Skip to main content

windows_bridge/file_transfer/
recipe.rs

1use vmi::{
2    arch::amd64::Amd64,
3    driver::VmiMemory,
4    os::windows::WindowsOs,
5    utils::shellcode::{KernelRecipe, ParameterValue, kernel_shellcode_call_recipe},
6};
7
8/// Compiled `file-transfer` shellcode.
9const FILE_TRANSFER_SHELLCODE: &[u8] = include_bytes!(concat!(
10    env!("CARGO_MANIFEST_DIR"),
11    "/examples/shellcodes/bin/x64/file-transfer.bin"
12));
13
14/// Builds a recipe that runs the `file-transfer` shellcode on the thread
15/// executing `NtClose`.
16///
17/// The call recipe passes the kernel image base as the first and the
18/// `file_handle` as the second argument.
19///
20/// **Note:** The transfer runs on the same thread that called `NtClose`.
21/// It reads the file before Windows closes the handle.
22///
23/// This keeps the transfer in the process where the handle refers to
24/// the file we want to read. The recipe for starting a new kernel thread
25/// (`spawn`) would run the transfer in the `System` process instead, where
26/// the same handle might refer to a different file or no file at all.
27pub fn file_transfer_recipe<Driver>(file_handle: u64) -> KernelRecipe<WindowsOs<Driver>>
28where
29    Driver: VmiMemory<Architecture = Amd64>,
30{
31    kernel_shellcode_call_recipe(FILE_TRANSFER_SHELLCODE, ParameterValue(file_handle))
32}