//随便写的混淆指令用于被探测到调试后执行迷惑调试人员,很多实现效率很差心血来潮的话再来改改-_-
_declspec(naked)void jmpFunction(DWORD Memory) {
__asm {
mov ebp,esp
push ebp
jmp dword ptr ss:[ebp+0x4]
pop ebp
retn
}
}
_declspec(naked)void memoryCopy(void *SourceMemory,void *TargeMemory) {
__asm {
mov ebp,esp
pushad
mov ecx,0x4096
mov edx,dword ptr ss:[ebp+0x4]
mov eax,dword ptr ss:[ebp+0x4]
mov ebx,dword ptr ss:[ebp+0x8]
copyMain:
mov edi,dword ptr ds:[ebx]
mov dword ptr ds:[edx],edi
inc edx
inc ebx
dec ecx
test ecx,ecx
jnz copyMain
popad
retn
}
}
int main() {
BYTE* memoryByte = (BYTE *)malloc(0x4096);
BYTE CompilationData[16] = {
0xEB,0x59,0x5F,0x55,0x5D,
0xFF,0x74,0x75,0x8B,0xC3,
0xCC,0x01,0x00,0x33,0xEB,0xE8
};
BYTE shamCompilation[4096] = { 0x0 };
DWORD shamMemory = (DWORD)&shamCompilation;
for (int i = 0; i <4096; i++) {
shamCompilation[i] = CompilationData[rand() % 16];
}
memoryCopy(memoryByte,shamCompilation);
jmpFunction(shamMemory);
}
ASM内存花指令
最新推荐文章于 2023-01-28 23:52:44 发布