wanna see whatdyi get for nuttin
Code:
CPU Disasm
Command Source
MOV EDI, EDI ; {
PUSH EBP
MOV EBP, ESP
SUB ESP, 8
MOV DWORD PTR SS:[LOCAL.2], 0 ; PEPROCESS eproc =NULL;
MOVZX EAX, BYTE PTR SS:[Create] ; if(Create){
TEST EAX, EAX
JZ SHORT proccreatemon1.000104AE
LEA ECX, [LOCAL.2] ; PsLookupProcessByProcessId(ProcessId,&eproc);
PUSH ECX
MOV EDX, DWORD PTR SS:[ProcessId]
PUSH EDX
CALL NEAR DWORD PTR DS:[<&ntoskrnl_exe.PsLookupProcessByProcessId>]
MOV EAX, DWORD PTR SS:[LOCAL.2] ; foo = (PCHAR)eproc+0x174;
ADD EAX, 174
MOV DWORD PTR SS:[LOCAL.1], EAX
MOV ECX, DWORD PTR SS:[LOCAL.1] ; DbgPrint("PID %X Process Name %s\n",ProcessId,foo);
PUSH ECX
MOV EDX, DWORD PTR SS:[ProcessId]
PUSH EDX
PUSH proccreatemon1.000104C0
CALL proccreatemon1.DbgPrint
ADD ESP, 0C
MOV ECX, DWORD PTR SS:[LOCAL.2] ; ObDereferenceObject(eproc);
CALL NEAR DWORD PTR DS:[<&ntoskrnl_exe.ObfDereferenceObject>]
MOV ESP, EBP ; }
POP EBP
RETN 0C
bow bow ooohhh ooohhh ooohhh
Code:
.text:00010460 ProcCreateMon proc near ; DATA XREF: DriverUnload+7o
.text:00010460 ; DriverEntry+11o
.text:00010460
.text:00010460 var_8 = dword ptr -8
.text:00010460 var_4 = dword ptr -4
.text:00010460 arg_4 = dword ptr 0Ch
.text:00010460 arg_8 = byte ptr 10h
.text:00010460
.text:00010460 mov edi, edi
.text:00010462 push ebp
.text:00010463 mov ebp, esp
.text:00010465 sub esp, 8
.text:00010468 mov [ebp+var_8], 0
.text:0001046F movzx eax, [ebp+arg_8]
.text:00010473 test eax, eax
.text:00010475 jz short loc_104AE
.text:00010477 lea ecx, [ebp+var_8]
.text:0001047A push ecx
.text:0001047B mov edx, [ebp+arg_4]
.text:0001047E push edx
.text:0001047F call ds:__imp__PsLookupProcessByProcessId@8 ; PsLookupProcessByProcessId(x,x)
.text:00010485 mov eax, [ebp+var_8]
.text:00010488 add eax, 174h
.text:0001048D mov [ebp+var_4], eax
.text:00010490 mov ecx, [ebp+var_4]
.text:00010493 push ecx
.text:00010494 mov edx, [ebp+arg_4]
.text:00010497 push edx
.text:00010498 push offset ??_C@_0BI@HPAHKJOK@PID?5?$CFX?5Process?5Name?5?$CFs?6?$AA@FNODOBFM@ ; "PID %X Process Name %s\n"
.text:0001049D call _DbgPrint
.text:000104A2 add esp, 0Ch
.text:000104A5 mov ecx, [ebp+var_8]
.text:000104A8 call ds:__imp_@ObfDereferenceObject@4 ; ObfDereferenceObject(x)
.text:000104AE
.text:000104AE loc_104AE: ; CODE XREF: ProcCreateMon+15j
.text:000104AE mov esp, ebp
.text:000104B0 pop ebp
.text:000104B1 retn 0Ch
.text:000104B1 ProcCreateMon endp
rubber biscuits cost more time than real biscuits
Code:
.text:00010460 ; int __stdcall ProcCreateMon(HANDLE parid,HANDLE pid,BOOL Create)
.text:00010460 ProcCreateMon proc near ; DATA XREF: DriverUnload+7o
.text:00010460 ; DriverEntry+11o
.text:00010460
.text:00010460 var_8 = dword ptr -8
.text:00010460 var_4 = dword ptr -4
.text:00010460 parid = dword ptr 8
.text:00010460 pid = dword ptr 0Ch
.text:00010460 Create = dword ptr 10h
.text:00010460
.text:00010460 mov edi, edi
.text:00010462 push ebp
.text:00010463 mov ebp, esp
.text:00010465 sub esp, 8
.text:00010468 mov [ebp+var_8], 0
.text:0001046F movzx eax, byte ptr [ebp+Create]
Bookmarks