Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

检测关键函数的前几条指令内容 #40

Closed
liaogang opened this issue Sep 20, 2018 · 1 comment
Closed

检测关键函数的前几条指令内容 #40

liaogang opened this issue Sep 20, 2018 · 1 comment

Comments

@liaogang
Copy link

您好，我看你的博客有这个inlinehook对抗的文章
里面有对inlinehook前几条指令内容进行，判断的方法。
一般来说使用 inlinehook 进行 hook 函数, 修改函数的前几条指令为跳转指令. 可以通过这个进行校验.

比如有一个检测函数对传入的函数地址的第二条指令进行了判断，如果是跳转指令则认为它是被修改过的了。　我想把前二条指令修改为垃圾指令，该从什么地方入手呢？
@jmpews
Copy link
Owner

jmpews commented Oct 11, 2018

个人感觉你的思路有点偏差, 你应该关注的是哪里读取的这个函数前几条指令进行检测, 以为即使你改成其他指令, 别人也知道你做了 patch.

@jmpews jmpews closed this as completed Oct 11, 2018
@lozn00 lozn00 mentioned this issue May 9, 2019
Closed
@Lamfi Lamfi mentioned this issue Dec 8, 2020
Closed
@daaoling daaoling mentioned this issue Apr 23, 2021
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@liaogang @jmpews