dinvoke 0.2.2

Dynamically run arbitrary unmanaged code.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136

.data

CONFIG STRUCT

    JumpAddress                     DQ 1
    ReturnAddress                   DQ 1
    Nargs                           DQ 1
    Arg01                           DQ 1
    Arg02                           DQ 1
    Arg03                           DQ 1
    Arg04                           DQ 1
    Arg05                           DQ 1
    Arg06                           DQ 1
    Arg07                           DQ 1
    Arg08                           DQ 1
    Arg09                           DQ 1
    Arg10                           DQ 1
    Arg11                           DQ 1
    SysId                           DD 0

CONFIG ENDS

.code

run_indirect_syscall proc

    mov		[rsp+08h], rbp
	mov		[rsp+10h], rbx
	mov		rbp, rsp
    add     rsp, 58h
    push    [rcx].CONFIG.ReturnAddress

	cmp		[rcx].CONFIG.Nargs, 11
	je		handle_eleven
	cmp		[rcx].CONFIG.Nargs, 10
	je		handle_ten
	cmp		[rcx].CONFIG.Nargs, 9
	je		handle_nine
	cmp		[rcx].CONFIG.Nargs, 8
	je		handle_eight
	cmp		[rcx].CONFIG.Nargs, 7
	je		handle_seven
	cmp		[rcx].CONFIG.Nargs, 6
	je		handle_six
	cmp		[rcx].CONFIG.Nargs, 5
	je		handle_five
	cmp		[rcx].CONFIG.Nargs, 4
	je		handle_four
	cmp		[rcx].CONFIG.Nargs, 3
	je		handle_three
	cmp		[rcx].CONFIG.Nargs, 2
	je		handle_two
	cmp		[rcx].CONFIG.Nargs, 1
	je		execute_syscall
	cmp		[rcx].CONFIG.Nargs, 0
	je		execute_syscall
run_indirect_syscall endp

restore proc
	mov		rsp, rbp
	mov		rbp, [rsp+08h]
	mov		rbx, [rsp+10h]
	ret
restore endp

handle_eleven proc
	push	r15
	mov		r15, [rcx].CONFIG.Arg11
	mov		[rsp+60h], r15
	pop		r15
	jmp		handle_ten
handle_eleven endp
handle_ten proc
	push	r15
	mov		r15, [rcx].CONFIG.Arg10
	mov		[rsp+58h], r15
	pop		r15
	jmp		handle_nine
handle_ten endp
handle_nine proc
	push	r15
	mov		r15, [rcx].CONFIG.Arg09
	mov		[rsp+50h], r15
	pop		r15
	jmp		handle_eight
handle_nine endp
handle_eight proc
	push	r15
	mov		r15, [rcx].CONFIG.Arg08
	mov		[rsp+48h], r15
	pop		r15
	jmp		handle_seven
handle_eight endp
handle_seven proc
	push	r15
	mov		r15, [rcx].CONFIG.Arg07
	mov		[rsp+40h], r15
	pop		r15
	jmp		handle_six
handle_seven endp
handle_six proc
	push	r15
	mov		r15, [rcx].CONFIG.Arg06
	mov		[rsp+38h], r15
	pop		r15
	jmp		handle_five
handle_six endp
handle_five proc
	push	r15
	mov		r15, [rcx].CONFIG.Arg05
	mov		[rsp+30h], r15
	pop		r15
	jmp		handle_four
handle_five endp
handle_four proc
	mov		r9, [rcx].CONFIG.Arg04
	jmp		handle_three
handle_four endp
handle_three proc
	mov		r8, [rcx].CONFIG.Arg03
	jmp		handle_two
handle_three endp
handle_two proc
	mov		rdx, [rcx].CONFIG.Arg02
	jmp		execute_syscall
handle_two endp

execute_syscall proc
	mov 	r10, [rcx].CONFIG.Arg01
    mov		r11, [rcx].CONFIG.JumpAddress
	mov 	eax, [rcx].CONFIG.SysId
	mov 	rcx, [rcx].CONFIG.Arg01
	jmp 	qword ptr r11
execute_syscall endp

end