mirror of
https://github.com/thomasxm/amber
synced 2026-06-08 17:46:04 +00:00
Ege Balcı
fae3275b68
- Major loader update! - Added TLS callback support - Added forwarded imports support - Removed GetProcAddress and LoadLibrary WinAPI usage - Switched to NTDLL WinApi functions - Wiper code improved - Added lite loader option for appending PE files on the fly! - Added experimental raw syscall loader - Added static build flags in makefile - File name bug fixed - Dockerfile updated - Github workflows added - README updated
36 lines
597 B
NASM
36 lines
597 B
NASM
[BITS 64]
|
|
|
|
|
|
run_tls_callbacks:
|
|
push rsi
|
|
push rbx
|
|
sub rsp,0x28
|
|
mov rsi,rcx
|
|
movsxd rax,DWORD [rcx+0x3c]
|
|
mov eax,DWORD [rcx+rax*1+0xd0]
|
|
mov edx,0x0
|
|
test eax,eax
|
|
je loc_1400033ad
|
|
mov eax,eax
|
|
mov rbx,QWORD [rcx+rax*1+0x18]
|
|
mov edx,0x1
|
|
test rbx,rbx
|
|
jne loc_1400033ca
|
|
loc_1400033ad:
|
|
mov eax,edx
|
|
add rsp,0x28
|
|
pop rbx
|
|
pop rsi
|
|
ret
|
|
loc_1400033b6:
|
|
mov r8d,0x0
|
|
mov edx,0x1
|
|
mov rcx,rsi
|
|
call rax
|
|
add rbx,0x8
|
|
loc_1400033ca:
|
|
mov rax,QWORD [rbx]
|
|
test rax,rax
|
|
jne loc_1400033b6
|
|
mov edx,0x1
|
|
jmp loc_1400033ad |