Code:
// intrinsics.h
#ifndef __INTRINSICS_H__
#define __INTRINSICS_H__
#ifdef __cplusplus
extern "C" {
#endif
static __inline__ __attribute__((always_inline)) void __asm_push(const void *d) {
#ifdef _M_AMD64
__asm__ __volatile__("pushq %0\n" : : "rim"(d));
#else
__asm__ __volatile__("push %0\n" : : "rim"(d));
#endif
}
static __inline__ __attribute__((always_inline)) unsigned long long __asm_call(const unsigned long long f) {
unsigned long long rv;
__asm__ __volatile__("call *%0\n" : "=r"(rv) : "0"(f));
return rv;
}
#if defined(_M_AMD64)
static __inline__ __attribute__((always_inline)) void __asm_writetorcx(const void *r) {
__asm__ __volatile__("movq %q[r], %%rcx\t\n": : [r]"g"(r):"memory","%rcx");
}
static __inline__ __attribute__((always_inline)) void __asm_writetordx(const void *r) {
__asm__ __volatile__("movq %q[r], %%rdx\n": : [r]"g"(r):"memory","%rdx");
}
static __inline__ __attribute__((always_inline)) void __asm_writetor8(const void *r) {
__asm__ __volatile__("movq %q[r], %%r8\n": : [r]"g"(r):"memory","%r8");
}
static __inline__ __attribute__((always_inline)) void __asm_writetor9(const void *r) {
__asm__ __volatile__("movq %q[r], %%r9\n": : [r]"g"(r):"memory","%r9");
}
/*** Taken from intrin.h ***/
static __inline__ __attribute__((always_inline)) unsigned __int64 __readgsqword(const unsigned long Offset)
{
unsigned __int64 value;
__asm__ __volatile__("movq %%gs:%a[Offset], %q[value]" : [value] "=q" (value) : [Offset] "irm" (Offset));
return value;
}
#else
static __inline__ __attribute__((always_inline)) unsigned long __readfsdword(const unsigned long Offset)
{
unsigned long value;
__asm__ __volatile__("movl %%fs:%a[Offset], %k[value]" : [value] "=q" (value) : [Offset] "irm" (Offset));
return value;
}
#endif //_M_AMD64
#ifdef __cplusplus
}
#endif
#endif // __INTRINSICS_H__test.c
PTEB getCurrentTeb() {
#if defined(_WIN64)
return (PPEB)__readgsqword(0x30);
#else
return (PTEB)__readfsdword(0x18);
#endif // defined
}
PPEB getCurrentPeb() {
PTEB teb;
if((teb=(PTEB)getCurrentTeb())==0)
return 0;
return (PPEB)teb->ProcessEnvironmentBlock;
}
static unsigned long long xcall(unsigned long long f, int c, ...) {
va_list xstack;
va_start(xstack, c);
int i=0;
unsigned long long fnc={0};
#if defined(_WIN64)
if(c<=0);
else {
//printf("Arguments count: %i working\n",c);
void *w = { (c > 0) ? c--, va_arg(xstack, void *) : 0 };
void *x = { (c > 0) ? c--, va_arg(xstack, void *) : 0 };
void *y = { (c > 0) ? c--, va_arg(xstack, void *) : 0 };
void *z = { (c > 0) ? c--, va_arg(xstack, void *) : 0 };
__asm_writetorcx(w);
__asm_writetordx(x);
__asm_writetor8(y);
__asm_writetor9(z);
if(c>0)
for(i=0;i<c;i++)
__asm_push(va_arg(xstack, void *));
}
#else
for(i=0;i<c;i++)
__asm_push(va_arg(xstack, void *));
#endif
fnc = __asm_call(f);
va_end(xstack);
return fnc;
}
// main.c
int main(int argc, char *argv[])
{
void *lpMsgBuff;
LPCSTR lib="user32.dll";
LPCSTR fn="MessageBoxA";
char l2[]="ws2_32.dll";
printf("Current TEB: 0x%lX\n", (unsigned long)getCurrentTeb());
printf("Current PEB: 0x%lX\n", (unsigned long)getCurrentPeb());
unsigned long long h=(unsigned long)GetProcAddress(
(HANDLE)LoadLibrary(lib),fn);
printf("Current %s Address: 0x%lX\n",fn , (unsigned long)h);
unsigned long long r=xcall(h,4, NULL, (void *)&l2,(void *)&l2, MB_OK);
if(r<=0) {
DWORD err=GetLastError();
printf("xcall returned 0, checking GetLastError()\n");
printf("Error code is: 0x%lX\n",GetLastError());
FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER |
FORMAT_MESSAGE_FROM_SYSTEM |
FORMAT_MESSAGE_IGNORE_INSERTS,
0,
err,
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
(LPTSTR)&lpMsgBuff,
0,0);
printf("Returned error Message: %s\n",(char *)lpMsgBuff);
system("pause");
return 0;
}
printf("%s address : 0x%lX\n", l2,(unsigned long)r);
printf("\n\n");
system("pause");
return 0;
}