Skip to content

Commit e352cb2

Browse files
iDigitalFlameiDigitalFlame
committed
Bug Fixes
- Exported the named security function calls. - Added methods to get attributes from Security Descriptor. - Fixed a bug in sentinel.py regarding encrypting output. - Added a property to DLL and ASM to guard aganist direct self injection without directly specifying. - Fixed a Sentinel bug that erronously split command lines - Shortened sentinel back-off time.
1 parent bb16309 commit e352cb2

15 files changed

+278
-131
lines changed

‎cmd/asm.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,10 @@ import (
3232
//
3333
// TODO(dij): Add Linux shellcode execution support.
3434
type Assembly struct {
35-
Data []byte
36-
t thread
37-
Timeout time.Duration
35+
Data []byte
36+
t thread
37+
Timeout time.Duration
38+
SameProcess bool
3839
}
3940

4041
// Run will start the Assembly thread and wait until it completes. This function

‎cmd/asm_windows.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ func (a *Assembly) Start() error {
4141
if len(a.Data) == 0 {
4242
return ErrEmptyCommand
4343
}
44-
if err := a.t.Start(0, a.Timeout, 0, a.Data); err != nil {
44+
if err := a.t.Start(0, a.Timeout, 0, a.Data, a.SameProcess); err != nil {
4545
return err
4646
}
4747
go a.t.wait(0, 0)

‎cmd/dll.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,10 @@ import (
2828
// The 'SetParent*' function will attempt to set the target that loads the DLL.
2929
// If none are specified, the DLL will be loaded into the current process.
3030
type DLL struct {
31-
Path string
32-
t thread
33-
Timeout time.Duration
31+
Path string
32+
t thread
33+
Timeout time.Duration
34+
SameProcess bool
3435
}
3536

3637
// Run will start the DLL thread and wait until it completes. This function

‎cmd/dll_windows.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ func (d *DLL) Start() error {
5656
for i := 0; i < len(b)-1; i += 2 {
5757
b[i], b[i+1] = byte(p[i/2]), byte(p[i/2]>>8)
5858
}
59-
if err := d.t.Start(0, d.Timeout, winapi.LoadLibraryAddress(), b); err != nil {
59+
if err := d.t.Start(0, d.Timeout, winapi.LoadLibraryAddress(), b, d.SameProcess); err != nil {
6060
return err
6161
}
6262
b = nil

‎cmd/thread_windows.go

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,9 +57,11 @@ func (t *thread) close() {
5757
if t.callback != nil {
5858
t.callback()
5959
} else {
60-
// NOTE(dij): We only need to close the owner if there is no callback as
61-
// it's usually a Zombie that'll handle it's own handle closure.
62-
winapi.CloseHandle(t.owner)
60+
if t.owner != 0 && t.owner != winapi.CurrentProcess {
61+
// NOTE(dij): We only need to close the owner if there is no callback as
62+
// it's usually a Zombie that'll handle it's own handle closure.
63+
winapi.CloseHandle(t.owner)
64+
}
6365
}
6466
winapi.CloseHandle(t.hwnd)
6567
t.hwnd, t.owner, t.loc = 0, 0, 0
@@ -261,7 +263,7 @@ func (t *thread) waitInner(x chan<- error, p, i uint32) {
261263
x <- e
262264
close(x)
263265
}
264-
func (t *thread) Start(p uintptr, d time.Duration, a uintptr, b []byte) error {
266+
func (t *thread) Start(p uintptr, d time.Duration, a uintptr, b []byte, same bool) error {
265267
if t.Running() {
266268
return ErrAlreadyStarted
267269
}
@@ -278,6 +280,9 @@ func (t *thread) Start(p uintptr, d time.Duration, a uintptr, b []byte) error {
278280
}
279281
atomic.StoreUint32(&t.cookie, 0)
280282
if t.ch, t.owner = make(chan struct{}), p; t.owner == 0 {
283+
if !same {
284+
return t.stopWith(exitStopped, ErrNotSame)
285+
}
281286
t.owner = winapi.CurrentProcess
282287
}
283288
var err error
@@ -292,6 +297,12 @@ func (t *thread) Start(p uintptr, d time.Duration, a uintptr, b []byte) error {
292297
if t.owner, err = t.filter.HandleFunc(0x43A, nil); err != nil {
293298
return t.stopWith(exitStopped, err)
294299
}
300+
if !same {
301+
if i, _ := winapi.GetProcessID(t.owner); i == winapi.GetCurrentProcessID() {
302+
winapi.CloseHandle(t.owner)
303+
return t.stopWith(exitStopped, ErrNotSame)
304+
}
305+
}
295306
}
296307
// 0x20 - PAGE_EXECUTE_READ
297308
z := uint32(0x20)
@@ -316,6 +327,9 @@ func (t *thread) Start(p uintptr, d time.Duration, a uintptr, b []byte) error {
316327
}
317328
}
318329
if t.owner == winapi.CurrentProcess || t.owner == 0 {
330+
if !same {
331+
return t.stopWith(exitStopped, ErrNotSame)
332+
}
319333
// 0x4 - PAGE_READWRITE
320334
if t.loc, err = winapi.NtAllocateVirtualMemory(t.owner, uint32(l), 0x4); err != nil {
321335
return t.stopWith(exitStopped, err)

‎cmd/util.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,12 @@ import (
2323
)
2424

2525
var (
26+
// ErrNotSame is an error returned by the 'Start' or 'Run' functions when
27+
// attempting to start a ASM or DLL without a Filter target and not setting
28+
// the 'SelfProcess' attribute to 'true',
29+
//
30+
// This is used to prevent accidental self-injection
31+
ErrNotSame = xerr.Sub("cannot host new thread", 0x80)
2632
// ErrNotStarted is an error returned by multiple functions when attempting
2733
// to access a Runnable function that requires the Runnable to be started first.
2834
ErrNotStarted = xerr.Sub("process has not started", 0x3A)

‎cmd/zombie_windows.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ func (z *Zombie) Start() error {
5555
if err := z.x.start(z.ctx, &z.Process, true); err != nil {
5656
return z.stopWith(exitStopped, err)
5757
}
58-
if err := z.t.Start(z.x.i.Process, z.Timeout, 0, z.Data); err != nil {
58+
if err := z.t.Start(z.x.i.Process, z.Timeout, 0, z.Data, true); err != nil {
5959
return z.stopWith(exitStopped, z.t.stopWith(exitStopped, err))
6060
}
6161
go z.wait()

‎device/winapi/calls.go

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1067,6 +1067,27 @@ func RegSetValueEx(h uintptr, path string, t uint32, data *byte, dataLen uint32)
10671067
return nil
10681068
}
10691069

1070+
// GetNamedSecurityInfo Windows API Call
1071+
//
1072+
// The GetNamedSecurityInfo function retrieves a copy of the security descriptor
1073+
// for an object specified by name.
1074+
//
1075+
// https://learn.microsoft.com/en-us/windows/win32/api/aclapi/nf-aclapi-getnamedsecurityinfow
1076+
func GetNamedSecurityInfo(path string, object, info uint32) (*SecurityDescriptor, error) {
1077+
n, err := UTF16PtrFromString(path)
1078+
if err != nil {
1079+
return nil, err
1080+
}
1081+
var s *SecurityDescriptor
1082+
r, _, err1 := syscallN(funcGetNamedSecurityInfo.address(), uintptr(unsafe.Pointer(n)), uintptr(object), uintptr(info), 0, 0, 0, 0, uintptr(unsafe.Pointer(&s)))
1083+
if r > 0 {
1084+
return nil, unboxError(err1)
1085+
}
1086+
c := s.copyRelative()
1087+
localFree(uintptr(unsafe.Pointer(s)))
1088+
return c, nil
1089+
}
1090+
10701091
// CreateEvent Windows API Call
10711092
//
10721093
// Creates or opens a named or unnamed event object.
@@ -1223,6 +1244,29 @@ func InitiateSystemShutdownEx(t, msg string, secs uint32, force, reboot bool, re
12231244
return nil
12241245
}
12251246

1247+
// SetNamedSecurityInfo Windows API Call
1248+
//
1249+
// The SetNamedSecurityInfo function sets specified security information in the
1250+
// security descriptor of a specified object. The caller identifies the object by name.
1251+
//
1252+
// https://learn.microsoft.com/en-us/windows/win32/api/aclapi/nf-aclapi-setnamedsecurityinfow
1253+
func SetNamedSecurityInfo(path string, object, info uint32, owner, group *SID, dacl, sacl *ACL) error {
1254+
n, err := UTF16PtrFromString(path)
1255+
if err != nil {
1256+
return err
1257+
}
1258+
/*r, _, err1 := syscallN(
1259+
funcSetNamedSecurityInfo.address(), uintptr(unsafe.Pointer(n)), uintptr(object), uintptr(info),
1260+
uintptr(unsafe.Pointer(owner)), uintptr(unsafe.Pointer(group)), uintptr(unsafe.Pointer(dacl)), uintptr(unsafe.Pointer(sacl)),
1261+
)*/
1262+
r, err1 := funcSetNamedSecurityInfo.Call(uintptr(unsafe.Pointer(n)), 1, 0x80000004, 0, 0, uintptr(unsafe.Pointer(dacl)), 0)
1263+
if r > 0 {
1264+
return err1
1265+
//return unboxError(err1)
1266+
}
1267+
return nil
1268+
}
1269+
12261270
// NtCreateSection Windows API Call
12271271
//
12281272
// The NtCreateSection routine creates a section object.

‎device/winapi/structs.go

Lines changed: 62 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -471,10 +471,12 @@ type ProcessInformation struct {
471471
//
472472
// DO NOT REORDER
473473
type SecurityDescriptor struct {
474-
_, _ byte
475-
_ SecurityDescriptorControl
476-
_, _ SID
477-
_, _ *ACL
474+
_, _ byte
475+
Control SecurityDescriptorControl
476+
owner *SID
477+
group *SID
478+
sacl *ACL
479+
dacl *ACL
478480
}
479481

480482
// SecurityAttributes matches the SECURITY_ATTRIBUTES struct
@@ -575,6 +577,62 @@ func localFree(h uintptr) (uintptr, error) {
575577
}
576578
return r, nil
577579
}
580+
581+
// Dacl attempts to retrieve the DACL of this SecurityDescriptor. The returned ACL
582+
// may be nil if no DACL was present.
583+
func (s *SecurityDescriptor) Dacl() (*ACL, error) {
584+
var (
585+
e, d bool
586+
a *ACL
587+
)
588+
r, _, _ := syscallN(funcRtlGetDaclSecurityDescriptor.address(), uintptr(unsafe.Pointer(s)), uintptr(unsafe.Pointer(&e)), uintptr(unsafe.Pointer(&a)), uintptr(unsafe.Pointer(&d)))
589+
if r > 0 {
590+
return nil, formatNtError(r)
591+
}
592+
return a, nil
593+
}
594+
595+
// Sacl attempts to retrieve the SACL of this SecurityDescriptor. The returned ACL
596+
// may be nil if no SACL was present.
597+
func (s *SecurityDescriptor) Sacl() (*ACL, error) {
598+
var (
599+
e, d bool
600+
a *ACL
601+
)
602+
r, _, _ := syscallN(funcRtlGetSaclSecurityDescriptor.address(), uintptr(unsafe.Pointer(s)), uintptr(unsafe.Pointer(&e)), uintptr(unsafe.Pointer(&a)), uintptr(unsafe.Pointer(&d)))
603+
if r > 0 {
604+
return nil, formatNtError(r)
605+
}
606+
return a, nil
607+
}
608+
609+
// Owner attempts to retrieve the SID of the Owner of this SecurityDescriptor. The
610+
// returned SID may be nil if no Owner was present.
611+
func (s *SecurityDescriptor) Owner() (*SID, error) {
612+
var (
613+
d bool
614+
v *SID
615+
)
616+
r, _, _ := syscallN(funcRtlGetOwnerSecurityDescriptor.address(), uintptr(unsafe.Pointer(s)), uintptr(unsafe.Pointer(&v)), uintptr(unsafe.Pointer(&d)))
617+
if r > 0 {
618+
return nil, formatNtError(r)
619+
}
620+
return v, nil
621+
}
622+
623+
// Group attempts to retrieve the SID of the Group of this SecurityDescriptor. The
624+
// returned SID may be nil if no Group was present.
625+
func (s *SecurityDescriptor) Group() (*SID, error) {
626+
var (
627+
d bool
628+
v *SID
629+
)
630+
r, _, _ := syscallN(funcRtlGetGroupSecurityDescriptor.address(), uintptr(unsafe.Pointer(s)), uintptr(unsafe.Pointer(&v)), uintptr(unsafe.Pointer(&d)))
631+
if r > 0 {
632+
return nil, formatNtError(r)
633+
}
634+
return v, nil
635+
}
578636
func convertSIDToStringSID(i *SID, s **uint16) error {
579637
r, _, err := syscallN(funcConvertSIDToStringSID.address(), uintptr(unsafe.Pointer(i)), uintptr(unsafe.Pointer(s)))
580638
if r == 0 {

‎device/winapi/xy_procs_crypt.go

Lines changed: 57 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -35,57 +35,61 @@ var (
3535
funcLoadLibraryEx = dllKernelBase.Proc(0x68D28778)
3636
funcFormatMessage = dllKernelBase.Proc(0x8233A148)
3737

38-
funcNtClose = dllNtdll.sysProc(0x36291E41)
39-
funcNtSetEvent = dllNtdll.sysProc(0x5E5D5E5B)
40-
funcRtlFreeHeap = dllNtdll.Proc(0xBC880A2D)
41-
funcNtTraceEvent = dllNtdll.sysProc(0x89F984CE)
42-
funcNtOpenThread = dllNtdll.sysProc(0x7319665F)
43-
funcRtlCreateHeap = dllNtdll.Proc(0xA1846AB)
44-
funcEtwEventWrite = dllNtdll.Proc(0xD32A6690) // >= WinVista
45-
funcDbgBreakPoint = dllNtdll.Proc(0x6861210F)
46-
funcNtOpenProcess = dllNtdll.sysProc(0x57367582)
47-
funcRtlDestroyHeap = dllNtdll.Proc(0x167E8613)
48-
funcNtResumeThread = dllNtdll.sysProc(0xA6F798EA)
49-
funcNtCreateSection = dllNtdll.sysProc(0x40A2511C)
50-
funcNtSuspendThread = dllNtdll.sysProc(0x9D419019)
51-
funcNtResumeProcess = dllNtdll.sysProc(0xB5333DBD)
52-
funcRtlAllocateHeap = dllNtdll.Proc(0x50AA445E)
53-
funcNtDuplicateToken = dllNtdll.sysProc(0x7A75D3A1)
54-
funcEtwEventRegister = dllNtdll.Proc(0xC0B4D94C) // >= WinVista
55-
funcNtSuspendProcess = dllNtdll.sysProc(0x8BD95BF8)
56-
funcNtCreateThreadEx = dllNtdll.sysProc(0x8E6261C) // >= WinVista (Xp sub = RtlCreateUserThread)
57-
funcNtCancelIoFileEx = dllNtdll.sysProc(0xD4909C18) // >= WinVista (Xp sub = NtCancelIoFile)
58-
funcNtDuplicateObject = dllNtdll.sysProc(0xAD2BC047)
59-
funcNtTerminateThread = dllNtdll.sysProc(0x18157A24)
60-
funcNtOpenThreadToken = dllNtdll.sysProc(0x82EEAAFE)
61-
funcEtwEventWriteFull = dllNtdll.Proc(0xAC8A097) // >= WinVista
62-
funcRtlReAllocateHeap = dllNtdll.Proc(0xA51D1975)
63-
funcNtMapViewOfSection = dllNtdll.sysProc(0x704A2F2C)
64-
funcNtTerminateProcess = dllNtdll.sysProc(0xB3AC5173)
65-
funcNtOpenProcessToken = dllNtdll.sysProc(0xB2CA3641)
66-
funcRtlCopyMappedMemory = dllNtdll.Proc(0x381752E6) // >= WinS2003 (Not in XP sub = RtlMoveMemory)
67-
funcNtFreeVirtualMemory = dllNtdll.sysProc(0x8C399853)
68-
funcNtImpersonateThread = dllNtdll.sysProc(0x12724B12)
69-
funcNtUnmapViewOfSection = dllNtdll.sysProc(0x19B022D)
70-
funcNtWriteVirtualMemory = dllNtdll.sysProc(0x2012F428)
71-
funcNtDeviceIoControlFile = dllNtdll.sysProc(0x5D0C9026)
72-
funcNtWaitForSingleObject = dllNtdll.sysProc(0x46D9033C)
73-
funcNtSetInformationToken = dllNtdll.sysProc(0x43623A4)
74-
funcNtProtectVirtualMemory = dllNtdll.sysProc(0xD86AFCB8)
75-
funcNtSetInformationThread = dllNtdll.sysProc(0x5F74B08D)
76-
funcRtlGetNtVersionNumbers = dllNtdll.Proc(0xD476F98B)
77-
funcEtwNotificationRegister = dllNtdll.Proc(0x7B7F821F) // >= WinVista
78-
funcNtAllocateVirtualMemory = dllNtdll.sysProc(0x46D22D36)
79-
funcRtlSetProcessIsCritical = dllNtdll.Proc(0xEE7639E9)
80-
funcNtFlushInstructionCache = dllNtdll.sysProc(0xEFB80179)
81-
funcNtAdjustTokenPrivileges = dllNtdll.sysProc(0x6CCF6931)
82-
funcNtQueryInformationToken = dllNtdll.sysProc(0x63C176C4)
83-
funcNtQueryInformationThread = dllNtdll.sysProc(0x115412D)
84-
funcNtQuerySystemInformation = dllNtdll.sysProc(0x337C7C64)
85-
funcNtWaitForMultipleObjects = dllNtdll.sysProc(0x5DF74043)
86-
funcNtQueryInformationProcess = dllNtdll.sysProc(0xC88AB8C)
87-
funcRtlWow64GetProcessMachines = dllNtdll.Proc(0x982D219D) // == 64bit/ARM64
88-
funcRtlLengthSecurityDescriptor = dllNtdll.Proc(0xF5677F7C)
38+
funcNtClose = dllNtdll.sysProc(0x36291E41)
39+
funcNtSetEvent = dllNtdll.sysProc(0x5E5D5E5B)
40+
funcRtlFreeHeap = dllNtdll.Proc(0xBC880A2D)
41+
funcNtTraceEvent = dllNtdll.sysProc(0x89F984CE)
42+
funcNtOpenThread = dllNtdll.sysProc(0x7319665F)
43+
funcRtlCreateHeap = dllNtdll.Proc(0xA1846AB)
44+
funcEtwEventWrite = dllNtdll.Proc(0xD32A6690) // >= WinVista
45+
funcDbgBreakPoint = dllNtdll.Proc(0x6861210F)
46+
funcNtOpenProcess = dllNtdll.sysProc(0x57367582)
47+
funcRtlDestroyHeap = dllNtdll.Proc(0x167E8613)
48+
funcNtResumeThread = dllNtdll.sysProc(0xA6F798EA)
49+
funcNtCreateSection = dllNtdll.sysProc(0x40A2511C)
50+
funcNtSuspendThread = dllNtdll.sysProc(0x9D419019)
51+
funcNtResumeProcess = dllNtdll.sysProc(0xB5333DBD)
52+
funcRtlAllocateHeap = dllNtdll.Proc(0x50AA445E)
53+
funcNtDuplicateToken = dllNtdll.sysProc(0x7A75D3A1)
54+
funcEtwEventRegister = dllNtdll.Proc(0xC0B4D94C) // >= WinVista
55+
funcNtSuspendProcess = dllNtdll.sysProc(0x8BD95BF8)
56+
funcNtCreateThreadEx = dllNtdll.sysProc(0x8E6261C) // >= WinVista (Xp sub = RtlCreateUserThread)
57+
funcNtCancelIoFileEx = dllNtdll.sysProc(0xD4909C18) // >= WinVista (Xp sub = NtCancelIoFile)
58+
funcNtDuplicateObject = dllNtdll.sysProc(0xAD2BC047)
59+
funcNtTerminateThread = dllNtdll.sysProc(0x18157A24)
60+
funcNtOpenThreadToken = dllNtdll.sysProc(0x82EEAAFE)
61+
funcEtwEventWriteFull = dllNtdll.Proc(0xAC8A097) // >= WinVista
62+
funcRtlReAllocateHeap = dllNtdll.Proc(0xA51D1975)
63+
funcNtMapViewOfSection = dllNtdll.sysProc(0x704A2F2C)
64+
funcNtTerminateProcess = dllNtdll.sysProc(0xB3AC5173)
65+
funcNtOpenProcessToken = dllNtdll.sysProc(0xB2CA3641)
66+
funcRtlCopyMappedMemory = dllNtdll.Proc(0x381752E6) // >= WinS2003 (Not in XP sub = RtlMoveMemory)
67+
funcNtFreeVirtualMemory = dllNtdll.sysProc(0x8C399853)
68+
funcNtImpersonateThread = dllNtdll.sysProc(0x12724B12)
69+
funcNtUnmapViewOfSection = dllNtdll.sysProc(0x19B022D)
70+
funcNtWriteVirtualMemory = dllNtdll.sysProc(0x2012F428)
71+
funcNtDeviceIoControlFile = dllNtdll.sysProc(0x5D0C9026)
72+
funcNtWaitForSingleObject = dllNtdll.sysProc(0x46D9033C)
73+
funcNtSetInformationToken = dllNtdll.sysProc(0x43623A4)
74+
funcNtProtectVirtualMemory = dllNtdll.sysProc(0xD86AFCB8)
75+
funcNtSetInformationThread = dllNtdll.sysProc(0x5F74B08D)
76+
funcRtlGetNtVersionNumbers = dllNtdll.Proc(0xD476F98B)
77+
funcEtwNotificationRegister = dllNtdll.Proc(0x7B7F821F) // >= WinVista
78+
funcNtAllocateVirtualMemory = dllNtdll.sysProc(0x46D22D36)
79+
funcRtlSetProcessIsCritical = dllNtdll.Proc(0xEE7639E9)
80+
funcNtFlushInstructionCache = dllNtdll.sysProc(0xEFB80179)
81+
funcNtAdjustTokenPrivileges = dllNtdll.sysProc(0x6CCF6931)
82+
funcNtQueryInformationToken = dllNtdll.sysProc(0x63C176C4)
83+
funcNtQueryInformationThread = dllNtdll.sysProc(0x115412D)
84+
funcNtQuerySystemInformation = dllNtdll.sysProc(0x337C7C64)
85+
funcNtWaitForMultipleObjects = dllNtdll.sysProc(0x5DF74043)
86+
funcNtQueryInformationProcess = dllNtdll.sysProc(0xC88AB8C)
87+
funcRtlWow64GetProcessMachines = dllNtdll.Proc(0x982D219D) // == 64bit/ARM64
88+
funcRtlLengthSecurityDescriptor = dllNtdll.Proc(0xF5677F7C)
89+
funcRtlGetDaclSecurityDescriptor = dllNtdll.Proc(0x13464D36)
90+
funcRtlGetSaclSecurityDescriptor = dllNtdll.Proc(0xE72F0F6F)
91+
funcRtlGetGroupSecurityDescriptor = dllNtdll.Proc(0xD1F4CD59)
92+
funcRtlGetOwnerSecurityDescriptor = dllNtdll.Proc(0xB5D71CF9)
8993

9094
funcReadFile = dllKernelBase.Proc(0xEBE8E9AF)
9195
funcWriteFile = dllKernelBase.Proc(0x567775AC)
@@ -132,6 +136,8 @@ var (
132136
funcRegCreateKeyEx = dllAdvapi32.Proc(0xA656F848)
133137
funcSetServiceStatus = dllAdvapi32.Proc(0xC09B613A)
134138
funcLookupAccountSid = dllAdvapi32.Proc(0x59E27333)
139+
funcGetNamedSecurityInfo = dllAdvapi32.Proc(0x411B68C7)
140+
funcSetNamedSecurityInfo = dllAdvapi32.Proc(0xFA5B67F3)
135141
funcLookupPrivilegeValue = dllAdvapi32.Proc(0xEC6FF8D6)
136142
funcConvertSIDToStringSID = dllAdvapi32.Proc(0x7AAB722D)
137143
funcCreateProcessWithToken = dllAdvapi32.Proc(0xC20739FE) // >= WinS2003 (Not in XP)

0 commit comments

Comments
 (0)