using System; using System.Diagnostics; namespace SharpHellsGate { /// /// Util class. Used mainly for debug output. /// public class Util { /// /// Structure used to store the name, address, system call and hash of a native Windows function. /// public struct APITableEntry { public string Name; public Int64 Address; public Int16 Syscall; public UInt64 Hash; } /// /// DJB2 Hash of the NtAllocateVirtualMemory function name. /// public static UInt64 NtAllocateVirtualMemoryHash { get; } = 0xf5bd373480a6b89b; /// /// DJB2 Hash of the NtProtectVirtualMemory function name. /// public static UInt64 NtProtectVirtualMemoryHash { get; } = 0x858bcb1046fb6a37; /// /// DJB2 Hash of the NtCreateThreadEx function name. /// public static UInt64 NtCreateThreadExHash { get; } = 0x64dc7db288c5015f; /// /// DJB2 Hash of the NtWaitForSingleObject function name. /// public static UInt64 NtWaitForSingleObjectHash { get; } = 0xc6a2fa174e551bcb; /// /// Log an informational information. /// /// Message to log. /// Indentation level. /// Message prefix. public static void LogInfo(string msg, int indent = 0, string prefix = "[>]") { #if DEBUG if (string.IsNullOrEmpty(msg)) return; LogMessage(msg, prefix, indent, ConsoleColor.Blue); #endif } /// /// Log an error information. /// /// Message to log. /// Indentation level. /// Message prefix. public static void LogError(string msg, int indent = 0, string prefix = "[-]") { #if DEBUG if (string.IsNullOrEmpty(msg)) return; LogMessage(msg, prefix, indent, ConsoleColor.Red); #endif } /// /// Log a success information. /// /// Message to log. /// Indentation level. /// Message prefix public static void LogSuccess(string msg, int indent = 0, string prefix = "[+]") { #if DEBUG if (string.IsNullOrEmpty(msg)) return; LogMessage(msg, prefix, indent, ConsoleColor.Green); #endif } /// /// Log a string to the console and to the debugger. /// /// Message to log. /// Indentation level. /// Message prefix. /// The color of the prifix on the console. private static void LogMessage(string msg, string prefix, int indent, ConsoleColor color) { // Indent Console.Write(new String(' ', indent)); Trace.Write(new String(' ', indent)); // Color and prefix Trace.Write(prefix); Console.ForegroundColor = color; Console.Write(prefix); Console.ResetColor(); // Message Console.WriteLine($" {msg}"); Trace.WriteLine($" {msg}"); } /// /// Revisited DJB2 algorithm. /// /// The ASCII name of a function. /// The djb2 hash of the function name. public static UInt64 GetFunctionDJB2Hash(string FunctionName) { if (string.IsNullOrEmpty(FunctionName)) return 0; UInt64 hash = 0x7734773477347734; foreach (char c in FunctionName) hash = ((hash << 0x5) + hash) + (byte)c; return hash; } } }