Module 5: Gadget Discovery & Selection

Finding the right instruction sequences in a sea of legitimate code.

Gadget Sources: Why ntdll and kernel32?

SilentMoonwalk restricts gadget searches to specific system DLLs for good reasons:

The Gadget Search Algorithm

SilentMoonwalk scans the .text section of target modules looking for specific byte patterns. The search must also verify that any candidate gadget falls within a function that has valid unwind metadata:

C++// Simplified gadget search: find all JMP [RBX] gadgets in a module
// Byte pattern for JMP QWORD PTR [RBX]: FF 23
// Byte pattern for JMP [RBX] with SIB:   FF 63 XX (with displacement)

struct Gadget {
    PVOID   address;           // Address of the gadget instruction
    DWORD   functionRva;       // RVA of containing function
    DWORD   offsetInFunction;  // Offset from function start
    DWORD   frameSize;         // Frame size from UNWIND_INFO
    PRUNTIME_FUNCTION pRtFunc; // Pointer to RUNTIME_FUNCTION entry
};

std::vector<Gadget> FindJmpRbxGadgets(HMODULE hModule) {
    std::vector<Gadget> results;
    DWORD64 imageBase = (DWORD64)hModule;

    // Get .text section bounds
    PIMAGE_NT_HEADERS pNt = RtlImageNtHeader(hModule);
    PIMAGE_SECTION_HEADER pSec = IMAGE_FIRST_SECTION(pNt);
    PBYTE textStart = NULL;
    DWORD textSize = 0;

    for (WORD i = 0; i < pNt->FileHeader.NumberOfSections; i++) {
        if (memcmp(pSec[i].Name, ".text", 5) == 0) {
            textStart = (PBYTE)imageBase + pSec[i].VirtualAddress;
            textSize = pSec[i].Misc.VirtualSize;
            break;
        }
    }

    // Scan for FF 23 (jmp [rbx]) pattern
    for (DWORD offset = 0; offset < textSize - 1; offset++) {
        if (textStart[offset] == 0xFF && textStart[offset + 1] == 0x23) {
            PVOID gadgetAddr = textStart + offset;
            DWORD rva = (DWORD)((DWORD64)gadgetAddr - imageBase);

            // CRITICAL: verify this address has a RUNTIME_FUNCTION
            DWORD64 imgBase;
            PRUNTIME_FUNCTION pFunc = RtlLookupFunctionEntry(
                (DWORD64)gadgetAddr, &imgBase, NULL
            );

            if (pFunc != NULL) {
                Gadget g;
                g.address = gadgetAddr;
                g.functionRva = pFunc->BeginAddress;
                g.offsetInFunction = rva - pFunc->BeginAddress;
                g.pRtFunc = pFunc;
                g.frameSize = ComputeFrameSize(
                    (PUNWIND_INFO)(imageBase + pFunc->UnwindData)
                );
                results.push_back(g);
            }
        }
    }
    return results;
}

Key Gadget Patterns

SilentMoonwalk needs several specific gadget types. Each serves a distinct purpose in the spoofing chain:

1. JMP [RBX] — The Trampoline Gadget

This is the most critical gadget. It transfers control to a function pointer stored at the address in RBX without pushing a return address. This allows the target API call to be made with a fully controlled stack.

x86-64 ASM; Pattern: FF 23
; Disassembly: jmp qword ptr [rbx]
;
; Before execution:
;   RBX = pointer to memory containing target API address
;   RSP = points to our fake return address on the spoofed stack
;
; After execution:
;   RIP = target API (e.g., NtWaitForSingleObject)
;   RSP = unchanged (no push occurred)
;   When target API hits RET, it pops our controlled return address

2. ADD RSP, N; RET — Stack Frame Gadgets

These gadgets advance RSP by a fixed amount and then return. They serve as the "body" of each synthetic frame, consuming exactly the right number of stack bytes to match a target function's unwind allocation:

x86-64 ASM; Pattern: 48 83 C4 XX C3  (ADD RSP, imm8; RET)
; Or:      48 81 C4 XX XX XX XX C3  (ADD RSP, imm32; RET)

; Example: add rsp, 0x28; ret
; Bytes:   48 83 C4 28 C3
;
; This gadget creates a "frame" of 0x28 bytes:
;   RSP += 0x28   (skip over frame data)
;   RET           (pop next gadget address, RSP += 8)
;   Total RSP change: 0x30 bytes

; For SilentMoonwalk, the ADD RSP value must match the
; UWOP_ALLOC_SMALL or UWOP_ALLOC_LARGE in the containing
; function's UNWIND_INFO.

3. POP REG; RET — Register Setup Gadgets

Used to load values into specific registers from the stack before the target API call:

x86-64 ASM; pop rcx; ret  -->  Bytes: 59 C3
; pop rdx; ret  -->  Bytes: 5A C3
; pop r8; ret   -->  Bytes: 41 58 C3
; pop r9; ret   -->  Bytes: 41 59 C3

; These are essential for setting up function arguments.
; The x64 calling convention passes the first 4 integer args
; in RCX, RDX, R8, R9. Before calling the target API via
; JMP [RBX], these registers must contain the correct values.

Gadget Validation Criteria

Not every instruction sequence that matches a byte pattern is a usable gadget. SilentMoonwalk applies strict validation:

Building a Gadget Database

SilentMoonwalk pre-scans target modules at initialization to build a database of usable gadgets, indexed by type and frame size:

C++// Gadget database structure
struct GadgetDB {
    // JMP [RBX] gadgets indexed by frame size
    std::map<DWORD, std::vector<Gadget>> jmpRbxByFrameSize;

    // ADD RSP, N; RET gadgets indexed by N value
    std::map<DWORD, std::vector<Gadget>> addRspBySize;

    // POP REG; RET gadgets indexed by register
    std::map<int, std::vector<Gadget>>  popRegByReg;

    void Build(HMODULE hModule) {
        // Scan .pdata to enumerate all functions with unwind info
        PIMAGE_NT_HEADERS pNt = RtlImageNtHeader(hModule);
        DWORD64 imageBase = (DWORD64)hModule;

        // Get .pdata (exception directory)
        DWORD pdataRva = pNt->OptionalHeader
            .DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION].VirtualAddress;
        DWORD pdataSize = pNt->OptionalHeader
            .DataDirectory[IMAGE_DIRECTORY_ENTRY_EXCEPTION].Size;

        PRUNTIME_FUNCTION pFuncs = (PRUNTIME_FUNCTION)(imageBase + pdataRva);
        DWORD numFuncs = pdataSize / sizeof(RUNTIME_FUNCTION);

        for (DWORD i = 0; i < numFuncs; i++) {
            PRUNTIME_FUNCTION pFunc = &pFuncs[i];
            PUNWIND_INFO pUnwind = (PUNWIND_INFO)(
                imageBase + pFunc->UnwindData
            );

            // Skip chained unwind info for simplicity
            if (pUnwind->Flags & UNW_FLAG_CHAININFO) continue;

            DWORD frameSize = ComputeFrameSize(pUnwind);
            DWORD funcSize = pFunc->EndAddress - pFunc->BeginAddress;

            // Scan function body (after prologue) for gadgets
            PBYTE funcStart = (PBYTE)(imageBase + pFunc->BeginAddress);
            DWORD scanStart = pUnwind->SizeOfProlog;

            for (DWORD off = scanStart; off < funcSize - 1; off++) {
                // Check for JMP [RBX]: FF 23
                if (funcStart[off] == 0xFF && funcStart[off+1] == 0x23) {
                    Gadget g = { funcStart + off, pFunc->BeginAddress,
                                 off, frameSize, pFunc };
                    jmpRbxByFrameSize[frameSize].push_back(g);
                }
                // Check for ADD RSP, imm8; RET: 48 83 C4 XX C3
                if (off + 4 < funcSize &&
                    funcStart[off]   == 0x48 &&
                    funcStart[off+1] == 0x83 &&
                    funcStart[off+2] == 0xC4 &&
                    funcStart[off+4] == 0xC3) {
                    BYTE addVal = funcStart[off+3];
                    Gadget g = { funcStart + off, pFunc->BeginAddress,
                                 off, frameSize, pFunc };
                    addRspBySize[addVal].push_back(g);
                }
            }
        }
    }
};

Practical Considerations

Gadget Chain Assembly Order

Once the gadget database is built, SilentMoonwalk assembles gadgets in a specific order for the complete spoofing chain. Here is the logical sequence:

1. Parameter setup gadgets — POP RCX/RDX/R8/R9 to load API arguments
2. RBX setup — Load address of target API into memory pointed to by RBX
3. Frame body gadgets — ADD RSP, N; RET gadgets matched to target function frame sizes
4. Trampoline gadget — JMP [RBX] to invoke the target API with the spoofed stack active
5. Recovery gadgets — After API returns, restore original stack state