Adjust for x64 shellcode

[vivami]

I'm trying to get this to work for x64 shellcode. The gadget pop r64; ret has the same opcodes as pop r32; ret (afaik, could be mistaken). However, if I add x64 calc shellcode and compile it for x64, it doesn't seem to work. Any idea why, or what else needs to be adjusted?

Thanks :)

[Nero22k]

I got it to work by using pop rax; ret.

static BOOL gadget_match_valid(PBYTE pbAddress)
{
    return *pbAddress == 0x58 && *(pbAddress +1) == 0xC3;
}

That's the only thing I changed.

[vivami]

Awesome, that worked. Thanks!

[LloydLabs]

Hi both, I'll add x64 support to the main branch tomorrow. This is definitely an issue; so I'll keep it open for now until the changes are made.

[BlackHandK]

The test of local 64-bit injection was successful. However, if notepad is injected remotely, If this also call using random gadget address NtQueueApcThreadEx (threadhandle, null, randomgadget shellcodestart, null, null) function can be a successful call, but cannot perform shellcode, As long as this parameter is not used, normal calls to NtQueueApcThreadEx or NtQueueApcThread can both be successful. Shouldn't the function GadgetFindRandPopRet be universal whether it is local or remote? Shouldn't the base addresses of key DLLS, such as ntdll and kernel32dll, be the same in other processes? Where on earth is the reason for this
Thanks :)