Instructions:
Push ebp
Mov ebp, esp
Inc ecx
Push edx
Nop
Pop edx
Dec ecx
Pop ebp
Inc ecx
Original jmp entry
1. Disguised vc
The entry code of the VC ++ program:
PUSH EBP
Mov ebp, ESP
PUSH-1
Push 415448 -\___
PUSH 4021A8-/in this Code, operations similar to this can be left blank
Mov eax, dword ptr fs: [0]
PUSH EAX
Mov dword ptr fs: [0], ESP
Add esp,-6C
PUSH EBX
PUSH ESI
PUSH EDI
Add byte ptr ds: [EAX], AL/this command can be left blank!
Jmp jump to the original entry point of the program
2. Jump
Somewhere:
Nop/"random" jump start...
The address of the next jmp in jmp.
Jmp .../...
Address of the original jmp entry/jump to the original oep
<<
New entry: push ebp
Mov ebp, esp
Inc ecx
Push edx
Nop
Pop edx
Dec ecx
Pop ebp
Inc ecx
Loop somewhere/jump to the above Code address!
3. C:
Integration
Replace A's code with B's
Push ebp
Mov ebp, esp
Push-1
Push 111111
Push 222222
Mov eax, fs: [0]
Push eax
Mov fs: [0], esp
Pop eax
Mov fs: [0], eax
Pop eax
Pop eax
Pop eax
Pop eax
Mov ebp, eax
Old jmp entry
4. c ++
Push ebp
Mov ebp, esp
Push-1
Push 111111
Push 222222
Mov eax, fs: [0]
Push eax
Mov fs: [0], esp
Pop eax
Mov fs: [0], eax
Pop eax
Pop eax
Pop eax
Pop eax
Mov ebp, eax
5. Microsoft Visual C + + 6.0
PUSH-1
PUSH 0
PUSH 0
Mov eax, dword ptr fs: [0]
PUSH EAX
Mov dword ptr fs: [0], ESP
Sub esp, 68
PUSH EBX
PUSH ESI
PUSH EDI
POP EAX
POP EAX
POP EAX
Add esp, 68
POP EAX
Mov dword ptr fs: [0], EAX
POP EAX
POP EAX
POP EAX
POP EAX
Mov ebp, EAX
Original JMP entry
6.
In mov ebp, eax
Add
PUSH EAX
POP EAX
7. VC ++ 5.0
PUSH EBP
Mov ebp, ESP
PUSH-1
Push 515448
PUSH 6021A8
Mov eax, dword ptr fs: [0]
PUSH EAX
Mov dword ptr fs: [0], ESP
Add esp,-6C
PUSH EBX
PUSH ESI
PUSH EDI
Jmp