Skip to content

Commit caf94bd

Browse files
hfiref0xhfiref0x
authored
Merge pull request #164 from hfiref0x/dev369
v 3.6.9 This is maintenance release. No new methods has been added / reworked / removed.
2 parents 530fde9 + 62ff831 commit caf94bd

27 files changed

Lines changed: 553 additions & 364 deletions

‎Source/Akagi/Resource.rc‎

0 Bytes
Binary file not shown.

‎Source/Akagi/compress.c‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
/*******************************************************************************
22
*
3-
* (C) COPYRIGHT AUTHORS, 2014 - 2022
3+
* (C) COPYRIGHT AUTHORS, 2014 - 2025
44
*
55
* TITLE: COMPRESS.C
66
*
7-
* VERSION: 3.61
7+
* VERSION: 3.69
88
*
9-
* DATE: 22 Jun 2022
9+
* DATE: 07 Jul 2025
1010
*
1111
* Compression and encoding/decoding support.
1212
*
@@ -133,6 +133,9 @@ BOOL IsValidContainerHeader(
133133
{
134134
DWORD HeaderCrc;
135135

136+
if (UnitHeader == NULL)
137+
return FALSE;
138+
136139
__try {
137140
if ((UnitHeader->Magic != UACME_CONTAINER_PACKED_DATA) && //Naka
138141
(UnitHeader->Magic != UACME_CONTAINER_PACKED_UNIT) && //Naka

‎Source/Akagi/console.c‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
/*******************************************************************************
22
*
3-
* (C) COPYRIGHT AUTHORS, 2022
3+
* (C) COPYRIGHT AUTHORS, 2022 - 2025
44
*
55
* TITLE: CONSOLE.C
66
*
7-
* VERSION: 3.62
7+
* VERSION: 3.69
88
*
9-
* DATE: 08 Jul 2022
9+
* DATE: 07 Jul 2025
1010
*
1111
* Debug console.
1212
*
@@ -115,9 +115,16 @@ VOID ConsoleRelease(
115115
)
116116
{
117117
DWORD dwStop = GetTickCount() + (10 * 1000);
118+
HANDLE nStdHandle = GetStdHandle(STD_INPUT_HANDLE);
119+
120+
if (nStdHandle == NULL || nStdHandle == INVALID_HANDLE_VALUE) {
121+
FreeConsole();
122+
return;
123+
}
118124

119125
ConsolePrint(TEXT("[+] Press Enter to exit or wait few seconds and it will close automatically\r\n"));
120126

127+
FlushConsoleInputBuffer(nStdHandle);
121128
while (!ConsoleIsKeyPressed(VK_RETURN) && GetTickCount() < dwStop)
122129
Sleep(50);
123130

‎Source/Akagi/fusutil.c‎

Lines changed: 53 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
/*******************************************************************************
22
*
3-
* (C) COPYRIGHT AUTHORS, 2020 - 2021
3+
* (C) COPYRIGHT AUTHORS, 2020 - 2025
44
*
55
* TITLE: FUSUTIL.C
66
*
7-
* VERSION: 3.58
7+
* VERSION: 3.69
88
*
9-
* DATE: 01 Dec 2021
9+
* DATE: 07 Jul 2025
1010
*
1111
* THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF
1212
* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED
@@ -376,12 +376,18 @@ BOOL fusUtilReferenceStreamByName(
376376

377377
do {
378378
pStorStream = (STORAGESTREAM*)streamPtr;
379+
if (IsBadReadPtr(pStorStream->rcName, sizeof(CHAR)))
380+
return FALSE;
381+
379382
if (_strcmpi_a(pStorStream->rcName, StreamName) == 0) {
380383
*StreamRef = pStorStream;
381384
return TRUE;
382385
}
383386

384387
nameLen = _strlen_a(pStorStream->rcName) + 1;
388+
if (nameLen > MAXUSHORT)
389+
return FALSE;
390+
385391
offset = ALIGN_UP(FIELD_OFFSET(STORAGESTREAM, rcName) + nameLen, ULONG);
386392
streamPtr = (PBYTE)RtlOffsetToPointer(streamPtr, offset);
387393
i++;
@@ -435,59 +441,62 @@ BOOL fusUtilGetImageMVID(
435441
cliHeader = (IMAGE_COR20_HEADER*)RtlImageDirectoryEntryToData(baseAddress, TRUE,
436442
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR, &sz);
437443

438-
pStorSign = (STORAGESIGNATURE*)RtlOffsetToPointer(baseAddress, cliHeader->MetaData.VirtualAddress);
439-
if (pStorSign->lSignature == STORAGE_MAGIC_SIG) {
440-
441-
offset = FIELD_OFFSET(STORAGESIGNATURE, pVersion) + pStorSign->iVersionString;
442-
pStorHeader = (STORAGEHEADER*)RtlOffsetToPointer(pStorSign, offset);
444+
if (cliHeader && sz >= sizeof(IMAGE_COR20_HEADER)) {
443445

444-
pStreamTables = NULL;
445-
if (!fusUtilReferenceStreamByName(pStorHeader, "#~", &pStreamTables)) {
446-
FreeLibrary(hModule);
447-
return FALSE;
448-
}
446+
pStorSign = (STORAGESIGNATURE*)RtlOffsetToPointer(baseAddress, cliHeader->MetaData.VirtualAddress);
447+
if (pStorSign && !IsBadReadPtr(pStorSign, sizeof(STORAGESIGNATURE)) &&
448+
pStorSign->lSignature == STORAGE_MAGIC_SIG)
449+
{
450+
offset = FIELD_OFFSET(STORAGESIGNATURE, pVersion) + pStorSign->iVersionString;
451+
pStorHeader = (STORAGEHEADER*)RtlOffsetToPointer(pStorSign, offset);
449452

450-
pStreamGuid = NULL;
451-
if (!fusUtilReferenceStreamByName(pStorHeader, "#GUID", &pStreamGuid)) {
452-
FreeLibrary(hModule);
453-
return FALSE;
454-
}
453+
pStreamTables = NULL;
454+
if (!fusUtilReferenceStreamByName(pStorHeader, "#~", &pStreamTables)) {
455+
FreeLibrary(hModule);
456+
return FALSE;
457+
}
455458

456-
pTablesHeader = (STORAGETABLESHEADER*)RtlOffsetToPointer(pStorSign, pStreamTables->iOffset);
457-
sz = 0;
458-
459-
//
460-
// __popcnt64 or the garbage code below
461-
//
462-
for (i = 0; i < MAX_CLR_TABLES; i++)
463-
if ((i < 32 && (pTablesHeader->Valid.u.LowPart >> i) & 1) ||
464-
(i >= 32 && (pTablesHeader->Valid.u.HighPart >> i) & 1))
465-
{
466-
sz++;
459+
pStreamGuid = NULL;
460+
if (!fusUtilReferenceStreamByName(pStorHeader, "#GUID", &pStreamGuid)) {
461+
FreeLibrary(hModule);
462+
return FALSE;
467463
}
468464

469-
offset = FIELD_OFFSET(STORAGETABLESHEADER, Rows) + (sz * sizeof(ULONG));
465+
pTablesHeader = (STORAGETABLESHEADER*)RtlOffsetToPointer(pStorSign, pStreamTables->iOffset);
466+
sz = 0;
467+
468+
//
469+
// __popcnt64 or the garbage code below
470+
//
471+
for (i = 0; i < MAX_CLR_TABLES; i++)
472+
if ((i < 32 && (pTablesHeader->Valid.u.LowPart >> i) & 1) ||
473+
(i >= 32 && (pTablesHeader->Valid.u.HighPart >> i) & 1))
474+
{
475+
sz++;
476+
}
470477

471-
tablesPtr = (PBYTE)RtlOffsetToPointer(pTablesHeader, offset);
472-
tablesPtr += sizeof(WORD);
478+
offset = FIELD_OFFSET(STORAGETABLESHEADER, Rows) + (sz * sizeof(ULONG));
473479

474-
if (pTablesHeader->HeapOffsetSizes & MD_STRINGS_BIT)
475-
tablesPtr += sizeof(DWORD);
476-
else
480+
tablesPtr = (PBYTE)RtlOffsetToPointer(pTablesHeader, offset);
477481
tablesPtr += sizeof(WORD);
478482

479-
if (pTablesHeader->HeapOffsetSizes & MD_GUIDS_BIT)
480-
mvidIndex = *(PULONG)tablesPtr;
481-
else
482-
mvidIndex = *(PUSHORT)tablesPtr;
483+
if (pTablesHeader->HeapOffsetSizes & MD_STRINGS_BIT)
484+
tablesPtr += sizeof(DWORD);
485+
else
486+
tablesPtr += sizeof(WORD);
487+
488+
if (pTablesHeader->HeapOffsetSizes & MD_GUIDS_BIT)
489+
mvidIndex = *(PULONG)tablesPtr;
490+
else
491+
mvidIndex = *(PUSHORT)tablesPtr;
483492

484-
if (mvidIndex) {
485-
guidsPtr = (LPGUID)RtlOffsetToPointer(pStorSign, pStreamGuid->iOffset);
486-
RtlCopyMemory(ModuleVersionId, &guidsPtr[mvidIndex - 1], sizeof(GUID));
487-
bResult = TRUE;
493+
if (mvidIndex) {
494+
guidsPtr = (LPGUID)RtlOffsetToPointer(pStorSign, pStreamGuid->iOffset);
495+
RtlCopyMemory(ModuleVersionId, &guidsPtr[mvidIndex - 1], sizeof(GUID));
496+
bResult = TRUE;
497+
}
488498
}
489499
}
490-
491500
FreeLibrary(hModule);
492501
}
493502

‎Source/Akagi/methods/antonioCoco.c‎

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
/*******************************************************************************
22
*
3-
* (C) COPYRIGHT AUTHORS, 2023
3+
* (C) COPYRIGHT AUTHORS, 2023 - 2025
44
*
55
* TITLE: ANTONIOCOCO.C
66
*
7-
* VERSION: 3.65
7+
* VERSION: 3.69
88
*
9-
* DATE: 01 Oct 2023
9+
* DATE: 07 Jul 2025
1010
*
1111
* UAC bypass method from antonioCoco.
1212
*
@@ -482,6 +482,7 @@ BOOL ucmxRpcAppendRequestData_Binary(
482482
{
483483
DWORD dwBytesAvailable = 0;
484484
DWORD dwDataLength = DataLength;
485+
DWORD dwPadding = 0;
485486

486487
if (IsUnicode)
487488
dwDataLength *= sizeof(WCHAR);
@@ -492,11 +493,13 @@ BOOL ucmxRpcAppendRequestData_Binary(
492493
if (RpcConnection->dwRequestInitialized == 0)
493494
return FALSE;
494495

496+
dwPadding = CALC_ALIGN_PADDING(dwDataLength, sizeof(ULONG));
497+
495498
//
496499
// Calculate number of bytes remaining in the input buffer.
497500
//
498501
dwBytesAvailable = sizeof(RpcConnection->bProcedureInputData) - RpcConnection->dwProcedureInputDataLength;
499-
if (dwDataLength > dwBytesAvailable)
502+
if ((dwDataLength + dwPadding) > dwBytesAvailable)
500503
{
501504
//
502505
// Set input error flag.
@@ -510,7 +513,7 @@ BOOL ucmxRpcAppendRequestData_Binary(
510513
//
511514
RtlCopyMemory(&RpcConnection->bProcedureInputData[RpcConnection->dwProcedureInputDataLength], Data, dwDataLength);
512515
RpcConnection->dwProcedureInputDataLength += dwDataLength;
513-
RpcConnection->dwProcedureInputDataLength += CALC_ALIGN_PADDING(dwDataLength, sizeof(ULONG));
516+
RpcConnection->dwProcedureInputDataLength += dwPadding;
514517

515518
return TRUE;
516519
}
@@ -715,6 +718,10 @@ SECURITY_STATUS ucmxForgeNetworkAuthToken(
715718
negotiateBuffer.cbBuffer = MAX_MESSAGE_SIZE;
716719
negotiateBuffer.BufferType = SECBUFFER_TOKEN;
717720
negotiateBuffer.pvBuffer = supHeapAlloc(MAX_MESSAGE_SIZE);
721+
if (negotiateBuffer.pvBuffer == NULL) {
722+
secStatus = SEC_E_INSUFFICIENT_MEMORY;
723+
break;
724+
}
718725

719726
secStatus = InitializeSecurityContext(&hCredClient,
720727
NULL,
@@ -738,6 +745,10 @@ SECURITY_STATUS ucmxForgeNetworkAuthToken(
738745
challengeBuffer.cbBuffer = MAX_MESSAGE_SIZE;
739746
challengeBuffer.BufferType = SECBUFFER_TOKEN;
740747
challengeBuffer.pvBuffer = supHeapAlloc(MAX_MESSAGE_SIZE);
748+
if (challengeBuffer.pvBuffer == NULL) {
749+
secStatus = SEC_E_INSUFFICIENT_MEMORY;
750+
break;
751+
}
741752

742753
secStatus = AcceptSecurityContext(&hCredServer,
743754
NULL,
@@ -758,6 +769,10 @@ SECURITY_STATUS ucmxForgeNetworkAuthToken(
758769
authenticateBuffer.cbBuffer = MAX_MESSAGE_SIZE;
759770
authenticateBuffer.BufferType = SECBUFFER_TOKEN;
760771
authenticateBuffer.pvBuffer = supHeapAlloc(MAX_MESSAGE_SIZE);
772+
if (authenticateBuffer.pvBuffer == NULL) {
773+
secStatus = SEC_E_INSUFFICIENT_MEMORY;
774+
break;
775+
}
761776

762777
secStatus = InitializeSecurityContext(NULL,
763778
&clientContextHandle,
@@ -815,6 +830,8 @@ SECURITY_STATUS ucmxForgeNetworkAuthToken(
815830
* Purpose:
816831
*
817832
* Bypass UAC using SSPI datagram context.
833+
*
834+
* Fixed by MS ninja patch (including old Win10 releases).
818835
*
819836
*/
820837
NTSTATUS ucmSspiDatagramMethod(

‎Source/Akagi/methods/azagarampur.c‎

Lines changed: 36 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@
44
*
55
* TITLE: AZAGARAMPUR.C
66
*
7-
* VERSION: 3.67
7+
* VERSION: 3.69
88
*
9-
* DATE: 11 Feb 2025
9+
* DATE: 07 Jul 2025
1010
*
1111
* UAC bypass methods from AzAgarampur.
1212
*
@@ -280,38 +280,37 @@ NTSTATUS ucmNICPoisonMethod(
280280
//
281281
// Restore original file contents and permissions.
282282
//
283-
if (origFileBuffer && lpTargetFileName) {
284-
285-
hFile = CreateFile(lpTargetFileName,
286-
GENERIC_WRITE,
287-
0,
288-
NULL,
289-
OPEN_EXISTING,
290-
0,
291-
NULL);
283+
if (origFileBuffer) {
284+
if (lpTargetFileName) {
285+
hFile = CreateFile(lpTargetFileName,
286+
GENERIC_WRITE,
287+
0,
288+
NULL,
289+
OPEN_EXISTING,
290+
0,
291+
NULL);
292292

293-
if (hFile != INVALID_HANDLE_VALUE) {
294-
WriteFile(hFile, origFileBuffer, origSize, &bytesIO, NULL);
295-
SetEndOfFile(hFile);
296-
CloseHandle(hFile);
293+
if (hFile != INVALID_HANDLE_VALUE) {
294+
WriteFile(hFile, origFileBuffer, origSize, &bytesIO, NULL);
295+
SetEndOfFile(hFile);
296+
CloseHandle(hFile);
297+
}
297298
}
298299

299300
supVirtualFree(origFileBuffer, NULL);
301+
}
300302

301-
if (oldSecurity) {
302-
303-
if (bSecurityReset) {
304-
305-
ucmMasqueradedSetObjectSecurityCOM(lpTargetFileName,
306-
DACL_SECURITY_INFORMATION,
307-
SE_FILE_OBJECT,
308-
oldSecurity);
309-
310-
}
311-
312-
CoTaskMemFree(oldSecurity);
303+
if (oldSecurity) {
304+
if (bSecurityReset && lpTargetFileName) {
305+
ucmMasqueradedSetObjectSecurityCOM(lpTargetFileName,
306+
DACL_SECURITY_INFORMATION,
307+
SE_FILE_OBJECT,
308+
oldSecurity);
313309
}
310+
CoTaskMemFree(oldSecurity);
311+
}
314312

313+
if (lpTargetFileName) {
315314
supHeapFree(lpTargetFileName);
316315
}
317316

@@ -1876,10 +1875,17 @@ NTSTATUS ucmxGenerateAUX(
18761875

18771876
asmName->lpVtbl->Finalize(asmName);
18781877
asmName->lpVtbl->Release(asmName);
1878+
asmName = NULL;
18791879
}
18801880

1881-
if (FAILED(hr) || bFound == FALSE)
1881+
if (FAILED(hr) || bFound == FALSE) {
1882+
if (asmName) {
1883+
asmName->lpVtbl->Finalize(asmName);
1884+
asmName->lpVtbl->Release(asmName);
1885+
asmName = NULL;
1886+
}
18821887
break;
1888+
}
18831889

18841890
lpDisplayNameANSI = (LPSTR)supHeapAlloc((1 + cchDisplayName) * sizeof(CHAR));
18851891
if (lpDisplayNameANSI == NULL)
@@ -1985,12 +1991,8 @@ NTSTATUS ucmxGenerateAUX(
19851991
if (asmEnum)
19861992
asmEnum->lpVtbl->Release(asmEnum);
19871993

1988-
if (!NT_SUCCESS(ntStatus)) {
1989-
1990-
if (auxPtr)
1991-
supHeapFree(auxPtr);
1992-
1993-
}
1994+
if (!NT_SUCCESS(ntStatus) && auxPtr)
1995+
supHeapFree(auxPtr);
19941996

19951997
return ntStatus;
19961998
}

0 commit comments

Comments
 (0)