admin/mgeeky-ShellcodeFluctuation
1
0
Fork 0
mirror of https://github.com/mgeeky/ShellcodeFluctuation synced 2026-06-06 16:14:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

Generalised memory protection revert to reuse protection originally met after locating shellcode for the first time.

Browse Source
This commit is contained in:
mgeeky
2021-10-07 16:49:14 +02:00
parent c1b026ef3e
commit 21a7194ca7
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ShellcodeFluctuation/header.h
+1
View File
@@ -31,6 +31,7 @@ struct FluctuationMetadata
SIZE_T shellcodeSize; SIZE_T shellcodeSize;
bool currentlyEncrypted; bool currentlyEncrypted;
DWORD encodeKey; DWORD encodeKey;
DWORD protect;
}; };
struct HookedSleep struct HookedSleep
ShellcodeFluctuation/main.cpp
+3 -3
View File
@@ -291,7 +291,7 @@ void shellcodeEncryptDecrypt(LPVOID callerAddress)
g_fluctuationData.shellcodeAddr, g_fluctuationData.shellcodeAddr,
g_fluctuationData.shellcodeSize, g_fluctuationData.shellcodeSize,
PAGE_READWRITE, PAGE_READWRITE,
&oldProt &g_fluctuationData.protect
); );
log("[>] Flipped to RW."); log("[>] Flipped to RW.");
@@ -330,11 +330,11 @@ void shellcodeEncryptDecrypt(LPVOID callerAddress)
::VirtualProtect( ::VirtualProtect(
g_fluctuationData.shellcodeAddr, g_fluctuationData.shellcodeAddr,
g_fluctuationData.shellcodeSize, g_fluctuationData.shellcodeSize,
Shellcode_Memory_Protection, g_fluctuationData.protect,
&oldProt &oldProt
); );
log("[<] Flipped to RX.\n"); log("[<] Flipped back to RX/RWX.\n");
} }
g_fluctuationData.currentlyEncrypted = !g_fluctuationData.currentlyEncrypted; g_fluctuationData.currentlyEncrypted = !g_fluctuationData.currentlyEncrypted;