mirror of
https://github.com/PowerShellMafia/PowerSploit
synced 2026-06-08 12:13:33 +00:00
Matt Graeber
dfec277813
Another awesome addition from Joe Bialek. Invoke-ReflectivePEInjection is a vast improvement over Invoke-ReflectiveDllInjection. It adds the following features: * Now supports loading exe files in memory * Supports reflective dll injection into a remote process * Additional sample Visual Studio solutions
21 lines
344 B
NASM
21 lines
344 B
NASM
[SECTION .text]
|
|
global _start
|
|
|
|
_start:
|
|
; Get stack setup
|
|
push rbx
|
|
mov rbx, rsp
|
|
and sp, 0xff00
|
|
|
|
; Call DllMain
|
|
mov rcx, 0x4141414141414141 ; DLLHandle, set by PowerShell
|
|
mov rdx, 0x1 ; PROCESS_ATTACH
|
|
mov r8, 0x0 ; NULL
|
|
mov rax, 0x4141414141414141 ; Address of DllMain, set by PS
|
|
call rax
|
|
|
|
; Fix stack
|
|
mov rsp, rbx
|
|
pop rbx
|
|
ret
|