| 2 | #include<Windows.h> |
| 3 | |
| 4 | class WindowsShellCodeInvoke { |
| 5 | #define HEAVENS_GAET_ENTER 0x6A, 0x33, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x83, 0x04, 0x24, 0x05, 0xCB |
| 6 | #define HEAVENS_GATE_LEAVE 0xE8, 0x00, 0x00, 0x00, 0x00, 0xC7, 0x44, 0x24, 0x04, 0x23, 0x00, 0x00, 0x00, 0x83, 0x04, 0x24, 0x0D, 0xCB, 0x66, 0x8C, 0xD8, 0x8E, 0xD0 |
| 7 | |
| 8 | #define FUNCTION_ENTER 0x55, 0x89, 0xE5, 0x83, 0xe4, 0xf0 |
| 9 | #define FUNCTION_LEAVE 0x89, 0xEC, 0x5D, 0xC3 |
| 10 | |
| 11 | private: |
| 12 | typedef void (__cdecl * LPSYSCALL_FUNC)( |
| 13 | UINT64 shellcode, |
| 14 | UINT64 args1, UINT64 args2, UINT64 args3, UINT64 args4, |
| 15 | UINT64 args_nums, |
| 16 | UINT64 args_arr, |
| 17 | UINT32 *ret |
| 18 | ); |
| 19 | |
| 20 | LPSYSCALL_FUNC p_syscall_func; |
| 21 | |
| 22 | public: |
| 23 | WindowsShellCodeInvoke() { } |
| 24 | |
| 25 | LPVOID VirtualAllocMemory(LPVOID base, UINT32 size, UINT32 flAllocationType, UINT32 flProtect); |
| 26 | |
| 27 | VOID InvokeShellcode(UINT8* bytes_sequence, UINT32 length); |
| 28 | |
| 29 | protected: |
| 30 | void p32(UINT32, UINT8* dst); |
| 31 | |
| 32 | void p64(UINT64, UINT8* dst); |
| 33 | }; |
nothing calls this directly
no outgoing calls
no test coverage detected