Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- // push ebp
- ret.push_back(0x55);
- // mov ebp, esp
- ret.push_back(0x8B); ret.push_back(0xEC);
- // push imm8
- ret.push_back(0x6A);
- // lpReserved
- ret.push_back(0);
- // push imm8
- ret.push_back(0x6A);
- // dwReason
- ret.push_back(1);
- // push imm32
- ret.push_back(0x68);
- // hInstance
- ret.insert(ret.end(), (BYTE*)&mBaseOfDll, ((BYTE*)&mBaseOfDll) + 4);
- // call far ptr
- ret.push_back(0x9A);
- // dllEntryPoint
- ret.insert(ret.end(), (BYTE*)&dwEntryPoint, ((BYTE*)&dwEntryPoint) + 4);
- // mov esp, ebp
- ret.push_back(0x8B); ret.push_back(0xE5);
- // pop ebp
- ret.push_back(0x5D);
- // retn 4
- ret.push_back(0xC2); ret.push_back(4); ret.push_back(0);
Advertisement
Add Comment
Please, Sign In to add comment