检测虚拟机代码总汇(更新中)

　检测虚拟机代码
 1 004092D0  /.  55            push ebp
 2 004092D1  |.  8BEC          mov ebp,esp
 3 004092D3  |.  51            push ecx
 4 004092D4  |.  53            push ebx
 5 004092D5  |.  68 1D934000   push 0040931D                    
 6 004092DA  |.  64:FF35 00000>push dword ptr fs:[0]
 7 004092E1  |.  64:8925 00000>mov dword ptr fs:[0],esp
 8 004092E8  |.  52            push edx
 9 004092E9  |.  51            push ecx
10 004092EA  |.  53            push ebx
11 004092EB  |.  B8 68584D56   mov eax,0x564D5868
12 004092F0  |.  BB 00000000   mov ebx,0x0
13 004092F5  |.  B9 0A000000   mov ecx,0xA
14 004092FA  |.  BA 58560000   mov edx,0x5658
15 004092FF  |.  ED            in eax,dx
16 00409300  |.  81FB 68584D56 cmp ebx,0x564D5868
17 00409306  |.  0F9445 FF     sete byte ptr ss:[ebp-0x1]
18 0040930A  |.  5B            pop ebx
19 0040930B  |.  59            pop ecx
20 0040930C  |.  5A            pop edx
21 0040930D  |.  64:8F05 00000>pop dword ptr fs:[0]
22 00409314  |.  83C4 10       add esp,0x10
23 00409317      B8 01000000   mov eax,0x1
24 0040931C  \.  C3            retn


特征码:B8 68 58 4D 56 BB 00 00 00 00 B9 0A 00 00 00 BA 58 56 00 00 ED 81 FB 68 58 4D 56

 

 

 

转载于:https://www.cnblogs.com/nXaqL/p/3571260.html