-
-
[求助]X64下 fastcall 函数 如何Shellcode
-
发表于: 2015-10-31 18:12 2596
-
这是 Tesla.Angela 的一段代码,这样子感觉很危险的样子,感觉add rcx, rdx前面应该还有指令,请大神们讲解下
typedef UINT64 (__fastcall *SCFN)(UINT64,UINT64,UINT64,UINT64);
VOID test()
{
SCFN scfn;
UINT64 ret;
UCHAR strShellCode[14]="\x48\x03\xCA\x49\x03\xC8\x49\x03\xC9\x48\x8B\xC1\xC3";
/*
add rcx,rdx
add rcx,r8
add rcx,r9
mov rax,rcx
ret
*/
scfn=ExAllocatePool(NonPagedPool,14);
memcpy(scfn,strShellCode,14);
ret=scfn(11,22,33,44);
DbgPrint("[x64Drv] Inline ASM return: %lld",ret);
ExFreePool(scfn);
}
typedef UINT64 (__fastcall *SCFN)(UINT64,UINT64,UINT64,UINT64);
VOID test()
{
SCFN scfn;
UINT64 ret;
UCHAR strShellCode[14]="\x48\x03\xCA\x49\x03\xC8\x49\x03\xC9\x48\x8B\xC1\xC3";
/*
add rcx,rdx
add rcx,r8
add rcx,r9
mov rax,rcx
ret
*/
scfn=ExAllocatePool(NonPagedPool,14);
memcpy(scfn,strShellCode,14);
ret=scfn(11,22,33,44);
DbgPrint("[x64Drv] Inline ASM return: %lld",ret);
ExFreePool(scfn);
}
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
赞赏
他的文章
看原图
赞赏
雪币:
留言: