Question

i 有一些问题,

有可能在窗户中设置一个自我改造的方案?

i write this program that use the _asm{} function:


#include <iostream>

using namespace std;

void print() //FUNCTION TO MODIFY
{
    cout << "Hello, World!
";
}

void Crypt(int adr)
{
    _asm {

        mov eax, adr

        xor_loop:
        xor byte ptr [eax], 0x24 
            inc eax
            cmp eax, 0xC3 //compare ret opcode
            jne xor_loop
    }

}

int main()
{
    print();

    void *ptr = print;  //address example : 003812E4

    cout << "Address : " << ptr << "
";

    int mem;

    _asm {
        lea eax, print
        mov mem, eax
        call eax
    }

    cout << "EAX : " << mem << "
";

    Crypt(mem);
    
    return 0;
}

但是,是否适当开展工作,是否有什么帮助?

pseudocode:

print function:
   mov eax, 0x80
   add eax, 0x02
   call eax
   ret

modify:
   lea eax, print
   xor byte ptr [eax], 0x24 //xor for modify opcode
   inc eax       //increase eax 1 byte
   cmp eax, 0xC3 //compare ret opcode
   jne modify

---------------------------------------------
modify print function example:
   mul eax
   mov eax, edx
   jnz ebx
   ret

Answer 1

Perhaps you should save your code in the .data section that you can t change the code in the .code section as it is protected(readonly).

有一种想法:

allocate a block of memory in the heap section to save function you want to change
copy the function code bytes into that memory
change the code and call the new function with the address you allocated.

友情链接