mirror of
https://github.com/rbmm/INJECT
synced 2026-06-08 17:02:59 +00:00
rbmm
159 lines
2.8 KiB
NASM
159 lines
2.8 KiB
NASM
|
|
WSTRING macro text
|
|
FORC arg, text
|
|
DW '&arg'
|
|
ENDM
|
|
DW 0
|
|
endm
|
|
|
|
.code
|
|
|
|
UserNormalRoutine proc
|
|
|
|
DllName$ = 20h
|
|
hmod$ = 30h
|
|
|
|
; params:
|
|
; rcx -> ImageBase;
|
|
; rdx -> unused
|
|
; r8 -> unused
|
|
|
|
ALIGN 2
|
|
nop
|
|
call @@0
|
|
WSTRING <{EBB50DDB-F6AA-492d-94E3-1D51B299F627}.DLL>
|
|
@@0:
|
|
pop rdx ; rdx -> LibName
|
|
mov [rsp + 08h],rcx ; rcx -> ImageBase
|
|
mov [rsp + 10h],rdi
|
|
mov [rsp + 18h],rbp
|
|
sub rsp,48h
|
|
|
|
mov rdi,rdx ; rdi -> LibName
|
|
xor eax,eax
|
|
repne scasw
|
|
sub rdi,rdx
|
|
mov DllName$[rsp + 2],di
|
|
dec edi
|
|
dec edi
|
|
mov DllName$[rsp + 0],di
|
|
mov DllName$[rsp + 8],rdx
|
|
|
|
mov rax,gs:[60h] ; rax = ProcessEnvironmentBlock
|
|
mov rax,[rax+18h] ; rax = Ldr
|
|
mov rax,[rax+30h] ; rax = InInitializationOrderModuleList.Flink
|
|
mov rcx,[rax+10h] ; rax = DllBase (ntdll.dll)
|
|
mov rbp,rcx ; rbp -> ntdll.dll
|
|
call @@1
|
|
db 'LdrLoadDll',0
|
|
@@1:
|
|
pop rdx
|
|
call getprocaddr
|
|
test rax,rax
|
|
jz @@2
|
|
|
|
lea r9,hmod$[rsp]
|
|
lea r8,DllName$[rsp]
|
|
xor rcx,rcx
|
|
mov rdx,rcx
|
|
call rax ; LdrLoadDll
|
|
|
|
@@2:
|
|
call @@3
|
|
db 'NtUnmapViewOfSection',0
|
|
@@3:
|
|
pop rdx
|
|
mov rcx,rbp
|
|
call getprocaddr
|
|
|
|
add rsp,48h
|
|
mov rdi,[rsp + 10h]
|
|
mov rbp,[rsp + 18h]
|
|
|
|
test rax,rax
|
|
jnz @@4
|
|
ret
|
|
@@4:
|
|
|
|
mov rdx,[rsp + 8h] ; ImageBase
|
|
xor rcx,rcx
|
|
dec rcx ; NtCurrentProcess()
|
|
jmp rax ; NtUnmapViewOfSection
|
|
|
|
UserNormalRoutine endp
|
|
|
|
getprocaddr proc private
|
|
|
|
push r12
|
|
push rbp
|
|
push rsi
|
|
push rdi
|
|
push rbx
|
|
|
|
mov rbx,rcx ; rbx -> PIMAGE_DOS_HEADER
|
|
mov rdi,rdx ; name
|
|
xor al,al
|
|
repne scasb
|
|
sub rdi,rdx
|
|
mov rbp,rdi ; rbp - name length
|
|
|
|
movsxd rax,dword ptr [rbx+3Ch] ; e_lfanew
|
|
mov eax,[rbx+rax+88h] ; pinth->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress
|
|
add rax,rbx ; rax -> PIMAGE_EXPORT_DIRECTORY
|
|
|
|
mov r9d,[rax+18h] ; NumberOfNames
|
|
test r9d,r9d
|
|
je @@5
|
|
|
|
mov r12d,[rax+1Ch] ; AddressOfFunctions
|
|
mov r11d,[rax+20h] ; AddressOfNames
|
|
mov r10d,[rax+24h] ; AddressOfNameOrdinals
|
|
add r10,rbx
|
|
add r11,rbx
|
|
add r12,rbx
|
|
|
|
xor r8d,r8d
|
|
@@1:
|
|
lea eax,[r8d+r9d]
|
|
shr eax,1 ; eax - index - [r8d, eax) : [eax, r9d)
|
|
|
|
mov edi,[r11+rax*4] ; AddressOfNames[eax]
|
|
add rdi,rbx ; rdi -> export name
|
|
|
|
mov rcx,rbp ; name length
|
|
mov rsi,rdx ; name
|
|
|
|
repe cmpsb
|
|
|
|
jnz @@2
|
|
|
|
movzx eax,word ptr [r10+rax*2] ; eax = AddressOfNameOrdinals[eax]
|
|
mov eax,dword ptr [r12+rax*4] ; eax = AddressOfFunctions[eax]
|
|
add rax,rbx
|
|
jmp @@6
|
|
|
|
@@2:
|
|
js @@3
|
|
|
|
lea r8d,[eax+1]
|
|
jmp @@4
|
|
@@3:
|
|
mov r9d,eax
|
|
@@4:
|
|
cmp r8d,r9d ; [r8d, r9d)
|
|
jb @@1
|
|
@@5:
|
|
xor eax,eax
|
|
@@6:
|
|
|
|
pop rbx
|
|
pop rdi
|
|
pop rsi
|
|
pop rbp
|
|
pop r12
|
|
ret
|
|
|
|
getprocaddr endp
|
|
|
|
|
|
end |