Compile Time Obfuscation in Meterpreter

.gitignore

@@ -4,3 +4,4 @@
 .vs
 *.user
 .vscode
+**/.env

c/meterpreter/source/metsrv/util_b64.c

@@ -0,0 +1,53 @@
+#include "util_b64.h"
+#include <string.h>
+#include <stdlib.h>
+
+static int b64_val(char c)
+{
+	if (c >= 'A' && c <= 'Z') return c - 'A';
+	if (c >= 'a' && c <= 'z') return c - 'a' + 26;
+	if (c >= '0' && c <= '9') return c - '0' + 52;
+	if (c == '+') return 62;
+	if (c == '/') return 63;
+	return -1;
+}
+
+BYTE* b64_decode(const char* input, size_t* out_len)
+{
+	if (!input || !out_len) return NULL;
+
+	size_t in_len = strlen(input);
+	if (in_len == 0 || (in_len % 4) != 0) return NULL;
+
+	size_t pad = 0;
+	if (input[in_len - 1] == '=') pad++;
+	if (in_len >= 2 && input[in_len - 2] == '=') pad++;
+
+	size_t decoded_len = (in_len / 4) * 3 - pad;
+	BYTE* out = (BYTE*)malloc(decoded_len);
+	if (!out) return NULL;
+
+	size_t oi = 0;
+	for (size_t i = 0; i < in_len; i += 4)
+	{
+		int v0 = b64_val(input[i]);
+		int v1 = b64_val(input[i + 1]);
+		int v2 = (input[i + 2] == '=') ? 0 : b64_val(input[i + 2]);
+		int v3 = (input[i + 3] == '=') ? 0 : b64_val(input[i + 3]);
+		if (v0 < 0 || v1 < 0 || v2 < 0 || v3 < 0)
+		{
+			free(out);
+			return NULL;
+		}
+		unsigned int triple = ((unsigned int)v0 << 18)
+		                    | ((unsigned int)v1 << 12)
+		                    | ((unsigned int)v2 <<  6)
+		                    |  (unsigned int)v3;
+		if (oi < decoded_len) out[oi++] = (BYTE)((triple >> 16) & 0xFF);
+		if (oi < decoded_len) out[oi++] = (BYTE)((triple >>  8) & 0xFF);
+		if (oi < decoded_len) out[oi++] = (BYTE)( triple        & 0xFF);
+	}
+
+	*out_len = decoded_len;
+	return out;
+}

c/meterpreter/source/metsrv/util_b64.h

@@ -0,0 +1,13 @@
+#ifndef _METERPRETER_METSRV_UTIL_B64_H
+#define _METERPRETER_METSRV_UTIL_B64_H
+
+#include "metsrv.h"
+
+/*
+ * Decode a base64 (RFC 4648) C string. On success returns a malloc'd buffer
+ * of *out_len bytes; caller must free(). Returns NULL on invalid input or
+ * allocation failure.
+ */
+BYTE* b64_decode(const char* input, size_t* out_len);
+
+#endif

c/meterpreter/source/metsrv/winapi.h

@@ -49,170 +49,8 @@ FARPROC WINAPI GetProcAddressH(HANDLE hModule, DWORD dwFunctionHash);
 // Compile-time hashes of the exports the wrappers below resolve. Exposed
 // here so other TUs can pass them to GetProcAddressH without repeating the
 // literal function-name strings.
-enum HashedFunctions {
-    H_ZwAllocateVirtualMemory = 0xD33D4AED,
-    H_ZwOpenProcess = 0xF0D09D60,
-    H_ZwWriteVirtualMemory = 0xC5D0A4C2,
-    H_ZwReadVirtualMemory = 0x3DEFA5C2,
-    H_ZwProtectVirtualMemory = 0xBC3F4D89,
-    H_ZwQueryVirtualMemory = 0x4FD39C92,
-    H_ZwFreeVirtualMemory = 0xDE63B5C3,
-    H_ZwQueueApcThread = 0xD2E9B347,
-    H_ZwOpenThread = 0x197D1E8D,
-    H_RtlGetVersion = 0xD0C1869C,
-    H_WriteProcessMemory = 0xD83D6AA1,
-    H_ReadProcessMemory = 0x579D1BE9,
-    H_OpenProcess = 0xEFE297C0,
-    H_VirtualAlloc = 0x91AFCA54,
-    H_VirtualAllocEx = 0x6E1A959C,
-    H_VirtualProtect = 0x7946C61B,
-    H_VirtualProtectEx = 0x53D98756,
-    H_VirtualQuery = 0xA3C8C8AA,
-    H_VirtualQueryEx = 0xF45A2B20,
-    H_VirtualFree = 0x30633AC,
-    H_VirtualFreeEx = 0xC3B4EB78,
-    H_CreateRemoteThread = 0x72BD9CDD,
-    H_CloseHandle = 0xFFD97FB,
-    H_DuplicateHandle = 0xBD566724,
-    H_CreateToolhelp32Snapshot = 0xE454DFED,
-    H_Thread32First = 0xB83BB6EA,
-    H_OpenThread = 0x58C91E6F,
-    H_SuspendThread = 0xE8C2CDC,
-    H_Thread32Next = 0x86FED608,
-    H_ResumeThread = 0x9E4A3F88,
-    H_FreeLibrary = 0x4DC9D5A0,
-    H_FlushInstructionCache = 0x53120980,
-    H_LocalFree = 0x5CBAEAF6,
-    H_CreateFileA = 0x7C0017A5,
-    H_WriteFile = 0xE80A791F,
-    H_LoadLibraryA = 0xEC0E4E8E,
-    H_WaitForMultipleObjects = 0x23EAD524,
-    H_SetHandleInformation = 0x7F9E1144,
-    H_GlobalFree = 0x7CB922F6,
-    H_CreateNamedPipeA = 0xB2D6846,
-    H_ConnectNamedPipe = 0xCB09C9F9,
-    H_GetOverlappedResult = 0xC087DCE8,
-    H_ReadFile = 0x10FA6516,
-    H_CreateThread = 0xCA2BD06B,
-    H_ResetEvent = 0x560B084F,
-    H_SetThreadErrorMode = 0x5922C47C,
-    H_OpenProcessToken = 0x591EA70F,
-    H_AdjustTokenPrivileges = 0x24488A0F,
-    H_ImpersonateLoggedOnUser = 0x6D821B37,
-    H_CryptDuplicateKey = 0x738BCBF6,
-    H_CryptSetKeyParam = 0x180E1DA8,
-    H_CryptDecrypt = 0x59202584,
-    H_CryptGenRandom = 0x4AABDD73,
-    H_CryptEncrypt = 0xD9242588,
-    H_CryptDestroyKey = 0x95E24580,
-    H_CryptReleaseContext = 0x5AE8E894,
-    H_CryptImportKey = 0xD864E84D,
-    H_OpenThreadToken = 0x8D91EA66,
-    H_AllocateAndInitializeSid = 0x5BDCE983,
-    H_SetEntriesInAclW = 0xB142E54,
-    H_InitializeAcl = 0xF8AF61AB,
-    H_InitializeSecurityDescriptor = 0x230EA37F,
-    H_SetSecurityDescriptorDacl = 0x534E5FC2,
-    H_SetSecurityDescriptorSacl = 0x714E5FC2,
-    H_LookupPrivilegeValueW = 0x97E8C2B8,
-    H_CryptDecodeObjectEx = 0x22BA7198,
-    H_CryptImportPublicKeyInfo = 0x35A052E0,
-    H_CertGetCertificateContextProperty = 0x481F9127,
-    H_GetUserObjectInformationA = 0x11EFCB2B,
-    H_GetThreadDesktop = 0x56641B89,
-    H_WSAStartup = 0x3BFCEDCB,
-    H_socket = 0x492F0B6E,
-    H_connect = 0x60AAF9EC,
-    H_accept = 0x498649E5,
-    H_setsockopt = 0xC055F2EC,
-    H_recv = 0xE71819B6,
-    H_WSADuplicateSocketA = 0x5DCA3BD3,
-    H_InternetOpenW = 0x57E8443F,
-    H_InternetConnectW = 0x1E4BE824,
-    H_HttpOpenRequestW = 0xF7DE76B5,
-    H_InternetSetOptionW = 0xF5EFA023,
-    H_HttpSendRequestW = 0x2DE6BEB3,
-    H_HttpQueryInfoW = 0xFB2F4610,
-    H_InternetReadFile = 0x5FE34B8B,
-    H_InternetCloseHandle = 0xFA9B69C7,
-    H_InternetCrackUrlW = 0xA5955290,
-    H_UuidCreate = 0xC439EDE7,
-    H_WinHttpOpen = 0xD1026DBE,
-    H_WinHttpConnect = 0x8AAE8F,
-    H_WinHttpOpenRequest = 0x8F34E1C1,
-    H_WinHttpGetIEProxyConfigForCurrentUser = 0xA206024C,
-    H_WinHttpGetProxyForUrl = 0x88DD3F88,
-    H_WinHttpSetOption = 0xD83C501E,
-    H_WinHttpSendRequest = 0x98348882,
-    H_WinHttpReceiveResponse = 0xDE22845E,
-    H_WinHttpQueryHeaders = 0x4F8B3B75,
-    H_WinHttpReadData = 0xB24F660F,
-    H_WinHttpQueryOption = 0xDB0FB31,
-    H_WinHttpCrackUrl = 0x73513B,
-    H_ZwQueryInformationProcess = 0xB16FE439,
-    H_ZwQueryObject = 0xFEF3F5D0,
-    H_ZwQueryInformationWorkerFactory = 0xBBC3527A,
-    H_ZwSetInformationWorkerFactory = 0xEC4E91FC,
-    H_ZwSetIoCompletion = 0x2FADE3F0,
-    H_RtlCreateUserThread = 0x442F2041,
-    H_ZwMapViewOfSection = 0xD5189BF4,
-    H_ZwCreateSection = 0x5D32CBCB,
-    H_ZwOpenSection = 0x92BBDE55,
-    H_ZwOpenFile = 0x8829D4B8,
-    H_ZwQueryAttributesFile = 0x94A7E91,
-    H_ZwClose = 0x5D044C61,
-    H_ZwLockVirtualMemory = 0x8169ADC3,
-    H_GetModuleHandleA = 0xD3324904,
-    H_CreateFileW = 0x7C0017BB,
-    H_CreateNamedPipeW = 0xB2D685C,
-    H_CreateEventA = 0x30C4B281,
-    H_CreateEventW = 0x30C4B297,
-    H_SetEvent = 0xF108744E,
-    H_WaitForSingleObject = 0xCE05D9AD,
-    H_Sleep = 0xDB2D49B0,
-    H_GetProcessHeap = 0xA80EECAE,
-    H_HeapAlloc = 0x2500383C,
-    H_HeapFree = 0x10C32616,
-    H_IsWow64Process = 0xE610CFB8,
-    H_ProcessIdToSessionId = 0xAC4BA4E8,
-    H_GetCurrentThreadId = 0x35BBF99E,
-    H_CryptAcquireContextA = 0x43C28BDA,
-    H_CryptAcquireContextW = 0x43C28BF0,
-    H_AddMandatoryAce = 0x4D8DB756,
-    H_send = 0xE97019A4,
-    H_bind = 0xC7701AA4,
-    H_listen = 0xE92EADA4,
-    H_closesocket = 0x79C679E7,
-    H_select = 0x5B1E69EE,
-    H_gethostbyname = 0x510CFDC4,
-    H_getaddrinfo = 0xACA705C,
-    H_freeaddrinfo = 0xBC96705E,
-    H_htons = 0xEB769C33,
-    H_htonl = 0xEB769C2C,
-    H_ntohl = 0xEB46FC2C,
-    H_inet_addr = 0x2FBA176D,
-    H_WinHttpCloseHandle = 0xB47C201,
-    H_WinHttpWriteData = 0xFC379FC3,
-    H_HeapReAlloc = 0xBDC761A8,
-    H_LocalAlloc = 0x4C0297FA,
-    H_GetSystemTime = 0xA70B95C5,
-    H_SystemTimeToFileTime = 0x45A577EA,
-    H_MultiByteToWideChar = 0xEF4AC4E4,
-    H_WideCharToMultiByte = 0xC1634AF9,
-    H_PeekNamedPipe = 0xB407C411,
-    H_SetNamedPipeHandleState = 0xE97BC532,
-    H_ReleaseMutex = 0x14A059E5,
-    H_CreateMutexA = 0x4EE4A045,
-    H_CreateMutexW = 0x4EE4A05B,
-    H_TerminateThread = 0xBD016F89,
-    H_lstrcmpW = 0xCB534951,
-    H_GetProcessWindowStation = 0x13374FFD,
-    H_WSAGetLastError = 0x9F5B7976,
-    H_inet_ntoa = 0x4A121B5C,
-    H_HttpQueryInfoA = 0xFB2F45FA,
-    H_CryptBinaryToStringA = 0x7CC2AAAF,
-    H_CryptStringToBinaryA = 0xF29E1FE8,
-};
+#include "winapi_hashes.h"  // Auto-generated at CMake configure time.
+
 
 NTSTATUS winapi_ntdll_ZwAllocateVirtualMemory(HANDLE hProcess, PVOID* pBaseAddress, ULONG_PTR pZeroBits, PSIZE_T pRegionSize, ULONG ulAllocationType, ULONG ulProtect);
 NTSTATUS winapi_ntdll_ZwOpenProcess(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);