Someone said to do something like this to avoid scans for WPM calls:
__declspec(naked) BOOL WINAPI SafeWriteProcessMemory(HANDLE hProcess,
LPCVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize,
SIZE_T *lpNumberOfBytesRead)
{
__asm
{
mov edi, edi
push ebp
mov ebp, esp
pop ebp
mov eax, WriteProcessMemory
add eax, 6
jmp eax
}
}
I put it in a program and debugged it in olly. I looked at kernel32.WriteProcessMemory
. We're using the add eax, 6
to jump from here:
MOV EDI,EDI ; BOOL kernel32.WriteProcessMemory(hProcess, ...)
PUSH EBP
MOV EBP,ESP
POP EBP
JMP <JMP.&API-MS-Win-Core-Memory-L1-1-0. ; Jump to KERNELBASE.WriteProcessMemory
To there. Effectively skipping over the instructions between the two. We're executing those instructions in our own call. But I don't understand why those instructions are being executed. We're pushing EBP
onto the stack, moving ESP
into EBP
, then restoring EBP
from the stack. That shouldn't actually be doing anything.
I debugged it instruction-by-instruction, and still can't figure out why it's being done.
Does it have something to do with Windows' useless mov edi,edi
s at the beginning of functions to allow jump patching?