2
memory=VirtualAlloc(lpAddress, 3*v48, flAllocationType, 16*v19);

                 .....

shellcode=(int (__stdcall *)(_DWORD, _DWORD))memory;

                 .....

shellcode(&hkernel32, 0)

If function pointer, for each parameter (_DWORD, _DWORD) is

lpAddress = _DWORD = &hkernel32

flAllocationType = _DWORD=0

Is it right?

0

2 Answers 2

1
memory=VirtualAlloc(lpAddress, 3*v48, flAllocationType, 16*v19);

memory will hold the allocated address

(int (__stdcall *)(_DWORD, _DWORD))

prototype of a function that takes two arguments of type DWORD (can be anything ida cannot know it arbitrarily chose DWORD based on size of parameter )

so  this line 

shellcode=(int (__stdcall *)(_DWORD, _DWORD))memory;

means

shellcode = memory

the next call is calling this addresss by trreating this address as a function pointer

so if you single step this line you will land on the allocated address

and execute shell code

it has nothing to do with flwhatever or &hkernel

from the looks of it it is a shell code that takes the base of kernel and tries to scan some thing in the shell code

0

It means that memory is treated as a function pointer, of a function with stdcall calling conventions, that receives 2 arguments and returns int value.

1
  • Thanks and I've one question.
    – hoshia1234
    Commented Aug 27, 2021 at 5:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.