Git Product home page Git Product logo

houdini's Introduction

Houdini

Houdini is a rust library that allows you to delete your executable while it's running.

This is fairly straightforward for unix systems, since the executable is released after getting mapped to the memory. We just need to find where it is and unlink it.

On Windows, we use a method discovered by @jonasLyk. My implementation heavily references @byt3bl33d3r's Nim implementation in OffensiveNim and in turn LloydLabs' initial C PoC.

Usage

// With a default placeholder value on windows (`svcmsrpc`)
use houdini;

fn main() {
    match houdini::disappear() {
        Ok(_) => println!("Pulled a Houdini!!"),
        Err(e) => println!("Nope! => {}", e),
    };
}
// With a placeholder you provide
use houdini::disappear;

fn main() {
    #[cfg(target_os = "windows")]
    match houdini::disappear_with_placeholder("temporary") {
        Ok(_) => println!("Pulled a Houdini!!"),
        Err(e) => println!("Nope! => {}", e),
    };
}

houdini's People

Contributors

yamakadi avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar

houdini's Issues

Possible buffer overflow ?

I think there might be a buffer overflow in how you instanciate the structre FILE_RENAME_INFO.

In the file mod.rs in windows directory, you do this :

`fn rename(placeholder: &[u8; 9], handle: HANDLE) -> Result<(), HoudiniError> {
let filename = placeholder.map(|b| b as u16);
let length = size_of::<[u16; 9]>();

let mut file_rename_info: FILE_RENAME_INFO = FILE_RENAME_INFO {
    Anonymous: FILE_RENAME_INFO_0 {
        ReplaceIfExists: BOOLEAN(0),
    },
    RootDirectory: HANDLE::default(),
    FileNameLength: length as u32,
    FileName: [0],
};

unsafe {
    copy(
        filename.as_ptr(),
        file_rename_info.FileName.as_mut_ptr(),
        length,
    )
};`

But here, you are instanciating FILE_RENAME_INFO as any other variables. So I think (tell me if I'm wrong) the memory allocation will only allocate an array of length 1 for the FileName member of the struct whereas you start copying your string at this location. So I think you copy your string here in non allocated memory.

The correct way to instanciate this string is on the heap, where you allocate as much memory as you need for your string + the size of the FILE_RENAME_INFO and reinterpret cast the given memory address as pointer to a FILE_RENAME_INFO struct.

In C, it would look like this :

FILE_RENAME_INFO *file_rename_info = malloc(sizeof(FILE_RENAME_INFO) + n * sizeof(wchar_t));

with n being your string size.

Maybe I'm all wrong about this as I'm not an expert on how Rust allocates memory and everything, but it might be worth looking into it.

Houdini state

Hello!

Does Houdini still work? Tested on Windows 11 and executable is not deleted.

regards

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.