FilesExpand file tree

 master

/

main.cpp

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

139 lines (114 loc) · 3.32 KB

 master

/

main.cpp

Copy path

Top

File metadata and controls

• Code
• Blame

139 lines (114 loc) · 3.32 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

#include <highcall.h>

#pragma comment(lib, "highcall.lib")

#include <stdio.h>

#include <stdlib.h>

#include <conio.h>

#define _CRTDBG_MAP_ALLOC

#include <stdlib.h>

#include <crtdbg.h>

int main()

{

NTSTATUS StartupStatus = HcInitialize();

LPWSTR lpUniqueId = HcUniqueHardwareId();

if (!NT_SUCCESS(StartupStatus))

{

printf("Failed startup. Reason: 0x%x\n", StartupStatus);

goto done;

}

else

{

printf("Startup successful, Administrator [%s], Hardware Id [%ws]\n", (HcGlobal.IsElevated ? "TRUE" : "FALSE"), lpUniqueId);

}

INPUT ip;

ip.type = INPUT_KEYBOARD;

ip.ki.wScan = 0;

ip.ki.time = 0;

ip.ki.dwExtraInfo = 0;

ip.ki.wVk = 0x41;

ip.ki.dwFlags = 0;

HcSleep(5000);

HcUserSendInput(1, &ip, sizeof(INPUT)); // down

ip.ki.dwFlags = KEYEVENTF_KEYUP;

HcUserSendInput(1, &ip, sizeof(INPUT)); // release

PEB peb;

if (!HcProcessGetPeb(NtCurrentProcess(), &peb))

{

printf("Failed retrieving PEB from self process, reason: 0x%x\n", HcErrorGetLastStatus());

}

else

{

printf("PEB.BeingDebugged [%d], PEB.ImageBaseAddress [%p], PEB.IsProtectedProcess [%d]\n", (ULONG) peb.BeingDebugged, peb.ImageBaseAddress, peb.IsProtectedProcess);

}

printf("Setting debugger trap.\n");

if (HcScanCheckDebuggerBasic(TRUE) == STATUS_DEBUGGER_ATTACHED)

{

printf("Pressing a key will make the program continue, because you are using a debugger, it will likely crash if you try to step the program.\n");

_getch();

}

NTSTATUS TrapStatus = HcScanApplyDebuggerMines();

if (!NT_SUCCESS(TrapStatus))

{

printf("Failed setting debugger trap. 0x%x\n", TrapStatus);

}

else

{

printf("Debugger trap set.\n");

}

printf("Scanning for debugger.\n");

NTSTATUS ScanStatus = HcScanCheckDebuggerBasic(TRUE);

if (ScanStatus == STATUS_FAIL_CHECK)

{

printf("Procedure failed with last status: 0x%x\n", HcErrorGetLastStatus());

}

else if (ScanStatus == STATUS_DEBUGGER_ATTACHED)

{

printf("Debugger detected.\n");

}

else

{

printf("No debugger detected! Hurray.\n");

}

while (true)

{

printf("Please enter the name of a x86_64 process with it's extension. Example: svchost.exe\n");

PROCESS_INFORMATION_W process;

HcInternalSet(&process, 0, sizeof(process));

char* processName = HcStringAllocA(256);

gets_s(processName, 255);

processName[256] = 0;

wchar_t* convertedProcessName = HcStringConvertAtoW(processName);

printf("You entered %s, wchar_t*: %ws\n", processName, convertedProcessName);

if (!HcProcessGetByNameW(convertedProcessName, &process))

{

printf("Failed locating %ws\n", convertedProcessName);

}

else

{

printf("Found %ws [%d]\n", convertedProcessName, process.Id);

HANDLE hProcess = HcProcessOpen(process.Id, PROCESS_ALL_ACCESS);

if (!hProcess)

{

printf("Could not open %ws\n", convertedProcessName);

}

else

{

printf("Opened %ws [%p]\n", convertedProcessName, hProcess);

PEB64 peb64;

if (!HcProcessGetPeb64(hProcess, &peb64))

{

printf("Failed retrieving PEB64 from %ws, reason: 0x%x\n", convertedProcessName, HcErrorGetLastStatus());

}

else

{

printf("PEB64.BeingDebugged [%d], PEB64.ImageBaseAddress [0x%llx], PEB64.IsProtectedProcess [%d]\n", (ULONG) peb64.BeingDebugged, peb64.ImageBaseAddress, peb.IsProtectedProcess);

}

}

}

HcFree(processName);

HcFree(convertedProcessName);

}

done:

_CrtDumpMemoryLeaks();

_getch();

return 0;

}