Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

TinyCon Could be smaller (x64 - 496B x86 - 448B) if syscall/shellcode is allowed #6

Copy link
Copy link

Description

@maj113
Issue body actions

This would remove the need to link against anything so no imports, my version looks something like this:

static NtWriteFile_t NtWriteFileSyscall() noexcept {
    __declspec(align(2)) static constexpr unsigned char stub[] = {
        0x4C, 0x8B, 0xD1, // MOV rcx -> R10
        0xB8, 0x08, 0x00, 0x00, 0x00, // MOV 0x08 (syscall identifier) -> EAX
        0x0F, 0x05, // Syscall
        0xC3 // RET
    };
    return (NtWriteFile_t)(void*)stub;
}

inline static void tiny_puts() noexcept {
    IO_STATUS_BLOCK iosb;
    HANDLE h = *(HANDLE*)(
        *(PBYTE*)(__readgsqword(0x60) + 0x20) + 0x28 // needs to be different on x86
        );

    __declspec(align(2)) static constexpr struct {  char data[2]; }  hi_data = { 'h', 'i'}; // "hello" gets it to 512B
    NtWriteFileSyscall()(h, NULL, NULL, NULL, &iosb, (PVOID)hi_data.data, 2, NULL, NULL);
}

 extern "C" void startmain() noexcept {
    tiny_puts();
}

you'd need to merge text with data to make the shellcode array executable

Since i don't use CMAKE myself i do that like this:

#pragma comment(linker, "/MERGE:.pdata=.text")
#pragma comment(linker, "/MERGE:.xdata=.data")
#pragma comment(linker, "/MERGE:.edata=.text")
#pragma comment(linker, "/MERGE:.text=.data")
#pragma comment(linker, "/MERGE:.rdata=.data")
Reactions are currently unavailable

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    Morty Proxy This is a proxified and sanitized view of the page, visit original site.