-
-
[分享]VMP 检测Vmware 代码小片段
-
发表于:
2013-7-15 03:04
16069
-
前面 心得文章也许放错板块了。
由于一个VMP 的程序加了 VMWare 检测，所以 想到程序镜像上找 0x564D5868 之类的，总是找不到，后来逐段分析到了，因此 记录下。并贴出来，共享下。0xxxxxxx 表示地址。
|. 00 429CA100 vPushImm4 0xxxxxxxx DWORD _t1880 = 0A19C42
|. 77 vAdd4 EXIT DWORD _t1881 = 0xxxxxxx; DWORD _t1882 = AddFlag(0A19C42, 0)
|. 0C vPopReg4 vR11 DWORD _t1883 = AddFlag(0xxxxxxx, 0)
|. 22 vPushReg4 vR8 DWORD _t1884 = 0
|. 25 vReadMemFs4 v133 = DWORD FS:[0]
|. 66 vPushVEsp DWORD _t1886 = 0FFFFF7FC
|. 22 vPushReg4 vR8 DWORD _t1887 = 0
|. 09 vWriteMemFs4 DWORD FS:[0] = v134; v134 = 0FFFFF7FC
|. 84 0A vPushImmSx1 0A DWORD _t1889 = 0A
|. 0C vPopReg4 vR11 DWORD _t1890 = 0A
|. 00 68584D56 vPushImm4 564D5868 DWORD _t1891 = 564D5868
|. 5C vPopReg4 vR1 DWORD _t1892 = 564D5868
|. 01 5856 vPushImmSx2 5658 DWORD _t1893 = 5658
|. 44 vPopReg4 vR4 DWORD _t1894 = 5658
|. 00 1B3BA100 vPushImm4 0A13B1B DWORD _t1895 = 0A13B1B
|. 1A vPushReg4 vR9 DWORD _t1896 = 0
|. 77 vAdd4 DWORD _v188 = 0A13B1B; DWORD _t1898 = AddFlag(0, 0A13B1B)
|. 24 vPopReg4 vR8 DWORD _t1899 = AddFlag(0, 0A13B1B)
|. 32 vPushReg4 vR6 ESI DWORD v135 = v123
|. F3 vPushReg4 vR14 DWORD _t1901 = 8C64333D ^ _v151
|. 4A vPushReg4 vR3 EBX DWORD v136 = 0
|. 02 vPushReg4 vR12 EFL DWORD v137 = v131
|. 0A vPushReg4 vR11 ECX DWORD v138 = 0A
|. 62 vPushReg4 vR0 EDI DWORD v139 = v127
|. 5A vPushReg4 vR1 EAX DWORD v140 = 564D5868
|. 52 vPushReg4 vR2 EBP DWORD v141 = 8
|. 42 vPushReg4 vR4 EDX DWORD v142 = 5658
|. 5A vPushReg4 vR1 DWORD _t1909 = 564D5868
|. F3 vPushReg4 vR14 DWORD _t1910 = 8C64333D ^ _v151
|. 70 vRet online 0xxxxxabd; 0xxxxxabc; in eax, dx
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
in eax, dx
