Direct Messages
The SIGmas
️
EXTERN malloc: PROC
.code
_verify_rdseed PROC
mov eax, 07h
xor ecx, ecx
cpuid
bt ebx, 18
jnc short unsupported
ret
unsupported:
ud2
_verify_rdseed ENDP
rand_seed PROC
test ecx, 7
jnz short crash
push rcx
push rbp
mov rbp, rsp
and rsp, -16
call malloc
mov rsp, rbp
pop rbp
test rax, rax
pop rcx
jz short crash
mov rdi, rax
seed:
rdrand rbx
mov qword ptr [rdi], rbx
add rdi, 8
sub ecx, 8
jg short seed
ret
crash:
ud2
rand_seed ENDP
END 
uintptr_t followJmp(uintptr_t address) {
if (*(unsigned char*)address != 0xE9 && !(*(unsigned char*)address != 0xFF && *(unsigned char*)(address + 1) != 0x25)) {
return address;
}
while (true) {
const auto byte = *(unsigned char*)address;
if (byte == 0xE9) {
int disp = *(int*)(address + 1);
address = (uintptr_t)(address + disp + 5);
} else if (byte == 0xFF && *(unsigned char*)(address + 1) == 0x25) {
address = *(uintptr_t*)(address + 6);
} else {
break;
}
}
return address;
}
bool hooked(jvmtiEnv* jvmti) {
int functioncount = sizeof(jvmtiInterface_1_) / sizeof(uintptr_t);
for (int i = 0; i < functioncount; i++) {
uintptr_t function = (uintptr_t)(((uintptr_t*)jvmti->functions)[i]);
if (function && followJmp(function) != function) {
return true;
}
}
return false;
} bool IsMemoryTraversed() {
auto m = VirtualAlloc(NULL, 4096, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
PSAPI_WORKING_SET_EX_INFORMATION _set;
_set.VirtualAddress = m;
while (true) {
if (QueryWorkingSetEx(GetCurrentProcess(), &_set, sizeof(_set)) && (_set.VirtualAttributes.Valid & 0x1)) {
printf("[check] stop fucking in the memory\n");
FatalExit(-28347918);
}
}
} uintptr_t followJmp(uintptr_t address) {
if (*(unsigned char*)address != 0xE9 && !(*(unsigned char*)address != 0xFF && *(unsigned char*)(address + 1) != 0x25)) {
return address;
}
while (true) {
const auto byte = *(unsigned char*)address;
if (byte == 0xE9) {
int disp = *(int*)(address + 1);
address = (uintptr_t)(address + disp + 5);
} else if (byte == 0xFF && *(unsigned char*)(address + 1) == 0x25) {
address = *(uintptr_t*)(address + 6);
} else {
break;
}
}
return address;
}
bool hooked(jvmtiEnv* jvmti) {
int functioncount = sizeof(jvmtiInterface_1_) / sizeof(uintptr_t);
for (int i = 0; i < functioncount; i++) {
uintptr_t function = (uintptr_t)(((uintptr_t*)jvmti->functions)[i]);
if (function && followJmp(function) != function) {
return true;
}
}
return false;
} 
️
. GitHub is where Pajeet-Industries builds software.