Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion sigs/cert.rst
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ Signature::
Parameters::

* HCRYPTPROV hProv
** LPCTSTR szSubsystemProtocol store_name
** LPCSTR szSubsystemProtocol store_name


CertOpenSystemStoreW
Expand Down
4 changes: 2 additions & 2 deletions sigs/crypto.rst
Original file line number Diff line number Diff line change
Expand Up @@ -313,7 +313,7 @@ Pre::
length += copy_uint32(&rgcbToBeHashed[idx]);
}

uint8_t *buf = mem_alloc(length);
uint8_t *buf = (uint8_t *)mem_alloc(length);
if(buf != NULL) {
for (uint32_t idx = 0, offset = 0; idx < cToBeHashed; idx++) {
copy_bytes(
Expand Down Expand Up @@ -564,7 +564,7 @@ Pre::
if(pMessage != NULL && pMessage->pBuffers != NULL) {
secbuf_get_buffer(pMessage->cBuffers,
pMessage->pBuffers, &buf, &length);
buf = memdup(buf, length);
buf = (uint8_t *)memdup(buf, length);
}

Logging::
Expand Down
12 changes: 6 additions & 6 deletions sigs/file.rst
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ Signature::

Parameters::

* LPCTSTR lpPathName
* LPCSTR lpPathName

Pre::

Expand Down Expand Up @@ -189,7 +189,7 @@ Signature::

Parameters::

* LPCTSTR lpFileName
* LPCSTR lpFileName
* FINDEX_INFO_LEVELS fInfoLevelId
* LPVOID lpFindFileData
* FINDEX_SEARCH_OPS fSearchOp
Expand Down Expand Up @@ -251,8 +251,8 @@ Signature::

Parameters::

* LPCTSTR lpExistingFileName
* LPCTSTR lpNewFileName
* LPCSTR lpExistingFileName
* LPCSTR lpNewFileName
** BOOL bFailIfExists fail_if_exists

Pre::
Expand Down Expand Up @@ -577,7 +577,7 @@ Signature::

Parameters::

* LPTSTR lpBuffer
* LPSTR lpBuffer
* UINT uSize

Logging::
Expand Down Expand Up @@ -613,7 +613,7 @@ Signature::

Parameters::

* LPTSTR lpBuffer
* LPSTR lpBuffer
* UINT uSize

Logging::
Expand Down
2 changes: 1 addition & 1 deletion sigs/job.rst
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ Signature::
Parameters::

* LPSECURITY_ATTRIBUTES lpJobAttributes
** LPCTSTR lpName
** LPCWSTR lpName

Logging::

Expand Down
30 changes: 15 additions & 15 deletions sigs/network.rst
Original file line number Diff line number Diff line change
Expand Up @@ -110,10 +110,10 @@ Signature::

Parameters::

** LPCTSTR lpszAgent user_agent
** LPCSTR lpszAgent user_agent
** DWORD dwAccessType access_type
** LPCTSTR lpszProxyName proxy_name
** LPCTSTR lpszProxyBypass proxy_bypass
** LPCSTR lpszProxyName proxy_name
** LPCSTR lpszProxyBypass proxy_bypass
** DWORD dwFlags flags

Interesting::
Expand Down Expand Up @@ -161,10 +161,10 @@ Signature::
Parameters::

** HINTERNET hInternet internet_handle
** LPCTSTR lpszServerName hostname
** LPCSTR lpszServerName hostname
** INTERNET_PORT nServerPort port
** LPCTSTR lpszUsername username
** LPCTSTR lpszPassword password
** LPCSTR lpszUsername username
** LPCSTR lpszPassword password
** DWORD dwService service
** DWORD dwFlags flags
* DWORD_PTR dwContext
Expand Down Expand Up @@ -219,8 +219,8 @@ Signature::
Parameters::

** HINTERNET hInternet internet_handle
** LPCTSTR lpszUrl url
* LPCTSTR lpszHeaders
** LPCSTR lpszUrl url
* LPCSTR lpszHeaders
* DWORD dwHeadersLength
** DWORD dwFlags flags
* DWORD_PTR dwContext
Expand Down Expand Up @@ -329,11 +329,11 @@ Signature::
Parameters::

** HINTERNET hConnect connect_handle
** LPCTSTR lpszVerb http_method
** LPCTSTR lpszObjectName path
** LPCTSTR lpszVersion http_version
** LPCTSTR lpszReferer referer
* LPCTSTR *lplpszAcceptTypes
** LPCSTR lpszVerb http_method
** LPCSTR lpszObjectName path
** LPCSTR lpszVersion http_version
** LPCSTR lpszReferer referer
* LPCSTR *lplpszAcceptTypes
** DWORD dwFlags flags
* DWORD_PTR dwContext

Expand Down Expand Up @@ -385,7 +385,7 @@ Signature::
Parameters::

** HINTERNET hRequest request_handle
* LPCTSTR lpszHeaders
* LPCSTR lpszHeaders
* DWORD dwHeadersLength
* LPVOID lpOptional
* DWORD dwOptionalLength
Expand Down Expand Up @@ -837,7 +837,7 @@ Signature::
Parameters::

* DWORD dwNetType
* LPTSTR lpProviderName
* LPWSTR lpProviderName
* LPDWORD lpBufferSize

Ensure::
Expand Down
2 changes: 1 addition & 1 deletion sigs/ole.rst
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ Pre::
MULTI_QI *multi_qi = pResults;
for (uint32_t idx = 0; idx < dwCount; idx++, multi_qi++) {
our_snprintf(index, sizeof(index), "%d", idx++);
clsid_to_string(copy_ptr(&multi_qi->pIID), clsid);
clsid_to_string((IID *)copy_ptr(&multi_qi->pIID), clsid);
log_string(&b, index, clsid, our_strlen(clsid));
}

Expand Down
2 changes: 1 addition & 1 deletion sigs/process_native.rst
Original file line number Diff line number Diff line change
Expand Up @@ -553,7 +553,7 @@ Middle::
// As it is non-trivial to extract the base address of the original
// mapped section, we'll just go ahead and read the memory from the
// remote process.
buffer = mem_alloc(buflen);
buffer = (uint8_t *)mem_alloc(buflen);
if(buffer != NULL) {
virtual_read_ex(ProcessHandle, *BaseAddress, buffer, &buflen);
}
Expand Down
36 changes: 18 additions & 18 deletions sigs/registry.rst
Original file line number Diff line number Diff line change
Expand Up @@ -13,15 +13,15 @@ RegOpenKeyExA
Parameters::

** HKEY hKey base_handle
** LPCTSTR lpSubKey regkey_r
** LPCSTR lpSubKey regkey_r
** DWORD ulOptions options
** REGSAM samDesired access
** PHKEY phkResult key_handle

Pre::

wchar_t *regkey = get_unicode_buffer();
reg_get_key_asciiz(hKey, lpSubKey, regkey);
reg_get_key_asciizA(hKey, lpSubKey, regkey);

Interesting::

Expand Down Expand Up @@ -75,9 +75,9 @@ RegCreateKeyExA
Parameters::

** HKEY hKey base_handle
** LPCTSTR lpSubKey regkey_r
** LPCSTR lpSubKey regkey_r
* DWORD Reserved
** LPTSTR lpClass class
** LPSTR lpClass class
** DWORD dwOptions options
** REGSAM samDesired access
* LPSECURITY_ATTRIBUTES lpSecurityAttributes
Expand All @@ -87,7 +87,7 @@ Parameters::
Pre::

wchar_t *regkey = get_unicode_buffer();
reg_get_key_asciiz(hKey, lpSubKey, regkey);
reg_get_key_asciizA(hKey, lpSubKey, regkey);

Interesting::

Expand Down Expand Up @@ -149,12 +149,12 @@ RegDeleteKeyA
Parameters::

** HKEY hKey key_handle
** LPCTSTR lpSubKey regkey_r
** LPCSTR lpSubKey regkey_r

Pre::

wchar_t *regkey = get_unicode_buffer();
reg_get_key_asciiz(hKey, lpSubKey, regkey);
reg_get_key_asciizA(hKey, lpSubKey, regkey);

Interesting::

Expand Down Expand Up @@ -231,10 +231,10 @@ Parameters::

** HKEY hKey key_handle
** DWORD dwIndex index
** LPTSTR lpName key_name
** LPSTR lpName key_name
* LPDWORD lpcName
* LPDWORD lpReserved
** LPTSTR lpClass class
** LPSTR lpClass class
* LPDWORD lpcClass
* PFILETIME lpftLastWriteTime

Expand Down Expand Up @@ -297,7 +297,7 @@ Parameters::

** HKEY hKey key_handle
** DWORD dwIndex index
** LPTSTR lpValueName regkey_r
** LPSTR lpValueName regkey_r
* LPDWORD lpcchValueName
* LPDWORD lpReserved
** LPDWORD lpType reg_type
Expand All @@ -316,7 +316,7 @@ Ensure::
Pre::

wchar_t *regkey = get_unicode_buffer();
reg_get_key_asciiz(hKey, lpValueName, regkey);
reg_get_key_asciizA(hKey, lpValueName, regkey);

*lpType = REG_NONE;

Expand Down Expand Up @@ -376,7 +376,7 @@ RegSetValueExA
Parameters::

** HKEY hKey key_handle
** LPCTSTR lpValueName regkey_r
** LPCSTR lpValueName regkey_r
* DWORD Reserved
** DWORD dwType reg_type
* const BYTE *lpData
Expand All @@ -389,7 +389,7 @@ Flags::
Pre::

wchar_t *regkey = get_unicode_buffer();
reg_get_key_asciiz(hKey, lpValueName, regkey);
reg_get_key_asciizA(hKey, lpValueName, regkey);

Interesting::

Expand Down Expand Up @@ -450,7 +450,7 @@ RegQueryValueExA
Parameters::

** HKEY hKey key_handle
** LPCTSTR lpValueName regkey_r
** LPCSTR lpValueName regkey_r
* LPDWORD lpReserved
** LPDWORD lpType reg_type
* LPBYTE lpData
Expand All @@ -468,7 +468,7 @@ Ensure::
Pre::

wchar_t *regkey = get_unicode_buffer();
reg_get_key_asciiz(hKey, lpValueName, regkey);
reg_get_key_asciizA(hKey, lpValueName, regkey);

*lpType = REG_NONE;

Expand Down Expand Up @@ -534,12 +534,12 @@ RegDeleteValueA
Parameters::

** HKEY hKey key_handle
** LPCTSTR lpValueName regkey_r
** LPCSTR lpValueName regkey_r

Pre::

wchar_t *regkey = get_unicode_buffer();
reg_get_key_asciiz(hKey, lpValueName, regkey);
reg_get_key_asciizA(hKey, lpValueName, regkey);

Interesting::

Expand Down Expand Up @@ -586,7 +586,7 @@ RegQueryInfoKeyA
Parameters::

** HKEY hKey key_handle
** LPTSTR lpClass class
** LPSTR lpClass class
* LPDWORD lpcClass
* LPDWORD lpReserved
** LPDWORD lpcSubKeys subkey_count
Expand Down
6 changes: 3 additions & 3 deletions sigs/registry_native.rst
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ Flags::

Pre::

wchar_t *class = extract_unicode_string_unistr(Class);
wchar_t *classStr = extract_unicode_string_unistr(Class);

wchar_t *regkey = get_unicode_buffer();
reg_get_key_objattr(ObjectAttributes, regkey);
Expand All @@ -41,11 +41,11 @@ Interesting::
Logging::

u regkey regkey
u class class
u class classStr

Post::

free_unicode_buffer(class);
free_unicode_buffer(classStr);
free_unicode_buffer(regkey);


Expand Down
22 changes: 11 additions & 11 deletions sigs/services.rst
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,8 @@ Signature::

Parameters::

** LPCTSTR lpMachineName machine_name
** LPCTSTR lpDatabaseName database_name
** LPCSTR lpMachineName machine_name
** LPCSTR lpDatabaseName database_name
** DWORD dwDesiredAccess desired_access

Interesting::
Expand Down Expand Up @@ -55,18 +55,18 @@ Signature::
Parameters::

** SC_HANDLE hSCManager service_manager_handle
** LPCTSTR lpServiceName service_name
** LPCTSTR lpDisplayName display_name
** LPCSTR lpServiceName service_name
** LPCSTR lpDisplayName display_name
** DWORD dwDesiredAccess desired_access
** DWORD dwServiceType service_type
** DWORD dwStartType start_type
** DWORD dwErrorControl error_control
* LPCTSTR lpBinaryPathName
* LPCTSTR lpLoadOrderGroup
* LPCSTR lpBinaryPathName
* LPCSTR lpLoadOrderGroup
* LPDWORD lpdwTagId
* LPCTSTR lpDependencies
** LPCTSTR lpServiceStartName service_start_name
** LPCTSTR lpPassword password
* LPCSTR lpDependencies
** LPCSTR lpServiceStartName service_start_name
** LPCSTR lpPassword password

Pre::

Expand Down Expand Up @@ -157,7 +157,7 @@ Signature::
Parameters::

** SC_HANDLE hSCManager service_manager_handle
** LPCTSTR lpServiceName service_name
** LPCSTR lpServiceName service_name
** DWORD dwDesiredAccess desired_access

Interesting::
Expand Down Expand Up @@ -204,7 +204,7 @@ Parameters::

** SC_HANDLE hService service_handle
* DWORD dwNumServiceArgs
* LPCTSTR *lpServiceArgVectors
* LPCSTR *lpServiceArgVectors

Logging::

Expand Down
Loading