Skip to content

Remove Functions from Stdapi IAT #814

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dledda-r7 wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Remove Functions from Stdapi IAT #814

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
74d9d64
feat(stdapi): remove import from iat part one
dledda-r7 Aug 26, 2026
0cb6686
feat(stdapi): remove import from iat part two
dledda-r7 Aug 26, 2026
7df5c3a
feat(stdapi): remove import from iat part three
dledda-r7 Aug 26, 2026
19d798a
feat: add local agent workspace to .gitignore
dledda-r7 Aug 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,3 +4,6 @@
.vs
*.user
.vscode

# Local agent workspace
.github/agent-workspace/
278 changes: 275 additions & 3 deletions c/meterpreter/source/common/common_winapi.h
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion c/meterpreter/source/extensions/stdapi/server/audio/output.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ static DWORD audio_channel_close(Channel *channel, Packet *request, LPVOID conte
AudioContext *ctx = (AudioContext *)context;

// Play the audio buffer
sndPlaySound(ctx->buffer, SND_MEMORY);
met_api->win_api.winmm.sndPlaySoundA(ctx->buffer, SND_MEMORY);

if (ctx->buffer)
{
Expand Down
32 changes: 16 additions & 16 deletions c/meterpreter/source/extensions/stdapi/server/fs/file.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ static DWORD file_channel_write(Channel *channel, Packet *request,
if (bufferSize) {
written = fwrite(buffer, 1, bufferSize, ctx->fd);
if (written < bufferSize) {
result = GetLastError();
result = met_api->win_api.kernel32.GetLastError();
}
}

Expand Down Expand Up @@ -69,7 +69,7 @@ static DWORD file_channel_read(Channel *channel, Packet *request,
if (bufferSize) {
bytes = fread(buffer, 1, bufferSize, ctx->fd);
if (bytes < bufferSize) {
result = GetLastError();
result = met_api->win_api.kernel32.GetLastError();
}
}

Expand Down Expand Up @@ -113,7 +113,7 @@ static DWORD file_channel_tell(Channel *channel, Packet *request,
LONG pos = 0;

if ((pos = ftell(ctx->fd)) < 0) {
result = GetLastError();
result = met_api->win_api.kernel32.GetLastError();
}

if (offset)
Expand Down Expand Up @@ -322,29 +322,29 @@ DWORD request_fs_file_hash(Remote* remote, Packet* packet, ALG_ID hashType)
if (result != ERROR_SUCCESS)
{
dprintf("[FILE HASH] Failed to open file: %s", filePath);
result = GetLastError();
result = met_api->win_api.kernel32.GetLastError();
break;
}

if (!CryptAcquireContext(&cryptProv, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
if (!met_api->win_api.advapi32.CryptAcquireContextA(&cryptProv, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
{
result = GetLastError();
result = met_api->win_api.kernel32.GetLastError();
dprintf("[FILE HASH] Failed to get the Crypt context: %d (%x)", result, result);
break;
}

if (!CryptCreateHash(cryptProv, hashType, 0, 0, &hashInstance))
if (!met_api->win_api.advapi32.CryptCreateHash(cryptProv, hashType, 0, 0, &hashInstance))
{
result = GetLastError();
result = met_api->win_api.kernel32.GetLastError();
dprintf("[FILE HASH] Failed to get the hash instance: %d (%x)", result, result);
break;
}

BOOL failed = FALSE;
while ((ret = fread(buff, 1, sizeof(buff), fd)) > 0) {
if (!CryptHashData(hashInstance, buff, (DWORD)ret, 0))
if (!met_api->win_api.advapi32.CryptHashData(hashInstance, buff, (DWORD)ret, 0))
{
result = GetLastError();
result = met_api->win_api.kernel32.GetLastError();
dprintf("[FILE HASH] Failed to hash a chunk of data", result, result);
failed = TRUE;
break;
Expand All @@ -358,19 +358,19 @@ DWORD request_fs_file_hash(Remote* remote, Packet* packet, ALG_ID hashType)

DWORD hashSize = 0;
DWORD hashBufferSize = sizeof(hashSize);
if (!CryptGetHashParam(hashInstance, HP_HASHSIZE, (BYTE*)&hashSize, &hashBufferSize, 0) || hashSize == 0)
if (!met_api->win_api.advapi32.CryptGetHashParam(hashInstance, HP_HASHSIZE, (BYTE*)&hashSize, &hashBufferSize, 0) || hashSize == 0)
{
result = GetLastError();
result = met_api->win_api.kernel32.GetLastError();
dprintf("[FILE HASH] Failed to get the hash size: %d (%x)", result, result);
}

dprintf("[FILE HASH] The given hash is %d bytes in size", hashSize);

// We'll reuse the buff var here because it's more than big enough for the
// size of any hash that'll be calculated
if (!CryptGetHashParam(hashInstance, HP_HASHVAL, buff, &hashSize, 0))
if (!met_api->win_api.advapi32.CryptGetHashParam(hashInstance, HP_HASHVAL, buff, &hashSize, 0))
{
result = GetLastError();
result = met_api->win_api.kernel32.GetLastError();
dprintf("[FILE HASH] Failed to get the hash value: %d (%x)", result, result);
break;
}
Expand All @@ -383,12 +383,12 @@ DWORD request_fs_file_hash(Remote* remote, Packet* packet, ALG_ID hashType)

if (hashInstance != 0)
{
CryptDestroyHash(hashInstance);
met_api->win_api.advapi32.CryptDestroyHash(hashInstance);
}

if (cryptProv != 0)
{
CryptReleaseContext(cryptProv, 0);
met_api->win_api.advapi32.CryptReleaseContext(cryptProv, 0);
}

if (fd != NULL)
Expand Down
Loading
Loading