Í»ÆÆÁ½¸öʵÀýÏÞÖÆ
-----Ò»´Î²»ÍêÃÀµÄPEDIY
¡¾Æƽâ×÷Õß¡¿ winndy [FCG][PYG]
¡¾×÷ÕßÓÊÏä¡¿ CNwinndy@hotmail.com
¡¾Ê¹Óù¤¾ß¡¿ PEID v0.93 OllyDbg v1.10 flyÐ޸İæ
¡¾Æƽâƽ̨¡¿ Winxp SP2
¡¾Èí¼þÃû³Æ¡¿ Ìì½¾2Íâ¹Ò--·Æ·Æ0502°æ
¡¾¹Ù·½ÍøÖ·¡¿ http://bbs.tj2wg.com/
¡¾±àдÓïÑÔ¡¿ VC6
¡¾Èí¼þ½éÉÜ¡¿ ²»Óöà˵ÁË...
¡¾ÆƽâÉùÃ÷¡¿ For study ,For Fun,
¡¾Æƽâ˵Ã÷¡¿ Ö»ÄÜÔËÐÐÁ½¸öʵÀý,ÎÞ¿Ç,0510°æµÄÊÇArmadillo 3.78 -> Silicon Realms Toolworks¼ÓµÄ¿Ç,²»»áÍÑ,
ËùÒÔÕÒÕâ¸ö0502À´ÈàÒ»Èà...
Íæµ½×îºó,¿ÉÒÔÔËÐÐ3¸öʵÀý,µ«ÊǵÚ3¸öʵÀýÔËÐÐ,hookסÌì½¾ºó,²»ÄÜÆô¶¯ÈȼüF12,...
×îºóʵÔÚÕÒ²»³öÔÒò,²»¹ýÏëÏë.Õâ´Î²»ÍêÃÀµÄpediy,Ò²·ÑÁ˲»ÉÙÖÜÕÛ,×Ô¼ºÐ´¸ö×ܽá°É...
ʧÎóÖ®´¦»¹Çë¸÷λÀÏ´óÖ¸³ö!
¡¾Æƽâ¹ý³Ì¡¿
ODÔØÈë·Æ·Æ,·´¼ü,"ËÑË÷"--"ËùÓвο¼Îı¾´®",
ÔÚÏÂÃæÉè¶Ïµã,È»ºó¹Û²ìºÍ±È½Ï,ʵÀýÒ»ºÍʵÀý¶þµÄ´úÂëµÄÇø±ð,ÒÔ¼°¼Ä´æÆ÷µÄ״̬µÈÖµ.
004047DD . 8B83 580F0000 mov eax,dword ptr ds:[ebx+F58]
004047E3 . 8B4B 20 mov ecx,dword ptr ds:[ebx+20]
004047E6 . 33ED xor ebp,ebp
004047E8 . 50 push eax ; /lParam
004047E9 . 55 push ebp ; |wParam => 0
004047EA . 68 80000000 push 80 ; |Message = WM_SETICON
004047EF . 51 push ecx ; |hWnd
004047F0 . FFD6 call esi ; \SendMessageA
004047F2 . 8B35 24604100 mov esi,dword ptr ds:[<&KERNEL32.Op>; kernel32.OpenMutexA
004047F8 . 68 ACA24100 push TJMan9.0041A2AC ; /MutexName = "TJMANRunOnlyOneInstance1"
004047FD . 55 push ebp ; |Inheritable => FALSE
004047FE . 68 01001F00 push 1F0001 ; |Access = 1F0001
00404803 . 89AB 54020000 mov dword ptr ds:[ebx+254],ebp ; |
00404809 . FFD6 call esi ; \OpenMutexA
0040480B . 51 push ecx
0040480C . 3BC5 cmp eax,ebp
0040480E . 8983 00030000 mov dword ptr ds:[ebx+300],eax
00404814 . 8BCC mov ecx,esp
00404816 75 7E jnz short TJMan9.00404896 ;ʵÀý1ÒÑÔËÐÐ,È¥ÔËÐÐʵÀý2
00404818 . 896424 14 mov dword ptr ss:[esp+14],esp
//d esp
//00125C30 71 FB 92 7C qû’|.
0040481C . 68 A0A24100 push TJMan.0041A2A0 ; ASCII "Íâ¹Ò1¿ª!"
00404821 . E8 5CF20000 call <jmp.&MFC42.#537>
00404826 . 8BCB mov ecx,ebx ; |
00404828 . E8 430B0000 call TJMan.00405370 ; \TJMan.00405370
0040482D . BF 8CA24100 mov edi,TJMan.0041A28C ; ASCII "TJ2HANDLE1byParker"
00404832 . 83C9 FF or ecx,FFFFFFFF
00404835 . 33C0 xor eax,eax
00404837 . 8D5424 24 lea edx,dword ptr ss:[esp+24]
0040483B . F2:AE repne scas byte ptr es:[edi]
0040483D . F7D1 not ecx
0040483F . 2BF9 sub edi,ecx
00404841 . 68 ACA24100 push TJMan.0041A2AC ; /MutexName = "TJMANRunOnlyOneInstance1"
00404846 . 8BC1 mov eax,ecx ; |
00404848 . 8BF7 mov esi,edi ; |
0040484A . 8BFA mov edi,edx ; |
0040484C . 55 push ebp ; |InitialOwner
0040484D . C1E9 02 shr ecx,2 ; |
00404850 . F3:A5 rep movs dword ptr es:[edi],dword ptr ds:[esi] ; |
00404852 . 8BC8 mov ecx,eax ; |
00404854 . 55 push ebp ; |pSecurity
00404855 . 83E1 03 and ecx,3 ; |
00404858 . F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[esi] ; |
0040485A . FF15 20604100 call dword ptr ds:[<&KERNEL32.CreateMutexA>] ; \CreateMutexA
00404860 . 3BC5 cmp eax,ebp
00404862 . 8983 00030000 mov dword ptr ds:[ebx+300],eax
00404868 . 74 11 je short TJMan.0040487B
0040486A . FF15 1C604100 call dword ptr ds:[<&KERNEL32.GetLastError>] ; [GetLastError
00404870 . 3D B7000000 cmp eax,0B7
00404875 . 0F85 C9000000 jnz TJMan.00404944
0040487B > 55 push ebp
0040487C . 55 push ebp
0040487D . 68 70A24100 push TJMan.0041A270 ; ASCII "ϵͳ´íÎó1£¬Íâ¹Ò²»ÄÜÔËÐÐ!"
00404882 . E8 3FF00000 call <jmp.&MFC42.#1200>
00404887 . 8B13 mov edx,dword ptr ds:[ebx]
00404889 . 8BCB mov ecx,ebx
0040488B . FF92 CC000000 call dword ptr ds:[edx+CC]
00404891 . E9 AE000000 jmp TJMan.00404944
//ÔËÐÐʵÀý2
00404896 > 896424 14 mov dword ptr ss:[esp+14],esp
//d esp
//00125C30 C0 5B 12 00 À[..
//Õâ¸öespºÃÏñºÜÖØÒª,ÔÚÊÖ¶¯Ôö¼ÓµÚ3¸öʵÀýµÄ´úÂëÖ®ºó,espΪ00125C34,ÔËÐгö´íÁË,
//×îºó±È½Ï¼Ä´æÆ÷µÄ״̬,ÔÙÍù¶ÑÕ»ÀïѹÈëÒ»¸ö²ÎÊý,È»ºóesp±äΪ00125C30,¾Í¿ÉÒÔÕý³£Æô¶¯µÚ3¸öʵÀýÁË.
0040489A . 68 68A24100 push TJMan.0041A268 ; ASCII "Íâ¹Ò2¿ª"
0040489F . E8 DEF10000 call <jmp.&MFC42.#537>
004048A4 . 8BCB mov ecx,ebx ; |
004048A6 . E8 C50A0000 call TJMan.00405370 ; \TJMan.00405370
//ͨ¹ýºóÀ´µÄµÚÈý¸öʵÀý¿ÉÒÔÖªµÀ,ÉÏÃæËÄÐдúÂëÊÇÀàËÆÓÃÀ´³õʼ»¯ÊµÀý(ini instance)µÄ´úÂë,
//////////////////
//Õâ¶Î´úÂëÔÚʵÀýÒ»ÖÖÊÇ·ÅÔÚÉÏÃæÎåÐдúÂëÇ°Ãæ,ÏÖÔÚ°ÑËü·ÅºóÃæÁË,×¢Òâ±È½ÏÇø±ð
//Ò²¾ÍÊÇ˵,ʵÀý2ÊÇÏȳõʼ»¯,È»ºóµ÷ÓÃOpenMutexAÀ´¿´ÊµÀýÊÇ·ñÒÑÔËÐÐ,
//¶øʵÀýÒ»ÊÇÏȵ÷ÓÃOpenMutexAÀ´¿´ÊµÀýÊÇ·ñÒÑÔËÐÐ,È»ºóÔÙÀ´³õʼ»¯,
//ÏÔÈ»,Ó¦¸ÃÏÈÅжÏʵÀýÊÇ·ñ´æÔÚ,È»ºóÔÙÀ´³õʼ»¯.
//ÔÚÊÖ¶¯¹¹ÔìÁËʵÀý3µÄ´úÂëÖ®ºó,»á·¢ÏÖʵÀý2µÄÕâÖÖ˳ÐòËù´øÀ´µÄÓ°Ïì,ÔÚºóÀ´,ÎÒÓÖÊÖ¶¯µ÷»»ÁËÕâÁ½¶ÎС´úÂëµÄ˳Ðò.
004048AB . 68 4CA24100 push TJMan.0041A24C ; ASCII "TJMANRunOnlyOneInstance2"
004048B0 . 55 push ebp
004048B1 . 68 01001F00 push 1F0001
{ ¶ÔÕձȽÏÁ½¸öʵÀýµÄ´úÂë:
ʵÀý1ÖÐÕâÀïÓÐÒ»¾ä
00404803 . 89AB 54020000 mov dword ptr ds:[ebx+254],ebp ; |
}
004048B6 . FFD6 call esi ;ESI 7C80EC1B kernel32.OpenMutexA
{ʵÀý1ÖÐÕâÀïÓÐÒ»¾ä
0040480B . 51 push ecx
ECX 7C92FB71 ntdll.7C92FB71
ÔÚºóÀ´½¨Á¢ÊµÀý3ºó,¶ÑջΪ00125C34,ÔËÐдíÎó,ΪÁËÐÞÕý¶ÑÕ»,ѹÈëÁË´Ë7C92FB71.
²»¹ýµ±µ÷»»ÊµÀý2µÄ³õʼ»¯ºÍopenmutexºó,ÓÉÓÚͬÑùµÄ¶ÑÕ»ÔÒò,°Ñpush 7C92FB71 NOPÁË,
ÔËÐÐÕý³£(Õâ¸ö²ÎÊýºÃÏñûÓÃ),Ö»Òª±£Ö¤espºÍecxΪ00125C30¾ÍÐÐÁË.
}
004048B8 . 3BC5 cmp eax,ebp
004048BA . 8983 00030000 mov dword ptr ds:[ebx+300],eax
{
ʵÀý1ÖÐÕâÀïÓÐÒ»¾ä
00404814 . 8BCC mov ecx,esp
ecx=00125C30
d ecx
00125C30 71 FB 92 7C qû’|.
×¢Òâ,ÕâÕýÊÇ0040480B´¦pushµÄecx.
}
004048C0 . 75 6C jnz short TJMan.0040492E
////µÚ¶þ¸öʵÀýÒÑÔËÐÐ,ÏÔʾ"Ö»Ö§³ÖË«¿ª".
//ËùÐèÒª×÷µÄ¾ÍÊÇÔÚÊʵ±µÄλÖÃÔö¼ÓÒ»¶Î´´½¨ÊµÀý3µÄ´úÂë,È»ºó´ÓÕâÀïÌøÈ¥.»ù±¾Ë¼Ïë¾ÍÊÇÕâÑù.
//´´½¨ÊµÀý3µÄ´úÂë,ÊÇ´ÓʵÀý2µÄ´úÂ뿽¹ýÈ¥µÄ,´Ó00404896µ½0040492C.
///////////////////
004048C2 . BF 38A24100 mov edi,TJMan.0041A238 ; ASCII "TJ2HANDLE2byParker"
004048C7 . 83C9 FF or ecx,FFFFFFFF
004048CA . 33C0 xor eax,eax
004048CC . 8D5424 24 lea edx,dword ptr ss:[esp+24] ;edx=esp+24=00125C34+24=00125C58
004048D0 . F2:AE repne scas byte ptr es:[edi]
004048D2 . F7D1 not ecx
004048D4 . 2BF9 sub edi,ecx
004048D6 . 68 4CA24100 push TJMan.0041A24C ; /MutexName = "TJMANRunOnlyOneInstance2"
004048DB . 8BC1 mov eax,ecx ; |
004048DD . 8BF7 mov esi,edi ; |
004048DF . 8BFA mov edi,edx ; |
004048E1 . 55 push ebp ; |InitialOwner
004048E2 . C1E9 02 shr ecx,2 ; |
004048E5 . F3:A5 rep movs dword ptr es:[edi],dword ptr ds:[esi] ; |
004048E7 . 8BC8 mov ecx,eax ; |
004048E9 . 55 push ebp ; |pSecurity
004048EA . 83E1 03 and ecx,3 ; |
004048ED . F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[esi] ; |
004048EF . FF15 20604100 call dword ptr ds:[<&KERNEL32.CreateMutexA>] ; \CreateMutexA
004048F5 . 3BC5 cmp eax,ebp
004048F7 . 8983 00030000 mov dword ptr ds:[ebx+300],eax
004048FD . 74 0D je short TJMan.0040490C
004048FF . FF15 1C604100 call dword ptr ds:[<&KERNEL32.GetLastError>] ; [GetLastError
00404905 . 3D B7000000 cmp eax,0B7
0040490A . 75 16 jnz short TJMan.00404922
0040490C > 55 push ebp
0040490D . 55 push ebp
0040490E . 68 1CA24100 push TJMan.0041A21C ; ASCII "ϵͳ´íÎó2£¬Íâ¹Ò²»ÄÜÔËÐÐ!"
00404913 . E8 AEEF0000 call <jmp.&MFC42.#1200>
00404918 . 8B13 mov edx,dword ptr ds:[ebx]
0040491A . 8BCB mov ecx,ebx
0040491C . FF92 CC000000 call dword ptr ds:[edx+CC]
00404922 > C783 54020000 01000000 mov dword ptr ds:[ebx+254],1, //////////
0040492C . EB 16 jmp short TJMan.00404944
//ÏÂÃæÕâ¶Î´úÂëÊÇÓÃÀ´ÏÔʾÐÅÏ¢µÄ.
//°ÑÏÂÃæÈ«²¿NOPµô,È»ºóÓÃÀ´×ö³¤×ªÒƵÄÌø°å!
//È»ºó°ÑÕâ¶Î´úÂë·ÅÔÚʵÀý3µÄ´úÂëºóÃæ,×îºóÔÙÌø»ØÀ´00404944.
//
0040492E > 55 push ebp
0040492F . 55 push ebp
00404930 . 68 00A24100 push TJMan.0041A200 ; ASCII "¶Ô²»Æð,Íâ¹Ò½ö½öÖ§³ÖË«¿ª!"
00404935 . E8 8CEF0000 call <jmp.&MFC42.#1200>
0040493A . 8B03 mov eax,dword ptr ds:[ebx]
0040493C . 8BCB mov ecx,ebx
0040493E . FF90 CC000000 call dword ptr ds:[eax+CC]
δÐÞ¸ÄÇ°µÄ´úÂë¾ÍÊÇÉÏÃæÕâЩÁË
=====================================================
//ÏÂÃæ¾ÍÒªÔÚ.text¶ÎÖÐÕÒÒ»¿é¿Õ°×µØ·½,°ÑÏÂÃæµÄ´úÂë(´´½¨ÊµÀý3,´ÓʵÀý2¿½±´¶øÀ´,È»ºóÔÙÐ޸IJ¿·Ö´úÂë,Ö÷ÒªÊÇһЩcall,±ÈÈçcall 00413A82,
//ÔÚ²»Í¬µÄλÖõ÷ÓÃ,Éú³ÉµÄ»úÆ÷´úÂë²»Ò»Ñù,ÒòΪ²ÉÓÃÏà¶ÔÑ°Ö··½Ê½)¼Ó½øÈ¥
//ÐÞ¸ÄPEµÄ¹¤¾ßÎÒ²ÉÓÃÁËraindy ºº»¯µÄstudyPE,ºÜºÃÓÃ.Ïò×÷Õߺͺº»¯×÷Õß±íʾ¾´Òâ!
//ÓÃstudyPE´ú¿ªTjman.exe,µã"Çø¶Î",ÔÚNO01,.textÇø¶ÎÕâÐеãÓÒ¼ü,"Ç°ÍùÇø¶Î¿ªÍ·"
//È»ºó¼ÇסÎÒÃÇÒª¿½±´µÄ´úÂëÊÇ´Ó00404896µ½0040492C,¼õÈ¥»ùÖ·00401000ºó¿ÉµÃµ½Ïà¶ÔλÒÆ,È»ºóÔÙÓÒ¼ü,"copy"Õâ¶Î´úÂë,
//ÔÚÕâ¸öÇø¶ÎµÄºóÃæÕÒ¸ö¿Õ°×µØ·½,µãÓÒ¼ü,"Õ³Ìù"¹ýÈ¥.ÎÒÑ¡µÄ¿ªÊ¼Î»ÖÃÊÇ000157B0.
//000157B0 (000157B0)
896424146868A24100E8DEF100008BCBE8C50A0000684CA24100556801001F00FFD63BC5898300030000756CBF38A2410083C9FF33C08D542424F2AEF7D12BF9684CA241008BC
18BF78BFA55C1E902F3A58BC85583E103F3A4FF15206041003BC5898300030000740DFF151C6041003DB700000075165555681CA24100E8AEEF00008B138BCBFF92CC000000C7
835402000001000000EB16
//////
ÏÂÃæÒª×öµÄ¾ÍÊÇ°ÑÇ°ÃæÌáµ½µÄ²¿·Ö²»×¼È·µÄcallÐ޸ĹýÀ´.
¸ÄÍêºó¿´µ½µÄ»¹ÊÇASCII "TJ2HANDLE2byParker",MutexName = "TJMANRunOnlyOneInstance2",ASCII "ϵͳ´íÎó2£¬Íâ¹Ò²»ÄÜÔËÐÐ!",ÒÔ¼°ASCII "¶Ô²»Æð,Íâ¹Ò½ö½ö
Ö§³ÖË«¿ª!"
Òò´Ë,»¹ÐèÒª×öµÄ¾ÍÊÇÔÚNO03,Çø¶Î.dataÖÐΪʵÀý3Ôö¼ÓÏÔʾµÄÊý¾Ý.Õⲿ·Ö¹¤×÷ºÜ¼òµ¥,°ÑʵÀý2µÄÊý¾Ý¿½±´¹ýÈ¥,
È»ºó32¸Ä³É33,°Ñ¶þµÄÄÚÂë¸Ä³ÉC8FD¾ÍÐÐÁË(µ«ÊÇOD»¹ÊDz»ÄÜÕý³£ÏÔʾ'Èý',²»ÖªÎªÊ²Ã´).
È»¶øºóÀ´¿´µ½,ÊÂÇé²»ÊÇÏëÏóÄÇô¼òµ¥.¸Õ¿ªÊ¼,ÎÒÃÇÕâ¶ÎÊý¾Ý·ÅÔÚ.dataµÄ±ãÒË000010C0´¦,¼¸ºõ½ô¸úÔÚÔÀ´µÄÊý¾ÝºóÃæÁË.
ºóÀ´µ÷ÊÔ·¢ÏÖ,ʵÀýÒ»ÔËÐкó,Õâ¶ÎÊý¾Ý¾Í±»ÐÞ¸ÄÁË,Èç"/MutexName = "ÿÿÿ""µÈ,¿´À´³ÌÐòÖ´ÐеÄʱºò»¹»áÓõ½Õⲿ·Ö¿Õ¼ä,
ÓÚÊÇÕâ¶ÎÊý¾ÝÓֵðá¼Ò,Õâ´ÎÔ¶µã°á°É,°áµ½ÁËÆ«ÒÆ000018C0´¦,ºóÀ´¾ÍûÎÊÌâÁË.
ºóÀ´ÔËÐеÚ3¸öʵÀý,±¨´í,·¢ÏÖÊǶÑÕ»µÄÎÊÌâ,
¼ûÏÂÃæµÄ´úÂë,¿´ËüÊÇÔÚÄÄÒ»Ðгö´íµÄ
00405370 /$ 6A FF push -1
//eax=00125B40
//d [eax]
//00374040 CD E2 B9 D2 33 BF AA 00 Íâ¹Ò3¿ª.
//00374048 0D F0 AD BA 0D F0 AD BA .ð?ð
00405372 |. 68 D0484100 push TJMan3.004148D0 ; SE handler installation
00405377 |. 64:A1 0000000>mov eax,dword ptr fs:[0]
0040537D |. 50 push eax
0040537E |. 64:8925 00000>mov dword ptr fs:[0],esp
00405385 |. 83EC 14 sub esp,14
00405388 |. 53 push ebx
00405389 |. 55 push ebp
0040538A |. 56 push esi
0040538B |. 57 push edi
0040538C |. 8BF1 mov esi,ecx
0040538E |. 8D4C24 10 lea ecx,dword ptr ss:[esp+10]
00405392 |. C74424 2C 000>mov dword ptr ss:[esp+2C],0
0040539A |. E8 75E50000 call <jmp.&MFC42.#540>
0040539F |. 8D4C24 20 lea ecx,dword ptr ss:[esp+20]
004053A3 |. C64424 2C 01 mov byte ptr ss:[esp+2C],1
004053A8 |. E8 67E50000 call <jmp.&MFC42.#540>
004053AD |. 68 80A14100 push TJMan3.0041A180 ; ASCII "
"
004053B2 |. 8D4C24 18 lea ecx,dword ptr ss:[esp+18]
004053B6 |. C64424 30 02 mov byte ptr ss:[esp+30],2
004053BB |. E8 C2E60000 call <jmp.&MFC42.#537>
004053C0 |. 8D4424 34 lea eax,dword ptr ss:[esp+34]
004053C4 |. 8D4C24 10 lea ecx,dword ptr ss:[esp+10]
004053C8 |. 50 push eax
004053C9 C64424 30 03 mov byte ptr ss:[esp+30],3
004053CE |. E8 23E50000 call <jmp.&MFC42.#858>
//³ÌÐòÔÚ004053CEÕâÀﱨ´íÁË,¸ú½øÈ¥,·¢ÏÖÒì³£ÔÚ73D34973´¦,ÊÇʲôÔÒòÄØ?
ÔÀ´ÔÚ73D3496F´¦edi=00125C34,¶ø[00125C34]=0,ËùÒÔ73D34973´¦¾ÍÊÇmov eax,[0],
ÏÔÈ»³ö´í,ÔõôÐÞÕýÄØ?¸ú½øʵÀý1ºÍʵÀý2¿´¿´!·¢ÏÖËüÃÇÔÚ73D3496F´¦µÄedi¶¼ÊÇ00125C30,
ÕÕè»»¢¿´¿´,ÐÞ¸Äedi,ÔËÐÐ,ÕâÀï²»ÔÙ±¨´í.
73D3496B M> 8BFF mov edi,edi
73D3496D 56 push esi
73D3496E 57 push edi
73D3496F 8B7C24 0C mov edi,dword ptr ss:[esp+C]
73D34973 8B07 mov eax,dword ptr ds:[edi]
73D34975 8BF1 mov esi,ecx
73D34977 8B0E mov ecx,dword ptr ds:[esi]
73D34979 3BC8 cmp ecx,eax
73D3497B 74 39 je short MFC42.73D349B6
73D3497D 8379 F4 00 cmp dword ptr ds:[ecx-C],0
73D34981 7D 0B jge short MFC42.73D3498E
73D34983 83C1 F4 add ecx,-0C
73D34986 3B0D C486E073 cmp ecx,dword ptr ds:[73E086C4] ; MFC42.73E086C8
73D3498C 75 06 jnz short MFC42.73D34994
73D3498E 8378 F4 00 cmp dword ptr ds:[eax-C],0
73D34992 7D 0D jge short MFC42.73D349A1
È»¶øÕâ¸ö00125C34ÊÇÄÄÀï´«½øÀ´µÄÄØ,×îºóÕÒµ½ÕâÀï:
004157B0 > \896424 14 mov dword ptr ss:[esp+14],esp
¶øÕâÀïÊÇʵÀý3µÄÓï¾ä,ËüÊÇ´Ó00404934 ³¤Ìøת¹ýÀ´µÄ,
²é¿´ÊµÀý2ÎÒÃÇ·¢ÏÖ¿ÉÒÔÔÚÕâ¸ö³¤jmpÇ°pushÒ»¸ö×Ö,±ã¿É¾ÀÕý¶ÑÕ»,
ÔÚ²»ÖªµÀÕâ¸öѹÈëµÄ²ÎÊýÊÇʲôÒâ˼µÄÇé¿öÏÂ,»¹ÊÇѹÈëºÍʵÀý2Ò»ÑùµÄ×Ö°É!
push 7C92FB71
È»ºóÔÙjmp TJMan3.004157B0
OKÁË!
ʵÀý3¿ÉÒÔÕý³£µ÷³öÀ´.
µ«ÊÇÔÙÃæ°åÀï¿´µ½ÁËÁ½ÐÐÎÄ×Ö
"Íâ¹Ò2¿ª
Íâ¹Ò3¿ª"
Ó¦¸ÃÖ»ÓÐÒ»ÐÐ"Íâ¹Ò3¿ª"µÄ,ΪʲôÄØ?
»ØÍ·¿´¿´Ç°ÃæµÄ´úÂë,·¢ÏÖ´ÓʵÀý2Ìø¹ýÀ´Ê±,³öÁ˵ãÎÊÌâ.
ÒòΪËüÏȳõʼ»¯,È»ºóÔÙOpenmutex,´ò¿ª»¥³âÁ¿,Õâ¸ö˳ÐòÔÚÂß¼ÉÏÓÐÎÊÌâ.
ÏÂÃæÎÒÃÇÔÙ½»»»Õâ¸öÁ½¶ÎС´úÂëµÄ˳Ðò!
»¹ÊÇÓÃStudyPE,copy,paste,copy,paste,...
ÐÞ¸ÄcallµÄÆ«ÒÆÁ¿,ÔËÐÐ,±¨´í...
ÔÙ×ÐϸÀ´¿´¿´¼Ä´æÆ÷µÄ״̬,±È½ÏÒ»ÏÂΪʲô³ö´í.
ÏÂÃæµÄgoodÊÇÔÚ½»»»Á½¶Î´úÂëÇ°µÄÕý³£ÔËÐеÄ״̬,badÊǽ»»»ºóµÄ״̬,
ͨ¹ýÐ޸ĿÉÒÔ·¢ÏÖ,Ö»Òª½«badµÄECX¸ÃΪgoodµÄECXÖµ,±ã¿ÉÒÔÕý³£ÔËÐÐÁË!
¿´À´Õâ¸ö00125C30ÕæÖØÒª°¡!
====
good
EAX 000000E8
ECX 00125C30
EDX 7C92EB94 ntdll.KiFastSystemCallRet
EBX 00126320 ASCII "0nA"
ESP 00125C30
EBP 00000000
ESI 7C80EC1B kernel32.OpenMutexA
EDI 00000000
bad
EAX 00000000
ECX 7C92FB71 ntdll.7C92FB71
EDX 00000002
EBX 00126320 ASCII "0nA"
ESP 00125C30
EBP 00000000
ESI 7C80EC1B kernel32.OpenMutexA
EDI 00000000
½öÐÞ¸´ecx=00125c30¾ÍÐÐÁË
============
ÓÚÊÇÔÙÏë°ì·¨ÐÞ¸´ECX,ͨ¹ý¹Û²ì·¢ÏÖ,Ö»ÒªÔÚ mov dword ptr ss:[esp+14],esp
Ç°Ãæ¼ÓÒ»¾ämov ecx,esp¾Í¿ÉÒÔÁË(ʵÀýÒ»ÖÐÓÐÕâÒ»¾ä)
ÔÙÆô¶¯StudyPE,°Ñ´úÂë°á¼Ò,ÌÚ³ö¿Õ¼ä...
ºóÀ´·¢ÏÖ,mov ecx,espÇ°ÃæµÄjnz short 00404934µÃ±ä³Éjnz long 00404934ÁË,
ÔÀ´Ö»ÓÐ2×Ö½Ú,ÏÖÔÚÈ´ÊÇ6×Ö½Ú,û°ì·¨,ÔÙ°á¼Ò,ÀÛ....
°áÍêºó»¹ÒªÐÞ¸ÄcallµÃÆ«ÒÆ,
×îºóʵÀý2¿ÉÒÔÔËÐÐÁË!
¿ÉÊÇ·¢ÏÖʵÀý3ÓÖ²»ÄÜÔËÐÐÁË,½»»»Ö®Ç°ÊÇ
push 7C92FB71
mov ecx,esp
jmp TJMan3.004157B0
¶ø½»»»ºóµÄespÒѾΪ00125C30,²»ÒªÔÙÐÞÕý¶ÑÕ»ÁË,
Õâ¾äpush 7C92FB71 NOPµô!
ʵÀýÈýÒ²¿ÉÒÔ´ò¿ªÁË!
ÏÂÃæÊÇÐ޸ĺóµÄ´úÂë:
´úÂë:
004047F2 . 8B35 24604100 mov esi,dword ptr ds:[<&KERNEL32.OpenMutexA>] ; kernel32.OpenMutexA
004047F8 . 68 ACA24100 push TJMan23.0041A2AC ; /MutexName = "TJMANRunOnlyOneInstance1"
004047FD . 55 push ebp ; |Inheritable => FALSE
004047FE . 68 01001F00 push 1F0001 ; |Access = 1F0001
00404803 . 89AB 54020000 mov dword ptr ds:[ebx+254],ebp ; |
00404809 . FFD6 call esi ; \OpenMutexA
0040480B . 51 push ecx
0040480C . 3BC5 cmp eax,ebp
0040480E . 8983 00030000 mov dword ptr ds:[ebx+300],eax
00404814 . 8BCC mov ecx,esp
00404816 75 7E jnz short TJMan23.00404896
00404818 896424 14 mov dword ptr ss:[esp+14],esp
0040481C . 68 A0A24100 push TJMan23.0041A2A0 ; ASCII "Íâ¹Ò1¿ª!"
00404821 . E8 5CF20000 call <jmp.&MFC42.#537>
00404826 . 8BCB mov ecx,ebx ; |
00404828 . E8 430B0000 call TJMan23.00405370 ; \TJMan23.00405370
0040482D . BF 8CA24100 mov edi,TJMan23.0041A28C ; ASCII "TJ2HANDLE1byParker"
00404832 . 83C9 FF or ecx,FFFFFFFF
00404835 . 33C0 xor eax,eax
00404837 . 8D5424 24 lea edx,dword ptr ss:[esp+24]
0040483B . F2:AE repne scas byte ptr es:[edi]
0040483D . F7D1 not ecx
0040483F . 2BF9 sub edi,ecx
00404841 . 68 ACA24100 push TJMan23.0041A2AC ; /MutexName = "TJMANRunOnlyOneInstance1"
00404846 . 8BC1 mov eax,ecx ; |
00404848 . 8BF7 mov esi,edi ; |
0040484A . 8BFA mov edi,edx ; |
0040484C . 55 push ebp ; |InitialOwner
0040484D . C1E9 02 shr ecx,2 ; |
00404850 . F3:A5 rep movs dword ptr es:[edi],dword ptr ds:[esi] ; |
00404852 . 8BC8 mov ecx,eax ; |
00404854 . 55 push ebp ; |pSecurity
00404855 . 83E1 03 and ecx,3 ; |
00404858 . F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[esi] ; |
0040485A . FF15 20604100 call dword ptr ds:[<&KERNEL32.CreateMutexA>] ; \CreateMutexA
00404860 . 3BC5 cmp eax,ebp
00404862 . 8983 00030000 mov dword ptr ds:[ebx+300],eax
00404868 . 74 11 je short TJMan23.0040487B
0040486A . FF15 1C604100 call dword ptr ds:[<&KERNEL32.GetLastError>] ; [GetLastError
00404870 . 3D B7000000 cmp eax,0B7
00404875 . 0F85 C9000000 jnz TJMan23.00404944
0040487B > 55 push ebp
0040487C . 55 push ebp
0040487D . 68 70A24100 push TJMan23.0041A270 ; ASCII "ϵͳ´íÎó1£¬Íâ¹Ò²»ÄÜÔËÐÐ!"
00404882 . E8 3FF00000 call <jmp.&MFC42.#1200>
00404887 . 8B13 mov edx,dword ptr ds:[ebx]
00404889 . 8BCB mov ecx,ebx
0040488B . FF92 CC000000 call dword ptr ds:[edx+CC]
00404891 . E9 AE000000 jmp TJMan23.00404944
00404896 > 68 4CA24100 push TJMan23.0041A24C ; ASCII "TJMANRunOnlyOneInstance2"
0040489B . 55 push ebp
0040489C . 68 01001F00 push 1F0001
004048A1 . FFD6 call esi ;OpenMutexA
004048A3 . 3BC5 cmp eax,ebp
004048A5 . 8983 00030000 mov dword ptr ds:[ebx+300],eax
004048AB 0F85 83000000 jnz TJMan23.00404934
004048B1 . 8BCC mov ecx,esp
004048B3 . 896424 14 mov dword ptr ss:[esp+14],esp
004048B7 . 68 68A24100 push TJMan23.0041A268 ; ASCII "Íâ¹Ò2¿ª"
004048BC . E8 C1F10000 call <jmp.&MFC42.#537>
004048C1 . 8BCB mov ecx,ebx ; |
004048C3 . E8 A80A0000 call TJMan23.00405370 ; \TJMan23.00405370
004048C8 . BF 38A24100 mov edi,TJMan23.0041A238 ; ASCII "TJ2HANDLE2byParker"
004048CD . 83C9 FF or ecx,FFFFFFFF
004048D0 . 33C0 xor eax,eax
004048D2 . 8D5424 24 lea edx,dword ptr ss:[esp+24]
004048D6 . F2:AE repne scas byte ptr es:[edi]
004048D8 . F7D1 not ecx
004048DA . 2BF9 sub edi,ecx
004048DC . 68 4CA24100 push TJMan23.0041A24C ; /MutexName = "TJMANRunOnlyOneInstance2"
004048E1 . 8BC1 mov eax,ecx ; |
004048E3 . 8BF7 mov esi,edi ; |
004048E5 . 8BFA mov edi,edx ; |
004048E7 . 55 push ebp ; |InitialOwner
004048E8 . C1E9 02 shr ecx,2 ; |
004048EB . F3:A5 rep movs dword ptr es:[edi],dword ptr ds:[esi] ; |
004048ED . 8BC8 mov ecx,eax ; |
004048EF . 55 push ebp ; |pSecurity
004048F0 . 83E1 03 and ecx,3 ; |
004048F3 . F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[esi] ; |
004048F5 . FF15 20604100 call dword ptr ds:[<&KERNEL32.CreateMutexA>] ; \CreateMutexA
004048FB . 3BC5 cmp eax,ebp
004048FD . 8983 00030000 mov dword ptr ds:[ebx+300],eax
00404903 . 74 0D je short TJMan23.00404912
00404905 . FF15 1C604100 call dword ptr ds:[<&KERNEL32.GetLastError>] ; [GetLastError
0040490B . 3D B7000000 cmp eax,0B7
00404910 . 75 16 jnz short TJMan23.00404928
00404912 > 55 push ebp
00404913 . 55 push ebp
00404914 . 68 1CA24100 push TJMan23.0041A21C ; ASCII "ϵͳ´íÎó2£¬Íâ¹Ò²»ÄÜÔËÐÐ!"
00404919 . E8 ACEF0000 call TJMan23.004138CA
0040491E . 8B13 mov edx,dword ptr ds:[ebx]
00404920 . 8BCB mov ecx,ebx
00404922 . FF92 CC000000 call dword ptr ds:[edx+CC]
00404928 C783 54020000>mov dword ptr ds:[ebx+254],1
00404932 . EB 10 jmp short TJMan23.00404944
00404934 > 90 nop
00404935 . 90 nop
00404936 . 90 nop
00404937 . 90 nop
00404938 . 90 nop
00404939 . 8BCC mov ecx,esp
0040493B . E9 700E0100 jmp TJMan23.004157B0
00404940 90 nop
00404941 90 nop
00404942 90 nop
00404943 90 nop
------ʵÀý3µÄ´úÂë-----
004157B0 > \896424 14 mov dword ptr ss:[esp+14],esp
004157B4 . 68 10B94100 push TJMan23.0041B910 ; ASCII "Íâ¹Ò3¿ª"
004157B9 . E8 C4E2FFFF call <jmp.&MFC42.#537>
004157BE . 8BCB mov ecx,ebx ; |
004157C0 . E8 ABFBFEFF call TJMan23.00405370 ; \TJMan23.00405370
004157C5 . 68 F5B84100 push TJMan23.0041B8F5 ; ASCII "JMANRunOnlyOneInstance3"
004157CA . 55 push ebp
004157CB . 68 01001F00 push 1F0001
004157D0 . FFD6 call esi
004157D2 . 3BC5 cmp eax,ebp
004157D4 . 8983 00030000 mov dword ptr ds:[ebx+300],eax
004157DA . 75 6C jnz short TJMan23.00415848
004157DC . BF E0B84100 mov edi,TJMan23.0041B8E0 ; ASCII "TJ2HANDLE3byParker"
004157E1 . 83C9 FF or ecx,FFFFFFFF
004157E4 . 33C0 xor eax,eax
004157E6 . 8D5424 24 lea edx,dword ptr ss:[esp+24]
004157EA . F2:AE repne scas byte ptr es:[edi]
004157EC . F7D1 not ecx
004157EE . 2BF9 sub edi,ecx
004157F0 . 68 F5B84100 push TJMan23.0041B8F5 ; /MutexName = "JMANRunOnlyOneInstance3"
004157F5 . 8BC1 mov eax,ecx ; |
004157F7 . 8BF7 mov esi,edi ; |
004157F9 . 8BFA mov edi,edx ; |
004157FB . 55 push ebp ; |InitialOwner
004157FC . C1E9 02 shr ecx,2 ; |
004157FF . F3:A5 rep movs dword ptr es:[edi],dword ptr ds:[esi] ; |
00415801 . 8BC8 mov ecx,eax ; |
00415803 . 55 push ebp ; |pSecurity
00415804 . 83E1 03 and ecx,3 ; |
00415807 . F3:A4 rep movs byte ptr es:[edi],byte ptr ds:[esi] ; |
00415809 . FF15 20604100 call dword ptr ds:[<&KERNEL32.CreateMutexA>] ; \CreateMutexA
0041580F . 3BC5 cmp eax,ebp
00415811 . 8983 00030000 mov dword ptr ds:[ebx+300],eax
00415817 . 74 0D je short TJMan23.00415826
00415819 . FF15 1C604100 call dword ptr ds:[<&KERNEL32.GetLastError>] ; [GetLastError
0041581F . 3D B7000000 cmp eax,0B7
00415824 . 75 16 jnz short TJMan23.0041583C
00415826 > 55 push ebp
00415827 . 55 push ebp
00415828 . 68 C4B84100 push TJMan23.0041B8C4 ; ASCII "ϵͳ´íÎó3£¬Íâ¹Ò²»ÄÜÔËÐÐ!"
0041582D . E8 94E0FFFF call <jmp.&MFC42.#1200>
00415832 . 8B13 mov edx,dword ptr ds:[ebx]
00415834 . 8BCB mov ecx,ebx
00415836 . FF92 CC000000 call dword ptr ds:[edx+CC]
0041583C > C783 54020000>mov dword ptr ds:[ebx+254],1
00415846 . EB 16 jmp short TJMan23.0041585E
00415848 > 55 push ebp
00415849 . 55 push ebp
0041584A . 68 00A24100 push TJMan23.0041A200 ;ÕâÀïÓ¦¸ÃÊÇ"¶Ô²»Æð,²»Ö§³ÖÈý¿ª",²»ÖªÔõô»ØÊÂ,²»ÄÜÏÔʾ'Èý'
0041584F . E8 72E0FFFF call <jmp.&MFC42.#1200>
00415854 . 8B03 mov eax,dword ptr ds:[ebx]
00415856 . 8BCB mov ecx,ebx
00415858 . FF90 CC000000 call dword ptr ds:[eax+CC]
0041585E >^ E9 E1F0FEFF jmp TJMan23.00404944
ËäȻʵÀý3¿ÉÒÔ´ò¿ª,µ«ÊǽøÈëÓÎÏ·ºó,²»ÄÜÆô¶¯Íâ¹ÒµÄÈȼü,
¶øʵÀý1ºÍʵÀý2¶¼¿ÉÒÔ,ʲôÔÒòÄØ?ÄѵÀʵÀý3µÄ´úÂ뻹ÓÐʲôÎÊÌâ?
ÕâÑùÀ´ÊÔÊÔ:ÏÈÔËÐÐʵÀýÒ»,È»ºó²»ÔËÐÐʵÀý2,ÒòΪʵÀý2ºÍʵÀý3µÄ´úÂëÍêÈ«Ò»ÖÂ,
Çø±ð½öÔÚÓÚÊý¾Ý(2±ä³É3).
00404816 75 7E jnz short TJMan23.00404896
ÕâÀïÊÇÌøȥʵÀý2,Ìøµ½00404896ºóÔÙÀ´¸ö³¤Ìøתjmp 004157B0,È¥ÔËÐÐʵÀý3.
ÕâÀï²»ÔÚ00404816Ö±½Ó³¤ÌøÊÇΪÁ˱ÜÃâÊý¾ÝÔٴΰá¼Ò.
½á¹ûʵÀý3»¹ÊDz»ÄÜÆô¶¯Èȼü,Õâ¿ÉÊǺÍʵÀý2Ò»ÑùµÄ´úÂë°¡!
ÔÎ~~ÕÒ²»µ½ÔÒòÁË...
»¹ÊÇдÏÂÁËÕâƪ×ܽá,ÀíÒ»Àí×Ô¼ºµÄ˼·....
¡¾²Î¿¼ÖªÊ¶¡¿´ÓÍøÉÏËѵÃ,ÁãÁãɢɢµÄ
1.
ÔÚInitApplicationÖд´½¨Ò»¸öͬ²½¶ÔÏó£¬Èç¹ûGETLASTERROR£¨£©µ÷Ó÷µ»ØERROR_ALREADY_EXISTS±íÃ÷ÒѾÓÐÒ»¸öÁË
ÔÚInitInstanceÀï¿ÉÒÔµ÷Ó㺣ºOpenMutexº¯ÊýÅжϻ¥³âÁ¿ÊÇ·ñ´æÔÚ£¬Èç¹ûûÓУ¬µ÷Ó㺣ºCreateMutex½¨Á¢Ò»¸ö»¥³âÁ¿£¬·´Ö®±íÃ÷ÒѾÓÐÒ»¸öʵÀýÁË¡£Í˳ö³ÌÐò
ʱµ÷Ó㺣ºReleaseMutexÊÍ·Å´´½¨µÄ»¥³âÁ¿¡£
2.
´´½¨»¥³âÁ¿£º
HANDLE CreateMutex(
LPSECURITY_ATTRIBUTES lpMutexAttributes,// °²È«ÐÅÏ¢
BOOL bInitialOwner, // ×î³õ״̬£¬
//Èç¹ûÉèÖÃΪÕ棬Ôò±íʾ´´½¨ËüµÄÏß³ÌÖ±½ÓÓµÓÐÁ˸û¥³âÁ¿£¬¶ø²»ÐèÒªÔÙÉêÇë
LPCTSTR lpName // Ãû×Ö£¬¿ÉÒÔΪNULL£¬µ«ÕâÑùÒ»À´¾Í²»Äܱ»ÆäËûÏß³Ì/½ø³Ì´ò¿ª
);
´ò¿ªÒ»¸ö´æÔڵĻ¥³âÁ¿£º
HANDLE OpenMutex(
DWORD dwDesiredAccess, // ´æÈ¡·½Ê½
BOOL bInheritHandle, // ÊÇ·ñ¿ÉÒÔ±»¼Ì³Ð
LPCTSTR lpName // Ãû×Ö
);
ÊÍ·Å»¥³âÁ¿µÄʹÓÃȨ£¬µ«ÒªÇóµ÷Óøú¯ÊýµÄÏß³ÌÓµÓиû¥³âÁ¿µÄʹÓÃȨ£º
BOOL ReleaseMutex(//×÷ÓÃÈçͬLeaveCriticalSection
HANDLE hMutex // ¾ä±ú
);
¹Ø±Õ»¥³âÁ¿£º
BOOL CloseHandle(
HANDLE hObject // ¾ä±ú
);
3.
CreateFileMappingµÄº¯ÊýΪָ¶¨µÄÎļþ´´½¨Ò»¸öÎļþÓ³Éä¶ÔÏ󣬸ú¯ÊýµÄÔÐÎÈçÏ£º
HANDLE CreateFileMapping(HANDLE hFile,//ÓÃÓÚÓ³ÉäµÄÎļþ¾ä±ú LPSECURITY?ATTRIBUTES FileMappingAttributes,//ÄÚ´æÓ³ÉäÎļþµÄ°²È«ÃèÊö·û DWORD
Flprotect,//ÎļþÓ³Éä¶ÔÏóµÄ×î´ó³¤¶ÈµÄ¸ß32λ DWORD dwMaximumSizelow,//×î´ó³¤¶ÈµÄµÍ32λ LPCTSTR IPNAME//Ö¸¶¨Õâ¸öÄÚ´æÓ³ÉäÎļþµÄÃû×Ö)
ÖµµÃ×¢ÒâµÄÊÇ£¬²ÎÊýÈç¹ûÊÇOXFFFFFFFF£¬½«ÔÚ²Ù×÷ϵͳÐéÄâÄÚ´æÒ³ÃæÌæ»»ÎļþÖд´½¨ÎļþÓ³Éä¶ÔÏ󣬶ø²»ÊÇʹÓôÅÅÌÎļþ£¬Í¬Ê±±ØÐë¸ø³öÕâ¸öÓ³Éä¶ÔÏóµÄ´óС¡£
¡¾Æƽâ×ܽ᡿ None
¡¾Greetings¡¿ ¿´Ñ©ÂÛ̳,FCGÂÛ̳,DFCGÂÛ̳µÈ
¡¾Íê¸åʱ¼äµÈ¡¿2005.05.13,22:31,ÌìÆø:Çç,¹ãÖÝ