From a16f4cd84db35227067a1c05ff975f145c17999a Mon Sep 17 00:00:00 2001 From: Dima van de Wouw Date: Wed, 14 Dec 2022 16:49:27 +0100 Subject: [PATCH] fix swapped arguments Signed-off-by: Dima van de Wouw --- Python/ShellcodeRDI.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Python/ShellcodeRDI.py b/Python/ShellcodeRDI.py index 5eefe6b..2fc381c 100644 --- a/Python/ShellcodeRDI.py +++ b/Python/ShellcodeRDI.py @@ -106,17 +106,17 @@ def ConvertToShellcode(dllBytes, functionHash=0x10, userData=b'None', flags=0): bootstrap += b'\x48\x83\xec' bootstrap += b'\x30' # 32 bytes for shadow space + 16 bytes for last args - # mov qword ptr [rsp + 0x28], rcx (shellcode base) - Push in arg 5 + # mov qword ptr [rsp + 0x20], rcx (shellcode base) - Push in arg 5 bootstrap += b'\x48\x89\x4C\x24' - bootstrap += b'\x28' + bootstrap += b'\x20' # add rcx, bootstrap += b'\x48\x81\xc1' bootstrap += pack('I', dllOffset) - # mov dword ptr [rsp + 0x20], - Push in arg 6 just above shadow space + # mov dword ptr [rsp + 0x28], - Push in arg 6 just above shadow space bootstrap += b'\xC7\x44\x24' - bootstrap += b'\x20' + bootstrap += b'\x28' bootstrap += pack('I', flags) # call - Transfer execution to the RDI