static memset(x,val,
len
)
{
auto i;
for
(i
=
0
; i <
len
; i
+
+
)
{
PatchByte(x
+
i,val);
}
}
/
/
是否为堆栈平衡
0
不为堆栈平衡 为堆栈平衡返回代码字节数
static IsStackBalance(x)
{
auto bsx;
bsx
=
Byte(x);
if
(bsx
=
=
0x48
&& Dword(x
+
1
)
=
=
0x0824648D
)
/
/
lea rsp,[rsp
+
8
]
{
return
5
;
}
else
if
(bsx >
=
0x58
&& bsx <
=
0x5F
)
/
/
pop rax
-
> rdi
{
return
1
;
}
else
if
(bsx
=
=
0x41
&& Byte(x
+
1
) >
=
0x58
&& Byte(x
+
1
) <
=
0x5F
)
/
/
pop r8
-
> r15
{
return
2
;
}
return
0
;
}
static IsFalseJump(x)
{
auto bsx,op,base,
len
;
bsx
=
Byte(x);
op
=
Byte(x
+
1
);
if
((bsx
=
=
0x48
|| bsx
=
=
0x49
)&& op >
=
0xB8
&& op <
=
0xBF
&&
(
(Byte(x
+
10
) >
=
0x50
&& Byte(x
+
10
) <
=
0x57
&& Byte(x
+
11
)
=
=
0xC3
) ||
(Byte(x
+
10
)
=
=
0x41
&& Byte(x
+
11
) >
=
0x50
&& Byte(x
+
11
) <
=
0x57
&& Byte(x
+
12
)
=
=
0xC3
)
)
)
/
/
mov rax
-
> r15 push rax
-
> r15 ret
{
base
=
Dword(x
+
2
);
base
=
base
+
(Dword(x
+
2
+
4
) <<
32
);
if
(base > x)
{
len
=
base
-
x ;
if
(
len
<
=
(
9
+
12
))
{
return
len
;
}
else
{
/
/
Message(
"find base:%X \n"
,x);
}
}
}
return
0
;
}
static main() {
auto x,FBin,ProcRange,StaclBytelen;
FBin
=
"E8 04 00 00 00"
;
/
/
call
+
4
for
(x
=
FindBinary(MinEA(),
0x03
,FBin);x !
=
BADADDR;x
=
FindBinary(x,
0x03
,FBin))
{
StaclBytelen
=
IsStackBalance(x
+
9
);
if
(StaclBytelen !
=
0
)
{
MakeCode(x
+
9
+
StaclBytelen);
memset(x,
0x90
,
9
+
StaclBytelen);
}
}
FBin
=
"E9 04 00 00 00"
;
/
/
jmp
+
4
for
(x
=
FindBinary(MinEA(),
0x03
,FBin);x !
=
BADADDR;x
=
FindBinary(x,
0x03
,FBin))
{
MakeCode(x
+
9
);
memset(x,
0x90
,
9
);
}
FBin
=
"C3"
;
/
/
mov rax
-
> r15
for
(x
=
FindBinary(MinEA(),
0x03
,FBin);x !
=
BADADDR;x
=
FindBinary(x,
0x03
,FBin))
{
StaclBytelen
=
IsFalseJump(x
-
11
);
if
(StaclBytelen !
=
0
)
{
MakeCode(x
-
11
+
StaclBytelen);
memset(x
-
11
,
0x90
,StaclBytelen);
}
StaclBytelen
=
IsFalseJump(x
-
12
);
if
(StaclBytelen !
=
0
)
{
MakeCode(x
-
12
+
StaclBytelen);
memset(x
-
12
,
0x90
,StaclBytelen);
}
}
AnalyzeArea (MinEA(),MaxEA());
}