Skip to content

Instantly share code, notes, and snippets.

@SteelPh0enix
Last active February 5, 2023 20:11
Show Gist options
  • Select an option

  • Save SteelPh0enix/34ced8fb715e81b2e3acee2a67942bd2 to your computer and use it in GitHub Desktop.

Select an option

Save SteelPh0enix/34ced8fb715e81b2e3acee2a67942bd2 to your computer and use it in GitHub Desktop.
// Credits to Vesim987
// - no structures
// - no headers
// - maximum 2 called functions
// - one declared function
// - no defined functions
// - mindfuck
//monster:
#define DWORD unsigned long
int main(int argc, char** argv)
{
DWORD peb = 0;
char *base;
const char *module = "KERNEL32.DLL";
const char *fname1 = "GetStdHandle";
DWORD func1;
const char *fname2 = "WriteConsoleA";
DWORD func2;
DWORD *curr;
DWORD *end;
DWORD i;
int written;
#ifdef __GNUC__
__asm__ __volatile__(
"movl %%fs:0x30, %0"
:"=r"(peb)
);
#else
__asm
{
mov ebx, fs:[0x30]
mov peb, ebx
}
#endif
curr = (DWORD*)(*(DWORD*)((*(DWORD*)(peb + 12)) + 0x4*5));
end = (DWORD*)(*(DWORD*)((*(DWORD*)(peb + 12)) + 0x4*6));
do
{
char temp = 0;
DWORD i = 0;
do
{
temp = ((char*)*(curr + 10))[i*2];
if(temp >= 'a' && temp <= 'z')
temp -= ' ';
if(temp != module[i])
goto next;
if(!module[i])
break;
i++;
}while(temp != 0);
base = *(char**)(curr + 0x4);
break;
next:
curr = (DWORD*)*curr;
}while(end != curr);
if(!base)
return 1;
#define GetProc(_name, _len, _func)\
if(len == _len)\
{\
for(j = 0; j < _len; j++)\
if(name[j] != _name[j])\
goto errf1;\
_func = (DWORD)base + ((DWORD*)(base + *(DWORD*)((*(DWORD*)(base + *((DWORD*) base + 0xF) + 0x78) + base) + 0x1C)))[((short*)(base + *(DWORD*)((*(DWORD*)(base + *((DWORD*) base + 0xF) + 0x78) + base) + 0x24)))[i]];\
}
for(i = 0; i < *(DWORD*)((*(DWORD*)(base + *((DWORD*) base + 0xF) + 0x78) + base) + 0x18); i++)
{
char *name = ((char**)(base + *(DWORD*)((*(DWORD*)(base + *((DWORD*) base + 0xF) + 0x78) + base) + 0x20)))[i] + (DWORD)base;
DWORD len;
DWORD j;
for(len = 0; len < 0xFFFF; len++)
if(name[len] == 0)
break;
GetProc(fname1, 12, func1);
GetProc(fname2, 13, func2);
errf1:
continue;
}
#undef GetProc
((int (__stdcall*)(void*, const void *, int, int*, void*))func2)(((void* (__stdcall*)(int))func1)(-11), "Hello World!", 12, &written, 0);
return 0;
}
@latekvo
Copy link
Copy Markdown

latekvo commented Feb 11, 2021

Its... its beautiful

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment