C++ copy file NT

premiumcat · 21.04.2021

C:

int copy_file(  LPCWSTR oldfile, LPCWSTR newfile )
{
    NTSTATUS status;

    HANDLE hOldFile, hNewFile;
    UNICODE_STRING OldFileName;
    UNICODE_STRING NewFileName;

    IO_STATUS_BLOCK ioStatusBlockOld;
    IO_STATUS_BLOCK ioStatusBlockNew;

    OBJECT_ATTRIBUTES objAttribsOld;
    OBJECT_ATTRIBUTES objAttribsNew;

    FILE_STANDARD_INFORMATION FileInfo;
    ULONG FileLength;
    BYTE* FileBuffer;
    LARGE_INTEGER FileOffset;

    NTLIB32.RtlInitUnicodeString(&OldFileName, oldfile);
    InitializeObjectAttributes(&objAttribsOld, &OldFileName, OBJ_CASE_INSENSITIVE, NULL, NULL);

    NTLIB32.NtOpenFile(&hOldFile,
                GENERIC_READ | SYNCHRONIZE,
                &objAttribsOld,
                &ioStatusBlockOld,
                FILE_SHARE_READ,
                FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE);

    NTLIB32.NtQueryInformationFile(hOldFile,
                &ioStatusBlockOld,
                &FileInfo,
                sizeof(FILE_STANDARD_INFORMATION),
                FileStandardInformation);

    FileLength = FileInfo.EndOfFile.u.LowPart;
    FileBuffer = (BYTE*)malloc(FileLength + 1);
    FileOffset.QuadPart = 0ULL;

    status = NTLIB32.NtReadFile(hOldFile,
                NULL,
                NULL,
                NULL,
                &ioStatusBlockOld,
                FileBuffer,
                FileLength,
                &FileOffset,
                NULL);

    FileBuffer[FileLength] = 0;
    NTLIB32.NtClose(hOldFile);

    NTLIB32.RtlInitUnicodeString(&NewFileName, newfile);
    InitializeObjectAttributes(&objAttribsNew, &NewFileName, OBJ_CASE_INSENSITIVE, NULL, NULL);

    status = NTLIB32.NtCreateFile(&hNewFile,
                GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE,
                &objAttribsNew,
                &ioStatusBlockNew,
                NULL,
                FILE_ATTRIBUTE_NORMAL,
                FILE_SHARE_READ,
                FILE_CREATE,
                FILE_WRITE_THROUGH | FILE_SYNCHRONOUS_IO_NONALERT,
                NULL,
                0);


    status = NTLIB32.NtWriteFile(
        hNewFile,
        NULL,
        NULL,
        NULL,
        &ioStatusBlockNew,
        FileBuffer,
        FileLength+1,
        NULL,
        NULL);


    NTLIB32.NtClose(hNewFile);

    return 0;
}

koeir · 22.04.2021

What is NTLIB32 ?

Quake3 · 22.04.2021

koeir сказал(а):

What is NTLIB32 ?

Очевидно, какой-то враппер для вызова функций Native api. Мб какой-то класс или что. Просто поменяйте на обычные вызовы или через getprocaddres.

premiumcat · 23.04.2021

Quake3 сказал(а):

Очевидно, какой-то враппер для вызова функций Native api. Мб какой-то класс или что. Просто поменяйте на обычные вызовы или через getprocaddres.

Да (Yes)

koeir · 23.04.2021

premiumcat сказал(а):

Yes (Yes)

Post is here please

premiumcat · 23.04.2021

koeir сказал(а):

Post is here please

"types32.h"

C:

#include "windows.h"
#include "winternl.h"

//NTDLL--------------------------------------------------

#define FileStandardInformation (FILE_INFORMATION_CLASS) 5

typedef PVOID PACTIVATION_CONTEXT;

typedef struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME
{
    struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME *Previous;
    PACTIVATION_CONTEXT ActivationContext;
    ULONG Flags;
} RTL_ACTIVATION_CONTEXT_STACK_FRAME, *PRTL_ACTIVATION_CONTEXT_STACK_FRAME;

typedef struct _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
{
    SIZE_T Size;
    ULONG Format;
    RTL_ACTIVATION_CONTEXT_STACK_FRAME Frame;
    PVOID Extra1;
    PVOID Extra2;
    PVOID Extra3;
    PVOID Extra4;
} RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED, *PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED;

#define RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_FORMAT_WHISTLER 0x1

typedef RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME;

typedef struct _FILE_LINK_INFORMATION
{
    BOOLEAN ReplaceIfExists;
    HANDLE RootDirectory;
    ULONG FileNameLength;
    WCHAR FileName[1];
} FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION;

typedef struct _FILE_STANDARD_INFORMATION {
  LARGE_INTEGER AllocationSize;
  LARGE_INTEGER EndOfFile;
  ULONG         NumberOfLinks;
  BOOLEAN       DeletePending;
  BOOLEAN       Directory;
} FILE_STANDARD_INFORMATION, *PFILE_STANDARD_INFORMATION;

typedef NTSTATUS (NTAPI *_NtCreateFile)(
        PHANDLE            FileHandle,
        ACCESS_MASK        DesiredAccess,
        POBJECT_ATTRIBUTES ObjectAttributes,
        PIO_STATUS_BLOCK   IoStatusBlock,
        PLARGE_INTEGER     AllocationSize,
        ULONG              FileAttributes,
        ULONG              ShareAccess,
        ULONG              CreateDisposition,
        ULONG              CreateOptions,
        PVOID              EaBuffer,
        ULONG              EaLength
);

typedef NTSTATUS (NTAPI *_NtOpenFile) (
        PHANDLE            FileHandle,
        ACCESS_MASK        DesiredAccess,
        POBJECT_ATTRIBUTES ObjectAttributes,
        PIO_STATUS_BLOCK   IoStatusBlock,
        ULONG              ShareAccess,
        ULONG              OpenOptions
);

typedef NTSTATUS (NTAPI *_NtWriteFile)(
        HANDLE           FileHandle,
        HANDLE           Event,
        PIO_APC_ROUTINE  ApcRoutine,
        PVOID            ApcContext,
        PIO_STATUS_BLOCK IoStatusBlock,
        PVOID            Buffer,
        ULONG            Length,
        PLARGE_INTEGER   ByteOffset,
        PULONG           Key
);

typedef NTSTATUS (NTAPI *_NtClose)(
        HANDLE Handle
);

typedef VOID (NTAPI *_RtlInitUnicodeString)(
        PUNICODE_STRING DestinationString,
        PCWSTR SourceString
);

typedef BOOLEAN (NTAPI *_RtlDosPathNameToNtPathName_U) (
        LPCWSTR lpPath,
        UNICODE_STRING *NtPath,
        BOOLEAN AllocFlag,
        UNICODE_STRING *Reserved
);

typedef PVOID (NTAPI *_RtlAllocateHeap) (
        PVOID  HeapHandle,
        ULONG  Flags,
        SIZE_T Size
);

typedef VOID (NTAPI *_RtlMoveMemory) (
        VOID UNALIGNED *Destination,
        const VOID UNALIGNED *Source,
        SIZE_T         Length
);

typedef NTSTATUS (NTAPI *_NtSetInformationFile) (
        HANDLE                 FileHandle,
        PIO_STATUS_BLOCK       IoStatusBlock,
        PVOID                  FileInformation,
        ULONG                  Length,
        int                     FileInformationClass
);

typedef HDESK (NTAPI * _NtUserCreateDesktop) (
     POBJECT_ATTRIBUTES ObjectAttributes,
     PUNICODE_STRING lpszDesktopDevice,
     LPDEVMODEW lpdmw,
     DWORD dwFlags,
     ACCESS_MASK dwDesiredAccess
);

typedef NTSTATUS (NTAPI * _NtQueryInformationFile) (
  HANDLE                 FileHandle,
  PIO_STATUS_BLOCK       IoStatusBlock,
  PVOID                  FileInformation,
  ULONG                  Length,
  FILE_INFORMATION_CLASS FileInformationClass
);

typedef NTSTATUS (NTAPI * _NtReadFile) (
  _In_     HANDLE           FileHandle,
  _In_opt_ HANDLE           Event,
  _In_opt_ PIO_APC_ROUTINE  ApcRoutine,
  _In_opt_ PVOID            ApcContext,
  _Out_    PIO_STATUS_BLOCK IoStatusBlock,
  _Out_    PVOID            Buffer,
  _In_     ULONG            Length,
  _In_opt_ PLARGE_INTEGER   ByteOffset,
  _In_opt_ PULONG           Key
);

typedef NTSTATUS (NTAPI * _NtDelayExecution) (
    IN BOOLEAN              Alertable,
    IN PLARGE_INTEGER       DelayInterval
);

typedef NTSTATUS (NTAPI * _RtlActivateActivationContextUnsafeFast) (
    IN PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame,
    IN PVOID Context
);

typedef NTSTATUS (NTAPI * _RtlDeactivateActivationContextUnsafeFast) (
    IN PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame
);

typedef struct _SERVER_INFO_101 {
    DWORD           sv101_platform_id;
    LPWSTR           sv101_name;
    DWORD           sv101_version_major;
    DWORD           sv101_version_minor;
    DWORD           sv101_type;
    LPWSTR           sv101_comment;
} SERVER_INFO_101, *PSERVER_INFO_101, *LPSERVER_INFO_101;

typedef struct NT32 {
    _NtOpenFile NtOpenFile;
    _NtCreateFile NtCreateFile;
    _NtWriteFile NtWriteFile;
    _NtClose NtClose;
    _RtlInitUnicodeString RtlInitUnicodeString;
    _RtlDosPathNameToNtPathName_U RtlDosPathNameToNtPathName_U;
    _NtSetInformationFile NtSetInformationFile;
    _NtUserCreateDesktop NtUserCreateDesktop;
    _NtQueryInformationFile NtQueryInformationFile;
    _NtReadFile NtReadFile;
    _NtDelayExecution NtDelayExecution;
    _RtlActivateActivationContextUnsafeFast RtlActivateActivationContextUnsafeFast;
    _RtlDeactivateActivationContextUnsafeFast RtlDeactivateActivationContextUnsafeFast;
};

HMODULE NTDLL = NULL;

struct NT32 NTLIB32 = { NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL };

main.c

Код:

#include "Types32.h"
extern struct NTLIB32;
int load_ntapi32()
{
    if (NULL != (NTDLL = LoadLibraryA("ntdll.dll")))
    {
        NTLIB32.NtOpenFile = (_NtOpenFile)GetProcAddress(NTDLL, "NtOpenFile");
        NTLIB32.NtCreateFile = (_NtCreateFile)GetProcAddress(NTDLL, "NtCreateFile");
        NTLIB32.NtWriteFile = (_NtWriteFile)GetProcAddress(NTDLL, "NtWriteFile");
        NTLIB32.NtReadFile = (_NtReadFile)GetProcAddress(NTDLL, "NtReadFile");
        NTLIB32.NtClose = (_NtClose)GetProcAddress(NTDLL, "NtClose");
        NTLIB32.NtSetInformationFile = (_NtSetInformationFile)GetProcAddress(NTDLL, "NtSetInformationFile");
        NTLIB32.NtQueryInformationFile = (_NtQueryInformationFile)GetProcAddress(NTDLL, "NtQueryInformationFile");

        NTLIB32.RtlInitUnicodeString = (_RtlInitUnicodeString)GetProcAddress(NTDLL, "RtlInitUnicodeString");
        NTLIB32.RtlDosPathNameToNtPathName_U = (_RtlDosPathNameToNtPathName_U)GetProcAddress(NTDLL, "RtlDosPathNameToNtPathName_U");

        NTLIB32.NtDelayExecution = (_NtDelayExecution)GetProcAddress(NTDLL, "NtDelayExecution");
        NTLIB32.RtlActivateActivationContextUnsafeFast = (_RtlActivateActivationContextUnsafeFast)GetProcAddress(NTDLL, "RtlActivateActivationContextUnsafeFast");
        NTLIB32.RtlDeactivateActivationContextUnsafeFast = (_RtlDeactivateActivationContextUnsafeFast)GetProcAddress(NTDLL, "RtlDeactivateActivationContextUnsafeFast");

        if ( NTLIB32.NtOpenFile != NULL\
            && NTLIB32.NtCreateFile != NULL\
            && NTLIB32.NtWriteFile != NULL\
            && NTLIB32.NtClose != NULL\
            && NTLIB32.RtlInitUnicodeString != NULL\
            && NTLIB32.RtlDosPathNameToNtPathName_U != NULL\
            && NTLIB32.NtSetInformationFile != NULL\
            && NTLIB32.NtQueryInformationFile != NULL\
            && NTLIB32.NtReadFile != NULL \
            && NTLIB32.RtlActivateActivationContextUnsafeFast != NULL \
            && NTLIB32.RtlDeactivateActivationContextUnsafeFast != NULL )
                return 0;
    }
    return -1;
}

...
load_ntapi32();
copy_file( L"\\??\\C:\\putty.exe", L"\\??\\C:\\putty2.exe" );
...

premiumcat · 23.04.2021

впринципе если заглядывать в исходники ReacOs можно найти множество реализаций сподручных функций. И чем нибудь более лучшим подгружать чем просто LoadLibrary/GetProcAddress. Думая нормально было бы по хешам, сисколам, или через wow64 если программа у нас 32 битная на 64 битной ос.
Как раз судя по всем на NT функции и вешается детект по рантайму. Так что если магичить с их вызовами тогда получится прорваться.

Apocalypse · 24.04.2021

Ого, чел открыл для себя ntdll апишки.

premiumcat · 24.04.2021

Apocalypse сказал(а):

Ого, чел открыл для себя ntdll апишки.

угумс. изучаю, очень интересно и нравится

C++ copy file NT

premiumcat

ripper

koeir

⭐️⭐️⭐️⭐️⭐️⭐⭐️⭐️⭐️⭐⭐️⭐️⭐️⭐️⭐️⭐⭐️⭐️⭐️⭐⭐️⭐️⭐️⭐️⭐️⭐⭐️⭐

Quake3

TPU unit

premiumcat

ripper

koeir

⭐️⭐️⭐️⭐️⭐️⭐⭐️⭐️⭐️⭐⭐️⭐️⭐️⭐️⭐️⭐⭐️⭐️⭐️⭐⭐️⭐️⭐️⭐️⭐️⭐⭐️⭐

premiumcat

ripper

premiumcat

ripper

Apocalypse

CPU register

premiumcat

ripper