#include "ProcessProfiler.h"



NTSTATUS Native_Server(void);

NTSTATUS Native_Accept(PACCEPT_PARAMS);



NTSTATUS Native_Server(void)

{

	OBJECT_ATTRIBUTES ObjAttr = {0};

	UNICODE_STRING PortName = {0};

    LARGE_INTEGER SectionSize = {LARGE_MESSAGE_SIZE};

	PORT_MESSAGE MessageHeader = {0};  

    NTSTATUS Status = 0;

    HANDLE LpcPortHandle = INVALID_HANDLE_VALUE;

    HANDLE SectionHandle = INVALID_HANDLE_VALUE;

	ACCEPT_PARAMS Params = {0};

	HANDLE hThread = INVALID_HANDLE_VALUE;

	CLIENT_ID ClientId = {0}; 

    __try

	{

		Status = NtCreateSection(&SectionHandle,SECTION_MAP_READ | SECTION_MAP_WRITE,NULL,&SectionSize,PAGE_EXECUTE_READWRITE,SEC_COMMIT,NULL);

        if(!NT_SUCCESS(Status))

            __leave;

		RtlInitUnicodeString(&PortName, LpcPortName);

        InitializeObjectAttributes(&ObjAttr, &PortName, 0, NULL, NULL);

        Status = NtCreatePort(&LpcPortHandle,&ObjAttr,NULL,sizeof(PORT_MESSAGE),0);

        if(!NT_SUCCESS(Status))

            __leave;

ContinueListening:

		 Status = NtListenPort(LpcPortHandle, &MessageHeader);

        if(!NT_SUCCESS(Status))

            __leave;

		else

		{

			Params.LpcPortHandle = LpcPortHandle;

			Params.SectionHandle = SectionHandle;

			Params.MessageHeader = MessageHeader;

			Status = RtlCreateUserThread(NtCurrentProcess(),0,0,0,0,0,(PUSER_THREAD_START_ROUTINE)Native_Accept,&Params,&hThread,&ClientId);

			if(!NT_SUCCESS(Status))

				__leave;

			__asm jmp ContinueListening;

		}

	}

    __finally

    {

        if(LpcPortHandle != NULL)

            NtClose(LpcPortHandle);

        if(SectionHandle != NULL)

            NtClose(SectionHandle);

		_ultow(Status,PortName.Buffer,10);

		NtDisplayString(&PortName);

    }

    return Status;

}

NTSTATUS Native_Accept(PACCEPT_PARAMS Accept)

{

	UNICODE_STRING Err = {0};

	HANDLE ServerHandle = NULL;

	PORT_VIEW ServerView = {0};

	REMOTE_PORT_VIEW ClientView;

    NTSTATUS Status = 0;	

	ServerView.Length        = sizeof(PORT_VIEW);

    ServerView.SectionHandle = Accept->SectionHandle;

    ServerView.SectionOffset = 0;

    ServerView.ViewSize      = LARGE_MESSAGE_SIZE;

    ClientView.Length        = sizeof(REMOTE_PORT_VIEW);

	Status = NtAcceptConnectPort(&ServerHandle,NULL,&Accept->MessageHeader,TRUE,&ServerView,&ClientView);

	if(!NT_SUCCESS(Status))

	{

		_ultow(Status,Err.Buffer,10);

		//RtlAppendUnicodeToString(&Err,L"\nIn NtAcceptPort";

		NtDisplayString(&Err);

		return Status;

	}

	Status = NtCompleteConnectPort(ServerHandle);

	if(!NT_SUCCESS(Status))

	{

		_ultow(Status,Err.Buffer,10);

		//RtlAppendUnicodeToString(&Err,L"\nIn NtCompleteConnect";

		NtDisplayString(&Err);

		return Status;

	}

	Status = NtReplyWaitReceivePort(ServerHandle,NULL,NULL,&Accept->MessageHeader);

	if(!NT_SUCCESS(Status))

	{

		_ultow(Status,Err.Buffer,10);

		//RtlAppendUnicodeToString(&Err,L"\nIn NtReplyWaitRecievePort";

		NtDisplayString(&Err);

		return Status;

	}

    //write to ClientView.ViewBase;

	Status = NtReplyPort(Accept->LpcPortHandle, &Accept->MessageHeader);

	{

		_ultow(Status,Err.Buffer,10);

		NtDisplayString(&Err);

		return Status;

	}

	if(ServerHandle != 0)

		NtClose(ServerHandle);

	if(Accept->LpcPortHandle != 0)

		NtClose(Accept->LpcPortHandle);

	if(Accept->SectionHandle != 0)

		NtClose(Accept->SectionHandle);

	return Status;

}

DWORD GetUid(VOID) {

  for(; {

    LUID Luid;

    DWORD Uid;

    NtAllocateLocallyUniqueId(&Luid);

    Uid = Luid.LowPart + Luid.HighPart;

    if((Uid > 0x10) && (Uid != 0xFFFFFFFF)) {

      return(Uid);

    }

  } 

}



NTSTATUS WINAPI SmSsContinue(VOID)

{



	DWORD Uid;

	HANDLE SmApiPort;

	NTSTATUS Status;

	Uid = GetUid();

	SECURITY_QUALITY_OF_SERVICE QoS = {sizeof(QoS), DEFAULT_IMPERSONATION_LEVEL, SECURITY_DYNAMIC_TRACKING, TRUE};

	UNICODE_STRING ApiPortName;

	SB_CONNECTION_REQUEST SbConnectionRequest;

	ULONG SbConnectionRequestSize;

	SbConnectionRequest.SbImageType = Uid;

	ApiPortName.MaximumLength = sizeof(L"\\SmApiPort";

	ApiPortName.Length =  ApiPortName.MaximumLength - 2;

	ApiPortName.Buffer =  L"\\SmApiPort";

	memcpy(SbConnectionRequest.SbApiPortName,ApiPortName.Buffer,ApiPortName.MaximumLength);

	SbConnectionRequestSize = sizeof(SbConnectionRequest);

	__try

	{

		Status = ZwConnectPort(&SmApiPort, &ApiPortName, &QoS, NULL, NULL, NULL, &SbConnectionRequest, &SbConnectionRequestSize);

		if(!NT_SUCCESS(Status))

		{	

			__leave;

		}

	}

	__except(1)

	{

		_ultow(Status,ApiPortName.Buffer,10);

		NtDisplayString(&ApiPortName);

	}

	return Status;

}





void NtProcessStartup( PSTARTUP_ARGUMENT Argument )

{

	SmSsContinue();

	Native_Server();

	NtTerminateProcess( NtCurrentProcess(), 0 );

}

#define _X86_

#include <windows.h>

#include "ntdll.h"



#define LARGE_MESSAGE_SIZE 0x5000

#define LpcPortName L"\\LpcInterceptPort"

#define DelayExecution "NtDelayExecution"



BOOL NtDelayExecutionEx(DWORD dwSeconds);



typedef struct {

       ULONG            Unknown[21];

       UNICODE_STRING   CommandLine;

       UNICODE_STRING   ImageFile;

} ENVIRONMENT_INFORMATION, *PENVIRONMENT_INFORMATION;



typedef struct {

       ULONG                     Unknown[3];

       PENVIRONMENT_INFORMATION  Environment;

} STARTUP_ARGUMENT, *PSTARTUP_ARGUMENT;



typedef struct {

	HANDLE LpcPortHandle;

	HANDLE SectionHandle;

	PORT_MESSAGE MessageHeader;

}ACCEPT_PARAMS,*PACCEPT_PARAMS;



typedef struct _SB_CONNECTION_REQUEST {

  ULONG SbImageType; /* Windows - 2, OS/2 - 5, POSIX - 7 */

  WCHAR SbApiPortName[120];

} SB_CONNECTION_REQUEST, *PSB_CONNECTION_REQUEST;







typedef NTSTATUS (NTAPI*NTDELAYEXECUTION)(BOOL,PLARGE_INTEGER);

BOOL NtDelayExecutionEx(DWORD dwSeconds)

{

	ANSI_STRING FnName = {0};

	PVOID DllHandle = 0;

	NTDELAYEXECUTION Delay;

	LARGE_INTEGER Interval = {0};

    Interval.QuadPart = -(__int64)dwSeconds * 10000 * 1000;

	if(!NT_SUCCESS(LdrLoadDll(0,0,(PUNICODE_STRING)L"ntdll.dll",&DllHandle)))

	{

		return FALSE;

	}

	RtlInitAnsiString(&FnName,DelayExecution);

	if(!NT_SUCCESS(LdrGetProcedureAddress(DllHandle,&FnName,0,(PVOID*)&Delay)))

	{

		return FALSE;

	}

	if(NT_SUCCESS(Delay(FALSE, &Interval)))

	{

		return TRUE;

	}

	else

	{

		return FALSE;

	}

}