mirror of
https://github.com/k1ng0fn0th1ng/reflectra
synced 2026-06-21 13:55:04 +00:00
john
31 lines
803 B
RPMSpec
31 lines
803 B
RPMSpec
x64:
|
|
load $DUMMY %path <> "asm/dummy.x64.bin"
|
|
|
|
# ParseDLL from Crystal Palace
|
|
ised insert "add rcx, rax" $DUMMY
|
|
|
|
# LoadPico from Crystal Palace
|
|
ised insert "call PicoDataSize" $DUMMY
|
|
|
|
# call SizeOfDLL from loader.c
|
|
ised insert "call SizeOfDLL" $DUMMY
|
|
|
|
# init_frame_info from spoof.c
|
|
ised insert "mov dword ptr [rbx+0x10], 0x17" $DUMMY
|
|
|
|
# GetSyscall from syscall.c
|
|
ised insert "shl ebx, 8" $DUMMY
|
|
|
|
# SpoofedSyscall from hooks.c
|
|
ised insert "mov r12d, ecx" $DUMMY
|
|
|
|
# go from loader.c
|
|
ised insert "sub rsp, 0x20" $DUMMY
|
|
|
|
# get_text_section_size from spoof.c
|
|
pack $XOREAX "h" "31C0" # xor eax, eax
|
|
ised replace "mov eax, 0" $XOREAX
|
|
|
|
# Disassemble object on stack and write output to assembly.txt
|
|
disassemble "bin/assembly.txt"
|