KeyClone 1.9.7.0 (Proof of concept)

Before:

before

  • 004814BA  |. E8 E161FDFF    CALL keyclone.004576A0  ;  First check
    004814BF  |. 0FB6C0         MOVZX EAX,AL
    004814C2  |. 85C0           TEST EAX,EAX
    004814C4     0F84 AB000000  JE keyclone.00481575
  • 004576A0  /$ 55             PUSH EBP
    004576A1  |. 8BEC           MOV EBP,ESP
    004576A3  |. 51             PUSH ECX
    004576A4  |. 894D FC        MOV DWORD PTR SS:[EBP-4],ECX
    004576A7  |. 8B45 FC        MOV EAX,DWORD PTR SS:[EBP-4]
    004576AA     8A80 2D060000  MOV AL,BYTE PTR DS:[EAX+62D]   ; >>  MOV AL,1
    004576B0  |. 8BE5           MOV ESP,EBP
    004576B2  |. 5D             POP EBP
    004576B3  \. C3             RETN

Patched for 6 Bytes

This is called from: keyclone.00433DCA, keyclone.00434A90, keyclone.00455701

  • 004364B0  /$ 55             PUSH EBP
    004364B1  |. 8BEC           MOV EBP,ESP
    004364B3  |. 51             PUSH ECX
    004364B4  |. 894D FC        MOV DWORD PTR SS:[EBP-4],ECX
    004364B7  |. 8B4D FC        MOV ECX,DWORD PTR SS:[EBP-4]
    004364BA  |. E8 2129FFFF    CALL keyclone.00428DE0
    004364BF  |. 33C9           XOR ECX,ECX
    004364C1     83F8 FF        CMP EAX,-1
    004364C4  |. 0F9EC1         SETLE CL
    004364C7     8AC1           MOV AL,CL                                ;  >> MOV AL,0
    004364C9  |. 8BE5           MOV ESP,EBP
    004364CB  |. 5D             POP EBP
    004364CC  \. C3             RETN

Patched for 1 Byte

And the last two:

00463589  |. 8985 F4FEFFFF  MOV DWORD PTR SS:[EBP-10C],EAX
0046358F  |. 83BD F4FEFFFF >CMP DWORD PTR SS:[EBP-10C],-1
00463596     7F 36   JG SHORT keyclone.004635CE   ;  >> JMP SHORT 004635CE

0046AD89  |. 8985 F4FEFFFF  MOV DWORD PTR SS:[EBP-10C],EAX
0046AD8F  |. 83BD F4FEFFFF >CMP DWORD PTR SS:[EBP-10C],-1
0046AD96   7F 2F  JG SHORT keyclone.0046ADC7   ;  JMP SHORT 0046ADC7

After:

after

Commenti

Post popolari in questo blog

c# – Semplice hack per risolvere un bug in function ValidatorOnChange(event)

swIP – Switch IP