shellcode

package
v0.0.0-...-12ad57f Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 25, 2024 License: MIT Imports: 10 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	MEM_COMMIT        = 0x1000
	MEM_RESERVE       = 0x2000
	PAGE_EXECUTE_READ = 0x20
	PAGE_READWRITE    = 0x04
)
View Source 
const (
	IDX = 32
)

Variables

This section is empty.

Functions

func CreateProcess 

func CreateProcess(shellcode []byte, pid int) error

func CreateRemoteThread 

func CreateRemoteThread(shellcode []byte, pid int) error

func EnumSystemLocales 

func EnumSystemLocales(shellcode []byte) error

func EnumSystemLocalesHalos 

func EnumSystemLocalesHalos(shellcode []byte) error

func EtwpCreateEtwThread 

func EtwpCreateEtwThread(shellcode []byte) error

func Fibers 

func Fibers(shellcode []byte) error

func NoRWX 

func NoRWX(shellcode []byte) error

func NtCreateThreadEx 

func NtCreateThreadEx(shellcode []byte, pid int) error

func NtCreateThreadExHalos 

func NtCreateThreadExHalos(shellcode []byte) error

func NtQueueApcThreadEx 

func NtQueueApcThreadEx(shellcode []byte) error

func ProcessHollowing 

func ProcessHollowing(shellcode []byte, proc string, blockdlls bool) error

func QueueUserApc 

func QueueUserApc(shellcode []byte) error

func RtlCreateUserThread 

func RtlCreateUserThread(shellcode []byte, pid int) error

func UuidFromString 

func UuidFromString(shellcode []byte) error

Types

type CLIENT_ID 

type CLIENT_ID struct {
	UniqueProcess uintptr
	UniqueThread  uintptr
}

type IMAGE_DATA_DIRECTORY 

type IMAGE_DATA_DIRECTORY struct {
	VirtualAddress uint32
	Size           uint32
}

type IMAGE_DOS_HEADER 

type IMAGE_DOS_HEADER struct {
	E_lfanew uint32
}

type IMAGE_FILE_HEADER 

type IMAGE_FILE_HEADER struct {
	Machine              uint16
	NumberOfSections     uint16
	TimeDateStamp        uint32
	PointerToSymbolTable uint32
	NumberOfSymbols      uint32
	SizeOfOptionalHeader uint16
	Characteristics      uint16
}

type IMAGE_NT_HEADER 

type IMAGE_NT_HEADER struct {
	Signature      uint32
	FileHeader     IMAGE_FILE_HEADER
	OptionalHeader IMAGE_OPTIONAL_HEADER
}

type IMAGE_OPTIONAL_HEADER 

type IMAGE_OPTIONAL_HEADER struct {
	Magic                       uint16
	MajorLinkerVersion          uint8
	MinorLinkerVersion          uint8
	SizeOfCode                  uint32
	SizeOfInitializedData       uint32
	SizeOfUninitializedData     uint32
	AddressOfEntryPoint         uint32
	BaseOfCode                  uint32
	ImageBase                   uint64
	SectionAlignment            uint32
	FileAlignment               uint32
	MajorOperatingSystemVersion uint16
	MinorOperatingSystemVersion uint16
	MajorImageVersion           uint16
	MinorImageVersion           uint16
	MajorSubsystemVersion       uint16
	MinorSubsystemVersion       uint16
	Win32VersionValue           uint32
	SizeOfImage                 uint32
	SizeOfHeaders               uint32
	CheckSum                    uint32
	Subsystem                   uint16
	DllCharacteristics          uint16
	SizeOfStackReserve          uint64
	SizeOfStackCommit           uint64
	SizeOfHeapReserve           uint64
	SizeOfHeapCommit            uint64
	LoaderFlags                 uint32
	NumberOfRvaAndSizes         uint32
	DataDirectory               [16]IMAGE_DATA_DIRECTORY
}

type IMAGE_OPTIONAL_HEADER32 

type IMAGE_OPTIONAL_HEADER32 struct {
	Magic                       uint16
	MajorLinkerVersion          byte
	MinorLinkerVersion          byte
	SizeOfCode                  uint32
	SizeOfInitializedData       uint32
	SizeOfUninitializedData     uint32
	AddressOfEntryPoint         uint32
	BaseOfCode                  uint32
	BaseOfData                  uint32 // Different from 64 bit header
	ImageBase                   uint64
	SectionAlignment            uint32
	FileAlignment               uint32
	MajorOperatingSystemVersion uint16
	MinorOperatingSystemVersion uint16
	MajorImageVersion           uint16
	MinorImageVersion           uint16
	MajorSubsystemVersion       uint16
	MinorSubsystemVersion       uint16
	Win32VersionValue           uint32
	SizeOfImage                 uint32
	SizeOfHeaders               uint32
	CheckSum                    uint32
	Subsystem                   uint16
	DllCharacteristics          uint16
	SizeOfStackReserve          uint64
	SizeOfStackCommit           uint64
	SizeOfHeapReserve           uint64
	SizeOfHeapCommit            uint64
	LoaderFlags                 uint32
	NumberOfRvaAndSizes         uint32
	DataDirectory               uintptr
}

type IMAGE_OPTIONAL_HEADER64 

type IMAGE_OPTIONAL_HEADER64 IMAGE_OPTIONAL_HEADER

type PEB 

type PEB struct {
	InheritedAddressSpace    byte // BYTE	0
	ReadImageFileExecOptions byte // BYTE	1
	BeingDebugged            byte // BYTE	2

	Mutant            uintptr // BYTE 4
	ImageBaseAddress  uintptr // BYTE 8
	Ldr               uintptr // PPEB_LDR_DATA
	ProcessParameters uintptr // PRTL_USER_PROCESS_PARAMETERS

	AtlThunkSListPtr uintptr // PVOID

	AtlThunkSListPtr32 uint32 // ULONG

	PostProcessInitRoutine uintptr // PPS_POST_PROCESS_INIT_ROUTINE

	SessionId uint32 // ULONG
	// contains filtered or unexported fields
}

type PROCESS_BASIC_INFORMATION 

type PROCESS_BASIC_INFORMATION struct {
	PebBaseAddress uintptr // PPEB

	UniqueProcessId              uintptr // ULONG_PTR
	InheritedFromUniqueProcessID uintptr // PVOID
	// contains filtered or unexported fields
}

https://github.com/elastic/go-windows/blob/master/ntdll.go#L77

type PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY 

type PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY struct {
	Flags uint32
}

type PROC_THREAD_ATTRIBUTE_ENTRY 

type PROC_THREAD_ATTRIBUTE_ENTRY struct {
	// contains filtered or unexported fields
}

type PROC_THREAD_ATTRIBUTE_LIST 

type PROC_THREAD_ATTRIBUTE_LIST struct {
	// contains filtered or unexported fields
}

type PTHREAD_BASIC_INFORMATION 

type PTHREAD_BASIC_INFORMATION struct {
	AffinityMask uintptr
	Priority     int
	BasePriority int
	// contains filtered or unexported fields
}

type ProcessInformation 

type ProcessInformation struct {
	Process   uintptr
	Thread    uintptr
	ProcessId uint32
	ThreadId  uint32
}

type SC_SERVICE_TAG_QUERY 

type SC_SERVICE_TAG_QUERY struct {
	// contains filtered or unexported fields
}

type StartupInfoEx 

type StartupInfoEx struct {
	windows.StartupInfo
	AttributeList *PROC_THREAD_ATTRIBUTE_LIST
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.