Skip to content

Commit

Permalink
chore: change slice var name for clarity
Browse files Browse the repository at this point in the history
  • Loading branch information
f1zm0 committed Apr 11, 2023
1 parent 8de5eec commit 5f1b1ce
Showing 1 changed file with 10 additions and 16 deletions.
26 changes: 10 additions & 16 deletions internal/resolver/rvasort/resolver.go
Original file line number Diff line number Diff line change
Expand Up @@ -21,37 +21,31 @@ func NewResolver(h hashing.HashFunction) (resolver.Resolver, error) {
r := &ssnSortResolver{
hasher: h,
}
zwStubs := resolver.ParseNtdllModule(r.hasher)
zws := resolver.ParseNtdllModule(r.hasher) // returns a slice of Syscall structs

sort.Slice(zwStubs, func(i, j int) bool {
return zwStubs[i].RVA < zwStubs[j].RVA // sort stubs by RVA
sort.Slice(zws, func(i, j int) bool {
return zws[i].RVA < zws[j].RVA // sort stubs by RVA
})

// search clean syscall;ret gadgets to use as syscall trampolines in stubs memory range
for _, st := range zwStubs {
for _, st := range zws {
if trampoline := getTrampoline(st.VA); trampoline != uintptr(0) {
st.TrampolineAddr = trampoline
r.cleanTrampolines = append(r.cleanTrampolines, trampoline)
}
}

r.zwStubs = make(map[uint64]*resolver.Syscall, len(zwStubs))
for idx, st := range zwStubs {
r.zwStubs = make(map[uint64]*resolver.Syscall, len(zws))
for idx, st := range zws {
st.SSN = uint16(idx)

// keep its default trampoline if it was unhooked, otherwise use one of the clean ones
if st.TrampolineAddr == uintptr(0) {
zwStubs[idx].TrampolineAddr = r.cleanTrampolines[0] // pick random one?
zws[idx].TrampolineAddr = r.cleanTrampolines[0] // pick random one?
}

r.zwStubs[zwStubs[idx].NameHash] = zwStubs[idx]
fmt.Printf(
"NameHash: %d | VA: 0x%x | SSN: %d | Trampoline: 0x%x\r\n\r\n",
zwStubs[idx].NameHash,
zwStubs[idx].VA,
zwStubs[idx].SSN,
zwStubs[idx].TrampolineAddr,
)
// add to zwStubs map
r.zwStubs[zws[idx].NameHash] = zws[idx]
}

return r, nil
Expand All @@ -61,5 +55,5 @@ func (r *ssnSortResolver) GetSyscall(fnHash uint64) (*resolver.Syscall, error) {
if v, ok := r.zwStubs[fnHash]; ok {
return v, nil
}
return nil, errors.New("could not find stub with the provided hash")
return nil, errors.New(fmt.Sprintf("syscall with hash %d not found", fnHash))
}

0 comments on commit 5f1b1ce

Please sign in to comment.