Generalised memory protection revert to reuse protection originally met after locating shellcode for the first time.

This commit is contained in:
mgeeky
2021-10-07 16:49:14 +02:00
parent c1b026ef3e
commit 21a7194ca7
2 changed files with 4 additions and 3 deletions
+1
View File
@@ -31,6 +31,7 @@ struct FluctuationMetadata
SIZE_T shellcodeSize;
bool currentlyEncrypted;
DWORD encodeKey;
DWORD protect;
};
struct HookedSleep
+3 -3
View File
@@ -291,7 +291,7 @@ void shellcodeEncryptDecrypt(LPVOID callerAddress)
g_fluctuationData.shellcodeAddr,
g_fluctuationData.shellcodeSize,
PAGE_READWRITE,
&oldProt
&g_fluctuationData.protect
);
log("[>] Flipped to RW.");
@@ -330,11 +330,11 @@ void shellcodeEncryptDecrypt(LPVOID callerAddress)
::VirtualProtect(
g_fluctuationData.shellcodeAddr,
g_fluctuationData.shellcodeSize,
Shellcode_Memory_Protection,
g_fluctuationData.protect,
&oldProt
);
log("[<] Flipped to RX.\n");
log("[<] Flipped back to RX/RWX.\n");
}
g_fluctuationData.currentlyEncrypted = !g_fluctuationData.currentlyEncrypted;