SymEnumProcesses

Shellcode Loader

Abusing callback to run shellcode.

Overview

Eksekusi shellcode dengan SymEnumProcesses.

BOOL IMAGEAPI SymEnumProcesses (PSYM_ENUMPROCESSES_CALLBACK EnumProcessesCallback, PVOID UserContext);

BOOL IMAGEAPI SymInitialize (HANDLE hProcess, PCSTR UserSearchPath, BOOL fInvadeProcess);

Reference

• MSDN SymEnumProcesses
• MSDN SymInitialize