// ShellCode_Ntdll.cpp : 定义控制台应用程序的入口点。
//
#include "shellcode_base.h"
#include <stdio.h>
#include <tchar.h>
#include <stdint.h>

#ifndef NTLIB_ERROR
# define NTLIB_ERROR ((unsigned int) (-1))
#endif  // NTLIB_ERROR

#define NT_SUCCESS(x) ((x) >= 0)

typedef struct Func {
	// kernel32
	_GetProcAddress GetProcAddress;
	_LoadLibraryA LoadLibraryA;
	// ntdll
	_RtlDecompressBuffer RtlDecompressBuffer;
} func_t, *func_p;

#ifdef __cplusplus
extern "C" {
#endif  // __cplusplus
	unsigned int __cdecl ntdll_entry(const void *source, unsigned int srclen, void *destination, unsigned int dstlen);
	unsigned int ntdll_main(const void *source, unsigned int srclen, void *destination, unsigned int dstlen);
	void ntdll_end();
	void init_func(func_p func);
#ifdef __cplusplus
}
#endif  // __cplusplus

#pragma optimize("ts", on)

unsigned int ntdll_entry(const void *source, unsigned int srclen, void *destination, unsigned int dstlen) {
	return ntdll_main(source, srclen, destination, dstlen);
};

void init_func(func_p func) {
	HMODULE kernel32 = get_kernel32_base();
	func->GetProcAddress = (_GetProcAddress)get_proc_address_from_hash(kernel32, GetProcAddress_Hash, 0);
	func->LoadLibraryA = (_LoadLibraryA)get_proc_address_from_hash(kernel32, LoadLibraryA_Hash, func->GetProcAddress);
	char s[] = { 'n', 't', 'd', 'l', 'l', 0 };
	HMODULE ntdll = func->LoadLibraryA(s);
	func->RtlDecompressBuffer = (_RtlDecompressBuffer)get_proc_address_from_hash(ntdll, RtlDecompressBuffer_Hash,
		func->GetProcAddress);
}

unsigned int ntdll_main(const void *source, unsigned int srclen, void *destination, unsigned int dstlen) {
	func_t func;
	init_func(&func);
	ULONG finalLen;
	NTSTATUS status = func.RtlDecompressBuffer(COMPRESSION_FORMAT_LZNT1 | COMPRESSION_ENGINE_MAXIMUM,
		(PUCHAR)destination,
		dstlen,
		(PUCHAR)source,
		srclen,
		&finalLen);
	if (!NT_SUCCESS(status) || finalLen != dstlen) return NTLIB_ERROR;
	return dstlen;
};

void ntdll_end() {
};

#pragma optimize("ts", off)

#ifdef _WIN64
# define OUT_FILE_NAME "ntdll_x64.bin"
#else
# define OUT_FILE_NAME "ntdll_x86.bin"
#endif

#define HASH(x) printf("#define %s_Hash 0x%X\n", x, calc_hash(x))

int _tmain(int argc, _TCHAR* argv[])
{
	//HASH("VirtualAlloc");
	//HASH("VirtualFree");
	uint8_t *start = (uint8_t *)ntdll_entry;
	uint8_t *end = (uint8_t *)ntdll_end;
	size_t size = end - start;
	printf("[*] ntdll shellcode start = %p, end = %p, size = %d\n", start, end, size);

	FILE *file = 0;
	fopen_s(&file, OUT_FILE_NAME, "wb");
	if (file == 0) {
		printf("[!] create out file error. file name = %s\n", OUT_FILE_NAME);
		return 0;
	}
	fwrite(start, 1, size, file);
	fflush(file);
	fclose(file);
	printf("[*] generate ntdll shellcode sucess.\n");
	return 0;
}