crummie5 / freshycalls Goto Github PK

FreshyCalls tries to make the use of syscalls comfortable and simple, without generating too much boilerplate and in modern C++17!

License: Mozilla Public License 2.0

C++ 100.00%

syscalls windows

freshycalls's Introduction

FreshyCalls: Syscalls Freshly Squeezed!

This library was made for academic purposes only. The authors are not responsible for what is given to this library and therefore we are exempt from any liability arising from the misuse of it.

Uses C++17 x64 ONLY

FreshyCalls tries to make the use of syscalls comfortable and simple, without generating too much boilerplate and in modern C++! Doesn't it bother you to have to define every syscall stub or function within a module? Or having to depend on the Windows version for the syscalls? Well, forget about all that. FreshyCalls makes use of some features implemented from C++11 such as the variadic templates along with some custom mini-shellcode to avoid this.

This library is the product of having been playing around with syscalls for a few months. For example, the extraction of numbers was a fluke discovery while we were investigating how the syscalls worked. We saw that there was some sort of relationship between the number and the address of the stub. And the masked stub was just an idea after researching about InstrumentationCallback - great work by Ionescu, more info here - and seeing how ScyllaHide did it.

We realized that they were detecting manual syscalls by checking the return address so we thought AV/EDR solutions might were doing the same hence we implemented it. Of course this can be "good" and "bad" at the same time, you avoid them to know that it is a manual syscall - at least with the InstrumentationCallback method - but you make it easier for them to detect which syscall is executed.

CallSyscall/DirectCallSyscall returns a struct that represents the result of the call, FunctionResult. This will facilitate error handling. Note that the rest of functions do internal error handlings and might generate exceptions. For instance, a piece of code from the PoC:

syscall.CallSyscall("NtOpenProcessToken", HANDLE(-1), TOKEN_ADJUST_PRIVILEGES, &token_handle)
      .OrDie("[ActiveSeDebug] An error happened while opening the current process token: \"{{result_msg}}\" (Error Code: {{result_as_hex}})");

Be aware we have released this library "for fun" and it is by no means perfect. You should expect some bugs.

You can find an example of how to use it here and a post explaining it a little more here

freshycalls's People

Contributors

Stargazers

Watchers

freshycalls's Issues

NtWriteVirtualMemory Partial copied issue

I resolved sry...

NtCreateThreadEx Not Working with Error Code 0xc0000005

Enviroment:
OS Name: Microsoft Windows 11 Home
OS Version: 10.0.22000 N/A Build 22000
Toolchain: Visual Studio 2019 MSVC with c++20 standard and x64 MT runtime

It's not working with following code to invoke NtCreateThreadEx .
But it works fine With HellsGate technique.
I want to learn deeply here Why it doesn't work just like HellsGate.

int FreshyCall(void *buffer, size_t size) {
	using namespace  std;
	NTSTATUS status = 0x00000000;

	// buffer is some sort of  shellcode complied by nasm with x64 bin mode , which will pop up a messagebox.
        // Its size is around  400 Bytes.
        // size is the size of  buffer.
	// char buffer [] = "\x90\x90\x90\x90\xcc\xcc\xcc\xcc\xc3 .... ";

	// Allocate memory for the shellcode
	PVOID lpAddress = NULL;
	size_t sDataSize = size;


	HANDLE ProcessHandle = (HANDLE)-1 ;
	//HANDLE ProcessHandle = GetCurrentProcess();


	try {

		auto &syscall = freshycalls::Syscall::get_instance();
		syscall
			.CallSyscall("NtAllocateVirtualMemory", ProcessHandle, &lpAddress,
						 0,
						 &sDataSize, MEM_COMMIT, PAGE_READWRITE)
			.OrDie("[NtAllocateVirtualMemory] Error:"
				   "Msg: \"{{result_msg}}\" (Error Code: "
				   "{{result_as_hex}})");

		VxMoveMemory(lpAddress, buffer, size);

		ULONG ulOldProtect = 0;
		syscall
			.CallSyscall("NtProtectVirtualMemory", ProcessHandle, &lpAddress,
						 &sDataSize, PAGE_EXECUTE_READ, &ulOldProtect)
			.OrDie("[NtProtectVirtualMemory] Error:"
				   "Msg: \"{{result_msg}}\" (Error Code: "
				   "{{result_as_hex}})");




                 //it works fine here to invoke the shellcode in place
                 // using func_t = void(*)();
		// auto func = (func_t)(lpAddress);
      
		// func(); 
		HANDLE hHostThread = INVALID_HANDLE_VALUE;

		
	
		syscall
			.CallSyscall("NtCreateThreadEx", &hHostThread, THREAD_ALL_ACCESS,
						 NULL, ProcessHandle, (LPTHREAD_START_ROUTINE)lpAddress,
						 NULL, FALSE, NULL, NULL, NULL, NULL)
			.OrDie("[NtCreateThreadEx] Error:"
				   "Msg: \"{{result_msg}}\" (Error Code: "
				   "{{result_as_hex}})");

		syscall.CallSyscall("NtWaitForSingleObject", hHostThread, TRUE, NULL)
			.OrDie("[NtWaitForSingleObject] Error:"
				   "Msg: \"{{result_msg}}\" (Error Code: "
				   "{{result_as_hex}})");
	} catch (std::exception &e) {
	
		cout << e.what() << endl;
	        return -1;
	
	}
	return 0;
}

Thanks.

Bridge between C#

Hey @ElephantSe4l & @jarilaos jarilaos , awesome work!

So I'm trying to create a bridge between FreshyCalls to C# using a DLL, I do not have much experience with C++ and was wondering why the following code does not compile:

// C++ 17 64bit
#include <windows.h>
#include <winternl.h>
#include "syscall/syscall.hpp"

static auto& syscall = freshycalls::Syscall::get_instance();

extern "C" __declspec(dllexport)

HANDLE HelloProcess(uint32_t process_id) {
    HANDLE handle{};
    OBJECT_ATTRIBUTES obj{};

    InitializeObjectAttributes(&obj, nullptr, 0, nullptr, nullptr);
    CLIENT_ID client = { reinterpret_cast<HANDLE>(static_cast<DWORD_PTR>(process_id)), nullptr };

    syscall.CallSyscall("NtOpenProcess",
        &handle,
        PROCESS_ALL_ACCESS,
        &obj,
        &client)
        .OrDie("[OpenProcess] An error happened while opening the target process: \"{{result_msg}}\" (Error Code: {{result_as_hex}})");

    return handle;
}

Any advice or help is more than welcome, thank you!

Kind regards,

Fenny

Wrong Syscall number retrieval in WS2012

OS_VERSION: Windows Server 2012 6.2.9200

While enumerating the Service call numbers at ExtractStubs they seem to be offseted by 1.

This is due to NtGetTickCount being stored as the first RVA in 6.2.9200 ntdll.dll and not making use of a syscall nº.

Thus, creating said offset +1:

In recent versions of ntdll.dll this function is, instead, referenced at the end of the EAT.

VirtualWriteMemory Address Issue when greater than 27352

Hey,

I'm trying to use FreshyCalls to do Process Injection and when the size of data I am trying to write with NtWriteVirtualMemory is greater than 27,352 the syscall returns AccessDenied. I've confirmed it allocates enough memory for this to fit (and double checked via ProcesHacker), so am assuming its an issue within the call trampoline and am not sure how to debug it.

Below is code that can be placed in the POC to replicate the issue.

int main(int argc, char *argv[]) {
  HANDLE process_handle;
  HANDLE file_handle;
  //const uint32_t process_id = GetPID(argc, argv);
  PVOID* mem = NULL;

  std::cout << "FreshyCalls' PoC dumper" << std::endl << std::endl;

  try {
    HANDLE hProcess;
    const char* sc = "\xc0\xd3";
    // Used in NtAllocateVirtualMemory
    SIZE_T fSize = ((sizeof(sc) + 780000 + 0x1000 - 1) & ~(0x1000 - 1));
    // Used in NtWriteVirtualMemory, when greater than 27,352 - fails to write
    SIZE_T wtf = 27353;

    std::cout << "[+] Grabbing handle to process...";
    hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION |
      PROCESS_VM_OPERATION | PROCESS_VM_WRITE |
      PROCESS_VM_READ, FALSE, 11368);
    if (hProcess)
        std::cout << " OK!" << std::endl;

    std::cout << "[+] Trying NtAllocateVirtualMemory...";
    syscall.CallSyscall("NtAllocateVirtualMemory", hProcess, &mem, 0, (PULONG)&fSize, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE)
        .OrDie("NtAllocateVirtualMemory: {{result_as_hex}}");
    std::cout << " OK!" << std::endl;
    
    std::cout << "[+] Trying NtWriteVirtualMemory...";

    syscall.CallSyscall("NtWriteVirtualMemory", hProcess, mem, sc, wtf, NULL)
        .OrDie("NtWriteVirtualMemory: {{result_as_hex}}");

    std::cout << " OK!" << std::endl;

  }
  catch (const std::runtime_error &e) {
    std::cerr << std::endl << e.what() << std::endl;
    exit(-1);
  }

  return 0;
}

NtWriteVirtualMemory return STATUS_ACCESS_VIOLATION

NTSTATUS Status;

LPVOID BasePointer = NULL;
SIZE_T BaseSize = 1024;

char Payload[2048];
memset(Payload, 0, 2048);

Status = syscall.CallSyscall("NtAllocateVirtualMemory", NtCurrentProcess,
                            &BasePointer, 0, &BaseSize,
                            MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE)
                            .result;

Status = syscall.CallSyscall("NtWriteVirtualMemory", NtCurrentProcess,
                            BasePointer, Payload, 1024, nullptr)
                            .result;

NtWriteVirtualMemory return code is STATUS_ACCESS_VIOLATION(0xC0000005)
I'm still a beginner, so I don't know why the error occurs and how to debug it...

OS: Windows 11
Arch: x64
Compiler: Visual Studio 2022

NtCreateThreadEx Not Working with Error Code 0xc0000005

Enviroment:
OS Name: Microsoft Windows 11 Home
OS Version: 10.0.22000 N/A Build 22000
Toolchain: Visual Studio 2019 MSVC with c++20 standard and x64 MT runtime

It's not working with following code to invoke NtCreateThreadEx .
But it works fine With HellsGate technique.
I want to learn deeply here Why it doesn't work just like HellsGate.

int FreshyCall(void *buffer, size_t size) {
	using namespace  std;
	NTSTATUS status = 0x00000000;

	// buffer is some sort of  shellcode complied by nasm with x64 bin mode , which will pop up a messagebox.
        // Its size is around  400 Bytes.
        // size is the size of  buffer.
	// char buffer [] = "\x90\x90\x90\x90\xcc\xcc\xcc\xcc\xc3 .... ";

	// Allocate memory for the shellcode
	PVOID lpAddress = NULL;
	size_t sDataSize = size;


	HANDLE ProcessHandle = (HANDLE)-1 ;
	//HANDLE ProcessHandle = GetCurrentProcess();


	try {

		auto &syscall = freshycalls::Syscall::get_instance();
		syscall
			.CallSyscall("NtAllocateVirtualMemory", ProcessHandle, &lpAddress,
						 0,
						 &sDataSize, MEM_COMMIT, PAGE_READWRITE)
			.OrDie("[NtAllocateVirtualMemory] Error:"
				   "Msg: \"{{result_msg}}\" (Error Code: "
				   "{{result_as_hex}})");

		VxMoveMemory(lpAddress, buffer, size);

		ULONG ulOldProtect = 0;
		syscall
			.CallSyscall("NtProtectVirtualMemory", ProcessHandle, &lpAddress,
						 &sDataSize, PAGE_EXECUTE_READ, &ulOldProtect)
			.OrDie("[NtProtectVirtualMemory] Error:"
				   "Msg: \"{{result_msg}}\" (Error Code: "
				   "{{result_as_hex}})");




                 //it works fine here to invoke the shellcode in place
                 // using func_t = void(*)();
		// auto func = (func_t)(lpAddress);
      
		// func(); 
		HANDLE hHostThread = INVALID_HANDLE_VALUE;

		
	
		syscall
			.CallSyscall("NtCreateThreadEx", &hHostThread, THREAD_ALL_ACCESS,
						 NULL, ProcessHandle, (LPTHREAD_START_ROUTINE)lpAddress,
						 NULL, FALSE, NULL, NULL, NULL, NULL)
			.OrDie("[NtCreateThreadEx] Error:"
				   "Msg: \"{{result_msg}}\" (Error Code: "
				   "{{result_as_hex}})");

		syscall.CallSyscall("NtWaitForSingleObject", hHostThread, TRUE, NULL)
			.OrDie("[NtWaitForSingleObject] Error:"
				   "Msg: \"{{result_msg}}\" (Error Code: "
				   "{{result_as_hex}})");
	} catch (std::exception &e) {
	
		cout << e.what() << endl;
	        return -1;
	
	}
	return 0;
}

Thanks.

crummie5 / freshycalls Goto Github PK

freshycalls's Introduction

FreshyCalls: Syscalls Freshly Squeezed!

freshycalls's People

Contributors

Stargazers

Watchers

Forkers

freshycalls's Issues

NtWriteVirtualMemory Partial copied issue

NtCreateThreadEx Not Working with Error Code 0xc0000005

Bridge between C#

Wrong Syscall number retrieval in WS2012

VirtualWriteMemory Address Issue when greater than 27352

NtWriteVirtualMemory return STATUS_ACCESS_VIOLATION

NtCreateThreadEx Not Working with Error Code 0xc0000005

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent