sync/es3n1n-defendnot
1
0
Fork 0
mirror of https://github.com/es3n1n/defendnot.git synced 2026-08-02 10:32:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(autorun): add AS_SYSTEM_ON_BOOT autorun type

Browse Source
This commit is contained in:
es3n1n
2025-05-15 21:51:22 +09:00
parent ad032ab0d5
commit 96d0cddf8c
4 changed files with 58 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
defendnot-loader/core/autorun.cpp
View File

@@ -90,10 +90,20 @@ namespace loader {
}
} // namespace
[[nodiscard]] bool add_to_autorun() {
[[nodiscard]] bool add_to_autorun(AutorunType type) {
const auto bin_path = shared::get_this_module_path();
return with_service([bin_path](ITaskService* service, ITaskFolder* folder) -> bool {
return with_service([bin_path, type](ITaskService* service, ITaskFolder* folder) -> bool {
/// Deduce the autorun config based on type
const auto task_trigger = type == AutorunType::AS_SYSTEM_ON_BOOT ? TASK_TRIGGER_BOOT : TASK_TRIGGER_LOGON;
const auto logon_type = type == AutorunType::AS_SYSTEM_ON_BOOT ? TASK_LOGON_SERVICE_ACCOUNT : TASK_LOGON_INTERACTIVE_TOKEN;
BSTR user_id = nullptr;
auto bstr_sys = bstr_t(L"SYSTEM");
if (type == AutorunType::AS_SYSTEM_ON_BOOT) {
user_id = bstr_sys;
}
ComPtr<ITaskDefinition> task;
auto hr = service->NewTask(0, task.ref_to_ptr());
if (FAILED(hr)) {
@@ -119,7 +129,7 @@ namespace loader {
}
ComPtr<ITrigger> trigger;
hr = trigger_collection->Create(TASK_TRIGGER_LOGON, trigger.ref_to_ptr());
hr = trigger_collection->Create(task_trigger, trigger.ref_to_ptr());
if (FAILED(hr)) {
return false;
}
@@ -148,9 +158,9 @@ namespace loader {
return false;
}
/// Elevated, when any user logs in
principal->put_GroupId(bstr_t("BUILTIN\\Users"));
principal->put_LogonType(TASK_LOGON_INTERACTIVE_TOKEN);
/// Elevated, when system boots
principal->put_UserId(user_id);
principal->put_LogonType(logon_type);
principal->put_RunLevel(TASK_RUNLEVEL_HIGHEST);
/// Info
@@ -166,8 +176,8 @@ namespace loader {
/// Register the task and we are done
ComPtr<IRegisteredTask> registered_task;
hr = folder->RegisterTaskDefinition(bstr_t(kTaskName.data()), task.get(), TASK_CREATE_OR_UPDATE, VARIANT{}, VARIANT{},
TASK_LOGON_INTERACTIVE_TOKEN, variant_t(L""), registered_task.ref_to_ptr());
hr = folder->RegisterTaskDefinition(bstr_t(kTaskName.data()), task.get(), TASK_CREATE_OR_UPDATE, VARIANT{}, VARIANT{}, TASK_LOGON_NONE,
variant_t(L""), registered_task.ref_to_ptr());
return SUCCEEDED(hr);
});
}

8
defendnot-loader/core/core.hpp
View File

@@ -5,15 +5,21 @@
#include <Windows.h>
namespace loader {
enum class AutorunType : std::uint8_t {
AS_SYSTEM_ON_BOOT = 0, ///< launch on system boot as NT AUTHORITY\SYSTEM
AS_CURRENT_USER_ON_LOGIN = 1, ///< launch on user login
};
struct Config {
public:
std::string name;
bool disable;
bool verbose;
bool from_autorun;
AutorunType autorun_type;
};
[[nodiscard]] HANDLE inject(std::string_view dll_path, std::string_view proc_name);
[[nodiscard]] bool add_to_autorun();
[[nodiscard]] bool add_to_autorun(AutorunType type);
[[nodiscard]] bool remove_from_autorun();
} // namespace loader