I'm practicing backdooring PE binary compiled with ASLR in a WOW64 environment. The approach is pretty straightforward and basically is something like this:
- Find code cave and a hijacking point. In this case, I choose not to patch the entry point but the shellcode will be trigged on user interaction.
- After the hijacking point is reached, I found a useful way to jump to my code cave.
- Once I'm inside my code cave, like standard approaches, I save my flags and registers with PUSHAD and PUSHFD instructions.
- Execute successfully the shellcode: my reverse shell is connected and working flawlessy.
- After that, I need to come back to the original flow, reconstructing the flags, registers and patched instructions.
In a no-ASLR environment, I can hardcode the original address back inside the ESP and executing standard POPFD, POPAD instructions. But now, how can I come back to the original ESP value? Also, I noticed that somehow the ESP address changes also in the offset and not only in the base address. Maybe it depends on some user interactions...