-
Notifications
You must be signed in to change notification settings - Fork 55
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
c340939
commit 08755f4
Showing
1 changed file
with
61 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,61 @@ | ||
%define counter ecx | ||
%define functionSize ebx | ||
%define startAddress eax | ||
%define addressOfUnencripted edi | ||
%define tmp edx | ||
%define functionStoreAddress esi ;where the original function is stored | ||
|
||
segment .text | ||
|
||
justDoIt:;couldnt think of anything | ||
pushad | ||
pushfd | ||
|
||
|
||
mov counter, 0h ; this value will change | ||
cmp counter, 0x000000FF | ||
jne increaseCounter | ||
|
||
;incase that they're equal | ||
mov dword [12345678h], 0 ;restore the counter | ||
|
||
mov dword functionSize, 69h ;wont change | ||
mov dword startAddress, 68h ;same | ||
mov dword addressOfUnencripted, 67h ;this will change | ||
|
||
mov tmp, functionSize | ||
shl tmp, 1 ;double it | ||
add tmp, startAddress | ||
add tmp, 1 | ||
|
||
mov functionStoreAddress, 12345678h | ||
|
||
cmp tmp, addressOfUnencripted | ||
jle resetAddressOfUnencripted | ||
|
||
;time to move it | ||
add addressOfUnencripted, 1 ;increase it | ||
mov [12345678h], addressOfUnencripted ; update it | ||
|
||
copyFunction: | ||
mov ecx, functionSize | ||
|
||
copy: | ||
movsb | ||
loop copy | ||
|
||
jmp endJustDoIt | ||
|
||
resetAddressOfUnencripted: | ||
mov addressOfUnencripted, startAddress | ||
mov [12345678h], addressOfUnencripted ;address where addressOfUnencripted is stored | ||
jmp copyFunction | ||
|
||
increaseCounter: | ||
add counter, 1h | ||
mov [12345678h], counter | ||
|
||
endJustDoIt: | ||
popfd | ||
popad | ||
jmp [12345678h] |