|
[下载]Win10 1909逆向虚拟机分享
唉。这标题太强大了。也点进来看了 |
|
|
|
[原创] 突如其来的想法 x86+x64 混合代码
附上测试程序。 wow64ext /** * * WOW64Ext Library * * Copyright (c) 2014 ReWolf * http://blog.rewolf.pl/ * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published * by the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with this program. If not, see <http://www.gnu.org/licenses/>. * */ ConsoleApplication3.dll 是64位的dll 调用 msg 建一个窗口
最后于 2018-5-14 12:36
被likecrack编辑
,原因:
|
|
|
|
[原创]SEH Hook
下硬件断点不是更好。不过只能四个地址 |
|
[原创]分享一个MASM文本转换为DWORD的函数
一直用ustr2dw |
|
[原创]Inline hook中继函数通用汇编宏
来几个函数.看得懂的.拿去用吧 acallb proc a_addr:dword,b_addr:dword local OldProtect pushad invoke IsBadWritePtr,a_addr,8 .if eax!=0 invoke VirtualProtect,a_addr,8,PAGE_EXECUTE_READWRITE,addr OldProtect .endif mov eax,a_addr mov edx,b_addr sub edx,eax sub edx,5 mov byte ptr[eax],0e8h xchg [eax+1],edx popad ret acallb endp ajmpb proc a_addr:dword,b_addr:dword local OldProtect pushad invoke IsBadWritePtr,a_addr,8 .if eax!=0 invoke VirtualProtect,a_addr,8,PAGE_EXECUTE_READWRITE,addr OldProtect .endif mov eax,a_addr mov edx,b_addr sub edx,eax sub edx,5 mov byte ptr[eax],0e9h xchg [eax+1],edx popad ret ajmpb endp xcopy proc src:dword,des:dword,slen:dword pushad mov edi,src mov esi,des mov ecx,slen xcopyloop: mov al,byte ptr[edi] mov byte ptr[esi],al inc edi inc esi loop xcopyloop popad ret xcopy endp hook_addr_jump proc lpaddr,myapi,jump LOCAL vaddr local OldProtect pushad invoke VirtualAlloc,0,1000h,MEM_RESERVE+MEM_COMMIT,PAGE_READWRITE mov vaddr,eax invoke acallb,vaddr,myapi mov ecx,lpaddr mov ebx,vaddr add ebx,5 invoke xcopy,ecx,ebx,jump mov ebx,vaddr add ebx,5 add ebx,jump mov ecx,lpaddr add ecx,jump invoke ajmpb,ebx,ecx invoke ajmpb,lpaddr,vaddr invoke VirtualProtect,vaddr,1000h,PAGE_EXECUTE_READWRITE,addr OldProtect popad ret hook_addr_jump endp |
操作理由
RANk
{{ user_info.golds == '' ? 0 : user_info.golds }}
雪币
{{ experience }}
课程经验
{{ score }}
学习收益
{{study_duration_fmt}}
学习时长
基本信息
荣誉称号:
{{ honorary_title }}
能力排名:
No.{{ rank_num }}
等 级:
LV{{ rank_lv-100 }}
活跃值:
在线值:
浏览人数:{{ visits }}
最近活跃:{{ last_active_time }}
注册时间:{{ user_info.create_date_jsonfmt }}
勋章
兑换勋章
证书
证书查询 >
能力值