Documentation ¶
Index ¶
- func GetBaseAddrOfLoadedDll(name string) (uintptr, error)
- func GetSyscallFromName(function string, exports *[]Exportfunc) (byte, uintptr, error)
- func GetSyscallNumbers(exports *[]Exportfunc) error
- func IndirectSyscall(ntapi string, argh ...uintptr) (errcode uint32, err error)
- func ListDllFromPEB() []dllstruct
- func PrintModules()
- func Syscall(ntapi string, argh ...uintptr) (errcode uint32, err error)
- func UnhookSyscalls(exports *[]Exportfunc) error
- type Exportfunc
- type IMAGE_EXPORT_DIRECTORY
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func GetBaseAddrOfLoadedDll ¶
returns address of a loaded module Example : addr, err := getBaseAddrOfLoadedDll("ntdll.dll")
func GetSyscallFromName ¶ added in v0.9.0
func GetSyscallFromName(function string, exports *[]Exportfunc) (byte, uintptr, error)
func GetSyscallNumbers ¶
func GetSyscallNumbers(exports *[]Exportfunc) error
func IndirectSyscall ¶ added in v0.9.0
func ListDllFromPEB ¶
func ListDllFromPEB() []dllstruct
adds all loaded modules and their base addresses in a slice
func Syscall ¶
Syscall calls the system function specified by callid with n arguments. Works much the same as syscall.Syscall - return value is the call error code and optional error text. All args are uintptrs to make it easy.
func UnhookSyscalls ¶
func UnhookSyscalls(exports *[]Exportfunc) error
Beta Version, This needs a lot of testing. I only tested this on win11 x64 and limited AVs
Types ¶
type Exportfunc ¶ added in v0.7.0
type Exportfunc struct {
// contains filtered or unexported fields
}
func GetModuleExports ¶
func GetModuleExports(name string) ([]Exportfunc, error)
Loops through the exports and returns it into a slice Any future queries or any unhooking will be happening on the slice and not the dll itself
type IMAGE_EXPORT_DIRECTORY ¶
type IMAGE_EXPORT_DIRECTORY struct { Characteristics uint32 // 0x0 TimeDateStamp uint32 // 0x4 MajorVersion uint16 // 0x8 MinorVersion uint16 // 0xa Name uint32 // 0xc Base uint32 // 0x10 NumberOfFunctions uint32 // 0x14 NumberOfNames uint32 // 0x18 AddressOfFunctions uint32 // 0x1c AddressOfNames uint32 // 0x20 AddressOfNameOrdinals uint32 // 0x24 }
func GetImageExportDirectory ¶
func GetImageExportDirectory(name string) (*IMAGE_EXPORT_DIRECTORY, error)
Get Image Export directory. We are interested in - AddressofFunctions - AddressOfNames - AddressOFNameOrdinals (maybe in the future) - Number of functions