RistBS

## ntIoFunctions.txt
2: kd> x nt!Io*
fffff800`3e820158 nt!IopStoreArcInformation (void)
fffff800`3df1ee6c nt!IopCheckListForCancelableIrp (void)
fffff800`3e56ebc4 nt!IopInitializeCrashDump (void)
fffff800`3df74b50 nt!IoCsqRemoveIrp (void)
fffff800`3e560a70 nt!IopPortAddAllocation (void)
fffff800`3df164f0 nt!IoReleaseRemoveLockEx (void)
fffff800`3df95750 nt!IoAllocateDriverObjectExtension (void)
fffff800`3e446f34 nt!IopQueryNameInternal (void)
fffff800`3ded49b0 nt!IoReportTargetDeviceChangeAsynchronous (void)

## CtlInject_Legacy.c
/*!
 *
 * ROGUE
 *
 * GuidePoint Security LLC
 *
 * Threat and Attack Simulation Team
 *
!*/

## export_payload_dialog.py
import asyncio
import qtinter
import ipaddress

from PyQt5.QtWidgets import *
from PyQt5.QtCore import *
from PyQt5.QtGui import *

class ExportPayloadDialog( QObject ):
    """

## shellcode_exec_workerfactory.c
#include <Windows.h>
#include <stdio.h>


#define PRINTDEBUG(fmt, ...) printf(fmt "\n", ##__VA_ARGS__)
#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)

#define WORKER_FACTORY_FULL_ACCESS 0xf00ff

typedef struct _UNICODE_STRING {

## wow64.cpp
//
// How to locate the WOW64 Callback Table in ntdll.dll
//
// @modexpblog
//

#define PHNT_VERSION PHNT_VISTA
#include <phnt_windows.h>
#include <phnt.h>

## Entry.c
/*!
 *
 * RPROXICMP
 *
 * GuidePoint Security LLC
 *
 * Threat and Attack Simulation Team
 *
!*/
	2: kd> x nt!Io*
	fffff800`3e820158 nt!IopStoreArcInformation (void)
	fffff800`3df1ee6c nt!IopCheckListForCancelableIrp (void)
	fffff800`3e56ebc4 nt!IopInitializeCrashDump (void)
	fffff800`3df74b50 nt!IoCsqRemoveIrp (void)
	fffff800`3e560a70 nt!IopPortAddAllocation (void)
	fffff800`3df164f0 nt!IoReleaseRemoveLockEx (void)
	fffff800`3df95750 nt!IoAllocateDriverObjectExtension (void)
	fffff800`3e446f34 nt!IopQueryNameInternal (void)
	fffff800`3ded49b0 nt!IoReportTargetDeviceChangeAsynchronous (void)
	/*!
	*
	* ROGUE
	*
	* GuidePoint Security LLC
	*
	* Threat and Attack Simulation Team
	*
	!*/
	import asyncio
	import qtinter
	import ipaddress

	from PyQt5.QtWidgets import *
	from PyQt5.QtCore import *
	from PyQt5.QtGui import *

	class ExportPayloadDialog( QObject ):
	"""
	#include <Windows.h>
	#include <stdio.h>


	#define PRINTDEBUG(fmt, ...) printf(fmt "\n", ##__VA_ARGS__)
	#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)

	#define WORKER_FACTORY_FULL_ACCESS 0xf00ff

	typedef struct _UNICODE_STRING {
	//
	// How to locate the WOW64 Callback Table in ntdll.dll
	//
	// @modexpblog
	//

	#define PHNT_VERSION PHNT_VISTA
	#include <phnt_windows.h>
	#include <phnt.h>
	/*!
	*
	* RPROXICMP
	*
	* GuidePoint Security LLC
	*
	* Threat and Attack Simulation Team
	*
	!*/