From 29086686d47c5e3fa4de914eb7accb160b4b917a Mon Sep 17 00:00:00 2001
From: jackullrich <contact@jackullri.ch>
Date: Mon, 8 Jul 2019 14:25:01 -0500
Subject: [PATCH] Added support for x64 and some code cleanup.

---
 ShellcodeStdio/ScStdio.cpp            |  32 ++++++++++++++++----------
 ShellcodeStdio/ScStdio.h              |   3 ---
 ShellcodeStdio/ShellcodeStdio.vcxproj |  12 ++++++++--
 ShellcodeStdio/main.cpp               |   5 ++--
 ShellcodeStdio/shellcode.bin          | Bin 0 -> 319 bytes
 5 files changed, 32 insertions(+), 20 deletions(-)
 create mode 100644 ShellcodeStdio/shellcode.bin

diff --git a/ShellcodeStdio/ScStdio.cpp b/ShellcodeStdio/ScStdio.cpp
index 7875f7e..85e8a00 100644
--- a/ShellcodeStdio/ScStdio.cpp
+++ b/ShellcodeStdio/ScStdio.cpp
@@ -1,28 +1,32 @@
 #include "ScStdio.h"
 
+#define ROR_SHIFT 13
+
 namespace ScStdio {
+
 	/*
-		Suggested VS Compilation Switches:
+		VS Compilation Switches:
 		C/C++ -> Optimization -> /O1, /Ob2, /Oi, /Os, /Oy-, /GL
 		C/C++ -> Code Generation -> /MT, /GS-, /Gy
 		Linker -> General -> /INCREMENTAL:NO
 	*/
 
+#ifndef _WIN64
 	__declspec(naked) void MalCodeBegin() { __asm { jmp MalCode } };
+#else
+	void MalCodeBegin() { MalCode(); }
+#endif
 
-#define htons(A) ((((WORD)(A) & 0xff00) >> 8) | (((WORD)(A) & 0x00ff) << 8))
-
-	__forceinline PEB *get_peb() {
-		PEB *p;
-		__asm {
-			mov eax, fs:[30h]
-			mov p, eax
-		}
+	PPEB getPEB() {
+		PPEB p;
+#ifndef _WIN64
+		p = (PPEB)__readfsdword(0x30);
+#else
+		p = (PPEB)__readgsqword(0x60);
+#endif
 		return p;
 	}
 
-#define ROR_SHIFT 13
-
 	constexpr DWORD ct_ror(DWORD n) {
 		return (n >> ROR_SHIFT) | (n << (sizeof(DWORD) * CHAR_BIT - ROR_SHIFT));
 	}
@@ -51,7 +55,7 @@ namespace ScStdio {
 	}
 
 	PVOID getProcAddrByHash(DWORD hash) {
-		PEB *peb = get_peb();
+		PEB *peb = getPEB();
 		LIST_ENTRY *first = peb->Ldr->InMemoryOrderModuleList.Flink;
 		LIST_ENTRY *ptr = first;
 		do {
@@ -106,7 +110,11 @@ namespace ScStdio {
 		MessageBoxA(NULL, strMboxMsg, strMboxTitle, MB_OK);
 	}
 
+#ifndef _WIN64
 	__declspec(naked) void MalCodeEnd() { };
+#else
+	void MalCodeEnd() {};
+#endif
 
 	BOOL WriteShellcodeToDisk()
 	{
diff --git a/ShellcodeStdio/ScStdio.h b/ShellcodeStdio/ScStdio.h
index bbf92fb..c977964 100644
--- a/ShellcodeStdio/ScStdio.h
+++ b/ShellcodeStdio/ScStdio.h
@@ -1,8 +1,5 @@
 #pragma once
 
-/* Original: ShellcodeStdio -> @ winternl.com (Jack Ullrich)*/
-/* Much credit to the reddit user: good_nickname */
-
 #include <Windows.h>
 #include <winnt.h>
 #include <winternl.h>
diff --git a/ShellcodeStdio/ShellcodeStdio.vcxproj b/ShellcodeStdio/ShellcodeStdio.vcxproj
index 8f5da3c..cc8b7de 100644
--- a/ShellcodeStdio/ShellcodeStdio.vcxproj
+++ b/ShellcodeStdio/ShellcodeStdio.vcxproj
@@ -22,7 +22,7 @@
     <VCProjectVersion>15.0</VCProjectVersion>
     <ProjectGuid>{FACF8E26-40F6-416F-B103-3FCB714FA6BB}</ProjectGuid>
     <RootNamespace>ShellcodeStdio</RootNamespace>
-    <WindowsTargetPlatformVersion>10.0.15063.0</WindowsTargetPlatformVersion>
+    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
@@ -72,6 +72,9 @@
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
     <LinkIncremental>false</LinkIncremental>
   </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
     <ClCompile>
       <WarningLevel>Level3</WarningLevel>
@@ -106,10 +109,15 @@
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
     <ClCompile>
       <WarningLevel>Level3</WarningLevel>
-      <Optimization>MaxSpeed</Optimization>
+      <Optimization>MinSpace</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
       <IntrinsicFunctions>true</IntrinsicFunctions>
       <SDLCheck>true</SDLCheck>
+      <InlineFunctionExpansion>AnySuitable</InlineFunctionExpansion>
+      <FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
+      <OmitFramePointers>false</OmitFramePointers>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+      <BufferSecurityCheck>false</BufferSecurityCheck>
     </ClCompile>
     <Link>
       <EnableCOMDATFolding>true</EnableCOMDATFolding>
diff --git a/ShellcodeStdio/main.cpp b/ShellcodeStdio/main.cpp
index 59fae28..1ca1291 100644
--- a/ShellcodeStdio/main.cpp
+++ b/ShellcodeStdio/main.cpp
@@ -1,7 +1,6 @@
 #include "ScStdio.h"
 
 int main(void) {
-
-	ScStdio::MalCode();
-	ScStdio::WriteShellcodeToDisk();	
+	 ScStdio::MalCode();
+	 ScStdio::WriteShellcodeToDisk();	
 }
\ No newline at end of file
diff --git a/ShellcodeStdio/shellcode.bin b/ShellcodeStdio/shellcode.bin
new file mode 100644
index 0000000000000000000000000000000000000000..79e313c369f942cbcfc65702875f1712f2724783
GIT binary patch
literal 319
zcmaEPh=GA2IIR1l@uk;7{QFKHJjL7aJF(aC0l&{d<_m6JaxJ$@U&M7Eias3L{igYi
zNXkM3u!it%2cAyfFWn9z-9I{A-*lG?blbOnEAj7kv+0g8sA#=i;?nJ7%)@-{#r*&O
z{{xu{ovuHa&lw-+^!?E3`p446SfWg+o2L<|pbn^j+4YB|>z5LlZr4BEz8@TbDy)Gj
zitbt0zA0U7d>}q9`sCqm-#^_h#wxum9{k&R41i3TUY3q-76ayEukV8$rx9#?`?%|u
z(&E&joxK9ve;jxHVQi$Al6KtnPfkup?7!o#FM=~tbB?>d$q6n234h4U?}+_$-1UY>
zY7S8NPQF5T{&Cj_ML8*o9kEYdZ~-0G>-#0}|An3NDk{#t`1SAq|KMKV7lFOLHv)tI
IUjVuZ0Q*9p&j0`b

literal 0
HcmV?d00001