.586 .model flat, stdcall assume fs:flat option casemap:none include \masm32\include\windows.inc include \masm32\include\kernel32.inc include \masm32\include\user32.inc include \masm32\include\gdi32.inc include \masm32\include\msvcrt.inc includelib \masm32\lib\kernel32.lib includelib \masm32\lib\user32.lib includelib \masm32\lib\gdi32.lib includelib \masm32\lib\msvcrt.lib .data OldAttr dd 0 TempVal dd 0 format1 db '%d bytes long: no exception',0ah,0 format2 db '%d bytes - 0x%.8x Exception',0ah,0 Eip dd 0 Pointer dd 0 .code start: call @F @@: pop eax ; EAX <--- EIP _test: jmp _protect db 100 dup (90h) jmp _return _protect: inc eax inc eax inc eax ; Eip - Esi ; Pointer - Edi mov esi, eax mov edi, eax mov [Eip], esi mov [Pointer], edi invoke VirtualProtect, esi,100,PAGE_EXECUTE_READWRITE,offset OldAttr _loop: mov byte ptr [edi], 03eh mov byte ptr [edi+1], 0c6h mov byte ptr [edi+2], 05 mov dword ptr [edi+3], offset TempVal mov byte ptr [edi+7], 0 inc edi inc dword ptr [Pointer] jmp _thread _start: ; SEH push offset _handler push dword ptr fs:[0] mov dword ptr fs:[0], esp jmp [Eip] _thread: invoke CreateThread, NULL, 0, offset _start, 0, 0, 0 invoke WaitForSingleObject, eax, INFINITE jmp _loop _return: mov esi, [Eip] mov edi, [Pointer] mov eax, edi sub eax, esi add eax, 6 invoke _imp__printf, offset format1, eax invoke ExitThread, 0 _handler: mov esi, [Eip] mov edi, [Pointer] mov eax, edi sub eax, esi cmp eax, 90 jge _end add eax, 6 mov edx, [esp+4] mov edx, [edx] invoke _imp__printf, offset format2, eax, edx invoke ExitThread, 0 _end: invoke ExitProcess, 0 end start
There are 31,313 total registered users.
[+] expand