ZeroMemoryEx / Amsi-Killer

Lifetime AMSI bypass
586 stars 88 forks source link

Command Line Arguments #2

Closed aconite33 closed 1 year ago

aconite33 commented 1 year ago

Hello! I've been testing your project.

I've been able to replace the specific PID target (e.g., powershell.exe) with:

tpid = GetCurrentProcessId(); so that I can use it in Nettitude's RunPE: https://github.com/nettitude/RunPE/

I've been trying to add command line arguments so that I can target a specific PID, a specific process name (e.g., powershell.exe) or if no arguments are passed, just use it's own ProcessID.

I'm having issues with GetPID function and passing in command line arguments. For RunPE, the program needs to use CommandLineToArgvW Detailed Here: https://github.com/nettitude/RunPE/issues/11

I'm having trouble getting GetPID to allow me to pass an argument with LPWSTR instead of LPCSTR, but I have been unsuccessful. Even trying to pass a PID directly doesn't seem to work.

Sample code below:

int
wmain() {

    int nArgs;
    LPWSTR* szArglist;

    szArglist = CommandLineToArgvW(GetCommandLineW(), &nArgs);

    BYTE pattern[] = { 0x48,'?','?', 0x74,'?',0x48,'?' ,'?' ,0x74,'?' ,0x48,'?' ,'?' ,'?' ,'?',0x74,0x33 };

    DWORD patternSize = sizeof(pattern);
    DWORD tpid = 0;

    if (nArgs > 1) {
        if (wcscmp(L"-i", szArglist[1]) == 0) {
            tpid = std::stoi(szArglist[2]);
        }
        if (wcscmp(L"-n", szArglist[1]) == 0) {
            USES_CONVERSION;
            tpid = GetPID(W2A(szArglist[2]));
        }
    }
    else {
        tpid = GetCurrentProcessId();
    }

    if (!tpid) {
        printf("Did not get a handle to the process. Exiting.");
        return -1;
    }

    printf("PID: %d\n", tpid);
ZeroMemoryEx commented 1 year ago

thank you il implement it