mirror of
https://github.com/maxDcb/C2Core
synced 2026-06-08 15:48:01 +00:00
Maxime dcb
119 lines
2.2 KiB
NASM
119 lines
2.2 KiB
NASM
.686p ; x86 target
|
|
.model flat, c ; <-- C calling convention
|
|
option casemap:none
|
|
|
|
EXTERN getGlobalHash: PROC
|
|
|
|
EXTERN SW3_GetSyscallAddress: PROC
|
|
|
|
|
|
.code
|
|
|
|
Sw3NtAllocateVirtualMemory PROC
|
|
jmp pipo
|
|
Sw3NtAllocateVirtualMemory ENDP
|
|
|
|
Sw3NtWaitForSingleObject PROC
|
|
jmp pipo
|
|
Sw3NtWaitForSingleObject ENDP
|
|
|
|
Sw3NtCreateThreadEx PROC
|
|
jmp pipo
|
|
Sw3NtCreateThreadEx ENDP
|
|
|
|
Sw3NtClose PROC
|
|
jmp pipo
|
|
Sw3NtClose ENDP
|
|
|
|
Sw3NtWriteVirtualMemory PROC
|
|
jmp pipo
|
|
Sw3NtWriteVirtualMemory ENDP
|
|
|
|
Sw3NtProtectVirtualMemory PROC
|
|
jmp pipo
|
|
Sw3NtProtectVirtualMemory ENDP
|
|
|
|
Sw3NtOpenProcess PROC
|
|
jmp pipo
|
|
Sw3NtOpenProcess ENDP
|
|
|
|
Sw3NtCreateProcess PROC
|
|
jmp pipo
|
|
Sw3NtCreateProcess ENDP
|
|
|
|
Sw3NtQueueApcThread PROC
|
|
jmp pipo
|
|
Sw3NtQueueApcThread ENDP
|
|
|
|
Sw3NtResumeThread PROC
|
|
jmp pipo
|
|
Sw3NtResumeThread ENDP
|
|
|
|
Sw3NtOpenProcessToken PROC
|
|
jmp pipo
|
|
Sw3NtOpenProcessToken ENDP
|
|
|
|
Sw3NtAdjustPrivilegesToken PROC
|
|
jmp pipo
|
|
Sw3NtAdjustPrivilegesToken ENDP
|
|
|
|
Sw3NtQueryVirtualMemory PROC
|
|
jmp pipo
|
|
Sw3NtQueryVirtualMemory ENDP
|
|
|
|
Sw3NtReadVirtualMemory PROC
|
|
jmp pipo
|
|
Sw3NtReadVirtualMemory ENDP
|
|
|
|
Sw3NtWriteFile PROC
|
|
jmp pipo
|
|
Sw3NtWriteFile ENDP
|
|
|
|
Sw3NtLoadDriver PROC
|
|
jmp pipo
|
|
Sw3NtLoadDriver ENDP
|
|
|
|
Sw3NtDeviceIoControlFile PROC
|
|
jmp pipo
|
|
Sw3NtDeviceIoControlFile ENDP
|
|
|
|
Sw3NtCreateKey PROC
|
|
jmp pipo
|
|
Sw3NtCreateKey ENDP
|
|
|
|
Sw3NtSetValueKey PROC
|
|
jmp pipo
|
|
Sw3NtSetValueKey ENDP
|
|
|
|
Sw3NtCreateFile PROC
|
|
jmp pipo
|
|
Sw3NtCreateFile ENDP
|
|
|
|
pipo PROC
|
|
push ebp
|
|
mov ebp, esp
|
|
call getGlobalHash
|
|
push eax
|
|
call SW3_GetSyscallAddress
|
|
lea esp, [esp+4]
|
|
test eax, eax
|
|
jz syscall_not_found
|
|
mov edx, eax
|
|
mov ecx, 0Bh
|
|
push_argument:
|
|
dec ecx
|
|
push [ebp + 8 + ecx * 4]
|
|
jnz push_argument
|
|
call edx
|
|
mov esp, ebp
|
|
pop ebp
|
|
ret
|
|
syscall_not_found:
|
|
mov eax, 0C0000225h
|
|
mov esp, ebp
|
|
pop ebp
|
|
ret
|
|
pipo ENDP
|
|
|
|
end
|