Commit

README.md

@@ -46,7 +46,7 @@ After that, simply compile both the payload and the loader and run the last one:
 
 # Usage
 
-There is not much mistery on this PoC execution. All it has to be done is to run the loader and use any tool like ProcessHacker to inspect the thread stack. Since the payload switches back to the control fiber before sleeping, the payload fiber's stack remains hidden most of the time.
+There is not much mistery on this PoC execution. All it has to be done is to run the loader and use any tool like ProcessHacker to inspect the thread stack. Since the payload switches back to the control fiber before sleeping, the payload fiber's stack remains hidden most of the time. You will see in the output how the two fibers are consecutively scheduled following the already commented logic. 
 
 The code is commented to show how to use, create and schedule fibers. You will notice that both the loader and the payload offered as example are "stuck" on an infinite loop, which allows to indefinitely switch between fibers and continue the execution. 
 

loader/src/main.rs

@@ -29,8 +29,8 @@ fn main() {
         let first_fiber = r.unwrap();
 
         // We reflectively map the payload in memory using DInvoke.
-        let dll = manualmap::read_and_map_module(r"..\payload\target\release\payload.dll").unwrap();
-        println!("[Loader] Payload reflectively loaded at memory address 0x{:x}", dll.1);
+        let dll = manualmap::read_and_map_module(r"..\..\..\payload\target\release\payload.dll").unwrap();
+        println!("[Loader] Payload mapped at memory address 0x{:x}", dll.1);
 
         // We create a new fiber to execute the run() function exported on the payload dll.
         let r: Option<PVOID>;

payload/src/lib.rs

@@ -24,7 +24,7 @@ pub extern fn run(params: PVOID)
              */
 
             // Add here any code you want the payload to execute. 
-            
+            println!("[Payload] I'm alive!");
             println!("[PayloaZzZ] Sleeping... Check the stack!");
             println!("--------------------------");
             let k32 = dinvoke::get_module_base_address("kernel32.dll");
@@ -33,7 +33,6 @@ pub extern fn run(params: PVOID)
             // Using DInvoke to call SwitchToFiber, since this is a PoC it is not needed
             // this kind of stealth.
             dinvoke::dynamic_invoke!(k32,"SwitchToFiber",func,_ret,params); 
-            println!("[Payload] I'm alive!");
             
             // Uncomment this is you want to check the difference between the two fiber's stacks.
             // It would be like calling Sleep directly from the payload.