分类游戏安全下的文章 - 白帽Wiki

[2021]过反截图,截图中隐藏自己

阅读全文

2021-02-28 huoji 0 条评论

rdtsc检测,出现问题立刻调用KeAccumulateTicks蓝屏:
```cpp
push    rbx
sub     rsp, 20h
rdtsc
shl     rdx, 20h
or      rax, rdx
mov     [rsp], rax
xor     eax, eax
xor     ecx, ecx
cpuid
lea     r8, [rsp+10h]
mov     [r8], eax
mov     [r8+4], ebx
mov     [r8+8], ecx
mov     [r8+0Ch], edx
rdtsc
shl     rdx, 20h
or      rax, rdx
mov     [rsp+8], rax
mov     rax, [rsp]
mov     rcx, [rsp+8]
sub     rcx, rax
mov     rax, rcx
add     rsp, 20h
pop     rbx
```
wrmsr检测:
```cpp
push    rbp
push    rcx
push    r9
movzx   r9, bp
push    r13
movsxd  r9, r11d
movsx   r9w, bl
xchg    r9b, r9b
push    r14
movzx   r9w, spl
cmovno  r9d, r9d
movsx   r9d, dx
push    rdi
setz    r9b
movsx   edi, di
push    r8
movsx   r9, r10w
movzx   r9, di
mov     ax, ss
pushfq
or      dword ptr [rsp], 100h
popfq
and     eax, 0FFFFFEFFh
wrmsr
pushfq
mov     ss, ax
icebp
rdmsr
pushfq
push	r10
and     dword ptr [rsp], 0FFFFFEFFh
popfq
push    rdx
push    rax
push    r15
push    rsi
mov     ecx, 0C0000084h
or      dword ptr [rsp], 100h
popfq
syscall
mov     r10, rcx
mov     ecx, 0C0000084h
pop     rax
pop     rdx
push    r12
push    rbx
wrmsr与syscall
mov     rax, r10
xor 	eax, eax
inc 	eax
ror     r9d, 1
not     r9d
rol     r9d, 1
xor     r9d, 529C0010h
push    r10
add     r10, rbx
bswap   r10w
xor     [rsp+210h+var_210], r9d
shld    r10, r9, 0B4h
rcl     r10, cl
bsf     r10, rbp
pop     r10
jmp     loc_14033A00E
```

阅读全文

2021-02-25 huoji 0 条评论

二进制安全游戏安全 C/C++汇编