You are here: hacking technology > hacker course > Content
Hot Articles
Recommend Articles
New Articles
The random combined command achieves exempts kills
  Add date: 07/15/2008   Publishing date: 07/15/2008   Hits: 7
Total 5 pages, Current page:1, Jump to page:
 

Note: The compilation flower instruction, may refer to the following geminate instruction, may willfully the free recombination. Achieves exempts kills the effect.
push ebp
pop ebp
push eax
pop eax
push esp
pop esp
push 0
push 0
push 10 -------And the digit may willfully, pay attention with under corresponds
push -10
nop -----------May in middle increase willfully
With it equivalent:
mov EDI, EDI

add esp,1 -------And the digit may willfully, pay attention by under corresponds
add esp,-1
add esp,1 --------And the digit may willfully, pay attention by under corresponds
sub esp,1
inc ecx
dec ecx
sub eax, -2 ----------And the digit may willfully, with the dec integer correspondence
dec eax
dec eax
add eax -2 ----------And the digit may willfully, with the inc integer correspondence
inc eax
inc eax
jmp next jmp address
jmp next address

push ebp
mov ebp, esp -------May do for the flowered instruction opening sentence

jmp entry point address ------Jumps to the procedure entry point address
Same also has (following three) with its effect:
push entry point address
retn
jb entry point address
jnb entry point address
mov eax, entry point address
jmp eax

************************************************
Compresses after the Beidou----After again VMProtect encryption, but auspicious star catalog surface

1.POP 0
POP 0
2.PUSH ebp
pop ebp
3.nop ----Generally inserts in among
a 4.jmp jmp address
jmp…
5.add esp,1 ----The digit may change
sub esp,1
6. add esp,1
add esp,-1
7.sub esp,1
sub esp,-1
8.push esi
push edi
9.inc ecx
dec ecx
10 sub eax,-2
dec eax
dec eax
11. (should exempt kills colored instruction classics, compression may move, exempts Caba)
push ebp
mov ebp, esp
pop esp
jmp original entrypoint address -

jmp equally in:
PUSH
RETN

12. Exempts kills Caba the colored instruction:
push ebx
push ebx
push ebx
pop ebx
pop ebx
pop ebx
jmp jumps to the next address
add esp,1
add esp,-1
push entrypoint address
retn

*************
12. (with on)
push ebp
push esp
pop ebp
pop esp
jmp original entrypoint address
13. the most new section multi-purpose exempts kills the colored instruction:
push ebp
push esp
pop ebp
add esp,-0C
add esp,0C
push eax
jmp entrance

14. exempts kills the colored instruction
push ebp
mov ebp, esp
add esp,-0C
add esp,0C
push eax
mov eax, entry point address
jmp eax
nop
15.
jmp alters to: Jg (is bigger than shift), JL (is smaller than shift)
Or alters to: jb (is smaller than shift), jnb (is bigger than or is equal to shift)
16. writes the Caba flower instruction to jump do not jump directly with jmp, otherwise, must kill directly
jmp ---Is killed directly
Altering to
jb
jnb
Or alters to:
push entry point address
retn
Or alters to:
mov eax, entry point address
jmp eax

17.1 sections exempt kill Caba the colored instruction:
push ebx
push ebx
pop ebx
pop ebx
add esp,1
add esp,-1
push entry point address

 

Other pages: : 1 * 2 * 3 * 4 * 5 * Next>>
Prev:The bored Css cross station hangs the horse Next:The hacker teaches you anything is the SQL injection method attack

Comment:

Category: Home > hacker course