diff --git a/ShellcodeFluctuation/header.h b/ShellcodeFluctuation/header.h index 2d56bf1..10637db 100644 --- a/ShellcodeFluctuation/header.h +++ b/ShellcodeFluctuation/header.h @@ -31,6 +31,7 @@ struct FluctuationMetadata SIZE_T shellcodeSize; bool currentlyEncrypted; DWORD encodeKey; + DWORD protect; }; struct HookedSleep diff --git a/ShellcodeFluctuation/main.cpp b/ShellcodeFluctuation/main.cpp index c9a440d..4b2e620 100644 --- a/ShellcodeFluctuation/main.cpp +++ b/ShellcodeFluctuation/main.cpp @@ -291,7 +291,7 @@ void shellcodeEncryptDecrypt(LPVOID callerAddress) g_fluctuationData.shellcodeAddr, g_fluctuationData.shellcodeSize, PAGE_READWRITE, - &oldProt + &g_fluctuationData.protect ); log("[>] Flipped to RW."); @@ -330,11 +330,11 @@ void shellcodeEncryptDecrypt(LPVOID callerAddress) ::VirtualProtect( g_fluctuationData.shellcodeAddr, g_fluctuationData.shellcodeSize, - Shellcode_Memory_Protection, + g_fluctuationData.protect, &oldProt ); - log("[<] Flipped to RX.\n"); + log("[<] Flipped back to RX/RWX.\n"); } g_fluctuationData.currentlyEncrypted = !g_fluctuationData.currentlyEncrypted;