能力值:
( LV4,RANK:50 )
|
-
-
4 楼
也算是开源了。 int __fastcall sub_140001070(DWORD th32ProcessID) { unsigned __int64 *v1; // r12 DWORD v2; // ebx char *v3; // r14 __int64 v4; // r8 __int64 v5; // r9 HANDLE v6; // rax __int64 v7; // r8 __int64 v8; // r9 void *v9; // r13 DWORD v10; // eax __int64 v11; // r8 __int64 v12; // r9 int result; // eax void *v14; // rsi HANDLE v15; // rax DWORD v16; // eax __int64 v17; // r8 __int64 v18; // r9 BYTE *v19; // rbx __int64 v20; // r8 __int64 v21; // r9 DWORD v22; // eax __int64 v23; // r8 __int64 v24; // r9 char *v25; // rcx int v26; // ebx signed __int64 v27; // rdi int v28; // er15 __int64 v29; // rdx unsigned int v30; // ebx __int64 v31; // r8 __int64 v32; // r9 __int64 v33; // r8 __int64 v34; // r9 __int64 v35; // r15 unsigned __int64 *v36; // rax DWORD v37; // eax __int64 v38; // r8 __int64 v39; // r9 __int64 v40; // rdx __int64 v41; // r8 __int64 v42; // r9 DWORD v43; // eax __int64 v44; // r8 __int64 v45; // r9 int v46; // edi unsigned __int64 *v47; // rbx unsigned __int64 v48; // r15 const wchar_t *v49; // rcx BYTE *v50; // rbx DWORD v51; // eax __int64 v52; // r8 __int64 v53; // r9 int v54; // [rsp+30h] [rbp-C0h] int v55; // [rsp+34h] [rbp-BCh] int v56; // [rsp+38h] [rbp-B8h] int v57; // [rsp+3Ch] [rbp-B4h] int v58; // [rsp+40h] [rbp-B0h] char v59; // [rsp+44h] [rbp-ACh] MODULEENTRY32W me; // [rsp+50h] [rbp-A0h] void *retaddr; // [rsp+4C8h] [rbp+3D8h] BYTE *lpBaseAddress; // [rsp+4D0h] [rbp+3E0h] BYTE *lpBaseAddressa; // [rsp+4D0h] [rbp+3E0h]
v1 = 0i64; v2 = th32ProcessID; v3 = 0i64; sub_140004A50((__int64)"->"); sub_140001010((__int64)L"ProcessId = %d\n", v2, v4, v5); v6 = OpenProcess(0x438u, 0, v2); v9 = v6; if ( !v6 ) { v10 = GetLastError(); result = sub_140001010((__int64)L"open process fail! error = %d\n", v10, v11, v12); v14 = retaddr; goto LABEL_24; } sub_140001010((__int64)L"hProcess = %d\n", (__int64)v6, v7, v8); me.dwSize = 1080; v15 = CreateToolhelp32Snapshot(8u, v2); v14 = v15; if ( v15 == (HANDLE)-1i64 ) { v16 = GetLastError(); sub_140001010((__int64)L"CreateToolhelp32Snapshot TH32CS_SNAPMODULE fail! error = %d\n", v16, v17, v18); } else { Module32FirstW(v15, &me); while ( (unsigned int)sub_14000319C(&me.modBaseSize, L"vmware-vmx.exe") ) Module32NextW(v14, &me); v19 = me.modBaseAddr; lpBaseAddress = me.modBaseAddr; v3 = (char *)sub_140004DE4(4096i64); if ( ReadProcessMemory(v9, v19, v3, 0x1000ui64, 0i64) ) { if ( *(_WORD *)v3 != 0x5A4D ) goto LABEL_23; v25 = &v3[*((signed int *)v3 + 15)]; if ( *(_DWORD *)v25 != 0x4550 ) goto LABEL_23; v26 = 0; v27 = (signed __int64)&v25[*((unsigned __int16 *)v25 + 10) + 24]; v28 = *((unsigned __int16 *)v25 + 3); if ( *((_WORD *)v25 + 3) ) { do { if ( !(unsigned int)sub_140004CD4(v27, ".text") ) break; v27 += 40i64; ++v26; } while ( v26 < v28 ); } v29 = (__int64)lpBaseAddress; v30 = *(_DWORD *)(v27 + 8); lpBaseAddressa = &lpBaseAddress[*(unsigned int *)(v27 + 12)]; sub_140001010((__int64)L"VMX Base = %llX\n", v29, v20, v21); sub_140001010((__int64)L"VMX Code Section = %llX\n", (__int64)lpBaseAddressa, v31, v32); sub_140001010((__int64)L"VMX Code Section Size = %X\n", v30, v33, v34); v35 = v30; v36 = (unsigned __int64 *)VirtualAlloc(0i64, v30, 0x1000u, 0x40u); v1 = v36; if ( v36 ) { if ( ReadProcessMemory(v9, lpBaseAddressa, v36, v30, 0i64) ) { v46 = 0; v54 = 0x2B9; v55 = 0xBAC08400; v47 = v1; v56 = 4; v57 = 0xB9D1450F; v58 = 1; v59 = 0xE8u; LODWORD(retaddr) = 0x586A756E; v48 = v35 - 21; if ( v48 ) { while ( (unsigned int)sub_140014550(v47, (__int64)&v54, 0x15ui64) ) { ++v46; v47 = (unsigned __int64 *)((char *)v47 + 1); if ( v46 >= v48 ) goto LABEL_21; } v50 = &lpBaseAddressa[(_DWORD)v47 - (_DWORD)v1 - 28]; sub_140001010((__int64)L"VMX Code Section Taeget = %llX\n", (__int64)v50, v41, v42); if ( !WriteProcessMemory(v9, v50, &retaddr, 4ui64, 0i64) ) { v51 = GetLastError(); sub_140001010((__int64)L"write VMXCode memory fail! error = %d\n", v51, v52, v53); goto LABEL_23; } v49 = L"Patch Successful...\n"; } else { LABEL_21: v49 = L"vmxh information obtain fail, patched? please check.\n"; } sub_140001010((__int64)v49, v40, v41, v42); } else { v43 = GetLastError(); sub_140001010((__int64)L"read VMXCode memory fail! error = %d\n", v43, v44, v45); } } else { v37 = GetLastError(); sub_140001010((__int64)L"alloc VMXCode memory fail! error = %d\n", v37, v38, v39); } } else { v22 = GetLastError(); sub_140001010((__int64)L"ReadProcessMemory fail! error = %d\n", v22, v23, v24); } } LABEL_23: result = CloseHandle(v9); LABEL_24: if ( v14 != (void *)-1i64 ) result = CloseHandle(v14); if ( v3 ) result = sub_140004DD0(v3); if ( v1 ) result = VirtualFree(v1, 0i64, 0x8000u); return result; }
|
能力值:
( LV3,RANK:20 )
|
-
-
16 楼
不晓得楼主有时间看我的回帖不, 我用的VmWare15 pro 版本是 15.5.1 ,试了一下您的东西,,in eax,dx检测没过去,,不知道为什么。。 希望楼主百忙中抽出时间解答下。。
|