diff --git a/AttackServices/DLLInjectionAttack/InjectorTest.exe b/AttackServices/DLLInjectionAttack/InjectorTest.exe deleted file mode 100644 index 78d0678..0000000 Binary files a/AttackServices/DLLInjectionAttack/InjectorTest.exe and /dev/null differ diff --git a/AttackServices/Direct3D11HookAttack/Direct3DTestApp.exe b/AttackServices/Direct3D11HookAttack/Direct3DTestApp.exe deleted file mode 100644 index 31188e6..0000000 Binary files a/AttackServices/Direct3D11HookAttack/Direct3DTestApp.exe and /dev/null differ diff --git a/AttackServices/HiddenKernelDLLInjectionAttack/AttackTest.exe b/AttackServices/HiddenKernelDLLInjectionAttack/AttackTest.exe deleted file mode 100644 index 5d913be..0000000 Binary files a/AttackServices/HiddenKernelDLLInjectionAttack/AttackTest.exe and /dev/null differ diff --git a/AttackServices/HiddenKernelDLLInjectionAttack/Injector.h b/AttackServices/HiddenKernelDLLInjectionAttack/Injector.h index f8644f3..07f8033 100644 --- a/AttackServices/HiddenKernelDLLInjectionAttack/Injector.h +++ b/AttackServices/HiddenKernelDLLInjectionAttack/Injector.h @@ -244,8 +244,7 @@ BOOL StealthInject(string processName, string dllPath) { SetTargetEProcessIfCanRead(eProcess, padSpace); WriteVirtual(backup1.data(), padSpace, pidBasedHook.size()); - // TODO Use ntdll.dll imports instead of GetKernelRoutine() and see if it's still crashing on PC - // first try NON_PAGED_CODE and NON_PAGED_DATA if possible + // TODO write test cases for the driver (e.g. loading & unloading 100x, init memory controller 100x, ...) return TRUE; } diff --git a/AttackServices/HiddenKernelDLLInjectionAttack/MemoryController.h b/AttackServices/HiddenKernelDLLInjectionAttack/MemoryController.h index 6d50cac..554100b 100644 --- a/AttackServices/HiddenKernelDLLInjectionAttack/MemoryController.h +++ b/AttackServices/HiddenKernelDLLInjectionAttack/MemoryController.h @@ -147,7 +147,7 @@ NON_PAGED_DATA static kernelFuncCall PsGetProcessId; NON_PAGED_DATA static kernelFuncCall ZwOpenSection; NON_PAGED_DATA static kernelFuncCall ZwMapViewOfSection; NON_PAGED_DATA static kernelFuncCall ZwClose; -NON_PAGED_DATA PPHYSICAL_MEMORY_RANGE(NTAPI* MmGetPhysicalMemoryRanges)(void); +NON_PAGED_DATA static PPHYSICAL_MEMORY_RANGE(NTAPI* MmGetPhysicalMemoryRanges)(void); /** Functions executed in kernel mode **/ @@ -396,30 +396,33 @@ void InitKernelFunctions() { ZwMapViewOfSection = GetKernelProcAddress<>("ZwMapViewOfSection"); ZwClose = GetKernelProcAddress<>("ZwClose"); MmGetPhysicalMemoryRanges = GetKernelProcAddress("MmGetPhysicalMemoryRanges"); + + // cout << ExAllocatePool << endl; + // cout << PsGetCurrentProcess << endl; + // cout << PsGetProcessId << endl; + // cout << ZwOpenSection << endl; + // cout << ZwMapViewOfSection << endl; + // cout << ZwClose << endl; + // cout << MmGetPhysicalMemoryRanges << endl; } BOOL InitMemoryController() { - if (!InitKernelModuleInfo()) { - return FALSE; - } InitKernelFunctions(); + cout << "loading driver..." << endl; + // system("PAUSE"); if (!InitDriver()) { return FALSE; } - cout << "about to init kernel funcs" << endl; - system("PAUSE"); - // RunInKernel(InitKernelFunctions, NULL); - cout << "done init kernel funcs" << endl; - system("PAUSE"); - cout << "about to GetPhysicalMemoryData" << endl; + cout << "getting GetPhysicalMemoryData" << endl; + // system("PAUSE"); RunInKernel(GetPhysicalMemoryData, NULL); - cout << "done GetPhysicalMemoryData" << endl; - system("PAUSE"); if (!physicalMemoryBegin || !physicalMemorySize || !uniqueProcessIdOffset || !activeProcessLinksOffset) { return FALSE; } + cout << "got GetPhysicalMemoryData" << endl; + // system("PAUSE"); targetDirectoryBase = currentDirectoryBase; diff --git a/AttackServices/HiddenKernelDLLInjectionAttack/workspace.code-workspace b/AttackServices/HiddenKernelDLLInjectionAttack/workspace.code-workspace deleted file mode 100644 index d60dc64..0000000 --- a/AttackServices/HiddenKernelDLLInjectionAttack/workspace.code-workspace +++ /dev/null @@ -1,3 +0,0 @@ -{ - "folders": [] -} \ No newline at end of file diff --git a/AttackServices/IATHookAttack/IATHookTest.exe b/AttackServices/IATHookAttack/IATHookTest.exe deleted file mode 100644 index f946615..0000000 Binary files a/AttackServices/IATHookAttack/IATHookTest.exe and /dev/null differ diff --git a/AttackServices/JmpHookAttack/InjectorTest.exe b/AttackServices/JmpHookAttack/InjectorTest.exe deleted file mode 100644 index e36829d..0000000 Binary files a/AttackServices/JmpHookAttack/InjectorTest.exe and /dev/null differ diff --git a/AttackServices/SystemProcessInjectionAttack/ServicesTest.exe b/AttackServices/SystemProcessInjectionAttack/ServicesTest.exe deleted file mode 100644 index 0a2c794..0000000 Binary files a/AttackServices/SystemProcessInjectionAttack/ServicesTest.exe and /dev/null differ diff --git a/AttackServices/ThreadHijackAttack/ThreadHijackTest.exe b/AttackServices/ThreadHijackAttack/ThreadHijackTest.exe deleted file mode 100644 index c1daaf4..0000000 Binary files a/AttackServices/ThreadHijackAttack/ThreadHijackTest.exe and /dev/null differ