Skip to content

Commit 4048e4d

Browse files
hfiref0xhfiref0x
committed
RC2
Better handling of malformed files, fixes to PH calculation, malformed test files added (including poc from #2 and from sources I don't really remember). Release candidate 2.
1 parent 3f5b4c0 commit 4048e4d

34 files changed

+951
-652
lines changed

‎AuthHashCalc.sha256

Lines changed: 33 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,41 @@
1-
0ff7b4f3f7cdd3c2d0cc85c9318e15a7e70f9cba58b351b10d602c7c7f3a77de *Bin\ahc32.exe
2-
327b561fed1894cbd2c8c31b3841eb34820af64a445a253f87f6128157950fa1 *Bin\ahc64.exe
1+
0fe7bced5c26aa798840f43545d275c5f51f3d64f18ff9ffd3750a945edae55a *Bin\ahc32.exe
2+
c1ad266312d0d6a06e2c8dd89cb32bbb564bb87bcdfd694347cf898bf95725eb *Bin\ahc64.exe
33
6dedc0ab11424471d995b569ca779272e9e7f8405abca675863256f42ebd3938 *Screenshots\cli.png
44
4787220600043ba0fadc09fa76194ba3a6ead6fc124ea934099b306a8f74fe73 *Screenshots\mainwnd.png
55
dcf5ac3479f9a3b519926c29becd2ec88584fffbb4d92235582a35cf10d99593 *Source\ahc.manifest
66
636925b3417b667439881cfe81c8091b4f76cfe508065d0c915e50616eb76554 *Source\AuthHashCalc.sln
7-
0c83859ceee7f409a47ccd41053a67edb15dd35c05d1152538135623d4c2b52e *Source\AuthHashCalc.vcxproj
8-
fe95abf388ba3edd8452d5c0dd8c3b90b880d74b34926f7ef14152ca27fe0c32 *Source\AuthHashCalc.vcxproj.filters
7+
bb4198a6f3589e4c2de6fc3d5ef663fe836914788823ae2c4ef8722d095f712d *Source\AuthHashCalc.vcxproj
8+
393cdbe6beee2cd0c5cd381bde752318afdc8805d29a3f95f51022a55d5c4e5c *Source\AuthHashCalc.vcxproj.filters
99
11670e3af4b2d8ab84359947d3b34ae8fc4363e04ead2b545e1d720242b72976 *Source\AuthHashCalc.vcxproj.user
10-
8adf12b26f52d91a5cd28bbe3473c20d03e103530f55dfe1ba1f31e81ebf28db *Source\global.h
11-
50eaa19158bb89b28a4e82cc703387f2dd2753ed2a42d03e56d8554568f35ae1 *Source\main.cpp
10+
99225431ee6da94bb5e740ea388c03e6a1743648f2f934fcc0043e4e96034d97 *Source\global.h
11+
a671d5c103e1c09f33c6cb7f751e74df4b8d7e14386198f97d37208e146160bd *Source\hash.cpp
12+
260879bed6f510f3c06a5afede94967e4f17b2aad972e2ffdebcaa408c41b2d9 *Source\hash.h
13+
088743b7b7a955d17f8769a4b0cb7a261be0df91443171f7def0156a2a6e66ff *Source\main.cpp
1214
c9bfabccf970e5f0bf7c281625ddde1a02533aee7de73a3d3e5926750bb172d1 *Source\main.ico
1315
5231ac27b80499f9c54c69ac397009ba29ea3038135cf386e3b44e30090f84cd *Source\ntos.h
1416
dab312fbef3e1e372092f0d07b29f8288509b0d69cab7fa5e527b3e85c3496d0 *Source\resource.h
15-
56d5cc7f85d1c1481059b791b1df6124f848d133e93216d58263356f9d48bad9 *Source\resource.rc
16-
32033f1941c7685694b22ee45e498c9d83de2a5f5bc3bd5ce251c116d6fcc2ff *Source\sup.cpp
17-
2203c43a517762bf61aae21ca7193fe4205a42eea5ca00b44aedd9109a6bc227 *Source\sup.h
17+
d21ffa3d21a2e2fdc9913d4c63208950e90566cb3b386358b6bf31b25c04cbbb *Source\resource.rc
18+
fa9cb66fc7d225c17a3c3417a315421f32b45b279d9b89e027a82006dc12a7ca *Source\sup.cpp
19+
392d3d4b648a0d12896227c320ae62bd4552d90e0e77296d6ad26c0e05d2d5f1 *Source\sup.h
20+
212672c8f4767647ad6ac2c52be30ef67375974702fd9899f664fe7489398a04 *Source\tests\BadNtHeaders.exe
21+
5426632bc809a95ed36bcfae71a53c98d84ffa7ef4593322854f54db067089ea *Source\tests\GLCKIO2_2pages.sys
22+
609a8c800e44c1216145422ab73f25642976b568266ed475e0454f570bc8d05f *Source\tests\GLCKIO2_invalid1.sys
23+
609a8c800e44c1216145422ab73f25642976b568266ed475e0454f570bc8d05f *Source\tests\GLCKIO2_invalid2.sys
24+
046631de6c519a9ee5cf93f8b5af2118ad67ec31a51e46ad11795e0974f4dca4 *Source\tests\32\32.dll
25+
7aa07b4ca16e46ffc284cbdd27186d5eed4e06042bf622187ab6bbc5ad93a675 *Source\tests\64\64.dll
26+
2226d24875e40b2457aee99f1b0a3558e0dc85d67072b13b011f0a023d646cb3 *Source\tests\ci\ci0.dll
27+
01347965f4a60f9a6465a005f581f011459defc1f77dcc4254569c5ec5f67b2c *Source\tests\ci\ci1.dll
28+
59ce783bd5f6178d02fe6436b295ab70c0558a2278c7294e23c71bcea817998a *Source\tests\ci\ci2.dll
29+
365cc819ab86e2a9ff85a98a0b8b41991cd64207e74f7883573426138713e134 *Source\tests\misc\aaaaaaaa.dll
30+
d2309f63de2501e3e7a72cebf9108edfcca42adf7cea269d4d32f8bffdeaa139 *Source\tests\misc\ccccccc.dll
31+
1a6852fc3f30bdb708678854565b1402cf80e5a66d1d630b1da23344b707f93b *Source\tests\misc\ddddddd.dll
32+
2226d24875e40b2457aee99f1b0a3558e0dc85d67072b13b011f0a023d646cb3 *Source\tests\misc\dddddddd.dll
33+
805739eadc35fe43258206e81b0ff7a50d9949d0fe7f7a7ea6603e1d0c8f4197 *Source\tests\misc\eeeeeeee.dll
34+
c65be88bb4fd4eabc1fe09175ba7eac4e67de44425c42a7a74938ce64dbeecad *Source\tests\misc\fffffffff.dll
35+
c65be88bb4fd4eabc1fe09175ba7eac4e67de44425c42a7a74938ce64dbeecad *Source\tests\misc\wwwww.dll
36+
efa923ce37c7b1a77e5952df6b7e03085e7861167a6e0dc1d82b1164705eacbd *Source\tests\misc\xxxxxxxxx.dll
37+
fe5521ec023d8c03cdba9145417070ffb6db7f5a2d77e150992c8c9c4713def4 *Source\tests\misc\yyyyyy.dll
38+
94ec28f6a426054c9c99939396e258b0fad2eae0687836c0192853a99e02eef6 *Source\tests\misc\zzzzzzzzzz.dll
39+
3548228c04849535ba626108306a12460d36aaff36a82c55d4b5fc7326203d4c *Source\tests\reloc\apphelp0.dll
40+
37ede7f772f13ebd667a0ec021dbb16644f1873cb7c879369eb07c6e8b629eab *Source\tests\reloc\apphelp1.dll
41+
6e57be1c2bbcd4100d6ba3b66961873505c4c4da8c2d0d60896f0e11e468d4c0 *Source\tests\reloc\apphelp2.dll

‎Bin/ahc32.exe

1.5 KB
Binary file not shown.

‎Bin/ahc64.exe

2 KB
Binary file not shown.

‎Source/AuthHashCalc.vcxproj

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,11 +186,13 @@
186186
</Manifest>
187187
</ItemDefinitionGroup>
188188
<ItemGroup>
189+
<ClCompile Include="hash.cpp" />
189190
<ClCompile Include="main.cpp" />
190191
<ClCompile Include="sup.cpp" />
191192
</ItemGroup>
192193
<ItemGroup>
193194
<ClInclude Include="global.h" />
195+
<ClInclude Include="hash.h" />
194196
<ClInclude Include="ntos.h" />
195197
<ClInclude Include="resource.h" />
196198
<ClInclude Include="sup.h" />

‎Source/AuthHashCalc.vcxproj.filters

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@
2121
<ClCompile Include="sup.cpp">
2222
<Filter>Source Files</Filter>
2323
</ClCompile>
24+
<ClCompile Include="hash.cpp">
25+
<Filter>Source Files</Filter>
26+
</ClCompile>
2427
</ItemGroup>
2528
<ItemGroup>
2629
<ClInclude Include="global.h">
@@ -35,6 +38,9 @@
3538
<ClInclude Include="ntos.h">
3639
<Filter>Header Files</Filter>
3740
</ClInclude>
41+
<ClInclude Include="hash.h">
42+
<Filter>Header Files</Filter>
43+
</ClInclude>
3844
</ItemGroup>
3945
<ItemGroup>
4046
<ResourceCompile Include="resource.rc">

‎Source/global.h

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
*
77
* VERSION: 1.03
88
*
9-
* DATE: 21 Oct 2021
9+
* DATE: 26 Oct 2021
1010
*
1111
* Common include header file.
1212
*
@@ -36,17 +36,38 @@
3636
#include <VersionHelpers.h>
3737
#include <ntstatus.h>
3838
#include "ntos.h"
39-
#include "sup.h"
4039
#include "resource.h"
4140

41+
#pragma comment(lib, "Bcrypt.lib")
42+
#pragma comment(lib, "Comctl32.lib")
43+
4244
typedef struct _CNG_CTX {
4345
PVOID Hash;
4446
PVOID HashObject;
4547
ULONG HashSize;
4648
ULONG HashObjectSize;
4749
BCRYPT_ALG_HANDLE AlgHandle;
4850
BCRYPT_HASH_HANDLE HashHandle;
51+
HANDLE HeapHandle;
4952
} CNG_CTX, * PCNG_CTX;
5053

51-
#pragma comment(lib, "Bcrypt.lib")
52-
#pragma comment(lib, "Comctl32.lib")
54+
typedef struct _FILE_EXCLUDE_DATA {
55+
ULONG ChecksumOffset;
56+
ULONG SecurityOffset;
57+
PIMAGE_DATA_DIRECTORY SecurityDirectory;
58+
} FILE_EXCLUDE_DATA, * PFILE_EXCLUDE_DATA;
59+
60+
typedef struct _FILE_VIEW_INFO {
61+
DWORD LastError;
62+
LPCWSTR FileName;
63+
HANDLE FileHandle;
64+
HANDLE SectionHandle;
65+
PVOID ViewBase;
66+
SIZE_T ViewSize;
67+
LARGE_INTEGER FileSize;
68+
PIMAGE_NT_HEADERS NtHeaders;
69+
FILE_EXCLUDE_DATA ExcludeData;
70+
} FILE_VIEW_INFO, * PFILE_VIEW_INFO;
71+
72+
#include "sup.h"
73+
#include "hash.h"

0 commit comments

Comments
 (0)