Move common assembly into a separate file

This commit is contained in:
mkrsym1 2023-06-25 02:19:24 +03:00
parent 22a7fb2a60
commit 55fd21feef
6 changed files with 78 additions and 124 deletions

62
injector/include/gpa.inc Normal file
View File

@ -0,0 +1,62 @@
BITS 64
; https://dennisbabkin.com/blog/?t=how-to-implement-getprocaddress-in-shellcode
GetKernel32ModuleHandle:
mov rax, gs:[60h]
mov rax, [rax + 18h]
mov rax, [rax + 20h]
mov rax, [rax]
mov rax, [rax]
mov rax, [rax + 20h]
ret
GetAddressOf_GetProcAddress:
mov eax, [rcx + 3ch]
add rax, rcx
lea rax, [rax + 88h]
mov edx, [rax]
lea rax, [rcx + rdx]
mov edx, [rax + 18h]
mov r8d, [rax + 20h]
lea r8, [rcx + r8]
mov r10, 41636f7250746547h ; "GetProcA"
mov r11, 0073736572646441h ; "Address\0"
.1:
mov r9d, [r8]
lea r9, [rcx + r9]
; Function name comparision
cmp r10, [r9]
jnz .2
cmp r11, [r9 + 7]
jnz .2
; Found GetProcAddress
neg rdx
mov r10d, [rax + 18h]
lea rdx, [r10 + rdx]
mov r10d, [rax + 24h]
lea r10, [rcx + r10]
movzx rdx, word [r10 + rdx * 2]
mov r10d, [rax + 1ch]
lea r10, [rcx + r10]
mov r10d, [r10 + rdx * 4]
lea rax, [rcx + r10] ; Function address
jmp .end
.2:
add r8, 4
dec rdx
jnz .1
.end:
ret

View File

@ -1,5 +1,8 @@
# Assemble the payload that will be injected into the game # Assemble the payload that will be injected into the game
l_payload_bin = asm_gen.process('src/payload.asm') l_payload_bin = asm_gen.process(
'src/payload.asm',
extra_args: [ str_include_dir ]
)
# Embed it into the library # Embed it into the library
l_res_files = custom_target( l_res_files = custom_target(
@ -13,6 +16,6 @@ shared_library(
'launcher_payload', 'launcher_payload',
'src/dll.c', 'src/dll.c',
l_res_files, l_res_files,
include_directories: '../include', include_directories: include_dir,
name_prefix: '' name_prefix: ''
) )

View File

@ -63,66 +63,7 @@ main: ; Replacement entry point
ret ret
; https://dennisbabkin.com/blog/?t=how-to-implement-getprocaddress-in-shellcode %include "gpa.inc"
GetKernel32ModuleHandle:
mov rax, gs:[60h]
mov rax, [rax + 18h]
mov rax, [rax + 20h]
mov rax, [rax]
mov rax, [rax]
mov rax, [rax + 20h]
ret
GetAddressOf_GetProcAddress:
mov eax, [rcx + 3ch]
add rax, rcx
lea rax, [rax + 88h]
mov edx, [rax]
lea rax, [rcx + rdx]
mov edx, [rax + 18h]
mov r8d, [rax + 20h]
lea r8, [rcx + r8]
mov r10, 41636f7250746547h ; "GetProcA"
mov r11, 0073736572646441h ; "Address\0"
.1:
mov r9d, [r8]
lea r9, [rcx + r9]
; Function name comparision
cmp r10, [r9]
jnz .2
cmp r11, [r9 + 7]
jnz .2
; Found GetProcAddress
neg rdx
mov r10d, [rax + 18h]
lea rdx, [r10 + rdx]
mov r10d, [rax + 24h]
lea r10, [rcx + r10]
movzx rdx, word [r10 + rdx * 2]
mov r10d, [rax + 1ch]
lea r10, [rcx + r10]
mov r10d, [r10 + rdx * 4]
lea rax, [rcx + r10] ; Function address
jmp .end
.2:
add r8, 4
dec rdx
jnz .1
.end:
ret
; Strings ; Strings

View File

@ -1,5 +1,11 @@
include_dir = include_directories('include')
str_include_dir = join_paths(meson.current_source_dir(), 'include')
# Assemble the payload that will be injected into the launcher # Assemble the payload that will be injected into the launcher
inj_payload_bin = asm_gen.process('src/payload.asm') inj_payload_bin = asm_gen.process(
'src/payload.asm',
extra_args: [ str_include_dir ]
)
# Embed it into the library # Embed it into the library
inj_res_files = custom_target( inj_res_files = custom_target(
@ -14,7 +20,7 @@ executable(
'jadeite', 'jadeite',
'src/injector.c', 'src/injector.c',
inj_res_files, inj_res_files,
include_directories: 'include', include_directories: include_dir,
name_prefix: '' name_prefix: ''
) )

View File

@ -28,66 +28,7 @@ main: ; Replacement entry point
ret ret
; https://dennisbabkin.com/blog/?t=how-to-implement-getprocaddress-in-shellcode %include "gpa.inc"
GetKernel32ModuleHandle:
mov rax, gs:[60h]
mov rax, [rax + 18h]
mov rax, [rax + 20h]
mov rax, [rax]
mov rax, [rax]
mov rax, [rax + 20h]
ret
GetAddressOf_GetProcAddress:
mov eax, [rcx + 3ch]
add rax, rcx
lea rax, [rax + 88h]
mov edx, [rax]
lea rax, [rcx + rdx]
mov edx, [rax + 18h]
mov r8d, [rax + 20h]
lea r8, [rcx + r8]
mov r10, 41636f7250746547h ; "GetProcA"
mov r11, 0073736572646441h ; "Address\0"
.1:
mov r9d, [r8]
lea r9, [rcx + r9]
; Function name comparision
cmp r10, [r9]
jnz .2
cmp r11, [r9 + 7]
jnz .2
; Found GetProcAddress
neg rdx
mov r10d, [rax + 18h]
lea rdx, [r10 + rdx]
mov r10d, [rax + 24h]
lea r10, [rcx + r10]
movzx rdx, word [r10 + rdx * 2]
mov r10d, [rax + 1ch]
lea r10, [rcx + r10]
mov r10d, [r10 + rdx * 4]
lea rax, [rcx + r10] ; Function address
jmp .end
.2:
add r8, 4
dec rdx
jnz .1
.end:
ret
; Strings ; Strings

View File

@ -8,6 +8,7 @@ asm_gen = generator(
nasm, nasm,
output: '@BASENAME@.bin', output: '@BASENAME@.bin',
arguments: [ arguments: [
'-i', '@EXTRA_ARGS@',
'-f', 'bin', '-f', 'bin',
'@INPUT@', '@INPUT@',
'-o', '@OUTPUT@' '-o', '@OUTPUT@'