Skip to content

Instantly share code, notes, and snippets.

@JixunMoe JixunMoe/NT88.asm
Created Sep 1, 2015

Embed
What would you like to do?
NT88 library in assembly.
format PE GUI 4.0 DLL
entry DllMain
include 'win32ax.inc'
 
section '.text' code readable executable
 
; 入口函数
proc DllMain hinstDLL,fdwReason,lpvReserved
  mov al, 1
  ret
endp
 
; 读取狗数据
; int NTRead(int address, int endAddress, char* pDataBuffer);
proc NTRead address,endAddress,pDataBuffer
  local oldProtect:DWORD
  push esi
  push edi
   
  mov ecx, [endAddress]
  mov esi, [address]
  sub ecx, esi
  push ecx
  mov edi, [pDataBuffer]
   
  lea eax, [oldProtect]
  push eax                     ; OldProtect
  push PAGE_READWRITE             ; New Protect
  push ecx                     ; Size
  push edi                     ; Source Address
  call [VirtualProtect]
   
  ; 回写数据
  mov ecx, [esp]             ; pop ecx  &  push ecx
  mov esi, _dogData             ; 指向模拟狗的数据
  add esi, [address]
  cld
  rep movsb
   
  pop ecx
  lea eax, [oldProtect]
  push eax                     ; OldProtect
  push [oldProtect]             ; New Protect
  push ecx                     ; Size
  sub edi, ecx                     ; edi 会增加, 所以改回去
  push edi                     ; Source Address
  call [VirtualProtect]
  pop edi
  pop esi
   
  xor eax, eax
  ret
endp
 
; 填充用函数 - 3 参数
proc NT3Arg a1, a2, a3
  xor eax, eax
  ret
endp
 
; 填充用函数 - 1 参数
proc NT1Arg a1
  xor eax, eax
  ret
endp
 
; 填充用函数 - 0 参数
proc NT0Arg
  xor eax, eax
  retn
endp
 
; 狗数据
section '.data' data readable writeable
  _dogData db 'azmap09.........-1'
 
; 导入表
section '.idata' import data readable writeable
  library kernel,'KERNEL32.DLL'
  import kernel,\
    VirtualProtect, 'VirtualProtect'
 
; 导出表
section '.edata' export data readable
  export 'NT88.DLL',\
    NT3Arg,'NT3DESCBCDecrypt',\
    NT3Arg,'NT3DESCBCEncrypt',\
    NT1Arg,'NTCheckLicense',\
    NT1Arg,'NTFindFirst',\
    NT1Arg,'NTGetHardwareID',\
    NT1Arg,'NTLogin',\
    NT0Arg,'NTLogout',\
    NTRead,'NTRead',\
    NT3Arg,'NTWrite'
 
section '.reloc' fixups data readable discardable
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.