Search code examples
nsis

NSIS ANTI EMULATOR

I'm trying to make a anti emulator allocating a big memory region and force the kernel to commit the pages to physical ram by filling the memory with values because the emulator can't allocate too much memory But I don't know how to fill the memory with values of that region this is what I made so far

System::Call "kernel32::LocalAlloc(i 0, i 143978374) p .r0" ; allocate 143 978 374 bytes and write pointer in $0

;I need to fill the memory with values here

System::Call "kernel32::LocalFree(p r0)"

Solution

  • If you call LocalAlloc with the LMEM_ZEROINIT flag Windows might write to the buffer for you. Technically speaking, this might be a implementation detail and in theory a future system could support such a feature in hardware. Your emulation thing, whatever that is, might ignore it as well.

    You can write to memory with the system plug-in struct syntax:

    !define PAGESIZE 4096
!define BLOBSIZE 143978374

!include Util.nsh
!ifndef IntPtrOp ; NSIS 2 compatibility
!define IntPtrOp IntOp
!endif
!ifndef IntPtrCmpU
!define IntCmpU
!endif

System::Alloc ${BLOBSIZE} ; This calls GlobalAlloc(GPTR, ...)
Pop $0
${IntPtrCmpU} $0 0 done "" "" ; Failure to allocate memory?
StrCpy $1 $0 ; Start
${IntPtrOp} $2 $1 + ${BLOBSIZE} ; End
loop:
    System::Call '*$1(&i1 42)' ; Set the first byte in the page to 42
    ${IntPtrOp} $1 $1 + ${PAGESIZE}
    ${IntPtrCmpU} $1 $2 "" loop ""
System::Free $0
done:

    The System plug-in is not super fast so a large memory block will take a while to fill.