I've looked at the code you provide and most of it is portable to Linux and ESXI with simple typedefs, however I'm not sure how the createSeed and createbyte functions were actually implemented in that version. I simply replaced QueryPerformanceFrequency(...) and QueryPerformanceCounter(...) as follows:
- QueryPerformanceFrequency(&qpf);
-
- LARGE_INTEGER qpc;
- QueryPerformanceCounter(&qpc);
+ long qpf = sysconf(_SC_CLK_TCK);
+ struct tms t;
+ clock_t qpc = times(&t);
Along with some other small changes and was able to compile and execute the code without issues using the samples available. However if the actual strategy used by Hive is different, I believe we wouldn't be able to generate valid dictionaries using this. Are you planning on inspecting the esxi_encrypt ELF binary at some point? Thanks!
I've looked at the code you provide and most of it is portable to Linux and ESXI with simple typedefs, however I'm not sure how the createSeed and createbyte functions were actually implemented in that version. I simply replaced QueryPerformanceFrequency(...) and QueryPerformanceCounter(...) as follows:
Along with some other small changes and was able to compile and execute the code without issues using the samples available. However if the actual strategy used by Hive is different, I believe we wouldn't be able to generate valid dictionaries using this. Are you planning on inspecting the esxi_encrypt ELF binary at some point? Thanks!