Skip to content

dadas190/Heavens-Gate-2.0

Repository files navigation

#Heaven's Gate 2.0

Unable to find any properly implemented/working code that works on Windows 10, I have decided to open the Heaven's Gate on my own.
Yes, this one is working on an updated Windows 10 (as of 22th July 2017)
Tested on Windows 7 too
Now donate some Bitcoin: 1LaLSsqSU1woJ72k9FByNjUF7dLzS6u443

HeavensGate.h includes the following functions:

uint64_t GetModuleHandle64(wchar_t *name)
Retrieves the HANDLE (base address) of a loaded 64bit module

uint64_t LoadLibrary64(char *name)
Loads a 64bit DLL using LdrLoadDll, returns its HANDLE (base address)

uint64_t GetProcAddress64(uint64_t dll, uint64_t *func)
Retrieves the address of a function from a 64bit module (import by ordinals work too - thats why function name isn't char, but uint64_t)

uint64_t X64Call(uint64_t proc, uint64_t a, uint64_t b, uint64_t c, uint64_t d)
Calls the specified 64bit function "proc" with arguments a,b,c,d. Only 4 arguments are supported because I don't need more. When calling functions that take less arguments, simply use 0 for the rest.


Another (internal) functions:
void memcpy64(uint64_t dst, uint64_t src, uint64_t sz)
Like normal memcpy, but supports 64bit addresses

void GetPEB64(void *peb)
Retrieves pointer to the 64bit PEB (Process Environment Block)

uint64_t GetKernel32()
Retrieves the handle (base address) of 64bit Kernel32.dll - loads it if its not loaded yet.

uint64_t GetModuleLDREntry(wchar_t *name)
Retrieves pointer to a LDR Entry corresponding to the specified module.

uint64_t MyGetProcAddress(uint64_t module, char *func)
Retrieves function pointer to the specified function in a 64bit module without using GetProcAddress/LdrGetProcedureAddress

uint64_t MakeUTFStr(char *in)
Converts input string to UNICODE_STRING64 needed for the LdrLoadDll call.

uint64_t MakeANSIStr(char *in)
Converts input string to ANSI_STRING64 needed for the LdrGetProcedureAddress call.


Everything is implemented in the HeavensGate.h, Source.cpp contains just some example code.

About

Executes 64bit code from a 32bit process

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages