vxaboveground/overlord
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

add more debug info

Browse Source
This commit is contained in:
KingKDot
2026-05-21 20:30:00 -05:00
parent 6e57f2ec1f
commit 0959c90e46
1 changed files with 158 additions and 129 deletions
Download Patch File Download Diff File Expand all files Collapse all files
HVNCInjection/src/NtApiHooks.c
+48 -19
View File
@@ -91,23 +91,15 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
#endif
}
// Helper function for case-insensitive wide string comparison
// Helper function for case-insensitive wide string comparison.
// Uses CompareStringOrdinal so Cyrillic, Greek, and other non-ASCII
// characters are properly case-folded (fixing crashes on Russian/Chinese
// Windows where the ASCII-only approach produced false mismatches).
int wcsnicmp_custom(const WCHAR* s1, const WCHAR* s2, SIZE_T count) {
for (SIZE_T i = 0; i < count; i++) {
WCHAR c1 = s1[i];
WCHAR c2 = s2[i];
// Convert to uppercase for comparison
if (c1 >= L'a' && c1 <= L'z') c1 = c1 - L'a' + L'A';
if (c2 >= L'a' && c2 <= L'z') c2 = c2 - L'a' + L'A';
// Also handle backslash vs forward slash
if (c1 == L'/') c1 = L'\\';
if (c2 == L'/') c2 = L'\\';
if (c1 != c2) return (c1 < c2) ? -1 : 1;
}
return 0;
if (count == 0) return 0;
int result = CompareStringOrdinal(s1, (int)count, s2, (int)count, TRUE);
if (result == CSTR_EQUAL) return 0;
return (result == CSTR_LESS_THAN) ? -1 : 1;
}
// Helper function to normalize NT paths - skip \??\ prefix if present
@@ -450,11 +442,10 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
if (!OriginalNtCreateFile) return 0xC0000001L; // STATUS_UNSUCCESSFUL
// Only attempt redirection if hooks are properly initialized and we have the original function
__try {
if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) {
SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR);
// Log all paths for debugging
if (g_LogFile != INVALID_HANDLE_VALUE && pathLength > 0) {
WCHAR tempPath[512] = { 0 };
SIZE_T copyLen = pathLength < 511 ? pathLength : 511;
@@ -486,6 +477,12 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
}
}
}
}
__except (EXCEPTION_EXECUTE_HANDLER) {
char _excMsg[64]; sprintf_s(_excMsg, 64, "[HOOK] NtCreateFile exception: 0x%X", GetExceptionCode()); CrashLog(_excMsg);
if (originalString) { ObjectAttributes->ObjectName = originalString; originalString = NULL; }
if (buffer) { HeapFree(GetProcessHeap(), 0, buffer); buffer = NULL; }
}
NTSTATUS result = OriginalNtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock,
AllocationSize, FileAttributes, ShareAccess, CreateDisposition,
@@ -513,10 +510,10 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
UNICODE_STRING newString = { 0 };
WCHAR* buffer = NULL;
__try {
if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) {
SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR);
// Log all paths for debugging
if (g_LogFile != INVALID_HANDLE_VALUE && pathLength > 0) {
WCHAR tempPath[512] = { 0 };
SIZE_T copyLen = pathLength < 511 ? pathLength : 511;
@@ -548,6 +545,12 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
}
}
}
}
__except (EXCEPTION_EXECUTE_HANDLER) {
char _excMsg[64]; sprintf_s(_excMsg, 64, "[HOOK] NtOpenFile exception: 0x%X", GetExceptionCode()); CrashLog(_excMsg);
if (originalString) { ObjectAttributes->ObjectName = originalString; originalString = NULL; }
if (buffer) { HeapFree(GetProcessHeap(), 0, buffer); buffer = NULL; }
}
NTSTATUS result = OriginalNtOpenFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, ShareAccess, OpenOptions);
@@ -566,6 +569,7 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
UNICODE_STRING newString = { 0 };
WCHAR* buffer = NULL;
__try {
if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) {
SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR);
@@ -582,6 +586,12 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
}
}
}
}
__except (EXCEPTION_EXECUTE_HANDLER) {
char _excMsg[64]; sprintf_s(_excMsg, 64, "[HOOK] NtDeleteFile exception: 0x%X", GetExceptionCode()); CrashLog(_excMsg);
if (originalString) { ObjectAttributes->ObjectName = originalString; originalString = NULL; }
if (buffer) { HeapFree(GetProcessHeap(), 0, buffer); buffer = NULL; }
}
NTSTATUS result = OriginalNtDeleteFile(ObjectAttributes);
@@ -609,6 +619,7 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
WCHAR FileName[1];
} FILE_RENAME_INFO;
__try {
if (g_HooksInitialized && FileInformation && (FileInformationClass == FileRenameInformation || FileInformationClass == FileRenameInformationEx)) {
FILE_RENAME_INFO* renameInfo = (FILE_RENAME_INFO*)FileInformation;
if (renameInfo->FileNameLength > 0) {
@@ -639,6 +650,10 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
}
}
}
}
__except (EXCEPTION_EXECUTE_HANDLER) {
char _excMsg[64]; sprintf_s(_excMsg, 64, "[HOOK] NtSetInfoFile exception: 0x%X", GetExceptionCode()); CrashLog(_excMsg);
}
return OriginalNtSetInformationFile(FileHandle, IoStatusBlock, FileInformation, Length, FileInformationClass);
}
@@ -653,6 +668,7 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
UNICODE_STRING newString = { 0 };
WCHAR* buffer = NULL;
__try {
if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) {
SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR);
@@ -669,6 +685,12 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
}
}
}
}
__except (EXCEPTION_EXECUTE_HANDLER) {
char _excMsg[64]; sprintf_s(_excMsg, 64, "[HOOK] NtQueryAttribs exception: 0x%X", GetExceptionCode()); CrashLog(_excMsg);
if (originalString) { ObjectAttributes->ObjectName = originalString; originalString = NULL; }
if (buffer) { HeapFree(GetProcessHeap(), 0, buffer); buffer = NULL; }
}
NTSTATUS result = OriginalNtQueryAttributesFile(ObjectAttributes, FileInformation);
@@ -690,6 +712,7 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
UNICODE_STRING newString = { 0 };
WCHAR* buffer = NULL;
__try {
if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) {
SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR);
@@ -706,6 +729,12 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
}
}
}
}
__except (EXCEPTION_EXECUTE_HANDLER) {
char _excMsg[64]; sprintf_s(_excMsg, 64, "[HOOK] NtQueryFullAttribs exception: 0x%X", GetExceptionCode()); CrashLog(_excMsg);
if (originalString) { ObjectAttributes->ObjectName = originalString; originalString = NULL; }
if (buffer) { HeapFree(GetProcessHeap(), 0, buffer); buffer = NULL; }
}
NTSTATUS result = OriginalNtQueryFullAttributesFile(ObjectAttributes, FileInformation);