首页
社区
课程
招聘
[求助]请问下 这个tmd的脚本是否有问题
发表于: 2014-8-6 15:44 3922

[求助]请问下 这个tmd的脚本是否有问题

2014-8-6 15:44
3922
以前跟过一段时间,后来不知什么原因电脑蓝屏,就没跟了。这次在虚拟机里面跟。总觉得有点问题。下面一段感觉很难理解。
  resume_go是断在VirtualAlloc的入口,但是rtr,返回正常代码。但是后面比较的是[esp+8],2000的关系,看堆栈觉得有问题,感觉是rtr之前就比较[esp+8],esp+8正好是分配内存大小。但是回到正常代码却不是。这里会判断是RISC还是CISC,本来是RISC加壳的,比较分配的代码是不是超过2000。按脚本运行,被判断成CISC。不知道如何解决,还是我理解错了?
  
resume:
cmp SET_RET, 01
jne resume_go
ret
////////////////////
resume_go:
bphwc eip
rtr
bphws eip, "x" 
cmp [esp+8], 2000
jne LABEL_03a
jmp LIN_alloc_vmb
////////////////////
LIN_alloc_vm:                 // lineair alloc and redirect first 6 allocs
esto
////////////////////
LIN_alloc_vmb:
free eax
mov eax,lineair
cmp 1000,[esp+8]
jb LIN_alloc_vma
mov [esp+8], 1000
////////////////////
LIN_alloc_vma:
add lineair, [esp+8]
cmp counterl, 5
inc counterl
je LABEL_03
jmp LIN_alloc_vm
////////////////////
LABEL_03:
eval "RISC VM was redirected, the VM is not located in the TM/WL section, the following section will be dumped to the program directory: {lineairmsg}, attach it to your dump."
log lineairmsg, "RISC VM was redirected to the following section: " 
eval "RISC VM was redirected to the following section: {lineairmsg}"
mov RISC, $RESULT
mov VMloccheck,1
// msg $RESULT
esto
jmp LABEL_03c
////////////////////
LABEL_03a:
// msg "Double dlls were detected before VM was written, the CISC VM is located in the TM/WL section"
mov VMloccheck,0
eval "CISC VM is located in the Themida - Winlicense section." 
mov RISC, $RESULT
log $RESULT, ""
jmp LABEL_03c
////////////////////
LABEL_03c:
mov SET_RET, 01
cmp VM_FOUND_YES, 01
jne LABEL_03c_A1
call EXTRA_VM_AFTER_CHECK
////////////////////
LABEL_03c_A1:
cmp kill_dd, 0
je LABEL_03b
mov TM_WL, [esp]

NOTEPAD no vm.zip

Themida - Winlicense 1.x - 2.x Multi PRO Edition 1.2.txt

[课程]Linux pwn 探索篇!

上传的附件:
收藏
免费 0
支持
分享
最新回复 (0)
游客
登录 | 注册 方可回帖
返回
//