Skip to content

Commit

Permalink
chore: change instance var name for better distinction from pkg name
Browse files Browse the repository at this point in the history
  • Loading branch information
f1zm0 committed Apr 24, 2023
1 parent a3a897f commit 887c346
Show file tree
Hide file tree
Showing 3 changed files with 20 additions and 15 deletions.
13 changes: 6 additions & 7 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
<p align="center">
<img src=".github/readme_banner.png" title="acheron banner" width="45%"/>
<img src=".github/readme_banner.png" title="acheron banner" width="55%"/>
</p>
<p align="center">
<a href="https://github.com/f1zm0/acheron/releases"><img alt="latest release version" src="https://img.shields.io/github/v/release/f1zm0/acheron?color=aabbcc&logo=github&logoColor=white&labelColor=2b2c33"></a>
Expand Down Expand Up @@ -33,7 +33,7 @@ The following steps are performed when creating a new syscall proxy instance:

## Quickstart

Integrating `acheron` into your offsec tools is pretty easy.
Integrating `acheron` into your offsec tools is pretty easy.

You just need to call `acheron.New()` to create a syscall proxy instance and use `acheron.Syscall()` to make an indirect syscall for `Nt*` APIs.

Expand All @@ -50,15 +50,15 @@ import (

func main() {
// creates Acheron instance, resolves SSNs, collects clean trampolines in ntdll.dlll, etc.
acheron, err := acheron.New()
ach, err := acheron.New()
if err != nil {
panic(err)
}

// make indirect syscall for NtQuerySystemInformation
bufferSize := uint32(0)
_ = acheron.Syscall(
acheron.HashString("NtQuerySystemInformation"),
_ = ach.Syscall(
ach.HashString("NtQuerySystemInformation"),
0x5, // arg1: _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass
0, // arg2: _Out_ PVOID SystemInformation
uintptr(bufferSize), // arg3: _In_ ULONG SystemInformationLength
Expand All @@ -69,7 +69,7 @@ func main() {
}
```

For more examples check out the [examples](examples) directory or [hades](https://github.com/f1zm0/hades) loader repository.
For more concrete examples check out the [examples](examples) directory or [hades](https://github.com/f1zm0/hades) loader repository.

## References

Expand All @@ -86,7 +86,6 @@ For more examples check out the [examples](examples) directory or [hades](https:
- https://www.usenix.org/legacy/events/vee06/full_papers/p154-bhansali.pdf
- https://redops.at/en/blog/direct-syscalls-a-journey-from-high-to-low


## Additional Notes

The name is a reference to the [Acheron](https://en.wikipedia.org/wiki/Acheron) river in Greek mythology, which is the river where souls of the dead are carried to the underworld.
Expand Down
12 changes: 9 additions & 3 deletions examples/custom_hashfunc/main.go

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 5 additions & 5 deletions examples/process_snapshot/main.go

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

0 comments on commit 887c346

Please sign in to comment.