| 86 | namespace CallSpoofer |
| 87 | { |
| 88 | class SpoofFunction |
| 89 | { |
| 90 | public: |
| 91 | uintptr_t temp = 0; |
| 92 | const uintptr_t xor_key = 0xff00ff00ff00ff00; |
| 93 | void* ret_addr_in_stack = 0; |
| 94 | |
| 95 | SpoofFunction(void* addr) :ret_addr_in_stack(addr) |
| 96 | { |
| 97 | temp = *(uintptr_t*)ret_addr_in_stack; |
| 98 | temp ^= xor_key; |
| 99 | *(uintptr_t*)ret_addr_in_stack = 0; |
| 100 | } |
| 101 | ~SpoofFunction() |
| 102 | { |
| 103 | temp ^= xor_key; |
| 104 | *(uintptr_t*)ret_addr_in_stack = temp; |
| 105 | } |
| 106 | }; |
| 107 | |
| 108 | #ifdef _KERNEL_MODE |
| 109 | __forceinline PVOID LocateShellCode(PVOID func, size_t size = 500) |
nothing calls this directly
no outgoing calls
no test coverage detected