bitstream93/shellcode-test-harnessA lightweight test harness designed to speed up shellcode development by providing an execution environment with integrated crash diagnostics and debug output redirection.
A lightweight test harness designed to speed up shellcode development by providing an execution environment with integrated crash diagnostics and debug output redirection.
g++ -o loader.exe loader.cc -ladvapi32 -luser32 -lkernel32 -static
# Execute a payload using the default host DLL
loader.exe --bin payload.bin
# Execute a payload by stomping a specific DLL
loader.exe --bin payload.bin --dll mscoree.dll
# Scan for all compatible DLLs
loader.exe --scan
# Scan for DLLs with a .text section large enough for a specific payload
loader.exe --scan --bin payload.bin
#if defined(DEBUG)
#define PDEBUG(format, ...) \
{ \
ntdll.DbgPrint(symbol<PCH>("%-48s " format), symbol<PCH>(({ \
char __buf[48]; \
memory::snprintf(__buf, sizeof(__buf), "[%s:%d]", \
__FUNCTION__, __LINE__); \
__buf; \
})), \
##__VA_ARGS__); \
}
#define PDEBUG_CTX(ctx, format, ...) \
{ \
if ((ctx) && (ctx)->ntdll.DbgPrint) { \
(ctx)->ntdll.DbgPrint(symbol<PCH>("%-48s " format), symbol<PCH>(({ \
char __buf[48]; \
memory::snprintf(__buf, sizeof(__buf), "[%s:%d]",\
__FUNCTION__, __LINE__); \
__buf; \
})), \
##__VA_ARGS__); \
} \
}
#else
#define PDEBUG(format, ...) \
{ \
; \
}
#define PDEBUG_CTX(ctx, format, ...) \
{ \
; \
}
#endif
PSYSCALL_TABLE pTable = NULL;
SIZE_T regionSize = sizeof(SYSCALL_TABLE);
ntdll.NtAllocateVirtualMemory(
(HANDLE)-1,
(PVOID*)&pTable,
0,
®ionSize,
MEM_COMMIT | MEM_RESERVE,
PAGE_READWRITE
);
if (pTable) {
pTable->NtTerminateProcess = 0x2c; // Example syscall number
PDEBUG("HEXDUMP:%p:%zu", pTable, sizeof(SYSCALL_TABLE));
}
