| 17 | } |
| 18 | |
| 19 | LPVOID WindowsShellCodeInvoke::VirtualAllocMemory(LPVOID base, UINT32 size, UINT32 flAllocationType, UINT32 flProtect) { |
| 20 | UINT64 base_address = (UINT64)base; |
| 21 | UINT8 p_base_address[4]; |
| 22 | p32((UINT32)&base_address, p_base_address); |
| 23 | |
| 24 | UINT64 region_size = size; |
| 25 | UINT8 p_region_size[4]; |
| 26 | p32((UINT32)®ion_size, p_region_size); |
| 27 | |
| 28 | UINT64 tmp = flAllocationType; |
| 29 | UINT8 fl_allocation_type[8]; |
| 30 | p64(tmp, fl_allocation_type); |
| 31 | |
| 32 | UINT8 fl_protect[8]; |
| 33 | tmp = flProtect; |
| 34 | p64(tmp, fl_protect); |
| 35 | |
| 36 | #define FLAT_ARRAY_DWORD(arr, base) arr[0 + base], arr[1 + base], arr[2 + base], arr[3 + base] |
| 37 | #define FLAT_ARRAY_QWORD(arr, base) FLAT_ARRAY_DWORD(arr, base + 0), FLAT_ARRAY_DWORD(arr, base + 4) |
| 38 | |
| 39 | UINT8 bytes_sequence[] = { |
| 40 | FUNCTION_ENTER, |
| 41 | HEAVENS_GAET_ENTER, |
| 42 | |
| 43 | 0x48, 0x31, 0xC9, // xor rcx, rcx |
| 44 | 0x48, 0xFF, 0xC9, // dec rcx #ProcessHandle |
| 45 | 0x49, 0x89, 0xCA, // mov r10, rcx |
| 46 | 0xBA, FLAT_ARRAY_DWORD(p_base_address, 0), // mov edx, #&base_address |
| 47 | 0x41, 0xB8, 0xFF, 0xFF, 0xFE, 0x7F, // mov r8d, 0x7FFEFFFF #ZeroBits |
| 48 | 0x41, 0xB9, FLAT_ARRAY_DWORD(p_region_size, 0), // mov r9d, #&RegionSize |
| 49 | 0x41, 0x57, // push r15 |
| 50 | 0x49, 0xBF, FLAT_ARRAY_QWORD(fl_protect, 0), // movabs r15, #flAllocationType |
| 51 | 0x41, 0x57, // push r15 |
| 52 | 0x49, 0xBF, FLAT_ARRAY_QWORD(fl_allocation_type, 0), // movabs r15, #flProtect |
| 53 | 0x41, 0x57, // push r15 |
| 54 | 0x41, 0x5F, // pop r15 |
| 55 | 0x41, 0x5F, // pop r15 |
| 56 | 0x41, 0x5F, // pop r15 |
| 57 | |
| 58 | 0xB8, 0x18, 0x00, 0x00, 0x00, // mov eax, 0x18 |
| 59 | |
| 60 | 0x48, 0x83, 0xEC, 0x40, // sub rsp, 0x30 |
| 61 | 0x0F, 0x05, // syscall |
| 62 | |
| 63 | HEAVENS_GATE_LEAVE, |
| 64 | FUNCTION_LEAVE, |
| 65 | }; |
| 66 | |
| 67 | InvokeShellcode(bytes_sequence, sizeof(bytes_sequence)); |
| 68 | |
| 69 | return (LPVOID)base_address; |
| 70 | } |
| 71 | |
| 72 | VOID WindowsShellCodeInvoke::InvokeShellcode(UINT8* bytes_sequence, UINT32 length) { |
| 73 | UINT32 block_size = (length & 0xfffff000) | ((length | 0xfff) ? 1000 : 0); |