能力值：
( LV6，RANK：90 )
2 楼
第1,3个组合：
能力值：
( LV12，RANK：250 )
21 楼
贴一些常用的变形代码（摘自月中人翻译的《变形实践》，vmprotect里用到不少），给愿意一起研究的看一下
BTW:是我的马甲
1、
XOR Reg,-1 --> NOT Reg
XOR Mem,-1 --> NOT Mem
MOV Reg,Reg --> NOP
SUB Reg,Imm --> ADD Reg,-Imm
SUB Mem,Imm --> ADD Mem,-Imm
XOR Reg,0 --> MOV Reg,0
XOR Mem,0 --> MOV Mem,0
ADD Reg,0 --> NOP
ADD Mem,0 --> NOP
OR Reg,0 --> NOP
OR Mem,0 --> NOP
AND Reg,-1 --> NOP
AND Mem,-1 --> NOP
AND Reg,0 --> MOV Reg,0
AND Mem,0 --> MOV Mem,0
XOR Reg,Reg --> MOV Reg,0
SUB Reg,Reg --> MOV Reg,0
OR Reg,Reg --> CMP Reg,0
AND Reg,Reg --> CMP Reg,0
TEST Reg,Reg --> CMP Reg,0
LEA Reg,[Imm] --> MOV Reg,Imm
LEA Reg,[Reg+Imm] --> ADD Reg,Imm
LEA Reg,[Reg2] --> MOV Reg,Reg2
LEA Reg,[Reg+Reg2] --> ADD Reg,Reg2
LEA Reg,[Reg2+Reg2+xxx]--> LEA Reg,[2*Reg2+xxx]
MOV Reg,Reg --> NOP
MOV Mem,Mem--> NOP
2、
PUSH Imm / POP Reg --> MOV Reg,Imm
PUSH Imm / POP Mem --> MOV Mem,Imm
PUSH Reg / POP Reg2 --> MOV Reg2,Reg
PUSH Reg / POP Mem --> MOV Mem,Reg
PUSH Mem / POP Reg --> MOV Reg,Mem
PUSH Mem / POP Mem2--> MOV Mem2,MemMOV Mem,Reg/PUSH Mem --> PUSH Reg
POP Mem / MOV Reg,Mem --> POP Reg
POP Mem2 / MOV Mem,Mem2 --> POP Mem
MOV Mem,Reg / MOV Reg2,Mem --> MOV Reg2,Reg
MOV Mem,Imm / PUSH Mem --> PUSH Imm
MOV Mem,Imm / OP Reg,Mem --> OP Reg,Imm
MOV Reg,Imm / ADD Reg,Reg2 --> LEA Reg,[Reg2+Imm]
MOV Reg,Reg2 / ADD Reg,Imm --> LEA Reg,[Reg2+Imm]
MOV Reg,Reg2 / ADD Reg,Reg3 --> LEA Reg,[Reg2+Reg3]
ADD Reg,Imm / ADD Reg,Reg2 --> LEA Reg,[Reg+Reg2+Imm]
ADD Reg,Reg2 / ADD Reg,Imm --> LEA Reg,[Reg+Reg2+Imm]
OP Reg,Imm / OP Reg,Imm2 --> OP Reg,(Imm OP Imm2)
OP Mem,Imm / OP Mem,Imm2 --> OP Mem,(Imm OP Imm2)
LEA Reg,[Reg2+Imm] / ADD Reg,Reg3 --> LEA Reg,[Reg2+Reg3+Imm]
LEA Reg,[(RegX+)Reg2+Imm] / ADD Reg,Reg2--> LEA Reg,[(RegX+)2*Reg2+Imm]
POP Mem / PUSH Mem --> NOP
MOV Mem2,Mem / MOV Mem3,Mem2 --> MOV Mem3,Mem
MOV Mem2,Mem / OP Reg,Mem2 --> OP Reg,Mem
MOV Mem2,Mem / MOV Mem2,xxx --> MOV Mem2,xxx
MOV Mem,Reg / CALL Mem --> CALL Reg
MOV Mem,Reg / JMP Mem --> JMP Reg
MOV Mem2,Mem / CALL Mem2 --> CALL Mem
MOV Mem2,Mem / JMP Mem2 --> JMP Mem
MOV Mem,Reg / MOV Mem2,Mem --> MOV Mem2,Reg
OP Reg,xxx / MOV Reg,yyy --> MOV Reg,yyy
Jcc @xxx / !Jcc @xxx--> JMP @xxx (this applies to (Jcc & 0FEh) with(Jcc | 1)
NOT Reg / NEG Reg --> ADD Reg,1
NOT Reg / ADD Reg,1 --> NEG Reg
NOT Mem / NEG Mem --> ADD Mem,1
NOT Mem / ADD Mem,1 --> NEG Mem
NEG Reg / NOT Reg --> ADD Reg,-1
NEG Reg / ADD Reg,-1 --> NOT Reg
NEG Mem / NOT Mem --> ADD Mem,-1
NEG Mem / ADD Mem,-1 --> NOT Mem
CMP X,Y / != Jcc (CMP without Jcc) --> NOP
TEST X,Y / != Jcc --> NOP
POP Mem / JMP Mem --> RET
PUSH Reg / RET --> JMP Reg
CALL Mem / MOV Mem2,EAX --> CALL Mem / APICALL_STORE Mem2
MOV Reg,Mem / CALL Reg --> CALL Mem
XOR Reg,Reg / MOV Reg8,[Mem] --> MOVZX Reg,byte ptr [Mem]
MOV Reg,[Mem] / AND Reg,0FFh --> MOVZX Reg,byte ptr [Mem]
3、
MOV Mem,Reg
OP Mem,Reg2
MOV Reg,Mem
--> OP Reg,Reg2
MOV Mem,Reg
OP Mem,Imm
MOV Reg,Mem
--> OP Reg,Imm
MOV Mem,Imm
OP Mem,Reg
MOV Reg,Mem
--> OP Reg,Imm (it can't be SUB)
MOV Mem2,Mem
OP Mem2,Reg
MOV Mem,Mem2
--> OP Mem,Reg
MOV Mem2,Mem
OP Mem2,Imm
MOV Mem,Mem2
--> OP Mem,Imm
CMP Reg,Reg
JO/JB/JNZ/JA/JS/JNP/JL/JG @xxx
!= Jcc
--> NOP
CMP Reg,Reg
JNO/JAE/JZ/JBE/JNS/JP/JGE/JLE @xxx
!= Jcc
--> JMP @xxx
MOV Mem,Imm
CMP/TEST Reg,Mem
Jcc @xxx
--> CMP/TEST Reg,Imm
Jcc @xxx
MOV Mem,Reg
SUB/CMP Mem,Reg2
Jcc @xxx
--> CMP Reg,Reg2
Jcc @xxx
MOV Mem,Reg
AND/TEST Mem,Reg2
Jcc @xxx
--> TEST Reg,Reg2
Jcc @xxx
MOV Mem,Reg
SUB/CMP Mem,Imm
Jcc @xxx
--> CMP Reg,Imm
Jcc @xxx
MOV Mem,Reg
AND/TEST Mem,Imm
Jcc @xxx
--> TEST Reg,Imm
Jcc @xxx
MOV Mem2,Mem
CMP/TEST Reg,Mem2
Jcc @xxx
--> CMP/TEST Reg,Mem
Jcc @xxx
MOV Mem2,Mem
AND/TEST Mem2,Reg
Jcc @xxx
--> TEST Mem,Reg
Jcc @xxx
MOV Mem2,Mem
SUB/CMP Mem2,Reg
Jcc @xxx
--> CMP Mem,Reg
Jcc @xxx
MOV Mem2,Mem
AND/TEST Mem2,Imm
Jcc @xxx
--> TEST Mem,Imm
Jcc @xxx
MOV Mem2,Mem
SUB/CMP Mem2,Imm
Jcc @xxx
--> CMP Mem,Imm
Jcc @xxx
PUSH EAX
PUSH ECX
PUSH EDX
--> APICALL_BEGIN
POP EDX
POP ECX
POP EAX
--> APICALL_END
