Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- static
- STATUS
- _ThreadSetupMainThreadUserStack(
- IN PVOID InitialStack,
- OUT PVOID* ResultingStack,
- IN PPROCESS Process
- )
- {
- ASSERT(InitialStack != NULL);
- ASSERT(ResultingStack != NULL);
- ASSERT(Process != NULL);
- PVOID pStack = NULL;
- LOG("GETS HERE 1 \n");
- PVOID topStack = (PVOID)PtrDiff(InitialStack, 0x308);
- MmuGetSystemVirtualAddressForUserBuffer(topStack,50*sizeof(QWORD), PAGE_RIGHTS_READWRITE,Process,&pStack);
- LOG("GETS HERE 2 \n");
- char* cmdLine = Process->FullCommandLine;
- QWORD argc = Process->NumberOfArguments;
- LOG("Argc = %d \n", argc);
- LOG("Argv = %s \n", cmdLine);
- PVOID argAddresses[30];
- char *argValues[30];
- char* currentArg;
- char* context;
- currentArg = NULL;
- context = NULL;
- int i = 0;
- LOG("GETS HERE 4 \n");
- #pragma warning(suppress:4127)
- while (TRUE){
- currentArg = (char*)strtok_s(cmdLine, " ", &context);
- if (currentArg == NULL) {
- break;
- }
- int sizeOfArg = strlen(currentArg) + 1;
- LOG("Arg = %s with size %d \n", currentArg, sizeOfArg);
- pStack = (PVOID)PtrDiff(pStack, sizeof(char)*sizeOfArg);
- topStack = (PVOID)PtrDiff(topStack, sizeof(char)*sizeOfArg);
- strcpy(pStack, currentArg);
- //PVOID argAddress = pStack;
- PVOID argAddress = topStack;
- argAddresses[i] = argAddress;
- argValues[i] = currentArg;
- i++;
- }
- LOG("DONE WRITING STRINGS \n");
- PVOID argvAddress;
- for (int j = i-1; j >= 0; j--) {
- LOG("Processing arg = %s at address 0x%X \n", argValues[j], argAddresses[j]);
- pStack = (PVOID)PtrDiff(pStack, sizeof(QWORD));
- topStack = (PVOID)PtrDiff(topStack, sizeof(QWORD));
- memcpy(pStack, &argAddresses[j], sizeof(QWORD));
- if (j == 0) {
- argvAddress = topStack;
- }
- }
- LOG(" END OF WHILE \n");
- //allign stack
- pStack = (PVOID)PtrDiff(AlignAddressUpper(pStack, 0x10), 0x08);
- topStack = (PVOID)PtrDiff(AlignAddressUpper(topStack, 0x10), 0x08);
- //shadow space ?
- pStack = (PVOID)PtrDiff(pStack, 2*sizeof(QWORD));
- topStack = (PVOID)PtrDiff(topStack, 2 * sizeof(QWORD));
- LOG("argvAddress is 0x%X \n", argvAddress);
- ////argv & argc
- pStack = (PVOID)PtrDiff(pStack, sizeof(QWORD));
- topStack = (PVOID)PtrDiff(topStack, sizeof(QWORD));
- memcpy(pStack, &argvAddress, sizeof(QWORD));
- LOG("Done with argv \n");
- pStack = (PVOID)PtrDiff(pStack, sizeof(QWORD));
- topStack = (PVOID)PtrDiff(topStack, sizeof(QWORD));
- memcpy(pStack, &argc, sizeof(QWORD));
- LOG("Done with argc \n");
- ////last one
- pStack = (PVOID)PtrDiff(pStack, sizeof(QWORD));
- topStack = (PVOID)PtrDiff(topStack, sizeof(QWORD));
- MmuFreeSystemVirtualAddressForUserBuffer(pStack);
- *ResultingStack = topStack;
- LOG("END \n");
- return STATUS_SUCCESS;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement