其实第一个问题就是杀死不知所以然的菜鸟们的必杀绝技，
完全看不懂是什么意思·······
我还是继续撸管去吧~~
以下代码简单模拟了HS的ring3反调
void u();
int _tmain(int argc, _TCHAR* argv[])
{
u();
return 0;
}
void u(){
MessageBoxA(NULL,"nu","MessageBoxA",MB_ICONINFORMATION);
}EXPORTS
MessageBoxA=MesageboxA
反调2：
mov eax,dwReason ;
cmp eax,DLL_PROCESS_ATTACH ; jnz ExitTlsCallBack0
call GetCurrentProcessId
int 21h
push eax
push 0
push PROCESS_ALL_ACCESS
call OpenProcess
push offset dwResult
push eax
call CheckRemoteDebuggerPresent
cmp dword ptr dwResult,0
jne _found
jmp ExitTlsCallBack0
_found:
call GetCurrentThread
push 0
push 0
push 11H
push eax
call NtSetInformationThread
mov eax,ebx ;
ExitTlsCallBack0:
mov dword ptr TLS_Start,0
xor eax,eax
inc eax
ret
TlsCallBack0 endp
偶滴QQ:2636234999 欢迎交流~
够弱智吧，喷子不要喷，哈哈-.-
void u();
int _tmain(int argc, _TCHAR* argv[])
{
u();
return 0;
}
void u(){
MessageBoxA(NULL,"nu","MessageBoxA",MB_ICONINFORMATION);
}EXPORTS
MessageBoxA=MesageboxA
反调2：
mov eax,dwReason ;
cmp eax,DLL_PROCESS_ATTACH ; jnz ExitTlsCallBack0
call GetCurrentProcessId
int 21h
push eax
push 0
push PROCESS_ALL_ACCESS
call OpenProcess
push offset dwResult
push eax
call CheckRemoteDebuggerPresent
cmp dword ptr dwResult,0
jne _found
jmp ExitTlsCallBack0
_found:
call GetCurrentThread
push 0
push 0
push 11H
push eax
call NtSetInformationThread
mov eax,ebx ;
ExitTlsCallBack0:
mov dword ptr TLS_Start,0
xor eax,eax
inc eax
ret
TlsCallBack0 endp
偶滴QQ:2636234999 欢迎交流~
够弱智吧，喷子不要喷，哈哈-.-
[ 此帖被小枫工作组在2012-10-22 00:39重新编辑 ]
