-
Notifications
You must be signed in to change notification settings - Fork 91
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
1c9f82a
commit a5dd658
Showing
8 changed files
with
157 additions
and
111 deletions.
There are no files selected for viewing
Empty file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,9 +1,9 @@ | ||
; define offsets for payload data structure | ||
[bits 32] | ||
[bits 64] | ||
|
||
%define payload_org_open_ptr 0 | ||
%define payload_prefix_open_ptr 4 | ||
%define payload_wopen 8 | ||
%define payload_org_alloc_ptr 12 | ||
%define payload_find_ret_addr 16 | ||
%define payload_hook_ret_addr 20 | ||
%define payload_prefix_open_ptr 8 | ||
%define payload_wopen 16 | ||
%define payload_org_alloc_ptr 24 | ||
%define payload_find_ret_addr 32 | ||
%define payload_hook_ret_addr 40 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,11 +1,11 @@ | ||
%include 'defines.asm' | ||
|
||
call back | ||
back: pop eax | ||
and eax, 0xFFFFF000 | ||
mov eax, DWORD payload_find_ret_addr[eax] | ||
push eax | ||
; following two lines are just shorter way to do: mov eax, 1 | ||
xor eax,eax | ||
inc eax | ||
back: pop rax | ||
and rax, 0xFFFFFFFFFFFFF000 | ||
mov rax, QWORD payload_find_ret_addr[rax] | ||
push rax | ||
; following two lines are just shorter way to do: mov rax, 1 | ||
xor rax,rax | ||
inc rax | ||
ret |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,38 +1,38 @@ | ||
%include 'defines.asm' | ||
|
||
; config | ||
%define config_scan_size 0x40 | ||
%define config_scan_size 0x80 | ||
|
||
; args | ||
%define arg_str 8 | ||
%define arg_file 12 | ||
%define arg_line 16 | ||
%define arg_str rcx | ||
%define arg_file rdx | ||
%define arg_line r8 | ||
|
||
; prologue | ||
enter 0, 0 | ||
push ebx | ||
push esi | ||
push rbx | ||
push rsi | ||
call back | ||
back: pop ebx | ||
and ebx, 0xFFFFF000 | ||
back: pop rbx | ||
and rbx, 0xFFFFFFFFFFFFF000 | ||
|
||
; scanning the stack | ||
mov esi, DWORD payload_find_ret_addr[ebx] | ||
mov eax, ebp | ||
add eax, config_scan_size | ||
scan: sub eax, 4 | ||
cmp eax, ebp | ||
mov rsi, QWORD payload_find_ret_addr[rbx] | ||
mov rax, rbp | ||
add rax, config_scan_size | ||
scan: sub rax, 8 | ||
cmp rax, rbp | ||
je done | ||
cmp esi, DWORD [eax] | ||
cmp rsi, QWORD [rax] | ||
jne scan | ||
mov esi, DWORD payload_hook_ret_addr[ebx] | ||
mov DWORD [eax], esi | ||
mov rsi, QWORD payload_hook_ret_addr[rbx] | ||
mov QWORD [rax], rsi | ||
|
||
; fetch resume address | ||
done: mov eax, DWORD payload_org_alloc_ptr[ebx] | ||
done: mov rax, QWORD payload_org_alloc_ptr[rbx] | ||
|
||
; epilogue | ||
pop esi | ||
pop ebx | ||
pop rsi | ||
pop rbx | ||
leave | ||
jmp eax | ||
jmp rax |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters