* A helper function to display the contents of a SYSCALL_API_ENTRY structure. * * @param name A pointer to a char* containing (human readable) target

* Sets the globals currentJmpAddr/SysNum to target sys call. * * Note: This is inspired by RecycledGate: * https://github.com/thefLink/RecycledGate/bl

* Move a specified byte into a memory location * * @param ptr A pointer to the destination buffer * @param byte The byte to copy into memory * @param

* A wrapper around BeaconGate to handle masking/unmasking Beacon * * @param info A pointer to a BEACON_INFO structure * @param gateFunction A pointer

* Find a specific byte pattern (gadget) in a module's .text section. * * Note: We search the .text section to make sure the gadget is RX. * * @param m

* Wrapper for calculating the stack size for a given function. * * @param returnAddress The target return address to calculate the stack size for.

* A helper function to display the contents of a RTL_API structure. * * @param name A pointer to a char* containing (human readable) target function n

* Mask Beacon * * @param beaconInfo A pointer to the BEACON_INFO structure */

* A helper function to display the contents of a FUNCTION_CALL structure. * * @param entry A pointer to a FUNCTION_CALL structure. */

* A helper function to display the contents of the SLEEPMASK_INFO structure. * * @param info A pointer to a SLEEPMASK_INFO structure. */

* Unit test runner which will ensure that all sys calls * are behaving as expected with whatever technique is * implemented in *-sleepmask.cpp. */

* UnMask Beacon * * @param beaconInfo A pointer to the BEACON_INFO structure */

* Execute BeaconGate. * * @param gateFunction A pointer to a FUNCTION_CALL structure */

* VirtualAllocEx --> NtAllocateVirtualMemory * * arg[0] [in] HANDLE hProcess --> [0] [in] HANDLE ProcessHandle * arg[1] [in] LPVOID lpAddre

* CreateRemoteThread --> NtCreateThreadEx * * --> [0] [out] PHANDLE ThreadHandle *

* VirtualProtectEx --> NtProtectVirtualMemory * * arg[0] HANDLE hProcess --> HANDLE ProcessHandle * arg[1] LPVOID lpAdress --> PVO

Test function wrapper to ensure that asm harnesses correctly pass up to 10 arguments.

* XOR Beacon's Sections/Heap Records * * @param beaconInfo A pointer to the BEACON_INFO structure * @param mask A Boolean value to indicate whether to

* XOR the provided buffer with the provided key * * @param buffer The buffer to XOR * @param size The size of the buffer * @param key The key to XOR t

* A function to compare two memory blocks * * @param ptr1 A pointer to the destination buffer * @param ptr2 A pointer to the source buffer * @para

* Calculates the stack size for a given function. * * @param pRuntimeFunction A pointer to a RUNTIME_FUNCTION structure. * @param imageBase A dword

* Execute DraugrGate. * * @param draugrCall A pointer to a DRAUGR_FUNCTION_CALL structure. */

* A wrapper around DraugrGate to handle masking/unmasking Beacon. * * @param info A pointer to a SLEEPMASK_INFO structure. * @param draugrCall A po

* Asm stub for performing draugr call stack spoofing. * * @param (...) accepts variadic args. * @return A PVOID containing return value. */

* Find a gadget to use for call stack spoofing. * * Note: This function has been optimized from the original * to only find gadgets once. * * @pa

* Find the specified gadgets and store them for future use. * * @param A pointer to a GADGETS structure. * * @return BOOL indicating success. */

* Find a specific region within the ALLOCATED_MEMORY structure * * @param allocatedMemory A pointer to a ALLOCATED_MEMORY structure * @param purpose

* Retrieve size of text section. * * @param pModule A pointer to target module. * @param pdwVirtualAddress [out] A pointer to start of target modul

* Initialise the fake stack frame. * * @param stackFrame A pointer to a SYNTHETIC_STACK_FRAME structure. * @return A BOOL indicating success. */

* Configures Draugr for use in BeaconGate. * * @param A pointer* to a DRAUGR_FUNCTION_CALL structure. */

* Configures system calls for use in BeaconGate. * * @param A pointer to a BEACON_SYSCALLS structure. */

* Check if memory protection is writable * @param dwProtection The current memory protection constant * @return A Boolean value to indicate it is writ

* CloseHandle --> NtClose * * arg[0] HANDLE hObject --> [0] [in] HANDLE Handle */

* CreateFileMappingA --> NtCreateSection * * --> [0] [out] PHANDLE Sectio

* DuplicateHandle --> NtDuplicateObject * * arg[0] [in] HANDLE hSourceProcessHandle --> [0] [in] HANDLE SourceProcessHandle * arg[1] [in]

* VirtualFree --> NtFreeVirtualMemory * * --> HANDLE ProcessHandle * arg[0] LPVOID lpAddress --> PVOID *BaseAddress *

* GetThreadContext --> NtGetContextThread * * arg[0] [in] HANDLE hThread --> [0] [in] HANDLE ThreadHandle * arg[1] [in, out] LPCONTE

* MapViewOfFile --> NtMapViewOfSection * * arg[0] [in] HANDLE fileMappingObject --> [0] [in] HANDLE SectionHandle *

* OpenProcess --> NtOpenProcess * * --> [0] [out] PHANDLE ProcessHandle * arg[0] [in] DWORD dwDesiredAccess --

* OpenThread --> NtOpenThread * * --> [0] [out] PHANDLE ThreadHandle * arg[0] [in] DWORD dwDesiredAccess --> [1]

* VirtualQuery --> NtQueryVirtualMemory * * --> [0] [in] HANDLE ProcessHandle * arg[0] [in] LPC

* ReadProcessMemory--> NtReadVirtualMemory * * arg[0] [in] HANDLE hProcess --> [0] [in] HANDLE ProcessHandle * arg[1] [in] LP

* ResumeThread --> NtResumeThread * * arg[0] [in] HANDLE hThread --> [0] [in] HANDLE ThreadHandle * --> [1] [out] P

* SetThreadContext --> NtSetContextThread * * arg[0] [in] HANDLE hThread --> [0] [in] HANDLE ThreadHandle * arg[1] [in] CONTEXT *lpContext

* UnmapViewOfFile --> NtUnmapViewOfSection * * --> [in] HANDLE ProcessHandle * arg[0] [in] LPCVOID lpBase Add

* WriteProcessMemory --> NtWriteProcessMemory * * arg[0] [in] HANDLE hProcess --> [0] [in] HANDLE ProcessHandle * arg[1] [

* A helper function to display the contents of a BEACON_SYSCALLS structure. * * @param entry A pointer to a BEACON_SYSCALLS structure. */

* Set the required gadget before ret address spoofing. * * Note: Here we ensure that a call to a function in WinINet will * return to WinINet.dll and

* The sys call interface layer between Beacon -> BeaconGate. * Routes higher level API (e.g. VirtualAlloc) to its Nt equivalent (e.g. NtAllocateVirtua

* XOR Heap Records * * @param beaconInfo A pointer to the BEACON_INFO structure */

* XOR the sections in the provided memory region * * @param allocatedRegion A pointer to a ALLOCATED_MEMORY_REGION structure * @param maskKey A pointe

Memory management APIs.

Thread APIs.

Handle APIs.

* A helper function to display the contents of a ALLOCATED_MEMORY_REGION structure. * * @param memoryRegion A pointer to a ALLOCATED_MEMORY_REGION str

* Spoofs the call stack for a target function. * * Note: The fake call stack could be cached to avoid re-calculating it for each function call. *

This attribute ensures the compiler generates code without prolog / epilog code. Note: This attribute causes an intellisense error as it cannot parse

Test function to ensure that asm harnesses correctly pass up to 10 arguments.

* Copy memory from one location to another * * @param dest A pointer to the destination buffer * @param src A pointer to the source buffer * @param si

* Sleepmask-VS entry point * * Note: To enable logging for Release builds set ENABLE_LOGGING to * 1 in debug.h. */

* Sleepmask-VS entry point * * Note: To enable logging for Release builds set ENABLE_LOGGING to * 1 in debug.h. */

* Sleepmask-VS entry point * * Note: To enable logging for Release builds set ENABLE_LOGGING to * 1 in debug.h. */

* Sleepmask-VS entry point * * Note: To enable logging for Release builds set ENABLE_LOGGING to * 1 in debug.h. */