Guest User

Untitled

a guest
Mar 7th, 2016
794
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. format PE GUI
  2. entry start
  3.  
  4. include 'win32a.inc'
  5.  
  6. section '.text' code readable executable
  7.  
  8.   start:
  9.     ; get handle to calling process
  10.     push    0
  11.     call    [GetModuleHandleA]
  12.  
  13.     ; make page writeable
  14.     push    esp     ; old protect
  15.     push    4       ; option PAGE_READWRITE
  16.     push    1       ; size
  17.     push    eax     ; address of starting page
  18.     mov edi, eax    ; save handle in edi
  19.     call    [VirtualProtect]
  20.  
  21.     ; erase header
  22.     xor ecx, ecx
  23.     mov ch, 0x10    ; set counter to 0x1000
  24.     xor eax, eax    ; fill with 0 bytes
  25.     rep stosb       ; will erase 0x1000 bytes
  26.                     ; starting at edi = handle
  27.     ; show our message
  28.     push    0           ; type MB_OK
  29.     push    _caption    ; dialog title
  30.     push    _message    ; message
  31.     push    0           ; no owner window
  32.     call    [MessageBoxA]
  33.  
  34.     push    0           ; success
  35.     call    [ExitProcess]
  36.  
  37. section '.data' data readable writeable
  38.  
  39.   _caption db 'Win32 assembly program',0
  40.   _message db 'Header is erased, now try dumping',0
  41.  
  42. section '.idata' import data readable writeable
  43.  
  44.   library kernel,'KERNEL32.DLL',\
  45.       user,'USER32.DLL'
  46.  
  47.   import kernel,\
  48.      GetModuleHandleA, 'GetModuleHandleA',\
  49.      ExitProcess,'ExitProcess',\
  50.      VirtualProtect,'VirtualProtect'
  51.  
  52.   import user,\
  53.      MessageBoxA, 'MessageBoxA'
  54.  
  55. section '.reloc' fixups data readable discardable
Add Comment
Please, Sign In to add comment