mimikatz/mimispool/mimispool.c

122 lines
2.5 KiB
C

/* Benjamin DELPY `gentilkiwi`
https://blog.gentilkiwi.com
benjamin@gentilkiwi.com
Licence : https://creativecommons.org/licenses/by/4.0/
*/
#include "mimispool.h"
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
BOOL ret = TRUE;
switch( ul_reason_for_call )
{
case DLL_PROCESS_ATTACH:
kspool(TEXT(__FUNCTION__) L"-PROCESS_ATTACH");
ret = FALSE;
// FALSE avoid to keep library in memory
// TRUE will mimic "real" driver/config -- to use/test with /useown on local (remote is not compatible with GetFileVersionInfo*)
break;
case DLL_THREAD_ATTACH:
kspool(TEXT(__FUNCTION__) L"-THREAD_ATTACH");
break;
case DLL_THREAD_DETACH:
kspool(TEXT(__FUNCTION__) L"-THREAD_DETACH");
break;
case DLL_PROCESS_DETACH:
kspool(TEXT(__FUNCTION__) L"-PROCESS_DETACH");
break;
}
return ret;
}
BOOL APIENTRY APIENTRY DrvQueryDriverInfo(DWORD dwMode, PVOID pBuffer, DWORD cbBuf, PDWORD pcbNeeded)
{
BOOL status = FALSE;
kspool(TEXT(__FUNCTION__));
if ( dwMode == DRVQUERY_USERMODE)
{
*pcbNeeded = sizeof(DWORD);
if (pBuffer && (cbBuf >= sizeof(DWORD)))
{
status = TRUE;
*(DWORD *)pBuffer = TRUE;
}
SetLastError(ERROR_INSUFFICIENT_BUFFER);
}
else
{
SetLastError(ERROR_INVALID_PARAMETER);
}
return status;
}
BOOL APIENTRY DrvEnableDriver(ULONG iEngineVersion, ULONG cj, DRVENABLEDATA *pded)
{
BOOL status = FALSE;
kspool(TEXT(__FUNCTION__));
if((iEngineVersion < 0x20000) || (cj < 0x10))
{
SetLastError(ERROR_BAD_DRIVER_LEVEL);
}
else
{
pded->iDriverVersion = 0x20000;
pded->pdrvfn = NULL;
pded->c = 0;
status = TRUE;
}
return status;
}
VOID APIENTRY DrvDisableDriver()
{
kspool(TEXT(__FUNCTION__));
}
VOID APIENTRY DrvResetConfigCache()
{
kspool(TEXT(__FUNCTION__));
}
void kspool(LPCWSTR szFrom)
{
FILE * kspool_logfile;
WCHAR Buffer[256 + 1];
DWORD cbBuffer = ARRAYSIZE(Buffer);
#pragma warning(push)
#pragma warning(disable:4996)
if(kspool_logfile = _wfopen(L"mimispool.log", L"a"))
#pragma warning(pop)
{
if(GetUserName(Buffer, &cbBuffer))
{
klog(kspool_logfile, L"[" PLATFORM L"] [%s] I\'m running with \'%s\' (and I like it :)\n", szFrom, Buffer);
}
fclose(kspool_logfile);
}
}
void klog(FILE * logfile, PCWCHAR format, ...)
{
if(logfile)
{
va_list args;
va_start(args, format);
vfwprintf(logfile, format, args);
va_end(args);
fflush(logfile);
}
}