CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

GitHub Repository: rapid7/metasploit-framework
Path: blob/master/external/source/evasion/windows/process_herpaderping/ProcessHerpaderping/utils.hpp
Views: 11788
1
#pragma once
2
3
namespace Utils
4
{
5
constexpr static uint32_t MaxFileBuffer{ 0x8000 }; // 32kib
6
7
#pragma warning(push)
8
#pragma warning(disable : 4634) // xmldoc: discarding XML document comment for invalid target
9
/// <summary>
10
/// Removes all occurrences of a set of values from an object.
11
/// </summary>
12
/// <typeparam name="T">
13
/// Object type to remove elements of. Must implement erase, be forward
14
/// iterate-able, and contained value type must be move assignable.
15
/// </typeparam>
16
/// <param name="Object">
17
/// Object to erase elements from.
18
/// </param>
19
/// <param name="Values">
20
/// Values to remove.
21
/// </param>
22
template <typename T>
23
void EraseAll(
24
_Inout_ T& Object,
25
_In_ const std::initializer_list<typename T::value_type>& Values)
26
{
27
for (const auto& value : Values)
28
{
29
Object.erase(std::remove(Object.begin(),
30
Object.end(),
31
value),
32
Object.end());
33
}
34
}
35
#pragma warning(pop)
36
37
/// <summary>
38
/// Formats an error code as a string.
39
/// </summary>
40
/// <param name="Error">
41
/// Error code to format as a string.
42
/// </param>
43
/// <returns>
44
/// Human readable string for the error code if the error is unknown a
45
/// string is returned formatted as "[number] - Unknown Error".
46
/// </returns>
47
std::wstring FormatError(_In_ uint32_t Error);
48
49
/// <summary>
50
/// Generates a buffer of a given length containing a supplied pattern.
51
/// </summary>
52
/// <param name="Buffer">
53
/// Buffer to fill with the patter, must not be empty.
54
/// </param>
55
/// <param name="Pattern">
56
/// Pattern to write into the buffer.
57
/// </param>
58
/// <returns>
59
/// Success when the buffer is filled with the pattern. Failure if Buffer
60
/// is empty.
61
/// </returns>
62
_Must_inspect_result_ HRESULT FillBufferWithPattern(
63
_Inout_ std::vector<uint8_t>& Buffer,
64
_In_ std::span<const uint8_t> Pattern);
65
66
/// <summary>
67
/// Gets a file size.
68
/// </summary>
69
/// <param name="FileHandle">
70
/// File to get the size of.
71
/// </param>
72
/// <param name="FileSize">
73
/// Set to the size of the file on success.
74
/// </param>
75
/// <returns>
76
/// Success if the file size of retrieved.
77
/// </returns>
78
_Must_inspect_result_ HRESULT GetFileSize(
79
_In_ handle_t FileHandle,
80
_Out_ uint64_t& FileSize);
81
82
/// <summary>
83
/// Sets a file pointer.
84
/// </summary>
85
/// <param name="FileHandle">
86
/// File to set the pointer of.
87
/// </param>
88
/// <param name="DistanceToMove">
89
/// Distance to move the file pointer.
90
/// </param>
91
/// <param name="MoveMethod">
92
/// Move method to use (FILE_BEGIN, FILE_CURRENT, FILE_END).
93
/// </param>
94
/// <returns>
95
/// Success if the file pointer was set (or was already set).
96
/// </returns>
97
_Must_inspect_result_ HRESULT SetFilePointer(
98
_In_ handle_t FileHandle,
99
_In_ int64_t DistanceToMove,
100
_In_ uint32_t MoveMethod);
101
102
/// <summary>
103
/// Copies the contents for a source file to the target by handle.
104
/// </summary>
105
/// <param name="SourceHandle">
106
/// Source file handle.
107
/// </param>
108
/// <param name="TargetHandle">
109
/// Target file handle.
110
/// </param>
111
/// <returns>
112
/// Success if the source file has been copied to the target.
113
/// </returns>
114
_Must_inspect_result_ HRESULT CopyFileByHandle(
115
_In_ handle_t SourceHandle,
116
_In_ handle_t TargetHandle);
117
118
/// <summary>
119
/// Overwrites the contents of a file with a pattern.
120
/// </summary>
121
/// <param name="FileHandle">
122
/// Target file to overwrite.
123
/// </param>
124
/// <param name="Pattern">
125
/// Pattern write over the file content.
126
/// </param>
127
/// <param name="PatternLength">
128
/// Length of Pattern buffer.
129
/// </param>
130
/// <returns>
131
/// Success if the file content was overwritten.
132
/// </returns>
133
_Must_inspect_result_ HRESULT OverwriteFileContentsWithPattern(
134
_In_ handle_t FileHandle,
135
_In_ std::span<const uint8_t> Pattern);
136
137
/// <summary>
138
/// Overwrites a file from a given offset with a pattern.
139
/// </summary>
140
/// <param name="FileHandle">
141
/// Target file to overwrite.
142
/// </param>
143
/// <param name="FileOffset">
144
/// Offset to begin writing from.
145
/// </param>
146
/// <param name="Pattern">
147
/// Pattern to use to extend the target file with.
148
/// </param>
149
/// <param name="WrittenBytes">
150
/// Number of bytes written.
151
/// </param>
152
/// <returns>
153
/// Success if the file was overwritten.
154
/// </returns>
155
_Must_inspect_result_ HRESULT OverwriteFileAfterWithPattern(
156
_In_ handle_t FileHandle,
157
_In_ uint64_t FileOffset,
158
_In_ std::span<const uint8_t> Pattern,
159
_Out_ uint32_t& WrittenBytes);
160
161
/// <summary>
162
/// Extends a PE file security directory by a number of bytes.
163
/// </summary>
164
/// <param name="FileHandle">
165
/// Target file handle.
166
/// </param>
167
/// <param name="ExtendedBy">
168
/// Number of bytes to extend the security directory by.
169
/// </param>
170
/// <returns>
171
/// Success if the security directory was extended. Failure if the file is
172
/// not a PE file or does not have a security directory.
173
/// </returns>
174
_Must_inspect_result_ HRESULT ExtendFileSecurityDirectory(
175
_In_ handle_t FileHandle,
176
_In_ uint32_t ExtendedBy);
177
178
/// <summary>
179
/// Retrieves the image entry point RVA from a file.
180
/// </summary>
181
/// <param name="FileHandle">
182
/// File to parse for the entry point RVA.
183
/// </param>
184
/// <param name="EntryPointRva">
185
/// Set to the entry point RVA on success.
186
/// </param>
187
/// <returns>
188
/// Success if the PE image entry RVA is located.
189
/// </returns>
190
_Must_inspect_result_ HRESULT GetImageEntryPointRva(
191
_In_ handle_t FileHandle,
192
_Out_ uint32_t& EntryPointRva);
193
194
/// <summary>
195
/// Writes remote process parameters into target process.
196
/// </summary>
197
/// <param name="ProcessHandle">
198
/// Process to write parameters into.
199
/// </param>
200
/// <param name="DllPath">
201
/// Dll path to write into the parameters, optional.
202
/// </param>
203
/// <param name="ImageFileName">
204
/// Image file name to write into the parameters.
205
/// </param>
206
/// <param name="CurrentDirectory">
207
/// Current directory to write into the parameters, optional.
208
/// </param>
209
/// <param name="CommandLine">
210
/// Command line to write into the parameters, optional.
211
/// </param>
212
/// <param name="EnvironmentBlock">
213
/// Environment block to write into the parameters, optional.
214
/// </param>
215
/// <param name="WindowTitle">
216
/// Window title to write into the parameters, optional.
217
/// </param>
218
/// <param name="DesktopInfo">
219
/// Desktop info to write into the parameters, optional.
220
/// </param>
221
/// <param name="ShellInfo">
222
/// ShellInfo to write into the parameters, optional.
223
/// </param>
224
/// <param name="RuntimeData">
225
/// Runtime data to write into the parameters, optional.
226
/// </param>
227
/// <returns>
228
/// Success if the remote process parameters are written.
229
/// </returns>
230
_Must_inspect_result_ HRESULT WriteRemoteProcessParameters(
231
_In_ handle_t ProcessHandle,
232
_In_ const std::wstring ImageFileName,
233
_In_opt_ const std::optional<std::wstring>& DllPath,
234
_In_opt_ const std::optional<std::wstring>& CurrentDirectory,
235
_In_opt_ const std::optional<std::wstring>& CommandLine,
236
_In_opt_ void* EnvironmentBlock,
237
_In_opt_ const std::optional<std::wstring>& WindowTitle,
238
_In_opt_ const std::optional<std::wstring>& DesktopInfo,
239
_In_opt_ const std::optional<std::wstring>& ShellInfo,
240
_In_opt_ const std::optional<std::wstring>& RuntimeData);
241
242
_Must_inspect_result_ BOOL ShouldReplaceWithFile(
243
_In_ const char* fileName);
244
245
_Must_inspect_result_ HRESULT GetFileName(
246
_In_ const char* sourceFileName,
247
_Out_ std::wstring& finalFileName);
248
249
#ifndef _WIN64
250
//
251
// Only needed for 32-bit Windows
252
//
253
typedef struct _FILE_VERSION
254
{
255
WORD MajorVersion;
256
WORD MinorVersion;
257
WORD BuildVersion;
258
WORD RevisionVersion;
259
} FILE_VERSION, * PFILE_VERSION;
260
261
_Must_inspect_result_ HRESULT GetFileVersion(
262
_In_ LPCWSTR lptstrFilename,
263
_Out_ PFILE_VERSION ver);
264
265
_Must_inspect_result_ HRESULT IsBuggyKernel();
266
#endif
267
}
268