mirror of
https://github.com/naksyn/ProcessStomping
synced 2026-06-06 16:14:38 +00:00
naksyn
401 lines
32 KiB
C++
401 lines
32 KiB
C++
// RDIShellcodeCLoader.cpp : Defines the entry point for the console application.
|
|
//
|
|
|
|
#include "stdafx.h"
|
|
#include <windows.h>
|
|
#include <string>
|
|
|
|
#define DEREF_64( name )*(DWORD64 *)(name)
|
|
#define DEREF_32( name )*(DWORD *)(name)
|
|
#define DEREF_16( name )*(WORD *)(name)
|
|
#define DEREF_8( name )*(BYTE *)(name)
|
|
|
|
#define ROTR32(value, shift) (((DWORD) value >> (BYTE) shift) | ((DWORD) value << (32 - (BYTE) shift)))
|
|
#define RVA(type, base, rva) (type)((ULONG_PTR) base + rva)
|
|
|
|
#define SRDI_CLEARHEADER 0x1
|
|
#define SRDI_CLEARMEMORY 0x2
|
|
#define SRDI_OBFUSCATEIMPORTS 0x4
|
|
#define SRDI_PASS_SHELLCODE_BASE 0x8
|
|
|
|
|
|
FARPROC GetProcAddressR(HMODULE hModule, LPCSTR lpProcName)
|
|
{
|
|
if (hModule == NULL || lpProcName == NULL)
|
|
return NULL;
|
|
|
|
PIMAGE_NT_HEADERS ntHeaders = RVA(PIMAGE_NT_HEADERS, hModule, ((PIMAGE_DOS_HEADER)hModule)->e_lfanew);
|
|
PIMAGE_DATA_DIRECTORY dataDir = &ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
|
|
if (!dataDir->Size)
|
|
return NULL;
|
|
|
|
PIMAGE_EXPORT_DIRECTORY exportDir = RVA(PIMAGE_EXPORT_DIRECTORY, hModule, dataDir->VirtualAddress);
|
|
if (!exportDir->NumberOfNames || !exportDir->NumberOfFunctions)
|
|
return NULL;
|
|
|
|
PDWORD expName = RVA(PDWORD, hModule, exportDir->AddressOfNames);
|
|
PWORD expOrdinal = RVA(PWORD, hModule, exportDir->AddressOfNameOrdinals);
|
|
LPCSTR expNameStr;
|
|
|
|
for (DWORD i = 0; i < exportDir->NumberOfNames; i++, expName++, expOrdinal++) {
|
|
|
|
expNameStr = RVA(LPCSTR, hModule, *expName);
|
|
|
|
if (!expNameStr)
|
|
break;
|
|
|
|
if (!_stricmp(lpProcName, expNameStr)) {
|
|
DWORD funcRva = *RVA(PDWORD, hModule, exportDir->AddressOfFunctions + (*expOrdinal * 4));
|
|
return RVA(FARPROC, hModule, funcRva);
|
|
}
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
BOOL Is64BitDLL(UINT_PTR uiLibraryAddress)
|
|
{
|
|
PIMAGE_NT_HEADERS pNtHeaders = (PIMAGE_NT_HEADERS)(uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew);
|
|
|
|
if (pNtHeaders->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) return true;
|
|
else return false;
|
|
}
|
|
|
|
DWORD GetFileContents(LPCSTR filename, LPSTR *data, DWORD &size)
|
|
{
|
|
std::FILE *fp = std::fopen(filename, "rb");
|
|
|
|
if (fp)
|
|
{
|
|
fseek(fp, 0, SEEK_END);
|
|
size = ftell(fp);
|
|
fseek(fp, 0, SEEK_SET);
|
|
|
|
*data = (LPSTR)malloc(size + 1);
|
|
fread(*data, size, 1, fp);
|
|
fclose(fp);
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
DWORD HashFunctionName(LPSTR name) {
|
|
DWORD hash = 0;
|
|
|
|
do
|
|
{
|
|
hash = ROTR32(hash, 13);
|
|
hash += *name;
|
|
name++;
|
|
} while (*(name - 1) != 0);
|
|
|
|
return hash;
|
|
}
|
|
|
|
BOOL ConvertToShellcode(LPVOID inBytes, DWORD length, DWORD userFunction, LPVOID userData, DWORD userLength, DWORD flags, LPSTR &outBytes, DWORD &outLength)
|
|
{
|
|
|
|
LPSTR rdiShellcode = NULL;
|
|
DWORD rdiShellcodeLength, dllOffset, userDataLocation;
|
|
|
|
#ifdef _DEBUG
|
|
LPSTR rdiShellcode64 = NULL, rdiShellcode32 = NULL;
|
|
DWORD rdiShellcode64Length = 0, rdiShellcode32Length = 0;
|
|
GetFileContents("../bin/ShellcodeRDI_x64.bin", &rdiShellcode64, rdiShellcode64Length);
|
|
GetFileContents("../bin/ShellcodeRDI_x86.bin", &rdiShellcode32, rdiShellcode32Length);
|
|
|
|
#else
|
|
//MARKER:S
|
|
LPSTR rdiShellcode32 = "\x81\xEC\x18\x01\x00\x00\x53\x55\x56\x57\x6A\x6B\x58\x6A\x65\x66\x89\x84\x24\xC8\x00\x00\x00\x33\xED\x58\x6A\x72\x59\x6A\x6E\x5B\x6A\x6C\x5A\x6A\x33\x66\x89\x84\x24\xCA\x00\x00\x00\x66\x89\x84\x24\xD0\x00\x00\x00\x58\x6A\x32\x66\x89\x84\x24\xD4\x00\x00\x00\x58\x6A\x2E\x66\x89\x84\x24\xD6\x00\x00\x00\x58\x6A\x64\x66\x89\x84\x24\xD8\x00\x00\x00\x58\x89\xAC\x24\xA4\x00\x00\x00\x89\xAC\x24\xB8\x00\x00\x00\x89\xAC\x24\xA8\x00\x00\x00\x89\xAC\x24\xC0\x00\x00\x00\x89\xAC\x24\xBC\x00\x00\x00\x89\xAC\x24\xA0\x00\x00\x00\x89\xAC\x24\xDC\x00\x00\x00\x66\x89\x8C\x24\xC8\x00\x00\x00\x66\x89\x9C\x24\xCA\x00\x00\x00\x66\x89\x94\x24\xCE\x00\x00\x00\x66\x89\x84\x24\xD6\x00\x00\x00\x66\x89\x94\x24\xD8\x00\x00\x00\x66\x89\x94\x24\xDA\x00\x00\x00\xC6\x44\x24\x30\x53\x88\x54\x24\x31\x66\xC7\x44\x24\x32\x65\x65\xC6\x44\x24\x34\x70\x66\xC7\x44\x24\x44\x4C\x6F\xC6\x44\x24\x46\x61\x88\x44\x24\x47\x66\xC7\x44\x24\x48\x4C\x69\xC6\x44\x24\x4A\x62\x88\x4C\x24\x4B\xC6\x44\x24\x4C\x61\x88\x4C\x24\x4D\x66\xC7\x44\x24\x4E\x79\x41\x66\xC7\x44\x24\x38\x56\x69\x88\x4C\x24\x3A\x66\xC7\x44\x24\x3B\x74\x75\xC6\x44\x24\x3D\x61\x88\x54\x24\x3E\xC6\x44\x24\x3F\x41\x88\x54\x24\x40\x88\x54\x24\x41\x66\xC7\x44\x24\x42\x6F\x63\x66\xC7\x44\x24\x50\x56\x69\x88\x4C\x24\x52\x66\xC7\x44\x24\x53\x74\x75\xC6\x44\x24\x55\x61\x88\x54\x24\x56\xC6\x44\x24\x57\x50\x88\x4C\x24\x58\xC7\x44\x24\x59\x6F\x74\x65\x63\xC6\x44\x24\x5D\x74\xC6\x84\x24\x88\x00\x00\x00\x46\x88\x94\x24\x89\x00\x00\x00\xC7\x84\x24\x8A\x00\x00\x00\x75\x73\x68\x49\x88\x9C\x24\x8E\x00\x00\x00\x66\xC7\x84\x24\x8F\x00\x00\x00\x73\x74\x88\x8C\x24\x91\x00\x00\x00\xC7\x84\x24\x92\x00\x00\x00\x75\x63\x74\x69\xC6\x84\x24\x96\x00\x00\x00\x6F\x6A\x65\x59\x88\x8C\x24\x9C\x00\x00\x00\x88\x4C\x24\x61\x88\x4C\x24\x68\x88\x4C\x24\x6D\x88\x8C\x24\x86\x00\x00\x00\xB9\x13\x9C\xBF\xBD\x88\x9C\x24\x97\x00\x00\x00\xC7\x84\x24\x98\x00\x00\x00\x43\x61\x63\x68\xC6\x44\x24\x60\x47\xC7\x44\x24\x62\x74\x4E\x61\x74\x66\xC7\x44\x24\x66\x69\x76\xC7\x44\x24\x69\x53\x79\x73\x74\x66\xC7\x44\x24\x6E\x6D\x49\x88\x5C\x24\x70\x66\xC7\x44\x24\x71\x66\x6F\x66\xC7\x44\x24\x74\x52\x74\x88\x54\x24\x76\xC6\x44\x24\x77\x41\x88\x44\x24\x78\x88\x44\x24\x79\x66\xC7\x44\x24\x7A\x46\x75\x88\x5C\x24\x7C\xC7\x44\x24\x7D\x63\x74\x69\x6F\x88\x9C\x24\x81\x00\x00\x00\x66\xC7\x84\x24\x82\x00\x00\x00\x54\x61\xC6\x84\x24\x84\x00\x00\x00\x62\x88\x94\x24\x85\x00\x00\x00\xE8\x76\x07\x00\x00\xB9\xB5\x41\xD9\x5E\x8B\xF0\xE8\x6A\x07\x00\x00\x8B\xD8\x8D\x84\x24\xC4\x00\x00\x00\x6A\x18\x89\x84\x24\xF0\x00\x00\x00\x58\x66\x89\x84\x24\xEA\x00\x00\x00\x66\x89\x84\x24\xE8\x00\x00\x00\x8D\x44\x24\x1C\x50\x8D\x84\x24\xEC\x00\x00\x00\x89\x5C\x24\x30\x50\x55\x55\xFF\xD6\x6A\x0C\x5F\x8D\x44\x24\x38\x66\x89\x7C\x24\x10\x89\x44\x24\x14\x8D\x84\x24\xB8\x00\x00\x00\x50\x55\x8D\x44\x24\x18\x66\x89\x7C\x24\x1A\x50\xFF\x74\x24\x28\xFF\xD3\x6A\x0E\x58\x66\x89\x44\x24\x10\x66\x89\x44\x24\x12\x8D\x44\x24\x50\x89\x44\x24\x14\x8D\x84\x24\xBC\x00\x00\x00\x50\x55\x8D\x44\x24\x18\x50\xFF\x74\x24\x28\xFF\xD3\x6A\x15\x58\x66\x89\x44\x24\x10\x66\x89\x44\x24\x12\x8D\x84\x24\x88\x00\x00\x00\x89\x44\x24\x14\x8D\x84\x24\xA8\x00\x00\x00\x50\x55\x8D\x44\x24\x18\x50\xFF\x74\x24\x28\xFF\xD3\x6A\x13\x5E\x8D\x44\x24\x60\x66\x89\x74\x24\x10\x89\x44\x24\x14\x8D\x84\x24\xC0\x00\x00\x00\x50\x55\x8D\x44\x24\x18\x66\x89\x74\x24\x1A\x50\xFF\x74\x24\x28\xFF\xD3\x6A\x05\x58\x66\x89\x44\x24\x10\x66\x89\x44\x24\x12\x8D\x44\x24\x30\x89\x44\x24\x14\x8D\x84\x24\xA0\x00\x00\x00\x50\x55\x8D\x44\x24\x18\x50\xFF\x74\x24\x28\xFF\xD3\x8D\x44\x24\x74\x66\x89\x74\x24\x10\x89\x44\x24\x14\x8D\x84\x24\xDC\x00\x00\x00\x50\x55\x8D\x44\x24\x18\x66\x89\x74\x24\x1A\x50\xFF\x74\x24\x28\xFF\xD3\x8D\x44\x24\x44\x66\x89\x7C\x24\x10\x89\x44\x24\x14\x8D\x84\x24\xA4\x00\x00\x00\x50\x55\x8D\x44\x24\x18\x66\x89\x7C\x24\x1A\x50\xFF\x74\x24\x28\xFF\xD3\x39\xAC\x24\xB8\x00\x00\x00\x0F\x84\xFC\x05\x00\x00\x39\xAC\x24\xBC\x00\x00\x00\x0F\x84\xEF\x05\x00\x00\x39\xAC\x24\xA0\x00\x00\x00\x0F\x84\xE2\x05\x00\x00\x39\xAC\x24\xA8\x00\x00\x00\x0F\x84\xD5\x05\x00\x00\x8B\xB4\x24\xC0\x00\x00\x00\x85\xF6\x0F\x84\xC6\x05\x00\x00\x8B\xAC\x24\x2C\x01\x00\x00\x8B\x7D\x3C\x03\xFD\x81\x3F\x50\x45\x00\x00\x0F\x85\xAE\x05\x00\x00\xB8\x4C\x01\x00\x00\x66\x39\x47\x04\x0F\x85\x9F\x05\x00\x00\x8B\x47\x38\xA8\x01\x0F\x85\x94\x05\x00\x00\x0F\xB7\x4F\x14\x33\xDB\x0F\xB7\x57\x06\x83\xC1\x24\x85\xD2\x74\x28\x03\xCF\x83\x79\x04\x00\x8B\x29\x74\x03\x8B\x41\x04\x03\xC5\x3B\xC3\x0F\x46\xC3\x83\xC1\x28\x8B\xD8\x8B\x47\x38\x83\xEA\x01\x75\xE1\x8B\xAC\x24\x2C\x01\x00\x00\x8D\x84\x24\x04\x01\x00\x00\x50\xFF\xD6\x8B\x94\x24\x08\x01\x00\x00\x8D\x72\xFF\x8D\x4A\xFF\xF7\xD6\x03\x4F\x50\x8D\x42\xFF\x03\xC3\x23\xCE\x23\xC6\x3B\xC8\x0F\x85\x2E\x05\x00\x00\x8B\x9C\x24\x3C\x01\x00\x00\x81\xC3\x00\xD0\x07\x00\xF6\x84\x24\x40\x01\x00\x00\x01\x89\x9C\x24\xAC\x00\x00\x00\x74\x21\x8B\x45\x3C\x89\x43\x3C\x8B\x4D\x3C\x3B\x4F\x54\x73\x2A\x8D\x14\x0B\x2B\xEB\x8A\x04\x2A\x41\x88\x02\x42\x3B\x4F\x54\x72\xF4\xEB\x17\x33\xD2\x39\x57\x54\x76\x10\x8B\xCB\x2B\xEB\x8A\x04\x29\x42\x88\x01\x41\x3B\x57\x54\x72\xF4\x8B\x6B\x3C\x33\xC9\x03\xEB\x89\x4C\x24\x18\x33\xC0\x89\x6C\x24\x24\x0F\xB7\x75\x14\x83\xC6\x28\x66\x3B\x45\x06\x73\x38\x8B\x94\x24\x2C\x01\x00\x00\x03\xF5\x33\xFF\x39\x3E\x76\x19\x8B\x46\x04\x8B\x4E\xFC\x03\xC7\x03\xCB\x8A\x04\x10\x88\x04\x39\x47\x3B\x3E\x72\xEB\x8B\x4C\x24\x18\x0F\xB7\x45\x06\x41\x83\xC6\x28\x89\x4C\x24\x18\x3B\xC8\x72\xD1\x8B\xC3\x2B\x45\x34\x6A\x01\x89\x44\x24\x24\x5A\x0F\x84\xB4\x00\x00\x00\x83\xBD\xA4\x00\x00\x00\x00\x0F\x84\xA7\x00\x00\x00\x8B\xB5\xA0\x00\x00\x00\x03\xF3\x83\x3E\x00\x0F\x84\x96\x00\x00\x00\x8B\xE8\x8D\x7E\x08\xEB\x74\x0F\xB7\x0F\x66\x8B\xC1\x8B\xD1\x66\xC1\xE8\x0C\x0F\xB7\xD8\x89\x5C\x24\x20\x8B\x9C\x24\xAC\x00\x00\x00\x66\x83\xF8\x0A\x75\x0F\x8B\x06\x81\xE1\xFF\x0F\x00\x00\x03\xCB\x01\x2C\x01\xEB\x40\x8B\x44\x24\x20\x66\x83\xF8\x03\x75\x0F\x8B\x06\x81\xE2\xFF\x0F\x00\x00\x03\xD3\x01\x2C\x02\xEB\x27\x33\xC9\x41\x66\x3B\xC1\x75\x07\x8B\xC5\xC1\xE8\x10\xEB\x0B\x6A\x02\x59\x66\x3B\xC1\x75\x10\x0F\xB7\xC5\x8B\x0E\x81\xE2\xFF\x0F\x00\x00\x03\xD3\x01\x04\x0A\x6A\x02\x58\x03\xF8\x8B\x46\x04\x03\xC6\x3B\xF8\x75\x83\x83\x3F\x00\x8B\xF7\x0F\x85\x73\xFF\xFF\xFF\x8B\x6C\x24\x24\x33\xD2\x42\x33\xFF\x39\xBD\x84\x00\x00\x00\x0F\x84\xD1\x01\x00\x00\x8B\xB5\x80\x00\x00\x00\x8B\xC7\x03\xF3\x89\x7C\x24\x18\x89\xB4\x24\xB0\x00\x00\x00\x8D\x4E\x0C\x39\x39\x74\x0C\x8D\x49\x14\x40\x39\x39\x75\xF8\x89\x44\x24\x18\x8B\x8C\x24\x40\x01\x00\x00\x83\xE1\x04\x89\x7C\x24\x20\x89\x8C\x24\xB4\x00\x00\x00\x0F\x84\xB8\x00\x00\x00\x3B\xC2\x0F\x86\xB0\x00\x00\x00\x8B\x8C\x24\x40\x01\x00\x00\xC1\xE9\x10\x89\x4C\x24\x20\x8D\x48\xFF\x89\x8C\x24\xE4\x00\x00\x00\x85\xC9\x0F\x84\x90\x00\x00\x00\x8B\x9C\x24\x2C\x01\x00\x00\x8B\xEF\x89\x74\x24\x28\x8B\xC8\x69\xDB\xFD\x43\x03\x00\x2B\xCD\x8D\xBC\x24\xF0\x00\x00\x00\x33\xD2\xB8\xFF\x7F\x00\x00\xF7\xF1\x81\xC3\xC3\x9E\x26\x00\x33\xD2\x6A\x05\x8D\x48\x01\x8B\xC3\xC1\xE8\x10\x25\xFF\x7F\x00\x00\xF7\xF1\x8B\x54\x24\x2C\x03\xC5\x6B\xC0\x14\x59\x6A\x05\x03\xC6\x45\x8B\xF0\xF3\xA5\x59\x8B\xF2\x8B\xF8\x8B\x44\x24\x18\xF3\xA5\x6A\x05\x8B\xFA\x8D\xB4\x24\xF4\x00\x00\x00\x59\x83\xC2\x14\xF3\xA5\x8B\xB4\x24\xB0\x00\x00\x00\x89\x54\x24\x28\x3B\xAC\x24\xE4\x00\x00\x00\x72\x8A\x8B\x9C\x24\xAC\x00\x00\x00\x33\xFF\x8B\x6C\x24\x24\x8B\xB5\x80\x00\x00\x00\x03\xF3\x89\x74\x24\x28\x39\x7E\x0C\x0F\x84\xC1\x00\x00\x00\x8B\x46\x0C\x03\xC3\x50\xFF\x94\x24\xA8\x00\x00\x00\x8B\xD0\x89\x54\x24\x1C\x8B\x3E\x8B\x6E\x10\x03\xFB\x03\xEB\x8B\x0F\x85\xC9\x74\x60\x8B\x74\x24\x2C\x85\xC9\x79\x09\x0F\xB7\x07\x55\x50\x6A\x00\xEB\x36\x83\xC1\x02\x33\xC0\x03\xCB\x89\x8C\x24\xB0\x00\x00\x00\x38\x01\x74\x0E\x40\x41\x80\x39\x00\x75\xF9\x8B\x8C\x24\xB0\x00\x00\x00\x55\x66\x89\x44\x24\x14\x66\x89\x44\x24\x16\x8D\x44\x24\x14\x6A\x00\x89\x4C\x24\x1C\x50\x52\xFF\xD6\x83\xC7\x04\x83\xC5\x04\x8B\x0F\x85\xC9\x74\x06\x8B\x54\x24\x1C\xEB\xA8\x8B\x74\x24\x28\x8B\x44\x24\x20\x85\xC0\x74\x21\x83\xBC\x24\xB4\x00\x00\x00\x00\x74\x17\x33\xC9\x41\x39\x4C\x24\x18\x76\x0E\x69\xC0\xE8\x03\x00\x00\x50\xFF\x94\x24\xA4\x00\x00\x00\x83\xC6\x14\x33\xFF\x89\x74\x24\x28\x39\x7E\x0C\x0F\x85\x43\xFF\xFF\xFF\x8B\x6C\x24\x24\x39\xBD\xE4\x00\x00\x00\x0F\x84\xB5\x00\x00\x00\x8B\x85\xE0\x00\x00\x00\x83\xC0\x04\x03\xC3\x89\x44\x24\x18\x8B\x00\x85\xC0\x0F\x84\x9C\x00\x00\x00\x8B\x6C\x24\x18\x03\xC3\x50\xFF\x94\x24\xA8\x00\x00\x00\x8B\xC8\x89\x4C\x24\x1C\x8B\x75\x08\x8B\x7D\x0C\x03\xF3\x03\xFB\x83\x3E\x00\x74\x61\x8B\x6C\x24\x2C\x8B\x17\x85\xD2\x79\x09\x56\x0F\xB7\xC2\x50\x6A\x00\xEB\x36\x83\xC2\x02\x33\xC0\x03\xD3\x89\x94\x24\xB4\x00\x00\x00\x38\x02\x74\x0E\x40\x42\x80\x3A\x00\x75\xF9\x8B\x94\x24\xB4\x00\x00\x00\x56\x66\x89\x44\x24\x14\x66\x89\x44\x24\x16\x8D\x44\x24\x14\x6A\x00\x89\x54\x24\x1C\x50\x51\xFF\xD5\x83\xC6\x04\x83\xC7\x04\x83\x3E\x00\x74\x06\x8B\x4C\x24\x1C\xEB\xA7\x8B\x6C\x24\x18\x83\xC5\x20\x89\x6C\x24\x18\x8B\x45\x00\x85\xC0\x0F\x85\x6E\xFF\xFF\xFF\x8B\x6C\x24\x24\x33\xFF\x57\x57\x6A\xFF\xFF\x94\x24\xB4\x00\x00\x00\x39\xBD\xC4\x00\x00\x00\x74\x25\x8B\x85\xC0\x00\x00\x00\x8B\x74\x03\x0C\x8B\x06\x85\xC0\x74\x15\x33\xED\x45\x57\x55\x53\xFF\xD0\x8D\x76\x04\x8B\x06\x85\xC0\x75\xF2\x8B\x6C\x24\x24\x33\xC0\x40\x50\x50\x8B\x45\x28\x53\x03\xC3\xFF\xD0\x83\xBC\x24\x30\x01\x00\x00\x00\x0F\x84\xC5\x00\x00\x00\x39\x7D\x7C\x0F\x84\xBC\x00\x00\x00\x8B\x55\x78\x03\xD3\x8B\x6A\x18\x85\xED\x0F\x84\xAC\x00\x00\x00\x39\x7A\x14\x0F\x84\xA3\x00\x00\x00\x8B\x7A\x20\x8B\x4A\x24\x03\xFB\x83\x64\x24\x2C\x00\x03\xCB\x85\xED\x0F\x84\x8C\x00\x00\x00\x8B\x37\x6A\x00\x58\x89\x44\x24\x18\x03\xF3\x74\x7F\x8A\x06\x84\xC0\x74\x2F\x8B\x5C\x24\x18\x0F\xBE\xC0\x03\xD8\xC1\xCB\x0D\x46\x8A\x06\x84\xC0\x75\xF1\x89\x5C\x24\x18\x8B\x44\x24\x18\x8B\x9C\x24\xAC\x00\x00\x00\x39\x84\x24\x30\x01\x00\x00\x75\x04\x85\xC9\x75\x15\x8B\x44\x24\x2C\x83\xC7\x04\x40\x83\xC1\x02\x89\x44\x24\x2C\x3B\xC5\x72\xAB\xEB\x35\x0F\xB7\x09\x8B\x42\x1C\x8D\x04\x88\x8B\x04\x18\x03\xC3\xF6\x84\x24\x40\x01\x00\x00\x08\x74\x0B\x6A\x04\xFF\xB4\x24\x40\x01\x00\x00\xEB\x0E\xFF\xB4\x24\x38\x01\x00\x00\xFF\xB4\x24\x38\x01\x00\x00\xFF\xD0\x59\x59\x8B\xC3\xEB\x02\x33\xC0\x5F\x5E\x5D\x5B\x81\xC4\x18\x01\x00\x00\xC3\x83\xEC\x14\x64\xA1\x30\x00\x00\x00\x53\x55\x56\x8B\x40\x0C\x57\x89\x4C\x24\x1C\x8B\x70\x0C\xE9\x99\x00\x00\x00\x8B\x56\x18\x33\xDB\x8B\x46\x30\x8B\x7E\x2C\x8B\x36\x89\x44\x24\x18\x8B\x42\x3C\x89\x54\x24\x10\x8B\x44\x10\x78\x89\x44\x24\x14\x85\xC0\x74\x75\xC1\xEF\x10\x33\xC9\x85\xFF\x74\x23\x8B\x54\x24\x18\x0F\xBE\x2C\x0A\xC1\xCB\x0D\x80\x3C\x0A\x61\x7C\x03\x83\xC3\xE0\x03\xDD\x41\x3B\xCF\x72\xE9\x8B\x54\x24\x10\x8B\x44\x24\x14\x8B\x7C\x10\x18\x8B\x44\x10\x20\x4F\x8D\x0C\xB8\x03\xCA\xEB\x34\x8B\x01\x33\xED\x03\xC2\x83\xE9\x04\x89\x44\x24\x18\x8B\xD0\x89\x4C\x24\x20\x8A\x0A\xC1\xCD\x0D\x0F\xBE\xC1\x03\xE8\x42\x84\xC9\x75\xF1\x8B\x54\x24\x10\x8D\x04\x2B\x3B\x44\x24\x1C\x74\x1E\x8B\x4C\x24\x20\x4F\x83\xFF\x01\x77\xC7\x83\x7E\x18\x00\x0F\x85\x5D\xFF\xFF\xFF\x33\xC0\x5F\x5E\x5D\x5B\x83\xC4\x14\xC3\x8B\x74\x24\x14\x8B\x44\x16\x24\x8D\x04\x78\x0F\xB7\x0C\x10\x8B\x44\x16\x1C\x8D\x04\x88\x8B\x04\x10\x03\xC2\xEB\xDB";
|
|
LPSTR rdiShellcode64 = "\x48\x8B\xC4\x48\x89\x58\x08\x44\x89\x48\x20\x4C\x89\x40\x18\x89\x50\x10\x55\x56\x57\x41\x54\x41\x55\x41\x56\x41\x57\x48\x8D\x6C\x24\x90\x48\x81\xEC\x70\x01\x00\x00\x45\x33\xFF\xC7\x45\xD0\x6B\x00\x65\x00\x48\x8B\xF1\x4C\x89\x7D\xF8\xB9\x13\x9C\xBF\xBD\x4C\x89\x7D\xC8\x44\x8B\xEA\x4C\x89\x7D\x08\x45\x8D\x4F\x65\x4C\x89\x7D\x10\x44\x88\x4D\xBC\x44\x88\x4D\xA2\x4C\x89\x7D\x00\x4C\x89\x7D\xE8\x4C\x89\x7D\x18\x44\x89\x7D\x24\x44\x89\x7C\x24\x24\xC7\x45\xD4\x72\x00\x6E\x00\xC7\x45\xD8\x65\x00\x6C\x00\xC7\x45\xDC\x33\x00\x32\x00\xC7\x45\xE0\x2E\x00\x64\x00\xC7\x45\xE4\x6C\x00\x6C\x00\xC7\x44\x24\x40\x53\x6C\x65\x65\xC6\x44\x24\x44\x70\xC7\x44\x24\x58\x4C\x6F\x61\x64\xC7\x44\x24\x5C\x4C\x69\x62\x72\xC7\x44\x24\x60\x61\x72\x79\x41\xC7\x44\x24\x48\x56\x69\x72\x74\xC7\x44\x24\x4C\x75\x61\x6C\x41\xC7\x44\x24\x50\x6C\x6C\x6F\x63\xC7\x44\x24\x68\x56\x69\x72\x74\xC7\x44\x24\x6C\x75\x61\x6C\x50\xC7\x44\x24\x70\x72\x6F\x74\x65\x66\xC7\x44\x24\x74\x63\x74\xC7\x45\xA8\x46\x6C\x75\x73\xC7\x45\xAC\x68\x49\x6E\x73\xC7\x45\xB0\x74\x72\x75\x63\xC7\x45\xB4\x74\x69\x6F\x6E\xC7\x45\xB8\x43\x61\x63\x68\xC7\x44\x24\x78\x47\x65\x74\x4E\xC7\x44\x24\x7C\x61\x74\x69\x76\xC7\x45\x80\x65\x53\x79\x73\xC7\x45\x84\x74\x65\x6D\x49\x66\xC7\x45\x88\x6E\x66\xC6\x45\x8A\x6F\xC7\x45\x90\x52\x74\x6C\x41\xC7\x45\x94\x64\x64\x46\x75\xC7\x45\x98\x6E\x63\x74\x69\xC7\x45\x9C\x6F\x6E\x54\x61\x66\xC7\x45\xA0\x62\x6C\xE8\x34\x08\x00\x00\xB9\xB5\x41\xD9\x5E\x48\x8B\xD8\xE8\x27\x08\x00\x00\x4C\x8B\xE0\x48\x89\x45\xF0\x48\x8D\x45\xD0\xC7\x45\x20\x18\x00\x18\x00\x4C\x8D\x4C\x24\x38\x48\x89\x45\x28\x4C\x8D\x45\x20\x33\xD2\x33\xC9\xFF\xD3\x48\x8B\x4C\x24\x38\x48\x8D\x44\x24\x48\x45\x33\xC0\x48\x89\x44\x24\x28\x4C\x8D\x4D\xC8\xC7\x44\x24\x20\x0C\x00\x0C\x00\x48\x8D\x54\x24\x20\x41\xFF\xD4\x48\x8B\x4C\x24\x38\x48\x8D\x44\x24\x68\x45\x33\xC0\x48\x89\x44\x24\x28\x4C\x8D\x4D\x00\xC7\x44\x24\x20\x0E\x00\x0E\x00\x48\x8D\x54\x24\x20\x41\xFF\xD4\xC7\x44\x24\x20\x15\x00\x15\x00\x48\x8B\x4C\x24\x38\x48\x8D\x45\xA8\x45\x33\xC0\x48\x89\x44\x24\x28\x4C\x8D\x4D\x08\x48\x8D\x54\x24\x20\x41\xFF\xD4\x48\x8B\x4C\x24\x38\x48\x8D\x44\x24\x78\x45\x33\xC0\x48\x89\x44\x24\x28\x4C\x8D\x4D\x10\xC7\x44\x24\x20\x13\x00\x13\x00\x48\x8D\x54\x24\x20\x41\xFF\xD4\x48\x8B\x4C\x24\x38\x48\x8D\x44\x24\x40\x45\x33\xC0\x48\x89\x44\x24\x28\x4C\x8D\x4D\xE8\xC7\x44\x24\x20\x05\x00\x05\x00\x48\x8D\x54\x24\x20\x41\xFF\xD4\x48\x8B\x4C\x24\x38\x48\x8D\x45\x90\x45\x33\xC0\x48\x89\x44\x24\x28\x4C\x8D\x4D\x18\xC7\x44\x24\x20\x13\x00\x13\x00\x48\x8D\x54\x24\x20\x41\xFF\xD4\x48\x8B\x4C\x24\x38\x48\x8D\x44\x24\x58\x45\x33\xC0\x48\x89\x44\x24\x28\x4C\x8D\x4D\xF8\xC7\x44\x24\x20\x0C\x00\x0C\x00\x48\x8D\x54\x24\x20\x41\xFF\xD4\x4C\x39\x7D\xC8\x0F\x84\xD0\x06\x00\x00\x4C\x39\x7D\x00\x0F\x84\xC6\x06\x00\x00\x4C\x39\x7D\xE8\x0F\x84\xBC\x06\x00\x00\x4C\x39\x7D\x08\x0F\x84\xB2\x06\x00\x00\x4C\x8B\x4D\x10\x4D\x85\xC9\x0F\x84\xA5\x06\x00\x00\x48\x63\x7E\x3C\x48\x03\xFE\x81\x3F\x50\x45\x00\x00\x0F\x85\x92\x06\x00\x00\xB8\x64\x86\x00\x00\x66\x39\x47\x04\x0F\x85\x83\x06\x00\x00\x44\x8B\x47\x38\x45\x8D\x5F\x01\x45\x84\xC3\x0F\x85\x72\x06\x00\x00\x0F\xB7\x4F\x14\x41\x8B\xDF\x48\x83\xC1\x24\x66\x44\x3B\x7F\x06\x73\x29\x44\x0F\xB7\x57\x06\x48\x03\xCF\x8B\x41\x04\x8B\x11\x85\xC0\x75\x06\x41\x8D\x04\x10\xEB\x02\x03\xC2\x3B\xC3\x0F\x46\xC3\x48\x83\xC1\x28\x8B\xD8\x4D\x2B\xD3\x75\xDF\x48\x8D\x4D\x38\x41\xFF\xD1\x8B\x55\x3C\x8B\xC2\xF7\xD8\x44\x8D\x72\xFF\x44\x03\x77\x50\x48\x8D\x4A\xFF\x4C\x23\xF0\x8B\xC3\x48\x03\xC8\x48\x8D\x42\xFF\x48\xF7\xD0\x48\x23\xC8\x4C\x3B\xF1\x0F\x85\x02\x06\x00\x00\x48\x8B\x4F\x30\x41\xB9\x04\x00\x00\x00\x41\xB8\x00\x30\x00\x00\x49\x8B\xD6\xFF\x55\xC8\x48\x8B\xD8\x48\x85\xC0\x75\x15\x44\x8D\x48\x04\x41\xB8\x00\x30\x00\x00\x49\x8B\xD6\x33\xC9\xFF\x55\xC8\x48\x8B\xD8\x44\x8B\x9D\xD8\x00\x00\x00\x41\xBE\x01\x00\x00\x00\x45\x84\xDE\x74\x1D\x8B\x46\x3C\x89\x43\x3C\x8B\x56\x3C\xEB\x0B\x8B\xCA\x41\x03\xD6\x8A\x04\x31\x88\x04\x19\x3B\x57\x54\x72\xF0\xEB\x19\x41\x8B\xD7\x44\x39\x7F\x54\x76\x10\x8B\xCA\x41\x03\xD6\x8A\x04\x31\x88\x04\x19\x3B\x57\x54\x72\xF0\x48\x63\x7B\x3C\x45\x8B\xD7\x48\x03\xFB\x48\x89\x7D\x30\x44\x0F\xB7\x47\x14\x49\x83\xC0\x28\x66\x44\x3B\x7F\x06\x73\x3A\x4C\x03\xC7\x45\x8B\xCF\x45\x39\x38\x76\x1F\x41\x8B\x50\x04\x41\x8B\x48\xFC\x41\x8B\xC1\x45\x03\xCE\x48\x03\xC8\x48\x03\xD0\x8A\x04\x32\x88\x04\x19\x45\x3B\x08\x72\xE1\x0F\xB7\x47\x06\x45\x03\xD6\x49\x83\xC0\x28\x44\x3B\xD0\x72\xC9\x4C\x8B\xD3\x4C\x2B\x57\x30\x0F\x84\xBE\x00\x00\x00\x44\x39\xBF\xB4\x00\x00\x00\x0F\x84\xB1\x00\x00\x00\x44\x8B\x87\xB0\x00\x00\x00\x4C\x03\xC3\x45\x39\x38\x0F\x84\x9E\x00\x00\x00\x41\xBD\x02\x00\x00\x00\x4D\x8D\x48\x08\xEB\x73\x41\x0F\xB7\x11\x0F\xB7\xCA\x0F\xB7\xC2\x66\xC1\xE9\x0C\x66\x83\xF9\x0A\x75\x13\x41\x8B\x08\x81\xE2\xFF\x0F\x00\x00\x48\x8D\x04\x13\x4C\x01\x14\x01\xEB\x49\x66\x83\xF9\x03\x75\x0E\x25\xFF\x0F\x00\x00\x48\x8D\x0C\x03\x41\x8B\xC2\xEB\x2E\x66\x41\x3B\xCE\x75\x15\x25\xFF\x0F\x00\x00\x48\x8D\x0C\x03\x49\x8B\xC2\x48\xC1\xE8\x10\x0F\xB7\xC0\xEB\x13\x66\x41\x3B\xCD\x75\x14\x25\xFF\x0F\x00\x00\x48\x8D\x0C\x03\x41\x0F\xB7\xC2\x41\x8B\x10\x48\x01\x04\x0A\x4D\x03\xCD\x41\x8B\x40\x04\x49\x03\xC0\x4C\x3B\xC8\x75\x81\x4D\x8B\xC1\x45\x39\x39\x0F\x85\x6F\xFF\xFF\xFF\x44\x8B\xAD\xB8\x00\x00\x00\x44\x39\xBF\x94\x00\x00\x00\x0F\x84\x86\x01\x00\x00\x44\x8B\x87\x90\x00\x00\x00\x45\x8B\xEF\x4C\x03\xC3\x49\x8D\x40\x0C\xEB\x07\x45\x03\xEE\x48\x8D\x40\x14\x44\x39\x38\x75\xF4\x41\x8B\xC3\x45\x8B\xE7\x83\xE0\x04\x89\x45\xC0\x74\x7F\x45\x3B\xEE\x76\x7A\x45\x8B\xE3\x45\x8B\xD7\x41\xC1\xEC\x10\x45\x8D\x5D\xFF\x45\x85\xDB\x74\x67\x4D\x8B\xC8\x41\x0F\x10\x01\x33\xD2\x41\x8B\xCD\x41\x2B\xCA\x69\xF6\xFD\x43\x03\x00\xB8\xFF\x7F\x00\x00\xF7\xF1\x33\xD2\x81\xC6\xC3\x9E\x26\x00\x41\x8D\x0C\x06\x8B\xC6\xC1\xE8\x10\x25\xFF\x7F\x00\x00\xF7\xF1\x41\x03\xC2\x45\x03\xD6\x48\x8D\x0C\x80\x41\x8B\x54\x88\x10\x41\x0F\x10\x0C\x88\x41\x0F\x11\x04\x88\x41\x8B\x41\x10\x41\x89\x44\x88\x10\x41\x0F\x11\x09\x41\x89\x51\x10\x4D\x8D\x49\x14\x45\x3B\xD3\x72\x9C\x8B\xB7\x90\x00\x00\x00\x48\x03\xF3\x44\x39\x7E\x0C\x0F\x84\xBC\x00\x00\x00\x8B\x7D\xC0\x8B\x4E\x0C\x48\x03\xCB\xFF\x55\xF8\x48\x89\x44\x24\x38\x4C\x8B\xD0\x44\x8B\x36\x44\x8B\x7E\x10\x4C\x03\xF3\x4C\x03\xFB\x49\x8B\x0E\x48\x85\xC9\x74\x65\x48\x8B\x7D\xF0\x48\x85\xC9\x79\x08\x45\x0F\xB7\x06\x33\xD2\xEB\x32\x48\x8D\x53\x02\x33\xC0\x48\x03\xD1\x38\x02\x74\x0E\x48\x8B\xCA\x48\xFF\xC1\x48\xFF\xC0\x80\x39\x00\x75\xF5\x48\x89\x54\x24\x28\x45\x33\xC0\x48\x8D\x54\x24\x20\x66\x89\x44\x24\x20\x66\x89\x44\x24\x22\x4D\x8B\xCF\x49\x8B\xCA\xFF\xD7\x49\x83\xC6\x08\x49\x83\xC7\x08\x49\x8B\x0E\x48\x85\xC9\x74\x07\x4C\x8B\x54\x24\x38\xEB\xA2\x8B\x7D\xC0\x45\x33\xFF\x45\x85\xE4\x74\x14\x85\xFF\x74\x10\x41\x83\xFD\x01\x76\x0A\x41\x69\xCC\xE8\x03\x00\x00\xFF\x55\xE8\x48\x83\xC6\x14\x44\x39\x7E\x0C\x0F\x85\x4B\xFF\xFF\xFF\x48\x8B\x7D\x30\x44\x8B\xAD\xB8\x00\x00\x00\x4C\x8B\x65\xF0\x44\x39\xBF\xF4\x00\x00\x00\x0F\x84\xB9\x00\x00\x00\x44\x8B\xBF\xF0\x00\x00\x00\x49\x83\xC7\x04\x4C\x03\xFB\x41\x8B\x07\x85\xC0\x0F\x84\x9D\x00\x00\x00\x41\xBD\x20\x00\x00\x00\x8B\xC8\x48\x03\xCB\xFF\x55\xF8\x48\x89\x44\x24\x38\x48\x8B\xC8\x41\x8B\x77\x08\x45\x8B\x77\x0C\x48\x03\xF3\x4C\x03\xF3\x48\x83\x3E\x00\x74\x5E\x49\x8B\x16\x48\x85\xD2\x79\x08\x44\x0F\xB7\xC2\x33\xD2\xEB\x33\x4C\x8D\x43\x02\x33\xC0\x4C\x03\xC2\x41\x38\x00\x74\x0E\x49\x8B\xD0\x48\xFF\xC2\x48\xFF\xC0\x80\x3A\x00\x75\xF5\x4C\x89\x44\x24\x28\x48\x8D\x54\x24\x20\x45\x33\xC0\x66\x89\x44\x24\x20\x66\x89\x44\x24\x22\x4C\x8B\xCE\x41\xFF\xD4\x48\x83\xC6\x08\x49\x83\xC6\x08\x48\x83\x3E\x00\x74\x07\x48\x8B\x4C\x24\x38\xEB\xA2\x4D\x03\xFD\x41\x8B\x07\x85\xC0\x0F\x85\x70\xFF\xFF\xFF\x44\x8B\xAD\xB8\x00\x00\x00\x45\x33\xFF\x0F\xB7\x77\x14\x45\x8B\xF7\x48\x83\xC6\x28\x41\xBC\x01\x00\x00\x00\x66\x44\x3B\x7F\x06\x0F\x83\xA4\x00\x00\x00\x48\x03\xF7\x45\x8D\x6C\x24\x1F\x44\x39\x3E\x74\x7C\x8B\x46\x14\x8B\xC8\x81\xE1\x00\x00\x00\x40\x0F\xBA\xE0\x1D\x72\x22\x85\xC9\x75\x0C\x85\xC0\x44\x8D\x41\x08\x45\x0F\x49\xC4\xEB\x33\x41\xB8\x04\x00\x00\x00\x85\xC0\x41\x8D\x40\xFE\x44\x0F\x49\xC0\xEB\x21\x85\xC9\x75\x11\xB9\x10\x00\x00\x00\x85\xC0\x44\x8D\x41\x70\x44\x0F\x49\xC1\xEB\x0C\x85\xC0\x41\xB8\x40\x00\x00\x00\x45\x0F\x49\xC5\x44\x89\x44\x24\x30\xF7\x46\x14\x00\x00\x00\x04\x74\x0A\x41\x0F\xBA\xE8\x09\x44\x89\x44\x24\x30\x8B\x4E\xFC\x4C\x8D\x4C\x24\x30\x8B\x16\x48\x03\xCB\xFF\x55\x00\x0F\xB7\x47\x06\x45\x03\xF4\x48\x83\xC6\x28\x44\x3B\xF0\x0F\x82\x6B\xFF\xFF\xFF\x44\x8B\xAD\xB8\x00\x00\x00\x45\x33\xC0\x33\xD2\x48\x83\xC9\xFF\xFF\x55\x08\x44\x39\xBF\xD4\x00\x00\x00\x74\x24\x8B\x87\xD0\x00\x00\x00\x48\x8B\x74\x18\x18\xEB\x0F\x45\x33\xC0\x41\x8B\xD4\x48\x8B\xCB\xFF\xD0\x48\x8D\x76\x08\x48\x8B\x06\x48\x85\xC0\x75\xE9\x4C\x8B\x4D\x18\x4D\x85\xC9\x74\x2F\x8B\x87\xA4\x00\x00\x00\x85\xC0\x74\x25\x8B\xC8\x4C\x8B\xC3\x48\xB8\xAB\xAA\xAA\xAA\xAA\xAA\xAA\xAA\x48\xF7\xE1\x8B\x8F\xA0\x00\x00\x00\x48\xC1\xEA\x03\x48\x03\xCB\x41\x2B\xD4\x41\xFF\xD1\x8B\x47\x28\x4D\x8B\xC4\x48\x03\xC3\x41\x8B\xD4\x48\x8B\xCB\xFF\xD0\x45\x85\xED\x0F\x84\xBB\x00\x00\x00\x44\x39\xBF\x8C\x00\x00\x00\x0F\x84\xAE\x00\x00\x00\x8B\x8F\x88\x00\x00\x00\x48\x03\xCB\x44\x8B\x59\x18\x45\x85\xDB\x0F\x84\x98\x00\x00\x00\x44\x39\x79\x14\x0F\x84\x8E\x00\x00\x00\x44\x8B\x49\x20\x41\x8B\xFF\x8B\x51\x24\x4C\x03\xCB\x48\x03\xD3\x45\x85\xDB\x74\x79\x45\x8B\x01\x45\x8B\xD7\x4C\x03\xC3\x74\x6E\x41\x8A\x00\x84\xC0\x74\x1E\x4D\x03\xC4\x0F\xBE\xC0\x44\x03\xD0\x41\xC1\xCA\x0D\x41\x8A\x00\x84\xC0\x75\xEC\x45\x3B\xEA\x75\x05\x48\x85\xD2\x75\x12\x41\x03\xFC\x49\x83\xC1\x04\x48\x83\xC2\x02\x41\x3B\xFB\x73\x39\xEB\xBE\x8B\x41\x1C\x0F\xB7\x0A\x48\x03\xC3\x44\x8B\x04\x88\x4C\x03\xC3\xF6\x85\xD8\x00\x00\x00\x08\x74\x0E\x48\x8B\x8D\xD0\x00\x00\x00\xBA\x08\x00\x00\x00\xEB\x0D\x8B\x95\xC8\x00\x00\x00\x48\x8B\x8D\xC0\x00\x00\x00\x41\xFF\xD0\x48\x8B\xC3\xEB\x02\x33\xC0\x48\x8B\x9C\x24\xB0\x01\x00\x00\x48\x81\xC4\x70\x01\x00\x00\x41\x5F\x41\x5E\x41\x5D\x41\x5C\x5F\x5E\x5D\xC3\xCC\xCC\xCC\x48\x8B\xC4\x48\x89\x58\x08\x48\x89\x68\x10\x48\x89\x70\x18\x48\x89\x78\x20\x41\x56\x48\x83\xEC\x10\x65\x48\x8B\x04\x25\x60\x00\x00\x00\x8B\xE9\x45\x33\xF6\x48\x8B\x50\x18\x4C\x8B\x42\x10\x4D\x39\x70\x30\x0F\x84\xBB\x00\x00\x00\x4D\x8B\x48\x30\x41\x8B\xD6\x41\x0F\x10\x40\x58\x4D\x8B\x00\x49\x63\x41\x3C\xF3\x0F\x7F\x04\x24\x46\x8B\x9C\x08\x88\x00\x00\x00\x45\x85\xDB\x74\xD1\x48\x8B\x04\x24\x48\xC1\xE8\x10\x66\x44\x3B\xF0\x73\x22\x48\x8B\x4C\x24\x08\x44\x0F\xB7\xD0\x0F\xBE\x01\xC1\xCA\x0D\x80\x39\x61\x7C\x03\x83\xC2\xE0\x03\xD0\x48\xFF\xC1\x49\x83\xEA\x01\x75\xE7\x4B\x8D\x3C\x19\x44\x8B\x57\x18\x8B\x47\x20\x41\xFF\xCA\x49\x03\xC1\x4A\x8D\x34\x90\xEB\x28\x8B\x1E\x45\x8B\xDE\x49\x03\xD9\x48\x8D\x76\xFC\x0F\xBE\x0B\x48\xFF\xC3\x41\xC1\xCB\x0D\x44\x03\xD9\x84\xC9\x75\xEF\x41\x8D\x04\x13\x3B\xC5\x74\x0E\x41\xFF\xCA\x41\x83\xFA\x01\x77\xD2\xE9\x57\xFF\xFF\xFF\x8B\x47\x24\x43\x8D\x0C\x12\x49\x03\xC1\x0F\xB7\x14\x01\x8B\x4F\x1C\x49\x03\xC9\x8B\x04\x91\x49\x03\xC1\xEB\x02\x33\xC0\x48\x8B\x5C\x24\x20\x48\x8B\x6C\x24\x28\x48\x8B\x74\x24\x30\x48\x8B\x7C\x24\x38\x48\x83\xC4\x10\x41\x5E\xC3";
|
|
DWORD rdiShellcode32Length = 2736, rdiShellcode64Length = 2725;
|
|
//MARKER:E
|
|
#endif
|
|
|
|
if (Is64BitDLL((UINT_PTR)inBytes))
|
|
{
|
|
|
|
rdiShellcode = rdiShellcode64;
|
|
rdiShellcodeLength = rdiShellcode64Length;
|
|
|
|
if (rdiShellcode == NULL || rdiShellcodeLength == 0) return 0;
|
|
|
|
BYTE bootstrap[69] = { 0 };
|
|
DWORD i = 0;
|
|
|
|
// call next instruction (Pushes next instruction address to stack)
|
|
bootstrap[i++] = 0xe8;
|
|
bootstrap[i++] = 0x00;
|
|
bootstrap[i++] = 0x00;
|
|
bootstrap[i++] = 0x00;
|
|
bootstrap[i++] = 0x00;
|
|
|
|
// Set the offset to our DLL from pop result
|
|
dllOffset = sizeof(bootstrap) - i + rdiShellcodeLength;
|
|
|
|
// pop rcx - Capture our current location in memory
|
|
bootstrap[i++] = 0x59;
|
|
|
|
// mov r8, rcx - copy our location in memory to r8 before we start modifying RCX
|
|
bootstrap[i++] = 0x49;
|
|
bootstrap[i++] = 0x89;
|
|
bootstrap[i++] = 0xc8;
|
|
|
|
// mov edx, <hash of function>
|
|
bootstrap[i++] = 0xba;
|
|
MoveMemory(bootstrap + i, &userFunction, sizeof(userFunction));
|
|
i += sizeof(userFunction);
|
|
|
|
// Setup the location of our user data
|
|
// add r8, <Offset of the DLL> + <Length of DLL>
|
|
bootstrap[i++] = 0x49;
|
|
bootstrap[i++] = 0x81;
|
|
bootstrap[i++] = 0xc0;
|
|
userDataLocation = dllOffset + length;
|
|
MoveMemory(bootstrap + i, &userDataLocation, sizeof(userDataLocation));
|
|
i += sizeof(userDataLocation);
|
|
|
|
// mov r9d, <Length of User Data>
|
|
bootstrap[i++] = 0x41;
|
|
bootstrap[i++] = 0xb9;
|
|
MoveMemory(bootstrap + i, &userLength, sizeof(userLength));
|
|
i += sizeof(userLength);
|
|
|
|
// push rsi - save original value
|
|
bootstrap[i++] = 0x56;
|
|
|
|
// mov rsi, rsp - store our current stack pointer for later
|
|
bootstrap[i++] = 0x48;
|
|
bootstrap[i++] = 0x89;
|
|
bootstrap[i++] = 0xe6;
|
|
|
|
// and rsp, 0x0FFFFFFFFFFFFFFF0 - Align the stack to 16 bytes
|
|
bootstrap[i++] = 0x48;
|
|
bootstrap[i++] = 0x83;
|
|
bootstrap[i++] = 0xe4;
|
|
bootstrap[i++] = 0xf0;
|
|
|
|
// sub rsp, 0x30 - Create some breathing room on the stack
|
|
bootstrap[i++] = 0x48;
|
|
bootstrap[i++] = 0x83;
|
|
bootstrap[i++] = 0xec;
|
|
bootstrap[i++] = 6 * 8; // 32 bytes for shadow space + 16 bytes for last args
|
|
|
|
// mov qword ptr [rsp + 0x28], rcx (shellcode base) - Push in arg 5
|
|
bootstrap[i++] = 0x48;
|
|
bootstrap[i++] = 0x89;
|
|
bootstrap[i++] = 0x4C;
|
|
bootstrap[i++] = 0x24;
|
|
bootstrap[i++] = 5 * 8;
|
|
|
|
// add rcx, <Offset of the DLL>
|
|
bootstrap[i++] = 0x48;
|
|
bootstrap[i++] = 0x81;
|
|
bootstrap[i++] = 0xc1;
|
|
MoveMemory(bootstrap + i, &dllOffset, sizeof(dllOffset));
|
|
i += sizeof(dllOffset);
|
|
|
|
// mov dword ptr [rsp + 0x20], <Flags> - Push arg 6 just above shadow space
|
|
bootstrap[i++] = 0xC7;
|
|
bootstrap[i++] = 0x44;
|
|
bootstrap[i++] = 0x24;
|
|
bootstrap[i++] = 4 * 8;
|
|
MoveMemory(bootstrap + i, &flags, sizeof(flags));
|
|
i += sizeof(flags);
|
|
|
|
// call - Transfer execution to the RDI
|
|
bootstrap[i++] = 0xe8;
|
|
bootstrap[i++] = sizeof(bootstrap) - i - 4; // Skip over the remainder of instructions
|
|
bootstrap[i++] = 0x00;
|
|
bootstrap[i++] = 0x00;
|
|
bootstrap[i++] = 0x00;
|
|
|
|
// mov rsp, rsi - Reset our original stack pointer
|
|
bootstrap[i++] = 0x48;
|
|
bootstrap[i++] = 0x89;
|
|
bootstrap[i++] = 0xf4;
|
|
|
|
// pop rsi - Put things back where we left them
|
|
bootstrap[i++] = 0x5e;
|
|
|
|
// ret - return to caller
|
|
bootstrap[i++] = 0xc3;
|
|
|
|
// Ends up looking like this in memory:
|
|
// Bootstrap shellcode
|
|
// RDI shellcode
|
|
// DLL bytes
|
|
// User data
|
|
outLength = length + userLength + rdiShellcodeLength + sizeof(bootstrap);
|
|
outBytes = (LPSTR)malloc(outLength);
|
|
MoveMemory(outBytes, bootstrap, sizeof(bootstrap));
|
|
MoveMemory(outBytes + sizeof(bootstrap), rdiShellcode, rdiShellcodeLength);
|
|
MoveMemory(outBytes + sizeof(bootstrap) + rdiShellcodeLength, inBytes, length);
|
|
MoveMemory(outBytes + sizeof(bootstrap) + rdiShellcodeLength + length, userData, userLength);
|
|
|
|
}
|
|
else { // 32 bit
|
|
|
|
rdiShellcode = rdiShellcode32;
|
|
rdiShellcodeLength = rdiShellcode32Length;
|
|
|
|
if (rdiShellcode == NULL || rdiShellcodeLength == 0) return 0;
|
|
|
|
BYTE bootstrap[50] = { 0 };
|
|
DWORD i = 0;
|
|
|
|
// call next instruction (Pushes next instruction address to stack)
|
|
bootstrap[i++] = 0xe8;
|
|
bootstrap[i++] = 0x00;
|
|
bootstrap[i++] = 0x00;
|
|
bootstrap[i++] = 0x00;
|
|
bootstrap[i++] = 0x00;
|
|
|
|
// Set the offset to our DLL from pop result
|
|
dllOffset = sizeof(bootstrap) - i + rdiShellcodeLength;
|
|
|
|
// pop eax - Capture our current location in memory
|
|
bootstrap[i++] = 0x58;
|
|
|
|
// push ebp
|
|
bootstrap[i++] = 0x55;
|
|
|
|
// move ebp, esp
|
|
bootstrap[i++] = 0x89;
|
|
bootstrap[i++] = 0xe5;
|
|
|
|
// mov edx, eax - copy our location in memory to ebx before we start modifying eax
|
|
bootstrap[i++] = 0x89;
|
|
bootstrap[i++] = 0xc2;
|
|
|
|
// add edx, <Offset to the DLL> + <Size of DLL>
|
|
bootstrap[i++] = 0x81;
|
|
bootstrap[i++] = 0xc2;
|
|
userDataLocation = dllOffset + length;
|
|
MoveMemory(bootstrap + i, &userDataLocation, sizeof(userDataLocation));
|
|
i += sizeof(userDataLocation);
|
|
|
|
// push <Flags>
|
|
bootstrap[i++] = 0x68;
|
|
MoveMemory(bootstrap + i, &flags, sizeof(flags));
|
|
i += sizeof(flags);
|
|
|
|
// push eax
|
|
bootstrap[i++] = 0x50;
|
|
|
|
// push <Length of User Data>
|
|
bootstrap[i++] = 0x68;
|
|
MoveMemory(bootstrap + i, &userLength, sizeof(userLength));
|
|
i += sizeof(userLength);
|
|
|
|
// push edx
|
|
bootstrap[i++] = 0x52;
|
|
|
|
// push <hash of function>
|
|
bootstrap[i++] = 0x68;
|
|
MoveMemory(bootstrap + i, &userFunction, sizeof(userFunction));
|
|
i += sizeof(userFunction);
|
|
|
|
// add eax, <Offset to the DLL>
|
|
bootstrap[i++] = 0x05;
|
|
MoveMemory(bootstrap + i, &dllOffset, sizeof(dllOffset));
|
|
i += sizeof(dllOffset);
|
|
|
|
// push eax
|
|
bootstrap[i++] = 0x50;
|
|
|
|
// call - Transfer execution to the RDI
|
|
bootstrap[i++] = 0xe8;
|
|
bootstrap[i++] = sizeof(bootstrap) - i - 4; // Skip the remainder of instructions
|
|
bootstrap[i++] = 0x00;
|
|
bootstrap[i++] = 0x00;
|
|
bootstrap[i++] = 0x00;
|
|
|
|
// add esp, 0x14 - clean up stack from args (cdecl)
|
|
bootstrap[i++] = 0x83;
|
|
bootstrap[i++] = 0xc4;
|
|
bootstrap[i++] = 0x14;
|
|
|
|
// leave
|
|
bootstrap[i++] = 0xc9;
|
|
|
|
// ret - return to caller
|
|
bootstrap[i++] = 0xc3;
|
|
|
|
// Ends up looking like this in memory:
|
|
// Bootstrap shellcode
|
|
// RDI shellcode
|
|
// DLL bytes
|
|
// User data
|
|
outLength = length + userLength + rdiShellcodeLength + sizeof(bootstrap);
|
|
outBytes = (LPSTR)malloc(outLength);
|
|
MoveMemory(outBytes, bootstrap, sizeof(bootstrap));
|
|
MoveMemory(outBytes + sizeof(bootstrap), rdiShellcode, rdiShellcodeLength);
|
|
MoveMemory(outBytes + sizeof(bootstrap) + rdiShellcodeLength, inBytes, length);
|
|
MoveMemory(outBytes + sizeof(bootstrap) + rdiShellcodeLength + length, userData, userLength);
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
typedef UINT_PTR(WINAPI * RDI)();
|
|
typedef void(WINAPI * Function)();
|
|
typedef BOOL(__cdecl * EXPORTEDFUNCTION)(LPVOID, DWORD);
|
|
|
|
int main(int argc, char *argv[], char *envp[])
|
|
{
|
|
LPSTR finalShellcode = NULL, data = NULL;
|
|
DWORD finalSize, dataSize;
|
|
DWORD dwOldProtect1 = 0;
|
|
SYSTEM_INFO sysInfo;
|
|
|
|
// For any MessageBox testing in the blob
|
|
HMODULE test = LoadLibraryA("User32.dll");
|
|
|
|
if (argc < 2) {
|
|
printf("\n[!] Usage:\n\n\tNativeLoader.exe <DLL File>\n\tNativeLoader.exe <Shellcode Bin>\n");
|
|
return 0;
|
|
}
|
|
if (!GetFileContents(argv[1], &data, dataSize)) {
|
|
printf("\n[!] Failed to load file\n");
|
|
return 0;
|
|
}
|
|
|
|
if (data[0] == 'M' && data[1] == 'Z') {
|
|
printf("[+] File is a DLL, attempting to convert\n");
|
|
|
|
if (!ConvertToShellcode(data, dataSize, HashFunctionName("SayHello"), "dave", 5, SRDI_CLEARHEADER, finalShellcode, finalSize)) {
|
|
printf("[!] Failed to convert DLL\n");
|
|
return 0;
|
|
}
|
|
|
|
printf("[+] Successfully Converted\n");
|
|
}
|
|
else {
|
|
finalShellcode = data;
|
|
finalSize = dataSize;
|
|
}
|
|
|
|
GetNativeSystemInfo(&sysInfo);
|
|
|
|
// Only set the first page to RWX
|
|
// This is should sufficiently cover the sRDI shellcode up top
|
|
if (VirtualProtect(finalShellcode, sysInfo.dwPageSize, PAGE_EXECUTE_READWRITE, &dwOldProtect1)) {
|
|
RDI rdi = (RDI)(finalShellcode);
|
|
|
|
printf("[+] Executing RDI\n");
|
|
HMODULE hLoadedDLL = (HMODULE)rdi(); // Excute DLL
|
|
|
|
free(finalShellcode); // Free the RDI blob. We no longer need it.
|
|
|
|
Function exportedFunction = (Function)GetProcAddressR(hLoadedDLL, "Uninstall");
|
|
if (exportedFunction) {
|
|
printf("[+] Calling exported functon\n");
|
|
exportedFunction();
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|