The art of Unpacking 번역 - SecretOfSh의 블로그

43 | 페이지
push .exception_handler
push dword [fs:0]
mov [fs:0],esp
; throw an exception
xor eax,eax
mov dword [eax],0
; restore exception handler
pop dword [fs:0]
add esp,4
:::
.exception_handler
;EAX = CONTEXT record
mov eax,[esp+0xc]
;Clear Debug Registers: Context .Dr0-Dr3,Dr6,Dr7
mov dword [eax+0x04].0
mov dword [eax+0x08].0
mov dword [eax+0x0c].0
mov dword [eax+0x10].0
mov dword [eax+0x14].0
mov dword [eax+0x18].0
;set Context.EIP upon return
add dword [eax+0xb8],6