寻找0XCC软件断点



配合反汇编引擎效果出奇;

Here is what I see in hacker defense testing 0xCC software breakpoints

;I write it with FASM assembler

include 'win32ax.inc'

use32

entry start

section '.text' code readable executable

start:

push ebp

mov ebp,esp

mov eax,[fs:30h] ;peb

mov ebx, dword[eax+08h] ;Imagebase

mov dword [imagebassaddress],ebx

mov eax,[eax+0ch]

mov eax,[eax+0ch]

mov ebx, dword [eax+20h] ;sizeofimage

mov dword [sizeofimage],ebx

invoke CreateThread,NULL,NULL,fuckocc,NULL,0,NULL

fucknima:

mov ecx,10

loop fucknima

mov esp,ebp

pop ebp

invoke exit,NULL

fuckocc:

;Function implementation

push ebp

mov ebp,esp

fuckcc_loop:

mov al,0xcc

mov edi,dword [imagebaseaddress];get ima