From 09de7e8ad173e250f91625f653f359672d16562e Mon Sep 17 00:00:00 2001
From: "dennisbabkin.com" <dennis_babkin@hotmail.com>
Date: Sat, 29 May 2021 12:57:11 -0700
Subject: [PATCH] Update asm64.asm

---
 InjectAll/Drv/asm64.asm | 74 ++++++++++++++++++++---------------------
 1 file changed, 37 insertions(+), 37 deletions(-)

diff --git a/InjectAll/Drv/asm64.asm b/InjectAll/Drv/asm64.asm
index 1643479..a9b5f5b 100644
--- a/InjectAll/Drv/asm64.asm
+++ b/InjectAll/Drv/asm64.asm
@@ -39,21 +39,21 @@ RundownRoutine PROC
 	; RCX = pointer to _KAPC
 
 	; First call our RundownRoutine_Proc from the C file
-	sub		rsp, 28h
-	call	RundownRoutine_Proc
-	add		rsp, 28h
+	sub             rsp, 28h
+	call            RundownRoutine_Proc
+	add             rsp, 28h
 
 	; Act depending on return value
-	test	rax, rax
-	jz		@@1
+	test            rax, rax
+	jz              @@1
 
 	; Then invoke ObDereferenceObject(g_DriverObject)
 	; 
 	; IMPORTANT: We need to invoke ObfDereferenceObject via a JMP because it will be freeing the driver
 	;            memory that our code runs from, thus can't return into it via a CALL instruction!
 	;
-	mov		rcx, g_DriverObject
-	jmp		__imp_ObfDereferenceObject
+	mov             rcx, g_DriverObject
+	jmp             __imp_ObfDereferenceObject
 
 @@1:
 	ret
@@ -74,49 +74,49 @@ KernelRoutine PROC
 	; [RSP + 28h] = pointer to SystemArgument2
 
 	; Move SystemArgument2 for the forwarded call to KernelRoutine_Proc
-	mov		rax, [rsp + 28h]
-	mov		[rsp + 18h], rax
+	mov             rax, [rsp + 28h]
+	mov             [rsp + 18h], rax
 
 	; Save our return address in the shadow stack
-	mov		rax, [rsp]
-	mov		[rsp + 20h], rax
+	mov             rax, [rsp]
+	mov             [rsp + 20h], rax
 
 
-    ; During call to KernelRoutine:                   During call to KernelRoutine_Proc:
+	; During call to KernelRoutine:                   During call to KernelRoutine_Proc:
 	; 
-    ;                                                 RSP:
-    ;                                                 -10h = return address from KernelRoutine_Proc
-    ; RSP:                                            -08h =  - shadow stack
-    ; +00h = return address from KernelRoutine        +00h =  - shadow stack
-    ; +08h =  - shadow stack                          +08h =  - shadow stack
-    ; +10h =  - shadow stack                          +10h =  - shadow stack
-    ; +18h =  - shadow stack                          +18h = pointer to SystemArgument2
-    ; +20h =  - shadow stack                          +20h = (saved return addr)
-    ; +28h = pointer to SystemArgument2
+	;                                                 RSP:
+	;                                                 -10h = return address from KernelRoutine_Proc
+	; RSP:                                            -08h =  - shadow stack
+	; +00h = return address from KernelRoutine        +00h =  - shadow stack
+	; +08h =  - shadow stack                          +08h =  - shadow stack
+	; +10h =  - shadow stack                          +10h =  - shadow stack
+	; +18h =  - shadow stack                          +18h = pointer to SystemArgument2
+	; +20h =  - shadow stack                          +20h = (saved return addr)
+	; +28h = pointer to SystemArgument2
 
 
 	; Align stack pointer on the 16-byte boundary for the KernelRoutine_Proc call (and restore it afterwards)
 	;	push rax = 8 bytes
 	;	call	 = 8 bytes
-	push	rax
-	call	KernelRoutine_Proc
-	test	rax, rax
-	pop		rax
+	push            rax
+	call            KernelRoutine_Proc
+	test            rax, rax
+	pop             rax
 
 	; Restore our return address 
-	mov		rax, [rsp + 20h]
-	mov		[rsp], rax
+	mov             rax, [rsp + 20h]
+	mov             [rsp], rax
 
 	; Act depending on return value from function
-	jz		@@1
+	jz              @@1
 
 	; Then invoke ObDereferenceObject(g_DriverObject)
 	; 
 	; IMPORTANT: We need to invoke ObfDereferenceObject via a JMP because it will be freeing the driver
 	;            memory that our code runs from, thus can't return into it via a CALL instruction!
 	;
-	mov		rcx, g_DriverObject
-	jmp		__imp_ObfDereferenceObject
+	mov             rcx, g_DriverObject
+	jmp             __imp_ObfDereferenceObject
 
 @@1:
 	ret
@@ -134,21 +134,21 @@ NormalRoutine PROC
 	; R8  = SystemArgument2
 
 	; First call our NormalRoutine_Proc from C file
-	sub		rsp, 28h
-	call	NormalRoutine_Proc
-	add		rsp, 28h
+	sub              rsp, 28h
+	call             NormalRoutine_Proc
+	add              rsp, 28h
 
 	; Act depending on return value from function
-	test	rax, rax
-	jz		@@1
+	test             rax, rax
+	jz               @@1
 
 	; Then invoke ObDereferenceObject(g_DriverObject)
 	; 
 	; IMPORTANT: We need to invoke ObfDereferenceObject via a JMP because it will be freeing the driver
 	;            memory that our code runs from, thus can't return into it via a CALL instruction!
 	;
-	mov		rcx, g_DriverObject
-	jmp		__imp_ObfDereferenceObject
+	mov              rcx, g_DriverObject
+	jmp              __imp_ObfDereferenceObject
 
 @@1:
 	ret