Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact

Assembly 

Anti Emulator MASM with memory allocation, breaks every emulator

You have a overflow on line 11 :)
(Mar 4, 2016 07:07 PM)Masm4ever Wrote:  Depends on the emulator.

There are plenty of reasons why HeapAlloc could fail.

If it doesn't contain that value, the emulator is buggy.

The AV must be incredibly dumb to interpret an access violation as "clean" code.

Here is a shorter version of "your" code. Show me an "emulator" that produces the !=123😎
Code
include \masm32\include\masm32rt.inc
.code
start:
mov ecx, 154720540
push ecx
invoke HeapAlloc, rv(GetProcessHeap), 0, ecx
pop ecx
.if eax
    xchg eax, edi
    push edi
    mov al, 123
    rep stosb
    push 0
    .if [edi-1] != al
        xor esp, esp
    .endif
    call GetProcessHeap
    push eax
    call HeapFree
    invoke MessageBox, 0, chr$("my code"), chr$("it's not emulated:"), MB_OK
.endif
invoke ExitProcess, 0
end start

It's 2016 and OP thinks junk calls do anything for creating an undetected binary.

Flagging systems exist, it's 2016. 👍


Possibly Related Threads...
Thread / Author Replies Views Last Post
by thegodhelloJan 11, 2018 10:46 AM 11 1,674 Jan 11, 2018 10:46 AM
Last Post: evelboy
by datguy.devAug 19, 2017 04:04 PM 1 105 Aug 19, 2017 04:04 PM
Last Post: awdasdqwert
[Assembly] by UefiMay 8, 2017 05:32 PM 17 929 May 8, 2017 05:32 PM
Last Post: Masm4ever