mirror of
https://github.com/thomasxm/amber
synced 2026-06-08 17:46:04 +00:00
Ege Balcı
fae3275b68
- Major loader update! - Added TLS callback support - Added forwarded imports support - Removed GetProcAddress and LoadLibrary WinAPI usage - Switched to NTDLL WinApi functions - Wiper code improved - Added lite loader option for appending PE files on the fly! - Added experimental raw syscall loader - Added static build flags in makefile - File name bug fixed - Dockerfile updated - Github workflows added - README updated
52 lines
2.7 KiB
NASM
52 lines
2.7 KiB
NASM
;#==============================================#
|
||
;# X64 Reflective Loader #
|
||
;# Author: Ege Balcı <egebalci@pm.me> #
|
||
;# Version: 3.0 #
|
||
;#==============================================#
|
||
;
|
||
[BITS 64]
|
||
|
||
%define e_lfanew 0x3C
|
||
%define _AddressOfEntry 0x28
|
||
loader_size equ pe_start-loader
|
||
|
||
|
||
call loader ; Get the address of PE image to stack
|
||
loader:
|
||
pop rsi ; Get current address to RSI
|
||
add rsi, loader_size ; Add the total loader size
|
||
push rbp ; Save RBP
|
||
mov rbp,rsp ; Create a stack frame
|
||
mov rcx,rsi ; Move the image address as first parameter
|
||
call map_image ; Perform PE image mapping
|
||
mov rdi, rax ; Get the address of mapped PE image into RDI
|
||
mov rcx, rdi ; Move a copy of the mapped image address into RCX as first parameter
|
||
call resolve_imports ; Resolve image imports
|
||
mov rcx, rdi ; Set the mapped image address as first parameter
|
||
call relocate_image ; Perform image base relocation
|
||
mov rcx, rdi ; Set the mapped image address as first parameter
|
||
call protect_sections ; Apply proper section memory protections
|
||
mov rcx, rdi ; Set the mapped image address as first parameter
|
||
call run_tls_callbacks ; Try to execute TLS callbacks. May fail... ¯\_(ツ)_/¯
|
||
xor rax, rax ; Clear out RAX
|
||
mov eax, DWORD [rdi+e_lfanew] ; Get the file header offset
|
||
mov eax, DWORD [rdi+rax+_AddressOfEntry] ; Get the AddressOfEntry into EAX
|
||
add rax,rdi ; Add the AOE onto new image base
|
||
cld ; Clear direction flags
|
||
mov rsp, rbp ; Restore stack frame
|
||
pop rbp ; Restore RBP
|
||
jmp rax ; Jmp to the PE->AOE
|
||
; ------------------------ FUNCTIONS ------------------------------------
|
||
%include "./inc/memcpy.asm"
|
||
%include "./inc/calc_crc.asm"
|
||
%include "./inc/map_image.asm"
|
||
%include "./inc/load_module.asm"
|
||
%include "./inc/relocate_image.asm"
|
||
%include "./inc/resolve_imports.asm"
|
||
%include "./inc/get_proc_by_crc.asm"
|
||
%include "./inc/get_module_by_crc.asm"
|
||
%include "./inc/protect_sections.asm"
|
||
%include "./inc/run_tls_callbacks.asm"
|
||
%include "../crc32_api/crc32_api_x64.asm"
|
||
;------------------------ FUNCTIONS -------------------------------------
|
||
pe_start: |