/*
tested on asprotect 1.23 RC4 only - arz
*/
var j
var k
eoe main
main:
/*
check for signature bytes
*/
mov j,eip
add j,47
mov k,[j]
mov j,[k]
cmp j,746F7250
je reset
/*
last exception?
*/
mov j,esp //based on britedreams lastex
add j,1C
mov k,[j]
cmp k,400000
je exit
cmp k,1000000 //did some testing on notepad :P
je exit
jmp continue
reset:
/*
zero the debugger check flags for no debugger checks
*/
mov j,eip
add j,41
mov k,[j] // get ptr to debug check array
sub k,4 // k Ptr do IsDebuggerPresent check flag
mov [k],0 // kill it (api won't be called)
add k,8 // k Ptr do anti-debug checks flag
mov [k],0 // kill the internal FS[?],TRW and system debugger checks
jmp continue
continue:
esto
jmp main
exit:
ret |
楼主: tianyu1973
| 
发表于 2008-10-6 21:21:26
