Advertisement
captmicro

Leet Emulation Dector

Nov 10th, 2012
349
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #define WIN32_LEAN_AND_MEAN
  2. #define NOWINRES
  3. #define NOSERVICE
  4. #define NOMCX
  5. #define NOIME
  6. #include <windows.h>
  7.  
  8. #pragma comment(lib, "user32.lib")
  9.  
  10. int main(void)
  11. {
  12.     char stuffz[] = "Hello World!";
  13.    
  14.     ;you should probably use a few different sqrt implementations for GOOD detectability
  15.     __asm
  16.     {
  17.         mov eax, 1649616 ;((6^2)^2)^2 = 6 (how many bytes to jump)
  18.         push esp
  19.         push eax
  20.         fld [esp]
  21.         pop eax
  22.         mov ebx, eax
  23.        
  24.         pop eax
  25.         _fsqrt_do1:
  26.         fsqrt
  27.         call _fsqrt_do2
  28.        
  29.         _fsqrt_do3:
  30.         mov eax, _fsqrt_do1
  31.         mov ebx, 3791
  32.         add ebx, 111
  33.         sub eax, 1 ;get before
  34.         call eax
  35.        
  36.         _fsqrt_do2:
  37.         cmp ebx, 3902
  38.         je _doentry
  39.         fsqrt
  40.         pop eax ;eax = return address
  41.         cmp eax, _fsqrt_do3 ;always true (should be!)
  42.         je _fsqrt_do3
  43.        
  44.         _doentry:
  45.         mov ebx, ondetect ;ondetect label
  46.         push eax
  47.         fst [esp] ;read out result (should == 6)
  48.         pop eax
  49.         sub ebx, eax
  50.         jmp ebx
  51.        
  52.         mov eax, 0
  53.         ret
  54.        
  55. ondetect:
  56.         push 0 ;opcode 0x52 (1 byte)
  57.         call ExitProcess ;opcode 0xE8 (5 bytes)
  58. realentry:
  59.         push 0
  60.         push stuffz
  61.         push stuffz
  62.         push 0
  63.         call MessageBoxA
  64.     };
  65.     return 0;
  66. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement