Source Byte

Online C++ to Assembly Converter (+) CodeConvert (+) Compiler Explorer (+) Code Beautify (+) C to VSCPU ASM Converter (+) ConV (+) CtoAssembly #reverse #useful

#froum https://bbs.kafan.cn/ https://bbs.pediy.com/ http://club.vfocus.net/index.php https://www.xf1433.com/ https://www.52pojie.cn/forum.php https://www.77169.net/ https://bbs.mayidui.net/ https://www.5566.net/ https://forum.butian.net/ https://unsafe.sh/ http://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/threads/65150/

#conference https://github.com/onhexgroup/Conferences

Ptrace Security GmbH What is Loader Lock? elliotonsecurity.com/what-is… #Linux #Kernel #Loader

https://github.com/es3n1n/obfuscator Native code PE bin2bin obfuscator #pe #windows

Introduction to stack management in x86-64 architecture for Windows (credits @3shw4r) offensivecraft.wordpress.com…

"C++ pidd spoofing" https://xss.is/threads/95950/post-666606

if (!CreateProcessWithSpoofedParentProcessIdW(Pi, ExampleBinaryPath, dwParentProcessId)) goto EXIT_ROUTINE; //set flag, code exiting without failure bFlag = TRUE; EXIT_ROUTINE: if (!bFlag) //if flag is false, code exited with an error, set return code to last error dwError = GetLastError(); return dwError; //return error code, or ERROR_SUCCESS depending on bFlag } `

return (dwSize + 0x1000); } DWORD GetPidFromNtQuerySystemInformationW(_In_ PWCHAR BinaryNameWithFileExtension) { NTQUERYSYSTEMINFORMATION NtQuerySystemInformation = NULL; DWORD ProcessId = 0, Length = 0, dwOffset = 0; PSYSTEM_PROCESS_INFORMATION ProcessInformationPointer = NULL; HMODULE hModule = NULL; NTSTATUS Status = STATUS_SUCCESS; PSYSTEM_PROCESS_INFORMATION Process = NULL; hModule = GetModuleHandleW(L"ntdll.dll"); if (hModule == NULL) goto EXIT_ROUTINE; NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hModule, "NtQuerySystemInformation"); if (!NtQuerySystemInformation) goto EXIT_ROUTINE; Length = QueryBufferSize(NtQuerySystemInformation); if (Length == 0) goto EXIT_ROUTINE; Process = (PSYSTEM_PROCESS_INFORMATION)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, Length); if (Process == NULL) goto EXIT_ROUTINE; Status = NtQuerySystemInformation(SystemProcessInformation, Process, Length, &Length); if (!NT_SUCCESS(Status)) goto EXIT_ROUTINE; ProcessInformationPointer = Process; do { if (ProcessInformationPointer->ImageName.Buffer) { if (StringCompareW(BinaryNameWithFileExtension, ProcessInformationPointer->ImageName.Buffer) == ERROR_SUCCESS) ProcessId = HandleToLong(ProcessInformationPointer->UniqueProcessId); } if (ProcessId != 0) break; ProcessInformationPointer = (PSYSTEM_PROCESS_INFORMATION)(((PBYTE)ProcessInformationPointer) + ProcessInformationPointer->NextEntryOffset); } while (ProcessInformationPointer->NextEntryOffset); EXIT_ROUTINE: if (Process) HeapFree(GetProcessHeap(), HEAP_ZERO_MEMORY, Process); return ProcessId; } BOOL CreateProcessWithSpoofedParentProcessIdW(_Inout_ PPROCESS_INFORMATION Pi, _In_ PWCHAR Path, _In_ DWORD dwParentProcessId) { BOOL bFlag = FALSE; PPROC_THREAD_ATTRIBUTE_LIST ThreadAttributes = NULL; SIZE_T dwAttributeSize = 0; HANDLE hHandle = NULL; STARTUPINFOEXW Si = { 0 }; Si.StartupInfo.cb = sizeof(STARTUPINFOEXW); hHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwParentProcessId); if (hHandle == NULL) goto EXIT_ROUTINE; InitializeProcThreadAttributeList(NULL, 1, 0, &dwAttributeSize); if (dwAttributeSize == 0) goto EXIT_ROUTINE; ThreadAttributes = (PPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, dwAttributeSize); if (ThreadAttributes == NULL) goto EXIT_ROUTINE; if (!InitializeProcThreadAttributeList(ThreadAttributes, 1, 0, &dwAttributeSize)) goto EXIT_ROUTINE; if (!UpdateProcThreadAttribute(ThreadAttributes, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &hHandle, sizeof(HANDLE), NULL, NULL)) goto EXIT_ROUTINE; Si.lpAttributeList = ThreadAttributes; if (!CreateProcessW(Path, NULL, NULL, NULL, TRUE, EXTENDED_STARTUPINFO_PRESENT, NULL, NULL, &Si.StartupInfo, Pi)) goto EXIT_ROUTINE; Si.lpAttributeList = ThreadAttributes; bFlag = TRUE; EXIT_ROUTINE: if (ThreadAttributes) HeapFree(GetProcessHeap(), HEAP_ZERO_MEMORY, (PPROC_THREAD_ATTRIBUTE_LIST)ThreadAttributes); return bFlag; } INT main(VOID) { WCHAR wSpoofedParentProcessBinaryImage[MAX_PATH * sizeof(WCHAR)] = { 0 }; PPROCESS_INFORMATION Pi = NULL; DWORD dwParentProcessId = 0; WCHAR ExampleBinaryPath[MAX_PATH * sizeof(WCHAR)] = L"C:\\Windows\\System32\\notepad.exe"; //generic error handling variables BOOL bFlag = FALSE; DWORD dwError = ERROR_SUCCESS; //allocate memory for process information structure Pi = (PPROCESS_INFORMATION)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(PROCESS_INFORMATION)); if (Pi == NULL) goto EXIT_ROUTINE; dwParentProcessId = GetPidFromNtQuerySystemInformationW((PWCHAR)L"firefox.exe"); if (dwParentProcessId == 0) goto EXIT_ROUTINE;

SystemCodeIntegrityPlatformManifestInformation = 179, SystemInterruptSteeringInformation = 180, SystemSupportedProcessorArchitectures = 181, SystemMemoryUsageInformation = 182, SystemCodeIntegrityCertificateInformation = 183, SystemPhysicalMemoryInformation = 184, SystemControlFlowTransition = 185, SystemKernelDebuggingAllowed = 186, SystemActivityModerationExeState = 187, SystemActivityModerationUserSettings = 188, SystemCodeIntegrityPoliciesFullInformation = 189, SystemCodeIntegrityUnlockInformation = 190, SystemIntegrityQuotaInformation = 191, SystemFlushInformation = 192, SystemProcessorIdleMaskInformation = 193, SystemSecureDumpEncryptionInformation = 194, SystemWriteConstraintInformation = 195, SystemKernelVaShadowInformation = 196, SystemHypervisorSharedPageInformation = 197, SystemFirmwareBootPerformanceInformation = 198, SystemCodeIntegrityVerificationInformation = 199, SystemFirmwarePartitionInformation = 200, SystemSpeculationControlInformation = 201, SystemDmaGuardPolicyInformation = 202, SystemEnclaveLaunchControlInformation = 203, SystemWorkloadAllowedCpuSetsInformation = 204, SystemCodeIntegrityUnlockModeInformation = 205, SystemLeapSecondInformation = 206, SystemFlags2Information = 207, SystemSecurityModelInformation = 208, SystemCodeIntegritySyntheticCacheInformation = 209, SystemFeatureConfigurationInformation = 210, SystemFeatureConfigurationSectionInformation = 211, SystemFeatureUsageSubscriptionInformation = 212, SystemSecureSpeculationControlInformation = 213, SystemSpacesBootInformation = 214, SystemFwRamdiskInformation = 215, SystemWheaIpmiHardwareInformation = 216, SystemDifSetRuleClassInformation = 217, SystemDifClearRuleClassInformation = 218, SystemDifApplyPluginVerificationOnDriver = 219, SystemDifRemovePluginVerificationOnDriver = 220, SystemShadowStackInformation = 221, SystemBuildVersionInformation = 222, #ifdef WINESRC SystemWineVersionInformation = 1000, #endif } SYSTEM_INFORMATION_CLASS, * PSYSTEM_INFORMATION_CLASS; typedef struct _LSA_UNICODE_STRING { USHORT Length; USHORT MaximumLength; PWSTR Buffer; } LSA_UNICODE_STRING, * PLSA_UNICODE_STRING, UNICODE_STRING, * PUNICODE_STRING; typedef struct _SYSTEM_PROCESS_INFORMATION { ULONG NextEntryOffset; ULONG NumberOfThreads; LARGE_INTEGER WorkingSetPrivateSize; ULONG HardFaultCount; ULONG NumberOfThreadsHighWatermark; ULONGLONG CycleTime; LARGE_INTEGER CreateTime; LARGE_INTEGER UserTime; LARGE_INTEGER KernelTime; UNICODE_STRING ImageName; LONG BasePriority; HANDLE UniqueProcessId; HANDLE InheritedFromUniqueProcessId; ULONG HandleCount; ULONG SessionId; ULONG_PTR PageDirectoryBase; SIZE_T PeakVirtualSize; SIZE_T VirtualSize; ULONG PageFaultCount; SIZE_T PeakWorkingSetSize; SIZE_T WorkingSetSize; SIZE_T QuotaPeakPagedPoolUsage; SIZE_T QuotaPagedPoolUsage; SIZE_T QuotaPeakNonPagedPoolUsage; SIZE_T QuotaNonPagedPoolUsage; SIZE_T PagefileUsage; SIZE_T PeakPagefileUsage; SIZE_T PrivatePageCount; LARGE_INTEGER ReadOperationCount; LARGE_INTEGER WriteOperationCount; LARGE_INTEGER OtherOperationCount; LARGE_INTEGER ReadTransferCount; LARGE_INTEGER WriteTransferCount; LARGE_INTEGER OtherTransferCount; } SYSTEM_PROCESS_INFORMATION, * PSYSTEM_PROCESS_INFORMATION; typedef NTSTATUS(NTAPI* NTQUERYSYSTEMINFORMATION)(SYSTEM_INFORMATION_CLASS, PVOID, ULONG, PULONG); INT StringCompareW(_In_ LPCWSTR String1, _In_ LPCWSTR String2) { for (; *String1 == *String2; String1++, String2++) { if (*String1 == '\0') return 0; } return ((*(LPCWSTR)String1 < *(LPCWSTR)String2) ? -1 : +1); } DWORD QueryBufferSize(_In_ NTQUERYSYSTEMINFORMATION NtQuerySystemInformation) { DWORD dwSize = ERROR_SUCCESS; NtQuerySystemInformation(SystemProcessInformation, NULL, 0, &dwSize);