-
-
写工具累了,无聊的看着WinLicense的API模拟代码
-
发表于: 2005-7-15 06:38
-
代码已去花...
036809D2 2 8BFF mov edi,edi
036809E8 1 95 xchg eax,ebp
036809E9 1 50 push eax
036809EA 1 52 push edx
036809EB 1 50 push eax
036809EC 1 52 push edx
036809ED 1 50 push eax
036809EE 1 52 push edx
036809EF 2 0F31 rdtsc
036809F1 1 5A pop edx
036809F2 1 58 pop eax
036809F3 2 0F31 rdtsc
036809F5 1 60 pushad
036809F6 1 61 popad
036809F7 1 5A pop edx
036809F8 1 58 pop eax
036809F9 2 0F31 rdtsc
03680A0F 1 5A pop edx
03680A10 1 58 pop eax
03680A11 1 50 push eax
03680A1D 1 95 xchg eax,ebp
03680A1E 1 60 pushad
03680A1F 3 66:8BD8 mov bx,ax
03680A32 1 61 popad
03680A33 2 8BEC mov ebp,esp
03680A35 1 50 push eax
03680A36 1 52 push edx
03680A4E 2 0F31 rdtsc
03680A69 1 5A pop edx
03680A6A 1 58 pop eax
03680A6B 4 837D 08 00 cmp dword ptr [ebp+8],0
03680A6F 1 60 pushad
03680A70 1 50 push eax
03680A71 1 52 push edx
03680A72 3 0FB7F3 movzx esi,bx
03680A75 2 0F31 rdtsc
03680A77 1 60 pushad
03680A78 1 61 popad
03680A79 1 5A pop edx
03680A7A 1 58 pop eax
03680A7B 1 50 push eax
03680A7C 1 52 push edx
03680A7D 1 9C pushfd
03680A89 6 81D6 5EC33542 adc esi,4235C35E
03680AA8 1 9D popfd
03680AA9 2 0F31 rdtsc
03680AAB 1 5A pop edx
03680AAC 1 58 pop eax
03680AAD 1 61 popad
03680AAE 6 0F84 76201A79 je 7C822B2A
03680AB4 1 50 push eax
03680AB5 1 52 push edx
03680AB6 1 60 pushad
03680AB7 1 9C pushfd
03680ACE 6 81EE 885E1A10 sub esi,101A5E88
03680ADF 1 9D popfd
03680AE0 1 9C pushfd
03680AF9 3 80E8 E8 sub al,E8
03680B07 1 9D popfd
03680B08 1 61 popad
03680B09 2 0F31 rdtsc
03680B24 1 5A pop edx
03680B25 1 58 pop eax
03680B26 3 FF75 08 push dword ptr [ebp+8]
03680B29 1 50 push eax
03680B2A 1 52 push edx
03680B38 2 0F31 rdtsc
03680B4B 1 5A pop edx
03680B4C 1 58 pop eax
03680B4D 5 E8 E2B41A79 call 7C82C034
03680B52 1 50 push eax
03680B53 1 52 push edx
03680B61 2 0F31 rdtsc
03680B74 1 5A pop edx
03680B75 1 58 pop eax
03680B76 2 85C0 test eax,eax
03680B86 6 0F84 39000000 je 03680BC5
03680B8C 1 60 pushad
03680B9B 5 BE 81EE9162 mov esi,6291EE81
03680BA0 1 61 popad
03680BA1 3 FF70 04 push dword ptr [eax+4]
03680BB0 5 E8 F8571A79 call 7C8263AD
03680BC5 1 5D pop ebp
03680BC6 1 60 pushad
03680BC7 5 B8 9D126B0D mov eax,D6B129D
03680BCC 1 9C pushfd
03680BD7 3 80C5 F8 add ch,F8
03680BE5 1 9D popfd
03680BE6 1 61 popad
03680BE7 3 C2 0400 retn 4
---?GetModuleHandleA
如果都这样模拟掉系统dll函数,修复IAT确实需要点力气了.
无聊的说.
036809D2 2 8BFF mov edi,edi
036809E8 1 95 xchg eax,ebp
036809E9 1 50 push eax
036809EA 1 52 push edx
036809EB 1 50 push eax
036809EC 1 52 push edx
036809ED 1 50 push eax
036809EE 1 52 push edx
036809EF 2 0F31 rdtsc
036809F1 1 5A pop edx
036809F2 1 58 pop eax
036809F3 2 0F31 rdtsc
036809F5 1 60 pushad
036809F6 1 61 popad
036809F7 1 5A pop edx
036809F8 1 58 pop eax
036809F9 2 0F31 rdtsc
03680A0F 1 5A pop edx
03680A10 1 58 pop eax
03680A11 1 50 push eax
03680A1D 1 95 xchg eax,ebp
03680A1E 1 60 pushad
03680A1F 3 66:8BD8 mov bx,ax
03680A32 1 61 popad
03680A33 2 8BEC mov ebp,esp
03680A35 1 50 push eax
03680A36 1 52 push edx
03680A4E 2 0F31 rdtsc
03680A69 1 5A pop edx
03680A6A 1 58 pop eax
03680A6B 4 837D 08 00 cmp dword ptr [ebp+8],0
03680A6F 1 60 pushad
03680A70 1 50 push eax
03680A71 1 52 push edx
03680A72 3 0FB7F3 movzx esi,bx
03680A75 2 0F31 rdtsc
03680A77 1 60 pushad
03680A78 1 61 popad
03680A79 1 5A pop edx
03680A7A 1 58 pop eax
03680A7B 1 50 push eax
03680A7C 1 52 push edx
03680A7D 1 9C pushfd
03680A89 6 81D6 5EC33542 adc esi,4235C35E
03680AA8 1 9D popfd
03680AA9 2 0F31 rdtsc
03680AAB 1 5A pop edx
03680AAC 1 58 pop eax
03680AAD 1 61 popad
03680AAE 6 0F84 76201A79 je 7C822B2A
03680AB4 1 50 push eax
03680AB5 1 52 push edx
03680AB6 1 60 pushad
03680AB7 1 9C pushfd
03680ACE 6 81EE 885E1A10 sub esi,101A5E88
03680ADF 1 9D popfd
03680AE0 1 9C pushfd
03680AF9 3 80E8 E8 sub al,E8
03680B07 1 9D popfd
03680B08 1 61 popad
03680B09 2 0F31 rdtsc
03680B24 1 5A pop edx
03680B25 1 58 pop eax
03680B26 3 FF75 08 push dword ptr [ebp+8]
03680B29 1 50 push eax
03680B2A 1 52 push edx
03680B38 2 0F31 rdtsc
03680B4B 1 5A pop edx
03680B4C 1 58 pop eax
03680B4D 5 E8 E2B41A79 call 7C82C034
03680B52 1 50 push eax
03680B53 1 52 push edx
03680B61 2 0F31 rdtsc
03680B74 1 5A pop edx
03680B75 1 58 pop eax
03680B76 2 85C0 test eax,eax
03680B86 6 0F84 39000000 je 03680BC5
03680B8C 1 60 pushad
03680B9B 5 BE 81EE9162 mov esi,6291EE81
03680BA0 1 61 popad
03680BA1 3 FF70 04 push dword ptr [eax+4]
03680BB0 5 E8 F8571A79 call 7C8263AD
03680BC5 1 5D pop ebp
03680BC6 1 60 pushad
03680BC7 5 B8 9D126B0D mov eax,D6B129D
03680BCC 1 9C pushfd
03680BD7 3 80C5 F8 add ch,F8
03680BE5 1 9D popfd
03680BE6 1 61 popad
03680BE7 3 C2 0400 retn 4
---?GetModuleHandleA
如果都这样模拟掉系统dll函数,修复IAT确实需要点力气了.
无聊的说.
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
