Virtual Machine
Trying to grep this sdlt vm check here.
var_8 = dword ptr -8
var_4 = byte ptr -4
push ebp
mov ebp, esp
sub esp, 8
mov eax, ds:dword_100020C8
mov cl, ds:byte_100020CC
mov [ebp+var_8], eax
mov [ebp+var_4], cl
sldt word ptr [ebp+var_8]
xor eax, eax
cmp [ebp+var_8], 0DEAD0000h
setnz al
xor edx, edx
cmp eax, 1
setz al
mov esp, ebp
pop ebp
retn
Im wondering why this bit of code does a cmp against 0DEAD00h and sets the lower register to the value. (so say a vm is active and it non-zero thusly al is set to 1).
Why does it later cmp eax, 1 then. this would mean 1 - 0 equals 1 thus ZF =0, but a CF=1. So then when setz al is called then al is equal to 0.
Is this interpretation correct? If so what was the point of this? Shouldnt it have been finished after the first cmp
Cheers
Posted Dec 9, 2020, 11:40 PM UTC · edited
Your interpretation appears correct; The only thing I can think of is if that zero flag is used later as a check (like after this snippet is called).
Do you have any snippets of what occurs after this is run?
No i dont have any follow ups yet. The antivm is actually in a func that id exported to the main program. The main program keeps crashing tho so i cant run it yet.
Is there an instruction to check specifically ZF? Im sure there is but it slips me in this early morning
You could be right though, but i guess ill never know. Thanks for the info
You can use pushf/pushfd and a cmp/test/bt to check the zero flag alone, but I agree it does seem like an odd/roundabout way of doing things.