Advertisement
Riremito

vmcrcs

Dec 22nd, 2014
535
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 1.56 KB | None | 0 0
  1. void _declspec(naked) AddrCheck(){
  2.     _asm{
  3.         pushfd
  4.         mov edi,[esp+0x04]
  5.         cmp edi,[Memory_Start]
  6.         jb EndingAC
  7.         cmp edi,[Memory_End]
  8.         ja EndingAC
  9.         sub edi,[Memory_Start]
  10.         add edi,[Memory]
  11. EndingAC:
  12.         popfd
  13.         ret 0x0004
  14.     }
  15. }
  16.  
  17. DWORD mov_eax_peax_ret = 0x00974166;
  18. void _declspec(naked) mov_eax_peax(){
  19.     _asm{
  20.         push edi
  21.         push eax
  22.         call AddrCheck
  23.         mov eax,[edi]
  24.         pop edi
  25.         mov word ptr [esp],0xA95C//org
  26.         jmp dword ptr [mov_eax_peax_ret]
  27.     }
  28. }
  29.  
  30. DWORD mov_al_pedx_ret = 0x0052ECB9;
  31. void _declspec(naked) mov_al_pedx(){
  32.     _asm{
  33.         push edi
  34.         push edx
  35.         call AddrCheck
  36.         mov al,[edi]
  37.         pop edi
  38.         push [esp]//org
  39.         jmp dword ptr [mov_al_pedx_ret]
  40.     }
  41. }
  42.  
  43. DWORD xor_al_pedx_ret = 0x0096FE0A;
  44. void _declspec(naked)  xor_al_pedx(){
  45.     _asm{
  46.         push edi
  47.         push edx
  48.         call AddrCheck
  49.         xor al,[edi]
  50.         pop edi
  51.         jmp dword ptr [xor_al_pedx_ret]
  52.     }
  53. }
  54.  
  55. DWORD mov_ax_peax_ret1 = 0x005FE357;
  56. void _declspec(naked) mov_ax_peax1(){
  57.     _asm{
  58.         push edi
  59.         push eax
  60.         call AddrCheck
  61.         mov ax,[edi]
  62.         pop edi
  63.         pushad//org
  64.         jmp dword ptr [mov_ax_peax_ret1]
  65.     }
  66. }
  67.  
  68. DWORD mov_ax_peax_ret2 = 0x005FDF84;
  69. void _declspec(naked) mov_ax_peax2(){
  70.     _asm{
  71.         push edi
  72.         push eax
  73.         call AddrCheck
  74.         mov ax,[edi]
  75.         pop edi
  76.         pushad//org
  77.         mov word ptr [esp+0x1C],0x69D0
  78.         jmp dword ptr [mov_ax_peax_ret2]
  79.     }
  80. }
  81.  
  82. void VMCRC(){
  83.     AM.WriteHook(0x0097415E, JMP, mov_eax_peax);
  84.     AM.WriteHook(0x0052ECB4, JMP, mov_al_pedx);
  85.     AM.WriteHook(0x0096DC0D, JMP, xor_al_pedx);
  86.     AM.WriteHook(0x0096FEE5, JMP, mov_ax_peax1);
  87.     AM.WriteHook(0x005FDF79, JMP, mov_ax_peax2);
  88. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement