admin/monoxgas-sRDI
1
0
Fork 0
mirror of https://github.com/monoxgas/sRDI synced 2026-06-06 16:14:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Move NtFlushInstructionCache above TLS callbacks

Browse Source
This commit is contained in:
Nick Landers
2019-06-10 10:58:49 -06:00
parent 71128b1ba3
commit 1a0fc5050e
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ShellcodeRDI/ShellcodeRDI.c
+2 -3
View File
@@ -526,6 +526,8 @@ ULONG_PTR ExecutePayload(ULONG_PTR uiLibraryAddress, DWORD dwFunctionHash, LPVOI
uiValueA += sizeof(IMAGE_SECTION_HEADER);
}
// We must flush the instruction cache to avoid stale code being used which was updated by our relocation processing.
pNtFlushInstructionCache((HANDLE)-1, NULL, 0);
///
// STEP 7: execute TLS callbacks
@@ -560,9 +562,6 @@ ULONG_PTR ExecutePayload(ULONG_PTR uiLibraryAddress, DWORD dwFunctionHash, LPVOI
// uiValueA = the VA of our newly loaded DLL/EXE's entry point
uiValueA = (uiBaseAddress + ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.AddressOfEntryPoint);
// We must flush the instruction cache to avoid stale code being used which was updated by our relocation processing.
pNtFlushInstructionCache((HANDLE)-1, NULL, 0);
// call our respective entry point, fudging our hInstance value
// if we are injecting a DLL via LoadRemoteLibraryR we call DllMain and pass in our parameter (via the DllMain lpReserved parameter)