Skip to content

Instantly share code, notes, and snippets.

@mbikovitsky

mbikovitsky/killbutmakeitlooklikeanaccident.bat

Forked from moyix/killbutmakeitlooklikeanaccident.sh
Last active July 31, 2023 17:52
Show Gist options
  • Star 4 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save mbikovitsky/208fd4780c2fa3879101b8fd4b204728 to your computer and use it in GitHub Desktop.
Save mbikovitsky/208fd4780c2fa3879101b8fd4b204728 to your computer and use it in GitHub Desktop.
Download ZIP
Script to inject an exit(0) syscall into a running process. NB: only x86_64 for now!
Raw
killbutmakeitlooklikeanaccident.bat
@"C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\cdb.exe" -sins -y "srv*nul" -c "r rip = ntdll!NtTerminateProcess; r rcx = -1; r rdx = 0; r rsp = (@rsp & 0xFFFFFFFFFFFFFFF0) - 8; eq @rsp (-1); qd" -p %1
Raw
killbutmakeitlooklikeanaccident.sh
#!/bin/bash
gdb -p "$1" -batch -ex 'set {short}$rip = 0x050f' -ex 'set $rax=231' -ex 'set $rdi=0' -ex 'cont'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment