Article View: comp.lang.asm.x86
Article #54Re: Absolute addresses, relative addresses
From: Koms Bomb
Date: Wed, 27 Aug 2003 01:26
Date: Wed, 27 Aug 2003 01:26
39 lines
3647 bytes
3647 bytes
"Eric Minso" <minso@altern.org> wrote in message news:7db38e60.0308260511.4b9a371@posting.google.com... > The main problem is that it seems that assembly language is required > and I still have some troubles with absolute and relative addresses. No trouble. call @@1 @@1: pop ebp Then you can use ebp and offset @@1 to do you relative address, then you needn't absolute address any more. As you said, there are a lot of virus source code in the internet, you can learn how they use above code to play relative address. > The other main problem is that I fear my program will be seen as a > virus by antiviruses. Yup. If you redirect the entry point out of the code segment, some antivirus monitor will complain loudly when the user run the 'protected' program. Maybe you can learn some EPO technic from the viruses, but if so, maybe we should call your program as a 'virus', though it can't replicate itself :-) To do your mission, I suggest you read the UPX source code and see how it works, I believe it can help you much. UPX is a real compress program, no AV s/w will regard it as a virus :-). Like UPX, you should re-orgnize the PE file rather than append a piece of code to file. Above is my experience, I hope it will help you. -- Koms Bomb *****Pardon my poor English***** --------------------- My TASM homepage, resource for assembly. Tools, articles, links. http://komsbomb.ols-lab.com
Technical Details
Message-ID:
<bih2a5$9c0db$1@ID-165313.news.uni-berlin.de>Path:
arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-06!sn-post-01!supernews.com!corp.supernews.com!news.crayne.org!clax86!robomod!not-for-mailReferences:
<7db38e60.0308250121.6135ebc1@posting.google.com> <bieiii$8dsqb$1@ID-165313.news.uni-berlin.de> <7db38e60.0308260511.4b9a371@posting.google.com>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: f7d8d,44f17f79ebe31523 X-Google-Attributes: gidf7d8d,public X-Google-Thread: 1093da,44f17f79ebe31523 X-Google-Attributes: gid1093da,public X-Google-Thread: 114917,44f17f79ebe31523 X-Google-Attributes: gid114917,public X-Google-Thread: feaef,44f17f79ebe31523 X-Google-Attributes: gidfeaef,public X-Google-ArrivalTime: 2003-08-26 21:29:32 PST Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!sn-xit-06!sn-post-01!supernews.com!corp.supernews.com!news.crayne.org!clax86!robomod!not-for-mail From: "Koms Bomb" <KomsBombREMOVETHIS@hotmail.com> Newsgroups: comp.lang.asm.x86,alt.lang.asm,alt.os.assembly,borland.public.tasm Subject: Re: Absolute addresses, relative addresses Approved: CLAX86 Moderators <ccrayne@crayne.org> Date: Wed, 27 Aug 2003 09:26:46 +0800 Organization: Posted via Supernews, http://www.supernews.com Message-ID: <bih2a5$9c0db$1@ID-165313.news.uni-berlin.de> X-CLAX86-Policy: http://www.pacificsites.com/~ccrayne/clax86.html X-CLAX86-Faq: http://www.faqs.org/faqs/by-newsgroup/comp/comp.lang.asm.x86.html X-CLAX86-Info-1: Send submissions to comp-lang-asm-x86@moderators.isc.org X-CLAX86-Info-2: Send technical complaints to ccrayne@crayne.org X-CLAX86-Info-3: Send complaints about policy to ccrayne@crayne.org X-Comment: moderators do not necessarily agree or disagree with this article. References: <7db38e60.0308250121.6135ebc1@posting.google.com> <bieiii$8dsqb$1@ID-165313.news.uni-berlin.de> <7db38e60.0308260511.4b9a371@posting.google.com> X-Orig-NNTP-Posting-Host: 61.51.185.135 X-Orig-X-Trace: news.uni-berlin.de 1061948575 9830827 61.51.185.135 (16 [165313]) X-Priority: 3 X-MSMail-Priority: Normal X-Newsreader: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-MailScanner-Information: Please contact the ISP for more information X-MailScanner: Found to be clean X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (score=0.6, required 4, FORGED_HOTMAIL_RCVD 1.10, PRIORITY_NO_NAME 0.46, QUOTED_EMAIL_TEXT -0.48, REFERENCES -0.50) X-UIDL: *%T!!T_C"!),Z!!X4a!! X-Complaints-To: abuse@supernews.com Lines: 43