, Auto update for LDR in PEB with every lib loaded, With more stuff i forget :D And lot of Bug fixes and improvements.
- Loading branch information
Showing
97 changed files
with
7,879 additions
and
12,374 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
|
|
||
|
|
||
| // _wcmdln fix | ||
|
|
||
| // var Path = '"C:\\pla\\' + Emu.Filename + '"'; // :D | ||
| // var _wcmdln_ptr = Emu.GetProcAddr(Emu.GetModuleHandle('msvcr90.dll'), '_wcmdln'); | ||
| // var po = | ||
| // Emu.WriteStringW(_wcmdln_ptr,Path) : Emu.WriteStringA(_wcmdln_ptr,Path); | ||
|
|
||
|
|
||
|
|
||
|
|
||
| // var tmpx = new ApiHook(); | ||
| // tmpx.OnCallBack = function () { | ||
|
|
||
|
|
||
| // info('EDI = ',Emu.ReadReg(REG_EDI).toString(16)) | ||
| // info('ESI = ',Emu.ReadReg(REG_ESI).toString(16)) | ||
| // info('Module : ',Emu.ReadStringA(Emu.ReadReg(REG_EAX))) | ||
|
|
||
| // return true; | ||
| // }; | ||
|
|
||
| // tmpx.install(0x401369); | ||
|
|
||
| // var tmpx = new ApiHook(); | ||
| // tmpx.OnCallBack = function () { | ||
|
|
||
| // info('esi = ',Emu.ReadReg(REG_ESI).toString(16)) | ||
| // info('ecx = ',Emu.ReadReg(REG_ECX).toString(16)) | ||
|
|
||
| // info('Module : ',Emu.ReadStringW(Emu.ReadReg(REG_ESI))) | ||
|
|
||
| // return true; | ||
| // }; | ||
|
|
||
| // tmpx.install(0x401037); | ||
|
|
||
|
|
||
| // var tmpz = new ApiHook(); | ||
| // tmpz.OnCallBack = function () { | ||
|
|
||
| // info('esi = ',Emu.ReadReg(REG_ESI).toString(16)) | ||
|
|
||
| // info('API : ',Emu.ReadStringA(Emu.ReadReg(REG_ESI))) | ||
|
|
||
| // return true; | ||
| // }; | ||
|
|
||
| // tmpz.install(0x401068); | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| // @ts-check | ||
| /// <reference path="./ApiHook.d.ts"/> | ||
| /// <reference path="./const.js" /> | ||
| /// <reference path="./API.d.ts"/> | ||
|
|
||
| 'use strict'; | ||
|
|
||
|
|
||
| var strcat = new ApiHook(); | ||
|
|
||
| strcat.OnCallBack = function (Emu, API, ret) { | ||
|
|
||
| // i think implementing this in JS is a bit hard so | ||
| // just let the library handle it :D | ||
| info('[!] just let the library handle it :D'); | ||
| return true; | ||
| }; | ||
| strcat.install('crtdll.dll', 'strcat'); | ||
|
|
||
|
|
||
| /* | ||
| ################################################################################################### | ||
| ################################################################################################### | ||
| */ | ||
|
|
||
|
|
||
| var __GetMainArgs = new ApiHook(); | ||
|
|
||
| __GetMainArgs.OnCallBack = function (Emu, API, ret) { | ||
|
|
||
| // i think implementing this in JS is a bit hard so | ||
| // just let the library handle it :D | ||
| info('[!] just let the library handle it :D'); | ||
| return true; | ||
| }; | ||
| __GetMainArgs.install('crtdll.dll', '__GetMainArgs'); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| // @ts-check | ||
| /// <reference path="./ApiHook.d.ts"/> | ||
| /// <reference path="./const.js" /> | ||
| /// <reference path="./API.d.ts"/> | ||
|
|
||
| 'use strict'; | ||
|
|
||
| var GetPath = new ApiHook(); | ||
| /* | ||
| int GetPath( | ||
| HDC hdc, | ||
| LPPOINT apt, | ||
| LPBYTE aj, | ||
| int cpt | ||
| ); | ||
| */ | ||
| GetPath.OnCallBack = function (Emu, API, ret) { | ||
|
|
||
| Emu.pop(); // pop return address .. | ||
|
|
||
| var hdc = Emu.isx64 ? Emu.ReadReg(REG_RCX) : Emu.pop(); | ||
| var apt = Emu.isx64 ? Emu.ReadReg(REG_EDX) : Emu.pop(); | ||
| var aj = Emu.isx64 ? Emu.ReadReg(REG_R8) : Emu.pop(); | ||
| var cpt = Emu.isx64 ? Emu.ReadReg(REG_R9) : Emu.pop(); | ||
|
|
||
| Emu.SetReg(REG_EAX, 1); | ||
| Emu.SetReg(Emu.isx64 ? REG_RIP : REG_EIP, ret); | ||
| return true; | ||
| }; | ||
| GetPath.install('gdi32.dll', 'GetPath'); | ||
|
|
||
| /* | ||
| ################################################################################################### | ||
| ################################################################################################### | ||
| */ | ||
|
|
||
|
|
||
|
|
||
| var SelectObject = new ApiHook(); | ||
| /* | ||
| HGDIOBJ SelectObject( | ||
| HDC hdc, | ||
| HGDIOBJ h | ||
| ); | ||
| */ | ||
| SelectObject.OnCallBack = function (Emu, API, ret) { | ||
|
|
||
| Emu.pop(); // pop return address .. | ||
|
|
||
| var hdc = Emu.isx64 ? Emu.ReadReg(REG_RCX) : Emu.pop(); | ||
| var h = Emu.isx64 ? Emu.ReadReg(REG_EDX) : Emu.pop(); | ||
|
|
||
| Emu.SetReg(REG_EAX, 0); | ||
| Emu.SetReg(Emu.isx64 ? REG_RIP : REG_EIP, ret); | ||
| return true; | ||
| }; | ||
| SelectObject.install('gdi32.dll', 'SelectObject'); | ||
|
|
||
| /* | ||
| ################################################################################################### | ||
| ################################################################################################### | ||
| */ | ||
|
|
Oops, something went wrong.