.386
.model flat, stdcall
option casemap :none ; case sensitive
include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib
.data
DbgNotFoundTitle db "Debugger status:",0h
DbgFoundTitle db "Debugger status:",0h
DbgNotFoundText db "Debugger hardware bpx not found!",0h
DbgFoundText db "Debugger hardware bpx found!",0h
.data?
OrgEbp dd ?
OrgEsp dd ?
SaveEip dd ?
.code
start:
; Setup SEH
MOV EAX,offset @Exit
MOV DWORD PTR[OrgEbp],EAX
MOV DWORD PTR[SaveEip],EBP
ASSUME FS : NOTHING
PUSH offset @DetectHardwareBPX
PUSH FS:[0]
MOV DWORD PTR[OrgEsp],ESP
MOV FS:[0], ESP
; Fire SEH
XOR EAX,EAX
XCHG DWORD PTR DS:[EAX],EAX
@Exit:
POP FS:[0]
ADD ESP,4
PUSH 0
CALL ExitProcess
@DetectHardwareBPX:
PUSH EBP
MOV EBP,ESP
MOV EAX,DWORD PTR SS:[EBP+10h]
; Restore ESP, EBP, EIP
MOV EBX,DWORD PTR[OrgEbp]
MOV DWORD PTR DS:[EAX+0B8h],EBX
MOV EBX,DWORD PTR[OrgEsp]
MOV DWORD PTR DS:[EAX+0C4h],EBX
MOV EBX,DWORD PTR[SaveEip]
MOV DWORD PTR DS:[EAX+0B4h],EBX
; Check DRx registers
CMP DWORD PTR DS:[EAX+4h],0
JNE @hardware_bpx_found
CMP DWORD PTR DS:[EAX+8h],0
JNE @hardware_bpx_found
CMP DWORD PTR DS:[EAX+0Ch],0
JNE @hardware_bpx_found
CMP DWORD PTR DS:[EAX+10h],0
JNE @hardware_bpx_found
PUSH 40h
PUSH offset DbgNotFoundTitle
PUSH offset DbgNotFoundText
PUSH 0
CALL MessageBox
@hbpx_exit:
MOV EAX,0
LEAVE
RET
@hardware_bpx_found:
PUSH 30h
PUSH offset DbgFoundTitle
PUSH offset DbgFoundText
PUSH 0
CALL MessageBox
JMP @hbpx_exit
end start
|
![[+] expand](/imagery/files/soysauce_blueprint.gif){kind=link}