admin/dennisbabkin-InjectAll
1
0
Fork 0
mirror of https://github.com/dennisbabkin/InjectAll synced 2026-06-06 15:34:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update asm64.asm

Browse Source
This commit is contained in:
dennisbabkin.com
2021-05-29 12:57:11 -07:00
committed by GitHub
parent 91dc2b8fe4
commit 09de7e8ad1
1 changed files with 37 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
InjectAll/Drv/asm64.asm
+37 -37
View File
@@ -39,21 +39,21 @@ RundownRoutine PROC
; RCX = pointer to _KAPC
; First call our RundownRoutine_Proc from the C file
sub rsp, 28h
call RundownRoutine_Proc
add rsp, 28h
sub rsp, 28h
call RundownRoutine_Proc
add rsp, 28h
; Act depending on return value
test rax, rax
jz @@1
test rax, rax
jz @@1
; Then invoke ObDereferenceObject(g_DriverObject)
;
; IMPORTANT: We need to invoke ObfDereferenceObject via a JMP because it will be freeing the driver
; memory that our code runs from, thus can't return into it via a CALL instruction!
;
mov rcx, g_DriverObject
jmp __imp_ObfDereferenceObject
mov rcx, g_DriverObject
jmp __imp_ObfDereferenceObject
@@1:
ret
@@ -74,49 +74,49 @@ KernelRoutine PROC
; [RSP + 28h] = pointer to SystemArgument2
; Move SystemArgument2 for the forwarded call to KernelRoutine_Proc
mov rax, [rsp + 28h]
mov [rsp + 18h], rax
mov rax, [rsp + 28h]
mov [rsp + 18h], rax
; Save our return address in the shadow stack
mov rax, [rsp]
mov [rsp + 20h], rax
mov rax, [rsp]
mov [rsp + 20h], rax
; During call to KernelRoutine: During call to KernelRoutine_Proc:
; During call to KernelRoutine: During call to KernelRoutine_Proc:
;
; RSP:
; -10h = return address from KernelRoutine_Proc
; RSP: -08h = - shadow stack
; +00h = return address from KernelRoutine +00h = - shadow stack
; +08h = - shadow stack +08h = - shadow stack
; +10h = - shadow stack +10h = - shadow stack
; +18h = - shadow stack +18h = pointer to SystemArgument2
; +20h = - shadow stack +20h = (saved return addr)
; +28h = pointer to SystemArgument2
; RSP:
; -10h = return address from KernelRoutine_Proc
; RSP: -08h = - shadow stack
; +00h = return address from KernelRoutine +00h = - shadow stack
; +08h = - shadow stack +08h = - shadow stack
; +10h = - shadow stack +10h = - shadow stack
; +18h = - shadow stack +18h = pointer to SystemArgument2
; +20h = - shadow stack +20h = (saved return addr)
; +28h = pointer to SystemArgument2
; Align stack pointer on the 16-byte boundary for the KernelRoutine_Proc call (and restore it afterwards)
; push rax = 8 bytes
; call = 8 bytes
push rax
call KernelRoutine_Proc
test rax, rax
pop rax
push rax
call KernelRoutine_Proc
test rax, rax
pop rax
; Restore our return address
mov rax, [rsp + 20h]
mov [rsp], rax
mov rax, [rsp + 20h]
mov [rsp], rax
; Act depending on return value from function
jz @@1
jz @@1
; Then invoke ObDereferenceObject(g_DriverObject)
;
; IMPORTANT: We need to invoke ObfDereferenceObject via a JMP because it will be freeing the driver
; memory that our code runs from, thus can't return into it via a CALL instruction!
;
mov rcx, g_DriverObject
jmp __imp_ObfDereferenceObject
mov rcx, g_DriverObject
jmp __imp_ObfDereferenceObject
@@1:
ret
@@ -134,21 +134,21 @@ NormalRoutine PROC
; R8 = SystemArgument2
; First call our NormalRoutine_Proc from C file
sub rsp, 28h
call NormalRoutine_Proc
add rsp, 28h
sub rsp, 28h
call NormalRoutine_Proc
add rsp, 28h
; Act depending on return value from function
test rax, rax
jz @@1
test rax, rax
jz @@1
; Then invoke ObDereferenceObject(g_DriverObject)
;
; IMPORTANT: We need to invoke ObfDereferenceObject via a JMP because it will be freeing the driver
; memory that our code runs from, thus can't return into it via a CALL instruction!
;
mov rcx, g_DriverObject
jmp __imp_ObfDereferenceObject
mov rcx, g_DriverObject
jmp __imp_ObfDereferenceObject
@@1:
ret