API tools faq
paste
wbenny

gc.asm

wbenny
Feb 1st, 2019
709
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
ASM (NASM) 1.59 KB | None | 0 0
raw download clone embed print report
  1. ;++
  2. ;
  3. ; Module Name:
  4. ;
  5. ;   cs.asm
  6. ;
  7. ;--
  8.  
  9. .CODE
  10.  
  11. ;++
  12. ;
  13. ; PVOID
  14. ; MwGenericCall(
  15. ;   _In_ ULONG SyscallNumber,
  16. ;   _In_ ULONG ArgumentCount,
  17. ;   _In_ va_list ArgumentList
  18. ;   )
  19. ;
  20. ;--
  21.  
  22.     MwGenericCall PROC PUBLIC
  23.  
  24.         ;
  25.         ; Save r12 to the shadow space.
  26.         ; This register will be held as a temporary
  27.         ; stack pointer for the syscall.
  28.         ;
  29.  
  30.         mov     qword ptr [rsp + 8], r12
  31.  
  32.         ;
  33.         ; eax = SyscallNumber
  34.         ; r10 = ArgumentCount
  35.         ; r11 = ArgumentList
  36.         ; r12 = ArgumentList - sizeof(PVOID)
  37.         ;       (space for return address)
  38.         ;
  39.  
  40.         mov     eax,  ecx
  41.         mov     r10d, edx
  42.         mov     r11,  r8
  43.         lea     r12,  qword ptr [r11 - 8]
  44.  
  45.  
  46.         ;
  47.         ; Assign first 4 arguments (rcx, rdx, r8, r9)
  48.         ; from the ArgumentList.
  49.         ;
  50.  
  51.         cmp     r10d, 1
  52.         cmovae  rcx, qword ptr [r11 +  0]
  53.  
  54.         cmp     r10d, 2
  55.         cmovae  rdx, qword ptr [r11 +  8]
  56.  
  57.         cmp     r10d, 3
  58.         cmovae  r8,  qword ptr [r11 + 16]
  59.  
  60.         cmp     r10d, 4
  61.         cmovae  r9,  qword ptr [r11 + 24]
  62.  
  63.         ;
  64.         ; The syscall handler expects the first
  65.         ; parameter in the r10 register.
  66.         ;
  67.  
  68.         mov     r10, rcx
  69.  
  70.         ;
  71.         ; Stack pivot, syscall, restore stack.
  72.         ;
  73.  
  74.         xchg    r12, rsp
  75.         syscall
  76.         xchg    r12, rsp
  77.  
  78.         ;
  79.         ; Restore r12 register from the shadow space.
  80.         ;
  81.  
  82.         mov     r12, qword ptr [rsp + 8]
  83.  
  84.         ret
  85.  
  86.     MwGenericCall ENDP
  87.  
  88.  
  89. END
Advertisement
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!