Updated x86 stack frame code in posh, python, and .NET

Added bootstrap size sanity check to python

DotNet/Program.cs

@@ -673,7 +673,7 @@ namespace RDIShellcodeLoader
             else // 32 Bit
             {
                 var rdiShellcode = rdiShellcode32;
-                int bootstrapSize = 45;
+                int bootstrapSize = 46;
 
                 // call next instruction (Pushes next instruction address to stack)
                 newShellcode.Add(0xe8);
@@ -685,9 +685,16 @@ namespace RDIShellcodeLoader
                 // Set the offset to our DLL from pop result
                 dllOffset = (uint)(bootstrapSize - newShellcode.Count + rdiShellcode.Length);
 
-                // pop ecx - Capture our current location in memory
+                // pop eax - Capture our current location in memory
                 newShellcode.Add(0x58);
 
+                // push ebp
+                newShellcode.Add(0x55);
+
+                // mov ebp, esp
+                newShellcode.Add(0x89);                
+                newShellcode.Add(0xe5);
+
                 // mov ebx, eax - copy our location in memory to ebx before we start modifying eax
                 newShellcode.Add(0x89);
                 newShellcode.Add(0xc3);
@@ -731,10 +738,8 @@ namespace RDIShellcodeLoader
                 newShellcode.Add(0x00);
                 newShellcode.Add(0x00);
 
-                // add esp, 0x14 - correct the stack pointer
-                newShellcode.Add(0x83);
-                newShellcode.Add(0xc4);
-                newShellcode.Add(0x14);
+                // leave
+                newShellcode.Add(0xc9);
 
                 // ret - return to caller
                 newShellcode.Add(0xc3);

PowerShell/ConvertTo-Shellcode.ps1

@@ -483,7 +483,7 @@ public class sRDI
         else // 32 Bit
         {
             var rdiShellcode = rdiShellcode32;
-            int bootstrapSize = 45;
+            int bootstrapSize = 46;
 
             // call next instruction (Pushes next instruction address to stack)
             newShellcode.Add(0xe8);
@@ -495,10 +495,16 @@ public class sRDI
             // Set the offset to our DLL from pop result
             dllOffset = (uint)(bootstrapSize - newShellcode.Count + rdiShellcode.Length);
 
-            //Here is where the we pop the address of our shellcode off the stack and into the first register
-            // pop ecx
+            // pop eax - Capture our current location in memory
             newShellcode.Add(0x58);
 
+            // push ebp
+            newShellcode.Add(0x55);
+
+            // mov ebp, esp
+            newShellcode.Add(0x89);                
+            newShellcode.Add(0xe5);
+
             // mov ebx, eax - copy our location in memory to ebx before we start modifying eax
             newShellcode.Add(0x89);
             newShellcode.Add(0xc3);
@@ -542,10 +548,8 @@ public class sRDI
             newShellcode.Add(0x00);
             newShellcode.Add(0x00);
 
-            // add esp, 0x14 - correct the stack pointer
-            newShellcode.Add(0x83);
-            newShellcode.Add(0xc4);
-            newShellcode.Add(0x14);
+            // leave
+            newShellcode.Add(0xc9);
 
             // ret - return to caller
             newShellcode.Add(0xc3);

Python/ShellcodeRDI.py

@@ -127,6 +127,9 @@ def ConvertToShellcode(dllBytes, functionHash=0x10, userData=b'None', flags=0):
         # ret - return to caller
         bootstrap += b'\xc3'
 
+        if len(bootstrap) != bootstrapSize:
+            raise Exception("x64 bootstrap length: {} != bootstrapSize: {}".format(len(bootstrap), bootstrapSize))
+
         # Ends up looking like this in memory:
         # Bootstrap shellcode
         # RDI shellcode
@@ -138,7 +141,7 @@ def ConvertToShellcode(dllBytes, functionHash=0x10, userData=b'None', flags=0):
         rdiShellcode = rdiShellcode32
 
         bootstrap = b''
-        bootstrapSize = 45
+        bootstrapSize = 46
 
         # call next instruction (Pushes next instruction address to stack)
         bootstrap += b'\xe8\x00\x00\x00\x00'
@@ -146,9 +149,15 @@ def ConvertToShellcode(dllBytes, functionHash=0x10, userData=b'None', flags=0):
         # Set the offset to our DLL from pop result
         dllOffset = bootstrapSize - len(bootstrap) + len(rdiShellcode)
 
-        # pop ecx - Capture our current location in memory
+        # pop eax - Capture our current location in memory
         bootstrap += b'\x58'
 
+        # push ebp
+        bootstrap += b'\x55'
+
+        # mov ebp, esp
+        bootstrap += b'\x89\xe5'
+
         # mov ebx, eax - copy our location in memory to ebx before we start modifying eax
         bootstrap += b'\x89\xc3'
 
@@ -184,12 +193,15 @@ def ConvertToShellcode(dllBytes, functionHash=0x10, userData=b'None', flags=0):
         bootstrap += pack('b', bootstrapSize - len(bootstrap) - 4) # Skip over the remainder of instructions
         bootstrap += b'\x00\x00\x00'
 
-        # add esp, 0x14 - correct the stack pointer
-        bootstrap += b'\x83\xc4\x14'
+        # leave
+        bootstrap += b'\xc9'
 
         # ret - return to caller
         bootstrap += b'\xc3'
 
+        if len(bootstrap) != bootstrapSize:
+            raise Exception("x86 bootstrap length: {} != bootstrapSize: {}".format(len(bootstrap), bootstrapSize))
+
         # Ends up looking like this in memory:
         # Bootstrap shellcode
         # RDI shellcode