Advertisement
Semper_Idem

Win64_Thunking

Dec 17th, 2020
816
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 3.26 KB | None | 0 0
  1. // Thunking for
  2. #if !_WIN64
  3. #error "Windows x64-only""
  4. #endif
  5. #include <stdio.h>
  6. #include <stdlib.h>
  7. #include <stddef.h>
  8. #include <inttypes.h>
  9.  
  10. #include <windows.h>
  11. #include <memoryapi.h>
  12.  
  13. #if HAS_STACK_ARGUMENTS
  14. typedef int (*c_callback)(int one, int two, int three, int four, int five, int six);
  15.  
  16. int another(void* self, int one, int two, int three, int four, int five, int six) {
  17.     printf("self = %p\n", self);
  18.     printf("one = %d, two = %d, three = %d, four = %d, five = %d, six = %d\n", one, two , three, four, five, six);
  19.     return one + two;
  20. }
  21.  
  22. int function(int one, int two, int three, int four, void* self, const void* const __res, const void *const _dummy, int five, int six) {
  23.     return another(self, one, two, three, four, five, six);
  24. }
  25. void call_callback(c_callback cb) {
  26.  
  27.     int ret = cb(1, 2, 3, 4, 5, 6);
  28.     printf("ret = %d\n", ret);
  29. }
  30.  
  31. #else
  32. typedef int (*c_callback)(int one);
  33. int another(void* self, int one) {
  34.     printf("self = %p\n", self);
  35.     printf("one = %d\n", one);
  36.     return one + 2;
  37. }
  38. int function(int one, int _two, int _three, int _four, void* self, const void* const __res, const void* const _dummy) {
  39.     return another(self, one);
  40. }
  41. void call_callback(c_callback cb) {
  42.     int ret = cb(1);
  43.     printf("ret = %d\n", ret);
  44. }
  45. #endif
  46.  
  47. int main()
  48. {
  49.  
  50.     char* buffer = (char*)VirtualAlloc(NULL, 4096, MEM_COMMIT, PAGE_READWRITE);
  51.     if (!buffer) {
  52.         return -1;
  53.     }
  54.     uint64_t self = 42;
  55.  
  56.     int idx = 0;
  57.  
  58.     memcpy(buffer + idx, &self, 8);
  59.     idx += 8;
  60.  
  61.     void* f_ptr = &function;
  62.     memcpy(buffer + idx, &f_ptr, 8);
  63.     idx += 8;
  64.  
  65.     unsigned char asm_command[] = {
  66.         // _capture_ip:
  67.           0x4C, 0x8D, 0x15, 0xF9, 0xFF, 0xFF, 0xFF, // lea         r10,[_capture_ip + 0FFFFFFF9h]
  68.         // _push_return_address:
  69.           0x4C, 0x8B, 0x1C, 0x24,                   // mov         r11,qword ptr [rsp]
  70.           0x41, 0x53,                               // push        r11
  71.           0x4C, 0x89, 0x5C, 0x24, 0x20,             // mov         qword ptr[rsp + 20h],r11
  72.         // _push_self:
  73.           0x41, 0x53,                               // push        r11
  74.           0x4D, 0x8B, 0x5A, 0xF0,                   // mov         r11,qword ptr[r10 - 10h]
  75.           0x4C, 0x89, 0x5C, 0x24, 0x20,             // mov         qword ptr[rsp + 20h],r11
  76.          // _invoke:
  77.           0x4D, 0x8B, 0x5A, 0xF8,                   // mov         r11,qword ptr[r10 - 8h]
  78.           0x41, 0xFF, 0xD3,                         // call        r11
  79.          // _restore_rsp:
  80.           0x41, 0x5B,                               // pop         r11
  81.           0x41, 0x5B,                               // pop         r11
  82.           0x4C, 0x8B, 0x5C, 0x24, 0x18,             // mov         r11,qword ptr[rsp + 18h]
  83.           0x4C, 0x89, 0x1C, 0x24,                   // mov         qword ptr[rsp],r11
  84.           0xC3                                      // ret
  85.     };
  86.     memcpy(buffer + idx, asm_command, sizeof(asm_command));
  87.     void* cmd_ptr = buffer + idx;
  88.  
  89.     DWORD _old_protect = 0;
  90.     VirtualProtect(buffer, 1, PAGE_EXECUTE_READWRITE, &_old_protect);
  91.  
  92.     c_callback cb = (c_callback)(buffer + idx);
  93.     call_callback(cb);
  94.  
  95.     VirtualFree(buffer, 0, MEM_RELEASE);
  96.    
  97.     printf("Goodbye\n");
  98. }
  99.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement