-
-
[求助]请问下 这个tmd的脚本是否有问题
-
发表于: 2014-8-6 15:44 4008
-
以前跟过一段时间,后来不知什么原因电脑蓝屏,就没跟了。这次在虚拟机里面跟。总觉得有点问题。下面一段感觉很难理解。
resume_go是断在VirtualAlloc的入口,但是rtr,返回正常代码。但是后面比较的是[esp+8],2000的关系,看堆栈觉得有问题,感觉是rtr之前就比较[esp+8],esp+8正好是分配内存大小。但是回到正常代码却不是。这里会判断是RISC还是CISC,本来是RISC加壳的,比较分配的代码是不是超过2000。按脚本运行,被判断成CISC。不知道如何解决,还是我理解错了?
NOTEPAD no vm.zip
Themida - Winlicense 1.x - 2.x Multi PRO Edition 1.2.txt
resume_go是断在VirtualAlloc的入口,但是rtr,返回正常代码。但是后面比较的是[esp+8],2000的关系,看堆栈觉得有问题,感觉是rtr之前就比较[esp+8],esp+8正好是分配内存大小。但是回到正常代码却不是。这里会判断是RISC还是CISC,本来是RISC加壳的,比较分配的代码是不是超过2000。按脚本运行,被判断成CISC。不知道如何解决,还是我理解错了?
resume: cmp SET_RET, 01 jne resume_go ret //////////////////// resume_go: bphwc eip rtr bphws eip, "x" cmp [esp+8], 2000 jne LABEL_03a jmp LIN_alloc_vmb //////////////////// LIN_alloc_vm: // lineair alloc and redirect first 6 allocs esto //////////////////// LIN_alloc_vmb: free eax mov eax,lineair cmp 1000,[esp+8] jb LIN_alloc_vma mov [esp+8], 1000 //////////////////// LIN_alloc_vma: add lineair, [esp+8] cmp counterl, 5 inc counterl je LABEL_03 jmp LIN_alloc_vm //////////////////// LABEL_03: eval "RISC VM was redirected, the VM is not located in the TM/WL section, the following section will be dumped to the program directory: {lineairmsg}, attach it to your dump." log lineairmsg, "RISC VM was redirected to the following section: " eval "RISC VM was redirected to the following section: {lineairmsg}" mov RISC, $RESULT mov VMloccheck,1 // msg $RESULT esto jmp LABEL_03c //////////////////// LABEL_03a: // msg "Double dlls were detected before VM was written, the CISC VM is located in the TM/WL section" mov VMloccheck,0 eval "CISC VM is located in the Themida - Winlicense section." mov RISC, $RESULT log $RESULT, "" jmp LABEL_03c //////////////////// LABEL_03c: mov SET_RET, 01 cmp VM_FOUND_YES, 01 jne LABEL_03c_A1 call EXTRA_VM_AFTER_CHECK //////////////////// LABEL_03c_A1: cmp kill_dd, 0 je LABEL_03b mov TM_WL, [esp]
NOTEPAD no vm.zip
Themida - Winlicense 1.x - 2.x Multi PRO Edition 1.2.txt
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!
赞赏
他的文章
- [求助]问一下这个ruby代码哪儿有问题 1400
- [求助]pop pop ret类型的SEH溢出现在还能用吗。 4735
- [求助]请问下 这个tmd的脚本是否有问题 4009
- [讨论]内存隐藏学习总结 18893
- [求助]oreans unvirtualizer的使用问题 13276
看原图
赞赏
雪币:
留言: