段寄存器探测

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
#include<stdio.h>
#include<Windows.h>


int TestSegment()
{
WORD val_cs = 0;
WORD val_ds = 0;
WORD val_ss = 0;

DWORD dwTemp = 11111111;
DWORD dwResult = 0;

__asm
{
xor eax, eax
mov ax, cs
mov val_cs, ax

xor eax, eax
mov ax, ds
mov val_ds, ax

xor eax, eax
mov ax, ss
mov val_ss, ax

xor eax, eax
mov ax, cs
//mov ds, ax

//lds ax,dwTemp

//xor eax, eax
//mov ax, ds
//mov val_ds, ax

lea eax, dword ptr ds : [dwTemp]
mov eax, dword ptr ds : [eax]
lea ebx, dword ptr ds : [dwResult]
mov dword ptr ds : [dwResult] , eax

//call getaddr //5 Bytes long

//jmp far func
}
printf("cs=%x\tds=%x\tss=%x\n", val_cs, val_ds, val_ss);
printf("%d\n", dwResult);

system("pause");

return 0;
}

void __declspec(naked) func()
{
__asm
{
jmp far eax
//jmp far dword ptr[eax]
}
}

void __declspec(naked) getaddr()
{
__asm
{
mov eax,dword ptr [esp]
add eax, 5 //skip call far 指令
ret
}
}


void __declspec(naked) TestJmpFar()
{
__asm
{
int 3
retn 4
}
}

int main(int argc, char* argv[], char* envp[])
{
//__asm
//{
// push 0x12345678
// call 0x20:0x12345678
//}
TestSegment();
}

段寄存器探测
https://rogxo.github.io/2021/12/06/2021-12-06-段寄存器探测/
作者
Rogxo
发布于
2021年12月6日
许可协议
CC BY-NC-SA 4.0