Recover the executable memory to it's original state
This commit is contained in:
parent
848ae06792
commit
0004c26d7a
@ -1,5 +1,50 @@
|
||||
BITS 64
|
||||
|
||||
; Macro definitions
|
||||
|
||||
; read dst, pSrc, size
|
||||
%macro read 3
|
||||
|
||||
mov %1, [%2]
|
||||
add %2, %3
|
||||
|
||||
%endmacro
|
||||
|
||||
; copy pDst, pSrc, temp, tempSize
|
||||
%macro copy 4
|
||||
|
||||
mov %3, [%2]
|
||||
mov [%1], %3
|
||||
add %1, %4
|
||||
add %2, %4
|
||||
|
||||
%endmacro
|
||||
|
||||
; unprotect addr, size, fn
|
||||
%macro unprotect 3
|
||||
|
||||
mov rcx, %1
|
||||
mov rdx, %2
|
||||
mov r8, 40h ; PAGE_EXECUTE_READWRITE
|
||||
lea r9, [rel oldProtect]
|
||||
|
||||
call %3
|
||||
|
||||
%endmacro
|
||||
|
||||
; reprotect addr, size, fn
|
||||
%macro reprotect 3
|
||||
|
||||
mov rcx, %1
|
||||
mov rdx, %2
|
||||
lea r9, [rel oldProtect]
|
||||
mov r8d, [r9]
|
||||
|
||||
call %3
|
||||
|
||||
%endmacro
|
||||
|
||||
|
||||
main: ; Replacement entry point
|
||||
push rsi
|
||||
push rdi
|
||||
@ -16,6 +61,14 @@ main: ; Replacement entry point
|
||||
mov rdi, rax ; *GetProcAddress
|
||||
|
||||
|
||||
mov rcx, rsi ; kernel32.dll
|
||||
lea rdx, [rel s_VirtualProtect]
|
||||
call rdi ; rax = *VirtualProtect
|
||||
|
||||
mov rcx, rax
|
||||
call RecoverExecutable
|
||||
|
||||
|
||||
mov rcx, rsi ; kernel32.dll
|
||||
lea rdx, [rel s_LoadLibraryW]
|
||||
call rdi ; rax = *LoadLibraryW
|
||||
@ -63,10 +116,65 @@ main: ; Replacement entry point
|
||||
ret
|
||||
|
||||
|
||||
RecoverExecutable: ; expects *VirtualProtect in rcx
|
||||
push rbx
|
||||
push r12
|
||||
push r13
|
||||
push r14
|
||||
sub rsp, 8
|
||||
|
||||
mov r13, rcx
|
||||
|
||||
; Find the recovery data structure
|
||||
lea rbx, [rel dllPath]
|
||||
|
||||
.search:
|
||||
read ax, rbx, 2
|
||||
test ax, ax
|
||||
jnz .search
|
||||
|
||||
; Recover entry point bytes (6 + 8 = 14 total)
|
||||
read r12, rbx, 8 ; Address
|
||||
mov r14, r12
|
||||
|
||||
unprotect r14, 14, r13
|
||||
copy r12, rbx, rax, 8
|
||||
copy r12, rbx, eax, 4
|
||||
copy r12, rbx, ax, 2
|
||||
reprotect r14, 14, r13
|
||||
|
||||
; Recover import descriptor bytes (20 total)
|
||||
read r12, rbx, 8
|
||||
mov r14, r12
|
||||
|
||||
unprotect r14, 20, r13
|
||||
copy r12, rbx, rax, 8
|
||||
copy r12, rbx, rax, 8
|
||||
copy r12, rbx, eax, 4
|
||||
reprotect r14, 20, r13
|
||||
|
||||
; Recover import data directory entry size bytes (4 total)
|
||||
read r12, rbx, 8
|
||||
mov r14, r12
|
||||
|
||||
unprotect r14, 4, r13
|
||||
copy r12, rbx, eax, 4
|
||||
reprotect r14, 4, r13
|
||||
|
||||
add rsp, 8
|
||||
pop r14
|
||||
pop r13
|
||||
pop r12
|
||||
pop rbx
|
||||
ret
|
||||
|
||||
|
||||
%include "gpa.asm"
|
||||
|
||||
oldProtect: dd 0
|
||||
|
||||
; Strings
|
||||
s_VirtualProtect: db "VirtualProtect", 0
|
||||
s_LoadLibraryW: db "LoadLibraryW", 0
|
||||
s_GetModuleHandleA: db "GetModuleHandleA", 0
|
||||
s_GetCommandLineW: db "GetCommandLineW", 0
|
||||
|
Loading…
Reference in New Issue
Block a user