首页
论坛
课程
招聘
[分享]smc for win64
2017-11-30 13:07 2601

[分享]smc for win64

2017-11-30 13:07
2601
;\UASM64\bin\uasm64 -c -win64
;\UASM64\bin\Link /ENTRY:entry_point /SUBSYSTEM:console /MACHINE:X64 /nologo /LARGEADDRESSAWARE
option casemap:none
option win64:3

include \UASM64\include\windows.inc

includelib \UASM64\Lib\user32.lib
includelib \UASM64\Lib\kernel32.lib

.data
_void dq 0
txt db "12345678901234567890123456789012345678901234567890",0
ptxt dq txt

align 16
; ----------
; algorithms
; ----------
string_length \
db 72,139,193,72,131,232,1,72,131,192,1,128,56,0,116,63
db 72,131,192,1,128,56,0,116,54,72,131,192,1,128,56,0
db 116,45,72,131,192,1,128,56,0,116,36,72,131,192,1,128
db 56,0,116,27,72,131,192,1,128,56,0,116,18,72,131,192
db 1,128,56,0,116,9,72,131,192,1,128,56,0,117,184,72
db 43,193,195

memory_copy \
db 76,139,222,76,139,215,252,72,139,241,72,139,250,73,139,200
db 72,193,233,3,243,72,165,73,139,200,72,131,225,7,243,164
db 73,139,250,73,139,243,195

llen dq 83
plen dq string_length                   ; length & pointer to str len

lcpy dq 39
pcpy dq memory_copy                     ; length & pointer to mem copy

.code

mcopy proc
; rcx = source address
; rdx = destination address
; r8  = byte count

; --------------
; save rsi & rdi
; --------------
mov r11, rsi
mov r10, rdi

cld
mov rsi, rcx
mov rdi, rdx
mov rcx, r8

shr rcx, 3
rep movsq

mov rcx, r8
and rcx, 7
rep movsb

; -----------------
; restore rsi & rdi
; -----------------
mov rdi, r10
mov rsi, r11

ret

mcopy endp

StdOut proc
; rcx = text address

LOCAL bWritten :QWORD
LOCAL @r12:QWORD
LOCAL @r13:QWORD
LOCAL @r14:QWORD
LOCAL dwBytesWrite:DWORD                      

mov @r12, r12                       ; preserve non-volatile registers
mov @r13, r13
mov @r14, r14

mov r12, rcx                        ; store address in r12

invoke GetStdHandle,STD_OUTPUT_HANDLE
mov r13, rax

mov rax, r12
sub rax, 1
@@:
add rax, 1
cmp BYTE PTR [rax], 0               ; get the text length
jne @B
sub rax, r12                        ; sub original address from RAX
mov r14, rax                        ; save string length into r14
mov dwBytesWrite,eax

invoke WriteFile,r13,r12,dwBytesWrite,ADDR bWritten,NULL
mov rax, bWritten

mov r12, @r12                       ; restore non-volatile registers
mov r13, @r13
mov r14, @r14

ret

StdOut endp

strHex2str proc inQword:QWORD,outFmt:QWORD,outBuf:QWORD
invoke RtlZeroMemory, outBuf, 128
invoke wsprintf,outBuf,outFmt,inQword
ret

strHex2str endp

entry_point proc
LOCAL hMem  :QWORD                      ; original memory pointer
LOCAL pMem  :QWORD                      ; variable pointer for code locations
LOCAL cpym  :QWORD                      ; memory pointer for memcopy
LOCAL slen  :QWORD                      ; memory pointer for string length
LOCAL buffer[128]:byte

invoke VirtualAlloc,0,1024,MEM_COMMIT or MEM_RESERVE,PAGE_EXECUTE_READWRITE
mov hMem, rax                 ; allocate executable memory
mov pMem, rax

mov r8,lcpy
mov rdx,pMem
mov rcx,pcpy
call mcopy

mov rax,pMem
mov cpym,rax

add pMem, 128 ; next 128 byte location

mov r8,llen
mov rdx,pMem
mov rcx,plen
call cpym ; copy slen algo using algo in memory

mov rax,pMem
mov slen,rax

mov rcx,ptxt
call slen ;; run the string length algo
invoke strHex2str,rax,CStr("%u = string length",13,10),addr buffer
lea rcx,buffer
call StdOut

invoke VirtualFree,hMem,0,MEM_RELEASE
mov _void, rax                  ; release original memory address
invoke strHex2str,_void,CStr("%u = free memory return value"),addr buffer
lea rcx,buffer
call StdOut

invoke ExitProcess,NULL

entry_point endp

end


[2023春季班]《安卓高级研修班(网课)》月薪两万班招生中~

收藏
点赞0
打赏
分享
最新回复 (2)
雪    币: 2
活跃值: 活跃值 (13)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
kellygod 活跃值 2017-12-1 19:48
2
0
没大致说一下原理  扔个汇编  新手没看懂,
雪    币: 306
活跃值: 活跃值 (786)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
sixL 活跃值 2017-12-2 00:00
3
0
1、这里示例代码(内存拷贝和串长度计算)放在数据段中如何执行;
2、引申开:将代码压缩、加密放在数据段中,启动后再解压、解密、执行。
游客
登录 | 注册 方可回帖
返回