Skip to main content

metadata.cpp

Source: src/modules/metadata.cpp

This module identifies the user account context in which the implant is currently executing.

Function Signature​

ModuleResult get_current_user();

Parameters​

  • None

Logic & Behavior​

  1. Buffer Allocation: Allocates a buffer of size UNLEN + 1 (standard Windows constant for max username length).
  2. API Call: Calls GetUserNameW to retrieve the wide-character username.
  3. Encoding Conversion:
  • Instead of using verbose WideCharToMultiByte routines, it leverages std::filesystem::path as a robust converter to transform the wchar_t buffer into a standard UTF-8 std::string.
  1. Error Handling: Returns GetLastError() if the API call fails.

Return Values (ModuleResult)​

  • data: The username string (e.g., Administrator or SYSTEM).
  • windows_error_code:
    • ERROR_SUCCESS (0): Retrieval successful.
    • WinAPI Error: If the buffer is too small or access is denied.

Module: get_computer_name (Hostname Discovery)

Source: src/modules/metadata.cpp

Retrieves the NetBIOS name of the local computer.

Function Signature​

ModuleResult get_computer_name();

Parameters​

  • None

Logic & Behavior​

  1. Buffer Allocation: Allocates a buffer based on MAX_COMPUTERNAME_LENGTH (typically 15 characters for NetBIOS names).
  2. API Call: Calls GetComputerNameW.
  3. Encoding Conversion: Uses the std::filesystem::path trick to safely convert the wide string to a standard string without corruption.

Return Values (ModuleResult)​

  • data: The hostname (e.g., DESKTOP-12345).
  • windows_error_code:
    • ERROR_SUCCESS (0): Retrieval successful.
    • WinAPI Error: Relevant error code on failure.

Module: get_current_process_name (Process Context)

Source: src/modules/metadata.cpp

Identifies the full path of the executable currently hosting the implant. This is useful for verifying if the implant has been successfully injected into a target process (like notepad.exe) or is running as a standalone artifact.

Function Signature​

ModuleResult get_current_process_name();

Parameters​

  • None

Logic & Behavior​

  1. Buffer Allocation: Allocates a large heap vector (32767 chars) to accommodate potential Windows extended paths (\\?\).
  2. API Call: Calls GetModuleFileNameW, passing NULL to indicate the current process.
  3. Validation:
  • Checks if the return length matches the buffer size (indicating ERROR_INSUFFICIENT_BUFFER).
  • Checks for a 0 return value (generic failure).
  1. Conversion: Converts the resulting path to a standard string.

Return Values (ModuleResult)​

  • data: The full path to the executable (e.g., C:\Windows\System32\svchost.exe).
  • windows_error_code:
    • ERROR_SUCCESS (0): Success.
    • ERROR_INSUFFICIENT_BUFFER: If the path exceeds the allocated vector size.
    • ERROR_INVALID_DATA: If string conversion fails.

Module: get_current_process_pid (Process ID)

Source: src/modules/metadata.cpp

Retrieves the unique Process ID (PID) assigned to the implant by the OS.

Function Signature​

ModuleResult get_current_process_pid();

Parameters​

  • None

Logic & Behavior​

  1. API Call: Calls GetCurrentProcessId().
  2. Conversion: Converts the resulting DWORD (integer) into a std::string.

Return Values (ModuleResult)​

  • data: The PID as a string (e.g., 4520).
  • windows_error_code:
    • ERROR_SUCCESS (0): Always returns success

Module: get_ip_address (Network Discovery)

Source: src/modules/metadata.cpp

Current Status: Placeholder

Intended to resolve the internal IP address of the host.

Function Signature​

ModuleResult get_ip_address();

Parameters​

  • None

Logic & Behavior​

  • Currently returns a static placeholder string.
  • Future Implementation: Will likely utilize GetAdaptersInfo or gethostname / getaddrinfo to resolve the active interface address.

Return Values (ModuleResult)​

  • data: Currently static "someip".
  • windows_error_code: ERROR_SUCCESS (0).