Skip to content

Instantly share code, notes, and snippets.

@3ts75

3ts75/ZwAllocateVirtualMemory_memcpy.cpp Secret

Last active May 12, 2021 02:16
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save 3ts75/fc3d41af5b58a8b0f7bb231292f8f851 to your computer and use it in GitHub Desktop.
Save 3ts75/fc3d41af5b58a8b0f7bb231292f8f851 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
ZwAllocateVirtualMemory_memcpy.cpp
#include <stdio.h>
#include <Windows.h>
#include <iostream>
using namespace std;
using _ZwAllocateVirtualMemory = NTSTATUS(NTAPI*)(
_In_ HANDLE ProcessHandle,
_Inout_ PVOID* BaseAddress,
_In_ ULONG_PTR ZeroBits,
_Inout_ PSIZE_T RegionSize,
_In_ ULONG AllocationType,
_In_ ULONG Protect
);
int main() {
_ZwAllocateVirtualMemory ZwAllocateVirtualMemory = (_ZwAllocateVirtualMemory)GetProcAddress(GetModuleHandleA("ntdll.dll"), "ZwAllocateVirtualMemory");
PBYTE pbShellcode = (PBYTE)"test";
SIZE_T ShellSize = sizeof(&pbShellcode);
PVOID BaseAddress = NULL;
ZwAllocateVirtualMemory(
GetCurrentProcess(),
&BaseAddress,
0xFFFFFFF,
&ShellSize,
MEM_COMMIT,
PAGE_EXECUTE_READWRITE
);
memcpy(BaseAddress, pbShellcode, ShellSize);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment