-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathinjection64.asm
67 lines (57 loc) · 928 Bytes
/
injection64.asm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
public start
.DATA
.CODE
stub:
start:
push rax
push rbx
push rcx
push rdx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
sub rsp, 8h
call here
sub rax, 20h
mov r8, offset msgBoxCaption - 140001000h
add r8, rax
mov rdx, offset msgBoxText - 140001000h
add rdx, rax
xor rcx, rcx ; hWnd = null
xor r9d, r9d ; uType = 0
sub rsp, 20h
db 0FFh, 15h, 0A0h, 0A0h, 0A0h, 0A0h
; call __imp_MessageBoxW
add rsp, 28h ; + 8 from (sub rsp, 8h)
pop r15
pop r14
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
pop rdi
pop rsi
pop rbp
pop rdx
pop rcx
pop rbx
pop rax
call stub
db 0E9h
db 0Ah, 0Ah, 0Ah, 0Ah
here:
mov rax, [rsp]
ret
msgBoxCaption dw 'U', 'n', 'c', 'l', 'e', ' ', 'S', 'o', 's', 'o', 0
msgBoxText dw 'H', 'e', 'l', 'l', 'o', ' ', 'f', 'r', 'o', 'm', ' ', 'u', 'n', 'c', 'l', 'e', ' ', 'S', 'o', 's', 'o', '!', 0
END