From 6c25796d2b580bc51cee204ddaeecb57a51f4478 Mon Sep 17 00:00:00 2001
From: Print3M <92022497+Print3M@users.noreply.github.com>
Date: Sat, 20 Jul 2024 00:17:19 +0200
Subject: [PATCH] now it works

---
 README.md     | 11 ++++++-----
 loader.c      |  8 ++++++--
 shellcode.asm |  6 ++----
 shellcoder.py |  7 ++++++-
 4 files changed, 20 insertions(+), 12 deletions(-)

diff --git a/README.md b/README.md
index 06b90f7..88f94ec 100644
--- a/README.md
+++ b/README.md
@@ -6,12 +6,13 @@ This script helps automate the shellcode testing process. It takes an Assembly f
 
 ## Usage
 
-Shellcoder most probably should be used on Windows because of the MSVC requirement.
+Shellcoder script most probably should be used on Windows because of the MSVC requirement.
 
-```powershell
-# Run script
-python shellcoder.py
-```
+1. Write your shellcode in `shellcode.asm`
+2. Run `python shellcoder.py`
+3. Execute output `.exe` file in `out/` directory!
+
+> **IMPORTANT**: Indicate that you are using 64-bit mode at the beginning of the assembly file. Add `[bits 64]` to the `shellcode.asm`.
 
 ## External dependencies
 
diff --git a/loader.c b/loader.c
index 0ed226d..aa1ec0f 100644
--- a/loader.c
+++ b/loader.c
@@ -1,4 +1,7 @@
 #include <windows.h>
+#include <stdio.h>
+unsigned char payload[] = ":PAYLOAD:";
+unsigned int payload_len = sizeof(payload);
 
 void main() {
   void* exec;
@@ -7,12 +10,13 @@ void main() {
   DWORD oldprotect = 0;
 
   // Shellcode
-  unsigned char payload[] = ":PAYLOAD:";
-  unsigned int payload_len = 205;
   exec = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
   RtlMoveMemory(exec, payload, payload_len);
   rv = VirtualProtect(exec, payload_len, PAGE_EXECUTE_READ, &oldprotect);
+
+  printf("[+] Exec...");
   th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)exec, 0, 0, 0);
   WaitForSingleObject(th, -1);
+  printf("[+] End...");
 
 }
\ No newline at end of file
diff --git a/shellcode.asm b/shellcode.asm
index 43b5566..02dd5ed 100644
--- a/shellcode.asm
+++ b/shellcode.asm
@@ -1,7 +1,5 @@
-; Compile & get shellcode from Kali:
-;   nasm -f win64 popcalc.asm -o popcalc.o
-;   for i in $(objdump -D popcalc.o | grep "^ " | cut -f2); do echo -n "\x$i" ; done
-; Get kernel32.dll base address
+[bits 64]
+
 xor rdi, rdi            ; RDI = 0x0
 mul rdi                 ; RAX&RDX =0x0
 mov rbx, gs:[rax+0x60]  ; RBX = Address_of_PEB
diff --git a/shellcoder.py b/shellcoder.py
index e630315..3fc2bb3 100644
--- a/shellcoder.py
+++ b/shellcoder.py
@@ -16,6 +16,11 @@
 #   - NASM (Netwide Assembler)
 #   - Visual Studio 2022
 
+"""
+[ ] Sprawdz czy zwykly shellcode dziala
+[ ] Moze NASM trzeba jakos inaczej kompilowac / pobierac?
+"""
+
 import subprocess
 import os
 import sys
@@ -65,7 +70,7 @@ if __name__ == "__main__":
 
     # Compile Assembly
     subprocess.run(
-        ["nasm", "-f", "win64", SHELLCODE_INPUT_FILE, "-o", SHELLCODE_OUTPUT_FILE], check=True
+        ["nasm", "-f", "bin", SHELLCODE_INPUT_FILE, "-o", SHELLCODE_OUTPUT_FILE], check=True
     )
 
     print(f"[+] NASM: {SHELLCODE_INPUT_FILE} -> {SHELLCODE_OUTPUT_FILE}")