mirror of
https://github.com/cpu0x00/Ghost
synced 2026-06-06 15:34:27 +00:00
cpu0x00
76 lines
1.7 KiB
NASM
76 lines
1.7 KiB
NASM
; shoutout to wklsec
|
|
; NOT MASM , this file is in NASM syntax and can only be assembled with NASM assembler
|
|
|
|
[BITS 64]
|
|
|
|
DEFAULT REL
|
|
|
|
section .text
|
|
|
|
; Exported Function Declaration
|
|
global RetSpoofCall
|
|
|
|
RetSpoofCall:
|
|
; Some space to work with
|
|
sub rsp, 0x100
|
|
|
|
; Store non-volatile registers
|
|
mov [rsp + 0x8], rsi
|
|
mov [rsp + 0x10], rdi
|
|
mov [rsp + 0x18], r12
|
|
|
|
; R10: Function to call
|
|
; R12: Address of handler
|
|
mov r10, rcx
|
|
lea r12, Fixup
|
|
|
|
; Some more space to work with
|
|
sub rsp, 0x200
|
|
|
|
; Place the gadget into our return address
|
|
mov [rsp], r8
|
|
|
|
; If no arguments, just make the call
|
|
cmp rdx, 0
|
|
je CallFunction
|
|
|
|
; Back these up, we'll need this later
|
|
; R11: nArgs
|
|
mov r11, rdx
|
|
|
|
; Move the arguments. Everything to be shifted down 3
|
|
; It does not matter if we move args to rcx/rdx/r8/r9 if a function doesn't use them, so move them all just in case
|
|
cmp rdx, 4
|
|
mov rcx, r9
|
|
mov rdx, [rsp + 0x300 + 0x28]
|
|
mov r8, [rsp + 0x300 + 0x30]
|
|
mov r9, [rsp + 0x300 + 0x38]
|
|
jle CallFunction
|
|
|
|
; movsq: move QWORD -- RSI -> RDI
|
|
; rep: repeats RCX amount of times
|
|
; additional 0x18 offset because technically the 4th arg was in the 7th slot
|
|
mov rax, rcx
|
|
mov rcx, r11
|
|
sub rcx, 4h
|
|
lea rsi, [rsp + 0x28 + 0x18 + 0x300]
|
|
lea rdi, [rsp + 0x28]
|
|
rep movsq
|
|
|
|
; Restore original rcx for patched call
|
|
mov rcx, rax
|
|
|
|
CallFunction:
|
|
; Jump to the function we want to call
|
|
jmp r10
|
|
|
|
Fixup:
|
|
; Restore non-volatile registers and stack frame
|
|
mov rsi, [rsp + 0x200 + 0x8]
|
|
mov rdi, [rsp + 0x200 + 0x10]
|
|
mov r12, [rsp + 0x200 + 0x18]
|
|
add rsp, 0x300
|
|
|
|
ret
|
|
|