当前位置：首页 > news >正文

x64汇编案例5

news 2026/6/8 6:48:39

x64汇编案例5
1)案例介绍
咱们平时在公司开发软件，或是自己写代码卖给客户的时候，肯定都做过各种各样的软件防御和反调试检测保护吧？像常见的调试类OD，x64dbg，IDA，还有抓包类Burp，Fiddler，都是我们重点要防范的对象。遇到这些逆向分析工具，咱们是不是最常用的方法就是调用Win32API里的Process32Next函数，遍历系统里正在运行的进程。一旦检测到上面这些风险进程名称存在，咱们的程序就直接拒绝启动，从源头阻止逆向破解。当然啦这种基础的进程检测防护放到现在来说，防护力度已经比较简单很容易被绕过。各位不用着急，等后面的进阶逆向课程，还有驱动开发课程，咱会一步步教大家更深入的技术，带大家搞懂怎么从R3应用层到R0内核层，甚至包括DMA相关的绕过和检测思路，实现各种防护绕过和更强的安全对抗，彻底吃透软件攻防的核心逻辑。

题外话：
PCIe三层：
物理层：排线，金手指，差分信号传输
数据链路层：校验，重传，帧封装
事务层：最重要，发读写请求，DMA指令都是走这层

DMA板子插入PCIe插槽，主板枚举PCIe设备
系统分配BAR(BaseAddressRegister-基地址寄存器)地址
板子通过PCIe事务层下发DMA读写TLP包
直接跨过CPU，绕过系统保护，读写整机物理内存
上位机软件再和DMA板子通信，读游戏内存，写内存

2）案例

题外话：
PCIe三层：
物理层：排线，金手指，差分信号传输
数据链路层：校验，重传，帧封装
事务层：最重要，发读写请求，DMA指令都是走这层

2）案例

题外话：
PCIe三层：
物理层：排线，金手指，差分信号传输
数据链路层：校验，重传，帧封装
事务层：最重要，发读写请求，DMA指令都是走这层

2）案例

题外话：
PCIe三层：
物理层：排线，金手指，差分信号传输
数据链路层：校验，重传，帧封装
事务层：最重要，发读写请求，DMA指令都是走这层

2）案例

;Project mouse right -> Build Dependencies -> Build Customizations
;Project mouse file.asm -> propertis -> item type -> Microsoft Macro Assembler
; Only rely on VS2022 built-in tools, no need for external MASM32 library

option casemap:none
; Link required libraries for x64 Windows resolve external symbols
includelib ucrt.lib ; Universal C Runtime Library contains printf implementation
includelib legacy_stdio_definitions.lib ; Provides legacy stdio function symbols printf compatibility
includelib kernel32.lib ; Windows Kernel32 library contains ExitProcess
includelib psapi.lib ; Process Status API

externdef printf:proc

; Windows api
externdef MessageBoxA:proc
externdef ExitProcess:proc
externdef GetSystemTime:proc
externdef Sleep:proc
externdef CreateToolhelp32Snapshot:proc
externdef Process32First:proc
externdef Process32Next:proc
externdef CloseHandle:proc
externdef GetLastError:proc

.data

szTitle db 'x64 Process Lister', 0
szMsg db 'Process Listing Complete', 0

; Print process info PID + full process name
szProcFormat db 'Process ID: %lu, Name: %s', 0Ah, 0

; Error message format strings include GetLastError() code
szSnapErr db 'Failed to create process snapshot (Error Code: %lu)', 0Ah, 0
szFirstErr db 'Failed to retrieve first process (Error Code: %lu)', 0Ah, 0
szNextErr db 'Failed to retrieve next process (Error Code: %lu)', 0Ah, 0

; STANDARD WINDOWS x64 PROCESSENTRY32 STRUCTURE
; Size = 304 bytes (0x130)
PROCESSENTRY32 struct
dwSize dd ? ; 0x00: Size of the structure
cntUsage dd ? ; 0x04: Number of references to the process
th32ProcessID dd ? ; 0x08: Unique process ID "PID"
pad1 dd ? ; 0x0C: 4 byte padding
th32DefaultHeapID dq ? ; 0x10: Process default heap ID (x64 = 8 bytes)
th32ModuleID dd ? ; 0x18: Process module ID
cntThreads dd ? ; 0x1C: Number of threads in the process
th32ParentProcessID dd ? ; 0x20: Parent process ID "PPID"
pcPriClassBase dd ? ; 0x24: Base priority of process threads
dwFlags dd ? ; 0x28: Flags
szExeFile db 260 dup(0) ; 0x2C: Full path/name of the process executable MAX_PATH=260
PROCESSENTRY32 ends

; Align structure instance to 16 byte
align 16
pe32 PROCESSENTRY32 <> ; Instance of PROCESSENTRY32 for process data

.code
;----------------------------------------------------------------------
; Notes: - Follows x64 stack alignment rules sub rsp, 40h for shadow space
; - Properly cleans up handles to avoid resource leaks
; - Uses standard Windows API error handling GetLastError
;----------------------------------------------------------------------
; C function testGetProcess()
testGetProcess proc
; Allocate 32 bytes of shadow space + 8 bytes for alignment
sub rsp, 40h

; CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
mov rcx, 0Bh ; TH32CS_SNAPPROCESS 0x0B = snapshot all processes
mov rdx, 0 ; th32ProcessID = 0 enumerate all processes
call CreateToolhelp32Snapshot

; Check if snapshot handle is INVALID_HANDLE_VALUE = -1
cmp rax, -1
jne SnapshotSuccess ; Jump if snapshot created successfully

; Snapshot failed
call GetLastError
mov rcx, offset szSnapErr ; Error format string
mov rdx, rax ; Error code from GetLastError()
call printf ; Print error message
jmp Cleanup ; Jump to stack cleanup

SnapshotSuccess:
mov rbx, rax

; Init PROCESSENTRY32 structure
; Set dwSize to the correct size of PROCESSENTRY32 304 bytes = 0x130
mov dword ptr [pe32.dwSize], 304

; Get first process in the snapshot Process32First(snapshot_handle, &pe32)
mov rcx, rbx ; 1 param snapshot handle
lea rdx, [pe32] ; 2 param pointer to PROCESSENTRY32 instance
call Process32First

; Check if Process32First succeeded
test rax, rax
jnz ProcessLoop ; Jump if first process retrieved

; Process32First failed
call GetLastError
mov rcx, offset szFirstErr
mov rdx, rax
call printf
jmp CloseSnapshot ; Jump to close snapshot handle

ProcessLoop:
; Print current process info (PID + full executable name)
; printf(szProcFormat, PID, szExeFile)
mov rcx, offset szProcFormat ; 1 param format string
mov edx, [pe32.th32ProcessID] ; 2 param PID
lea r8, [pe32.szExeFile] ; 3 parma pointer to full process name
call printf

; Get next process in the snapshot Process32Next(snapshot_handle, &pe32)
mov rcx, rbx ; 1 parma snapshot handle
lea rdx, [pe32] ; 2 param pointer to PROCESSENTRY32
call Process32Next

; Continue loop if next process exists non-zero return = success
test rax, rax
jnz ProcessLoop ; Repeat if more processes

; Check if Process32Next failed
call GetLastError
cmp rax, 18 ; ERROR_NO_MORE_FILES 18 = normal end of list
je CloseSnapshot ; No error skip print error

; Process32Next failed
mov rcx, offset szNextErr
mov rdx, rax
call printf

CloseSnapshot:
; CloseHandle(snapshot_handle)
mov rcx, rbx
call CloseHandle

Cleanup:
add rsp, 40h
ret
testGetProcess endp

2）案例其他案例请查看，aes解码,密钥123456789，密文U2FsdGVkX1/Bd4k8ZAij4D8oMKFwS3bBvmalzk3NT7UEJTw7/qemqhDLwG4nl9H9/nO3Xk0Ebmv0W50P9akHkb0F2ubxR31a6lldXh/T1P5UbUFht0mf2SUJwAKMq1bg

查看全文

http://www.jsqmd.com/news/972981/