feat: Improve the "Encrypt Obfuscated Code" feature to use TeaDelKew for encryption
- The "Encrypt Obfuscated Code" feature is now complete, using a new encryption algorithm called TeaDelKew, which is based on XTEA, to encrypt all obfuscated code and decrypt it at the entry point before execution. - Some code improvements were also made.
This commit is contained in:
keowu
@@ -261,7 +261,7 @@ bool Ryujin::run(const RyujinObfuscatorConfig& config) {
|
||||
}
|
||||
|
||||
// Encrypt all obfuscated code
|
||||
if (config.m_isEncryptObfuscatedCode) {
|
||||
if (config.m_isEncryptObfuscatedCode && !config.m_isRandomSection) {
|
||||
|
||||
/*
|
||||
To "encrypt" all the obfuscated code:
|
||||
@@ -271,81 +271,308 @@ bool Ryujin::run(const RyujinObfuscatorConfig& config) {
|
||||
4 - We will then have the code ready to be properly executed.
|
||||
*/
|
||||
|
||||
// Logic to encrypt executable code.
|
||||
for (auto& byte : opcodesWithRelocsFixed) byte ^= 0x37; // TODO: Make this better - XOR n<>o <20> criptografia.
|
||||
/*
|
||||
Begin TeaDelKew algorithm Implementation
|
||||
(C) Jo<4A>o Vitor(@Keowu) avaliable on https://github.com/keowu/gamespy/blob/main/code_base/Kurumi/TeaDelKewTests/TeaDelKewAlgo.hh#L2
|
||||
*/
|
||||
|
||||
// Aligning the data so we can run TeaDelKew
|
||||
while (opcodesWithRelocsFixed.size() % 8 != 0) {
|
||||
|
||||
opcodesWithRelocsFixed.push_back(0x00);
|
||||
offsetVA += 1;
|
||||
|
||||
}
|
||||
|
||||
// TEADELKEW key
|
||||
uint32_t key[4] = {
|
||||
|
||||
0x77122545, 0x88998877, 0x9944DEAD, 0x10CAFEB4
|
||||
|
||||
};
|
||||
|
||||
// TEADELKEW KeyBox
|
||||
uint32_t kew_box[12] = {
|
||||
|
||||
0x77122545, 0x88998877, 0x9944DEAD, 0x10CAFEB4,
|
||||
0x45B0B0C4, 0x35DEADDE, 0x25C4C4C4, 0x85634897,
|
||||
0x56123456, 0x11454545, 0x12323232, 0x95959595
|
||||
|
||||
};
|
||||
|
||||
// Encrypting all the opcode generated by the obfuscator using the TeaDelKew algorithm
|
||||
for (size_t i = 0; i < opcodesWithRelocsFixed.size(); i += 8) {
|
||||
|
||||
uint32_t* block = reinterpret_cast<uint32_t*>(&opcodesWithRelocsFixed[i]);
|
||||
|
||||
uint32_t v0 = ~block[0];
|
||||
uint32_t v1 = ~block[1];
|
||||
|
||||
uint32_t sum = 0;
|
||||
uint32_t delta = 0x00B0B0C4;
|
||||
|
||||
uint32_t k0 = key[0] ^ 0xDEADBEEF;
|
||||
uint32_t k1 = key[1] ^ 0xDEADBEEF;
|
||||
uint32_t k2 = key[2] ^ 0xDEADBEEF;
|
||||
uint32_t k3 = key[3] ^ 0xDEADBEEF;
|
||||
|
||||
for (int j = 0; j < 2048; j++) {
|
||||
|
||||
v1 ^= kew_box[j % 12];
|
||||
v0 ^= kew_box[j % 12];
|
||||
v1 ^= (j * 0x44444444 ^ ~j);
|
||||
v0 ^= (j * 0x44444444 ^ ~j);
|
||||
|
||||
}
|
||||
|
||||
for (int j = 0; j < 2048; j++) {
|
||||
|
||||
v0 += ~((v1 << 4 ^ v1 >> 5) + v1) ^ (sum + k0);
|
||||
sum += delta;
|
||||
v1 += ~((v0 << 4 ^ v0 >> 5) + v0) ^ (sum + k1);
|
||||
|
||||
}
|
||||
|
||||
block[0] = v0;
|
||||
block[1] = v1;
|
||||
}
|
||||
|
||||
// Entry point stub to decrypt the obfuscated code
|
||||
std::vector<unsigned char> entryPoint = {
|
||||
|
||||
0x40, 0x57, 0x48, 0x81, 0xEC, 0xA0, 0x00, 0x00, 0x00, 0x65, 0x48, 0x8B,
|
||||
0x04, 0x25, 0x60, 0x00, 0x00, 0x00, 0x48, 0x89, 0x44, 0x24, 0x70, 0x48,
|
||||
0x83, 0x7C, 0x24, 0x70, 0x00, 0x75, 0x05, 0xE9, 0x0A, 0x03, 0x00, 0x00,
|
||||
0x48, 0x8B, 0x44, 0x24, 0x70, 0x48, 0x8B, 0x40, 0x10, 0x48, 0x89, 0x44,
|
||||
0x24, 0x58, 0x48, 0x83, 0x7C, 0x24, 0x58, 0x00, 0x75, 0x05, 0xE9, 0xEF,
|
||||
0x02, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x58, 0x48, 0x89, 0x44, 0x24,
|
||||
0x78, 0x48, 0x8B, 0x44, 0x24, 0x78, 0x0F, 0xB7, 0x00, 0x3D, 0x4D, 0x5A,
|
||||
0x00, 0x00, 0x74, 0x05, 0xE9, 0xD1, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x44,
|
||||
0x24, 0x78, 0x48, 0x63, 0x40, 0x3C, 0x48, 0x8B, 0x4C, 0x24, 0x58, 0x48,
|
||||
0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x44, 0x24, 0x60, 0x48, 0x8B,
|
||||
0x44, 0x24, 0x60, 0x81, 0x38, 0x50, 0x45, 0x00, 0x00, 0x74, 0x05, 0xE9,
|
||||
0xA6, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x60, 0x0F, 0xB7, 0x40,
|
||||
0x06, 0x66, 0x89, 0x44, 0x24, 0x48, 0x48, 0x8B, 0x44, 0x24, 0x60, 0x0F,
|
||||
0xB7, 0x40, 0x14, 0x48, 0x8B, 0x4C, 0x24, 0x60, 0x48, 0x8D, 0x44, 0x01,
|
||||
0x18, 0x48, 0x89, 0x44, 0x24, 0x50, 0x48, 0x8D, 0x44, 0x24, 0x38, 0x48,
|
||||
0x8B, 0xF8, 0x33, 0xC0, 0xB9, 0x09, 0x00, 0x00, 0x00, 0xF3, 0xAA, 0xC6,
|
||||
0x44, 0x24, 0x20, 0x2E, 0xC6, 0x44, 0x24, 0x21, 0x52, 0xC6, 0x44, 0x24,
|
||||
0x22, 0x79, 0xC6, 0x44, 0x24, 0x23, 0x75, 0xC6, 0x44, 0x24, 0x24, 0x6A,
|
||||
0xC6, 0x44, 0x24, 0x25, 0x69, 0xC6, 0x44, 0x24, 0x26, 0x6E, 0xC6, 0x44,
|
||||
0x24, 0x27, 0x00, 0x48, 0x8D, 0x44, 0x24, 0x28, 0x48, 0x8B, 0xF8, 0x33,
|
||||
0xC0, 0xB9, 0x01, 0x00, 0x00, 0x00, 0xF3, 0xAA, 0x48, 0xB8, 0x99, 0x99,
|
||||
0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x48, 0x89, 0x84, 0x24, 0x90, 0x00,
|
||||
0x00, 0x00, 0x48, 0xB8, 0x88, 0x88, 0x88, 0x88, 0x88, 0x88, 0x88, 0x88,
|
||||
0x48, 0x89, 0x84, 0x24, 0x88, 0x00, 0x00, 0x00, 0xC7, 0x44, 0x24, 0x4C,
|
||||
0x00, 0x00, 0x00, 0x00, 0xEB, 0x18, 0x8B, 0x44, 0x24, 0x4C, 0xFF, 0xC0,
|
||||
0x89, 0x44, 0x24, 0x4C, 0x48, 0x8B, 0x44, 0x24, 0x50, 0x48, 0x83, 0xC0,
|
||||
0x28, 0x48, 0x89, 0x44, 0x24, 0x50, 0x0F, 0xB7, 0x44, 0x24, 0x48, 0x39,
|
||||
0x44, 0x24, 0x4C, 0x0F, 0x8D, 0xE1, 0x01, 0x00, 0x00, 0xC7, 0x44, 0x24,
|
||||
0x30, 0x00, 0x00, 0x00, 0x00, 0xEB, 0x0A, 0x8B, 0x44, 0x24, 0x30, 0xFF,
|
||||
0xC0, 0x89, 0x44, 0x24, 0x30, 0x83, 0x7C, 0x24, 0x30, 0x08, 0x7D, 0x19,
|
||||
0x48, 0x63, 0x44, 0x24, 0x30, 0x48, 0x63, 0x4C, 0x24, 0x30, 0x48, 0x8B,
|
||||
0x54, 0x24, 0x50, 0x0F, 0xB6, 0x04, 0x02, 0x88, 0x44, 0x0C, 0x38, 0xEB,
|
||||
0xD6, 0xB8, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC0, 0x08, 0xC6, 0x44,
|
||||
0x04, 0x38, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x50, 0x8B, 0x40, 0x0C, 0x89,
|
||||
0x44, 0x24, 0x68, 0x48, 0x8B, 0x44, 0x24, 0x50, 0x8B, 0x40, 0x08, 0x89,
|
||||
0x44, 0x24, 0x6C, 0x8B, 0x44, 0x24, 0x68, 0x48, 0x8B, 0x4C, 0x24, 0x58,
|
||||
0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84, 0x24, 0x80, 0x00,
|
||||
0x00, 0x00, 0xB8, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC0, 0x00, 0x0F,
|
||||
0xBE, 0x44, 0x04, 0x38, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9,
|
||||
0x00, 0x0F, 0xBE, 0x4C, 0x0C, 0x20, 0x3B, 0xC1, 0x0F, 0x85, 0x47, 0x01,
|
||||
0x00, 0x00, 0xB8, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC0, 0x01, 0x0F,
|
||||
0xBE, 0x44, 0x04, 0x38, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9,
|
||||
0x01, 0x0F, 0xBE, 0x4C, 0x0C, 0x20, 0x3B, 0xC1, 0x0F, 0x85, 0x23, 0x01,
|
||||
0x00, 0x00, 0xB8, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC0, 0x02, 0x0F,
|
||||
0xBE, 0x44, 0x04, 0x38, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9,
|
||||
0x02, 0x0F, 0xBE, 0x4C, 0x0C, 0x20, 0x3B, 0xC1, 0x0F, 0x85, 0xFF, 0x00,
|
||||
0x00, 0x00, 0xB8, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC0, 0x03, 0x0F,
|
||||
0xBE, 0x44, 0x04, 0x38, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9,
|
||||
0x03, 0x0F, 0xBE, 0x4C, 0x0C, 0x20, 0x3B, 0xC1, 0x0F, 0x85, 0xDB, 0x00,
|
||||
0x00, 0x00, 0xB8, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC0, 0x04, 0x0F,
|
||||
0xBE, 0x44, 0x04, 0x38, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9,
|
||||
0x04, 0x0F, 0xBE, 0x4C, 0x0C, 0x20, 0x3B, 0xC1, 0x0F, 0x85, 0xB7, 0x00,
|
||||
0x00, 0x00, 0xB8, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC0, 0x05, 0x0F,
|
||||
0xBE, 0x44, 0x04, 0x38, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9,
|
||||
0x05, 0x0F, 0xBE, 0x4C, 0x0C, 0x20, 0x3B, 0xC1, 0x0F, 0x85, 0x93, 0x00,
|
||||
0x00, 0x00, 0xB8, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC0, 0x06, 0x0F,
|
||||
0xBE, 0x44, 0x04, 0x38, 0xB9, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9,
|
||||
0x06, 0x0F, 0xBE, 0x4C, 0x0C, 0x20, 0x3B, 0xC1, 0x75, 0x73, 0xC7, 0x44,
|
||||
0x24, 0x34, 0x00, 0x00, 0x00, 0x00, 0xEB, 0x0A, 0x8B, 0x44, 0x24, 0x34,
|
||||
0xFF, 0xC0, 0x89, 0x44, 0x24, 0x34, 0x48, 0x63, 0x44, 0x24, 0x34, 0x8B,
|
||||
0x4C, 0x24, 0x6C, 0x48, 0x2B, 0x8C, 0x24, 0x88, 0x00, 0x00, 0x00, 0x48,
|
||||
0x3B, 0xC1, 0x73, 0x26, 0x48, 0x63, 0x44, 0x24, 0x34, 0x48, 0x8B, 0x8C,
|
||||
0x24, 0x80, 0x00, 0x00, 0x00, 0x0F, 0xB6, 0x04, 0x01, 0x83, 0xF0, 0x37,
|
||||
0x48, 0x63, 0x4C, 0x24, 0x34, 0x48, 0x8B, 0x94, 0x24, 0x80, 0x00, 0x00,
|
||||
0x00, 0x88, 0x04, 0x0A, 0xEB, 0xBA, 0x48, 0x8B, 0x84, 0x24, 0x90, 0x00,
|
||||
0x00, 0x00, 0x48, 0x8B, 0x4C, 0x24, 0x58, 0x48, 0x03, 0xC8, 0x48, 0x8B,
|
||||
0xC1, 0x48, 0x89, 0x84, 0x24, 0x98, 0x00, 0x00, 0x00, 0xFF, 0x94, 0x24,
|
||||
0x98, 0x00, 0x00, 0x00, 0x90, 0xE9, 0xF8, 0xFD, 0xFF, 0xFF, 0x48, 0x81,
|
||||
0xC4, 0xA0, 0x00, 0x00, 0x00, 0x5F, 0xC3
|
||||
/*
|
||||
#pragma optimize("", off)
|
||||
__declspec(noinline) __declspec(safebuffers)void ryujinEntryPoint() {
|
||||
|
||||
auto peb = reinterpret_cast<PVOID>(__readgsqword(0x60));
|
||||
if (!peb) return;
|
||||
|
||||
auto imageBase = *reinterpret_cast<PVOID*>(reinterpret_cast<BYTE*>(peb) + 0x10);
|
||||
if (!imageBase) return;
|
||||
|
||||
auto dos = reinterpret_cast<PIMAGE_DOS_HEADER>(imageBase);
|
||||
if (dos->e_magic != 0x5A4D) return;
|
||||
|
||||
auto nt = reinterpret_cast<PIMAGE_NT_HEADERS64>(reinterpret_cast<BYTE*>(imageBase) + dos->e_lfanew);
|
||||
if (nt->Signature != 0x00004550) return;
|
||||
|
||||
auto numSections = nt->FileHeader.NumberOfSections;
|
||||
auto section = IMAGE_FIRST_SECTION(nt);
|
||||
|
||||
char name[9] { 0 };
|
||||
char chLookingName[9] { '.', 'R', 'y', 'u', 'j', 'i', 'n', '\0' };
|
||||
uintptr_t rvaEntryPointOriginal = 0x9999999999999999;
|
||||
uintptr_t szStub = 0x8888888888888888;
|
||||
|
||||
for (auto i = 0; i < numSections; ++i, ++section) {
|
||||
|
||||
for (auto j = 0; j < 8; ++j) name[j] = section->Name[j];
|
||||
name[8] = 0;
|
||||
|
||||
auto rva = section->VirtualAddress;
|
||||
auto size = section->Misc.VirtualSize;
|
||||
auto va = reinterpret_cast<uintptr_t>((BYTE*)imageBase + rva);
|
||||
|
||||
if (name[0] == chLookingName[0] && name[1] == chLookingName[1] && name[2] == chLookingName[2] && name[3] == chLookingName[3]
|
||||
&& name[4] == chLookingName[4] && name[5] == chLookingName[5] && name[6] == chLookingName[6]) {
|
||||
|
||||
uint32_t kew_box[12] = {
|
||||
|
||||
0x77122545, 0x88998877, 0x9944DEAD, 0x10CAFEB4,
|
||||
0x45B0B0C4, 0x35DEADDE, 0x25C4C4C4, 0x85634897,
|
||||
0x56123456, 0x11454545, 0x12323232, 0x95959595
|
||||
|
||||
};
|
||||
|
||||
for (auto i = 0; i < (size - szStub); i += 8) {
|
||||
|
||||
if ((i + 8) > (size - szStub)) break;
|
||||
|
||||
auto* block = reinterpret_cast<uint32_t*>(va + i);
|
||||
|
||||
auto v0 = block[0];
|
||||
auto v1 = block[1];
|
||||
|
||||
uint32_t key[4] = {
|
||||
|
||||
0x77122545, 0x88998877,
|
||||
0x9944DEAD, 0x10CAFEB4
|
||||
|
||||
};
|
||||
|
||||
uint32_t sum = 0x85862000, delta = 0x00B0B0C4;
|
||||
|
||||
uint32_t k0 = key[0] ^ 0xDEADBEEF, k1 = key[1] ^ 0xDEADBEEF,
|
||||
k2 = key[2] ^ 0xDEADBEEF, k3 = key[3] ^ 0xDEADBEEF;
|
||||
|
||||
for (auto j = 0; j < 2048; j++) {
|
||||
|
||||
v1 -= ~((v0 << 4 ^ v0 >> 5) + v0) ^ (sum + k1);
|
||||
sum -= delta;
|
||||
v0 -= ~((v1 << 4 ^ v1 >> 5) + v1) ^ (sum + k0);
|
||||
|
||||
}
|
||||
|
||||
for (auto j = 0; j < 2048; j++) {
|
||||
|
||||
v1 ^= kew_box[j % 12];
|
||||
v0 ^= kew_box[j % 12];
|
||||
v1 ^= (j * 0x44444444 ^ ~j);
|
||||
v0 ^= (j * 0x44444444 ^ ~j);
|
||||
|
||||
}
|
||||
|
||||
block[0] = ~v0;
|
||||
block[1] = ~v1;
|
||||
}
|
||||
|
||||
using tpdEntryPoint = void(__stdcall*)();
|
||||
tpdEntryPoint oep = reinterpret_cast<tpdEntryPoint>(reinterpret_cast<uintptr_t>(imageBase) + rvaEntryPointOriginal);
|
||||
oep();
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
#pragma optimize("", on)
|
||||
*/
|
||||
0x40, 0x57, 0x48, 0x81, 0xEC, 0x20, 0x01, 0x00, 0x00, 0x65, 0x48, 0x8B,
|
||||
0x04, 0x25, 0x60, 0x00, 0x00, 0x00, 0x48, 0x89, 0x84, 0x24, 0xB0, 0x00,
|
||||
0x00, 0x00, 0x48, 0x83, 0xBC, 0x24, 0xB0, 0x00, 0x00, 0x00, 0x00, 0x75,
|
||||
0x05, 0xE9, 0x26, 0x06, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0xB0, 0x00,
|
||||
0x00, 0x00, 0x48, 0x8B, 0x40, 0x10, 0x48, 0x89, 0x44, 0x24, 0x78, 0x48,
|
||||
0x83, 0x7C, 0x24, 0x78, 0x00, 0x75, 0x05, 0xE9, 0x08, 0x06, 0x00, 0x00,
|
||||
0x48, 0x8B, 0x44, 0x24, 0x78, 0x48, 0x89, 0x84, 0x24, 0xB8, 0x00, 0x00,
|
||||
0x00, 0x48, 0x8B, 0x84, 0x24, 0xB8, 0x00, 0x00, 0x00, 0x0F, 0xB7, 0x00,
|
||||
0x3D, 0x4D, 0x5A, 0x00, 0x00, 0x74, 0x05, 0xE9, 0xE4, 0x05, 0x00, 0x00,
|
||||
0x48, 0x8B, 0x84, 0x24, 0xB8, 0x00, 0x00, 0x00, 0x48, 0x63, 0x40, 0x3C,
|
||||
0x48, 0x8B, 0x4C, 0x24, 0x78, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48,
|
||||
0x89, 0x84, 0x24, 0x80, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x80,
|
||||
0x00, 0x00, 0x00, 0x81, 0x38, 0x50, 0x45, 0x00, 0x00, 0x74, 0x05, 0xE9,
|
||||
0xB0, 0x05, 0x00, 0x00, 0x48, 0x8B, 0x84, 0x24, 0x80, 0x00, 0x00, 0x00,
|
||||
0x0F, 0xB7, 0x40, 0x06, 0x66, 0x89, 0x44, 0x24, 0x58, 0x48, 0x8B, 0x84,
|
||||
0x24, 0x80, 0x00, 0x00, 0x00, 0x0F, 0xB7, 0x40, 0x14, 0x48, 0x8B, 0x8C,
|
||||
0x24, 0x80, 0x00, 0x00, 0x00, 0x48, 0x8D, 0x44, 0x01, 0x18, 0x48, 0x89,
|
||||
0x44, 0x24, 0x68, 0x48, 0x8D, 0x44, 0x24, 0x48, 0x48, 0x8B, 0xF8, 0x33,
|
||||
0xC0, 0xB9, 0x09, 0x00, 0x00, 0x00, 0xF3, 0xAA, 0xC6, 0x44, 0x24, 0x30,
|
||||
0x2E, 0xC6, 0x44, 0x24, 0x31, 0x52, 0xC6, 0x44, 0x24, 0x32, 0x79, 0xC6,
|
||||
0x44, 0x24, 0x33, 0x75, 0xC6, 0x44, 0x24, 0x34, 0x6A, 0xC6, 0x44, 0x24,
|
||||
0x35, 0x69, 0xC6, 0x44, 0x24, 0x36, 0x6E, 0xC6, 0x44, 0x24, 0x37, 0x00,
|
||||
0x48, 0x8D, 0x44, 0x24, 0x38, 0x48, 0x8B, 0xF8, 0x33, 0xC0, 0xB9, 0x01,
|
||||
0x00, 0x00, 0x00, 0xF3, 0xAA, 0x48, 0xB8, 0x99, 0x99, 0x99, 0x99, 0x99,
|
||||
0x99, 0x99, 0x99, 0x48, 0x89, 0x84, 0x24, 0x08, 0x01, 0x00, 0x00, 0x48,
|
||||
0xB8, 0x88, 0x88, 0x88, 0x88, 0x88, 0x88, 0x88, 0x88, 0x48, 0x89, 0x84,
|
||||
0x24, 0xC0, 0x00, 0x00, 0x00, 0xC7, 0x44, 0x24, 0x5C, 0x00, 0x00, 0x00,
|
||||
0x00, 0xEB, 0x18, 0x8B, 0x44, 0x24, 0x5C, 0xFF, 0xC0, 0x89, 0x44, 0x24,
|
||||
0x5C, 0x48, 0x8B, 0x44, 0x24, 0x68, 0x48, 0x83, 0xC0, 0x28, 0x48, 0x89,
|
||||
0x44, 0x24, 0x68, 0x0F, 0xB7, 0x44, 0x24, 0x58, 0x39, 0x44, 0x24, 0x5C,
|
||||
0x0F, 0x8D, 0xE2, 0x04, 0x00, 0x00, 0xC7, 0x44, 0x24, 0x40, 0x00, 0x00,
|
||||
0x00, 0x00, 0xEB, 0x0A, 0x8B, 0x44, 0x24, 0x40, 0xFF, 0xC0, 0x89, 0x44,
|
||||
0x24, 0x40, 0x83, 0x7C, 0x24, 0x40, 0x08, 0x7D, 0x19, 0x48, 0x63, 0x44,
|
||||
0x24, 0x40, 0x48, 0x63, 0x4C, 0x24, 0x40, 0x48, 0x8B, 0x54, 0x24, 0x68,
|
||||
0x0F, 0xB6, 0x04, 0x02, 0x88, 0x44, 0x0C, 0x48, 0xEB, 0xD6, 0xB8, 0x01,
|
||||
0x00, 0x00, 0x00, 0x48, 0x6B, 0xC0, 0x08, 0xC6, 0x44, 0x04, 0x48, 0x00,
|
||||
0x48, 0x8B, 0x44, 0x24, 0x68, 0x8B, 0x40, 0x0C, 0x89, 0x84, 0x24, 0x90,
|
||||
0x00, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x68, 0x8B, 0x40, 0x08, 0x89,
|
||||
0x44, 0x24, 0x64, 0x8B, 0x84, 0x24, 0x90, 0x00, 0x00, 0x00, 0x48, 0x8B,
|
||||
0x4C, 0x24, 0x78, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84,
|
||||
0x24, 0x00, 0x01, 0x00, 0x00, 0xB8, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B,
|
||||
0xC0, 0x00, 0x0F, 0xBE, 0x44, 0x04, 0x48, 0xB9, 0x01, 0x00, 0x00, 0x00,
|
||||
0x48, 0x6B, 0xC9, 0x00, 0x0F, 0xBE, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x0F,
|
||||
0x85, 0x42, 0x04, 0x00, 0x00, 0xB8, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B,
|
||||
0xC0, 0x01, 0x0F, 0xBE, 0x44, 0x04, 0x48, 0xB9, 0x01, 0x00, 0x00, 0x00,
|
||||
0x48, 0x6B, 0xC9, 0x01, 0x0F, 0xBE, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x0F,
|
||||
0x85, 0x1E, 0x04, 0x00, 0x00, 0xB8, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B,
|
||||
0xC0, 0x02, 0x0F, 0xBE, 0x44, 0x04, 0x48, 0xB9, 0x01, 0x00, 0x00, 0x00,
|
||||
0x48, 0x6B, 0xC9, 0x02, 0x0F, 0xBE, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x0F,
|
||||
0x85, 0xFA, 0x03, 0x00, 0x00, 0xB8, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B,
|
||||
0xC0, 0x03, 0x0F, 0xBE, 0x44, 0x04, 0x48, 0xB9, 0x01, 0x00, 0x00, 0x00,
|
||||
0x48, 0x6B, 0xC9, 0x03, 0x0F, 0xBE, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x0F,
|
||||
0x85, 0xD6, 0x03, 0x00, 0x00, 0xB8, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B,
|
||||
0xC0, 0x04, 0x0F, 0xBE, 0x44, 0x04, 0x48, 0xB9, 0x01, 0x00, 0x00, 0x00,
|
||||
0x48, 0x6B, 0xC9, 0x04, 0x0F, 0xBE, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x0F,
|
||||
0x85, 0xB2, 0x03, 0x00, 0x00, 0xB8, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B,
|
||||
0xC0, 0x05, 0x0F, 0xBE, 0x44, 0x04, 0x48, 0xB9, 0x01, 0x00, 0x00, 0x00,
|
||||
0x48, 0x6B, 0xC9, 0x05, 0x0F, 0xBE, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x0F,
|
||||
0x85, 0x8E, 0x03, 0x00, 0x00, 0xB8, 0x01, 0x00, 0x00, 0x00, 0x48, 0x6B,
|
||||
0xC0, 0x06, 0x0F, 0xBE, 0x44, 0x04, 0x48, 0xB9, 0x01, 0x00, 0x00, 0x00,
|
||||
0x48, 0x6B, 0xC9, 0x06, 0x0F, 0xBE, 0x4C, 0x0C, 0x30, 0x3B, 0xC1, 0x0F,
|
||||
0x85, 0x6A, 0x03, 0x00, 0x00, 0xC7, 0x84, 0x24, 0xC8, 0x00, 0x00, 0x00,
|
||||
0x45, 0x25, 0x12, 0x77, 0xC7, 0x84, 0x24, 0xCC, 0x00, 0x00, 0x00, 0x77,
|
||||
0x88, 0x99, 0x88, 0xC7, 0x84, 0x24, 0xD0, 0x00, 0x00, 0x00, 0xAD, 0xDE,
|
||||
0x44, 0x99, 0xC7, 0x84, 0x24, 0xD4, 0x00, 0x00, 0x00, 0xB4, 0xFE, 0xCA,
|
||||
0x10, 0xC7, 0x84, 0x24, 0xD8, 0x00, 0x00, 0x00, 0xC4, 0xB0, 0xB0, 0x45,
|
||||
0xC7, 0x84, 0x24, 0xDC, 0x00, 0x00, 0x00, 0xDE, 0xAD, 0xDE, 0x35, 0xC7,
|
||||
0x84, 0x24, 0xE0, 0x00, 0x00, 0x00, 0xC4, 0xC4, 0xC4, 0x25, 0xC7, 0x84,
|
||||
0x24, 0xE4, 0x00, 0x00, 0x00, 0x97, 0x48, 0x63, 0x85, 0xC7, 0x84, 0x24,
|
||||
0xE8, 0x00, 0x00, 0x00, 0x56, 0x34, 0x12, 0x56, 0xC7, 0x84, 0x24, 0xEC,
|
||||
0x00, 0x00, 0x00, 0x45, 0x45, 0x45, 0x11, 0xC7, 0x84, 0x24, 0xF0, 0x00,
|
||||
0x00, 0x00, 0x32, 0x32, 0x32, 0x12, 0xC7, 0x84, 0x24, 0xF4, 0x00, 0x00,
|
||||
0x00, 0x95, 0x95, 0x95, 0x95, 0x48, 0xC7, 0x44, 0x24, 0x70, 0x00, 0x00,
|
||||
0x00, 0x00, 0xEB, 0x0E, 0x48, 0x8B, 0x44, 0x24, 0x70, 0x48, 0x83, 0xC0,
|
||||
0x08, 0x48, 0x89, 0x44, 0x24, 0x70, 0x8B, 0x44, 0x24, 0x64, 0x48, 0x2B,
|
||||
0x84, 0x24, 0xC0, 0x00, 0x00, 0x00, 0x48, 0x39, 0x44, 0x24, 0x70, 0x0F,
|
||||
0x83, 0x93, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x44, 0x24, 0x70, 0x48, 0x83,
|
||||
0xC0, 0x08, 0x8B, 0x4C, 0x24, 0x64, 0x48, 0x2B, 0x8C, 0x24, 0xC0, 0x00,
|
||||
0x00, 0x00, 0x48, 0x3B, 0xC1, 0x76, 0x05, 0xE9, 0x74, 0x02, 0x00, 0x00,
|
||||
0x48, 0x8B, 0x44, 0x24, 0x70, 0x48, 0x8B, 0x8C, 0x24, 0x00, 0x01, 0x00,
|
||||
0x00, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48, 0x89, 0x84, 0x24, 0x88,
|
||||
0x00, 0x00, 0x00, 0xB8, 0x04, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC0, 0x00,
|
||||
0x48, 0x8B, 0x8C, 0x24, 0x88, 0x00, 0x00, 0x00, 0x8B, 0x04, 0x01, 0x89,
|
||||
0x44, 0x24, 0x20, 0xB8, 0x04, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC0, 0x01,
|
||||
0x48, 0x8B, 0x8C, 0x24, 0x88, 0x00, 0x00, 0x00, 0x8B, 0x04, 0x01, 0x89,
|
||||
0x44, 0x24, 0x24, 0xC7, 0x84, 0x24, 0xA0, 0x00, 0x00, 0x00, 0x45, 0x25,
|
||||
0x12, 0x77, 0xC7, 0x84, 0x24, 0xA4, 0x00, 0x00, 0x00, 0x77, 0x88, 0x99,
|
||||
0x88, 0xC7, 0x84, 0x24, 0xA8, 0x00, 0x00, 0x00, 0xAD, 0xDE, 0x44, 0x99,
|
||||
0xC7, 0x84, 0x24, 0xAC, 0x00, 0x00, 0x00, 0xB4, 0xFE, 0xCA, 0x10, 0xC7,
|
||||
0x44, 0x24, 0x44, 0x00, 0x20, 0x86, 0x85, 0xC7, 0x84, 0x24, 0x98, 0x00,
|
||||
0x00, 0x00, 0xC4, 0xB0, 0xB0, 0x00, 0xB8, 0x04, 0x00, 0x00, 0x00, 0x48,
|
||||
0x6B, 0xC0, 0x00, 0x8B, 0x84, 0x04, 0xA0, 0x00, 0x00, 0x00, 0x35, 0xEF,
|
||||
0xBE, 0xAD, 0xDE, 0x89, 0x84, 0x24, 0x9C, 0x00, 0x00, 0x00, 0xB8, 0x04,
|
||||
0x00, 0x00, 0x00, 0x48, 0x6B, 0xC0, 0x01, 0x8B, 0x84, 0x04, 0xA0, 0x00,
|
||||
0x00, 0x00, 0x35, 0xEF, 0xBE, 0xAD, 0xDE, 0x89, 0x84, 0x24, 0x94, 0x00,
|
||||
0x00, 0x00, 0xB8, 0x04, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC0, 0x02, 0x8B,
|
||||
0x84, 0x04, 0xA0, 0x00, 0x00, 0x00, 0x35, 0xEF, 0xBE, 0xAD, 0xDE, 0x89,
|
||||
0x84, 0x24, 0xF8, 0x00, 0x00, 0x00, 0xB8, 0x04, 0x00, 0x00, 0x00, 0x48,
|
||||
0x6B, 0xC0, 0x03, 0x8B, 0x84, 0x04, 0xA0, 0x00, 0x00, 0x00, 0x35, 0xEF,
|
||||
0xBE, 0xAD, 0xDE, 0x89, 0x84, 0x24, 0xFC, 0x00, 0x00, 0x00, 0xC7, 0x44,
|
||||
0x24, 0x60, 0x00, 0x00, 0x00, 0x00, 0xEB, 0x0A, 0x8B, 0x44, 0x24, 0x60,
|
||||
0xFF, 0xC0, 0x89, 0x44, 0x24, 0x60, 0x81, 0x7C, 0x24, 0x60, 0x00, 0x08,
|
||||
0x00, 0x00, 0x7D, 0x7E, 0x8B, 0x44, 0x24, 0x20, 0xC1, 0xE0, 0x04, 0x8B,
|
||||
0x4C, 0x24, 0x20, 0xC1, 0xE9, 0x05, 0x33, 0xC1, 0x03, 0x44, 0x24, 0x20,
|
||||
0xF7, 0xD0, 0x8B, 0x8C, 0x24, 0x94, 0x00, 0x00, 0x00, 0x8B, 0x54, 0x24,
|
||||
0x44, 0x03, 0xD1, 0x8B, 0xCA, 0x33, 0xC1, 0x8B, 0x4C, 0x24, 0x24, 0x2B,
|
||||
0xC8, 0x8B, 0xC1, 0x89, 0x44, 0x24, 0x24, 0x8B, 0x84, 0x24, 0x98, 0x00,
|
||||
0x00, 0x00, 0x8B, 0x4C, 0x24, 0x44, 0x2B, 0xC8, 0x8B, 0xC1, 0x89, 0x44,
|
||||
0x24, 0x44, 0x8B, 0x44, 0x24, 0x24, 0xC1, 0xE0, 0x04, 0x8B, 0x4C, 0x24,
|
||||
0x24, 0xC1, 0xE9, 0x05, 0x33, 0xC1, 0x03, 0x44, 0x24, 0x24, 0xF7, 0xD0,
|
||||
0x8B, 0x8C, 0x24, 0x9C, 0x00, 0x00, 0x00, 0x8B, 0x54, 0x24, 0x44, 0x03,
|
||||
0xD1, 0x8B, 0xCA, 0x33, 0xC1, 0x8B, 0x4C, 0x24, 0x20, 0x2B, 0xC8, 0x8B,
|
||||
0xC1, 0x89, 0x44, 0x24, 0x20, 0xE9, 0x6E, 0xFF, 0xFF, 0xFF, 0xC7, 0x44,
|
||||
0x24, 0x28, 0x00, 0x00, 0x00, 0x00, 0xEB, 0x0A, 0x8B, 0x44, 0x24, 0x28,
|
||||
0xFF, 0xC0, 0x89, 0x44, 0x24, 0x28, 0x81, 0x7C, 0x24, 0x28, 0x00, 0x08,
|
||||
0x00, 0x00, 0x0F, 0x8D, 0x83, 0x00, 0x00, 0x00, 0x8B, 0x44, 0x24, 0x28,
|
||||
0x99, 0xB9, 0x0C, 0x00, 0x00, 0x00, 0xF7, 0xF9, 0x8B, 0xC2, 0x48, 0x98,
|
||||
0x8B, 0x84, 0x84, 0xC8, 0x00, 0x00, 0x00, 0x8B, 0x4C, 0x24, 0x24, 0x33,
|
||||
0xC8, 0x8B, 0xC1, 0x89, 0x44, 0x24, 0x24, 0x8B, 0x44, 0x24, 0x28, 0x99,
|
||||
0xB9, 0x0C, 0x00, 0x00, 0x00, 0xF7, 0xF9, 0x8B, 0xC2, 0x48, 0x98, 0x8B,
|
||||
0x84, 0x84, 0xC8, 0x00, 0x00, 0x00, 0x8B, 0x4C, 0x24, 0x20, 0x33, 0xC8,
|
||||
0x8B, 0xC1, 0x89, 0x44, 0x24, 0x20, 0x69, 0x44, 0x24, 0x28, 0x44, 0x44,
|
||||
0x44, 0x44, 0x8B, 0x4C, 0x24, 0x28, 0xF7, 0xD1, 0x33, 0xC1, 0x8B, 0x4C,
|
||||
0x24, 0x24, 0x33, 0xC8, 0x8B, 0xC1, 0x89, 0x44, 0x24, 0x24, 0x69, 0x44,
|
||||
0x24, 0x28, 0x44, 0x44, 0x44, 0x44, 0x8B, 0x4C, 0x24, 0x28, 0xF7, 0xD1,
|
||||
0x33, 0xC1, 0x8B, 0x4C, 0x24, 0x20, 0x33, 0xC8, 0x8B, 0xC1, 0x89, 0x44,
|
||||
0x24, 0x20, 0xE9, 0x65, 0xFF, 0xFF, 0xFF, 0x8B, 0x44, 0x24, 0x20, 0xF7,
|
||||
0xD0, 0xB9, 0x04, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x00, 0x48, 0x8B,
|
||||
0x94, 0x24, 0x88, 0x00, 0x00, 0x00, 0x89, 0x04, 0x0A, 0x8B, 0x44, 0x24,
|
||||
0x24, 0xF7, 0xD0, 0xB9, 0x04, 0x00, 0x00, 0x00, 0x48, 0x6B, 0xC9, 0x01,
|
||||
0x48, 0x8B, 0x94, 0x24, 0x88, 0x00, 0x00, 0x00, 0x89, 0x04, 0x0A, 0xE9,
|
||||
0x48, 0xFD, 0xFF, 0xFF, 0x48, 0x8B, 0x84, 0x24, 0x08, 0x01, 0x00, 0x00,
|
||||
0x48, 0x8B, 0x4C, 0x24, 0x78, 0x48, 0x03, 0xC8, 0x48, 0x8B, 0xC1, 0x48,
|
||||
0x89, 0x84, 0x24, 0x10, 0x01, 0x00, 0x00, 0xFF, 0x94, 0x24, 0x10, 0x01,
|
||||
0x00, 0x00, 0x90, 0xE9, 0xF7, 0xFA, 0xFF, 0xFF, 0x48, 0x81, 0xC4, 0x20,
|
||||
0x01, 0x00, 0x00, 0x5F, 0xC3
|
||||
|
||||
};
|
||||
|
||||
|
||||
Reference in New Issue
Block a user