vxaboveground/overlord
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

add more debug info

Browse Source
This commit is contained in:
KingKDot
2026-05-21 20:30:00 -05:00
parent 6e57f2ec1f
commit 0959c90e46
1 changed files with 158 additions and 129 deletions
Download Patch File Download Diff File Expand all files Collapse all files
HVNCInjection/src/NtApiHooks.c
+158 -129
View File
@@ -91,23 +91,15 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
#endif #endif
} }
// Helper function for case-insensitive wide string comparison // Helper function for case-insensitive wide string comparison.
// Uses CompareStringOrdinal so Cyrillic, Greek, and other non-ASCII
// characters are properly case-folded (fixing crashes on Russian/Chinese
// Windows where the ASCII-only approach produced false mismatches).
int wcsnicmp_custom(const WCHAR* s1, const WCHAR* s2, SIZE_T count) { int wcsnicmp_custom(const WCHAR* s1, const WCHAR* s2, SIZE_T count) {
for (SIZE_T i = 0; i < count; i++) { if (count == 0) return 0;
WCHAR c1 = s1[i]; int result = CompareStringOrdinal(s1, (int)count, s2, (int)count, TRUE);
WCHAR c2 = s2[i]; if (result == CSTR_EQUAL) return 0;
return (result == CSTR_LESS_THAN) ? -1 : 1;
// Convert to uppercase for comparison
if (c1 >= L'a' && c1 <= L'z') c1 = c1 - L'a' + L'A';
if (c2 >= L'a' && c2 <= L'z') c2 = c2 - L'a' + L'A';
// Also handle backslash vs forward slash
if (c1 == L'/') c1 = L'\\';
if (c2 == L'/') c2 = L'\\';
if (c1 != c2) return (c1 < c2) ? -1 : 1;
}
return 0;
} }
// Helper function to normalize NT paths - skip \??\ prefix if present // Helper function to normalize NT paths - skip \??\ prefix if present
@@ -450,42 +442,47 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
if (!OriginalNtCreateFile) return 0xC0000001L; // STATUS_UNSUCCESSFUL if (!OriginalNtCreateFile) return 0xC0000001L; // STATUS_UNSUCCESSFUL
// Only attempt redirection if hooks are properly initialized and we have the original function __try {
if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) { if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) {
SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR); SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR);
// Log all paths for debugging if (g_LogFile != INVALID_HANDLE_VALUE && pathLength > 0) {
if (g_LogFile != INVALID_HANDLE_VALUE && pathLength > 0) { WCHAR tempPath[512] = { 0 };
WCHAR tempPath[512] = { 0 }; SIZE_T copyLen = pathLength < 511 ? pathLength : 511;
SIZE_T copyLen = pathLength < 511 ? pathLength : 511; wcsncpy_s(tempPath, 512, ObjectAttributes->ObjectName->Buffer, copyLen);
wcsncpy_s(tempPath, 512, ObjectAttributes->ObjectName->Buffer, copyLen); LogDebug(L"");
LogDebug(L""); LogDebug(L"[NtCreateFile] Original Path: ");
LogDebug(L"[NtCreateFile] Original Path: "); LogDebug(tempPath);
LogDebug(tempPath);
}
if (NeedsRedirection(ObjectAttributes->ObjectName->Buffer, pathLength)) {
SIZE_T newLength = 0;
buffer = ReplacePath(ObjectAttributes->ObjectName->Buffer, pathLength, &newLength);
if (buffer) {
WCHAR tempBuf[512] = { 0 };
SIZE_T copyLen = newLength < 511 ? newLength : 511;
wcsncpy_s(tempBuf, 512, buffer, copyLen);
LogDebug(L"[NtCreateFile] *** REDIRECTING TO: ");
LogDebug(tempBuf);
originalString = ObjectAttributes->ObjectName;
newString.Buffer = buffer;
newString.Length = (USHORT)(newLength * sizeof(WCHAR));
newString.MaximumLength = (USHORT)((newLength + 1) * sizeof(WCHAR));
ObjectAttributes->ObjectName = &newString;
} }
else {
LogDebug(L"[NtCreateFile] ReplacePath returned NULL"); if (NeedsRedirection(ObjectAttributes->ObjectName->Buffer, pathLength)) {
SIZE_T newLength = 0;
buffer = ReplacePath(ObjectAttributes->ObjectName->Buffer, pathLength, &newLength);
if (buffer) {
WCHAR tempBuf[512] = { 0 };
SIZE_T copyLen = newLength < 511 ? newLength : 511;
wcsncpy_s(tempBuf, 512, buffer, copyLen);
LogDebug(L"[NtCreateFile] *** REDIRECTING TO: ");
LogDebug(tempBuf);
originalString = ObjectAttributes->ObjectName;
newString.Buffer = buffer;
newString.Length = (USHORT)(newLength * sizeof(WCHAR));
newString.MaximumLength = (USHORT)((newLength + 1) * sizeof(WCHAR));
ObjectAttributes->ObjectName = &newString;
}
else {
LogDebug(L"[NtCreateFile] ReplacePath returned NULL");
}
} }
} }
} }
__except (EXCEPTION_EXECUTE_HANDLER) {
char _excMsg[64]; sprintf_s(_excMsg, 64, "[HOOK] NtCreateFile exception: 0x%X", GetExceptionCode()); CrashLog(_excMsg);
if (originalString) { ObjectAttributes->ObjectName = originalString; originalString = NULL; }
if (buffer) { HeapFree(GetProcessHeap(), 0, buffer); buffer = NULL; }
}
NTSTATUS result = OriginalNtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, NTSTATUS result = OriginalNtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock,
AllocationSize, FileAttributes, ShareAccess, CreateDisposition, AllocationSize, FileAttributes, ShareAccess, CreateDisposition,
@@ -513,41 +510,47 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
UNICODE_STRING newString = { 0 }; UNICODE_STRING newString = { 0 };
WCHAR* buffer = NULL; WCHAR* buffer = NULL;
if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) { __try {
SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR); if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) {
SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR);
// Log all paths for debugging if (g_LogFile != INVALID_HANDLE_VALUE && pathLength > 0) {
if (g_LogFile != INVALID_HANDLE_VALUE && pathLength > 0) { WCHAR tempPath[512] = { 0 };
WCHAR tempPath[512] = { 0 }; SIZE_T copyLen = pathLength < 511 ? pathLength : 511;
SIZE_T copyLen = pathLength < 511 ? pathLength : 511; wcsncpy_s(tempPath, 512, ObjectAttributes->ObjectName->Buffer, copyLen);
wcsncpy_s(tempPath, 512, ObjectAttributes->ObjectName->Buffer, copyLen); LogDebug(L"");
LogDebug(L""); LogDebug(L"[NtOpenFile] Original Path: ");
LogDebug(L"[NtOpenFile] Original Path: "); LogDebug(tempPath);
LogDebug(tempPath);
}
if (NeedsRedirection(ObjectAttributes->ObjectName->Buffer, pathLength)) {
SIZE_T newLength = 0;
buffer = ReplacePath(ObjectAttributes->ObjectName->Buffer, pathLength, &newLength);
if (buffer) {
WCHAR tempBuf[512] = { 0 };
SIZE_T copyLen = newLength < 511 ? newLength : 511;
wcsncpy_s(tempBuf, 512, buffer, copyLen);
LogDebug(L"[NtOpenFile] *** REDIRECTING TO: ");
LogDebug(tempBuf);
originalString = ObjectAttributes->ObjectName;
newString.Buffer = buffer;
newString.Length = (USHORT)(newLength * sizeof(WCHAR));
newString.MaximumLength = (USHORT)((newLength + 1) * sizeof(WCHAR));
ObjectAttributes->ObjectName = &newString;
} }
else {
LogDebug(L"[NtOpenFile] ReplacePath returned NULL"); if (NeedsRedirection(ObjectAttributes->ObjectName->Buffer, pathLength)) {
SIZE_T newLength = 0;
buffer = ReplacePath(ObjectAttributes->ObjectName->Buffer, pathLength, &newLength);
if (buffer) {
WCHAR tempBuf[512] = { 0 };
SIZE_T copyLen = newLength < 511 ? newLength : 511;
wcsncpy_s(tempBuf, 512, buffer, copyLen);
LogDebug(L"[NtOpenFile] *** REDIRECTING TO: ");
LogDebug(tempBuf);
originalString = ObjectAttributes->ObjectName;
newString.Buffer = buffer;
newString.Length = (USHORT)(newLength * sizeof(WCHAR));
newString.MaximumLength = (USHORT)((newLength + 1) * sizeof(WCHAR));
ObjectAttributes->ObjectName = &newString;
}
else {
LogDebug(L"[NtOpenFile] ReplacePath returned NULL");
}
} }
} }
} }
__except (EXCEPTION_EXECUTE_HANDLER) {
char _excMsg[64]; sprintf_s(_excMsg, 64, "[HOOK] NtOpenFile exception: 0x%X", GetExceptionCode()); CrashLog(_excMsg);
if (originalString) { ObjectAttributes->ObjectName = originalString; originalString = NULL; }
if (buffer) { HeapFree(GetProcessHeap(), 0, buffer); buffer = NULL; }
}
NTSTATUS result = OriginalNtOpenFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, ShareAccess, OpenOptions); NTSTATUS result = OriginalNtOpenFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, ShareAccess, OpenOptions);
@@ -566,22 +569,29 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
UNICODE_STRING newString = { 0 }; UNICODE_STRING newString = { 0 };
WCHAR* buffer = NULL; WCHAR* buffer = NULL;
if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) { __try {
SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR); if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) {
SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR);
if (NeedsRedirection(ObjectAttributes->ObjectName->Buffer, pathLength)) { if (NeedsRedirection(ObjectAttributes->ObjectName->Buffer, pathLength)) {
SIZE_T newLength = 0; SIZE_T newLength = 0;
buffer = ReplacePath(ObjectAttributes->ObjectName->Buffer, pathLength, &newLength); buffer = ReplacePath(ObjectAttributes->ObjectName->Buffer, pathLength, &newLength);
if (buffer) { if (buffer) {
originalString = ObjectAttributes->ObjectName; originalString = ObjectAttributes->ObjectName;
newString.Buffer = buffer; newString.Buffer = buffer;
newString.Length = (USHORT)(newLength * sizeof(WCHAR)); newString.Length = (USHORT)(newLength * sizeof(WCHAR));
newString.MaximumLength = (USHORT)((newLength + 1) * sizeof(WCHAR)); newString.MaximumLength = (USHORT)((newLength + 1) * sizeof(WCHAR));
ObjectAttributes->ObjectName = &newString; ObjectAttributes->ObjectName = &newString;
}
} }
} }
} }
__except (EXCEPTION_EXECUTE_HANDLER) {
char _excMsg[64]; sprintf_s(_excMsg, 64, "[HOOK] NtDeleteFile exception: 0x%X", GetExceptionCode()); CrashLog(_excMsg);
if (originalString) { ObjectAttributes->ObjectName = originalString; originalString = NULL; }
if (buffer) { HeapFree(GetProcessHeap(), 0, buffer); buffer = NULL; }
}
NTSTATUS result = OriginalNtDeleteFile(ObjectAttributes); NTSTATUS result = OriginalNtDeleteFile(ObjectAttributes);
@@ -609,36 +619,41 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
WCHAR FileName[1]; WCHAR FileName[1];
} FILE_RENAME_INFO; } FILE_RENAME_INFO;
if (g_HooksInitialized && FileInformation && (FileInformationClass == FileRenameInformation || FileInformationClass == FileRenameInformationEx)) { __try {
FILE_RENAME_INFO* renameInfo = (FILE_RENAME_INFO*)FileInformation; if (g_HooksInitialized && FileInformation && (FileInformationClass == FileRenameInformation || FileInformationClass == FileRenameInformationEx)) {
if (renameInfo->FileNameLength > 0) { FILE_RENAME_INFO* renameInfo = (FILE_RENAME_INFO*)FileInformation;
SIZE_T pathLength = renameInfo->FileNameLength / sizeof(WCHAR); if (renameInfo->FileNameLength > 0) {
SIZE_T pathLength = renameInfo->FileNameLength / sizeof(WCHAR);
if (NeedsRedirection(renameInfo->FileName, pathLength)) { if (NeedsRedirection(renameInfo->FileName, pathLength)) {
SIZE_T newLength = 0; SIZE_T newLength = 0;
WCHAR* newPath = ReplacePath(renameInfo->FileName, pathLength, &newLength); WCHAR* newPath = ReplacePath(renameInfo->FileName, pathLength, &newLength);
if (newPath) { if (newPath) {
ULONG newInfoSize = sizeof(FILE_RENAME_INFO) - sizeof(WCHAR) + (newLength * sizeof(WCHAR)); ULONG newInfoSize = sizeof(FILE_RENAME_INFO) - sizeof(WCHAR) + (newLength * sizeof(WCHAR));
FILE_RENAME_INFO* newRenameInfo = (FILE_RENAME_INFO*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, newInfoSize); FILE_RENAME_INFO* newRenameInfo = (FILE_RENAME_INFO*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, newInfoSize);
if (newRenameInfo) { if (newRenameInfo) {
newRenameInfo->ReplaceIfExists = renameInfo->ReplaceIfExists; newRenameInfo->ReplaceIfExists = renameInfo->ReplaceIfExists;
newRenameInfo->RootDirectory = renameInfo->RootDirectory; newRenameInfo->RootDirectory = renameInfo->RootDirectory;
newRenameInfo->FileNameLength = (ULONG)(newLength * sizeof(WCHAR)); newRenameInfo->FileNameLength = (ULONG)(newLength * sizeof(WCHAR));
memcpy(newRenameInfo->FileName, newPath, newRenameInfo->FileNameLength); memcpy(newRenameInfo->FileName, newPath, newRenameInfo->FileNameLength);
NTSTATUS result = OriginalNtSetInformationFile(FileHandle, IoStatusBlock, newRenameInfo, newInfoSize, FileInformationClass); NTSTATUS result = OriginalNtSetInformationFile(FileHandle, IoStatusBlock, newRenameInfo, newInfoSize, FileInformationClass);
HeapFree(GetProcessHeap(), 0, newRenameInfo); HeapFree(GetProcessHeap(), 0, newRenameInfo);
HeapFree(GetProcessHeap(), 0, newPath);
return result;
}
HeapFree(GetProcessHeap(), 0, newPath); HeapFree(GetProcessHeap(), 0, newPath);
return result;
} }
HeapFree(GetProcessHeap(), 0, newPath);
} }
} }
} }
} }
__except (EXCEPTION_EXECUTE_HANDLER) {
char _excMsg[64]; sprintf_s(_excMsg, 64, "[HOOK] NtSetInfoFile exception: 0x%X", GetExceptionCode()); CrashLog(_excMsg);
}
return OriginalNtSetInformationFile(FileHandle, IoStatusBlock, FileInformation, Length, FileInformationClass); return OriginalNtSetInformationFile(FileHandle, IoStatusBlock, FileInformation, Length, FileInformationClass);
} }
@@ -653,22 +668,29 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
UNICODE_STRING newString = { 0 }; UNICODE_STRING newString = { 0 };
WCHAR* buffer = NULL; WCHAR* buffer = NULL;
if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) { __try {
SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR); if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) {
SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR);
if (NeedsRedirection(ObjectAttributes->ObjectName->Buffer, pathLength)) { if (NeedsRedirection(ObjectAttributes->ObjectName->Buffer, pathLength)) {
SIZE_T newLength = 0; SIZE_T newLength = 0;
buffer = ReplacePath(ObjectAttributes->ObjectName->Buffer, pathLength, &newLength); buffer = ReplacePath(ObjectAttributes->ObjectName->Buffer, pathLength, &newLength);
if (buffer) { if (buffer) {
originalString = ObjectAttributes->ObjectName; originalString = ObjectAttributes->ObjectName;
newString.Buffer = buffer; newString.Buffer = buffer;
newString.Length = (USHORT)(newLength * sizeof(WCHAR)); newString.Length = (USHORT)(newLength * sizeof(WCHAR));
newString.MaximumLength = (USHORT)((newLength + 1) * sizeof(WCHAR)); newString.MaximumLength = (USHORT)((newLength + 1) * sizeof(WCHAR));
ObjectAttributes->ObjectName = &newString; ObjectAttributes->ObjectName = &newString;
}
} }
} }
} }
__except (EXCEPTION_EXECUTE_HANDLER) {
char _excMsg[64]; sprintf_s(_excMsg, 64, "[HOOK] NtQueryAttribs exception: 0x%X", GetExceptionCode()); CrashLog(_excMsg);
if (originalString) { ObjectAttributes->ObjectName = originalString; originalString = NULL; }
if (buffer) { HeapFree(GetProcessHeap(), 0, buffer); buffer = NULL; }
}
NTSTATUS result = OriginalNtQueryAttributesFile(ObjectAttributes, FileInformation); NTSTATUS result = OriginalNtQueryAttributesFile(ObjectAttributes, FileInformation);
@@ -690,22 +712,29 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
UNICODE_STRING newString = { 0 }; UNICODE_STRING newString = { 0 };
WCHAR* buffer = NULL; WCHAR* buffer = NULL;
if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) { __try {
SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR); if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) {
SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR);
if (NeedsRedirection(ObjectAttributes->ObjectName->Buffer, pathLength)) { if (NeedsRedirection(ObjectAttributes->ObjectName->Buffer, pathLength)) {
SIZE_T newLength = 0; SIZE_T newLength = 0;
buffer = ReplacePath(ObjectAttributes->ObjectName->Buffer, pathLength, &newLength); buffer = ReplacePath(ObjectAttributes->ObjectName->Buffer, pathLength, &newLength);
if (buffer) { if (buffer) {
originalString = ObjectAttributes->ObjectName; originalString = ObjectAttributes->ObjectName;
newString.Buffer = buffer; newString.Buffer = buffer;
newString.Length = (USHORT)(newLength * sizeof(WCHAR)); newString.Length = (USHORT)(newLength * sizeof(WCHAR));
newString.MaximumLength = (USHORT)((newLength + 1) * sizeof(WCHAR)); newString.MaximumLength = (USHORT)((newLength + 1) * sizeof(WCHAR));
ObjectAttributes->ObjectName = &newString; ObjectAttributes->ObjectName = &newString;
}
} }
} }
} }
__except (EXCEPTION_EXECUTE_HANDLER) {
char _excMsg[64]; sprintf_s(_excMsg, 64, "[HOOK] NtQueryFullAttribs exception: 0x%X", GetExceptionCode()); CrashLog(_excMsg);
if (originalString) { ObjectAttributes->ObjectName = originalString; originalString = NULL; }
if (buffer) { HeapFree(GetProcessHeap(), 0, buffer); buffer = NULL; }
}
NTSTATUS result = OriginalNtQueryFullAttributesFile(ObjectAttributes, FileInformation); NTSTATUS result = OriginalNtQueryFullAttributesFile(ObjectAttributes, FileInformation);