{"action":"created","issue":{"url":"https://api.github.com/repos/secretsquirrel/the-backdoor-factory/issues/49","labels_url":"https://api.github.com/repos/secretsquirrel/the-backdoor-factory/issues/49/labels{/name}","comments_url":"https://api.github.com/repos/secretsquirrel/the-backdoor-factory/issues/49/comments","events_url":"https://api.github.com/repos/secretsquirrel/the-backdoor-factory/issues/49/events","html_url":"https://github.com/secretsquirrel/the-backdoor-factory/issues/49","id":91494389,"number":49,"title":"Off Entry Point Patching (PE)","user":{"login":"secretsquirrel","id":1679850,"avatar_url":"https://avatars.githubusercontent.com/u/1679850?v=3","gravatar_id":"","url":"https://api.github.com/users/secretsquirrel","html_url":"https://github.com/secretsquirrel","followers_url":"https://api.github.com/users/secretsquirrel/followers","following_url":"https://api.github.com/users/secretsquirrel/following{/other_user}","gists_url":"https://api.github.com/users/secretsquirrel/gists{/gist_id}","starred_url":"https://api.github.com/users/secretsquirrel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/secretsquirrel/subscriptions","organizations_url":"https://api.github.com/users/secretsquirrel/orgs","repos_url":"https://api.github.com/users/secretsquirrel/repos","events_url":"https://api.github.com/users/secretsquirrel/events{/privacy}","received_events_url":"https://api.github.com/users/secretsquirrel/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/secretsquirrel/the-backdoor-factory/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-06-27T17:34:08Z","updated_at":"2015-07-05T02:50:25Z","closed_at":null,"body":"Because it's not that hard.  No reason to execute a binary in memory (like other tools) to patch at random spots in the in binary."},"comment":{"url":"https://api.github.com/repos/secretsquirrel/the-backdoor-factory/issues/comments/118572255","html_url":"https://github.com/secretsquirrel/the-backdoor-factory/issues/49#issuecomment-118572255","issue_url":"https://api.github.com/repos/secretsquirrel/the-backdoor-factory/issues/49","id":118572255,"user":{"login":"secretsquirrel","id":1679850,"avatar_url":"https://avatars.githubusercontent.com/u/1679850?v=3","gravatar_id":"","url":"https://api.github.com/users/secretsquirrel","html_url":"https://github.com/secretsquirrel","followers_url":"https://api.github.com/users/secretsquirrel/followers","following_url":"https://api.github.com/users/secretsquirrel/following{/other_user}","gists_url":"https://api.github.com/users/secretsquirrel/gists{/gist_id}","starred_url":"https://api.github.com/users/secretsquirrel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/secretsquirrel/subscriptions","organizations_url":"https://api.github.com/users/secretsquirrel/orgs","repos_url":"https://api.github.com/users/secretsquirrel/repos","events_url":"https://api.github.com/users/secretsquirrel/events{/privacy}","received_events_url":"https://api.github.com/users/secretsquirrel/received_events","type":"User","site_admin":false},"created_at":"2015-07-05T02:50:25Z","updated_at":"2015-07-05T02:50:25Z","body":"New resume execution stubs will need to be completely position independent. Make for x86/x64 payloads.\r\n\r\nUse the following method to find ASLR offset: PEB imagebase - expected imagebase (then correct for signed-ness):\r\n\r\n```\r\n\"\\x31\\xd2\"             # xor edx, edx                           ;prep edx for use\r\n\"\\x64\\x8b\\x52\\x30\"     # mov edx, dword ptr fs:[edx + 0x30]     ;PEB\r\n\"\\x8b\\x52\\x08\"         # mov edx, dword ptr [edx + 8]           ;PEB.imagebase\r\n```"}}