Skip to content

Instantly share code, notes, and snippets.

@SteelPh0enix
Last active February 5, 2023 20:11
Show Gist options
  • Save SteelPh0enix/34ced8fb715e81b2e3acee2a67942bd2 to your computer and use it in GitHub Desktop.
Save SteelPh0enix/34ced8fb715e81b2e3acee2a67942bd2 to your computer and use it in GitHub Desktop.
// Credits to Vesim987
// - no structures
// - no headers
// - maximum 2 called functions
// - one declared function
// - no defined functions
// - mindfuck
//monster:
#define DWORD unsigned long
int main(int argc, char** argv)
{
DWORD peb = 0;
char *base;
const char *module = "KERNEL32.DLL";
const char *fname1 = "GetStdHandle";
DWORD func1;
const char *fname2 = "WriteConsoleA";
DWORD func2;
DWORD *curr;
DWORD *end;
DWORD i;
int written;
#ifdef __GNUC__
__asm__ __volatile__(
"movl %%fs:0x30, %0"
:"=r"(peb)
);
#else
__asm
{
mov ebx, fs:[0x30]
mov peb, ebx
}
#endif
curr = (DWORD*)(*(DWORD*)((*(DWORD*)(peb + 12)) + 0x4*5));
end = (DWORD*)(*(DWORD*)((*(DWORD*)(peb + 12)) + 0x4*6));
do
{
char temp = 0;
DWORD i = 0;
do
{
temp = ((char*)*(curr + 10))[i*2];
if(temp >= 'a' && temp <= 'z')
temp -= ' ';
if(temp != module[i])
goto next;
if(!module[i])
break;
i++;
}while(temp != 0);
base = *(char**)(curr + 0x4);
break;
next:
curr = (DWORD*)*curr;
}while(end != curr);
if(!base)
return 1;
#define GetProc(_name, _len, _func)\
if(len == _len)\
{\
for(j = 0; j < _len; j++)\
if(name[j] != _name[j])\
goto errf1;\
_func = (DWORD)base + ((DWORD*)(base + *(DWORD*)((*(DWORD*)(base + *((DWORD*) base + 0xF) + 0x78) + base) + 0x1C)))[((short*)(base + *(DWORD*)((*(DWORD*)(base + *((DWORD*) base + 0xF) + 0x78) + base) + 0x24)))[i]];\
}
for(i = 0; i < *(DWORD*)((*(DWORD*)(base + *((DWORD*) base + 0xF) + 0x78) + base) + 0x18); i++)
{
char *name = ((char**)(base + *(DWORD*)((*(DWORD*)(base + *((DWORD*) base + 0xF) + 0x78) + base) + 0x20)))[i] + (DWORD)base;
DWORD len;
DWORD j;
for(len = 0; len < 0xFFFF; len++)
if(name[len] == 0)
break;
GetProc(fname1, 12, func1);
GetProc(fname2, 13, func2);
errf1:
continue;
}
#undef GetProc
((int (__stdcall*)(void*, const void *, int, int*, void*))func2)(((void* (__stdcall*)(int))func1)(-11), "Hello World!", 12, &written, 0);
return 0;
}
@latekvo
Copy link

latekvo commented Feb 11, 2021

Its... its beautiful

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment