-
-
[求助]请问下 这个tmd的脚本是否有问题
-
发表于: 2014-8-6 15:44 4154
-
以前跟过一段时间,后来不知什么原因电脑蓝屏,就没跟了。这次在虚拟机里面跟。总觉得有点问题。下面一段感觉很难理解。
resume_go是断在VirtualAlloc的入口,但是rtr,返回正常代码。但是后面比较的是[esp+8],2000的关系,看堆栈觉得有问题,感觉是rtr之前就比较[esp+8],esp+8正好是分配内存大小。但是回到正常代码却不是。这里会判断是RISC还是CISC,本来是RISC加壳的,比较分配的代码是不是超过2000。按脚本运行,被判断成CISC。不知道如何解决,还是我理解错了?
NOTEPAD no vm.zip
Themida - Winlicense 1.x - 2.x Multi PRO Edition 1.2.txt
resume_go是断在VirtualAlloc的入口,但是rtr,返回正常代码。但是后面比较的是[esp+8],2000的关系,看堆栈觉得有问题,感觉是rtr之前就比较[esp+8],esp+8正好是分配内存大小。但是回到正常代码却不是。这里会判断是RISC还是CISC,本来是RISC加壳的,比较分配的代码是不是超过2000。按脚本运行,被判断成CISC。不知道如何解决,还是我理解错了?
resume:
cmp SET_RET, 01
jne resume_go
ret
////////////////////
resume_go:
bphwc eip
rtr
bphws eip, "x"
cmp [esp+8], 2000
jne LABEL_03a
jmp LIN_alloc_vmb
////////////////////
LIN_alloc_vm: // lineair alloc and redirect first 6 allocs
esto
////////////////////
LIN_alloc_vmb:
free eax
mov eax,lineair
cmp 1000,[esp+8]
jb LIN_alloc_vma
mov [esp+8], 1000
////////////////////
LIN_alloc_vma:
add lineair, [esp+8]
cmp counterl, 5
inc counterl
je LABEL_03
jmp LIN_alloc_vm
////////////////////
LABEL_03:
eval "RISC VM was redirected, the VM is not located in the TM/WL section, the following section will be dumped to the program directory: {lineairmsg}, attach it to your dump."
log lineairmsg, "RISC VM was redirected to the following section: "
eval "RISC VM was redirected to the following section: {lineairmsg}"
mov RISC, $RESULT
mov VMloccheck,1
// msg $RESULT
esto
jmp LABEL_03c
////////////////////
LABEL_03a:
// msg "Double dlls were detected before VM was written, the CISC VM is located in the TM/WL section"
mov VMloccheck,0
eval "CISC VM is located in the Themida - Winlicense section."
mov RISC, $RESULT
log $RESULT, ""
jmp LABEL_03c
////////////////////
LABEL_03c:
mov SET_RET, 01
cmp VM_FOUND_YES, 01
jne LABEL_03c_A1
call EXTRA_VM_AFTER_CHECK
////////////////////
LABEL_03c_A1:
cmp kill_dd, 0
je LABEL_03b
mov TM_WL, [esp]NOTEPAD no vm.zip
Themida - Winlicense 1.x - 2.x Multi PRO Edition 1.2.txt
[培训]科锐软件逆向54期预科班、正式班开始火爆招生报名啦!!!
赞赏
他的文章
- [求助]问一下这个ruby代码哪儿有问题 1545
- [求助]pop pop ret类型的SEH溢出现在还能用吗。 4866
- [求助]请问下 这个tmd的脚本是否有问题 4155
- [讨论]内存隐藏学习总结 19340
- [求助]oreans unvirtualizer的使用问题 13657
赞赏
雪币:
留言: