[gigajew]

You can use the hooked module SbieDll.dll if the application was started with Sandboxie, to log messages in it's own dedicated window (this creates an opportunity for social engineering)

[Dalvik]

Code

return (T)(Marshal.GetDelegateForFunctionPointer(procAddress, typeof(T)) as object);

Why not just:

Code

return (T)Marshal.GetDelegateForFunctionPointer(procAddress, typeof(T));

[0xDEAD10CC]

Code

return (T)(Marshal.GetDelegateForFunctionPointer(procAddress, typeof(T)) as object);

Why not just:

Code

return (T)Marshal.GetDelegateForFunctionPointer(procAddress, typeof(T));

Because you cannot cast Delegate to typeof(T) directly like this. The reason he can't use as on T directly though is because of his lack of type constraints that restrict it to be a reference type, which a Delegate type is... I would have done it like this:

Code

internal static T CreateDelegateFunc<T>(string library, string function)
    where T : class
{
    IntPtr moduleHandle = GetModuleHandle(library);
    if (moduleHandle == IntPtr.Zero)
        return null;

    IntPtr procAddress = GetProcAddress(moduleHandle, function);
    if (procAddress == IntPtr.Zero)
        return null;

    return Marshal.GetDelegateForFunctionPointer(procAddress, typeof(T)) as T;
}

Instead of boxing it... And I also gave the function a more appropriate name.

Code

CreateDelegateFunc<Beep>("kernel32.dll", "Beep")?.Invoke(700, 500);

[Dalvik]

- Absolute facts -

Ah you're right I forgot about the type constraint that was required for that.

[int]

is this the new exploit meta?

[gigajew]

If you're going to bitch about type constraints you should also know that it requires the c# language version 7.3 or higher to use (for abstract delegate type constraint) which is not really considered a feasible requirement for a snippet like this. I want people who use VS 2012 to be able to use my code with minimal modifications if they need to

[0xDEAD10CC]

If you're going to bitch about type constraints you should also know that it requires the c# language version 7.3 or higher to use (for abstract delegate type constraint) which is not really considered a feasible requirement for a snippet like this. I want people who use VS 2012 to be able to use my code with minimal modifications if they need to

Really now? 🤨



You really have absolutely no clue about C# do you? I'm not using a delegate type constraint. Lastly, that compiled in VS 2008 using .NET 3.5 (C# 3.0)... Please stop posting against this now. Use a compiler and test your theories... class indicates that T must be a reference type, and since the semantics behind the as keyword require that the type can be assigned null (not a valuetype value) -- I'll let you put 2 and 2 together, hopefully this time you can.

Even without delegate type constraints or any of that, you can simply:

Code

if (!typeof(Delegate).IsAssignableFrom(typeof(T)))
    throw new InvalidOperationException("Generic type must be a delegate type");

---

The constraint I was using came out long before null propagation, which is what you're obviously allowing as it's in your example code for Invoke().

[gigajew]

Okay, I was wrong and I did not realize you could type constraint using 'class' and changing the cast as T instead of (T). I also changed it to return null as you had done. Anyway, I was playing around with ESET/Nod32 and looking at their library responsible for hooks in processes and realized they export a function called UninstallHooks() with no parameters. This could actually work:

Code

   /// <summary>
   /// ESET/Nod32 hook uninstall signature
   /// </summary>
   [SuppressUnmanagedCodeSecurity]
   private delegate void UninstallHooks();

   /// <summary>
   /// Remove ESET/Nod32 hooks if possible
   /// </summary>
   static void RemoveNod32Hooks()
   {
       CreateApi<UninstallHooks>("eplgHooks.dll", "UninstallHooks")?.Invoke();
   }

[0xDEAD10CC]

Okay, I was wrong and I did not realize you could type constraint using 'class' and changing the cast as T instead of (T). I also changed it to return null as you had done. Anyway, I was playing around with ESET/Nod32 and looking at their library responsible for hooks in processes and realized they export a function called UninstallHooks() with no parameters. This could actually work:

Code

   /// <summary>
   /// ESET/Nod32 hook uninstall signature
   /// </summary>
   [SuppressUnmanagedCodeSecurity]
   private delegate void UninstallHooks();

   /// <summary>
   /// Remove ESET/Nod32 hooks if possible
   /// </summary>
   static void RemoveNod32Hooks()
   {
       CreateApi<UninstallHooks>("eplgHooks.dll", "UninstallHooks")?.Invoke();
   }

The way to find out would be to try. Seems very odd that someone would export that in an AV solution. I don't use that one so I don't know.

[gigajew]

ESET is a pretty reputable AV company, I would probably say it's one of the better ones out there having tried it for a couple of years. Now I stay pretty free of infections in general with the default AV software because I don't really do a lot of fishy things online. But ESET has successfully removed any suspicious executables I've had in the past.

A side note: AVG and Avast seem to be pretty much the same software in the base. Edit: just read about it Avast bought AVG so if you happen to find an exploit in either of the platforms you hit two flies in one. They both share their hook names: aswhookx.dll, and aswhooka.dll which I'm guessing since they depend on ntdll CreateThread I suppose they put their initialization in DllMain() and don't expose any exports

[Dalvik]

Lastly, that compiled in VS 2008 using .NET 3.5 (C# 3.0)...

Any reason you're using VS 2008 over 2017?

---

The constraint I was using came out long before null propagation, which is what you're obviously allowing as it's in your example code for Invoke().

That is one sexy theme. Are you using VS code? Or is it just a custom theme for VS?

[0xDEAD10CC]

Any reason you're using VS 2008 over 2017?

---

That is one sexy theme. Are you using VS code? Or is it just a custom theme for VS?

1) For the demonstration that class constraint works on older C# language versions, .NET framework, and IDE's. (Read above - I could have changed settings in 2017 but to immediately illustrate the point I just compiled the code in 2008 which will never support C# 7+.) I still have 2017 Enterprise and Rider 2018. I keep 2015 Enterprise though as well for driver development.

2) That's still my VS 2008 (which I keep around for .NET compact framework library work because there's work I still need to maintain on Windows CE)

:)

[Dalvik]

1) For the demonstration that class constraint works on older C# language versions, .NET framework, and IDE's. (Read above - I could have changed settings in 2017 but to immediately illustrate the point I just compiled the code in 2008 which will never support C# 7+.) I still have 2017 Enterprise and Rider 2018. I keep 2015 Enterprise though as well for driver development.

Why keep around older versions? I assume 2017 also works for driver development or am I completely wrong here?

2) That's still my VS 2008 (which I keep around for .NET compact framework library work because there's work I still need to maintain on Windows CE)

Ah okay. I assumed that since the theme was different that you used a different IDE, and it looked similar to VSC.

[0xDEAD10CC]

Why keep around older versions? I assume 2017 also works for driver development or am I completely wrong here?


Ah okay. I assumed that since the theme was different that you used a different IDE, and it looked similar to VSC.

No it doesn't, you're wrong. (https://stackoverflow.com/questions/4369...alling-wdk) Only 2015 has the template AFAIK, and I also only have Installshield LE on my 2015 installation. Compact framework projects will not work on newer VS versions either unless you hack it and I'd rather just leave it alone.

[Dalvik]

No it doesn't, you're wrong. (https://stackoverflow.com/questions/4369...alling-wdk) Only 2015 has the template AFAIK, and I also only have Installshield LE on my 2015 installation. Compact framework projects will not work on newer VS versions either unless you hack it and I'd rather just leave it alone.

Well I stand corrected. Though in my defense, driver development is basically Chinese to me.