|
Exception proc pRecord,pFrame,pContext,pDispatch
call PushSehBackProc
call ClearSehFrame
jmp ecx
PushSehBackProc:
pop ecx
mov eax,pContext
mov [eax.cx_Eip],ecx
xor eax,eax ;忽略错误继续执行
ret
Exception endp
GetEspAddr:
call PushOffsetEspAddr
dd ?
PushOffsetEspAddr:
pop edx
ret
.code
Start:
call PushErrorProc
call MessageBoxA,0,offset Msg,offset Msg,0
ret
PushErrorProc:
pop ecx
call SetSehFrame
mov ds:[0],eax
call ClearSehFrame
ret
end Start
作了如此多我们的代码就安全了吗？？
No!!
对方还有Soft-ICE 这个极品——呵呵，刚才的那些代码遇到她就。。。为死去的人默哀三分钟〉〉
可是道高一尺，魔高一丈——还是有办法的。。。
看下面的代码
；----------简单的代码做出重要的事情------------
.586p
.model flat
extrn CreateFileA:PROC
extrn CloseHandle:PROC
extrn MessageBoxA:PROC
extrn ExitProcess:PROC
.data
szTitle db "SoftICE detection",0
szMessage db "SoftICE for Win9x : "
answ1 db "not found!",10
db "SoftICE for WinNT : "
answ2 db "not found!",10
nfnd db "found! ",10
SICE9X db "\\.\SICE",0
SICENT db "\\.\NTICE",0
.code
NoSoftICE:
push 00000000h ; 针对SoftICE for Win9x的检测
push 00000080h
push 00000003h
push 00000000h
push 00000001h
push 0C0000000h
push offset SICE9X
call CreateFileA
inc eax
jz NoSICE9X
dec eax
push eax ; 关闭局柄
call CloseHandle
lea edi,answ1 ; SoftICE for win9x found!找到了找到了——呵呵，你死了
call PutFound
NoSICE9X:
push 00000000h ;针对SoftICE for WinNT的检测
push 00000080h
push 00000003h
push 00000000h
push 00000001h
push 0C0000000h
push offset SICENT
call CreateFileA
inc eax
jz NoSICENT
dec eax
push eax ; 关闭局柄
call CloseHandle
lea edi,answ2 ; SoftICE for WinNT found!——呵呵，你想怎样就怎样
call PutFound
NoSICENT:
push 00h
push offset szTitle ; 显示结果
push offset szMessage
push 00h
call MessageBoxA
push 00h ; 结束程序
call ExitProcess
PutFound:；在这里是找到后的表情——you know what i meant??
mov ecx,0Bh
lea esi,nfnd
rep movsb
ret
end NoSoftICE
以后有机会在谈些反静态分析的方法上一页 [1] [2] |
