MMap: APC SxS fix

Author: DarthTon

src/BlackBone/Asm/AsmHelper32.cpp

@@ -37,7 +37,7 @@ void AsmHelper32::GenPrologue( bool switchMode /*= false*/ )
 /// </summary>
 /// <param name="switchMode">Unused</param>
 /// <param name="retSize">Stack change value</param>
-void AsmHelper32::GenEpilogue( bool switchMode /*= false*/ , int retSize /*= WordSize */ )
+void AsmHelper32::GenEpilogue( bool switchMode /*= false*/ , int retSize /*= 0xC */ )
 {
     if (retSize == -1)
         retSize = WordSize;

src/BlackBone/Asm/AsmHelper32.h

@@ -25,7 +25,7 @@ class AsmHelper32 : public AsmHelperBase
     /// </summary>
     /// <param name="switchMode">Unused</param>
     /// <param name="retSize">Stack change value</param>
-    virtual void GenEpilogue( bool switchMode = false, int retSize = 4 );
+    virtual void GenEpilogue( bool switchMode = false, int retSize = 0xC );
 
     /// <summary>
     /// Generate function call

src/BlackBone/Include/FunctionTypes.h

@@ -218,6 +218,14 @@ typedef NTSTATUS( NTAPI *fnRtlCreateActivationContext )(
     OUT PVOID*  ActCtx
     );
 
+typedef NTSTATUS( NTAPI* fnNtQueueApcThread )(
+    IN HANDLE ThreadHandle,
+    IN PVOID ApcRoutine, /*PKNORMAL_ROUTINE*/
+    IN PVOID NormalContext,
+    IN PVOID SystemArgument1,
+    IN PVOID SystemArgument2
+    );
+
 // RtlImageNtHeader
 typedef PIMAGE_NT_HEADERS( NTAPI* fnRtlImageNtHeader )(
     IN PVOID ModuleAddress

src/BlackBone/Process/RPC/RemoteExec.cpp

@@ -21,6 +21,7 @@ RemoteExec::RemoteExec( Process& proc )
 {
     LOAD_IMPORT( "NtOpenEvent", L"ntdll.dll" );
     LOAD_IMPORT( "NtCreateEvent", L"ntdll.dll" );
+    LOAD_IMPORT( "NtQueueApcThread", L"ntdll.dll" );
 }
 
 RemoteExec::~RemoteExec()
@@ -137,7 +138,9 @@ NTSTATUS RemoteExec::ExecInWorkerThread( PVOID pCode, size_t size, uint64_t& cal
 #endif
 
     // Execute code in thread context
-    if (QueueUserAPC( _userCode.ptr<PAPCFUNC>(), _hWorkThd.handle(), _userCode.ptr<ULONG_PTR>() ))
+    // TODO: Find out why am I passing pRemoteCode as an argument???
+    auto pRemoteCode = _userCode.ptr<PVOID>();
+    if (NT_SUCCESS( SAFE_NATIVE_CALL( NtQueueApcThread, _hWorkThd.handle(), pRemoteCode, pRemoteCode, nullptr, nullptr ) ))
     {
         dwResult = WaitForSingleObject( _hWaitEvent, 30 * 1000 /*wait 30s*/ );
         callResult = _userData.Read<uint64_t>( RET_OFFSET, 0 );