在shelllwolf 的
反调试技巧总结-原理和实现中有一段int3/popf反调试:
__asm
{
push offset e_handler; set exception handler
push dword ptr fs:[0h]
mov dword ptr fs:[0h],esp
xor eax,eax;reset EAX invoke int3
int 3h
pushfd
nop
nop
nop
nop
pop dword ptr fs:[0h];restore exception handler
add esp,4
test eax,eax; check the flag
je rf_label
jmp rt_label
e_handler:
push offset e_handler1; set exception handler
push dword ptr fs:[0h]
mov dword ptr fs:[0h],esp
xor eax,eax;reset EAX invoke int3
int 3h
nop
pop dword ptr fs:[0h];restore exception handler
add esp,4
;EAX = ContextRecord
mov ebx,eax;dr0=>ebx
mov eax,dword ptr [esp+0xc]
;set ContextRecord.EIP
inc dword ptr [eax+0xb8];
mov dword ptr [eax+0xb0],ebx;dr0=>eax
xor eax,eax
retn
e_handler1:
;EAX = ContextRecord
mov eax,dword ptr [esp+0xc]
;set ContextRecord.EIP
inc dword ptr [eax+0xb8];
mov ebx,dword ptr[eax+0x04]
mov dword ptr [eax+0xb0],ebx;dr0=>eax
xor eax,eax
retn
rt_label:
xor eax,eax
inc eax
mov esp,ebp
pop ebp
retn
rf_label:
xor eax,eax
mov esp,ebp
pop ebp
retn
}
我在OllyICE上F9测试失败(没有hideod),跟直接运行一样
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!