mirror of
https://github.com/maxDcb/DreamWalkers
synced 2026-06-08 15:49:24 +00:00
maxdcb
53 lines
2.1 KiB
Markdown
53 lines
2.1 KiB
Markdown
# Shellcode Bootstrap
|
|
|
|
`DreamWalkers.py` emits a small architecture-specific bootstrap before the extracted `memoryModuleLoader` bytes. Its only job is to pass the serialized `INSTANCE` pointer as the first argument, then transfer execution to `Loader`.
|
|
|
|
## x64
|
|
|
|
The x64 bootstrap uses a `call`/`pop` pattern to discover the inline `INSTANCE` address without an absolute pointer. `call after_instance` pushes the address of the embedded instance blob, `pop rcx` moves it into the first Windows x64 argument register, and the wrapper aligns `rsp` plus reserves 32 bytes of shadow space before calling the loader.
|
|
|
|
```asm
|
|
call after_instance ; pushes &INSTANCE
|
|
db INSTANCE bytes
|
|
after_instance:
|
|
pop rcx ; rcx = INSTANCE*
|
|
push rbp
|
|
mov rbp, rsp
|
|
and rsp, -16
|
|
sub rsp, 20h ; Windows x64 shadow space
|
|
call Loader
|
|
mov rsp, rbp
|
|
pop rbp
|
|
ret
|
|
```
|
|
|
|
## x86
|
|
|
|
The x86 bootstrap also uses `call`/`pop` to get the inline `INSTANCE` address. The loader expects a normal stack argument at `[esp+4]`, so the bootstrap preserves the caller return address, pushes `INSTANCE*`, then calls the loader. The call return address points to a cleanup stub that removes the synthetic argument and returns with `ret 4`, preserving the thread-start return layout used by the tester path.
|
|
|
|
```asm
|
|
call after_instance ; pushes &INSTANCE
|
|
db INSTANCE bytes
|
|
after_instance:
|
|
pop ecx ; ecx = INSTANCE*
|
|
pop edx ; save caller return address
|
|
push edx ; restore caller return address
|
|
push ecx ; stack arg: INSTANCE*
|
|
call Loader ; return address is cleanup
|
|
cleanup:
|
|
add esp, 4 ; drop INSTANCE*
|
|
ret 4
|
|
```
|
|
|
|
## ARM64
|
|
|
|
The ARM64 bootstrap uses fixed-width instructions. `adr x0, instance` computes the inline `INSTANCE` address into the first Windows ARM64 argument register, then `b Loader` branches directly to the extracted loader bytes. The branch is not a link branch, so the loader returns through the link register already provided by the shellcode caller.
|
|
|
|
```asm
|
|
adr x0, instance ; x0 = INSTANCE*
|
|
b Loader
|
|
instance:
|
|
db INSTANCE bytes
|
|
Loader:
|
|
```
|