Functions — github.com/Kudaes/Fiber

hub / github.com/Kudaes/Fiber / functions

Functions79 in github.com/Kudaes/Fiber

↓ 25 callersFunctionget_module_base_address

Retrieves the base address of a module loaded in the current process. In case that the module can't be found in the current process, it will return 0

loader/dinvoke/src/lib.rs:181

↓ 23 callersFunctionget_module_base_address

Retrieves the base address of a module loaded in the current process. In case that the module can't be found in the current process, it will return 0

payload/dinvoke/src/lib.rs:181

↓ 11 callersFunctionget_function_address

Retrieves the address of an exported function from the specified module. This functions is analogous to GetProcAddress from Win32. The exported funct

loader/dinvoke/src/lib.rs:216

↓ 8 callersFunctionget_function_address

Retrieves the address of an exported function from the specified module. This functions is analogous to GetProcAddress from Win32. The exported funct

payload/dinvoke/src/lib.rs:216

↓ 7 callersFunctionclose_handle

Closes a HANDLE object. It will return either a boolean value or an Err with a descriptive error message. If the function fails the bool value return

loader/dinvoke/src/lib.rs:970

↓ 6 callersFunctionfind_syscall_address

Retrieves the memory address of a syscall instruction. It expects the memory address of the function as a parameter, and it will iterate over each fo

loader/dinvoke/src/lib.rs:87

↓ 6 callersFunctionfind_syscall_address

Retrieves the memory address of a syscall instruction. It expects the memory address of the function as a parameter, and it will iterate over each fo

payload/dinvoke/src/lib.rs:87

↓ 5 callersFunctionset_hardware_breakpoint

It sets a hardware breakpoint on a certain memory address. # Examples ``` let ntdll = dinvoke::get_module_base_address("ntdll.dll"); let nt_open_pro

loader/dinvoke/src/lib.rs:52

↓ 5 callersFunctionset_hardware_breakpoint

It sets a hardware breakpoint on a certain memory address. # Examples ``` let ntdll = dinvoke::get_module_base_address("ntdll.dll"); let nt_open_pro

payload/dinvoke/src/lib.rs:52

↓ 3 callersFunctionget_function_address_by_ordinal

Retrieves the address of an exported function from the specified module by its ordinal. In case that the function's address can't be retrieved, it wi

loader/dinvoke/src/lib.rs:779

↓ 3 callersFunctionnt_protect_virtual_memory

Dynamically calls NtProtectVirtualMemory. It will return the NTSTATUS value returned by the call.

loader/dinvoke/src/lib.rs:1086

↓ 3 callersFunctionnt_write_virtual_memory

Dynamically calls NtWriteVirtualMemory. It will return the NTSTATUS value returned by the call.

loader/dinvoke/src/lib.rs:1017

↓ 2 callersFunctionadd_runtime_table

(pe_info: &PeMetadata, image_ptr: *mut c_void)

loader/manualmap/src/lib.rs:556

↓ 2 callersFunctionclean_dos_header

This method is reponsible of cleaning IOCs that may reveal the pressence of a manually mapped PE in a private memory region. It will remove PE magic b

loader/manualmap/src/lib.rs:529

↓ 2 callersFunctionclose_handle

Closes a HANDLE object. It will return either a boolean value or an Err with a descriptive error message. If the function fails the bool value return

payload/dinvoke/src/lib.rs:970

↓ 2 callersFunctionget_api_mapping

()

loader/dinvoke/src/lib.rs:365

↓ 2 callersFunctionget_pe_metadata

Retrieves PE headers information from the module base address. It will return either a data::PeMetada struct containing the PE metadata or a String w

loader/manualmap/src/lib.rs:136

↓ 2 callersFunctionload_library_a

Loads and retrieves a module's base address by dynamically calling LoadLibraryA. It will return either the module's base address or 0. # Examples `

loader/dinvoke/src/lib.rs:878

↓ 2 callersFunctionmap_module_to_memory

Maps a module to a valid memory space in the current process. The parameters required are a vector with the module content, the base address where th

loader/manualmap/src/lib.rs:191

↓ 2 callersFunctionnt_allocate_virtual_memory

Dynamically calls NtAllocateVirtualMemory. It will return the NTSTATUS value returned by the call.

loader/dinvoke/src/lib.rs:1054

↓ 2 callersFunctionrelocate_module

Relocates a module in memory. The parameters required are the module's metadata information and a pointer to the base address where the module is map

loader/manualmap/src/lib.rs:250

↓ 2 callersFunctionrewrite_module_iat

Rewrites the IAT of a manually mapped module. The parameters required are the module's metadata information and a pointer to the base address where t

loader/manualmap/src/lib.rs:318

↓ 2 callersFunctionset_module_section_permissions

Sets correct module section permissions for a manually mapped module. The parameters required are the module's metadata information and a pointer to

loader/manualmap/src/lib.rs:589

↓ 1 callersFunctionget_api_mapping

()

payload/dinvoke/src/lib.rs:365

↓ 1 callersFunctionget_forward_address

(function_ptr: *mut u8)

loader/dinvoke/src/lib.rs:281

↓ 1 callersFunctionget_forward_address

(function_ptr: *mut u8)

payload/dinvoke/src/lib.rs:281

↓ 1 callersFunctionget_function_address_by_ordinal

Retrieves the address of an exported function from the specified module by its ordinal. In case that the function's address can't be retrieved, it wi

payload/dinvoke/src/lib.rs:779

↓ 1 callersFunctionldr_get_procedure_address

Retrieves the address of an exported function from the specified module either by its name or by its ordinal number. This functions internally calls

loader/dinvoke/src/lib.rs:808

↓ 1 callersFunctionldr_get_procedure_address

Retrieves the address of an exported function from the specified module either by its name or by its ordinal number. This functions internally calls

payload/dinvoke/src/lib.rs:808

↓ 1 callersFunctionload_library_a

Loads and retrieves a module's base address by dynamically calling LoadLibraryA. It will return either the module's base address or 0. # Examples `

payload/dinvoke/src/lib.rs:878

↓ 1 callersFunctionmain

This code must be considered like a payload loader, i.e. this code will be running from a small and "innocent" PE on disk. This small PoC will perform

loader/src/main.rs:20

↓ 1 callersFunctionmain

()

payload/bindings/build.rs:1

↓ 1 callersFunctionmanually_map_module

Manually maps a PE into the current process. It will return either a pair (PeMetadata,isize) containing the mapped PE metadata and its base address o

loader/manualmap/src/lib.rs:68

↓ 1 callersFunctionnt_allocate_virtual_memory

Dynamically calls NtAllocateVirtualMemory. It will return the NTSTATUS value returned by the call.

payload/dinvoke/src/lib.rs:1054

↓ 1 callersFunctionnt_create_section

Dynamically calls NtCreateSection. It will return the NTSTATUS value returned by the call.

loader/dinvoke/src/lib.rs:1247

↓ 1 callersFunctionnt_map_view_of_section

Dynamically calls NtMapViewOfSection. It will return the NTSTATUS value returned by the call.

loader/dinvoke/src/lib.rs:1268

↓ 1 callersFunctionnt_open_file

Dynamically calls NtOpenFile. It will return the NTSTATUS value returned by the call.

loader/dinvoke/src/lib.rs:1227

↓ 1 callersFunctionnt_protect_virtual_memory

Dynamically calls NtProtectVirtualMemory. It will return the NTSTATUS value returned by the call.

payload/dinvoke/src/lib.rs:1086

↓ 1 callersFunctionnt_query_information_process

Dynamically calls NtQueryInformationProcess. It will return the NTSTATUS value returned by the call.

loader/dinvoke/src/lib.rs:1161

↓ 1 callersFunctionnt_query_information_process

Dynamically calls NtQueryInformationProcess. It will return the NTSTATUS value returned by the call.

payload/dinvoke/src/lib.rs:1161

↓ 1 callersFunctionnt_write_virtual_memory

Dynamically calls NtWriteVirtualMemory. It will return the NTSTATUS value returned by the call.

payload/dinvoke/src/lib.rs:1017

↓ 1 callersFunctionread_and_map_module

Manually maps a PE from disk to the memory of the current process. It will return either a pair (PeMetadata,isize) containing the mapped PE metadata

loader/manualmap/src/lib.rs:45

↓ 1 callersFunctionrtl_init_unicode_string

Dynamically calls RtlInitUnicodeString. It will return the NTSTATUS value returned by the call.

loader/dinvoke/src/lib.rs:1199

Functionbreakpoint_handler

This function acts as an Exception Handler, and should be combined with a hardware breakpoint. Whenever the HB gets triggered, this function will be

loader/dinvoke/src/lib.rs:111

Functionbreakpoint_handler

This function acts as an Exception Handler, and should be combined with a hardware breakpoint. Whenever the HB gets triggered, this function will be

payload/dinvoke/src/lib.rs:111

Functioncall_module_entry_point

Calls the module's entry point with the option DLL_ATTACH_PROCESS. # Examples ```ignore let pe = manualmap::read_and_map_module("c:\\some\\random\\f

loader/dinvoke/src/lib.rs:730

Functioncall_module_entry_point

Calls the module's entry point with the option DLL_ATTACH_PROCESS. # Examples ```ignore let pe = manualmap::read_and_map_module("c:\\some\\random\\f

payload/dinvoke/src/lib.rs:730

Methoddefault

()

loader/data/src/lib.rs:112

Methoddefault

()

payload/data/src/lib.rs:112

Functionget_ntdll_eat

Returns a BTreeMap<isize,String> composed of pairs (memory address, function name) with all the Nt exported functions on ntdll.dll. This functions wi

loader/dinvoke/src/lib.rs:513

Functionget_ntdll_eat

Returns a BTreeMap<isize,String> composed of pairs (memory address, function name) with all the Nt exported functions on ntdll.dll. This functions wi

payload/dinvoke/src/lib.rs:513

Functionget_syscall_id

Returns the syscall id that correspond to the function specified. This functions will return -1 in case that the syscall id of the specified function

loader/dinvoke/src/lib.rs:592

Functionget_syscall_id

Returns the syscall id that correspond to the function specified. This functions will return -1 in case that the syscall id of the specified function

payload/dinvoke/src/lib.rs:592

Functionmain

()

loader/bindings/build.rs:1

Functionmap_to_allocated_memory

(module_ptr: *const u8, image_ptr: *mut c_void, pe_info: &PeMetadata)

loader/manualmap/src/lib.rs:758

Functionmap_to_section

Map a module to a memory section. The parameter required is the file path of the module that should be mapped.

loader/manualmap/src/lib.rs:668

Functionnt_create_section

Dynamically calls NtCreateSection. It will return the NTSTATUS value returned by the call.

payload/dinvoke/src/lib.rs:1247

Functionnt_create_thread_ex

Dynamically calls NtCreateThreadEx. It will return the NTSTATUS value returned by the call.

loader/dinvoke/src/lib.rs:1289

Functionnt_create_thread_ex

Dynamically calls NtCreateThreadEx. It will return the NTSTATUS value returned by the call.

payload/dinvoke/src/lib.rs:1289

Functionnt_map_view_of_section

Dynamically calls NtMapViewOfSection. It will return the NTSTATUS value returned by the call.

payload/dinvoke/src/lib.rs:1268

Functionnt_open_file

Dynamically calls NtOpenFile. It will return the NTSTATUS value returned by the call.

payload/dinvoke/src/lib.rs:1227

Functionnt_open_process

Dynamically calls NtOpenProcess. It will return the NTSTATUS value returned by the call.

loader/dinvoke/src/lib.rs:1122

Functionnt_open_process

Dynamically calls NtOpenProcess. It will return the NTSTATUS value returned by the call.

payload/dinvoke/src/lib.rs:1122

Functionopen_process

Opens a HANDLE to a process. If the function fails, it will return a null HANDLE. # Examples ``` let pid = 792u32; let handle = dinvoke::open_proce

loader/dinvoke/src/lib.rs:933

Functionopen_process

Opens a HANDLE to a process. If the function fails, it will return a null HANDLE. # Examples ``` let pid = 792u32; let handle = dinvoke::open_proce

payload/dinvoke/src/lib.rs:933

Functionprepare_syscall

Given a valid syscall id, it will allocate the required shellcode to execute that specific syscall. This functions will return the memory address whe

loader/dinvoke/src/lib.rs:631

Functionprepare_syscall

Given a valid syscall id, it will allocate the required shellcode to execute that specific syscall. This functions will return the memory address whe

payload/dinvoke/src/lib.rs:631

Functionrtl_adjust_privilege

Dynamically calls RtlAdjustPrivilege. It will return the NTSTATUS value returned by the call.

loader/dinvoke/src/lib.rs:1180

Functionrtl_adjust_privilege

Dynamically calls RtlAdjustPrivilege. It will return the NTSTATUS value returned by the call.

payload/dinvoke/src/lib.rs:1180

Functionrtl_init_unicode_string

Dynamically calls RtlInitUnicodeString. It will return the NTSTATUS value returned by the call.

payload/dinvoke/src/lib.rs:1199

Functionrtl_zero_memory

Dynamically calls RtlZeroMemory. It will return the NTSTATUS value returned by the call.

loader/dinvoke/src/lib.rs:1213

Functionrtl_zero_memory

Dynamically calls RtlZeroMemory. It will return the NTSTATUS value returned by the call.

payload/dinvoke/src/lib.rs:1213

Functionrun

(params: PVOID)

payload/src/lib.rs:12

Functionset_unhandled_exception_filter

Dynamically calls SetUnhandledExceptionFilter.

loader/dinvoke/src/lib.rs:851

Functionset_unhandled_exception_filter

Dynamically calls SetUnhandledExceptionFilter.

payload/dinvoke/src/lib.rs:851

Functionuse_hardware_breakpoints

Enables or disables the use of exception handlers in combination with hardware breakpoints.

loader/dinvoke/src/lib.rs:34

Functionuse_hardware_breakpoints

Enables or disables the use of exception handlers in combination with hardware breakpoints.

payload/dinvoke/src/lib.rs:34

Functionvirtual_free

Dynamically calls VirtualFree.

loader/dinvoke/src/lib.rs:996

Functionvirtual_free

Dynamically calls VirtualFree.

payload/dinvoke/src/lib.rs:996