Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- LABEL Main
- #check if being debugged
- fastcall IsBeingDebugged
- printf 'IsProcessDebugged --> %d|n', retval
- mov b, retval #retval = alias for a
- getfs 0x30 # retval = &PEB
- #typedef struct _PEB {
- # BYTE Reserved1[2];
- # BYTE BeingDebugged;
- # ..
- #}
- add retval, 2
- mov a8l, [retval]
- movx a, a8l
- printf 'FS:[0x30]+0x2 --> %d|n', a
- or a, b
- jcc e, ERR_DEBUG, a, 1 # on condition, a and b are => e=equal, jmp to ERR_DEBUG, [for other conditions google x86 intel JCC]
- #get 2 numbers from user
- fastcall AskForNumber, 1
- movf b, retval
- fastcall AskForNumber, 2
- movf c, retval
- movf dst, b
- add dst, c
- printf '%d+%d=%d|n|n', b, c, dst
- jmp endNormal
- LABEL ERR_DEBUG
- printf 'Dont debug me :('
- xor dst, dst
- LABEL endNormal
- ret dst
- ENDLABEL
- LABEL IsBeingDebugged
- GetProcAddress KERNEL32, IsDebuggerPresent
- jmp32 retval
- ENDLABEL
- LABEL AskForNumber # DWORD AskForNumber(int NumberNo)
- printf 'Number %d:', c
- push 0x0 # push 0 to stack
- movf a, stack #a = pointer to current stack value (0x0)
- scanf '%d', a
- pop retval #retval = value from stack & stack poped
- ret #we dont need to retfull X, since retval is already set by us
- ENDLABEL
- # --- What This Code Demonstrates --- #
- #
- # nonvolatile registers, SRC, DST, BASE, STACK, B
- # volatile registers = A, C & D
- #
- # default way of calling Canthon functons is -->__fastcall
- # but it doesnt use stack so only the first 2 arguements
- # from left to right are passed in ECX(C) and EDX(D) registers;
- # all other arguments are IGNORED. fastcall function, ARG1, ARG2
- #
- # endlabel is not a real instruction, but Canthon ignores unknown commands
- #
- # you cant use STACK in default function calls since stack is used for saving registers
- # A (retval) on functions where its not useful(ex:printf), or BASE which is used for storing function pointers in extern calls.
- #
- # inline asm = _asm
- #
- # jmp, call, fastcall can be used on labels
- # jmp32, call32, fastcall32 can be used on registers and direct values.
- # you can use "fastcall StdcallFunction thisptr, 0, Arg1, Arg2, Arg3"
- # to call a stdcall function
- # or "fastcall CdeclFunction thisptr, 0, Arg1, Arg2, Arg3"
- # & "add stack, 0xC"
- # to call a cdecl function
- # |n = new line (\n)
Add Comment
Please, Sign In to add comment