-
-
SEH ? 虚拟 CPU ? 垃圾?
-
发表于:
2005-4-15 23:30
5892
-
恶搞的代码,如果把 OPCODE 集发展下去想跟踪就得费费脑子了。
v_key_sign equ 0DEADC0DEh ; haha
v_call_opcode_num32 equ '00'
v_push_opcode_num32 equ '01'
v_jmp_opcode_num32 equ '02'
v_push macro opcode1
dw -1
dd v_key_sign
dd v_push_opcode_num32
dd opcode1
;==push opcode1
endm
v_call macro opcode1
dw -1
dd v_key_sign
dd v_call_opcode_num32
dd opcode1
;==call opcode1(address)
endm
v_jmp macro opcode1
dw -1
dd v_key_sign
dd v_call_opcode_num32
dd opcode1
;==call opcode1(address)
endm
;opcode×î´ó£´×Ö½Ú
.386
.Model Flat,StdCall
Option CaseMap:None
assume fs:flat
include windows.inc
include kernel32.inc
include user32.inc
includelib kernel32.lib
includelib user32.lib
.data
szcaption db ' my own CPU? muhahahahahah',0
szsth db ' oh my!!!!!!!!!!!!!!!!!!!!!!!!!I really hate dustx',0
.code
start:
push offset DCProcessor
push fs:[eax]
mov fs:[eax], esp ; reg processor
v_jmp place1
;--------------------------------------------------
place3:
v_push 0
v_call GetModuleHandleA
xchg esi, eax
v_call GetCommandLineA
xchg edi, eax
v_push 0
v_push offset szcaption
v_push offset szsth
v_push 0
v_call MessageBoxA
v_push 7758521h ;for test
v_call ExitProcess
place1:
v_jmp place2
db 'haaaaaaaaaaaaaaaaaaa'
place2:
v_jmp place3
;--------------------------------------------------
DCProcessor:
SehHandler1 PROC C pExcept:DWORD,pFrame:DWORD,pContext:DWORD,pDispatch:DWORD
pushad
mov esi, pContext
assume esi: ptr CONTEXT
mov edi, [esi].regEip
inc edi
inc edi
mov eax, [edi]
cmp eax, v_key_sign
jnz @@not_vpc_code
;;;;;;;;;;;;;;;;;;;;;;;;
add edi, 4 ;
mov eax, [edi]
.if eax==v_push_opcode_num32
add edi, 4
sub [esi].regEsp, 4h
mov eax, [esi].regEsp
push [edi]
pop [eax]
add edi, 4 ; Ö¸ÏòÐéÄâÖ¸Áîºó±ß
.elseif eax==v_call_opcode_num32
add edi, 4
mov eax, [edi] ; eax->to callµØÖ・
sub [esi].regEsp, 4h;・µ»ØµØÖ・stack space
lea ecx, [edi+4] ; ->・µ»ØµØÖ・
mov ebx, [esi].regEsp
mov [ebx], ecx
mov edi, eax ;дeip
.elseif eax==v_jmp_opcode_num32
add edi, 4
mov eax, [edi]
xchg eax, edi
.endif
;ÐÞÕýeip
mov [esi].regEip, edi
;;;;;;;;;;;;;;;;;;;;;;;;
@@not_vpc_code:
popad
mov EAX,ExceptionContinueExecution
assume eax:nothing
ret
SehHandler1 ENDP
end start
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课