Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Path: blob/master/external/source/evasion/windows/process_herpaderping/ProcessHerpaderping/utils.hpp
Views: 11788
#pragma once12namespace Utils3{4constexpr static uint32_t MaxFileBuffer{ 0x8000 }; // 32kib56#pragma warning(push)7#pragma warning(disable : 4634) // xmldoc: discarding XML document comment for invalid target8/// <summary>9/// Removes all occurrences of a set of values from an object.10/// </summary>11/// <typeparam name="T">12/// Object type to remove elements of. Must implement erase, be forward13/// iterate-able, and contained value type must be move assignable.14/// </typeparam>15/// <param name="Object">16/// Object to erase elements from.17/// </param>18/// <param name="Values">19/// Values to remove.20/// </param>21template <typename T>22void EraseAll(23_Inout_ T& Object,24_In_ const std::initializer_list<typename T::value_type>& Values)25{26for (const auto& value : Values)27{28Object.erase(std::remove(Object.begin(),29Object.end(),30value),31Object.end());32}33}34#pragma warning(pop)3536/// <summary>37/// Formats an error code as a string.38/// </summary>39/// <param name="Error">40/// Error code to format as a string.41/// </param>42/// <returns>43/// Human readable string for the error code if the error is unknown a44/// string is returned formatted as "[number] - Unknown Error".45/// </returns>46std::wstring FormatError(_In_ uint32_t Error);4748/// <summary>49/// Generates a buffer of a given length containing a supplied pattern.50/// </summary>51/// <param name="Buffer">52/// Buffer to fill with the patter, must not be empty.53/// </param>54/// <param name="Pattern">55/// Pattern to write into the buffer.56/// </param>57/// <returns>58/// Success when the buffer is filled with the pattern. Failure if Buffer59/// is empty.60/// </returns>61_Must_inspect_result_ HRESULT FillBufferWithPattern(62_Inout_ std::vector<uint8_t>& Buffer,63_In_ std::span<const uint8_t> Pattern);6465/// <summary>66/// Gets a file size.67/// </summary>68/// <param name="FileHandle">69/// File to get the size of.70/// </param>71/// <param name="FileSize">72/// Set to the size of the file on success.73/// </param>74/// <returns>75/// Success if the file size of retrieved.76/// </returns>77_Must_inspect_result_ HRESULT GetFileSize(78_In_ handle_t FileHandle,79_Out_ uint64_t& FileSize);8081/// <summary>82/// Sets a file pointer.83/// </summary>84/// <param name="FileHandle">85/// File to set the pointer of.86/// </param>87/// <param name="DistanceToMove">88/// Distance to move the file pointer.89/// </param>90/// <param name="MoveMethod">91/// Move method to use (FILE_BEGIN, FILE_CURRENT, FILE_END).92/// </param>93/// <returns>94/// Success if the file pointer was set (or was already set).95/// </returns>96_Must_inspect_result_ HRESULT SetFilePointer(97_In_ handle_t FileHandle,98_In_ int64_t DistanceToMove,99_In_ uint32_t MoveMethod);100101/// <summary>102/// Copies the contents for a source file to the target by handle.103/// </summary>104/// <param name="SourceHandle">105/// Source file handle.106/// </param>107/// <param name="TargetHandle">108/// Target file handle.109/// </param>110/// <returns>111/// Success if the source file has been copied to the target.112/// </returns>113_Must_inspect_result_ HRESULT CopyFileByHandle(114_In_ handle_t SourceHandle,115_In_ handle_t TargetHandle);116117/// <summary>118/// Overwrites the contents of a file with a pattern.119/// </summary>120/// <param name="FileHandle">121/// Target file to overwrite.122/// </param>123/// <param name="Pattern">124/// Pattern write over the file content.125/// </param>126/// <param name="PatternLength">127/// Length of Pattern buffer.128/// </param>129/// <returns>130/// Success if the file content was overwritten.131/// </returns>132_Must_inspect_result_ HRESULT OverwriteFileContentsWithPattern(133_In_ handle_t FileHandle,134_In_ std::span<const uint8_t> Pattern);135136/// <summary>137/// Overwrites a file from a given offset with a pattern.138/// </summary>139/// <param name="FileHandle">140/// Target file to overwrite.141/// </param>142/// <param name="FileOffset">143/// Offset to begin writing from.144/// </param>145/// <param name="Pattern">146/// Pattern to use to extend the target file with.147/// </param>148/// <param name="WrittenBytes">149/// Number of bytes written.150/// </param>151/// <returns>152/// Success if the file was overwritten.153/// </returns>154_Must_inspect_result_ HRESULT OverwriteFileAfterWithPattern(155_In_ handle_t FileHandle,156_In_ uint64_t FileOffset,157_In_ std::span<const uint8_t> Pattern,158_Out_ uint32_t& WrittenBytes);159160/// <summary>161/// Extends a PE file security directory by a number of bytes.162/// </summary>163/// <param name="FileHandle">164/// Target file handle.165/// </param>166/// <param name="ExtendedBy">167/// Number of bytes to extend the security directory by.168/// </param>169/// <returns>170/// Success if the security directory was extended. Failure if the file is171/// not a PE file or does not have a security directory.172/// </returns>173_Must_inspect_result_ HRESULT ExtendFileSecurityDirectory(174_In_ handle_t FileHandle,175_In_ uint32_t ExtendedBy);176177/// <summary>178/// Retrieves the image entry point RVA from a file.179/// </summary>180/// <param name="FileHandle">181/// File to parse for the entry point RVA.182/// </param>183/// <param name="EntryPointRva">184/// Set to the entry point RVA on success.185/// </param>186/// <returns>187/// Success if the PE image entry RVA is located.188/// </returns>189_Must_inspect_result_ HRESULT GetImageEntryPointRva(190_In_ handle_t FileHandle,191_Out_ uint32_t& EntryPointRva);192193/// <summary>194/// Writes remote process parameters into target process.195/// </summary>196/// <param name="ProcessHandle">197/// Process to write parameters into.198/// </param>199/// <param name="DllPath">200/// Dll path to write into the parameters, optional.201/// </param>202/// <param name="ImageFileName">203/// Image file name to write into the parameters.204/// </param>205/// <param name="CurrentDirectory">206/// Current directory to write into the parameters, optional.207/// </param>208/// <param name="CommandLine">209/// Command line to write into the parameters, optional.210/// </param>211/// <param name="EnvironmentBlock">212/// Environment block to write into the parameters, optional.213/// </param>214/// <param name="WindowTitle">215/// Window title to write into the parameters, optional.216/// </param>217/// <param name="DesktopInfo">218/// Desktop info to write into the parameters, optional.219/// </param>220/// <param name="ShellInfo">221/// ShellInfo to write into the parameters, optional.222/// </param>223/// <param name="RuntimeData">224/// Runtime data to write into the parameters, optional.225/// </param>226/// <returns>227/// Success if the remote process parameters are written.228/// </returns>229_Must_inspect_result_ HRESULT WriteRemoteProcessParameters(230_In_ handle_t ProcessHandle,231_In_ const std::wstring ImageFileName,232_In_opt_ const std::optional<std::wstring>& DllPath,233_In_opt_ const std::optional<std::wstring>& CurrentDirectory,234_In_opt_ const std::optional<std::wstring>& CommandLine,235_In_opt_ void* EnvironmentBlock,236_In_opt_ const std::optional<std::wstring>& WindowTitle,237_In_opt_ const std::optional<std::wstring>& DesktopInfo,238_In_opt_ const std::optional<std::wstring>& ShellInfo,239_In_opt_ const std::optional<std::wstring>& RuntimeData);240241_Must_inspect_result_ BOOL ShouldReplaceWithFile(242_In_ const char* fileName);243244_Must_inspect_result_ HRESULT GetFileName(245_In_ const char* sourceFileName,246_Out_ std::wstring& finalFileName);247248#ifndef _WIN64249//250// Only needed for 32-bit Windows251//252typedef struct _FILE_VERSION253{254WORD MajorVersion;255WORD MinorVersion;256WORD BuildVersion;257WORD RevisionVersion;258} FILE_VERSION, * PFILE_VERSION;259260_Must_inspect_result_ HRESULT GetFileVersion(261_In_ LPCWSTR lptstrFilename,262_Out_ PFILE_VERSION ver);263264_Must_inspect_result_ HRESULT IsBuggyKernel();265#endif266}267268