SymFindFileInPath

Shellcode Loader

Abusing callback to run shellcode.

Overview

Eksekusi shellcode dengan SymFindFileInPath.

BOOL IMAGEAPI SymFindFileInPath ( HANDLE hprocess, PCSTR SearchPath, PCSTR FileName, PVOID id, DWORD two, DWORD three, DWORD flags, PSTR FoundFile, PFINDFILEINPATHCALLBACK callback, PVOID context);

BOOL IMAGEAPI SymSrvGetFileIndexInfo (PCSTR File, PSYMSRV_INDEX_INFO Info, DWORD Flags);

Reference

• MSDN SymFindFileInPath
• MSDN SymSrvGetFileIndexInfo