EnumDirTree

Shellcode Loader

Abusing callback to run shellcode.

Overview

Eksekusi shellcode dengan EnumDirTree.

BOOL IMAGEAPI EnumDirTree (HANDLE hProcess, PCSTR RootPath, PCSTR InputPathName, PSTR OutputPathBuffer, PENUMDIRTREE_CALLBACK cb, PVOID data);

BOOL IMAGEAPI EnumDirTreeW (HANDLE hProcess, PCWSTR RootPath, PCWSTR InputPathName, PWSTR OutputPathBuffer, PENUMDIRTREE_CALLBACKW cb, PVOID data);

BOOL IMAGEAPI SymInitialize (HANDLE hProcess, PCSTR UserSearchPath, BOOL fInvadeProcess);

Reference

• MSDN EnumDirTree
• MSDN EnumDirTreeW
• MSDN SymInitialize