rackme, API-


         

thunk


, jump thunk API- . memcpy. memcpy. jump' VirtualProtect PAGE_READWRITE, , , , . , .   ,   .

:

// / thunk

//============================================================================

__declspec( naked ) _do_asm(char *src)

{

__asm

{

; ,

push ecx

push esi

push edi

;

push esp ; old-old (hack!!!)

push eax ; old

; VirtualProtect(p,0x1000,PAGE_READWRITE, &old);

;

push esp ; &old

push PAGE_READWRITE ;

PAGE_EXECUTE_READWRITE!

push

0x1000 ; size

push

[p] ;

call ds:VirtualProtect

; src

p

mov ecx, JUMP_SZ/4 ; size .

mov esi, [esp+18h] ; src !!! !!!

mov edi, [p] ; dst

rep movsd ; !

; VirtualProtect(p,0x1000,old,&old-old)

;

push esp ; old (hack!!!)

push

1000h ; size

push

[p] ;



    





Forekc.ru
, , , , , , , , , ,