我听见脚步声是你尿的软皮鞋根

好虚伪
//code by skylly
//for shoooo's vm engine
gpa "VirtualFree", "kernel32.dll"
cmp $RESULT,0
je err
var VF
mov VF,$RESULT
bp VF
esto
esto
esto
bc VF
rtu

find eip,#FFE0#
cmp $RESULT,0
je err
go $RESULT
sti
//vm start here

fuckvm:
//首先找到 op_code起始地址
var temp
lps:
mov temp,[eip]
and temp,FF
cmp temp,E9  //jmp
je vmstart
sti
jmp lps

vmstart:
sti
var addr
mov addr,[esp]
cmt eip,"请等待分析过程..."
//解析
anly:
var tempcode
mov tempcode,[addr]
and tempcode,FF
cmp tempcode,0C
je vm_0C
cmp tempcode,0D
je vm_0D
cmp tempcode,13
je vm_13
cmp tempcode,14
je vm_14
cmp tempcode,1C
je vm_1C
cmp tempcode,2C
je vm_2C
cmp tempcode,2D
je vm_2D
cmp tempcode,35
je vm_35
cmp tempcode,39
je vm_39
cmp tempcode,3D
je vm_3D
cmp tempcode,3F
je vm_3F
cmp tempcode,42
je vm_42
cmp tempcode,45
je vm_45
cmp tempcode,48
je vm_48
cmp tempcode,4A
je vm_4A
cmp tempcode,4F
je vm_4F
cmp tempcode,54
je vm_54
cmp tempcode,55
je vm_55
cmp tempcode,5C
je vm_5C
cmp tempcode,5E
je vm_5E
cmp tempcode,60
je vm_60
cmp tempcode,61
je vm_5E //这里和5e一样的操作
cmp tempcode,64
je vm_5E //这里和5e一样的操作
cmp tempcode,68
je vm_68
cmp tempcode,6A
je vm_6A
cmp tempcode,76
je vm_5E //这里和5e一样的操作
cmp tempcode,78
je vm_5E //这里和5e一样的操作
cmp tempcode,7A
je vm_7A
cmp tempcode,7B
je vm_7B
cmp tempcode,7D
je vm_7D
//to be continue...

jmp unknown

vm_0C:
//je neweip
var code
var reg
inc addr
mov reg,[addr]
and reg,FF
cmp reg,1A
jne err
inc addr
mov code,[addr]
add addr,4
add code,addr
sub addr,5
eval "{addr}: je {code}"
log $RESULT
add addr,5      
var addr1
var addr2
mov addr1,addr
mov addr2,code
bphws addr1,"r"
bphws addr2,"r"
esto
bphwc addr1
bphwc addr2
mov addr,esi
dec addr
jmp anly

vm_0D:
//or vm_reg1 vm_reg2
var reg1
var reg2
inc addr
mov reg1,[addr]
and reg1,FF
inc addr
mov reg2,[addr]
and reg2,FF
sub addr,2
eval "{addr}: or vmreg_{reg2}, vmreg_{reg1}"
log $RESULT
add addr,3
jmp anly

vm_13:
//and 400, vm_reg
//push 结果
var code
inc addr
mov code,[addr]
and code,FF
dec addr
eval "{addr}: and [esp], 400, vmreg_{code}"
log $RESULT
add addr,2
jmp anly

vm_14:
//mov fs: [vm_reg1], vm_reg2
var reg1
var reg2
inc addr
mov reg1,[addr]
and reg1,FF
inc addr
mov reg2,[addr]
and reg2,FF
sub addr,2
eval "{addr}: mov dword ptr fs: [vmreg_{reg2}], vmreg_{reg1}"
log $RESULT
add addr,3
jmp anly

vm_1C:
//mov vm_reg,const
var code
var reg
inc addr
mov code,[addr]
add addr,4
mov reg,[addr]
and reg,FF
sub addr,5
eval "{addr}: mov vmreg_{reg}, {code}"
log $RESULT
add addr,6
jmp anly

vm_2C:
//add vm_reg, esi
var code
inc addr
mov code,[addr]
and code,FF
dec addr
eval "{addr}: add vmreg_{code}, esi"
log $RESULT
add addr,2
jmp anly

vm_2D:
//mov word vm_reg1,[vm_reg2]
var reg1
var reg2
inc addr
mov reg1,[addr]
and reg1,FF
inc addr
mov reg2,[addr]
and reg2,FF
sub addr,2
eval "{addr}: mov word vmreg_{reg2}, [vmreg_{reg1}]"
log $RESULT
add addr,3
jmp anly

vm_35:
//mov byte ptr vm_reg1, vm_reg2
var reg1
var reg2
inc addr
mov reg1,[addr]
and reg1,FF
inc addr
mov reg2,[addr]
and reg2,FF
sub addr,2
eval "{addr}: mov byte vmreg_{reg2}, vmreg_{reg1}"
log $RESULT
add addr,3
jmp anly

vm_39:
//xor vm_reg1 vm_reg2
var reg1
var reg2
inc addr
mov reg1,[addr]
and reg1,FF
inc addr
mov reg2,[addr]
and reg2,FF
sub addr,2
eval "{addr}: xor vmreg_{reg2}, vmreg_{reg1}"
log $RESULT
add addr,3
jmp anly

vm_3D:
//pop vm_reg
var code
inc addr
mov code,[addr]
and code,FF
dec addr
eval "{addr}: pop vmreg_{code}"
log $RESULT
add addr,2
jmp anly

vm_3F:
//and byte ptr vm_reg1, vm_reg2
var reg1
var reg2
inc addr
mov reg1,[addr]
and reg1,FF
inc addr
mov reg2,[addr]
and reg2,FF
sub addr,2
eval "{addr}: and byte vmreg_{reg2}, vmreg_{reg1}"
log $RESULT
add addr,3
jmp anly

vm_42:
//mov [vm_reg1],vm_reg2
var reg1
var reg2
inc addr
mov reg1,[addr]
and reg1,FF
inc addr
mov reg2,[addr]
and reg2,FF
sub addr,2
eval "{addr}: mov [vmreg_{reg2}], vmreg_{reg1}"
log $RESULT
add addr,3
jmp anly

vm_45:
//sub vm_reg1,vm_reg2
var reg1
var reg2
inc addr
mov reg1,[addr]
and reg1,FF
inc addr
mov reg2,[addr]
and reg2,FF
sub addr,2
eval "{addr}: sub vmreg_{reg2}, vmreg_{reg1}"
log $RESULT
add addr,3
jmp anly

vm_48:
//jmp neweip
var code
var reg
inc addr
mov reg,[addr]
and reg,FF
cmp reg,1A
jne err
inc addr
mov code,[addr]
add addr,4
add code,addr
sub addr,5
eval "{addr}: jmp {code}"
log $RESULT
add addr,5
mov addr,code     //跳转了
jmp anly

vm_4A:
//mov ebp, vm_reg
var code
inc addr
mov code,[addr]
and code,FF
dec addr
eval "{addr}: mov ebp, vmreg_{code}]"
log $RESULT
add addr,2
jmp anly

vm_4F:
//shr dword vm_reg1,vm_reg2
var reg1
var reg2
inc addr
mov reg1,[addr]
and reg1,FF
inc addr
mov reg2,[addr]
and reg2,FF
sub addr,2
eval "{addr}: shr vmreg_{reg2}, vmreg_{reg1}"
log $RESULT
add addr,3
jmp anly

vm_54:
//push vm_reg
var code
inc addr
mov code,[addr]
and code,FF
dec addr
eval "{addr}: push vmreg_{code}"
log $RESULT
add addr,2
jmp anly

vm_55:
//retn to a real api call
eval "{addr}: out of vm"
log $RESULT
//add addr,1
bphws addr,"r"
esto
bphwc addr

mov addr,ebp
add addr,24
var temp
mov temp,[addr]
eval "jmp api: {temp}"
log $RESULT
add addr,4
mov addr,[addr]

cmp temp,10000000
jb end          //如果不是个api地址

bphws addr,"x"
esto

vmreturn:
bphwc addr
jmp fuckvm

vm_5C:
//pushfd
//or [esp],vm_13的运行结果
//pop vm_reg
var code
inc addr
mov code,[addr]
and code,FF
dec addr
eval "{addr}: or vmreg_{code}, eflag, [esp]"
log $RESULT
add addr,2
jmp anly

vm_5E:
//mov vm_reg1,vm_reg2
var reg1
var reg2
inc addr
mov reg1,[addr]
and reg1,FF
inc addr
mov reg2,[addr]
and reg2,FF
sub addr,2
eval "{addr}: mov vmreg_{reg2}, vmreg_{reg1}"
log $RESULT
add addr,3
jmp anly

vm_60:
//jne neweip
var code
var reg
inc addr
mov reg,[addr]
and reg,FF
cmp reg,1A
jne err
inc addr
mov code,[addr]
add addr,4
add code,addr
sub addr,5
eval "{addr}: jne {code}"
log $RESULT
add addr,5      
var addr1
var addr2
mov addr1,addr
mov addr2,code
bphws addr1,"r"
bphws addr2,"r"
esto
bphwc addr1
bphwc addr2
mov addr,esi
dec addr
jmp anly

vm_68:
//shl dword vm_reg1,vm_reg2
var reg1
var reg2
inc addr
mov reg1,[addr]
and reg1,FF
inc addr
mov reg2,[addr]
and reg2,FF
sub addr,2
eval "{addr}: shl vmreg_{reg2}, vmreg_{reg1}"
log $RESULT
add addr,3
jmp anly

vm_6A:
//add vm_reg1,vm_reg2
var reg1
var reg2
inc addr
mov reg1,[addr]
and reg1,FF
inc addr
mov reg2,[addr]
and reg2,FF
sub addr,2
eval "{addr}: add vmreg_{reg2}, vmreg_{reg1}"
log $RESULT
add addr,3
jmp anly

vm_7A:
//mov byte vm_reg1,[vm_reg2]
var reg1
var reg2
inc addr
mov reg1,[addr]
and reg1,FF
inc addr
mov reg2,[addr]
and reg2,FF
sub addr,2
eval "{addr}: mov byte vmreg_{reg2}, [vmreg_{reg1}]"
log $RESULT
add addr,3
jmp anly

vm_7B:
//and vm_reg1,vm_reg2
var reg1
var reg2
inc addr
mov reg1,[addr]
and reg1,FF
inc addr
mov reg2,[addr]
and reg2,FF
sub addr,2
eval "{addr}: and vmreg_{reg2}, vmreg_{reg1}"
log $RESULT
add addr,3
jmp anly

vm_7D:
//mov vm_reg1, (vm_reg2 shr 8; and FF)
var reg1
var reg2
inc addr
mov reg1,[addr]
and reg1,FF
inc addr
mov reg2,[addr]
and reg2,FF
sub addr,2
eval "{addr}: mov vmreg_{reg2}, (vmreg_{reg1} shr 8; and FF)"
log $RESULT
add addr,3
jmp anly

unknown:
eval "unkonw code at: {addr}"
log $RESULT
msg $RESULT
ret

end:
//vm外的代码
bphws temp,"x"
esto
bphwc temp
cmt eip,"here is not vmed"
bphws addr,"x"
esto
jmp vmreturn
ret

err:
msg "error"
ret

我每次加出来的pcode都是随机的

学习一下
123456

顶了再看~~~

那就再把记事本加个壳放出来呀
学习一下

学习.......

放个看雪上主页跑hash的工具
直接反pcode对有vm经验的人没什么难度
关键是反出来的东西整理成有意义的可读的代码
我下面的工作会在这方面下功夫

上传的附件：

• ultra.rar （86.94kb，30次下载）

还不忘记切换mj，佩服

我有一个插件, 马桶下同时30个马甲一起登录论坛

MJ成灾

那么多的马甲难道不会忘记密码?难道建立了马甲数据库?

我猜密码是ID的md5

估计还有个自动输入密码的插件

这个号的名字起的相当有深度,要是能配个合适的头像,再刷篇精华,就可以成为精品了。

开眼界了
123456

我听见脚步声是预料的软皮鞋跟，他推开门晚风好冷没有的预征。

密码保存的,自动登陆