let h_event = unsafe { CreateEventW(null_mut(), 0, 0, null_mut()) };
40
+
let h_event = unsafe { CreateEventW(null(), 0, 0, null()) };
37
41
log::info!("[+] h_event: {:#x}", h_event);
38
42
43
+
if h_event == INVALID_HANDLE_VALUE {
44
+
panic!("[!] CreateEventW failed with error: {}", unsafe {
45
+
GetLastError()
46
+
});
47
+
}
48
+
39
49
// Creates a queue for timers. Timer-queue timers are lightweight objects that enable you to specify a callback function to be called at a specified time.
panic!("[!] CreateTimerQueue failed with error: {}", unsafe {
56
+
GetLastError()
57
+
});
58
+
}
59
+
44
60
let nt_continue = unsafe {
45
61
GetProcAddress(
46
62
GetModuleHandleA("ntdll.dll\0".as_ptr()),
47
63
"NtContinue\0".as_ptr(),
48
64
)
49
65
};
66
+
67
+
if nt_continue.is_none() {
68
+
panic!("[!] NtContinue not found");
69
+
}
70
+
71
+
log::info!("[+] NtContinue: {:#x}", nt_continue.unwrap() as u64);
72
+
50
73
let sys_func032 = unsafe {
51
74
GetProcAddress(
52
75
LoadLibraryA("cryptsp.dll\0".as_ptr()),
53
76
"SystemFunction032\0".as_ptr(),
54
77
)
55
78
};
79
+
80
+
if sys_func032.is_none() {
81
+
panic!("[!] SystemFunction032 not found");
82
+
}
83
+
84
+
log::info!("[+] SystemFunction032: {:#x}", sys_func032.unwrap() as u64);
85
+
56
86
let rtlcont = unsafe {
57
87
GetProcAddress(
58
88
GetModuleHandleA("ntdll.dll\0".as_ptr()),
skipped 1 lines
60
90
)
61
91
};
62
92
93
+
if rtlcont.is_none() {
94
+
panic!("[!] RtlCaptureContext not found");
95
+
}
96
+
97
+
log::info!("[+] RtlCaptureContext: {:#x}", rtlcont.unwrap() as u64);
98
+
63
99
let image_base = unsafe { GetModuleHandleA(null_mut()) };
64
100
let dos_header = image_base as *mut IMAGE_DOS_HEADER;
65
-
let nt_headesr =
101
+
let nt_headers =
66
102
unsafe { (dos_header as u64 + (*dos_header).e_lfanew as u64) as *mut IMAGE_NT_HEADERS64 };
67
-
let image_size = unsafe { (*nt_headesr).OptionalHeader.SizeOfImage };
103
+
let image_size = unsafe { (*nt_headers).OptionalHeader.SizeOfImage };
68
104
69
105
log::info!("[+] Image Base: {:#x}", image_base as u64);
70
106
log::info!("[+] Image Size: {:#x}", image_size as u64);
71
-
log::info!("[+] NtContinue: {:#x}", nt_continue.unwrap() as u64);
72
-
log::info!("[+] SystemFunction032: {:#x}", sys_func032.unwrap() as u64);
73
-
log::info!("[+] RtlCaptureContext: {:#x}", rtlcont.unwrap() as u64);
74
107
75
108
key.Buffer = key_buf.as_mut_ptr() as *mut u16;
76
109
key.Length = key_buf.len() as u16; // 16
skipped 2 lines
79
112
img.Buffer = image_base as *mut u16;
80
113
img.Length = image_size as u16;
81
114
img.MaximumLength = image_size as u16;
115
+
pause();
82
116
83
117
log::info!("[+] Calling CreateTimerQueueTimer with ctx_thread");
84
118
// Creates a timer-queue timer. This timer expires at the specified due time, then after every specified period. When the timer expires, the callback function is called.
