Learning a piece of fraudulent code and a self-deletion program

Today, I suddenly saw the following code:

Push 0
Call @ 1
DB 'title', 0
@ 1: Call @ 2
DB 'message', 0
@ 2: Push 0
Call messageboxa

I did not respond to it in a clear sense. I don't know what's going on, And suddenly thought of a self-deletion program I 've seen before. I didn't understand what's going on at the time, today, I took a look at the post I posted and finally understood what was going on.

First, this piece of spoofing code can trick some disassembly software into a messy code. In fact, this code completes the following functions:

MessageBox (0, "message", "title", 0 );

A dialog box is displayed. After call @ 1, press the address of DB "title", 0 into the stack. After call @ 2, press the address of DB "message" and 0 into the stack, before executing the call MessageBox operation, the stack content is as follows:

0

ADDR of "message"; the return address after the call @ 2 is executed

ADDR of "title"; the return address after the call @ 1 is executed

0

In this way, you can call this function normally.

Next, let's talk about this self-deletion program (because it cannot be used in XP)

The Code is as follows:

# Include "windows. H"

Int main (INT argc, char * argv [])
...{
Char Buf [max_path];
Hmodule module;

Module = getmodulehandle (0 );
Getmodulefilename (module, Buf, max_path );
Closehandle (handle) 4 );

_ ASM
...{
Lea eax, Buf
Push 0
Push 0
Push eax
Push exitprocess
Push Module
Push deletefile
Push unmapviewoffile
RET
}

Return 0;
}

 

Closehandle (handle) 4) is used to close the image handle of the exe.

The assembly code below is the core, implementing the first invoke unmapviewoffile, Module

Because this is the case in the stack when the function is called.

......
Localvar2
Localvar1
Return address
Arg1
Arg2
Arg3
......

This is the case when unmapviewoffile is called.

ADDR of deletefile
ARG

Because unmapviewoffile has only one parameter, it uses Arg, the module pushed by push module, as its parameter, and the deletefile address as the return address. Therefore, after unmapviewoffile is executed, the system will return to deletefile for execution. The same method is used when deletefile is executed. The eax pushed to the stack is used as the parameter, and the first push 0 is used as the parameter for the next exitprocess, second, only to comply with API call conventions