首页
社区
课程
招聘
[原创]大材小用---SEH 求指令字节数
2012-2-12 21:06 3507

[原创]大材小用---SEH 求指令字节数

2012-2-12 21:06
3507
突发奇想的、没有什么技术性可言、主要是用单步来统计已经执行过的指令的字节数~

.386
.model flat, stdcall
option casemap:none

include windows.inc
include kernel32.inc
include user32.inc
includelib kernel32.lib
includelib user32.lib

.data
dllb db 'kernel32.dll', 0
messb db 'Beep', 0
;copycode db 20 dup(0)
obuf db 20 dup(0)

.data?
oldprod dd ?
starteip dd ?
endeip dd ?
inum dd ?
oldesp dd ?
.code
start:
assume fs:nothing

push offset sshproc
push fs:[0]
mov fs:[0], esp

lea ebx, copycode
invoke VirtualProtect, ebx, 30, PAGE_EXECUTE_READWRITE, addr oldprod
invoke LoadLibrary, addr dllb
invoke GetProcAddress, eax, addr messb
mov esi, eax
lea edi, copycode
xor eax, eax

mov ecx, 20
re1:
mov bl, [esi+eax]
mov [edi+eax], bl
inc eax
loop re1

lea ebx, inum
mov dword ptr [ebx], 0

lea edi, copycode_e
jmp edi

ghome:
mov esp, dword ptr [oldesp]
jmp r_
format_1:
db 'number = %d', 0
r_: 
lea eax, endeip
mov eax, [eax]
invoke wsprintf, addr obuf, addr format_1, eax
invoke MessageBox, 0, addr obuf, 0, 0
add esp, 8

jmp toend

copycode_e:

lea ebx, starteip
mov [ebx], offset copycode

s_1_start:
pushfd
pop eax
or eax, 100h
push eax
popfd
s_1_end:
mov dword ptr [oldesp], esp
copycode:
db 30 dup(90h)


toend:
ret
sshproc proc, pexc:dword, pframe:dword, pcon:dword, pdis:dword

jmp s1
txt db 'number = %x', 0
s1:

assume eax:ptr CONTEXT
mov eax, pcon
mov edx, [eax].regEip


inc dword ptr [inum]
lea ebx, starteip
mov ebx, dword ptr [ebx]

sub edx, ebx
;sub edx, 5
push eax
push edx

;invoke wsprintf, addr obuf, addr txt, edx
;invoke MessageBox, 0, addr obuf, 0, 0

pop edx
pop eax

.if dword ptr [inum] > 3
	lea ebx, endeip
	mov dword ptr [ebx], edx
	mov dword ptr [eax].regEip, ghome
	xor eax, eax
	ret
.endif

or [eax].regFlag, 0100h
mov eax, 0

ret
sshproc endp
end start

[CTF入门培训]顶尖高校博士及硕士团队亲授《30小时教你玩转CTF》,视频+靶场+题目!助力进入CTF世界

收藏
点赞4
打赏
分享
最新回复 (0)
游客
登录 | 注册 方可回帖
返回