etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
utils.c (3991B)
      1 #define _CRT_SECURE_NO_WARNINGS
      2 #include "utils.h"
      3 #include "logger.h"
      4 #include <stdlib.h>
      5 #include <string.h>
      6 
      7 // ======================================
      8 //  Functions to XOR encrypt/decrypt
      9 // ======================================
     10 const char* XOR_KEY = "0123456789abcdefghij";
     11 size_t key_len = 20;
     12 
     13 char* xor_decrypt_string(const unsigned char* cipher, size_t len, const char* key, size_t key_len)
     14 {
     15     char* result = (char*)malloc(len + 1);
     16     if (!result) return NULL;
     17     for (size_t i = 0; i < len; i++) {
     18         result[i] = cipher[i] ^ key[i % key_len];
     19     }
     20     result[len] = '\0';
     21     return result;
     22 }
     23 
     24 void xor_buffer(unsigned char* buffer, size_t len, const char* key, size_t key_len)
     25 {
     26     for (size_t i = 0; i < len; i++) {
     27         buffer[i] ^= key[i % key_len];
     28     }
     29 }
     30 
     31 // ========================================
     32 //  Function to convert string to UNICODE
     33 // ========================================
     34 wchar_t* to_wide(const char* str) {
     35     int len = MultiByteToWideChar(CP_UTF8, 0, str, -1, NULL, 0);
     36     if (len == 0) return NULL;
     37     wchar_t* wstr = (wchar_t*)malloc(len * sizeof(wchar_t));
     38     if (!wstr) return NULL;
     39     MultiByteToWideChar(CP_UTF8, 0, str, -1, wstr, len);
     40     return wstr;
     41 }
     42 
     43 // =====================================================
     44 // Function to load clean versions of DLLs
     45 // =====================================================
     46 HMODULE LoadCleanDLL(char* dllPath) {
     47 
     48     HMODULE hDLL = LoadLibraryA(dllPath);
     49     /* DEBUG
     50     if (hDLL)
     51     {
     52         log_success("Loaded clean copy of %s at: %p", dllPath, hDLL);
     53     }
     54     else
     55     {
     56         log_error("Failed to load %s. Error: %lu", dllPath, GetLastError());
     57     }*/
     58 
     59     return hDLL;
     60 }
     61 
     62 // =====================================================
     63 // GetProcAddress reimplementation
     64 // =====================================================
     65 
     66 FARPROC CustomGetProcAddress(HMODULE hModule, LPCSTR lpProcName) {
     67     if (!hModule || !lpProcName) return NULL;
     68 
     69     BYTE* baseAddr = (BYTE*)hModule;
     70     IMAGE_DOS_HEADER* dosHeader = (IMAGE_DOS_HEADER*)baseAddr;
     71     if (dosHeader->e_magic != IMAGE_DOS_SIGNATURE) return NULL;
     72 
     73     IMAGE_NT_HEADERS* ntHeaders = (IMAGE_NT_HEADERS*)(baseAddr + dosHeader->e_lfanew);
     74     if (ntHeaders->Signature != IMAGE_NT_SIGNATURE) return NULL;
     75 
     76     IMAGE_DATA_DIRECTORY exportDirData = ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
     77     if (!exportDirData.VirtualAddress) return NULL;
     78 
     79     IMAGE_EXPORT_DIRECTORY* exportDir = (IMAGE_EXPORT_DIRECTORY*)(baseAddr + exportDirData.VirtualAddress);
     80 
     81     DWORD* names = (DWORD*)(baseAddr + exportDir->AddressOfNames);
     82     WORD* ordinals = (WORD*)(baseAddr + exportDir->AddressOfNameOrdinals);
     83     DWORD* functions = (DWORD*)(baseAddr + exportDir->AddressOfFunctions);
     84 
     85     for (DWORD i = 0; i < exportDir->NumberOfNames; i++) {
     86         char* name = (char*)(baseAddr + names[i]);
     87         if (_stricmp(name, lpProcName) == 0) {
     88             WORD ordinal = ordinals[i];
     89             DWORD funcRVA = functions[ordinal];
     90             FARPROC address = (FARPROC)(baseAddr + funcRVA);
     91 
     92             // Check if it's a forward export
     93             DWORD exportStart = exportDirData.VirtualAddress;
     94             DWORD exportEnd = exportStart + exportDirData.Size;
     95             if (funcRVA >= exportStart && funcRVA <= exportEnd) {
     96                 // It's a forward export (e.g., "sechost.OpenProcessToken")
     97                 char* forwardName = (char*)address;
     98                 char dllName[256] = { 0 };
     99                 char funcName[128] = { 0 };
    100 
    101                 sscanf(forwardName, "%[^.].%s", dllName, funcName);
    102                 strcat_s(dllName, sizeof(dllName), ".dll");
    103 
    104                 HMODULE hFwd = LoadLibraryA(dllName);
    105                 if (!hFwd) return NULL;
    106 
    107                 return GetProcAddress(hFwd, funcName);
    108             }
    109 
    110             return address;
    111         }
    112     }
    113 
    114     return NULL;
    115 }