+- الفريق العربي للهندسة العكسية (https://www.at4re.net/f)
+-- قسم : منتديات البرمجة - Programming Forums (https://www.at4re.net/f/forum-5.html)
+--- قسم : البرمجة بالأسمبلي - Assembly Section (https://www.at4re.net/f/forum-16.html)
+--- الموضوع : Get register(snif) 2 method src (/thread-2490.html)
Get register(snif) 2 method src - kesmezar - 24-01-2021
السلام عليكم
Esselâmun aleykum
ربما هناك حاجة.
rp:at4re
(I write using translation)
RE: Get register(snif) 2 method src - vosiyons - 25-01-2021
Thanks mate
RE: Get register(snif) 2 method src - icrypto - 31-01-2021
? Is there any chance to adapt it to get registers values from 64 bit program
RE: Get register(snif) 2 method src - kesmezar - 31-01-2021
يجب أن تعمل eax-rax / edx-rdx عليها. ربما سيساعد شخص ما باستخدام 64 بت. جربه بتحويل بسيط مثل
It needs to work on it. Maybe someone using 64 bit will help. Try it with a simple conversion like eax-rax / edx-rdx.
RE: Get register(snif) 2 method src - icrypto - 31-01-2021
.Can you please! provide an external download link ? cause I haven't download privilege yet
RE: Get register(snif) 2 method src - kesmezar - 31-01-2021
Please read the forum rules. 5 useful shares and you are free. Or read better codes from the archive https://www.at4re.net/f/thread-508.html.
يرجى قراءة قواعد المنتدى. 5 مشاركات مفيدة وأنت حر. أو اقرأ أكواد أفضل من الأرشيف https://www.at4re.net/f/thread-508.html.
RE: Get register(snif) 2 method src - icrypto - 31-01-2021
(31-01-2021, 10:14 AM)kesmezar كتب : 5 useful shares and you are free
!Ok thanks
RE: Get register(snif) 2 method src - icrypto - 04-02-2021
! Hi
.Converted on the fly to build 64 bit release
.Converted on the fly to build 64 bit release
include masm64rt.inc
;;---------------------------------------
.const
IDD_DIALOG equ 101
GET_REG_BTN equ 2000
raxAddrEdt equ 1003
rcxAddrEdt equ 1005
rdxAddrEdt equ 1007
rbxAddrEdt equ 1009
rspAddrEdt equ 1011
rbpAddrEdt equ 1013
rsiAddrEdt equ 1015
rdiAddrEdt equ 1017
raxRegValueEdt equ 1018
rcxRegValueEdt equ 1019
rdxRegValueEdt equ 1020
rbxRegValueEdt equ 1021
rspRegValueEdt equ 1022
rbpRegValueEdt equ 1023
rsiRegValueEdt equ 1024
rdiRegValueEdt equ 1025
TargetAddress equ 004503EFh
InfiniteLoopBytes db 0EBh, 0FEh, 0
OriginalBytesBuff db 00h, 00h, 0
FileName db "CrackMe.exe", 0
Format db "%p", 0
;;---------------------------------------
.data
PI PROCESS_INFORMATION<>
SSI STARTUPINFO<>
align 8
ctx CONTEXT64<>
;;---------------------------------------
.data?
hInstance dq ?
dqBuff dq ?
RaxBuff db 50 dup (?)
RcxBuff db 50 dup (?)
RdxBuff db 50 dup (?)
RbxBuff db 50 dup (?)
RspBuff db 50 dup (?)
RbpBuff db 50 dup (?)
RsiBuff db 50 dup (?)
RdiBuff db 50 dup (?)
ThreadID dd ?
;;---------------------------------------
.code
GetRegisterValues proc hWin:HWND
invoke CreateProcess, addr FileName, 0, 0, 0, FALSE, CREATE_SUSPENDED, 0, 0, addr SSI, addr PI
invoke ReadProcessMemory, PI.hProcess, TargetAddress, addr OriginalBytesBuff, 2, 0
invoke WriteProcessMemory, PI.hProcess, TargetAddress, addr InfiniteLoopBytes, 2, 0
invoke ResumeThread, PI.hThread
mov ctx.ContextFlags, CONTEXT_FULL
@InfiniteLoop:
invoke GetThreadContext, PI.hThread, addr ctx
.if (ctx.Rip ~= TargetAddress)
jmp @InfiniteLoop
.endif
invoke SuspendThread, PI.hThread
invoke GetThreadContext, PI.hThread, addr ctx
mov rax, qword ptr ctx+120 ;; --> ctx.Rax
mov dqBuff, rax
invoke wsprintf, addr RaxBuff, addr Format, dqBuff
invoke SetDlgItemText, hWin, raxAddrEdt, addr RaxBuff
invoke ReadProcessMemory, PI.hProcess, dqBuff, addr RaxBuff, 50, 0
invoke SetDlgItemText, hWin, raxRegValueEdt, addr RaxBuff
mov rax, qword ptr ctx+128 ;; --> ctx.Rcx
mov dqBuff, rax
invoke wsprintf, addr RcxBuff, addr Format, dqBuff
invoke SetDlgItemText, hWin, rcxAddrEdt, addr RcxBuff
invoke ReadProcessMemory, PI.hProcess, dqBuff, addr RcxBuff, 50, 0
invoke SetDlgItemText, hWin, rcxRegValueEdt, addr RcxBuff
mov rax, qword ptr ctx+136 ;; --> ctx.Rdx
mov dqBuff, rax
invoke wsprintf, addr RdxBuff, addr Format, dqBuff
invoke SetDlgItemText, hWin, rdxAddrEdt, addr RdxBuff
invoke ReadProcessMemory, PI.hProcess, dqBuff, addr RdxBuff, 50, 0
invoke SetDlgItemText, hWin, rdxRegValueEdt, addr RdxBuff
mov rax, qword ptr ctx+144 ;; --> ctx.Rbx
mov dqBuff, rax
invoke wsprintf, addr RbxBuff, addr Format, dqBuff
invoke SetDlgItemText, hWin, rbxAddrEdt, addr RbxBuff
invoke ReadProcessMemory, PI.hProcess, dqBuff, addr RbxBuff, 50, 0
invoke SetDlgItemText, hWin, rbxRegValueEdt, addr RbxBuff
mov rax, qword ptr ctx+152 ;; --> ctx.Rsp
mov dqBuff, rax
invoke wsprintf, addr RspBuff, addr Format, dqBuff
invoke SetDlgItemText, hWin, rspAddrEdt, addr RspBuff
invoke ReadProcessMemory, PI.hProcess, dqBuff, addr RspBuff, 50, 0
invoke SetDlgItemText, hWin, rspRegValueEdt, addr RspBuff
mov rax, qword ptr ctx+160 ;; --> ctx.Rbp
mov dqBuff, rax
invoke wsprintf, addr RbpBuff, addr Format, dqBuff
invoke SetDlgItemText, hWin, rbpAddrEdt, addr RbpBuff
invoke ReadProcessMemory, PI.hProcess, dqBuff, addr RbpBuff, 50, 0
invoke SetDlgItemText, hWin, rbpRegValueEdt, addr RbpBuff
mov rax, qword ptr ctx+168 ;; --> ctx.Rsi
mov dqBuff, rax
invoke wsprintf, addr RsiBuff, addr Format, dqBuff
invoke SetDlgItemText, hWin, rsiAddrEdt, addr RsiBuff
invoke ReadProcessMemory, PI.hProcess, dqBuff, addr RsiBuff, 50, 0
invoke SetDlgItemText, hWin, rsiRegValueEdt, addr RsiBuff
mov rax, qword ptr ctx+176 ;; --> ctx.Rdi
mov dqBuff, rax
invoke wsprintf, addr RdiBuff, addr Format, dqBuff
invoke SetDlgItemText, hWin, rdiAddrEdt, addr RdiBuff
invoke ReadProcessMemory, PI.hProcess, dqBuff, addr RdiBuff, 50, 0
invoke SetDlgItemText, hWin, rdiRegValueEdt, addr RdiBuff
invoke WriteProcessMemory, PI.hProcess, TargetAddress, addr OriginalBytesBuff, 2, 0
invoke ResumeThread, PI.hThread
ret
GetRegisterValues endp
;;---------------------------------------
DlgProc proc hWin:QWORD, uMsg:QWORD, wParam:QWORD, lParam:QWORD
mov rax, uMsg
.if rax == WM_INITDIALOG
.elseif rax == WM_COMMAND
.if wParam == GET_REG_BTN
invoke CreateThread, NULL, 0, addr GetRegisterValues, hWin, 0, addr ThreadID
.endif
.elseif rax == WM_CLOSE
invoke EndDialog, hWin, 0
.else
mov rax, FALSE
ret
.endif
mov rax, TRUE
ret
DlgProc endp
;;---------------------------------------
start proc
invoke GetModuleHandleA, NULL
mov hInstance, rax
invoke DialogBoxParam, hInstance, IDD_DIALOG, NULL, addr DlgProc, NULL
invoke ExitProcess, 0
ret
start endp
end