superexe.bat

超级增强断点源代码!配合trw2000和sice 使用!可以调试一些反调试的外壳和程序! 用vc编译

;@goto translate

;===============================================================================

.586P
.MODEL FLAT, STDCALL

 OPTION      CASEMAP :NONE

 INCLUDELIB  iKERNEL32.LIB
 INCLUDELIB  iUSER32.LIB

 INCLUDE     APIMACRO.MAC

 UNICODE     = 0
 ARGUMENTS   = 0  ;koliduje s hWnd a hDlg a..hInstance
 INCLUDE     W32MAIN.INC

.586P

 CallDriver  PROTO :DWORD


;===============================================================================
.DATA
 ID_ERASE   EQU  10H
 ID_MONITOR EQU  11H
 
 EN_ERASE   DWORD FALSE
 EN_MONITOR DWORD FALSE
 FuncFirst EQU 1
 ;GetVer    EQU 0
 Unhook    EQU 0+1
 Erase     EQU 1+1
 Monitor   EQU 2+1
 hDevice   DWORD ?
 hErase    DWORD ?
 hMonitor  DWORD ?

;===============================================================================

.CODE

CrFail                 BYTE "Can't load "
DosDeviceName	       BYTE "\\.\SuperBPM.VXD",0
;DosDeviceName	       BYTE "\\.\TRW.VXD",0
ErrTitle               BYTE "Perverse BPM",0
 
EVEN

WinMainCRTStartup:
PUBLIC WinMainCRTStartup

  hTemplateFile EQU 0
 iWin32 CreateFileA, <OFFSET DosDeviceName>,\
                     <GENERIC_READ OR GENERIC_WRITE>,\
                     <FILE_SHARE_READ OR FILE_SHARE_WRITE>,\
                     0,\
                     OPEN_EXISTING,\
                     FILE_FLAG_DELETE_ON_CLOSE,\
                     hTemplateFile
 CMP    EAX, -1
 JNE    CreateSuccess
 
 iWin32 MessageBoxA, 0, <OFFSET CrFail>, <OFFSET ErrTitle>, MB_ICONEXCLAMATION
 JMP    QuitIt

CreateSuccess:
 MOV    hDevice,EAX

 iWin32 GetModuleHandleA ,0
; MOV    hInst,EAX

; iWin32 DialogBoxParamW, hInst,1, 0, <OFFSET MainDlg>,0
 iWin32 DialogBoxParamA, EAX,1, 0, <OFFSET MainDlg>,0

 iWin32 CloseHandle, hDevice
QuitIt: 
 iWin32 ExitProcess, 0

EVEN
CallDriver PROC DrvFunc:DWORD
; LOCAL OutBuffer:    DWORD
 LOCAL BytesReturned:DWORD

 MOV   EAX, DrvFunc
 LEA   ECX, BytesReturned
; LEA   EDX, OutBuffer
 SUB   EDX, EDX  
; INC    EAX ;OR    EAX, (FuncFirst+0)
 iWin32 DeviceIoControl, hDevice, EAX, EDX, EDX, EDX, EDX, ECX,  EDX
; OR    EAX, EAX
; MOV   EAX, OutBuffer.MainReturnCode
 RET
CallDriver ENDP


MainDlg PROC NEAR32 STDCALL PUBLIC USES EBX ESI EDI,\
	hDlg:DWORD, wmsg:DWORD, wparam:DWORD, lparam:DWORD

;        MOV     ECX, hDlg
        MOV     EAX, wmsg
;        MOV     hWnd, ECX
  
        CMP     EAX, WM_INITDIALOG
        JNE     @f
;        iWin32  LoadIconW, hInst, ID_ICON 
;        iWin32  SendMessageW, hWnd, WM_SETICON, FALSE, EAX

	iWin32	GetDlgItem, hDlg, ID_ERASE
	MOV	hErase,EAX

	iWin32	GetDlgItem, hDlg, ID_MONITOR
	MOV	hMonitor,EAX
        JMP     SuccReturn  

        @@:
        CMP     EAX, WM_COMMAND
        JNE     CheckExit
	MOVZX	EAX, word ptr [wparam]
        CMP     EAX, ID_ERASE
        JNE     @f  

	iWin32	EnableWindow, hMonitor, EN_MONITOR
        XOR     EN_MONITOR,1
        JE      UnhookSTC  
        PUSH    Erase                
        JMP     HookSTC

       @@: 
	iWin32	EnableWindow, hErase, EN_ERASE
        XOR     EN_ERASE,1
        JE      UnhookSTC  
        PUSH    Monitor
        JMP     HookSTC

      UnhookSTC:
        PUSH    Unhook 
      HookSTC:
	CALL	CallDriver
        JMP     SuccReturn


      CheckExit:
        CMP     EAX, WM_CLOSE
        JNE     Default
       
	INVOKE	CallDriver, Unhook
      FineUnHooked:
	iWin32	EndDialog, hDlg, TRUE

    SuccReturn:
        SUB     EAX,  EAX
        INC     EAX
	JMP	Return
    Default:
	SUB     EAX, EAX 
    Return:
	RET

MainDlg ENDP






END ;WinMainCRTStartup

:translate
@echo off
ML /c /coff %0
C:\BC5\BIN\BRC32.EXE -r -w40 SupeEXEr.rc
CVTRES SupeEXEr /MACHINE:IX86 
LINK.EXE SuperEXE.obj SupeEXEr.obj /OUT:SuperBPM.exe /SUBSYSTEM:WINDOWS /RELEASE /ALIGN:0X1000 /SECTION:SuperBPM,EWR /MERGE:.data=.text /MERGE:.rdata=.text /MERGE:.text=SuperBPM
EDITBIN -RELEASE -SECTION:.rsrc=SuperBPM SuperBPM.exe
DEL SuperEXE.obj
DEL SupeEXEr.obj
DEL SupeEXEr.res