-
Автор темы
- #1
Обратите внимание, пользователь заблокирован на форуме. Не рекомендуется проводить сделки.
Код:
auto assembler = blackbone::AsmFactory::GetAssembler(m_InnerProcess.modules().GetMainModule()->type);
auto& asmHelper = *assembler;
asmHelper.GenPrologue();
//Save EDI, ECX regs
asmHelper->push(asmHelper->zdi);
asmHelper->push(asmHelper->zcx);
//MOV EDI, p_Domain
asmHelper->mov(asmHelper->zdi, p_Domain);
//ADD EDI, 0x70 (Offset of domain_assemblies)
asmHelper->add(asmHelper->zdi, 0x70);
//MOV ECX, DWORD PTR DS[EDI]
//Store domain_assemblies into a temp variable
asmHelper->mov(asmHelper->zcx, asmHelper->intptr_ptr(asmHelper->zdi));
//MOV ECX, 0x4
//ECX now points to 2nd assembly in list
asmHelper->add(asmHelper->zcx, 0x4);
//MOV ECX, DWORD PTR DS[ECX]
asmHelper->mov(asmHelper->zcx, asmHelper->intptr_ptr(asmHelper->zcx));
//MOV DWORD PTR DS[EDI], ECX
//Replace real domain_assemblies with our temp variable
asmHelper->mov(asmHelper->intptr_ptr(asmHelper->zdi), asmHelper->zcx);
//Restore EDI, ECX regs
asmHelper->pop(asmHelper->zcx);
asmHelper->pop(asmHelper->zdi);
m_InnerProcess.remote().AddReturnWithEvent(asmHelper);
asmHelper.GenEpilogue();
uint64_t callResult = NULL;
NTSTATUS result = m_InnerProcess.remote().ExecInWorkerThread(asmHelper->make(), asmHelper->getCodeSize(), callResult);
return NT_SUCCESS(result);