Skip to content

Commit

Permalink
It's INJECT_SHELLCODE, not INIT_SHELLCODE
Browse files Browse the repository at this point in the history
  • Loading branch information
32th-System authored Feb 28, 2024
1 parent 0349bd1 commit f97cc74
Showing 1 changed file with 5 additions and 5 deletions.
10 changes: 5 additions & 5 deletions thprac/src/thprac/thprac_load_exe.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@

namespace THPrac {

// This array is generated by compiling init_shellcode.cpp. Check the comment at the top of that file for more info.
unsigned char INIT_SHELLCODE[] = {
// This array is generated by compiling inject_shellcode.cpp. Check the comment at the top of that file for more info.
unsigned char INJECT_SHELLCODE[] = {
0x55, 0x53, 0x57, 0x56, 0x83, 0xEC, 0x38, 0x8B, 0x4C, 0x24, 0x4C, 0x8B, 0x41, 0x08, 0x8B, 0x51,
0x0C, 0x89, 0x54, 0x24, 0x34, 0x8B, 0x51, 0x10, 0x89, 0x54, 0x24, 0x24, 0x8B, 0x51, 0x14, 0x89,
0x54, 0x24, 0x20, 0x8B, 0x71, 0x18, 0x83, 0xC1, 0x1C, 0x51, 0xFF, 0xD0, 0x85, 0xC0, 0x0F, 0x84,
Expand Down Expand Up @@ -56,7 +56,7 @@ unsigned char INIT_SHELLCODE[] = {
0x38, 0x5E, 0x5F, 0x5B, 0x5D, 0xC2, 0x04, 0x00, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC,
};

static_assert(sizeof(INIT_SHELLCODE) % 16 == 0);
static_assert(sizeof(INJECT_SHELLCODE) % 16 == 0);

bool LoadSelf(HANDLE hProcess, void* userdata, size_t userdataSize)
{
Expand Down Expand Up @@ -84,11 +84,11 @@ bool LoadSelf(HANDLE hProcess, void* userdata, size_t userdataSize)
return false;
defer(VirtualFreeEx(hProcess, rModule, 0, MEM_RELEASE));
WriteProcessMemory(hProcess, rModule, &lModule, sizeof(remote_param), nullptr);
LPVOID pRemoteInit = VirtualAllocEx(hProcess, nullptr, sizeof(INIT_SHELLCODE), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
LPVOID pRemoteInit = VirtualAllocEx(hProcess, nullptr, sizeof(INJECT_SHELLCODE), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if (!pRemoteInit)
return false;
defer(VirtualFreeEx(hProcess, pRemoteInit, 0, MEM_RELEASE));
WriteProcessMemory(hProcess, pRemoteInit, INIT_SHELLCODE, sizeof(INIT_SHELLCODE), nullptr);
WriteProcessMemory(hProcess, pRemoteInit, INJECT_SHELLCODE, sizeof(INJECT_SHELLCODE), nullptr);

// Invoke
InjectResult rResult;
Expand Down

0 comments on commit f97cc74

Please sign in to comment.