var ShellExecuteW = Module.findExportByName("Shell32.dll", 'ShellExecuteW')
Interceptor.attach(ShellExecuteW, {
onEnter: function (args, state) {
console.log("[+] ShellExecuteW");
},
onLeave: function (retval, state) {
console.log("leave ShellExecuteW returns:"+retval);
}
});
var GetVolumeInformationByHandleW = Module.findExportByName("Kernel32.dll", 'GetVolumeInformationByHandleW')
Interceptor.attach(GetVolumeInformationByHandleW, {
onEnter: function (args, state) {
console.log("[+] GetVolumeInformationByHandleW");
},
onLeave: function (retval, state) {
console.log("leave GetVolumeInformationByHandleW returns:"+retval);
}
});
var GetVolumeInformationW = Module.findExportByName("Kernel32.dll", 'GetVolumeInformationW')
Interceptor.attach(GetVolumeInformationW, {
onEnter: function (args, state) {
console.log("[+] GetVolumeInformationW");
},
onLeave: function (retval, state) {
console.log("leave GetVolumeInformationW returns:"+retval);
}
});
var GetLogicalDriveStringsW = Module.findExportByName("Kernel32.dll", 'GetLogicalDriveStringsW')
Interceptor.attach(GetLogicalDriveStringsW, {
onEnter: function (args, state) {
console.log("[+] GetLogicalDriveStringsW");
},
onLeave: function (retval, state) {
console.log("leave GetLogicalDriveStringsW returns:"+retval);
}
});
var QueryDosDeviceW = Module.findExportByName("Kernel32.dll", 'QueryDosDeviceW')
Interceptor.attach(QueryDosDeviceW, {
onEnter: function (args, state) {
console.log("[+] QueryDosDeviceW");
},
onLeave: function (retval, state) {
console.log("leave QueryDosDeviceW returns:"+retval);
}
});
var getProc = Module.findExportByName("Kernel32.dll", 'GetProcAddress')
Interceptor.attach(getProc, {
onEnter: function (args, state) {
console.log("[+] GetProcAddress");
},
onLeave: function (retval, state) {
console.log("leave GetProcAddress");
}
});
var LoadLibraryW = Module.findExportByName("Kernel32.dll", 'LoadLibraryW')
Interceptor.attach(LoadLibraryW , {
onEnter: function (args, state) {
console.log("[+] LoadLibraryW ");
},
onLeave: function (retval, state) {
console.log("leave LoadLibraryW ");
}
});
var LoadLibraryExW = Module.findExportByName("Kernel32.dll", 'LoadLibraryExW')
Interceptor.attach(LoadLibraryExW , {
onEnter: function (args, state) {
console.log("[+] LoadLibraryExW ");
},
onLeave: function (retval, state) {
console.log("leave LoadLibraryExW ");
}
});
var GetNativeSystemInfo = Module.findExportByName("Kernel32.dll", 'GetNativeSystemInfo')
Interceptor.attach(GetNativeSystemInfo , {
onEnter: function (args, state) {
console.log("[+] GetNativeSystemInfo ");
},
onLeave: function (retval, state) {
console.log("leave GetNativeSystemInfo ");
}
});
var GetSystemInfo = Module.findExportByName("Kernel32.dll", 'GetSystemInfo')
Interceptor.attach(GetSystemInfo , {
onEnter: function (args, state) {
console.log("[+] GetSystemInfo ");
},
onLeave: function (retval, state) {
console.log("leave GetSystemInfo ");
}
});
var RegCreateKeyExW = Module.findExportByName("Advapi32.dll", 'RegCreateKeyExW')
Interceptor.attach(RegCreateKeyExW , {
onEnter: function (args, state) {
console.log("[+] RegCreateKeyExW ");
},
onLeave: function (retval, state) {
console.log("leave RegCreateKeyExW ");
}
});
var RegOpenKeyExW = Module.findExportByName("Advapi32.dll", 'RegOpenKeyExW')
Interceptor.attach(RegOpenKeyExW , {
onEnter: function (args, state) {
console.log("[+] RegOpenKeyExW ");
},
onLeave: function (retval, state) {
console.log("leave RegOpenKeyExW ");
}
});
var CoInitialize = Module.findExportByName("Ole32.dll", 'CoInitialize')
Interceptor.attach(CoInitialize , {
onEnter: function (args, state) {
console.log("[+] CoInitialize ");
},
onLeave: function (retval, state) {
console.log("leave CoInitialize ");
}
});
var CoCreateInstance = Module.findExportByName("Ole32.dll", 'CoCreateInstance')
Interceptor.attach(CoCreateInstance , {
onEnter: function (args, state) {
console.log("[+] CoCreateInstance ");
},
onLeave: function (retval, state) {
console.log("leave CoCreateInstance ");
}
});
var GetAdaptersInfo = Module.findExportByName("Iphlpapi.dll", 'GetAdaptersInfo')
Interceptor.attach(GetSystemInfo , {
onEnter: function (args, state) {
console.log("[+] GetAdaptersInfo ");
},
onLeave: function (retval, state) {
console.log("leave GetAdaptersInfo ");
}
});
var GetInterfaceInfo = Module.findExportByName("Iphlpapi.dll", 'GetInterfaceInfo')
Interceptor.attach(GetSystemInfo , {
onEnter: function (args, state) {
console.log("[+] GetInterfaceInfo ");
},
onLeave: function (retval, state) {
console.log("leave GetInterfaceInfo ");
}
});
var dic = Module.findExportByName("Kernel32.dll", 'DeviceIoControl')
Interceptor.attach(dic, {
onEnter: function (args, state) {
console.log("[+] DeviceIoControl");
},
onLeave: function (retval, state) {
}
});
var GetSystemFirmwareTable = Module.findExportByName("Kernel32.dll", 'GetSystemFirmwareTable')
Interceptor.attach(GetSystemFirmwareTable, {
onEnter: function (args, state) {
console.log("[+] GetSystemFirmwareTable");
},
onLeave: function (retval, state) {
}
});
var EnumSystemFirmwareTables = Module.findExportByName("Kernel32.dll", 'EnumSystemFirmwareTables')
Interceptor.attach(EnumSystemFirmwareTables, {
onEnter: function (args, state) {
console.log("[+] EnumSystemFirmwareTables");
},
onLeave: function (retval, state) {
console.log(retval)
}
});
var GetVersion = Module.findExportByName("Kernel32.dll", 'GetVersion')
Interceptor.attach(GetVersion, {
onEnter: function (args, state) {
console.log("[+] GetVersion");
},
onLeave: function (retval, state) {
console.log(retval)
}
});
