| 65 | } |
| 66 | |
| 67 | static void ProcessImports(const Pe::PeNative& pe) { |
| 68 | |
| 69 | //For POC purposes, import resolution does not currently support |
| 70 | //forwarders or API sets. This is left for the C2 implementation |
| 71 | |
| 72 | for (const auto& mod : pe.imports()) { |
| 73 | |
| 74 | auto modName = mod.libName(); |
| 75 | HMODULE currentModule = nullptr; |
| 76 | |
| 77 | if(strcmp(modName, "beacon.dll") != 0){ |
| 78 | currentModule = LoadLibraryA(modName); |
| 79 | if (currentModule == nullptr) { |
| 80 | throw std::format("Failed to load dependent libary {}", modName); |
| 81 | } |
| 82 | } |
| 83 | |
| 84 | for (const auto& imp : mod) { |
| 85 | |
| 86 | auto ptr = (FARPROC*)imp.importAddressTableEntry(); |
| 87 | |
| 88 | if(currentModule != nullptr){ |
| 89 | //If the current import DLL is not beacon.dll, resolve functions as normal |
| 90 | if (imp.type() == Pe::ImportType::name) { |
| 91 | *ptr = GetProcAddress(currentModule, imp.name()->Name); |
| 92 | }else { |
| 93 | *ptr = GetProcAddress(currentModule, MAKEINTRESOURCE(imp.ordinal())); |
| 94 | } |
| 95 | |
| 96 | if (*ptr == nullptr) { |
| 97 | throw std::format("Unresolved import {}!{}", modName, imp.type() == Pe::ImportType::name ? imp.name()->Name : MAKEINTRESOURCE(imp.ordinal())); |
| 98 | } |
| 99 | |
| 100 | }else{ |
| 101 | //Current DLL is beacon.dll, resolve via internal C2 mechanism |
| 102 | *ptr = ResolveBeaconFunction(imp.name()->Name); |
| 103 | } |
| 104 | } |
| 105 | } |
| 106 | } |
| 107 | |
| 108 | static void ProcessRelocations(const Pe::PeNative& pe, uintptr_t delta) { |
| 109 |
no test coverage detected