Icefox's Blog

int getHandle = GetModuleHandle (ntdll){
      //
}
GetProcAddress (getHandle, ZwTerminateProcess){
      //这里很容易被中断,所以在这里最好的了
}

;--start
;//整数偏移判断
mov ebx,[ebp+8]
mov eax,[ebp+0ch]
mov [ebx],eax

;//VMP ctypt 

mov eax,[ebp-08]
sub eax,2710h
mov edi,[ebp-04h]
xor ecx,ecx
xor ebp,ebp
xor esi,esi
xor edx,edx
xor ebx,ebx
sub edi,2710h
mov esp,edi
add esp,64h
push 0
push -1
sub edi,200h
push edi
xor edi,edi
push 0
mov [esp],eax
retn

;--end