(Mar 4, 2016 07:07 PM)Masm4ever Wrote: Depends on the emulator.
There are plenty of reasons why HeapAlloc could fail.
If it doesn't contain that value, the emulator is buggy.
The AV must be incredibly dumb to interpret an access violation as "clean" code.
Here is a shorter version of "your" code. Show me an "emulator" that produces the !=123😎
Code
include \masm32\include\masm32rt.inc
.code
start:
mov ecx, 154720540
push ecx
invoke HeapAlloc, rv(GetProcessHeap), 0, ecx
pop ecx
.if eax
xchg eax, edi
push edi
mov al, 123
rep stosb
push 0
.if [edi-1] != al
xor esp, esp
.endif
call GetProcessHeap
push eax
call HeapFree
invoke MessageBox, 0, chr$("my code"), chr$("it's not emulated:"), MB_OK
.endif
invoke ExitProcess, 0
end start
It's 2016 and OP thinks junk calls do anything for creating an undetected binary.
Flagging systems exist, it's 2016. 👍