首页
社区
课程
招聘
[原创]第一题VM人肉还原,附带还原工具源码
发表于: 2010-11-1 12:23 10069

[原创]第一题VM人肉还原,附带还原工具源码

2010-11-1 12:23
10069
收藏
免费 7
支持
分享
最新回复 (7)
雪    币: 8209
活跃值: (4518)
能力值: ( LV15,RANK:2473 )
在线值:
发帖
回帖
粉丝
2
人肉多少钱一斤啊
2010-11-1 12:25
0
雪    币: 296
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
4块吧~~!
2010-11-1 12:26
0
雪    币: 370
活跃值: (52)
能力值: ( LV13,RANK:350 )
在线值:
发帖
回帖
粉丝
4
买不了
我直接不管它  盯着VMContext的变化,也看出来了
然后随便猜下 果然是故意把异或运算写成或运算了
2010-11-1 12:31
0
雪    币: 59
活跃值: (55)
能力值: ( LV3,RANK:30 )
在线值:
发帖
回帖
粉丝
5
VM00_Instruction: RtlLeaveCriticalSection
VM01_Instruction: mov VM_Stack[8] , VM_EFL
VM02_Instruction: mov VM_EFL , VM_Stack[8]
VM03_Instruction: mov VM_Ptr VM_Register[VM_OP1] , VM_Stack[VM_OP2]
VM04_Instruction: mov VM_Ptr VM_Stack[VM_OP1] , VM_Register[VM_OP2]
VM05_Instruction: mov VM_Ptr VM_Stack[VM_OP1] , VM_Stack[VM_OP2]
VM06_Instruction: mov VM_Ptr VM_Stack[VM_OP1] , VM_OP2
VM07_Instruction: mov VM_Ptr [VM_Stack[VM_OP1]] , VM_Stack[VM_OP2]
VM08_Instruction: mov VM_Ptr VM_Stack[VM_OP1] , [VM_Stack[VM_OP2]]
VM09_Instruction: add VM_Stack[0] ,VM_Stack[1]
VM10_Instruction: sub VM_Stack[0] ,VM_Stack[1]
VM11_Instruction: mul VM_Stack[0] ,VM_Stack[1]
VM12_Instruction: div VM_Stack[0] ,VM_Stack[1]
VM13_Instruction: mov VM_Stack[9], ZFSF(VM_Stack[8])
VM14_Instruction: test VM_Stack[9] <>0 ; VM_EIP = VM_EIP + (VM_OP1 shl 4)
VM15_Instruction: add VM_Ptr VM_Stack[0] ,VM_Stack[1] ; mov VM_Stack[8],EFL
VM16_Instruction: sub VM_Ptr VM_Stack[0] ,VM_Stack[1] ; mov VM_Stack[8],EFL
VM17_Instruction: mul VM_Ptr VM_Stack[0] ,VM_Stack[1] ; mov VM_Stack[8],EFL
VM18_Instruction: div VM_Ptr VM_Stack[0] ,VM_Stack[1] ; mov VM_Stack[8],EFL
VM19_Instruction: test VM_Ptr VM_Stack[0] ,VM_Stack[1] ; mov VM_Stack[8],EFL
VM20_Instruction: and VM_Ptr VM_Stack[0] ,VM_Stack[1] ; mov VM_Stack[8],EFL
VM21_Instruction: xor VM_Ptr VM_Stack[0] ,VM_Stack[1] ; mov VM_Stack[8],EFL
VM22_Instruction: or  VM_Ptr VM_Stack[0] ,VM_Stack[1] ; mov VM_Stack[8],EFL
VM23_Instruction: not VM_Ptr VM_Stack[0] ,VM_Stack[1] ; mov VM_Stack[8],EFL
VM24_Instruction: shr VM_Ptr VM_Stack[0] ,VM_Stack[1] ; mov VM_Stack[8],EFL
VM25_Instruction: sar VM_Ptr VM_Stack[0] ,VM_Stack[1] ; mov VM_Stack[8],EFL
VM2627_Instruction: shl VM_Ptr VM_Stack[0] ,VM_Stack[1] ; mov VM_Stack[8],EFL
VM2829_Instruction: nop
2010-11-1 12:49
0
雪    币: 6051
活跃值: (1441)
能力值: ( LV15,RANK:1473 )
在线值:
发帖
回帖
粉丝
6
应该是4块VM代码吧?
2010-11-1 12:57
0
雪    币: 8209
活跃值: (4518)
能力值: ( LV15,RANK:2473 )
在线值:
发帖
回帖
粉丝
7
三楼的是在回答我二楼的问题
2010-11-1 13:16
0
雪    币: 59
活跃值: (55)
能力值: ( LV3,RANK:30 )
在线值:
发帖
回帖
粉丝
8
你牛,我才反映过来.
2010-11-1 14:25
0
游客
登录 | 注册 方可回帖
返回
//