-
Notifications
You must be signed in to change notification settings - Fork 0
/
asmfunction.asm
199 lines (191 loc) · 4.43 KB
/
asmfunction.asm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
title "amd64 function"
_hookImplementFunction_x64 PROTO C
wrtext SEGMENT READ WRITE EXECUTE
BreakInt3 proc
int 3
ret
BreakInt3 endp
_hookImplementFunction proc
push rbx
push rcx
push rdx
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
push rbp
push rsp
pushfq
mov rbp, rsp
sub rsp, 200h
mov rcx, rbp
call _hookImplementFunction_x64
add rsp, 200h
popfq
add rsp, 8h
pop rbp
pop r15
pop r14
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
pop rdi
pop rsi
pop rdx
pop rcx
pop rbx
add rsp, 8h
ret
_hookImplementFunction endp
_callPreProcessing_x64 proc
; shadow spaces
mov qword ptr [rsp + 8],rcx ;__pnode
mov qword ptr [rsp + 10h],rdx ;__params
mov qword ptr [rsp + 18h],r8 ;__psize
mov qword ptr [rsp + 20h],r9 ;__post_func
;dword ptr [rsp + 28h] __status
push rbx
push rcx
push rdx
push r8
push r9
push r10
push r11
push r12
push r13
sub rsp, 100h
mov rax, qword ptr [rsp + 160h]
cdq
and rdx, 3
add rax, rdx
sar rax, 3
mov r11, rax
xor r12, r12
test rax, rax
jle for_exit
loop_start: ;Backward propagation argments
mov rax, r12
imul rbx, rax, 8
mov r10, qword ptr [rsp + 158h]
cmp rax, 0
jnz loop_1
mov rdx, qword ptr [r10]
jmp loop_4
loop_1:
cmp rax, 1
jnz loop_2
mov r8, qword ptr [r10 + rbx]
jmp loop_4
loop_2:
cmp rax, 2
jnz loop_3
mov r9, qword ptr [r10 + rbx]
jmp loop_4
loop_3:
mov r13, qword ptr [r10 + rbx]
mov qword ptr [rsp + rbx + 8h], r13
loop_4:
inc r12
cmp r12, r11
jl loop_start
for_exit:
mov rax, qword ptr [rsp + 168h]
call rax
mov rbx, qword ptr [rsp + 170h]
mov dword ptr [rbx], eax
add rsp, 100h
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
pop rdx
pop rcx
pop rbx
ret
_callPreProcessing_x64 endp
_callOrginApiFunction_x64 proc
; shadow spaces
mov qword ptr [rsp + 8],rcx ;__params
mov qword ptr [rsp + 10h],rdx ;__psize
mov qword ptr [rsp + 18h],r8 ;__call_conv, only support __fastcall x64 now
mov qword ptr [rsp + 20h],r9 ;__orgin_func
;qword ptr [rsp + 28h] __return
push rbx
push rcx
push rdx
push r8
push r9
push r10
push r11
push r12
push r13
sub rsp, 100h
mov rax, qword ptr [rsp + 158h]
cdq
and rdx, 3
add rax, rdx
sar rax, 3
mov r11, rax
xor r12, r12
test rax, rax
jle for_exit
loop_start: ;Backward propagation argments
mov rax, r12
imul rbx, rax, 8
mov r10, qword ptr [rsp + 150h]
cmp rax, 0
jnz loop_1
mov rcx, qword ptr [r10]
jmp loop_5
loop_1:
cmp rax, 1
jnz loop_2
mov rdx, qword ptr [r10 + rbx]
jmp loop_5
loop_2:
cmp rax, 2
jnz loop_3
mov r8, qword ptr [r10 + rbx]
jmp loop_5
loop_3:
cmp rax, 3
jnz loop_4
mov r9, qword ptr [r10 + rbx]
jmp loop_5
loop_4:
mov r13, qword ptr [r10 + rbx]
mov qword ptr [rsp + rbx], r13
loop_5:
inc r12
cmp r12, r11
jl loop_start
for_exit:
mov rax, qword ptr [rsp + 168h]
call rax
mov rbx, qword ptr [rsp + 170h]
mov qword ptr [rbx], rax
add rsp, 100h
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
pop rdx
pop rcx
pop rbx
ret
_callOrginApiFunction_x64 endp
wrtext ENDS
END