[原创]躲避MyMonitor分析

以前分析病毒都会丢MyMonitor分析一下,偶然发现MyMonitor是通过DLL注入,并inline hook 几个关键API,这就简单了.下面告诉你怎么检测他,方法很简单,如果你是写病毒,用这个方法可以糊弄下MyMonitor

assume fs:nothing
mov	eax,fs:[30H] 	;Peb;                        /* 030 */
mov	eax,[eax+0ch]	;PPEB_LDR_DATA                LdrData;                           /*  0c */
mov	PPEB_LDR_DATA,eax
mov	esi,[eax+28]	;InInitializationOrderModuleList.flink
.repeat
	mov	eax,[esi+24]	;FullDllName
	;cBit = 00000000010000000000000001000000b
	.if	(dword ptr [eax+6] & (not 00690077H)) || (dword ptr [eax+6+4] & (not 0064006eH)) || \
		(dword ptr [eax+6+4+4] & (not 0077006fH)) || (dword ptr [eax+6+4+4+4] & (not 005c0073H))
		iatCall	MessageBoxA,0,"被注入了","haha",0
		ret
	.endif
	mov	esi,[esi]
.until	!dword ptr [esi+8] ;DllBase

上传的附件

GUI.rar