0

I attached my asm into my source code of dll and hooked it to my exe, and it works like a charm but when I packed my exe using exe packer. the dll with asm not working on exe packed. any idea how to solve this problem?

#include "StdAfx.h"

void __declspec(naked) MyStuff() {
    __asm {
        PUSH EBP
            MOV EBP, ESP
            MOV EAX, DWORD PTR SS : [EBP + 0x8]
            MOV EAX, DWORD PTR DS : [EAX]
            XOR EAX, ENCPACKET
            MOV DWORD PTR SS : [EBP + 0x8], EAX
            MOV AX, WORD PTR SS : [EBP + 0xA]
            POP EBP
            RETN 0x4
    }
}

void SetStuff(){
    SetJmp((LPVOID)0x00424B1C,  MyStuff);
}

The result was:

005DB4E0   /> \55                PUSH EBP
005DB4E1   |.  8BEC              MOV EBP,ESP
005DB4E3   |.  56                PUSH ESI
005DB4E4   |.  FF75 0C           PUSH DWORD PTR SS:[EBP+C]
005DB4E7   |.  B9 403E0801       MOV ECX,01083E40
005DB4EC   |.  E8 38CCE3FF       CALL 00418129
005DB4F1   |.  8BF0              MOV ESI,EAX
005DB4F3   |.  85F6              TEST ESI,ESI
005DB4F5   |.  74 1E             JE SHORT 005DB515
005DB4F7   |.  FF75 08           PUSH DWORD PTR SS:[EBP+8]
005DB4FA   |.  8BCE              MOV ECX,ESI
005DB4FC   |.  E8 D799E4FF       CALL 00424ED8
005DB501   |.  8B4D 10           MOV ECX,DWORD PTR SS:[EBP+10]
005DB504   |.  FF75 08           PUSH DWORD PTR SS:[EBP+8]
005DB507   |.  8901              MOV DWORD PTR DS:[ECX],EAX
005DB509   |.  8BCE              MOV ECX,ESI
005DB50B   |.  E8 EEA5E4FF       CALL 00425AFE
005DB510   |.  8B4D 14           MOV ECX,DWORD PTR SS:[EBP+14]
005DB513   |.  8901              MOV DWORD PTR DS:[ECX],EAX
005DB515   |>  5E                POP ESI
005DB516   |.  5D                POP EBP
005DB517   \.  C2 1000           RETN 10

and may I ask is it possible to run an asm into specific offset like this?

#include "StdAfx.h"

void __declspec(naked) MyStuff() {
    __asm {
005DB4E0->        PUSH EBP
005DB4E1->            MOV EBP, ESP
005DB4E3->            MOV EAX, DWORD PTR SS : [EBP + 0x8]
005DB4E4->            MOV EAX, DWORD PTR DS : [EAX]
005DB4E7->            XOR EAX, ENCPACKET
005DB4EC->            MOV DWORD PTR SS : [EBP + 0x8], EAX
005DB4E1->            MOV AX, WORD PTR SS : [EBP + 0xA]
005DB4F3->            POP EBP
005DB4F4->            RETN 0x4
    }
}
Michael Petch
  • 46,082
  • 8
  • 107
  • 198
djsoda
  • 25
  • 1
  • 9

0 Answers0