linux 自修改代码 smc,[Win32]自修改代码SMC

该楼层疑似违规已被系统折叠 隐藏此楼查看此楼

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

; SMC.ASM is a test piece for reading and writing to the code section

; of a PE file. In this example, there are two procedures, one which

; is called, the second that is read and written at the address

; of the first. The proc is called twice, before & after the code has

; been modified.

; --------------By G-Spider

; fasm smc.asm smc.exe

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

format PE GUI 4.0

entry start

include 'win32a.inc'

section '.text' code readable writeable executable

start:

call f1

mov esi,f2.rpStart

mov edi,f1.ppStart

mov ecx,f2.rpEnd-f2.rpStart

rep movsb

call f1

ret

;---------------------------------------------

f1:

.ppStart:

invoke MessageBox,0,Phony,ttl1,MB_OK

ret

.ppEnd:

;**********************************************

if (f2.rpEnd-f2.rpStart) > (f1.ppEnd-f1.ppStart)

repeat (f2.rpEnd-f2.rpStart)-(f1.ppEnd-f1.ppStart)

nop

end repeat

end if

;**********************************************

f2:

.rpStart:

cinvoke wsprintf,lpBuf,Replc,f1.ppStart-$$

invoke MessageBox,0,lpBuf,ttl2,MB_OK

ret

.rpEnd:

;---------------------------------------------

Phony db 'This is 1st call of proc',0

Replc db 'This is 2nd call of proc',0ah,'Current offset=%0Xh',0

ttl1 db "Original Code",0

ttl2 db "Replacement Code",0

lpBuf rb 64

section '.idata' import data readable writeable

library user32,'user32.dll'

import user32,\

MessageBox,'MessageBoxA',\

wsprintf,'wsprintfA'