-
Notifications
You must be signed in to change notification settings - Fork 0
/
debug_script.js
127 lines (117 loc) · 26.1 KB
/
debug_script.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
var sys_data = {"ntdll.dll": {"ZwAccessCheck": {"args": ["_In_ PSECURITY_DESCRIPTOR SecurityDescriptor", "_In_ HANDLE ClientToken", "_In_ ACCESS_MASK DesiredAccess", "_In_ PGENERIC_MAPPING GenericMapping", "_Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet", "_Inout_ PULONG PrivilegeSetLength", "_Out_ PACCESS_MASK GrantedAccess", "_Out_ PNTSTATUS AccessStatus"], "addr": 652128}, "ZwAcceptConnectPort": {"args": ["_Out_ PHANDLE PortHandle", "_In_opt_ PVOID PortContext", "_In_ PPORT_MESSAGE ConnectionRequest", "_In_ BOOLEAN AcceptConnection", "_Inout_opt_ PPORT_VIEW ServerView", "_Out_opt_ PREMOTE_PORT_VIEW ClientView"], "addr": 652192}, "ZwReleaseSemaphore": {"args": ["_In_ HANDLE SemaphoreHandle", "_In_ LONG ReleaseCount", "_Out_opt_ PLONG PreviousCount"], "addr": 652448}, "ZwClose": {"args": ["_In_ HANDLE Handle"], "addr": 652608}, "ZwQueryValueKey": {"args": ["_In_ HANDLE KeyHandle", "_In_ PUNICODE_STRING ValueName", "_In_ __drv_strictTypeMatch(__drv_typeConst)\nKEY_VALUE_INFORMATION_CLASS KeyValueInformationClass", "_Out_writes_bytes_opt_(Length) PVOID KeyValueInformation", "_In_ ULONG Length", "_Deref_out_range_(<=,Length) PULONG ResultLength"], "addr": 652864}, "ZwWriteFileGather": {"args": ["_In_ HANDLE FileHandle", "_In_opt_ HANDLE Event", "_In_opt_ PIO_APC_ROUTINE ApcRoutine", "_In_opt_ PVOID ApcContext", "_Out_ PIO_STATUS_BLOCK IoStatusBlock", "_In_ PFILE_SEGMENT_ELEMENT SegmentArray", "_In_ ULONG Length", "_In_opt_ PLARGE_INTEGER ByteOffset", "_In_opt_ PULONG Key"], "addr": 652992}, "ZwSetInformationFile": {"args": ["_In_ HANDLE FileHandle", "_Out_ PIO_STATUS_BLOCK IoStatusBlock", "_In_reads_bytes_(Length) PVOID FileInformation", "_In_ ULONG Length", "_In_ FILE_INFORMATION_CLASS FileInformationClass"], "addr": 653376}, "ZwUnmapViewOfSection": {"args": ["_In_ HANDLE ProcessHandle", "_In_opt_ PVOID BaseAddress"], "addr": 653472}, "ZwFsControlFile": {"args": ["_In_ HANDLE FileHandle", "_In_opt_ HANDLE Event", "_In_opt_ PIO_APC_ROUTINE ApcRoutine", "_In_opt_ PVOID ApcContext", "_Out_ PIO_STATUS_BLOCK IoStatusBlock", "_In_ ULONG FsControlCode", "_In_reads_bytes_opt_(InputBufferLength) PVOID InputBuffer", "_In_ ULONG InputBufferLength", "_Out_writes_bytes_opt_(OutputBufferLength) PVOID OutputBuffer", "_In_ ULONG OutputBufferLength"], "addr": 653952}, "ZwContinue": {"args": ["_In_ PCONTEXT ContextRecord", "_In_ BOOLEAN TestAlert"], "addr": 654272}, "ZwQueryDefaultUILanguage": {"args": ["_Out_ LANGID *DefaultUILanguageId"], "addr": 654304}, "ZwApphelpCacheControl": {"args": [], "addr": 654560}, "ZwWaitForMultipleObjects": {"args": ["_In_ ULONG Count", "_In_reads_(Count) HANDLE Handles[]", "_In_ WAIT_TYPE WaitType", "_In_ BOOLEAN Alertable", "_In_opt_ PLARGE_INTEGER Timeout"], "addr": 655024}, "ZwTraceEvent": {"args": ["_In_opt_ HANDLE TraceHandle", "_In_ ULONG Flags", "_In_ ULONG FieldSize", "_In_ PVOID Fields"], "addr": 655120}, "ZwSetTimer": {"args": ["_In_ HANDLE TimerHandle", "_In_ PLARGE_INTEGER DueTime", "_In_opt_ PTIMER_APC_ROUTINE TimerApcRoutine", "_In_opt_ PVOID TimerContext", "_In_ BOOLEAN ResumeTimer", "_In_opt_ LONG Period", "_Out_opt_ PBOOLEAN PreviousState"], "addr": 655248}, "ZwAccessCheckByType": {"args": ["_In_ PSECURITY_DESCRIPTOR SecurityDescriptor", "_In_opt_ PSID PrincipalSelfSid", "_In_ HANDLE ClientToken", "_In_ ACCESS_MASK DesiredAccess", "_In_reads_(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList", "_In_ ULONG ObjectTypeListLength", "_In_ PGENERIC_MAPPING GenericMapping", "_Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet", "_Inout_ PULONG PrivilegeSetLength", "_Out_ PACCESS_MASK GrantedAccess", "_Out_ PNTSTATUS AccessStatus"], "addr": 655280}, "ZwAlpcCreatePort": {"args": ["_Out_ PHANDLE PortHandle", "_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes", "_In_opt_ PALPC_PORT_ATTRIBUTES PortAttributes"], "addr": 656048}, "ZwAlpcDeleteSectionView": {"args": ["_In_ HANDLE PortHandle", "_Reserved_ ULONG Flags", "_In_ PVOID ViewBase"], "addr": 656272}, "ZwAlpcSendWaitReceivePort": {"args": ["_In_ HANDLE PortHandle", "_In_ ULONG Flags", "_In_reads_bytes_opt_(SendMessage->u1.s1.TotalLength) PPORT_MESSAGE SendMessage", "_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES SendMessageAttributes", "_Out_writes_bytes_to_opt_(*BufferLength,*BufferLength) PPORT_MESSAGE ReceiveMessage", "_Inout_opt_ PSIZE_T BufferLength", "_Inout_opt_ PALPC_MESSAGE_ATTRIBUTES ReceiveMessageAttributes", "_In_opt_ PLARGE_INTEGER Timeout"], "addr": 656592}, "ZwAlpcSetInformation": {"args": ["_In_ HANDLE PortHandle", "_In_ __drv_strictTypeMatch(__drv_typeConst) ALPC_PORT_INFORMATION_CLASS PortInformationClass", "_In_reads_bytes_opt_(Length) PVOID PortInformation", "_In_ ULONG Length"], "addr": 656624}, "ZwCancelIoFileEx": {"args": ["_In_ HANDLE FileHandle", "_In_opt_ PIO_STATUS_BLOCK IoRequestToCancel", "_Out_ PIO_STATUS_BLOCK IoStatusBlock"], "addr": 656784}, "ZwCommitEnlistment": {"args": ["_In_ HANDLE EnlistmentHandle", "_In_opt_ PLARGE_INTEGER TmVirtualClock"], "addr": 657008}, "ZwConnectPort": {"args": ["_Out_ PHANDLE PortHandle", "_In_ PUNICODE_STRING PortName", "_In_ PSECURITY_QUALITY_OF_SERVICE SecurityQos", "_Inout_opt_ PPORT_VIEW ClientView", "_Inout_opt_ PREMOTE_PORT_VIEW ServerView", "_Out_opt_ PULONG MaxMessageLength", "_Inout_updates_bytes_to_opt_(*ConnectionInformationLength,*ConnectionInformationLength)", "PVOID ConnectionInformation", "_Inout_opt_ PULONG ConnectionInformationLength"], "addr": 657296}, "ZwCreateCrossVmEvent": {"args": [], "addr": 657456}, "ZwCreateDirectoryObject": {"args": ["_Out_ PHANDLE DirectoryHandle", "_In_ ACCESS_MASK DesiredAccess", "_In_ POBJECT_ATTRIBUTES ObjectAttributes"], "addr": 657552}, "ZwCreateJobObject": {"args": ["_Out_ PHANDLE JobHandle", "_In_ ACCESS_MASK DesiredAccess", "_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes"], "addr": 657808}, "ZwCreatePartition": {"args": ["_In_opt_ HANDLE ParentPartitionHandle", "_Out_ PHANDLE PartitionHandle", "_In_ ACCESS_MASK DesiredAccess", "_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes", "_In_ ULONG PreferredNode"], "addr": 658096}, "ZwCreatePort": {"args": ["_Out_ PHANDLE PortHandle", "_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes", "_In_ ULONG MaxConnectionInfoLength", "_In_ ULONG MaxMessageLength", "_In_opt_ ULONG MaxPoolUsage"], "addr": 658128}, "ZwCreateProcess": {"args": ["_Out_ PHANDLE ProcessHandle", "_In_ ACCESS_MASK DesiredAccess", "_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes", "_In_ HANDLE ParentProcess", "_In_ BOOLEAN InheritObjectTable", "_In_opt_ HANDLE SectionHandle", "_In_opt_ HANDLE DebugPort", "_In_opt_ HANDLE TokenHandle"], "addr": 658192}, "ZwCreateThreadEx": {"args": ["_Out_ PHANDLE ThreadHandle", "_In_ ACCESS_MASK DesiredAccess", "_In_opt_ POBJECT_ATTRIBUTES ObjectAttributes", "_In_ HANDLE ProcessHandle", "_In_ PVOID /* PUSER_THREAD_START_ROUTINE */ StartRoutine", "_In_opt_ PVOID Argument", "_In_ ULONG CreateFlags", "_In_ SIZE_T ZeroBits", "_In_ SIZE_T StackSize", "_In_ SIZE_T MaximumStackSize", "_In_opt_ PPS_ATTRIBUTE_LIST AttributeList"], "addr": 658480}, "ZwCreateTimer2": {"args": ["_Out_ PHANDLE TimerHandle", "_In_opt_ PVOID Reserved1", "_In_opt_ PVOID Reserved2", "_In_ ULONG Attributes", "_In_ ACCESS_MASK DesiredAccess"], "addr": 658576}, "ZwDeletePrivateNamespace": {"args": ["_In_ HANDLE NamespaceHandle"], "addr": 659152}, "ZwDeleteValueKey": {"args": ["_In_ HANDLE KeyHandle", "_In_ PUNICODE_STRING ValueName"], "addr": 659184}, "ZwDeleteWnfStateName": {"args": ["_In_ PCWNF_STATE_NAME StateName"], "addr": 659248}, "ZwDisplayString": {"args": ["_In_ PUNICODE_STRING String"], "addr": 659344}, "ZwEnumerateDriverEntries": {"args": ["_Out_writes_bytes_opt_(*BufferLength) PVOID Buffer", "_Inout_ PULONG BufferLength"], "addr": 659472}, "ZwExtendSection": {"args": ["_In_ HANDLE SectionHandle", "_Inout_ PLARGE_INTEGER NewSectionSize"], "addr": 659568}, "ZwFlushVirtualMemory": {"args": ["_In_ HANDLE ProcessHandle", "_Inout_ PVOID *BaseAddress", "_Inout_ PSIZE_T RegionSize", "_Out_ PIO_STATUS_BLOCK IoStatus"], "addr": 659856}, "ZwGetContextThread": {"args": ["_In_ HANDLE ThreadHandle", "_Inout_ PCONTEXT ThreadContext"], "addr": 660080}, "ZwGetCurrentProcessorNumber": {"args": ["_Out_ PPROCESSOR_NUMBER ProcNumber"], "addr": 660112}, "ZwGetCurrentProcessorNumberEx": {"args": ["_Out_ PPROCESSOR_NUMBER ProcNumber"], "addr": 660144}, "ZwGetMUIRegistryInfo": {"args": ["_In_ ULONG Flags", "_Inout_opt_ ULONG *DataSize", "_Inout_updates_bytes_opt_(*DataSize) PVOID Data"], "addr": 660208}, "ZwIsSystemResumeAutomatic": {"args": [], "addr": 660592}, "ZwIsUILanguageComitted": {"args": ["VOID"], "addr": 660624}, "ZwLockRegistryKey": {"args": ["_In_ HANDLE KeyHandle"], "addr": 660944}, "ZwMapViewOfSectionEx": {"args": [], "addr": 661200}, "ZwModifyBootEntry": {"args": ["_In_ PBOOT_ENTRY BootEntry"], "addr": 661232}, "ZwNotifyChangeKey": {"args": ["_In_ HANDLE KeyHandle", "_In_opt_ HANDLE Event", "_In_opt_ PIO_APC_ROUTINE ApcRoutine", "_In_opt_ PVOID ApcContext", "_Out_ PIO_STATUS_BLOCK IoStatusBlock", "_In_ ULONG CompletionFilter", "_In_ BOOLEAN WatchTree", "_Out_writes_bytes_opt_(BufferSize) PVOID Buffer", "_In_ ULONG BufferSize", "_In_ BOOLEAN Asynchronous"], "addr": 661360}, "ZwOpenCpuPartition": {"args": [], "addr": 661456}, "ZwOpenObjectAuditAlarm": {"args": ["_In_ PUNICODE_STRING SubsystemName", "_In_opt_ PVOID HandleId", "_In_ PUNICODE_STRING ObjectTypeName", "_In_ PUNICODE_STRING ObjectName", "_In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor", "_In_ HANDLE ClientToken", "_In_ ACCESS_MASK DesiredAccess", "_In_ ACCESS_MASK GrantedAccess", "_In_opt_ PPRIVILEGE_SET Privileges", "_In_ BOOLEAN ObjectCreation", "_In_ BOOLEAN AccessGranted", "_Out_ PBOOLEAN GenerateOnClose"], "addr": 661776}, "ZwPrepareComplete": {"args": ["_In_ HANDLE EnlistmentHandle", "_In_opt_ PLARGE_INTEGER TmVirtualClock"], "addr": 662288}, "ZwPrepareEnlistment": {"args": ["_In_ HANDLE EnlistmentHandle", "_In_opt_ PLARGE_INTEGER TmVirtualClock"], "addr": 662320}, "ZwPrivilegedServiceAuditAlarm": {"args": ["_In_ PUNICODE_STRING SubsystemName", "_In_ PUNICODE_STRING ServiceName", "_In_ HANDLE ClientToken", "_In_ PPRIVILEGE_SET Privileges", "_In_ BOOLEAN AccessGranted"], "addr": 662416}, "ZwQueryEaFile": {"args": ["_In_ HANDLE FileHandle", "_Out_ PIO_STATUS_BLOCK IoStatusBlock", "_Out_writes_bytes_(Length) PVOID Buffer", "_In_ ULONG Length", "_In_ BOOLEAN ReturnSingleEntry", "_In_reads_bytes_opt_(EaListLength) PVOID EaList", "_In_ ULONG EaListLength", "_In_opt_ PULONG EaIndex", "_In_ BOOLEAN RestartScan"], "addr": 662800}, "ZwQueryFullAttributesFile": {"args": ["_In_ POBJECT_ATTRIBUTES ObjectAttributes", "_Out_ PFILE_NETWORK_OPEN_INFORMATION FileInformation"], "addr": 662832}, "ZwQueryInformationByName": {"args": [], "addr": 662896}, "ZwQueryInformationResourceManager": {"args": ["_In_ HANDLE ResourceManagerHandle", "_In_ RESOURCEMANAGER_INFORMATION_CLASS ResourceManagerInformationClass", "_Out_writes_bytes_(ResourceManagerInformationLength) PVOID ResourceManagerInformation", "_In_ ULONG ResourceManagerInformationLength", "_Out_opt_ PULONG ReturnLength"], "addr": 663056}, "ZwQueryInformationTransaction": {"args": ["_In_ HANDLE TransactionManagerHandle", "_In_ TRANSACTIONMANAGER_INFORMATION_CLASS TransactionManagerInformationClass", "_Out_writes_bytes_(TransactionManagerInformationLength) PVOID TransactionManagerInformation", "_In_ ULONG TransactionManagerInformationLength", "_Out_ PULONG ReturnLength"], "addr": 663088}, "ZwQueryInformationTransactionManager": {"args": ["_In_ HANDLE TransactionManagerHandle", "_In_ TRANSACTIONMANAGER_INFORMATION_CLASS TransactionManagerInformationClass", "_Out_writes_bytes_(TransactionManagerInformationLength) PVOID TransactionManagerInformation", "_In_ ULONG TransactionManagerInformationLength", "_Out_ PULONG ReturnLength"], "addr": 663120}, "ZwQueryInstallUILanguage": {"args": ["_Out_ LANGID *InstallUILanguageId"], "addr": 663184}, "ZwQueryIoRingCapabilities": {"args": [], "addr": 663280}, "ZwQueryMultipleValueKey": {"args": ["_In_ HANDLE KeyHandle", "_Inout_updates_(EntryCount) PKEY_VALUE_ENTRY ValueEntries", "_In_ ULONG EntryCount", "_Out_writes_bytes_(*BufferLength) PVOID ValueBuffer", "_Inout_ PULONG BufferLength", "_Out_opt_ PULONG RequiredBufferLength"], "addr": 663344}, "ZwQueryMutant": {"args": ["_In_ HANDLE MutantHandle", "_In_ MUTANT_INFORMATION_CLASS MutantInformationClass", "_Out_writes_bytes_(MutantInformationLength) PVOID MutantInformation", "_In_ ULONG MutantInformationLength", "_Out_opt_ PULONG ReturnLength"], "addr": 663376}, "ZwQueryOpenSubKeysEx": {"args": ["_In_ POBJECT_ATTRIBUTES TargetKey", "_In_ ULONG BufferLength", "_Out_writes_bytes_(BufferLength) PVOID Buffer", "_Out_ PULONG RequiredSize"], "addr": 663440}, "ZwQuerySecurityPolicy": {"args": [], "addr": 663600}, "ZwQuerySemaphore": {"args": ["_In_ HANDLE SemaphoreHandle", "_In_ SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass", "_Out_writes_bytes_(SemaphoreInformationLength) PVOID SemaphoreInformation", "_In_ ULONG SemaphoreInformationLength", "_Out_opt_ PULONG ReturnLength"], "addr": 663632}, "ZwQuerySymbolicLinkObject": {"args": ["_In_ HANDLE LinkHandle", "_Inout_ PUNICODE_STRING LinkTarget", "_Out_opt_ PULONG ReturnedLength"], "addr": 663664}, "ZwQuerySystemEnvironmentValueEx": {"args": ["_In_ PUNICODE_STRING VariableName", "_In_ LPGUID VendorGuid", "_Out_writes_bytes_opt_(*ValueLength) PVOID Value", "_Inout_ PULONG ValueLength", "_Out_opt_ PULONG Attributes"], "addr": 663728}, "ZwQueryWnfStateData": {"args": ["_In_ PCWNF_STATE_NAME StateName", "_In_opt_ PCWNF_TYPE_ID TypeId", "_In_opt_ const VOID* ExplicitScope", "_Out_ PWNF_CHANGE_STAMP ChangeStamp", "_Out_writes_bytes_to_opt_(*BufferSize,*BufferSize) PVOID Buffer", "_Inout_ PULONG BufferSize"], "addr": 663824}, "ZwQueryWnfStateNameInformation": {"args": ["_In_ PCWNF_STATE_NAME StateName", "_In_ WNF_STATE_NAME_INFORMATION NameInfoClass", "_In_opt_ const PVOID ExplicitScope", "_Out_writes_bytes_(InfoBufferSize) PVOID InfoBuffer", "_In_ ULONG InfoBufferSize"], "addr": 663856}, "ZwQueueApcThreadEx2": {"args": [], "addr": 663920}, "ZwReplacePartitionUnit": {"args": ["_In_ PUNICODE_STRING TargetInstancePath", "_In_ PUNICODE_STRING SpareInstancePath", "_In_ ULONG Flags"], "addr": 664464}, "ZwReplyWaitReplyPort": {"args": ["_In_ HANDLE PortHandle", "_Inout_ PPORT_MESSAGE ReplyMessage"], "addr": 664496}, "ZwRestoreKey": {"args": ["_In_ HANDLE KeyHandle", "_In_opt_ HANDLE FileHandle", "_In_ ULONG Flags"], "addr": 664624}, "ZwRevertContainerImpersonation": {"args": ["VOID"], "addr": 664688}, "ZwRollforwardTransactionManager": {"args": ["_In_ HANDLE TransactionManagerHandle", "_In_opt_ PLARGE_INTEGER TmVirtualClock"], "addr": 664848}, "ZwSetBootOptions": {"args": ["_In_ PBOOT_OPTIONS BootOptions", "_In_ ULONG FieldsToChange"], "addr": 665072}, "ZwSetDebugFilterState": {"args": ["_In_ ULONG ComponentId", "_In_ ULONG Level", "_In_ BOOLEAN State"], "addr": 665200}, "ZwSetHighEventPair": {"args": ["_In_ HANDLE EventPairHandle"], "addr": 665392}, "ZwSetInformationDebugObject": {"args": [], "addr": 665520}, "ZwSetInformationIoRing": {"args": [], "addr": 665584}, "ZwSetInformationTransaction": {"args": ["_In_opt_ HANDLE TmHandle", "_In_ TRANSACTIONMANAGER_INFORMATION_CLASS TransactionManagerInformationClass", "_In_reads_bytes_(TransactionManagerInformationLength) PVOID TransactionManagerInformation", "_In_ ULONG TransactionManagerInformationLength"], "addr": 665776}, "ZwSetIntervalProfile": {"args": ["_In_ ULONG Interval", "_In_ KPROFILE_SOURCE Source"], "addr": 665904}, "ZwSetLdtEntries": {"args": ["_In_ ULONG Selector0", "_In_ ULONG Entry0Low", "_In_ ULONG Entry0Hi", "_In_ ULONG Selector1", "_In_ ULONG Entry1Low", "_In_ ULONG Entry1Hi"], "addr": 666000}, "ZwSetThreadExecutionState": {"args": ["_In_ EXECUTION_STATE NewFlags, // ES_xxx flags\n _Out_ PEXECUTION_STATE PreviousFlags"], "addr": 666320}, "ZwSetTimer2": {"args": ["_In_ HANDLE TimerHandle", "_In_ PLARGE_INTEGER DueTime", "_In_opt_ PLARGE_INTEGER Period", "_In_ PT2_SET_PARAMETERS Parameters"], "addr": 666352}, "ZwSetTimerResolution": {"args": ["_In_ ULONG DesiredTime", "_In_ BOOLEAN SetResolution", "_Out_ PULONG ActualTime"], "addr": 666416}, "ZwSuspendProcess": {"args": ["_In_ HANDLE ProcessHandle"], "addr": 666800}, "ZwSuspendThread": {"args": ["_In_ HANDLE ThreadHandle", "_Out_opt_ PULONG PreviousSuspendCount"], "addr": 666832}, "ZwWaitForAlertByThreadId": {"args": [], "addr": 667472}}, "win32u.dll": {"NtGdiGetCharSet": {"args": ["_In_ HDC hdc"], "addr": 5504}, "NtUserSetWindowPos": {"args": [], "addr": 6336}, "NtGdiCombineRgn": {"args": ["_In_ HRGN hrgnDst", "_In_ HRGN hrgnSrc1", "_In_ HRGN hrgnSrc2", "_In_ int iMode"], "addr": 6784}, "NtUserScrollDC": {"args": [], "addr": 8480}, "NtUserGetObjectInformation": {"args": [], "addr": 8512}, "NtGdiCreateBitmap": {"args": ["_In_ HDC hdc", "_In_ UINT uiWidth", "_In_ UINT uiHeight", "_In_ DWORD Format", "_In_opt_ HANDLE hDxSharedSurface"], "addr": 8544}, "NtUserCreateWindowEx": {"args": [], "addr": 8832}, "NtGdiStretchDIBitsInternal": {"args": ["_In_ HDC hdc", "_In_ int xDst", "_In_ int yDst", "_In_ int cxDst", "_In_ int cyDst", "_In_ int xSrc", "_In_ int ySrc", "_In_ int cxSrc", "_In_ int cySrc", "_In_reads_bytes_opt_(cjMaxBits) LPBYTE pjInit", "_In_ LPBITMAPINFO pbmi", "_In_ DWORD dwUsage", "_In_ DWORD dwRop4", "_In_ UINT cjMaxInfo", "_In_ UINT cjMaxBits", "_In_ HANDLE hcmXform"], "addr": 9152}, "NtUserGetUpdateRgn": {"args": [], "addr": 9312}, "NtUserSetThreadDesktop": {"args": [], "addr": 9664}, "NtUserSetCursorIconData": {"args": [], "addr": 10144}, "NtUserSetWindowRgn": {"args": [], "addr": 11168}, "NtUserGetOpenClipboardWindow": {"args": [], "addr": 11584}, "NtUserPaintMenuBar": {"args": [], "addr": 12288}, "NtGdiFillPath": {"args": ["_In_ HDC hdc"], "addr": 13216}, "NtUserPaintDesktop": {"args": [], "addr": 13504}, "NtUserSetClipboardViewer": {"args": [], "addr": 13664}, "NtDCompositionRegisterVirtualDesktopVisual": {"args": [], "addr": 15200}, "NtDxgkConnectDoorbell": {"args": [], "addr": 15840}, "NtDxgkSubmitPresentBltToHwQueue": {"args": [], "addr": 16544}, "NtDxgkVailPromoteCompositionSurface": {"args": [], "addr": 16736}, "NtGdiAddRemoteFontToDC": {"args": ["_In_ HDC hdc", "_In_reads_bytes_(cjBuffer) PVOID pvBuffer", "_In_ ULONG cjBuffer", "_In_opt_ PUNIVERSAL_FONT_ID pufi"], "addr": 17632}, "NtGdiChangeGhostFont": {"args": ["_In_ KERNEL_PVOID *pfontID", "_In_ BOOL bLoad"], "addr": 18112}, "NtGdiCreateMetafileDC": {"args": ["_In_ HDC hdc"], "addr": 18496}, "NtGdiDdDDIAcquireKeyedMutex": {"args": [], "addr": 18944}, "NtGdiDdDDIAcquireSwapChain": {"args": [], "addr": 19008}, "NtGdiDdDDICreateKeyedMutex2": {"args": [], "addr": 19776}, "NtGdiDdDDIFlipOverlay": {"args": [], "addr": 20704}, "NtGdiDdDDIGetProcessDeviceRemovalSupport": {"args": [], "addr": 21248}, "NtGdiDdDDIGetSwapChainSurfacePhysicalAddress": {"args": [], "addr": 21568}, "NtGdiDdDDIOpenSynchronizationObject": {"args": [], "addr": 22528}, "NtGdiDdDDIQueryProtectedSessionInfoFromNtHandle": {"args": [], "addr": 23072}, "NtGdiDdDDIQueryStatistics": {"args": [], "addr": 23232}, "NtGdiDdDDIReleaseProcessVidPnSourceOwners": {"args": [], "addr": 23456}, "NtGdiDdDDIReleaseSwapChain": {"args": [], "addr": 23488}, "NtGdiDdDDISetContextSchedulingPriority": {"args": [], "addr": 23680}, "NtGdiDdDDISubmitCommandToHwQueue": {"args": [], "addr": 24512}, "NtGdiEllipse": {"args": ["_In_ HDC hdc", "_In_ int xLeft", "_In_ int yTop", "_In_ int xRight", "_In_ int yBottom"], "addr": 25344}, "NtGdiEnableEudc": {"args": ["_In_ BOOL"], "addr": 25376}, "NtGdiEudcLoadUnloadLink": {"args": ["_In_reads_opt_(cwcBaseFaceName) LPCWSTR pBaseFaceName", "_In_ UINT cwcBaseFaceName", "_In_reads_(cwcEudcFontPath) LPCWSTR pEudcFontPath", "_In_ UINT cwcEudcFontPath", "_In_ INT iPriority", "_In_ INT iFontLinkType", "_In_ BOOL bLoadLin"], "addr": 26560}, "NtGdiGetCertificateByHandle": {"args": [], "addr": 27168}, "NtGdiGetCurrentDpiInfo": {"args": ["_In_ HMONITOR hmon", "_Out_ DPI_INFORMATION* dpiInfo"], "addr": 27392}, "NtGdiGetMonitorID": {"args": ["_In_ HDC hdc", "_In_ DWORD dwSize", "_Out_writes_bytes_(dwSize) LPWSTR pszMonitorID"], "addr": 28064}, "NtGdiGetSuggestedOPMProtectedOutputArraySize": {"args": [], "addr": 28576}, "NtGdiMirrorWindowOrg": {"args": ["_In_ HDC hdc"], "addr": 29088}, "NtGdiSetPixelFormat": {"args": ["_In_ HDC hdc", "_In_ int ipfd"], "addr": 30464}, "NtGdiUpdateColors": {"args": ["_In_ HDC hdc"], "addr": 30944}, "NtMITSetInputObservationState": {"args": [], "addr": 32064}, "NtSetCompositionSurfaceBufferUsage": {"args": [], "addr": 34304}, "NtUserAcquireIAMKey": {"args": [], "addr": 34848}, "NtUserCanBrokerForceForeground": {"args": [], "addr": 35392}, "NtUserCheckProcessForClipboardAccess": {"args": [], "addr": 35616}, "NtUserCreateSystemThreads": {"args": [], "addr": 36352}, "NtUserDeferWindowDpiChanges": {"args": [], "addr": 36512}, "NtUserDisableProcessWindowFiltering": {"args": [], "addr": 36896}, "NtUserDoSoundDisconnect": {"args": [], "addr": 37152}, "NtUserEnableIAMAccess": {"args": [], "addr": 37728}, "NtUserEnumClipboardFormats": {"args": [], "addr": 38272}, "NtUserFrostCrashedWindow": {"args": [], "addr": 38432}, "NtUserGetKeyNameText": {"args": [], "addr": 39936}, "NtUserGetPointerDeviceCursors": {"args": [], "addr": 40448}, "NtUserGetPointerDeviceProperties": {"args": [], "addr": 40544}, "NtUserGetPointerProprietaryId": {"args": [], "addr": 40736}, "NtUserGetPrecisionTouchPadConfiguration": {"args": [], "addr": 40800}, "NtUserGetRegisteredRawInputDevices": {"args": [], "addr": 41216}, "NtUserGetWindowTrackInfoAsync": {"args": [], "addr": 42048}, "NtUserHidePointerContactVisualization": {"args": [], "addr": 42240}, "NtUserLinkDpiCursor": {"args": [], "addr": 43488}, "NtUserLockCursor": {"args": [], "addr": 43616}, "NtUserMenuItemFromPoint": {"args": [], "addr": 44096}, "NtUserReassociateQueueEventCompletionPacket": {"args": [], "addr": 45120}, "NtUserRegisterErrorReportingDialog": {"args": [], "addr": 45344}, "NtUserRemoteRedrawRectangle": {"args": [], "addr": 46400}, "NtUserSetCaretBlinkTime": {"args": [], "addr": 47360}, "NtUserSetClassWord": {"args": [], "addr": 47456}, "NtUserSetDialogSystemMenu": {"args": [], "addr": 47744}, "NtUserSetImeHotKey": {"args": [], "addr": 48160}, "NtUserSetObjectInformation": {"args": [], "addr": 48768}, "NtUserSetWindowCompositionTransition": {"args": [], "addr": 49696}, "NtUserSetWindowRgnEx": {"args": [], "addr": 49824}, "NtUserSetWindowStationUser": {"args": [], "addr": 49920}, "NtUserShellHandwritingDelegateInput": {"args": [], "addr": 49952}, "NtUserWaitAvailableMessageEx": {"args": [], "addr": 51520}}};
var funcs_map = {};
var register_args = ["rcx", "rdx", "r8", "r9"];
function lib_includes(libname, liblist) {
for (var i = 0; i < liblist.length; i++) {
if (libname.toLowerCase() == liblist[i].toLowerCase()) {
return true
}
}
return false
}
function func_includes(funcname, funclist) {
for (var i = 0; i < funclist.length; i++) {
if (funcname.toLowerCase() == funclist[i].toLowerCase()) {
return true
}
}
return false
}
function mutate_n(n, ratio){
return n + Math.floor(Math.random() * ratio) - ratio/2;
}
function mutate_buf(ptr, size, arg_i) {
let buf = Memory.readByteArray(ptr, size);
let buf_view = new Uint8Array(buf);
// deep copy buf
let new_buf = new ArrayBuffer(size);
let new_buf_view = new Uint8Array(new_buf);
for (let i = 0; i < size; i++) {
if (Math.random() < 0.7) {
new_buf_view[i] = buf_view[i];
}else{
new_buf_view[i] = mutate_n(buf_view[i], 10)
}
}
Memory.writeByteArray(ptr, new_buf_view);
console.log("Mutating buffer arg " + arg_i);
console.log("From:");
console.log(buf);
console.log("To:");
console.log(new_buf);
}
function mutate_args(context, args, f_args_infos) {
let syscall_args = ["rcx", "rdx", "r8", "r9"];
for (let i = 0; i < args.length; i++) {
if (Math.random() < 0.02) {
try{
Memory.readPointer(args[i])
mutate_buf(Memory.readPointer(args[i]), 0x100, i);
}catch(e){
continue;
}
}
else if (i < syscall_args.length && Math.random() < 0.01 ) {
let reg_name = syscall_args[i];
// convert to int
let reg_val = parseInt(args[i]);
let new_val = mutate_n(reg_val, 10000);
context[reg_name] = new_val;
let hex_val = "0x" + new_val.toString(16);
console.log("Mutating " + reg_name + " from " + args[i] + " to " + hex_val);
}
}
}
setTimeout(function() {
Process.enumerateModules({
onMatch: function(module) {
//console.log("Found " + module.name + " at " + module.base);
if (lib_includes(module.name, Object.keys(sys_data))) {
let exports = module.enumerateExports();
let module_name = module.name.toLowerCase();
for (let f_name in sys_data[module_name]) {
// call random function
let infos = sys_data[module_name][f_name];
let ea = infos["addr"]
ea = module.base.add(ptr(ea));
funcs_map[ea] = [f_name, module.name]
try {
//console.log("Hooking " + f_name + " at " + ea);
Interceptor.attach(ea, {
onEnter: function(args) {
let f_name = funcs_map[this.context.pc][0];
let module_name = funcs_map[this.context.pc][1];
console.log(f_name);
let rcx = this.context.rcx;
let rdx = this.context.rdx;
let r8 = this.context.r8;
let r9 = this.context.r9;
let syscall_args = [rcx, rdx, r8, r9];
let arg_index = 0;
let stack_arg = Memory.readPointer(this.context.rsp.add(arg_index * Process.pointerSize));
while (stack_arg != 0 && arg_index < 4) {
stack_arg = Memory.readPointer(this.context.rsp.add(arg_index * Process.pointerSize));
syscall_args.push(stack_arg);
arg_index++;
}
let f_args_infos = sys_data[module_name][f_name]["args"];
for (let i = 0; i < syscall_args.length; i++) {
let arg_info = "";
if (i < f_args_infos.length) {
arg_info = f_args_infos[i];
}
console.log("Arg " + i + ": " + " " + arg_info + " " + syscall_args[i]);
}
mutate_args(this.context, syscall_args, f_args_infos);
}
});
} catch (e) {
console.log("Error: " + e);
}
}
}
},
onComplete: function() {
}
});
}, 500);