diff options
Diffstat (limited to 'CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/GetProcAddress.asm')
| -rw-r--r-- | CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/GetProcAddress.asm | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/GetProcAddress.asm b/CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/GetProcAddress.asm new file mode 100644 index 0000000..bf2ac9e --- /dev/null +++ b/CodeExecution/Invoke-ReflectivePEInjection_Resources/Shellcode/x86/GetProcAddress.asm @@ -0,0 +1,28 @@ +[SECTION .text] + +global _start + +_start: + ; Save state of ebx and stack + push ebx + mov ebx, esp + + ; Align stack + and esp, 0xffffffc0 + + ; Call GetProcAddress + mov eax, 0x41414141 ; DllHandle, supplied by PS + mov ecx, 0x41414141 ; Function name, supplied by PS + push ecx + push eax + mov eax, 0x41414141 ; GetProcAddress address, supplied by PS + call eax + + ; Write GetProcAddress return value to an address supplied by PS + mov ecx, 0x41414141 ; Address supplied by PS + mov [ecx], eax + + ; Fix stack + mov esp, ebx + pop ebx + ret |