Created
January 10, 2019 23:26
Revisions
-
DvdGiessen created this gist
Jan 10, 2019 .There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode charactersOriginal file line number Diff line number Diff line change @@ -0,0 +1,64 @@ extrn GetStartupInfoW: PROC extrn CreateProcessW: PROC extrn ExitProcess: PROC .data target word 2eh, 2eh, 5ch, 42h, 61h, 73h, 65h, 5ch, 42h, 69h, 6eh, 61h, 72h word 69h, 65h, 73h, 5ch, 57h, 69h, 6eh, 36h, 34h, 53h, 74h, 65h, 61h word 6dh, 5ch, 43h, 69h, 76h, 69h, 6ch, 69h, 7ah, 61h, 74h, 69h, 6fh word 6eh, 56h, 49h, 5fh, 44h, 58h, 31h, 32h, 2eh, 65h, 78h, 65h, 0 ; ..\Base\Binaries\Win64Steam\CivilizationVI_DX12.exe as UTF-16 .code main proc frame local startupInfo [104] :byte local processInfo [24] :byte ; set up stack base push rbp .pushreg rbp mov rbp, rsp .setframe rbp, 0 ; reserve space on stack for structs + last 6 CreateProcessW arguments + shadow space sub rsp, 32 + 104 + 24 + 6 * 8 + 32 .allocstack 32 + 104 + 24 + 6 * 8 + 32 .endprolog ; get startupInfo for this process lea rcx, startupInfo call GetStartupInfoW ; write arguments for CreateProcessW to reserved space on stack lea rax, processInfo mov qword ptr [rsp + 72], rax ; lpProcessInformation lea rax, startupInfo mov qword ptr [rsp + 64], rax ; lpStartupInfo mov qword ptr [rsp + 56], 0 ; lpCurrentDirectory = NULL mov qword ptr [rsp + 48], 0 ; lpEnvironment = NULL mov qword ptr [rsp + 40], 0 ; dwCreationFlags = 0 mov qword ptr [rsp + 32], 0 ; bInheritHandles = NULL ; first 4 arguments are passed via registers mov r9, 0 ; lpThreadAttributes = NULL mov r8, 0 ; lpProcessAttributes = NULL mov rdx, 0 ; lpCommandLine = NULL lea rcx, target ; lpApplicationName = target ; run target process using CreateProcessW call CreateProcessW ; exit this process mov rcx, rax ; uExitCode = returncode of CreateProcessW call ExitProcess ; explicitly exit, see https://stackoverflow.com/a/39907035 ; never reached, but if you want to know: this is how we'd properly restore the stack add rsp, 32 + 104 + 24 + 6 * 8 + 32 pop rbp ret 0 align 4 main endp end