Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save mbikovitsky/208fd4780c2fa3879101b8fd4b204728 to your computer and use it in GitHub Desktop.
Save mbikovitsky/208fd4780c2fa3879101b8fd4b204728 to your computer and use it in GitHub Desktop.
Script to inject an exit(0) syscall into a running process. NB: only x86_64 for now!
@"C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\cdb.exe" -sins -y "srv*nul" -c "r rip = ntdll!NtTerminateProcess; r rcx = -1; r rdx = 0; r rsp = (@rsp & 0xFFFFFFFFFFFFFFF0) - 8; eq @rsp (-1); qd" -p %1
#!/bin/bash
gdb -p "$1" -batch -ex 'set {short}$rip = 0x050f' -ex 'set $rax=231' -ex 'set $rdi=0' -ex 'cont'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment