好友
阅读权限10
听众
最后登录1970-1-1
|
#pragma region MSangoCRC
DWORD MS_CRC1_RET,MS_CRC2_RET;
unsigned char *MS_Memory, *EN_Memory, *dhF_Memory;
unsigned int MS_Memory_Start, MS_Memory_End, EN_Memory_Start, EN_Memory_End, dhF_Memory_Start, dhF_Memory_End;
DWORD dw_ms1_dhfzw = 0x1DAF50;
DWORD dw_ms1_dhfzwRet = 0x18EF01;
DWORD dw_MSSer = 0;
DWORD dw_ms_size, dw_ms_end, dw_en_size, dw_en_end, dw_dhf_size, dw_dhf_end;
DWORD dw_ij, dw_ijend;
long int dw_im, dw_imend;
void _declspec(naked) Ms1_crc()
{
//检测自身的CRC
/*
dhFactory.dll+108C9B - 8B 45 00 - mov eax,[ebp+00] //这边
dhFactory.dll+108C9E - F8 - clc
dhFactory.dll+108C9F - 66 0FB3 E9 - btr cx,bp
dhFactory.dll+108CA3 - 66 0FBB D9 - btc cx,bx
dhFactory.dll+108CA7 - 66 0FBE D1 - movsx dx,cl
dhFactory.dll+108CAB - 33 C3 - xor eax,ebx
*/
VMProtectBegin("ms1crc");
_asm
{
cmp ebp, [MS_Memory_Start]
jb En1_CRC
cmp ebp, [MS_Memory_End]
ja En1_CRC
sub ebp, [MS_Memory_Start]
add ebp, [MS_Memory]
jmp Ending_MS1CRC
En1_CRC:
cmp ebp, [EN_Memory_Start]
jb dhF1_CRC
cmp ebp, [EN_Memory_End]
ja dhF1_CRC
sub ebp, [EN_Memory_Start]
add ebp, [EN_Memory]
jmp Ending_MS1CRC
dhF1_CRC:
cmp ebp, [dhF_Memory_Start]
jb Ending_MS1CRC
cmp ebp, [dhF_Memory_End]
ja Ending_MS1CRC
sub ebp, [dhF_Memory_Start]
add ebp, [dhF_Memory]
Ending_MS1CRC:
mov eax, dword ptr ss : [ebp]
clc
btr cx, bp
jmp[MS_CRC1_RET]
}
VMProtectEnd();
}
void _declspec(naked) Ms2_crc()
{
//检测自身的CRC的CRC
/*
dhFactory.dll+15A30 - 8B 45 00 - mov eax,[ebp+00]
dhFactory.dll+15A33 - 33 C3 - xor eax,ebx
dhFactory.dll+15A35 - C1 C0 10 - rol eax,10
dhFactory.dll+15A38 - 8B D8 - mov ebx,eax
dhFactory.dll+15A3A - B8 5917B7D1 - mov eax,D1B71759
dhFactory.dll+15A3F - F7 E7 - mul edi
dhFactory.dll+15A41 - C1 EA 0C - shr edx,0C
*/
VMProtectBegin("ms2crc");
_asm
{
cmp ebp, [MS_Memory_Start]
jb En2_CRC
cmp ebp, [MS_Memory_End]
ja En2_CRC
sub ebp, [MS_Memory_Start]
add ebp, [MS_Memory]
jmp Ending_MS2CRC
En2_CRC:
cmp ebp, [EN_Memory_Start]
jb dhF2_CRC
cmp ebp, [EN_Memory_End]
ja dhF2_CRC
sub ebp, [EN_Memory_Start]
add ebp, [EN_Memory]
jmp Ending_MS2CRC
dhF2_CRC:
cmp ebp, [dhF_Memory_Start]
jb Ending_MS2CRC
cmp ebp, [dhF_Memory_End]
ja Ending_MS2CRC
sub ebp, [dhF_Memory_Start]
add ebp, [dhF_Memory]
Ending_MS2CRC:
mov eax, [ebp + 00]
xor eax, ebx
jmp[MS_CRC2_RET]
}
VMProtectEnd();
}
void _declspec(naked) ms1_FakeDHFZw()
{
VMProtectBegin("vmdhfzw");
__asm{
push eax
mov eax, [esp-0x10]
add eax, 0x1000
cmp eax, [MS_Memory]
jl zwEnCheck2
cmp eax, [dw_ms_end]
jg zwEnCheck2
jmp FuckDHzw
zwEnCheck2 :
mov eax, [esp - 0x10]
add eax,0x1000
cmp eax, [EN_Memory]
jl zwdhFCheck2
cmp eax, [dw_en_end]
jg zwdhFCheck2
jmp FuckDHzw
zwdhFCheck2 :
mov eax, [esp - 0x10]
add eax, 0x1000
cmp eax, [dhF_Memory]
jl zwijCheck2
cmp eax, [dw_dhf_end]
jg zwijCheck2
jmp FuckDHzw
zwijCheck2 :
mov eax, [esp - 0x10]
add eax, 0x1000
cmp eax, [dw_ij]
jl zwimCheck2
cmp eax, [dw_ijend]
jg zwimCheck2
jmp FuckDHzw
zwimCheck2 :
mov eax, [esp - 0x10]
add eax, 0x1000
cmp eax, [dw_im]
jl NofuckDHzw
cmp eax, [dw_imend]
jg NofuckDHzw
FuckDHzw:
mov eax, [esp-0x8]
mov dword ptr ds : [eax], 0x75000000
mov dword ptr ds : [eax + 0x4], 0x0
mov dword ptr ds : [eax + 0x8], 0x0
mov dword ptr ds : [eax + 0xC], 0x1000
mov dword ptr ds : [eax + 0x10], 0x10000
mov dword ptr ds : [eax + 0x14], 0x1
NofuckDHzw:
pop eax
jmp[dw_ms1_dhfzwRet]
}
VMProtectEnd();
}
#pragma endregion MSango.bin
有特征,建议不用劫持ijl15的方法,因为你没办法隐藏他。所以直接把crc代码放出来了~ |
免费评分
-
查看全部评分
|
[复制链接]
发表于 2017-7-12 01:38
|
发表于 2017-7-13 01:52
