refactor: injector (EOP -> overwrite)

This commit is contained in:
Dobin Rutishauser
2025-06-21 14:06:50 +02:00
parent 1db212de53
commit a782fd0842
7 changed files with 319 additions and 303 deletions
+8 -12
View File
@@ -1,10 +1,13 @@
from enum import Enum
import os
# FilePath type for better clarity in the code
class FilePath(str):
pass
# with data/shellcodes/createfile.bin
# for data/shellcodes/createfile.bin
VerifyFilename: FilePath = FilePath("C:\\Temp\\a")
# Input Binary
@@ -23,19 +26,16 @@ PATH_VIRTUALPROTECT = "data/source/virtualprotect/"
PATH_WEB_PROJECT = "projects/"
CODE_INJECT_SIZE_CHECK_ADD = 128
class PayloadLocation(Enum):
CODE = ".text"
DATA = ".rdata"
class CarrierInvokeStyle(Enum):
ChangeEntryPoint = "change EntryPoint"
BackdoorCallInstr = "backdoor Entrypoint"
class FunctionInvokeStyle(Enum):
peb_walk = "peb_walk"
iat_reuse = "iat_reuse"
OverwriteFunc = "Overwrite Function"
BackdoorFunc = "Backdoor Function"
class PeRelocEntry():
@@ -60,7 +60,3 @@ class IatEntry():
def __str__(self):
return "IatEntry: dll_name: {} func_name: {} iat_vaddr: 0x{:X}".format(
self.dll_name, self.func_name, self.iat_vaddr)
CODE_INJECT_SIZE_CHECK_ADD = 128
+1 -1
View File
@@ -23,7 +23,7 @@ class Settings():
# Config
self.carrier_name: str = ""
self.carrier_invoke_style: CarrierInvokeStyle = CarrierInvokeStyle.BackdoorCallInstr
self.carrier_invoke_style: CarrierInvokeStyle = CarrierInvokeStyle.BackdoorFunc
self.decoder_style: str = "xor_2"
self.payload_location: PayloadLocation = PayloadLocation.DATA
self.short_call_patching: bool = False