This would remove the need to link against anything so no imports, my version looks something like this:
static NtWriteFile_t NtWriteFileSyscall () noexcept {
__declspec (align (2 )) static constexpr unsigned char stub[] = {
0x4C , 0x8B , 0xD1 , // MOV rcx -> R10
0xB8 , 0x08 , 0x00 , 0x00 , 0x00 , // MOV 0x08 (syscall identifier) -> EAX
0x0F , 0x05 , // Syscall
0xC3 // RET
};
return (NtWriteFile_t)(void *)stub;
}
inline static void tiny_puts () noexcept {
IO_STATUS_BLOCK iosb;
HANDLE h = *(HANDLE *)(
*(PBYTE *)(__readgsqword (0x60 ) + 0x20 ) + 0x28 // needs to be different on x86
);
__declspec (align (2 )) static constexpr struct { char data[2 ]; } hi_data = { ' h' , ' i' }; // "hello" gets it to 512B
NtWriteFileSyscall ()(h, NULL , NULL , NULL , &iosb, (PVOID )hi_data.data , 2 , NULL , NULL );
}
extern " C" void startmain () noexcept {
tiny_puts ();
}
you'd need to merge text with data to make the shellcode array executable
Since i don't use CMAKE myself i do that like this:
#pragma comment(linker, "/MERGE:.pdata=.text")
#pragma comment(linker, "/MERGE:.xdata=.data")
#pragma comment(linker, "/MERGE:.edata=.text")
#pragma comment(linker, "/MERGE:.text=.data")
#pragma comment(linker, "/MERGE:.rdata=.data") Reactions are currently unavailable
This would remove the need to link against anything so no imports, my version looks something like this:
you'd need to merge text with data to make the shellcode array executable
Since i don't use CMAKE myself i do that like this: