检测虚拟机代码
1 004092D0 /. 55 push ebp
2 004092D1 |. 8BEC mov ebp,esp
3 004092D3 |. 51 push ecx
4 004092D4 |. 53 push ebx
5 004092D5 |. 68 1D934000 push 0040931D
6 004092DA |. 64:FF35 00000>push dword ptr fs:[0]
7 004092E1 |. 64:8925 00000>mov dword ptr fs:[0],esp
8 004092E8 |. 52 push edx
9 004092E9 |. 51 push ecx
10 004092EA |. 53 push ebx
11 004092EB |. B8 68584D56 mov eax,0x564D5868
12 004092F0 |. BB 00000000 mov ebx,0x0
13 004092F5 |. B9 0A000000 mov ecx,0xA
14 004092FA |. BA 58560000 mov edx,0x5658
15 004092FF |. ED in eax,dx
16 00409300 |. 81FB 68584D56 cmp ebx,0x564D5868
17 00409306 |. 0F9445 FF sete byte ptr ss:[ebp-0x1]
18 0040930A |. 5B pop ebx
19 0040930B |. 59 pop ecx
20 0040930C |. 5A pop edx
21 0040930D |. 64:8F05 00000>pop dword ptr fs:[0]
22 00409314 |. 83C4 10 add esp,0x10
23 00409317 B8 01000000 mov eax,0x1
24 0040931C \. C3 retn
特征码:B8 68 58 4D 56 BB 00 00 00 00 B9 0A 00 00 00 BA 58 56 00 00 ED 81 FB 68 58 4D 56
