myph

~ shellcode loader for your evasion needs
git clone https://github.com/matro7sh/myph.git
asm_x64.s (1145B)
      1 #define maxargs 16
      2 //func runSyscall(callid uint16, argh ...uintptr) (uint32)
      3 TEXT ·runSyscall(SB), $0-56
      4 	XORQ AX,AX
      5 	MOVW callid+0(FP), AX
      6 	PUSHQ CX
      7 
      8 	//put variadic size into CX
      9 	MOVQ argh_len+16(FP),CX
     10 
     11 	//put variadic pointer into SI
     12 	MOVQ argh_base+8(FP),SI
     13 
     14 	// SetLastError(0).
     15 	MOVQ	0x30(GS), DI
     16 	MOVL	$0, 0x68(DI)
     17 	SUBQ	$(maxargs*8), SP	// room for args
     18 
     19 	// Fast version, do not store args on the stack.
     20 	CMPL	CX, $4
     21 	JLE	loadregs
     22 
     23 	// Check we have enough room for args.
     24 	CMPL	CX, $maxargs
     25 	JLE	2(PC)
     26 	INT	$3			// not enough room -> crash
     27 
     28 	// Copy args to the stack.
     29 	MOVQ	SP, DI
     30 	CLD
     31 	REP; MOVSQ
     32 	MOVQ	SP, SI
     33 
     34 loadregs:
     35 	SUBQ	$8, SP
     36 
     37 	// Load first 4 args into correspondent registers.
     38 	MOVQ	0(SI), CX
     39 	MOVQ	8(SI), DX
     40 	MOVQ	16(SI), R8
     41 	MOVQ	24(SI), R9
     42 
     43 	// Floating point arguments are passed in the XMM
     44 	// registers. Set them here in case any of the arguments
     45 	// are floating point values. For details see
     46 	//	https://msdn.microsoft.com/en-us/library/zthk2dkh.aspx
     47 
     48 	MOVQ	CX, X0
     49 	MOVQ	DX, X1
     50 	MOVQ	R8, X2
     51 	MOVQ	R9, X3
     52 	MOVQ CX, R10
     53 	SYSCALL
     54 	ADDQ	$((maxargs+1)*8), SP
     55 
     56 	// Return result.
     57 	POPQ	CX
     58 	MOVL	AX, errcode+32(FP)
     59 	RET