Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- // Thunking for
- #if !_WIN64
- #error "Windows x64-only""
- #endif
- #include <stdio.h>
- #include <stdlib.h>
- #include <stddef.h>
- #include <inttypes.h>
- #include <windows.h>
- #include <memoryapi.h>
- #if HAS_STACK_ARGUMENTS
- typedef int (*c_callback)(int one, int two, int three, int four, int five, int six);
- int another(void* self, int one, int two, int three, int four, int five, int six) {
- printf("self = %p\n", self);
- printf("one = %d, two = %d, three = %d, four = %d, five = %d, six = %d\n", one, two , three, four, five, six);
- return one + two;
- }
- int function(int one, int two, int three, int four, void* self, const void* const __res, const void *const _dummy, int five, int six) {
- return another(self, one, two, three, four, five, six);
- }
- void call_callback(c_callback cb) {
- int ret = cb(1, 2, 3, 4, 5, 6);
- printf("ret = %d\n", ret);
- }
- #else
- typedef int (*c_callback)(int one);
- int another(void* self, int one) {
- printf("self = %p\n", self);
- printf("one = %d\n", one);
- return one + 2;
- }
- int function(int one, int _two, int _three, int _four, void* self, const void* const __res, const void* const _dummy) {
- return another(self, one);
- }
- void call_callback(c_callback cb) {
- int ret = cb(1);
- printf("ret = %d\n", ret);
- }
- #endif
- int main()
- {
- char* buffer = (char*)VirtualAlloc(NULL, 4096, MEM_COMMIT, PAGE_READWRITE);
- if (!buffer) {
- return -1;
- }
- uint64_t self = 42;
- int idx = 0;
- memcpy(buffer + idx, &self, 8);
- idx += 8;
- void* f_ptr = &function;
- memcpy(buffer + idx, &f_ptr, 8);
- idx += 8;
- unsigned char asm_command[] = {
- // _capture_ip:
- 0x4C, 0x8D, 0x15, 0xF9, 0xFF, 0xFF, 0xFF, // lea r10,[_capture_ip + 0FFFFFFF9h]
- // _push_return_address:
- 0x4C, 0x8B, 0x1C, 0x24, // mov r11,qword ptr [rsp]
- 0x41, 0x53, // push r11
- 0x4C, 0x89, 0x5C, 0x24, 0x20, // mov qword ptr[rsp + 20h],r11
- // _push_self:
- 0x41, 0x53, // push r11
- 0x4D, 0x8B, 0x5A, 0xF0, // mov r11,qword ptr[r10 - 10h]
- 0x4C, 0x89, 0x5C, 0x24, 0x20, // mov qword ptr[rsp + 20h],r11
- // _invoke:
- 0x4D, 0x8B, 0x5A, 0xF8, // mov r11,qword ptr[r10 - 8h]
- 0x41, 0xFF, 0xD3, // call r11
- // _restore_rsp:
- 0x41, 0x5B, // pop r11
- 0x41, 0x5B, // pop r11
- 0x4C, 0x8B, 0x5C, 0x24, 0x18, // mov r11,qword ptr[rsp + 18h]
- 0x4C, 0x89, 0x1C, 0x24, // mov qword ptr[rsp],r11
- 0xC3 // ret
- };
- memcpy(buffer + idx, asm_command, sizeof(asm_command));
- void* cmd_ptr = buffer + idx;
- DWORD _old_protect = 0;
- VirtualProtect(buffer, 1, PAGE_EXECUTE_READWRITE, &_old_protect);
- c_callback cb = (c_callback)(buffer + idx);
- call_callback(cb);
- VirtualFree(buffer, 0, MEM_RELEASE);
- printf("Goodbye\n");
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement