vmcall / nt-mapper

C++17 PE manualmapper

nt-mapper

PE mapper in c++17

Features

• Relocate image
• Fix import address table
  • Handle api-set
• Export directory parsing (forwarded and normal)
• Two execution modes: 'Thread creation' and 'Thread hijacking'

Thread Hijacker

• Preserves all registers, volatile or not
  • Exception 1: SSE registers
  • Exception 2: AVX registers
• Preserves all flags
• Automatically frees hijack shellcode after execution
• Arbitrary shadow-space for dllmain
• Aligns stack in case of recusant code

To-do

• Static TLS
• TLS callbacks
• Loader entry
• C++ exceptions

Thanks

• DarthTon
• Daax
• JustMagic