-
-
[原创]大材小用---SEH 求指令字节数
-
2012-2-12 21:06 3507
-
突发奇想的、没有什么技术性可言、主要是用单步来统计已经执行过的指令的字节数~
.386 .model flat, stdcall option casemap:none include windows.inc include kernel32.inc include user32.inc includelib kernel32.lib includelib user32.lib .data dllb db 'kernel32.dll', 0 messb db 'Beep', 0 ;copycode db 20 dup(0) obuf db 20 dup(0) .data? oldprod dd ? starteip dd ? endeip dd ? inum dd ? oldesp dd ? .code start: assume fs:nothing push offset sshproc push fs:[0] mov fs:[0], esp lea ebx, copycode invoke VirtualProtect, ebx, 30, PAGE_EXECUTE_READWRITE, addr oldprod invoke LoadLibrary, addr dllb invoke GetProcAddress, eax, addr messb mov esi, eax lea edi, copycode xor eax, eax mov ecx, 20 re1: mov bl, [esi+eax] mov [edi+eax], bl inc eax loop re1 lea ebx, inum mov dword ptr [ebx], 0 lea edi, copycode_e jmp edi ghome: mov esp, dword ptr [oldesp] jmp r_ format_1: db 'number = %d', 0 r_: lea eax, endeip mov eax, [eax] invoke wsprintf, addr obuf, addr format_1, eax invoke MessageBox, 0, addr obuf, 0, 0 add esp, 8 jmp toend copycode_e: lea ebx, starteip mov [ebx], offset copycode s_1_start: pushfd pop eax or eax, 100h push eax popfd s_1_end: mov dword ptr [oldesp], esp copycode: db 30 dup(90h) toend: ret sshproc proc, pexc:dword, pframe:dword, pcon:dword, pdis:dword jmp s1 txt db 'number = %x', 0 s1: assume eax:ptr CONTEXT mov eax, pcon mov edx, [eax].regEip inc dword ptr [inum] lea ebx, starteip mov ebx, dword ptr [ebx] sub edx, ebx ;sub edx, 5 push eax push edx ;invoke wsprintf, addr obuf, addr txt, edx ;invoke MessageBox, 0, addr obuf, 0, 0 pop edx pop eax .if dword ptr [inum] > 3 lea ebx, endeip mov dword ptr [ebx], edx mov dword ptr [eax].regEip, ghome xor eax, eax ret .endif or [eax].regFlag, 0100h mov eax, 0 ret sshproc endp end start
[CTF入门培训]顶尖高校博士及硕士团队亲授《30小时教你玩转CTF》,视频+靶场+题目!助力进入CTF世界
赞赏
他的文章
看原图