ReloXÐÞ¸´DLLÍÑ¿ÇÖØ¶¨Î»±íµÄ¼ò±ã·½·¨¡ª¡ªÓÃOllydbgÊÖÍÑNeolite¼Ó¿ÇµÄDLL
¡¾×÷ÕßÉùÃ÷¡¿£ºÖ»ÊǸÐÐËȤ£¬Ã»ÓÐÆäËûÄ¿µÄ¡£Ê§ÎóÖ®´¦¾´ÇëÖîλ´óÏÀ´Í½Ì£¡
¡¾µ÷ÊÔ»·¾³¡¿£ºWinXP¡¢Ollydbg V1.10¡¢PEiD¡¢LordPE¡¢WinHex¡¢ReloX
¡¾ÊµÀýÏÂÔØ¡¿£ºµã»÷ÏÂÔØ
¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª
¡¾Íѿǹý³Ì¡¿£º
ijЩ¿Ç±£»¤µÄDLLÍÑ¿ÇÊ±ÖØ¶¨Î»±íÐÞ¸´ÈÃÈËÍ·Í´£¬Å¼È»·¢ÏÖÁËReloXÐÞ¸´Öض¨Î»±íµÄ¹¤¾ß£¬ÊÔÑéÁ˼¸´Î¾ÓÈ»³É¹¦ÁË£¬ËùÒÔд¸ö¼òµ¥µÄ¹ý³Ì¼ÓÒÔÍÆ¹ãÕâ¸ö¹¤¾ß¡£ÓÉÓڱȽÏæ£¬ËùÒÔÖ»²âÊÔÁËNeoliteºÍUPX¼Ó¿ÇDLLµÄÖØ¶¨Î»±íÐÞ¸´£¬ÆäËü¿Ç´ó¼ÒÔÙ¶à²âÊÔ°É¡£
EdrLib.dllÊÇNeolite V2.0×î´ó±ÈÀýѹËõ£¬¼ÓÃÜÁËÖØ¶¨Î»±í£¬ÎÞ·¨×Ô¶¯Íѿǡ£
¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª
Ò»¡¢Entry Point
NeoliteÊÇѹËõ¿Ç£¬OEP·Ç³£ÈÝÒ××ßµ½¡£
003D710F E9 A6000000 jmp EdrLib.003D71BA
//½øÈëOllydbgºóÔÝÍ£ÔÚÕâ
003D71BA 8B4424 04 mov eax,dword ptr ss:[esp+4]
003D71BE 2305 20713D00 and eax,dword ptr ds:[3D7120]
003D71C4 E8 ED040000 call EdrLib.003D76B6
003D71C9 FE05 B9713D00 inc byte ptr ds:[3D71B9]
003D71CF FFE0 jmp eax
//ÕâÀï¾ÍÊÇÌøÏòOEPµÄµØ·½£¡:-) ÔÚÕâÀï¡°Âñ·ü¡±¸ö¶Ïµã£¬¿ªÊ¼µÚ¶þ²½²Ù×÷
¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª
¶þ¡¢Êʵ±µÄDumpʱ»ú£º¸ã¶¨ÊäÈë±í
϶ϣºBP VirtualProtect
ÖжϺóÈ¡Ïû¶Ïµã£¬Alt+F9·µ»Ø
003D7B22 FF55 7A call dword ptr ss:[ebp+7A]; kernel32.VirtualProtect
003D7B25 FF75 66 push dword ptr ss:[ebp+66]
003D7B28 8D55 A2 lea edx,dword ptr ss:[ebp-5E]
003D7B2B 8D85 5EFDFFFF lea eax,dword ptr ss:[ebp-2A2]
003D7B31 FF75 5A push dword ptr ss:[ebp+5A]
003D7B34 8B4F 0C mov ecx,dword ptr ds:[edi+C]
003D7B37 E8 B4030000 call EdrLib.003D7EF0
//Çø¶Î½âѹ
003D7B3C 8B55 0A mov edx,dword ptr ss:[ebp+A]
003D7B3F 8B47 04 mov eax,dword ptr ds:[edi+4]
003D7B42 8B52 24 mov edx,dword ptr ds:[edx+24]
003D7B45 25 00000080 and eax,80000000
003D7B4A 81E2 00000080 and edx,80000000
003D7B50 39D0 cmp eax,edx
003D7B52 0F84 60FFFFFF je EdrLib.003D7AB8
003D7B58 F647 04 20 test byte ptr ds:[edi+4],20
003D7B5C 0F84 4FFFFFFF je EdrLib.003D7AB1
003D7B62 C745 AA 20000000 mov dword ptr ss:[ebp-56],20
003D7B69 E9 4AFFFFFF jmp EdrLib.003D7AB8
//Ñ»·
003D7B6E 837E 24 00 cmp dword ptr ds:[esi+24],0
//F4µ½ÕâÀï [esi+24]£½[003E4024]=0000442C ÊäÈë±íµÄRVA£¡ ¡ï
003D7B72 0F84 1D010000 je EdrLib.003D7C95
ÏÖÔÚ³ÌÐò´úÂëÒѾ½â¿ª£¬APIº¯ÊýµÄϵͳµØÖ·»¹Ã»ÓÐÌî³ä½øIAT£¬Ò²Ã»ÓÐÖØ¶¨Î»£¬»¹µÈʲô£¿ÔËÐÐLordPEÍêÈ«Dump³öÕâ¸ödll¡£
¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª
Èý¡¢·ÉÏò¹âÃ÷Ö®áÛ
DumpÍê±ÏÖ®ºóÖ±½ÓF9ÔËÐУ¬ÖжÏÔÚÎÒÃÇÊ×ÏÈ¡°Âñ·ü¡±µÄ¶Ïµã´¦¡£
003D71CF FFE0 jmp eax ; EdrLib.003D11C9
//·ÉÏò¹âÃ÷Ö®áÛ£¡:-)
003D11C9 55 push ebp
//OEP
003D11CA 8BEC mov ebp,esp
003D11CC 53 push ebx
003D11CD 8B5D 08 mov ebx,dword ptr ss:[ebp+8]
¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª
ËÄ¡¢PEÐÞÕý
ÓÃLordPEÐÞÕýdumped.dllµÄOEP RVA=000011C9£¬Import Table RVA=0000442C£¬IAT RVA¿ÉÒÔÇåÁã¡£
ɾ³ýOreloc¡¢.neolit¡¢.relocÈý¸öÇø¶Î£¬ÓÃWinHexÒÆ³ý00006000ÖÁĩβµÄ¿ÇÊý¾Ý¡£
Êä³ö±íûÓмÓÃÜ£¬¿ÉÒÔÓÃLordPEÀ´²ì¿´¡£RVA=000070A2 Size=6D
WinHex´ò¿ªEdrLib.dll£¬°ÑÆ«ÒÆ0X10A2´¦µÄ06D×Ö½Ú¸´ÖƳöÀ´£»ÔÚdumped.dllÖÐÕÒÒ»µã¿ÕµØ£¬°ÑÆäŲÖÁ4900´¦°É
ÐÞÕýdumped.dllµÄExport Table RVA=00004900£¬SizeÒ»Ñù¡£
µ±È»ÒªÐÞÕýÏà¹ØÊý¾ÝÁË£º
->Export Table
Characteristics: 0x00000000
TimeDateStamp: 0x3DC70847 (GMT: Mon Nov 04 23:52:39 2002)
MajorVersion: 0x0000
MinorVersion: 0x0000 -> 0.00
Name: 0x000070DE ("EdrLib.dll") ==>ÐÞ¸ÄΪ£º0x0000493C
Base: 0x00000001
NumberOfFunctions: 0x00000002
NumberOfNames: 0x00000002
AddressOfFunctions: 0x000070CA ==>ÐÞ¸ÄΪ£º0x00004928
AddressOfNames: 0x000070D2 ==>ÐÞ¸ÄΪ£º0x00004930
AddressOfNameOrdinals: 0x000070DA ==>ÐÞ¸ÄΪ£º0x00004938
Ordinal RVA Symbol Name
------- ---------- ----------------------------------
0x0001 0x00001010 "_EdrCenterTextA@12"
0x0002 0x00001080 "_EdrCenterTextW@12""
¿ÉÒÔÖ±½ÓÓÃWinHexÐ޸ģº
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F //ÔÀ´µÄÊä³ö±í
000010A0 00 00 00 00 47 08 C7 3D 00 00 00 00 DE 70 ....G.?....Þp
000010B0 00 00 01 00 00 00 02 00 00 00 02 00 00 00 CA 70 ..............Êp
000010C0 00 00 D2 70 00 00 DA 70 00 00 10 10 00 00 80 10 ..Òp..Úp......€.
000010D0 00 00 E9 70 00 00 FC 70 00 00 00 00 01 00 45 64 ..ép..üp......Ed
000010E0 72 4C 69 62 2E 64 6C 6C 00 5F 45 64 72 43 65 6E rLib.dll._EdrCen
000010F0 74 65 72 54 65 78 74 41 40 31 32 00 5F 45 64 72 terTextA@12._Edr
00001100 43 65 6E 74 65 72 54 65 78 74 57 40 31 32 00 CenterTextW@12.
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F //Ð޸ĵÄÊä³ö±í
00004900 00 00 00 00 47 08 C7 3D 00 00 00 00 3C 49 00 00 ....G.?....<I..
00004910 01 00 00 00 02 00 00 00 02 00 00 00 28 49 00 00 ............(I..
00004920 30 49 00 00 38 49 00 00 10 10 00 00 80 10 00 00 0I..8I......€...
00004930 47 49 00 00 5A 49 00 00 00 00 01 00 45 64 72 4C GI..ZI......EdrL
00004940 69 62 2E 64 6C 6C 00 5F 45 64 72 43 65 6E 74 65 ib.dll._EdrCente
00004950 72 54 65 78 74 41 40 31 32 00 5F 45 64 72 43 65 rTextA@12._EdrCe
00004960 6E 74 65 72 54 65 78 74 57 40 31 32 00 nterTextW@12.
Ö»±£ÁôLordPEµÄ¡°Validate PE¡±Ñ¡Ï¶Ôdumped.dllÖØ½¨PE¡£
¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª
Îå¡¢ReloX£ºÐÞ¸´Öض¨Î»±íµÄ¡°Í¨Óá±¼ò±ã·½·¨
ReloX V1.0µÄ×÷ÕßÊÇÅ£ÈËMackT/uCF2000£¬¼´Import REConstructorµÄ×÷Õß¡£
ReloX¿ÉÒÔͨ¹ý±È½Ï²»Í¬»ùÖ·µÄDumpÎļþ,È·¶¨Öض¨Î»±í¡£
¸ÐлºÃÓÑWiNroot£¬ÌصØÐ´Á˸öDLL_LoadEX¡£Óÿ´Ñ©ÀÏ´óµÄDLL_LoaderÒ²¿ÉÒÔ¡£
°ÑEdrLib.dll¸´ÖÆÒ»·Ý£¬È»ºóÓÃDLL_LoadEXÔØÈëEdrLib.dllºÍ¸´ÖÆEdrLib.dll£¬×¢ÒâÁ½¸ö½ø³ÌµÄ»ùÖ·¡£
ÓÃLordPEÖ±½Ó°ÑÕâ2¸öDLL½ø³ÌDump³öÀ´£¬Áí´æÎª1.dll£¨ImageBase=01040000£©ºÍ2.dll£¨ImageBase=01060000£©
ΪÁ˼õСÌå»ý£¬É¾³ý1.dllºÍ2.dllµÄOreloc¡¢.neolit¡¢.relocÈý¸öÇø¶Î£¬ÓÃWinHexÒÆ³ý00006000ÖÁĩβµÄÊý¾Ý
ÔËÐÐReloX£¬Ñ¡Ôñ1.dllºÍ2.dll£¬·Ö±ðÌîÈëÆäÏàÓ¦µÄ»ùÖ·£¬µãComPare£¬ÉԵȣ¬·ÖÎöÍê±Ï¡£
Fix PE Module,Ìáʾdumped_.dll±£´æ³É¹¦¡£ReloXÒѾ×Ô¶¯ÐÞÕýÁËRelocation RVAºÍSize£¡
¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª
Áù¡¢Î²Éù
ÏÖÔÚÍѿǺóµÄDLLÒѾ¿ÉÒÔÔËÐÐÁË¡£µ«ÊÇÓÃOllydbgÔØÈëʱ»áµ¯³ö¡°Module EdrLib has empty code section¡±µÄÌáʾ£¬¸Ðл³¬ÈËheXer£¬Ö¸½ÌÊÇBaseOfCodeµÄÔµ¹Ê£¬00007000ÒѾ±»É¾µôÁË£¬ËùÒÔÌáʾ´íÎ󡣿ÉÒÔ°ÑBaseOfCodeÐÞÕýΪ00001000£¬ÕâÑù¾Í²»»áÌáʾÁË¡£Èç¹ûÏë×öµÄÍêÃÀµã£¬»¹¿ÉÒÔ°ÑBaseOfData¡¢SizeOfCodeµÈÐÞÕý¡£
¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª
, _/
/| _.-~/ \_ , Çà´º¶¼Ò»ÉÎ
( /~ / \~-._ |\
`\\ _/ \ ~\ ) Ḛ̀Ѹ¡Ãû
_-~~~-.) )__/;;,. \_ //'
/'_,\ --~ \ ~~~- ,;;\___( (.-~~~-. »»ÁËÆÆ½âÇá¿ñ
`~ _( ,_..--\ ( ,;'' / ~-- /._`\
/~~//' /' `~\ ) /--.._, )_ `~
" `~" " `" /~'`\ `\\~~\
" " "~' ""
UnPacked By : fly
2004-12-22 18:00