separate allocate and change memory protection

2026-09-01 19:07:15 +00:00 · 2023-10-11 11:14:14 +02:00 · 2023-10-11 11:14:14 +02:00 · ed791c9b17
commit ed791c9b17
parent 45dbe8792e
6 changed files with 45 additions and 27 deletions
--- a/load-code/shellcode/execute-shellcode-via-copyfile2.yml
+++ b/load-code/shellcode/execute-shellcode-via-copyfile2.yml
@ -11,21 +11,7 @@ rule:
      - c2bb17c12975ea61ff43a71afd9c3ff111d018af161859abae0bdb0b3dae98f9:0x140001010
  features:
    - and:
-      - or:
-        - match: allocate RWX memory
-        - basic block:
-          - and:
-            # xor     ecx, ecx        ; lpAddress
-            # mov     edx, 31Fh       ; dwSize
-            # mov     r8d, 1000h      ; flAllocationType
-            # lea     r9d, [rcx+40h]  ; flProtect
-            # call    cs:VirtualAlloc
-            - match: allocate memory
-            - or:
-              - number: 0x40
-              - instruction:
-                - mnemonic: lea
-                - offset: 0x40
+      - match: allocate or change RWX memory
      - api: CopyFile2
      - api: DeleteFileW
      - number: 0x00000001 = COPY_FILE_FAIL_IF_EXISTS