NtOpenSymbolicLinkObject

; Direct syscall stub for NtOpenSymbolicLinkObject (SSN 0x138, Win11 24H2)
NtOpenSymbolicLinkObject PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 138h         ; SSN (BUILD-SPECIFIC, resolve dynamically)
    syscall
    ret
NtOpenSymbolicLinkObject ENDP

// Open \??\C: and dump its target string — typically \Device\HarddiskVolume3.
// Useful sandbox-escape recon and for distinguishing real volumes from
// mapped network drives whose target is \Device\Mup\...
#include <windows.h>
#include <winternl.h>

#define SYMBOLIC_LINK_QUERY 0x0001
#define OBJ_CASE_INSENSITIVE 0x00000040

typedef NTSTATUS (NTAPI *pNtOpenSymbolicLinkObject)(
    PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
typedef NTSTATUS (NTAPI *pNtQuerySymbolicLinkObject)(
    HANDLE, PUNICODE_STRING, PULONG);

BOOL ResolveDosDrive(WCHAR letter, PWSTR out, ULONG outChars) {
    pNtOpenSymbolicLinkObject NtOpenSymbolicLinkObject =
        (pNtOpenSymbolicLinkObject)GetProcAddress(
            GetModuleHandleA("ntdll.dll"), "NtOpenSymbolicLinkObject");
    pNtQuerySymbolicLinkObject NtQuerySymbolicLinkObject =
        (pNtQuerySymbolicLinkObject)GetProcAddress(
            GetModuleHandleA("ntdll.dll"), "NtQuerySymbolicLinkObject");

    WCHAR path[16]; swprintf_s(path, 16, L"\\??\\%lc", letter);
    UNICODE_STRING us; RtlInitUnicodeString(&us, path);
    OBJECT_ATTRIBUTES oa;
    InitializeObjectAttributes(&oa, &us, OBJ_CASE_INSENSITIVE, NULL, NULL);

    HANDLE h = NULL;
    if (!NT_SUCCESS(NtOpenSymbolicLinkObject(&h, SYMBOLIC_LINK_QUERY, &oa)))
        return FALSE;

    UNICODE_STRING target;
    target.Buffer = out;
    target.Length = 0;
    target.MaximumLength = (USHORT)(outChars * sizeof(WCHAR));
    NTSTATUS s = NtQuerySymbolicLinkObject(h, &target, NULL);
    CloseHandle(h);
    return NT_SUCCESS(s);
}

// Cargo: ntapi = "0.4", widestring = "1", windows-sys = "0.59"
// Open a symbolic link with DELETE and close it to remove the link from
// the object namespace. Used to swap a sandbox-escape symlink mid-race or
// to clean up an unwanted competing implant's rendezvous marker.
use ntapi::ntobapi::NtOpenSymbolicLinkObject;
use ntapi::ntrtl::RtlInitUnicodeString;
use winapi::shared::ntdef::{OBJECT_ATTRIBUTES, UNICODE_STRING};
use widestring::U16CString;
use windows_sys::Win32::Foundation::CloseHandle;

const DELETE: u32 = 0x0001_0000;
const OBJ_CASE_INSENSITIVE: u32 = 0x40;

pub unsafe fn evict_symlink(nt_path: &str) -> bool {
    let w = U16CString::from_str(nt_path).unwrap();
    let mut us: UNICODE_STRING = std::mem::zeroed();
    RtlInitUnicodeString(&mut us, w.as_ptr());
    let mut oa: OBJECT_ATTRIBUTES = std::mem::zeroed();
    oa.Length = std::mem::size_of::<OBJECT_ATTRIBUTES>() as u32;
    oa.ObjectName = &mut us;
    oa.Attributes = OBJ_CASE_INSENSITIVE;
    let mut h: isize = 0;
    if NtOpenSymbolicLinkObject(&mut h as *mut _ as _, DELETE, &mut oa) < 0 {
        return false;
    }
    CloseHandle(h as _);
    true
}