Typically each C2 provider will impement their own resolution method of beacon APIs. Beacuse our loader is a POC, we simply use the comatibility layer beacon.dll directly
| 49 | //method of beacon APIs. Beacuse our loader is a POC, we simply |
| 50 | //use the comatibility layer beacon.dll directly |
| 51 | static FARPROC ResolveBeaconFunction(const char* beaconFunction){ |
| 52 | |
| 53 | static auto beaconMod = LoadLibrary("beacon.dll"); |
| 54 | |
| 55 | if(beaconMod == nullptr){ |
| 56 | throw std::string("Failed to find beacon.dll compatibility DLL"); |
| 57 | } |
| 58 | |
| 59 | //We dont need to resolve BeaconInvokeStandalone because |
| 60 | //the method is only ever called when running standalone |
| 61 | if (strcmp(beaconFunction, "BeaconInvokeStandalone") == 0) |
| 62 | return nullptr; |
| 63 | else |
| 64 | return GetProcAddress(beaconMod, beaconFunction); |
| 65 | } |
| 66 | |
| 67 | static void ProcessImports(const Pe::PeNative& pe) { |
| 68 |