Code

Add x86_64 support#97

Code

Open

cube0x8 wants to merge 21 commits intotaviso:x86_64taviso/loadlibrary:x86_64from cube0x8:x64cube0x8/loadlibrary:x64Copy head branch name to clipboard

+5,533-11,851

Commits

Commits on Feb 15, 2021

• Added "debug" target in Makefile

  Show description for 8bf7233
  cube0x8

  committed
  8bf7233

Commits on Feb 17, 2021

• Added ARCH target flag for the peloader library. Added first test which successfully check a PE (x64) header.

  Show description for 9a2ee40
  cube0x8

  committed
  9a2ee40

Commits on Feb 26, 2021

• Modified test target.

  Show description for 15ad102
  cube0x8

  committed
  15ad102

• a x64 PE is mapped and linked.

  cube0x8

  committed
  de07f73

Commits on Mar 3, 2021

• Created skeleton for x64 APIs loading.

  Show description for 77497a9
  cube0x8

  committed
  77497a9

Commits on Mar 22, 2021

• Removed libdisasm and imported zydis as submodule. libdisasm has been replaced by zydis, so now we've got a x86/x86_64 disassembler. hook.c now uses zydis to patch functions (only x86 for now)

  cube0x8

  committed
  4d8d7b0

Commits on Apr 9, 2021

• Added x86_64 support for libhook and added assembly dispatchers to redirect functions and switch calling convention

  cube0x8

  committed
  bc565fe

Commits on May 9, 2021

• x86_64 WINAPIs are correctly dispatched and mpclient boots up and scan eicar.com successfully

  cube0x8

  committed
  cb17618

Commits on May 11, 2021

• Added x86_64_call_exported_function wrapper to call DLL exports.

  cube0x8

  committed
  56f4b3e

Commits on May 12, 2021

• Fixed bug on stack alignment for x64 dispatchers and added priority for zydis decoder constructor.

  cube0x8

  committed
  844c5fe

Commits on May 14, 2021

• No redzone for mpclient_x64 and peloader. The subhook hooks were pushing addresses on the stack and overwriting some useful value on the redzone. For now, the redzone has been disabled (-mno-red-zo…

  Show description for 97d3bec
  cube0x8

  committed
  97d3bec

Commits on May 23, 2021

• The jmp from the fixup area to the x86_64 dispatcher is made by subhook. We can't rely on a jmp near immediate in this case.

  cube0x8

  committed
  188676c

Commits on May 29, 2021

• Added check on setup_call_to_dispatcher return value. Integrated log.c as logging utility for all the project.

  cube0x8

  committed
  8ecacf9

• It looks like __attribute__((ms_abi)) can spawn deamons, resurrect the dead and make a good coffee (and eventually it changes the calling convention of a function to Windows x86_64 as well...)

  cube0x8

  committed
  020b7a7

• x64 NASM dispatchers are not useful anymore :( re-written the libhook.a which now supports both HOOK_DEFAULT and HOOK_REPLACE_FUNCTION mode.

  cube0x8

  committed
  3a0edb7

Commits on May 30, 2021

• Implemented remove_function_redirect function

  cube0x8

  committed
  5c65a4f

• Added -maccumulate-outgoing-args to compile mpclient_x64, since it also uses WINAPI functions.

  cube0x8

  committed
  c827d74

Commits on Jul 16, 2021

• Added x64 SEH support

  cube0x8

  committed
  9675382

Commits on Jul 19, 2021

• Removed a __debugbreak() in the wrong place and freed FunctionEntry after handler has been executed

  cube0x8

  committed
  04cda3f

Commits on Jul 27, 2021

• both mpclient and mpclient_x64 compile

  cube0x8

  committed
  d4acd2b

Commits on Jul 28, 2021

• Removed NASM dependency

  cube0x8

  committed
  5c344a0