Metasploit Framework

patch that will allow you to tell the hunter to use a given register as start location

Usage :

badchars = "" 
eggoptions =
{
    :startreg => "edx" 
}
hunter,egg = generate_egghunter(payload.encoded,badchars,eggoptions)

Code (based on revision 10651):

20a21
> # Startreg code added by corelanc0d3r
40a42,43
>                 startreg      = opts[:startreg]
>
44a48,56
>                 startstub = ''
>                 if startreg
>                     if startreg.downcase != 'edx'
>                         startstub = "\n\tmov edx,#{startreg}\n\tjmp next_addr" 
>                     else
>                         startstub = "\n\tjmp next_addr" 
>                     end
>                 end
>                 startstub << "\n\t" if startstub.length > 0
46a59
> #{startstub}
104a118,127
>                 startstub = ''
>                 if startreg
>                     if startreg.downcase != 'ecx'
>                         startstub = "\n\tmov ecx,#{startreg}\n\tjmp next_addr" 
>                     else
>                         startstub = "\n\tjmp next_addr" 
>                     end
>                 end
>                 startstub << "\n\t" if startstub.length > 0
>
106a130
> #{startstub}

diff file, created from trunk root

Closing since most of it has been addressed, the remaining bits (separate encoder invocation) has been moved to #2989.