dyncvoke-spoof 0.1.0

Call stack spoofing primitives for Dyncvoke (synthetic and desync)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

use core::ffi::c_void;
use core::ptr;

use data::lc;
use spoof::{spoof_syscall, AsPointer};

fn main() {
    let mut addr: *mut c_void = ptr::null_mut();
    let mut size: usize = 0x1000;

    let alloc = lc!("NtAllocateVirtualMemory");
    let status = spoof_syscall!(
        alloc.as_str(),
        -1isize,
        addr.as_ptr_mut(),
        0usize,
        size.as_ptr_mut(),
        0x3000u32,
        0x04u32
    );

    let code = match status {
        Ok(_) => 0,
        Err(_) => 1,
    };
    std::process::exit(code);
}