admin/paranoidninja-Proxy-Function-Calls-For-ETwTI
1
0
Fork 0
mirror of https://github.com/paranoidninja/Proxy-Function-Calls-For-ETwTI synced 2026-06-06 16:34:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Ba Dum Tss

Browse Source
This commit is contained in:
Paranoid Ninja
2023-01-29 15:54:56 +05:30
committed by GitHub
parent 16933d5391
commit 94c218149c
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxyHelper
+16
View File
@@ -0,0 +1,16 @@
section .text
global WorkCallback
WorkCallback:
mov rbx, rdx ; backing up the struct as we are going to stomp rdx
mov rax, [rbx] ; NtAllocateVirtualMemory
mov rcx, [rbx + 0x8] ; HANDLE ProcessHandle
mov rdx, [rbx + 0x10] ; PVOID *BaseAddress
xor r8, r8 ; ULONG_PTR ZeroBits
mov r9, [rbx + 0x18] ; PSIZE_T RegionSize
mov r10, [rbx + 0x20] ; ULONG Protect
mov [rsp+0x30], r10 ; stack pointer for 6th arg
mov r10, 0x3000 ; ULONG AllocationType
mov [rsp+0x28], r10 ; stack pointer for 5th arg
jmp rax