Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact

Assembly 

ASM RDTSC VirtualMachine Detector

"jmp exit" in the label "notvm" and "jz average" in the label "loop" are innecesary..

When i go home i test
(Sep 4, 2015 02:22 AM)SIM-1866423 Wrote:  If you are talking about technical issue, explain me why.I would love to learn ..

Sorry by my english..

Well.. im not a "master" with asm i think that my level with this language is 6/10

When i said that some jumps are innecesary, i want to said that some jumps are innecesary.

Example:

PHP Code

<?php 
mov al
, 20
jmp myminijump
myminijump
:
add al, 20 

I think that your code works fine.. but you can reduce the size of your code (thats its ironic with asm 😁 ).

I have a question.. when the code take the decision to determinate if is a virtualmachine or not.. is compared with the value '0xc8'.. where you pick this value??

In the same part of your code where you put the jumps 'jg vm, jl notvm' if eax is exactly 0xc8 no one jump is processed so the program continue to 'vm' label. Maybe you want process in this situation, just only need add the letter 'e' so 'jge or jle'. Both jump have the same size. 1 byte.

Again, sorry by my english. I would love to learn, too. 😉😉


Possibly Related Threads...
Thread / Author Replies Views Last Post
by missNasserJun 30, 2016 04:41 AM 1 230 Jun 30, 2016 04:41 AM
Last Post: csrk
by TheftApr 8, 2013 02:38 PM 0 128 Apr 8, 2013 02:38 PM
Last Post: Theft
[Lua] by VaqxinationFeb 3, 2013 07:38 PM 19 1,745 Feb 3, 2013 07:38 PM
Last Post: carsn