AsmUtils.cs 45 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858
  1. using Mir2Assistant.Common.Utils;
  2. using System.ComponentModel;
  3. using System.Diagnostics;
  4. using System.Reflection;
  5. using System.Runtime.InteropServices;
  6. using System.Security;
  7. namespace Mir2Assistant.Utils;
  8. public class AsmUtils
  9. {
  10. private string Asmcode = "";
  11. public int? pid { get; set; }
  12. private string hex(int address)
  13. {
  14. string str = address.ToString("X");
  15. return str;
  16. }
  17. public string intTohex(int value, int num)
  18. {
  19. string str1;
  20. string str2 = "";
  21. str1 = "0000000" + this.hex(value);
  22. str1 = str1.Substring(str1.Length - num, num);
  23. for (int i = 0; i < str1.Length / 2; i++)
  24. {
  25. str2 = str2 + str1.Substring(str1.Length - 2 - 2 * i, 2);
  26. }
  27. return str2;
  28. }
  29. public AsmUtils SUB_ESP(int addre)
  30. {
  31. if ((addre <= 127) && (addre >= -128))
  32. {
  33. this.Asmcode = this.Asmcode + "83EC" + intTohex(addre, 2);
  34. }
  35. else
  36. {
  37. this.Asmcode = this.Asmcode + "81EC" + intTohex(addre, 8);
  38. }
  39. return this;
  40. }
  41. public AsmUtils Nop()
  42. {
  43. this.Asmcode = this.Asmcode + "90";
  44. return this;
  45. }
  46. public AsmUtils RetA(int addre)
  47. {
  48. this.Asmcode = this.Asmcode + intTohex(addre, 4);
  49. return this;
  50. }
  51. public AsmUtils IN_AL_DX()
  52. {
  53. this.Asmcode = this.Asmcode + "EC";
  54. return this;
  55. }
  56. public AsmUtils TEST_EAX_EAX()
  57. {
  58. this.Asmcode = this.Asmcode + "85C0";
  59. return this;
  60. }
  61. public AsmUtils Leave()
  62. {
  63. this.Asmcode = this.Asmcode + "C9";
  64. return this;
  65. }
  66. public AsmUtils Pushad()
  67. {
  68. this.Asmcode = this.Asmcode + "60";
  69. return this;
  70. }
  71. public AsmUtils Pushfd()
  72. {
  73. this.Asmcode = this.Asmcode + "9C";
  74. return this;
  75. }
  76. public AsmUtils Popad()
  77. {
  78. this.Asmcode = this.Asmcode + "61";
  79. return this;
  80. }
  81. public AsmUtils Popfd()
  82. {
  83. this.Asmcode = this.Asmcode + "9D";
  84. return this;
  85. }
  86. public AsmUtils Ret()
  87. {
  88. this.Asmcode = this.Asmcode + "C3";
  89. return this;
  90. }
  91. #region ADD
  92. public AsmUtils Add_EAX_EDX()
  93. {
  94. this.Asmcode = this.Asmcode + "03C2";
  95. return this;
  96. }
  97. public AsmUtils Add_EBX_EAX()
  98. {
  99. this.Asmcode = this.Asmcode + "03D8";
  100. return this;
  101. }
  102. public AsmUtils Add_EAX_DWORD_Ptr(int addre)
  103. {
  104. this.Asmcode = this.Asmcode + "0305" + intTohex(addre, 8);
  105. return this;
  106. }
  107. public AsmUtils Add_EBX_DWORD_Ptr(int addre)
  108. {
  109. this.Asmcode = this.Asmcode + "031D" + intTohex(addre, 8);
  110. return this;
  111. }
  112. public AsmUtils Add_EBP_DWORD_Ptr(int addre)
  113. {
  114. this.Asmcode = this.Asmcode + "032D" + intTohex(addre, 8);
  115. return this;
  116. }
  117. public AsmUtils Add_EAX(int addre)
  118. {
  119. this.Asmcode = this.Asmcode + "05" + intTohex(addre, 8);
  120. return this;
  121. }
  122. public AsmUtils Add_EBX(int addre)
  123. {
  124. if ((addre <= 127) && (addre >= -128))
  125. this.Asmcode = this.Asmcode + "83C3" + intTohex(addre, 2);
  126. else
  127. this.Asmcode = this.Asmcode + "81C3" + intTohex(addre, 8);
  128. return this;
  129. }
  130. public AsmUtils Add_ECX(int addre)
  131. {
  132. if ((addre <= 127) && (addre >= -128))
  133. this.Asmcode = this.Asmcode + "83C1" + intTohex(addre, 2);
  134. else
  135. this.Asmcode = this.Asmcode + "81C1" + intTohex(addre, 8);
  136. return this;
  137. }
  138. public AsmUtils Add_EDX(int addre)
  139. {
  140. if ((addre <= 127) && (addre >= -128))
  141. this.Asmcode = this.Asmcode + "83C2" + intTohex(addre, 2);
  142. else
  143. this.Asmcode = this.Asmcode + "81C2" + intTohex(addre, 8);
  144. return this;
  145. }
  146. public AsmUtils Add_ESI(int addre)
  147. {
  148. if ((addre <= 127) && (addre >= -128))
  149. this.Asmcode = this.Asmcode + "83C6" + intTohex(addre, 2);
  150. else
  151. this.Asmcode = this.Asmcode + "81C6" + intTohex(addre, 8);
  152. return this;
  153. }
  154. public AsmUtils Add_ESP(int addre)
  155. {
  156. if ((addre <= 127) && (addre >= -128))
  157. this.Asmcode = this.Asmcode + "83C4" + intTohex(addre, 2);
  158. else
  159. this.Asmcode = this.Asmcode + "81C4" + intTohex(addre, 8);
  160. return this;
  161. }
  162. #endregion
  163. #region mov
  164. public AsmUtils Mov_DWORD_Ptr_EAX_ADD(int addre, int addre1)
  165. {
  166. if ((addre <= 127) && (addre >= -128))
  167. {
  168. this.Asmcode = this.Asmcode + "C740" + intTohex(addre, 2) + intTohex(addre1, 8);
  169. }
  170. else
  171. {
  172. this.Asmcode = this.Asmcode + "C780" + intTohex(addre, 8) + intTohex(addre1, 8);
  173. }
  174. return this;
  175. }
  176. public AsmUtils Mov_DWORD_Ptr_ESP_ADD(int addre, int addre1)
  177. {
  178. if ((addre <= 127) && (addre >= -128))
  179. {
  180. this.Asmcode = this.Asmcode + "C74424" + intTohex(addre, 2) + intTohex(addre1, 8);
  181. }
  182. else
  183. {
  184. this.Asmcode = this.Asmcode + "C78424" + intTohex(addre, 8) + intTohex(addre1, 8);
  185. }
  186. return this;
  187. }
  188. public AsmUtils Mov_DWORD_Ptr_ESP_ADD_EAX(int addre)
  189. {
  190. if ((addre <= 127) && (addre >= -128))
  191. {
  192. this.Asmcode = this.Asmcode + "894424" + intTohex(addre, 2);
  193. }
  194. else
  195. {
  196. this.Asmcode = this.Asmcode + "898424" + intTohex(addre, 8);
  197. }
  198. return this;
  199. }
  200. public AsmUtils Mov_DWORD_Ptr_ESP(int addre)
  201. {
  202. this.Asmcode = this.Asmcode + "C70424" + intTohex(addre, 8);
  203. return this;
  204. }
  205. public AsmUtils Mov_DWORD_Ptr_EAX(int addre)
  206. {
  207. this.Asmcode = this.Asmcode + "A3" + intTohex(addre, 8);
  208. return this;
  209. }
  210. public AsmUtils Mov_EBX_DWORD_Ptr(int addre)
  211. {
  212. this.Asmcode = this.Asmcode + "8B1D" + intTohex(addre, 8);
  213. return this;
  214. }
  215. public AsmUtils Mov_ECX_DWORD_Ptr(int addre)
  216. {
  217. this.Asmcode = this.Asmcode + "8B0D" + intTohex(addre, 8);
  218. return this;
  219. }
  220. public AsmUtils Mov_EAX_DWORD_Ptr(int addre)
  221. {
  222. this.Asmcode = this.Asmcode + "A1" + intTohex(addre, 8);
  223. return this;
  224. }
  225. public AsmUtils Mov_EDX_DWORD_Ptr(int addre)
  226. {
  227. this.Asmcode = this.Asmcode + "8B15" + intTohex(addre, 8);
  228. return this;
  229. }
  230. public AsmUtils Mov_ESI_DWORD_Ptr(int addre)
  231. {
  232. this.Asmcode = this.Asmcode + "8B35" + intTohex(addre, 8);
  233. return this;
  234. }
  235. public AsmUtils Mov_ESP_DWORD_Ptr(int addre)
  236. {
  237. this.Asmcode = this.Asmcode + "8B25" + intTohex(addre, 8);
  238. return this;
  239. }
  240. public AsmUtils Mov_EBP_DWORD_Ptr(int addre)
  241. {
  242. this.Asmcode = this.Asmcode + "8B2D" + intTohex(addre, 8);
  243. return this;
  244. }
  245. public AsmUtils Mov_EAX_DWORD_Ptr_EAX(int addre)
  246. {
  247. this.Asmcode = this.Asmcode + "8B00";
  248. return this;
  249. }
  250. public AsmUtils Mov_EAX_DWORD_Ptr_EAX()
  251. {
  252. this.Asmcode = this.Asmcode + "8B00";
  253. return this;
  254. }
  255. public AsmUtils Mov_EAX_DWORD_Ptr_EBP()
  256. {
  257. this.Asmcode = this.Asmcode + "8B4500";
  258. return this;
  259. }
  260. public AsmUtils Mov_EAX_DWORD_Ptr_EBX()
  261. {
  262. this.Asmcode = this.Asmcode + "8B03";
  263. return this;
  264. }
  265. public AsmUtils Mov_EAX_DWORD_Ptr_ECX()
  266. {
  267. this.Asmcode = this.Asmcode + "8B01";
  268. return this;
  269. }
  270. public AsmUtils Mov_EAX_DWORD_Ptr_EDX()
  271. {
  272. this.Asmcode = this.Asmcode + "8B02";
  273. return this;
  274. }
  275. public AsmUtils Mov_EAX_DWORD_Ptr_EDI()
  276. {
  277. this.Asmcode = this.Asmcode + "8B07";
  278. return this;
  279. }
  280. public AsmUtils Mov_EAX_DWORD_Ptr_ESP()
  281. {
  282. this.Asmcode = this.Asmcode + "8B0424";
  283. return this;
  284. }
  285. public AsmUtils Mov_EAX_DWORD_Ptr_ESI()
  286. {
  287. this.Asmcode = this.Asmcode + "8B06";
  288. return this;
  289. }
  290. public AsmUtils Mov_EAX_DWORD_Ptr_EAX_Add(int addre)
  291. {
  292. if ((addre <= 127) && (addre >= -128))
  293. {
  294. this.Asmcode = this.Asmcode + "8B40" + intTohex(addre, 2);
  295. }
  296. else
  297. {
  298. this.Asmcode = this.Asmcode + "8B80" + intTohex(addre, 8);
  299. }
  300. return this;
  301. }
  302. public AsmUtils Mov_EAX_DWORD_Ptr_ESP_Add(int addre)
  303. {
  304. if ((addre <= 127) && (addre >= -128))
  305. this.Asmcode = this.Asmcode + "8B4424" + intTohex(addre, 2);
  306. else
  307. this.Asmcode = this.Asmcode + "8B8424" + intTohex(addre, 8);
  308. return this;
  309. }
  310. public AsmUtils Mov_EAX_DWORD_Ptr_EBX_Add(int addre)
  311. {
  312. if ((addre <= 127) && (addre >= -128))
  313. this.Asmcode = this.Asmcode + "8B43" + intTohex(addre, 2);
  314. else
  315. this.Asmcode = this.Asmcode + "8B83" + intTohex(addre, 8);
  316. return this;
  317. }
  318. public AsmUtils Mov_EAX_DWORD_Ptr_ECX_Add(int addre)
  319. {
  320. if ((addre <= 127) && (addre >= -128))
  321. this.Asmcode = this.Asmcode + "8B41" + intTohex(addre, 2);
  322. else
  323. this.Asmcode = this.Asmcode + "8B81" + intTohex(addre, 8);
  324. return this;
  325. }
  326. public AsmUtils Mov_EAX_DWORD_Ptr_EDX_Add(int addre)
  327. {
  328. if ((addre <= 127) && (addre >= -128))
  329. this.Asmcode = this.Asmcode + "8B42" + intTohex(addre, 2);
  330. else
  331. this.Asmcode = this.Asmcode + "8B82" + intTohex(addre, 8);
  332. return this;
  333. }
  334. public AsmUtils Mov_EAX_DWORD_Ptr_EDI_Add(int addre)
  335. {
  336. if ((addre <= 127) && (addre >= -128))
  337. this.Asmcode = this.Asmcode + "8B47" + intTohex(addre, 2);
  338. else
  339. this.Asmcode = this.Asmcode + "8B87" + intTohex(addre, 8);
  340. return this;
  341. }
  342. public AsmUtils Mov_EAX_DWORD_Ptr_EBP_Add(int addre)
  343. {
  344. if ((addre <= 127) && (addre >= -128))
  345. this.Asmcode = this.Asmcode + "8B45" + intTohex(addre, 2);
  346. else
  347. this.Asmcode = this.Asmcode + "8B85" + intTohex(addre, 8);
  348. return this;
  349. }
  350. public AsmUtils Mov_EAX_DWORD_Ptr_ESI_Add(int addre)
  351. {
  352. if ((addre <= 127) && (addre >= -128))
  353. this.Asmcode = this.Asmcode + "8B46" + intTohex(addre, 2);
  354. else
  355. this.Asmcode = this.Asmcode + "8B86" + intTohex(addre, 8);
  356. return this;
  357. }
  358. public AsmUtils Mov_EBX_DWORD_Ptr_EAX_Add(int addre)
  359. {
  360. if ((addre <= 127) && (addre >= -128))
  361. this.Asmcode = this.Asmcode + "8B58" + intTohex(addre, 2);
  362. else
  363. this.Asmcode = this.Asmcode + "8B98" + intTohex(addre, 8);
  364. return this;
  365. }
  366. public AsmUtils Mov_EBX_DWORD_Ptr_ESP_Add(int addre)
  367. {
  368. if ((addre <= 127) && (addre >= -128))
  369. this.Asmcode = this.Asmcode + "8B5C24" + intTohex(addre, 2);
  370. else
  371. this.Asmcode = this.Asmcode + "8B9C24" + intTohex(addre, 8);
  372. return this;
  373. }
  374. public AsmUtils Mov_EBX_DWORD_Ptr_EBX_Add(int addre)
  375. {
  376. if ((addre <= 127) && (addre >= -128))
  377. this.Asmcode = this.Asmcode + "8B5B" + intTohex(addre, 2);
  378. else
  379. this.Asmcode = this.Asmcode + "8B9B" + intTohex(addre, 8);
  380. return this;
  381. }
  382. public AsmUtils Mov_EBX_DWORD_Ptr_ECX_Add(int addre)
  383. {
  384. if ((addre <= 127) && (addre >= -128))
  385. this.Asmcode = this.Asmcode + "8B59" + intTohex(addre, 2);
  386. else
  387. this.Asmcode = this.Asmcode + "8B99" + intTohex(addre, 8);
  388. return this;
  389. }
  390. public AsmUtils Mov_EBX_DWORD_Ptr_EDX_Add(int addre)
  391. {
  392. if ((addre <= 127) && (addre >= -128))
  393. this.Asmcode = this.Asmcode + "8B5A" + intTohex(addre, 2);
  394. else
  395. this.Asmcode = this.Asmcode + "8B9A" + intTohex(addre, 8);
  396. return this;
  397. }
  398. public AsmUtils Mov_EBX_DWORD_Ptr_EDI_Add(int addre)
  399. {
  400. if ((addre <= 127) && (addre >= -128))
  401. this.Asmcode = this.Asmcode + "8B5F" + intTohex(addre, 2);
  402. else
  403. this.Asmcode = this.Asmcode + "8B9F" + intTohex(addre, 8);
  404. return this;
  405. }
  406. public AsmUtils Mov_EBX_DWORD_Ptr_EBP_Add(int addre)
  407. {
  408. if ((addre <= 127) && (addre >= -128))
  409. this.Asmcode = this.Asmcode + "8B5D" + intTohex(addre, 2);
  410. else
  411. this.Asmcode = this.Asmcode + "8B9D" + intTohex(addre, 8);
  412. return this;
  413. }
  414. public AsmUtils Mov_EBX_DWORD_Ptr_ESI_Add(int addre)
  415. {
  416. if ((addre <= 127) && (addre >= -128))
  417. this.Asmcode = this.Asmcode + "8B5E" + intTohex(addre, 2);
  418. else
  419. this.Asmcode = this.Asmcode + "8B9E" + intTohex(addre, 8);
  420. return this;
  421. }
  422. public AsmUtils Mov_ECX_DWORD_Ptr_EAX_Add(int addre)
  423. {
  424. if ((addre <= 127) && (addre >= -128))
  425. this.Asmcode = this.Asmcode + "8B48" + intTohex(addre, 2);
  426. else
  427. this.Asmcode = this.Asmcode + "8B88" + intTohex(addre, 8);
  428. return this;
  429. }
  430. public AsmUtils Mov_ECX_DWORD_Ptr_ESP_Add(int addre)
  431. {
  432. if ((addre <= 127) && (addre >= -128))
  433. this.Asmcode = this.Asmcode + "8B4C24" + intTohex(addre, 2);
  434. else
  435. this.Asmcode = this.Asmcode + "8B8C24" + intTohex(addre, 8);
  436. return this;
  437. }
  438. public AsmUtils Mov_ECX_DWORD_Ptr_EBX_Add(int addre)
  439. {
  440. if ((addre <= 127) && (addre >= -128))
  441. this.Asmcode = this.Asmcode + "8B4B" + intTohex(addre, 2);
  442. else
  443. this.Asmcode = this.Asmcode + "8B8B" + intTohex(addre, 8);
  444. return this;
  445. }
  446. public AsmUtils Mov_ECX_DWORD_Ptr_ECX_Add(int addre)
  447. {
  448. if ((addre <= 127) && (addre >= -128))
  449. this.Asmcode = this.Asmcode + "8B49" + intTohex(addre, 2);
  450. else
  451. this.Asmcode = this.Asmcode + "8B89" + intTohex(addre, 8);
  452. return this;
  453. }
  454. public AsmUtils Mov_ECX_DWORD_Ptr_EDX_Add(int addre)
  455. {
  456. if ((addre <= 127) && (addre >= -128))
  457. this.Asmcode = this.Asmcode + "8B4A" + intTohex(addre, 2);
  458. else
  459. this.Asmcode = this.Asmcode + "8B8A" + intTohex(addre, 8);
  460. return this;
  461. }
  462. public AsmUtils Mov_ECX_DWORD_Ptr_EDI_Add(int addre)
  463. {
  464. if ((addre <= 127) && (addre >= -128))
  465. this.Asmcode = this.Asmcode + "8B4F" + intTohex(addre, 2);
  466. else
  467. this.Asmcode = this.Asmcode + "8B8F" + intTohex(addre, 8);
  468. return this;
  469. }
  470. public AsmUtils Mov_ECX_DWORD_Ptr_EBP_Add(int addre)
  471. {
  472. if ((addre <= 127) && (addre >= -128))
  473. this.Asmcode = this.Asmcode + "8B4D" + intTohex(addre, 2);
  474. else
  475. this.Asmcode = this.Asmcode + "8B8D" + intTohex(addre, 8);
  476. return this;
  477. }
  478. public AsmUtils Mov_ECX_DWORD_Ptr_ESI_Add(int addre)
  479. {
  480. if ((addre <= 127) && (addre >= -128))
  481. this.Asmcode = this.Asmcode + "8B4E" + intTohex(addre, 2);
  482. else
  483. this.Asmcode = this.Asmcode + "8B8E" + intTohex(addre, 8);
  484. return this;
  485. }
  486. public AsmUtils Mov_EDX_DWORD_Ptr_EAX_Add(int addre)
  487. {
  488. if ((addre <= 127) && (addre >= -128))
  489. this.Asmcode = this.Asmcode + "8B50" + intTohex(addre, 2);
  490. else
  491. this.Asmcode = this.Asmcode + "8B90" + intTohex(addre, 8);
  492. return this;
  493. }
  494. public AsmUtils Mov_EDX_DWORD_Ptr_ESP_Add(int addre)
  495. {
  496. if ((addre <= 127) && (addre >= -128))
  497. this.Asmcode = this.Asmcode + "8B5424" + intTohex(addre, 2);
  498. else
  499. this.Asmcode = this.Asmcode + "8B9424" + intTohex(addre, 8);
  500. return this;
  501. }
  502. public AsmUtils Mov_EDX_DWORD_Ptr_EBX_Add(int addre)
  503. {
  504. if ((addre <= 127) && (addre >= -128))
  505. this.Asmcode = this.Asmcode + "8B53" + intTohex(addre, 2);
  506. else
  507. this.Asmcode = this.Asmcode + "8B93" + intTohex(addre, 8);
  508. return this;
  509. }
  510. public AsmUtils Mov_EDX_DWORD_Ptr_ECX_Add(int addre)
  511. {
  512. if ((addre <= 127) && (addre >= -128))
  513. this.Asmcode = this.Asmcode + "8B51" + intTohex(addre, 2);
  514. else
  515. this.Asmcode = this.Asmcode + "8B91" + intTohex(addre, 8);
  516. return this;
  517. }
  518. public AsmUtils Mov_EDX_DWORD_Ptr_EDX_Add(int addre)
  519. {
  520. if ((addre <= 127) && (addre >= -128))
  521. this.Asmcode = this.Asmcode + "8B52" + intTohex(addre, 2);
  522. else
  523. this.Asmcode = this.Asmcode + "8B92" + intTohex(addre, 8);
  524. return this;
  525. }
  526. public AsmUtils Mov_EDX_DWORD_Ptr_EDI_Add(int addre)
  527. {
  528. if ((addre <= 127) && (addre >= -128))
  529. this.Asmcode = this.Asmcode + "8B57" + intTohex(addre, 2);
  530. else
  531. this.Asmcode = this.Asmcode + "8B97" + intTohex(addre, 8);
  532. return this;
  533. }
  534. public AsmUtils Mov_EDX_DWORD_Ptr_EBP_Add(int addre)
  535. {
  536. if ((addre <= 127) && (addre >= -128))
  537. this.Asmcode = this.Asmcode + "8B55" + intTohex(addre, 2);
  538. else
  539. this.Asmcode = this.Asmcode + "8B95" + intTohex(addre, 8);
  540. return this;
  541. }
  542. public AsmUtils Mov_EDX_DWORD_Ptr_ESI_Add(int addre)
  543. {
  544. if ((addre <= 127) && (addre >= -128))
  545. this.Asmcode = this.Asmcode + "8B56" + intTohex(addre, 2);
  546. else
  547. this.Asmcode = this.Asmcode + "8B96" + intTohex(addre, 8);
  548. return this;
  549. }
  550. public AsmUtils Mov_ECX_EAX()
  551. {
  552. this.Asmcode = this.Asmcode + "8BC8";
  553. return this;
  554. }
  555. public AsmUtils Mov_EAX(int addre)
  556. {
  557. this.Asmcode = this.Asmcode + "B8" + intTohex(addre, 8);
  558. return this;
  559. }
  560. public AsmUtils Mov_EBX(int addre)
  561. {
  562. this.Asmcode = this.Asmcode + "BB" + intTohex(addre, 8);
  563. return this;
  564. }
  565. public AsmUtils Mov_ECX(int addre)
  566. {
  567. this.Asmcode = this.Asmcode + "B9" + intTohex(addre, 8);
  568. return this;
  569. }
  570. public AsmUtils Mov_EDX(int addre)
  571. {
  572. this.Asmcode = this.Asmcode + "BA" + intTohex(addre, 8);
  573. return this;
  574. }
  575. public AsmUtils Mov_ESI(int addre)
  576. {
  577. this.Asmcode = this.Asmcode + "BE" + intTohex(addre, 8);
  578. return this;
  579. }
  580. public AsmUtils Mov_ESP(int addre)
  581. {
  582. this.Asmcode = this.Asmcode + "BC" + intTohex(addre, 8);
  583. return this;
  584. }
  585. public AsmUtils Mov_EBP(int addre)
  586. {
  587. this.Asmcode = this.Asmcode + "BD" + intTohex(addre, 8);
  588. return this;
  589. }
  590. public AsmUtils Mov_EDI(int addre)
  591. {
  592. this.Asmcode = this.Asmcode + "BF" + intTohex(addre, 8);
  593. return this;
  594. }
  595. public AsmUtils Mov_ESI_DWORD_Ptr_EAX()
  596. {
  597. this.Asmcode = this.Asmcode + "8B7020";
  598. return this;
  599. }
  600. public AsmUtils Mov_EBX_DWORD_Ptr_EAX()
  601. {
  602. this.Asmcode = this.Asmcode + "8B18";
  603. return this;
  604. }
  605. public AsmUtils Mov_EBX_DWORD_Ptr_EBP()
  606. {
  607. this.Asmcode = this.Asmcode + "8B5D00";
  608. return this;
  609. }
  610. public AsmUtils Mov_EBX_DWORD_Ptr_EBX()
  611. {
  612. this.Asmcode = this.Asmcode + "8B1B";
  613. return this;
  614. }
  615. public AsmUtils Mov_EBX_DWORD_Ptr_ECX()
  616. {
  617. this.Asmcode = this.Asmcode + "8B19";
  618. return this;
  619. }
  620. public AsmUtils Mov_EBX_DWORD_Ptr_EDX()
  621. {
  622. this.Asmcode = this.Asmcode + "8B1A";
  623. return this;
  624. }
  625. public AsmUtils Mov_EBX_DWORD_Ptr_EDI()
  626. {
  627. this.Asmcode = this.Asmcode + "8B1F";
  628. return this;
  629. }
  630. public AsmUtils Mov_EBX_DWORD_Ptr_ESP()
  631. {
  632. this.Asmcode = this.Asmcode + "8B1C24";
  633. return this;
  634. }
  635. public AsmUtils Mov_EBX_DWORD_Ptr_ESI()
  636. {
  637. this.Asmcode = this.Asmcode + "8B1E";
  638. return this;
  639. }
  640. public AsmUtils Mov_ECX_DWORD_Ptr_EAX()
  641. {
  642. this.Asmcode = this.Asmcode + "8B08";
  643. return this;
  644. }
  645. public AsmUtils Mov_ECX_DWORD_Ptr_EBP()
  646. {
  647. this.Asmcode = this.Asmcode + "8B4D00";
  648. return this;
  649. }
  650. public AsmUtils Mov_ECX_DWORD_Ptr_EBX()
  651. {
  652. this.Asmcode = this.Asmcode + "8B0B";
  653. return this;
  654. }
  655. public AsmUtils Mov_ECX_DWORD_Ptr_ECX()
  656. {
  657. this.Asmcode = this.Asmcode + "8B09";
  658. return this;
  659. }
  660. public AsmUtils Mov_ECX_DWORD_Ptr_EDX()
  661. {
  662. this.Asmcode = this.Asmcode + "8B0A";
  663. return this;
  664. }
  665. public AsmUtils Mov_ECX_DWORD_Ptr_EDI()
  666. {
  667. this.Asmcode = this.Asmcode + "8B0F";
  668. return this;
  669. }
  670. public AsmUtils Mov_ECX_DWORD_Ptr_ESP()
  671. {
  672. this.Asmcode = this.Asmcode + "8B0C24";
  673. return this;
  674. }
  675. public AsmUtils Mov_ECX_DWORD_Ptr_ESI()
  676. {
  677. this.Asmcode = this.Asmcode + "8B0E";
  678. return this;
  679. }
  680. public AsmUtils Mov_EDX_DWORD_Ptr_EAX()
  681. {
  682. this.Asmcode = this.Asmcode + "8B10";
  683. return this;
  684. }
  685. public AsmUtils Mov_EDX_DWORD_Ptr_EBP()
  686. {
  687. this.Asmcode = this.Asmcode + "8B5500";
  688. return this;
  689. }
  690. public AsmUtils Mov_EDX_DWORD_Ptr_EBX()
  691. {
  692. this.Asmcode = this.Asmcode + "8B13";
  693. return this;
  694. }
  695. public AsmUtils Mov_EDX_DWORD_Ptr_ECX()
  696. {
  697. this.Asmcode = this.Asmcode + "8B11";
  698. return this;
  699. }
  700. public AsmUtils Mov_EDX_DWORD_Ptr_EDX()
  701. {
  702. this.Asmcode = this.Asmcode + "8B12";
  703. return this;
  704. }
  705. public AsmUtils Mov_EDX_DWORD_Ptr_EDI()
  706. {
  707. this.Asmcode = this.Asmcode + "8B17";
  708. return this;
  709. }
  710. public AsmUtils Mov_EDX_DWORD_Ptr_ESI()
  711. {
  712. this.Asmcode = this.Asmcode + "8B16";
  713. return this;
  714. }
  715. public AsmUtils Mov_EDX_DWORD_Ptr_ESP()
  716. {
  717. this.Asmcode = this.Asmcode + "8B1424";
  718. return this;
  719. }
  720. public AsmUtils Mov_EAX_EBP()
  721. {
  722. this.Asmcode = this.Asmcode + "8BC5";
  723. return this;
  724. }
  725. public AsmUtils Mov_EAX_EBX()
  726. {
  727. this.Asmcode = this.Asmcode + "8BC3";
  728. return this;
  729. }
  730. public AsmUtils Mov_EAX_ECX()
  731. {
  732. this.Asmcode = this.Asmcode + "8BC1";
  733. return this;
  734. }
  735. public AsmUtils Mov_EAX_EDI()
  736. {
  737. this.Asmcode = this.Asmcode + "8BC7";
  738. return this;
  739. }
  740. public AsmUtils Mov_EAX_EDX()
  741. {
  742. this.Asmcode = this.Asmcode + "8BC2";
  743. return this;
  744. }
  745. public AsmUtils Mov_EAX_ESI()
  746. {
  747. this.Asmcode = this.Asmcode + "8BC6";
  748. return this;
  749. }
  750. public AsmUtils Mov_EAX_ESP()
  751. {
  752. this.Asmcode = this.Asmcode + "8BC4";
  753. return this;
  754. }
  755. public AsmUtils Mov_EBX_EBP()
  756. {
  757. this.Asmcode = this.Asmcode + "8BDD";
  758. return this;
  759. }
  760. public AsmUtils Mov_EBX_EAX()
  761. {
  762. this.Asmcode = this.Asmcode + "8BD8";
  763. return this;
  764. }
  765. public AsmUtils Mov_EBX_ECX()
  766. {
  767. this.Asmcode = this.Asmcode + "8BD9";
  768. return this;
  769. }
  770. public AsmUtils Mov_EBX_EDI()
  771. {
  772. this.Asmcode = this.Asmcode + "8BDF";
  773. return this;
  774. }
  775. public AsmUtils Mov_EBX_EDX()
  776. {
  777. this.Asmcode = this.Asmcode + "8BDA";
  778. return this;
  779. }
  780. public AsmUtils Mov_EBX_ESI()
  781. {
  782. this.Asmcode = this.Asmcode + "8BDE";
  783. return this;
  784. }
  785. public AsmUtils Mov_EBX_ESP()
  786. {
  787. this.Asmcode = this.Asmcode + "8BDC";
  788. return this;
  789. }
  790. public AsmUtils Mov_ECX_EBP()
  791. {
  792. this.Asmcode = this.Asmcode + "8BCD";
  793. return this;
  794. }
  795. public AsmUtils Mov_ECX_EBX()
  796. {
  797. this.Asmcode = this.Asmcode + "8BCB";
  798. return this;
  799. }
  800. public AsmUtils Mov_ECX_EDI()
  801. {
  802. this.Asmcode = this.Asmcode + "8BCF";
  803. return this;
  804. }
  805. public AsmUtils Mov_ECX_EDX()
  806. {
  807. this.Asmcode = this.Asmcode + "8BCA";
  808. return this;
  809. }
  810. public AsmUtils Mov_ECX_ESI()
  811. {
  812. this.Asmcode = this.Asmcode + "8BCE";
  813. return this;
  814. }
  815. public AsmUtils Mov_ECX_ESP()
  816. {
  817. this.Asmcode = this.Asmcode + "8BCC";
  818. return this;
  819. }
  820. public AsmUtils Mov_EDX_EBP()
  821. {
  822. this.Asmcode = this.Asmcode + "8BD5";
  823. return this;
  824. }
  825. public AsmUtils Mov_EDX_EBX()
  826. {
  827. this.Asmcode = this.Asmcode + "8BD3";
  828. return this;
  829. }
  830. public AsmUtils Mov_EDX_ECX()
  831. {
  832. this.Asmcode = this.Asmcode + "8BD1";
  833. return this;
  834. }
  835. public AsmUtils Mov_EDX_EDI()
  836. {
  837. this.Asmcode = this.Asmcode + "8BD7";
  838. return this;
  839. }
  840. public AsmUtils Mov_EDX_EAX()
  841. {
  842. this.Asmcode = this.Asmcode + "8BD0";
  843. return this;
  844. }
  845. public AsmUtils Mov_EDX_ESI()
  846. {
  847. this.Asmcode = this.Asmcode + "8BD6";
  848. return this;
  849. }
  850. public AsmUtils Mov_EDX_ESP()
  851. {
  852. this.Asmcode = this.Asmcode + "8BD4";
  853. return this;
  854. }
  855. public AsmUtils Mov_ESI_EBP()
  856. {
  857. this.Asmcode = this.Asmcode + "8BF5";
  858. return this;
  859. }
  860. public AsmUtils Mov_ESI_EBX()
  861. {
  862. this.Asmcode = this.Asmcode + "8BF3";
  863. return this;
  864. }
  865. public AsmUtils Mov_ESI_ECX()
  866. {
  867. this.Asmcode = this.Asmcode + "8BF1";
  868. return this;
  869. }
  870. public AsmUtils Mov_ESI_EDI()
  871. {
  872. this.Asmcode = this.Asmcode + "8BF7";
  873. return this;
  874. }
  875. public AsmUtils Mov_ESI_EAX()
  876. {
  877. this.Asmcode = this.Asmcode + "8BF0";
  878. return this;
  879. }
  880. public AsmUtils Mov_ESI_EDX()
  881. {
  882. this.Asmcode = this.Asmcode + "8BF2";
  883. return this;
  884. }
  885. public AsmUtils Mov_ESI_ESP()
  886. {
  887. this.Asmcode = this.Asmcode + "8BF4";
  888. return this;
  889. }
  890. public AsmUtils Mov_ESP_EBP()
  891. {
  892. this.Asmcode = this.Asmcode + "8BE5";
  893. return this;
  894. }
  895. public AsmUtils Mov_ESP_EBX()
  896. {
  897. this.Asmcode = this.Asmcode + "8BE3";
  898. return this;
  899. }
  900. public AsmUtils Mov_ESP_ECX()
  901. {
  902. this.Asmcode = this.Asmcode + "8BE1";
  903. return this;
  904. }
  905. public AsmUtils Mov_ESP_EDI()
  906. {
  907. this.Asmcode = this.Asmcode + "8BE7";
  908. return this;
  909. }
  910. public AsmUtils Mov_ESP_EAX()
  911. {
  912. this.Asmcode = this.Asmcode + "8BE0";
  913. return this;
  914. }
  915. public AsmUtils Mov_ESP_EDX()
  916. {
  917. this.Asmcode = this.Asmcode + "8BE2";
  918. return this;
  919. }
  920. public AsmUtils Mov_ESP_ESI()
  921. {
  922. this.Asmcode = this.Asmcode + "8BE6";
  923. return this;
  924. }
  925. public AsmUtils Mov_EDI_EBP()
  926. {
  927. this.Asmcode = this.Asmcode + "8BFD";
  928. return this;
  929. }
  930. public AsmUtils Mov_EDI_EAX()
  931. {
  932. this.Asmcode = this.Asmcode + "8BF8";
  933. return this;
  934. }
  935. public AsmUtils Mov_EDI_EBX()
  936. {
  937. this.Asmcode = this.Asmcode + "8BFB";
  938. return this;
  939. }
  940. public AsmUtils Mov_EDI_ECX()
  941. {
  942. this.Asmcode = this.Asmcode + "8BF9";
  943. return this;
  944. }
  945. public AsmUtils Mov_EDI_EDX()
  946. {
  947. this.Asmcode = this.Asmcode + "8BFA";
  948. return this;
  949. }
  950. public AsmUtils Mov_EDI_ESI()
  951. {
  952. this.Asmcode = this.Asmcode + "8BFE";
  953. return this;
  954. }
  955. public AsmUtils Mov_EDI_ESP()
  956. {
  957. this.Asmcode = this.Asmcode + "8BFC";
  958. return this;
  959. }
  960. public AsmUtils Mov_EBP_EDI()
  961. {
  962. this.Asmcode = this.Asmcode + "8BDF";
  963. return this;
  964. }
  965. public AsmUtils Mov_EBP_EAX()
  966. {
  967. this.Asmcode = this.Asmcode + "8BE8";
  968. return this;
  969. }
  970. public AsmUtils Mov_EBP_EBX()
  971. {
  972. this.Asmcode = this.Asmcode + "8BEB";
  973. return this;
  974. }
  975. public AsmUtils Mov_EBP_ECX()
  976. {
  977. this.Asmcode = this.Asmcode + "8BE9";
  978. return this;
  979. }
  980. public AsmUtils Mov_EBP_EDX()
  981. {
  982. this.Asmcode = this.Asmcode + "8BEA";
  983. return this;
  984. }
  985. public AsmUtils Mov_EBP_ESI()
  986. {
  987. this.Asmcode = this.Asmcode + "8BEE";
  988. return this;
  989. }
  990. public AsmUtils Mov_EBP_ESP()
  991. {
  992. this.Asmcode = this.Asmcode + "8BEC";
  993. return this;
  994. }
  995. #endregion
  996. #region Push
  997. public AsmUtils Push68(int addre)
  998. {
  999. this.Asmcode = this.Asmcode + "68" + intTohex(addre, 8);
  1000. return this;
  1001. }
  1002. public AsmUtils Push6A(int addre)
  1003. {
  1004. this.Asmcode = this.Asmcode + "6A" + intTohex(addre, 2);
  1005. return this;
  1006. }
  1007. public AsmUtils Push_EAX()
  1008. {
  1009. this.Asmcode = this.Asmcode + "50";
  1010. return this;
  1011. }
  1012. public AsmUtils Push_DWORD_Ptr(int addre)
  1013. {
  1014. this.Asmcode = this.Asmcode + "FF35" + intTohex(addre, 8);
  1015. return this;
  1016. }
  1017. public AsmUtils Push_ECX()
  1018. {
  1019. this.Asmcode = this.Asmcode + "51";
  1020. return this;
  1021. }
  1022. public AsmUtils Push_EDX()
  1023. {
  1024. this.Asmcode = this.Asmcode + "52";
  1025. return this;
  1026. }
  1027. public AsmUtils Push_EBX()
  1028. {
  1029. this.Asmcode = this.Asmcode + "53";
  1030. return this;
  1031. }
  1032. public AsmUtils Push_ESP()
  1033. {
  1034. this.Asmcode = this.Asmcode + "54";
  1035. return this;
  1036. }
  1037. public AsmUtils Push_EBP()
  1038. {
  1039. this.Asmcode = this.Asmcode + "55";
  1040. return this;
  1041. }
  1042. public AsmUtils Push_ESI()
  1043. {
  1044. this.Asmcode = this.Asmcode + "56";
  1045. return this;
  1046. }
  1047. public AsmUtils Push_EDI()
  1048. {
  1049. this.Asmcode = this.Asmcode + "57";
  1050. return this;
  1051. }
  1052. #endregion
  1053. #region Call
  1054. public AsmUtils Call_EAX()
  1055. {
  1056. this.Asmcode = this.Asmcode + "FFD0";
  1057. return this;
  1058. }
  1059. public AsmUtils Call_EBX()
  1060. {
  1061. this.Asmcode = this.Asmcode + "FFD3";
  1062. return this;
  1063. }
  1064. public AsmUtils Call_ECX()
  1065. {
  1066. this.Asmcode = this.Asmcode + "FFD1";
  1067. return this;
  1068. }
  1069. public AsmUtils Call_EDX()
  1070. {
  1071. this.Asmcode = this.Asmcode + "FFD2";
  1072. return this;
  1073. }
  1074. public AsmUtils Call_ESI()
  1075. {
  1076. this.Asmcode = this.Asmcode + "FFD2";
  1077. return this;
  1078. }
  1079. public AsmUtils Call_ESP()
  1080. {
  1081. this.Asmcode = this.Asmcode + "FFD4";
  1082. return this;
  1083. }
  1084. public AsmUtils Call_EBP()
  1085. {
  1086. this.Asmcode = this.Asmcode + "FFD5";
  1087. return this;
  1088. }
  1089. public AsmUtils Call_EDI()
  1090. {
  1091. this.Asmcode = this.Asmcode + "FFD7";
  1092. return this;
  1093. }
  1094. public AsmUtils Call_DWORD_Ptr(int addre)
  1095. {
  1096. this.Asmcode = this.Asmcode + "FF15" + intTohex(addre, 8);
  1097. return this;
  1098. }
  1099. public AsmUtils Call_DWORD_Ptr_EAX()
  1100. {
  1101. this.Asmcode = this.Asmcode + "FF10";
  1102. return this;
  1103. }
  1104. public AsmUtils Call_DWORD_Ptr_EBX()
  1105. {
  1106. this.Asmcode = this.Asmcode + "FF13";
  1107. return this;
  1108. }
  1109. #endregion
  1110. #region Lea
  1111. public AsmUtils Lea_EAX_DWORD_Ptr_EAX_Add(int addre)
  1112. {
  1113. if ((addre <= 127) && (addre >= -128))
  1114. this.Asmcode = this.Asmcode + "8D40" + intTohex(addre, 2);
  1115. else
  1116. this.Asmcode = this.Asmcode + "8D80" + intTohex(addre, 8);
  1117. return this;
  1118. }
  1119. public AsmUtils Lea_EAX_DWORD_Ptr_EBX_Add(int addre)
  1120. {
  1121. if ((addre <= 127) && (addre >= -128))
  1122. this.Asmcode = this.Asmcode + "8D43" + intTohex(addre, 2);
  1123. else
  1124. this.Asmcode = this.Asmcode + "8D83" + intTohex(addre, 8);
  1125. return this;
  1126. }
  1127. public AsmUtils Lea_EAX_DWORD_Ptr_ECX_Add(int addre)
  1128. {
  1129. if ((addre <= 127) && (addre >= -128))
  1130. this.Asmcode = this.Asmcode + "8D41" + intTohex(addre, 2);
  1131. else
  1132. this.Asmcode = this.Asmcode + "8D81" + intTohex(addre, 8);
  1133. return this;
  1134. }
  1135. public AsmUtils Lea_EAX_DWORD_Ptr_EDX_Add(int addre)
  1136. {
  1137. if ((addre <= 127) && (addre >= -128))
  1138. this.Asmcode = this.Asmcode + "8D42" + intTohex(addre, 2);
  1139. else
  1140. this.Asmcode = this.Asmcode + "8D82" + intTohex(addre, 8);
  1141. return this;
  1142. }
  1143. public AsmUtils Lea_EAX_DWORD_Ptr_ESI_Add(int addre)
  1144. {
  1145. if ((addre <= 127) && (addre >= -128))
  1146. this.Asmcode = this.Asmcode + "8D46" + intTohex(addre, 2);
  1147. else
  1148. this.Asmcode = this.Asmcode + "8D86" + intTohex(addre, 8);
  1149. return this;
  1150. }
  1151. public AsmUtils Lea_EAX_DWORD_Ptr_ESP_Add(int addre)
  1152. {
  1153. if ((addre <= 127) && (addre >= -128))
  1154. this.Asmcode = this.Asmcode + "8D40" + intTohex(addre, 2);
  1155. else
  1156. this.Asmcode = this.Asmcode + "8D80" + intTohex(addre, 8);
  1157. return this;
  1158. }
  1159. public AsmUtils Lea_EAX_DWORD_Ptr_EBP_Add(int addre)
  1160. {
  1161. if ((addre <= 127) && (addre >= -128))
  1162. this.Asmcode = this.Asmcode + "8D4424" + intTohex(addre, 2);
  1163. else
  1164. this.Asmcode = this.Asmcode + "8D8424" + intTohex(addre, 8);
  1165. return this;
  1166. }
  1167. public AsmUtils Lea_EAX_DWORD_Ptr_EDI_Add(int addre)
  1168. {
  1169. if ((addre <= 127) && (addre >= -128))
  1170. this.Asmcode = this.Asmcode + "8D47" + intTohex(addre, 2);
  1171. else
  1172. this.Asmcode = this.Asmcode + "8D87" + intTohex(addre, 8);
  1173. return this;
  1174. }
  1175. public AsmUtils Lea_EBX_DWORD_Ptr_EAX_Add(int addre)
  1176. {
  1177. if ((addre <= 127) && (addre >= -128))
  1178. this.Asmcode = this.Asmcode + "8D58" + intTohex(addre, 2);
  1179. else
  1180. this.Asmcode = this.Asmcode + "8D98" + intTohex(addre, 8);
  1181. return this;
  1182. }
  1183. public AsmUtils Lea_EBX_DWORD_Ptr_ESP_Add(int addre)
  1184. {
  1185. if ((addre <= 127) && (addre >= -128))
  1186. this.Asmcode = this.Asmcode + "8D5C24" + intTohex(addre, 2);
  1187. else
  1188. this.Asmcode = this.Asmcode + "8D9C24" + intTohex(addre, 8);
  1189. return this;
  1190. }
  1191. public AsmUtils Lea_EBX_DWORD_Ptr_EBX_Add(int addre)
  1192. {
  1193. if ((addre <= 127) && (addre >= -128))
  1194. this.Asmcode = this.Asmcode + "8D5B" + intTohex(addre, 2);
  1195. else
  1196. this.Asmcode = this.Asmcode + "8D9B" + intTohex(addre, 8);
  1197. return this;
  1198. }
  1199. public AsmUtils Lea_EBX_DWORD_Ptr_ECX_Add(int addre)
  1200. {
  1201. if ((addre <= 127) && (addre >= -128))
  1202. this.Asmcode = this.Asmcode + "8D59" + intTohex(addre, 2);
  1203. else
  1204. this.Asmcode = this.Asmcode + "8D99" + intTohex(addre, 8);
  1205. return this;
  1206. }
  1207. public AsmUtils Lea_EBX_DWORD_Ptr_EDX_Add(int addre)
  1208. {
  1209. if ((addre <= 127) && (addre >= -128))
  1210. this.Asmcode = this.Asmcode + "8D5A" + intTohex(addre, 2);
  1211. else
  1212. this.Asmcode = this.Asmcode + "8D9A" + intTohex(addre, 8);
  1213. return this;
  1214. }
  1215. public AsmUtils Lea_EBX_DWORD_Ptr_EDI_Add(int addre)
  1216. {
  1217. if ((addre <= 127) && (addre >= -128))
  1218. this.Asmcode = this.Asmcode + "8D5F" + intTohex(addre, 2);
  1219. else
  1220. this.Asmcode = this.Asmcode + "8D9F" + intTohex(addre, 8);
  1221. return this;
  1222. }
  1223. public AsmUtils Lea_EBX_DWORD_Ptr_EBP_Add(int addre)
  1224. {
  1225. if ((addre <= 127) && (addre >= -128))
  1226. this.Asmcode = this.Asmcode + "8D5D" + intTohex(addre, 2);
  1227. else
  1228. this.Asmcode = this.Asmcode + "8D9D" + intTohex(addre, 8);
  1229. return this;
  1230. }
  1231. public AsmUtils Lea_EBX_DWORD_Ptr_ESI_Add(int addre)
  1232. {
  1233. if ((addre <= 127) && (addre >= -128))
  1234. this.Asmcode = this.Asmcode + "8D5E" + intTohex(addre, 2);
  1235. else
  1236. this.Asmcode = this.Asmcode + "8D9E" + intTohex(addre, 8);
  1237. return this;
  1238. }
  1239. public AsmUtils Lea_ECX_DWORD_Ptr_EAX_Add(int addre)
  1240. {
  1241. if ((addre <= 127) && (addre >= -128))
  1242. this.Asmcode = this.Asmcode + "8D48" + intTohex(addre, 2);
  1243. else
  1244. this.Asmcode = this.Asmcode + "8D88" + intTohex(addre, 8);
  1245. return this;
  1246. }
  1247. public AsmUtils Lea_ECX_DWORD_Ptr_ESP_Add(int addre)
  1248. {
  1249. if ((addre <= 127) && (addre >= -128))
  1250. this.Asmcode = this.Asmcode + "8D4C24" + intTohex(addre, 2);
  1251. else
  1252. this.Asmcode = this.Asmcode + "8D8C24" + intTohex(addre, 8);
  1253. return this;
  1254. }
  1255. public AsmUtils Lea_ECX_DWORD_Ptr_EBX_Add(int addre)
  1256. {
  1257. if ((addre <= 127) && (addre >= -128))
  1258. this.Asmcode = this.Asmcode + "8D4B" + intTohex(addre, 2);
  1259. else
  1260. this.Asmcode = this.Asmcode + "8D8B" + intTohex(addre, 8);
  1261. return this;
  1262. }
  1263. public AsmUtils Lea_ECX_DWORD_Ptr_ECX_Add(int addre)
  1264. {
  1265. if ((addre <= 127) && (addre >= -128))
  1266. this.Asmcode = this.Asmcode + "8D49" + intTohex(addre, 2);
  1267. else
  1268. this.Asmcode = this.Asmcode + "8D89" + intTohex(addre, 8);
  1269. return this;
  1270. }
  1271. public AsmUtils Lea_ECX_DWORD_Ptr_EDX_Add(int addre)
  1272. {
  1273. if ((addre <= 127) && (addre >= -128))
  1274. this.Asmcode = this.Asmcode + "8D4A" + intTohex(addre, 2);
  1275. else
  1276. this.Asmcode = this.Asmcode + "8D8A" + intTohex(addre, 8);
  1277. return this;
  1278. }
  1279. public AsmUtils Lea_ECX_DWORD_Ptr_EDI_Add(int addre)
  1280. {
  1281. if ((addre <= 127) && (addre >= -128))
  1282. this.Asmcode = this.Asmcode + "8D4F" + intTohex(addre, 2);
  1283. else
  1284. this.Asmcode = this.Asmcode + "8D8F" + intTohex(addre, 8);
  1285. return this;
  1286. }
  1287. public AsmUtils Lea_ECX_DWORD_Ptr_EBP_Add(int addre)
  1288. {
  1289. if ((addre <= 127) && (addre >= -128))
  1290. this.Asmcode = this.Asmcode + "8D4D" + intTohex(addre, 2);
  1291. else
  1292. this.Asmcode = this.Asmcode + "8D8D" + intTohex(addre, 8);
  1293. return this;
  1294. }
  1295. public AsmUtils Lea_ECX_DWORD_Ptr_ESI_Add(int addre)
  1296. {
  1297. if ((addre <= 127) && (addre >= -128))
  1298. this.Asmcode = this.Asmcode + "8D4E" + intTohex(addre, 2);
  1299. else
  1300. this.Asmcode = this.Asmcode + "8D8E" + intTohex(addre, 8);
  1301. return this;
  1302. }
  1303. public AsmUtils Lea_EDX_DWORD_Ptr_EAX_Add(int addre)
  1304. {
  1305. if ((addre <= 127) && (addre >= -128))
  1306. this.Asmcode = this.Asmcode + "8D50" + intTohex(addre, 2);
  1307. else
  1308. this.Asmcode = this.Asmcode + "8D90" + intTohex(addre, 8);
  1309. return this;
  1310. }
  1311. public AsmUtils Lea_EDX_DWORD_Ptr_ESP_Add(int addre)
  1312. {
  1313. if ((addre <= 127) && (addre >= -128))
  1314. this.Asmcode = this.Asmcode + "8D5424" + intTohex(addre, 2);
  1315. else
  1316. this.Asmcode = this.Asmcode + "8D9424" + intTohex(addre, 8);
  1317. return this;
  1318. }
  1319. public AsmUtils Lea_EDX_DWORD_Ptr_EBX_Add(int addre)
  1320. {
  1321. if ((addre <= 127) && (addre >= -128))
  1322. this.Asmcode = this.Asmcode + "8D53" + intTohex(addre, 2);
  1323. else
  1324. this.Asmcode = this.Asmcode + "8D93" + intTohex(addre, 8);
  1325. return this;
  1326. }
  1327. public AsmUtils Lea_EDX_DWORD_Ptr_ECX_Add(int addre)
  1328. {
  1329. if ((addre <= 127) && (addre >= -128))
  1330. this.Asmcode = this.Asmcode + "8D51" + intTohex(addre, 2);
  1331. else
  1332. this.Asmcode = this.Asmcode + "8D91" + intTohex(addre, 8);
  1333. return this;
  1334. }
  1335. public AsmUtils Lea_EDX_DWORD_Ptr_EDX_Add(int addre)
  1336. {
  1337. if ((addre <= 127) && (addre >= -128))
  1338. this.Asmcode = this.Asmcode + "8D52" + intTohex(addre, 2);
  1339. else
  1340. this.Asmcode = this.Asmcode + "8D92" + intTohex(addre, 8);
  1341. return this;
  1342. }
  1343. public AsmUtils Lea_EDX_DWORD_Ptr_EDI_Add(int addre)
  1344. {
  1345. if ((addre <= 127) && (addre >= -128))
  1346. this.Asmcode = this.Asmcode + "8D57" + intTohex(addre, 2);
  1347. else
  1348. this.Asmcode = this.Asmcode + "8D97" + intTohex(addre, 8);
  1349. return this;
  1350. }
  1351. public AsmUtils Lea_EDX_DWORD_Ptr_EBP_Add(int addre)
  1352. {
  1353. if ((addre <= 127) && (addre >= -128))
  1354. this.Asmcode = this.Asmcode + "8D55" + intTohex(addre, 2);
  1355. else
  1356. this.Asmcode = this.Asmcode + "8D95" + intTohex(addre, 8);
  1357. return this;
  1358. }
  1359. public AsmUtils Lea_EDX_DWORD_Ptr_ESI_Add(int addre)
  1360. {
  1361. if ((addre <= 127) && (addre >= -128))
  1362. this.Asmcode = this.Asmcode + "8D56" + intTohex(addre, 2);
  1363. else
  1364. this.Asmcode = this.Asmcode + "8D96" + intTohex(addre, 8);
  1365. return this;
  1366. }
  1367. #endregion
  1368. #region POP
  1369. public AsmUtils Pop_EAX()
  1370. {
  1371. this.Asmcode = this.Asmcode + "58";
  1372. return this;
  1373. }
  1374. public AsmUtils Pop_EBX()
  1375. {
  1376. this.Asmcode = this.Asmcode + "5B";
  1377. return this;
  1378. }
  1379. public AsmUtils Pop_ECX()
  1380. {
  1381. this.Asmcode = this.Asmcode + "59";
  1382. return this;
  1383. }
  1384. public AsmUtils Pop_EDX()
  1385. {
  1386. this.Asmcode = this.Asmcode + "5A";
  1387. return this;
  1388. }
  1389. public AsmUtils Pop_ESI()
  1390. {
  1391. this.Asmcode = this.Asmcode + "5E";
  1392. return this;
  1393. }
  1394. public AsmUtils Pop_ESP()
  1395. {
  1396. this.Asmcode = this.Asmcode + "5C";
  1397. return this;
  1398. }
  1399. public AsmUtils Pop_EDI()
  1400. {
  1401. this.Asmcode = this.Asmcode + "5F";
  1402. return this;
  1403. }
  1404. public AsmUtils Pop_EBP()
  1405. {
  1406. this.Asmcode = this.Asmcode + "5D";
  1407. return this;
  1408. }
  1409. #endregion
  1410. #region CMP
  1411. public AsmUtils Cmp_EAX(int addre)
  1412. {
  1413. if ((addre <= 127) && (addre >= -128))
  1414. this.Asmcode = this.Asmcode + "83F8" + intTohex(addre, 2);
  1415. else
  1416. this.Asmcode = this.Asmcode + "3D" + intTohex(addre, 8);
  1417. return this;
  1418. }
  1419. public AsmUtils Cmp_EAX_EDX()
  1420. {
  1421. this.Asmcode = this.Asmcode + "3BC2";
  1422. return this;
  1423. }
  1424. public AsmUtils Cmp_EAX_DWORD_Ptr(int addre)
  1425. {
  1426. this.Asmcode = this.Asmcode + "3B05" + intTohex(addre, 8);
  1427. return this;
  1428. }
  1429. public AsmUtils Cmp_DWORD_Ptr_EAX(int addre)
  1430. {
  1431. this.Asmcode = this.Asmcode + "3905" + intTohex(addre, 8);
  1432. return this;
  1433. }
  1434. #endregion
  1435. #region DEC
  1436. public AsmUtils Dec_EAX()
  1437. {
  1438. this.Asmcode = this.Asmcode + "48";
  1439. return this;
  1440. }
  1441. public AsmUtils Dec_EBX()
  1442. {
  1443. this.Asmcode = this.Asmcode + "4B";
  1444. return this;
  1445. }
  1446. public AsmUtils Dec_ECX()
  1447. {
  1448. this.Asmcode = this.Asmcode + "49";
  1449. return this;
  1450. }
  1451. public AsmUtils Dec_EDX()
  1452. {
  1453. this.Asmcode = this.Asmcode + "4A";
  1454. return this;
  1455. }
  1456. #endregion
  1457. #region idiv
  1458. public AsmUtils Idiv_EAX()
  1459. {
  1460. this.Asmcode = this.Asmcode + "F7F8";
  1461. return this;
  1462. }
  1463. public AsmUtils Idiv_EBX()
  1464. {
  1465. this.Asmcode = this.Asmcode + "F7FB";
  1466. return this;
  1467. }
  1468. public AsmUtils Idiv_ECX()
  1469. {
  1470. this.Asmcode = this.Asmcode + "F7F9";
  1471. return this;
  1472. }
  1473. public AsmUtils Idiv_EDX()
  1474. {
  1475. this.Asmcode = this.Asmcode + "F7FA";
  1476. return this;
  1477. }
  1478. #endregion
  1479. #region Imul
  1480. public AsmUtils Imul_EAX_EDX()
  1481. {
  1482. this.Asmcode = this.Asmcode + "0FAFC2";
  1483. return this;
  1484. }
  1485. public AsmUtils Imul_EAX(int addre)
  1486. {
  1487. this.Asmcode = this.Asmcode + "6BC0" + intTohex(addre, 2);
  1488. return this;
  1489. }
  1490. public AsmUtils ImulB_EAX(int addre)
  1491. {
  1492. this.Asmcode = this.Asmcode + "69C0" + intTohex(addre, 8);
  1493. return this;
  1494. }
  1495. #endregion
  1496. #region Inc
  1497. public AsmUtils Inc_EAX()
  1498. {
  1499. this.Asmcode = this.Asmcode + "40";
  1500. return this;
  1501. }
  1502. public AsmUtils Inc_EBX()
  1503. {
  1504. this.Asmcode = this.Asmcode + "43";
  1505. return this;
  1506. }
  1507. public AsmUtils Inc_ECX()
  1508. {
  1509. this.Asmcode = this.Asmcode + "41";
  1510. return this;
  1511. }
  1512. public AsmUtils Inc_EDX()
  1513. {
  1514. this.Asmcode = this.Asmcode + "42";
  1515. return this;
  1516. }
  1517. public AsmUtils Inc_EDI()
  1518. {
  1519. this.Asmcode = this.Asmcode + "47";
  1520. return this;
  1521. }
  1522. public AsmUtils Inc_ESI()
  1523. {
  1524. this.Asmcode = this.Asmcode + "46";
  1525. return this;
  1526. }
  1527. public AsmUtils Inc_DWORD_Ptr_EAX()
  1528. {
  1529. this.Asmcode = this.Asmcode + "FF00";
  1530. return this;
  1531. }
  1532. public AsmUtils Inc_DWORD_Ptr_EBX()
  1533. {
  1534. this.Asmcode = this.Asmcode + "FF03";
  1535. return this;
  1536. }
  1537. public AsmUtils Inc_DWORD_Ptr_ECX()
  1538. {
  1539. this.Asmcode = this.Asmcode + "FF01";
  1540. return this;
  1541. }
  1542. public AsmUtils Inc_DWORD_Ptr_EDX()
  1543. {
  1544. this.Asmcode = this.Asmcode + "FF02";
  1545. return this;
  1546. }
  1547. #endregion
  1548. #region jmp
  1549. public AsmUtils JMP_EAX()
  1550. {
  1551. this.Asmcode = this.Asmcode + "FFE0";
  1552. return this;
  1553. }
  1554. #endregion
  1555. public byte[] AsmChangebytes(string asmPram)
  1556. {
  1557. byte[] reAsmCode = new byte[asmPram.Length / 2];
  1558. for (int i = 0; i < reAsmCode.Length; i++)
  1559. {
  1560. reAsmCode[i] = Convert.ToByte(Int32.Parse(asmPram.Substring(i * 2, 2), System.Globalization.NumberStyles.AllowHexSpecifier));
  1561. }
  1562. return reAsmCode;
  1563. }
  1564. public static AsmUtils Init(int _pid)
  1565. {
  1566. var asm = new AsmUtils();
  1567. asm.pid = _pid;
  1568. asm.Pushfd().Pushad().Push_EBP();
  1569. return asm;
  1570. }
  1571. public byte[] GetAsmCode()
  1572. {
  1573. this.Pop_EBP().Popad().Popfd().Ret();
  1574. return AsmChangebytes(Asmcode); ;
  1575. }
  1576. private void RunAsm(byte[] DShell)
  1577. {
  1578. IntPtr outSize;
  1579. IntPtr hProcess = WindowUtils.OpenProcess(0x001F0FFF, false, pid!.Value);
  1580. IntPtr addr = WindowUtils.VirtualAllocEx(hProcess, IntPtr.Zero, DShell.Length, 0x3000, 0x40);
  1581. WindowUtils.WriteProcessMemory(hProcess, addr, DShell, DShell.Length, out outSize);
  1582. IntPtr hThread = WindowUtils.CreateRemoteThread(hProcess, IntPtr.Zero, 0, addr, IntPtr.Zero, 0, IntPtr.Zero);
  1583. WindowUtils.WaitForSingleObject(hThread, 1000);
  1584. WindowUtils.VirtualFreeEx(hProcess, addr, DShell.Length, 0x4000);
  1585. WindowUtils.CloseHandle(hThread);
  1586. WindowUtils.CloseHandle(hProcess);
  1587. }
  1588. public void Run()
  1589. {
  1590. this.RunAsm(GetAsmCode());
  1591. }
  1592. }