The art of Unpacking 번역 - SecretOfSh의 블로그

21 | 페이지
push 0x1000
push NULL
call [VirtualAlloc]
test eax,eax
jz .failed
mov [.pAllocatedMem],eax
; store a RETN on the allocated memory
mov byte [eax],0xc3
; then set the PAGE_GUARD attribute of the allocated memory
lea eax,[.dwOldProtect]
push eax
push PAGE_EXECUTE_READ | PAGE_GUARD
push 0x1000
push dword [.pAllocatedMem]
call [VirtualProtect]
; set marker (eax) as 0
xor eax,eax
; trigger a STATUS_GUARD_PAGE_VIOLATION exeception
call [.pAllocatedMem]
; check if marker had not been changed (exception handler not called)
test eax,eax
je .debugger_found
:::
.exception_handler