KeyClone 1.9.7.0 (Proof of concept)
Before:
- 004814BA |. E8 E161FDFF CALL keyclone.004576A0 ; First check
004814BF |. 0FB6C0 MOVZX EAX,AL
004814C2 |. 85C0 TEST EAX,EAX
004814C4 0F84 AB000000 JE keyclone.00481575 -
004576A0 /$ 55 PUSH EBP
004576A1 |. 8BEC MOV EBP,ESP
004576A3 |. 51 PUSH ECX
004576A4 |. 894D FC MOV DWORD PTR SS:[EBP-4],ECX
004576A7 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004576AA 8A80 2D060000 MOV AL,BYTE PTR DS:[EAX+62D] ; >> MOV AL,1
004576B0 |. 8BE5 MOV ESP,EBP
004576B2 |. 5D POP EBP
004576B3 \. C3 RETN
Patched for 6 Bytes
This is called from: keyclone.00433DCA, keyclone.00434A90, keyclone.00455701
- 004364B0 /$ 55 PUSH EBP
004364B1 |. 8BEC MOV EBP,ESP
004364B3 |. 51 PUSH ECX
004364B4 |. 894D FC MOV DWORD PTR SS:[EBP-4],ECX
004364B7 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004364BA |. E8 2129FFFF CALL keyclone.00428DE0
004364BF |. 33C9 XOR ECX,ECX
004364C1 83F8 FF CMP EAX,-1
004364C4 |. 0F9EC1 SETLE CL
004364C7 8AC1 MOV AL,CL ; >> MOV AL,0
004364C9 |. 8BE5 MOV ESP,EBP
004364CB |. 5D POP EBP
004364CC \. C3 RETN
Patched for 1 Byte
And the last two:
00463589 |. 8985 F4FEFFFF MOV DWORD PTR SS:[EBP-10C],EAX
0046358F |. 83BD F4FEFFFF >CMP DWORD PTR SS:[EBP-10C],-1
00463596 7F 36 JG SHORT keyclone.004635CE ; >> JMP SHORT 004635CE
0046AD89 |. 8985 F4FEFFFF MOV DWORD PTR SS:[EBP-10C],EAX
0046AD8F |. 83BD F4FEFFFF >CMP DWORD PTR SS:[EBP-10C],-1
0046AD96 7F 2F JG SHORT keyclone.0046ADC7 ; JMP SHORT 0046ADC7
After:
Commenti
Posta un commento