modfakecodehere.bas

软件作者：kylinpoet (E.S.T) PS：发现网上用VB写加花程序的源码很难找 同时也为了加深一下对PE结构的了解 就动手写了这个程序 本来还想加个 crc校验 或者 修改PE结

Attribute VB_Name = "ModFakeCodeHere"
'********************************************
''' 作者:kylinpoet or 獬独
''''2007-05-14 23:44 初稿
''''2007-05-15 13:32 修改
''''转载请保留作者 声明
'********************************************
'IsDebuggerPresent   'eax = 1 表示有调试
'00401C2B      50                push    eax
'00401C2C >    64:A1 18000000    mov     eax, dword ptr fs:[18]           ;  (initial cpu selection)
'00401C32      8B40 30           mov     eax, dword ptr [eax+30]
'00401C35      0FB640 02         movzx   eax, byte ptr [eax+2]
'00401C39      85C0              test    eax, eax
'00401C3B    - 75 FE             jnz     short 00401C3B
'00401C3D      58                pop     eax









'EXECryptor 特征码
'最后的E9 是jmp 的OPCODE
Public Const strEXECryptor  As String = "E8240000008B4C240CC70117000100C781B80000000000000031C089411489411880A1C1000000FEC3"
Public Const strAsPack As String = "60E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB0040000061"
Public Const strBJFNT As String = "EB033A4D3A1EEB02CD209CEB02CD20EB02CD2060619D1F"
Public Const strExeShield As String = "E8040000008360EB0C5DEB050000000000"
Public Const strIsDebuggerPresent = "5064A1180000008B40300FB6400285C075FE58"