µÚ2ƪ Obsidium 1.3.0.4ѧϰÊÖ¼Ç
Ç°ÃæÄÇÆªÎÄÕ£¬ÊµÀý³ÌÐòÊÇÃ»ÖØ¶¨Î»±íµÄ£¬Òò´ËObsidium¶ÔÍâ¿ÇûÓÐÖØ¶¨Î»¡£½«ÊµÀý³ÌÐòTraceMe.exeÖØÐ±àÒëһϣ¬¼ÓÉÏÖØ¶¨Î»±í£¬ÔÙÓÃ
Obsidium 1.304¼Ó¿Ç±£»¤¡££¨ÓÉÓÚÖØÐ±àÒë¹ýÁË£¬Òò´ËÕâ¸öʵÀýÓëÉÏÆªÊÇ2¸ö²»Í¬µÄ³ÌÐò£¬ÇëÎð²ÎÕÕÉÏÆªµÄ¶øÎóµ¼£©¡£
¼Ó¿Çʱ£¬½«Ò»Ð©³£Óõı£»¤¶¼Ñ¡ÉÏÁË£¬ÕâÆª½ÌѧûÓÐSDK²¿·Ö£¬ÓйØSDKµÄ´¦Àí£¬Çë²Î¿¼heXerµÄ±Ê¼Ç£ºObsidium1.2.5.0Ö÷³ÌÐòÍѿǼǼµãµÎ
¸½¼þ:obsidium1.304ʵÀýÏÂÔØ
Ò».OD·´¸ú×Ù
ObsidiumÔÚ1.304¼ÓÉÏÁËÐí¶à·´¸ú×Ù´úÂ룬¿ÉÒÔÓÃÒþ²ØOD²å¼þHideOD¶ã¹ýÕâЩ·´¸ú×Ù¡£²å¼þÏÂÔØ£º
http://bbs.pediy.com/showthread.php?s=&threadid=19170
Ö»ÐèÒª½«HideNtDebgBit,CheckRemoteDebuggerPresent,Process32NextÈýÏî¹´Éϼ´¿ÉÒþ²ØOD¡£
³ýÁËÓòå¼þÒþ²ØÍ⣬»¹±ØÐ뽫ODÀà±êʶ¸Äµô£¬ÏÂÃæµÄºì×Ö£º
000B5FE0 CFC2 B5F7 CAD4 A1A3 0000 0000 004F 6C6C 7944 4247 .............OllyDBG
000B5FF4 0000 6F6C 6C79 6462 6700 2E69 6E69 0049 434F 5F41 ..ollydbg..ini.ICO_A
000B6008 4141 4D41 494E 004D 4149 4E4D 454E 5500 4F4C 4C59 AAMAIN.MAINMENU.OLLY
000B601C 4442 4700 CEDE B7A8 B4B4 BDA8 D6F7 D2AA B4B0 BFDA DBG .................
Õâ¶ÎÊÇObsidium 1.3.0.4ÀûÓÃCheckRemoteDebuggerPresent¼ì²âµ÷ÊÔÆ÷´úÂ룬ÊÇgoldeneggÒÔǰÕûÀíµÄ¡£
ÒýÓÃ:
½âÂëʱ»áÓг¤³¤µÄÒ»ÁгýÁã´íÎó¡£´óÔ¼ÓÐÁ½°Ù¶à¸ö³ý0¡£
ÔËÐкó»áÆô¶¯Ò»¸öỊ̈߳¬Î±´úÂëÊÇÕâÑù×ӵģº
while(1)
{
Sleep(500);
if(CheckRemoteDebuggerPresent()) ExitProcess();
if(IsDebugPresent()) ExitProcess();
DebugBreak(); //Ò쳣ʱÖÐseh×Ô¶¯°ÑeipÖ¸ÏòÑ»·¿ªÊ¼¡£
ExitProcess();
}
µ±È»£¬ÕâЩAPI¶¼ÊÇÒÔ¼ÓÃÜÐÎʽÔËÐеġ£
ÕâÑùÔËÐÐÆðÀ´ºó,odµÄlogÖоͿÉÒÔ¿´µ½³¤³¤µÄÒ»´óÁÐint3ÖжÏÔÚntdll.DebugBreak,ÇÒÒ»Ö±²»Í£µÄÔö¶àÏÂÈ¥¡£
ÉÏÃæËµµÄ¡°API¶¼ÊÇÒÔ¼ÓÃÜÐÎʽÔËÐеġ±ÊÇÔõô»ØÊÂÄØ£¿
Èç¹ûÓÃPE±à¼¹¤¾ß²é¿´¼Ó¿ÇºóµÄÎļþ£¬»á·¢ÏÖδ¼Ó¿ÇµÄÎļþºÍ¼Ó¿ÇºóµÄÎļþµÄÊäÈë±í²»Ò»Ñù£¬¼Ó¿ÇºóµÄÊäÈë±íÒ»°ãËùÒýÈëµÄDLLºÍAPIº¯ÊýºÜ
ÉÙ£¬ÉõÖÁÖ»ÓÐKernel32.dllÒÔ¼°GetProcAddressÕâ¸öAPIº¯Êý£¬ÓÐЩÁ¬Õâ¸öº¯Êý¶¼Ã»ÓС£¿Çʵ¼ÊÉÏ»¹ÐèÒªÆäËûµÄAPIº¯ÊýÀ´Íê³ÉËüµÄ¹¤×÷£¬ÎªÁË
Òþ²ØÕâЩAPI£¬ËüÒ»°ãÖ»ÔڿǵĴúÂëÖÐÓÃÏÔʽÁ´½Ó·½Ê½¶¯Ì¬¼ÓÔØÕâЩAPIº¯Êý¡£
Ò»°ãµÄ¿ÇÊÇͨ¹ýLoadLibrary¼ÓÔØDLL£¬GetProcAddress¼ÓÔØº¯ÊýµÄ£º
HMODULE GetModuleHandle(
LPCTSTR lpModuleName // DLLÎļþÃûµØÖ·
);
FARPROC GetProcAddress(
HMODULE hModule, // DLLÄ£¿é¾ä±ú
LPCSTR lpProcName // º¯ÊýÃû
);
Èç¹ûÍâ¿ÇÊäÈë±íÀïûÓÐLoadLibrary£¬¿ÉÄÜÊÇͨ¹ý±©Á¦ËÑË÷»ñµÃKernel32.dll»ùÖ·µÄ£¬Ïà¹ØÎÄÕÂÇë²Î¿¼¿´Ñ©ÂÛ̳¾«»ª¼¯¡£Íâ¿Çµ÷Óú¯Êý£¬
Ò»°ãÊÇͨ¹ýGetProcAddressº¯ÊýʵÏֵģ¬Òò´Ë¶ÔÕâÉè¶ÏÄܺܿìÕÒµ½¸ÐÐËȤµÄ¶«Î÷¡£µ«ÏÖÔڵļÓÃÜ¿ÇΪÁ˸üºÃÁËÒþ²Ø×Ô¼º²Ù×÷£¬¼º²»µ÷ÓÃϵ
ͳÌṩµÄGetProcAddressº¯ÊýʵÏÖÁË£¬¶øÊÇ×Ô¼º×¨ÃÅдһ¶Î´úÂëÀ´ÊµÏÖGetProcAddress¹¦ÄÜ¡£Obsidium 1.3.0.4¾ÍÊÇÕâÇé¿ö¡£ÎªÁËÈôó¼Ò
¸üºÃµÄÀí½â£¬ÎÒÃÇÏÈÀ´Ñ°ÕÒObsidium×Ô¼ºµÄGetProcAddressº¯Êý¡£ÓÃVirtualAllocÀ´×öΪÈëµã£¬ÒòΪÍâ¿Ç¶¼ÓÃÕ⺯Êý·ÖÅäÁÙʱ¿Õ¼ä·Å´úÂ룬
Òò´ËÓÃµÄ±È½ÏÆµ·±¡£
¼Çס£¬²»Òª½«¶ÏµãÉèÔÚVirtualAllocµÚÒ»×Ö½Ú£¬ÒòΪÍâ¿Ç³ÌÐò»á¼ì²âµÚÒ»×Ö½ÚÊÇ·ñÓжϵãµÄ£¬ÎÒÒ»°ãϲ»¶½«¶ÏµãÉèÔÚº¯Êýβ²¿¡£°´Ctrl£«G
Ìøµ½VirtualAlloc£º
7C809A81 k> 8BFF mov edi,edi
7C809A83 55 push ebp
7C809A84 8BEC mov ebp,esp
7C809A86 FF75 14 push dword ptr ss:[ebp+14]
7C809A89 FF75 10 push dword ptr ss:[ebp+10]
7C809A8C FF75 0C push dword ptr ss:[ebp+C]
7C809A8F FF75 08 push dword ptr ss:[ebp+8]
7C809A92 6A FF push -1
7C809A94 E8 09000000 call kernel32.VirtualAllocEx
7C809A99 5D pop ebp
7C809A9A C2 1000 retn 10 //ÔÚÕâ°´F2Éè¸ö¶Ïµã
ÉèÖÃÄÚ´æ·ÃÎÊÒì³££¬2´Îºó»áµ÷ÓÃVirtualAllocº¯Êý¡£·µ»Øµ½ÈçÏ´úÂ룬ȡÏû»¨Ö¸Áî¸ÉÈź󣬵õ½µÄ¸É¾»´úÂëÈçÏ£º
00403688 6A 00 push 0
0040368A 6A 56 push 56
0040368C 6A 00 push 0
0040368E 68 4A0DCE09 push 9CE0D4A
00403693 FFB6 98000000 push dword ptr [esi+98]
00403699 FF56 54 call [esi+54]
0040369C 90 nop
0040369D 90 nop
0040369E 90 nop
0040369F 90 nop
004036A0 8B55 0C mov edx, [ebp+C]
004036A3 90 nop
004036A4 90 nop
004036A5 90 nop
004036A6 90 nop
004036A7 81C2 00040000 add edx, 400
004036AD 90 nop
004036AE 90 nop
004036AF 90 nop
004036B0 90 nop
004036B1 6A 40 push 40
004036B3 68 00300000 push 3000
004036B8 52 push edx
004036B9 6A 00 push 0
004036BB 50 push eax
004036BC FF96 84000000 call [esi+84] //ÕâÀïµ÷ÓÃVirtualAlloc£¬ÎÒÃÇ´ÓÕâÀïCALL·µ»Ø
ÏòÉÏ¿´£¬¹À¼Æ00403699¾ÍÊÇObsidium×Ô¼ºÊµÏÖµÄGetProcAddress´úÂë¡£
ÖØÐ¼ÓÔØ³ÌÐò£¬Í¨¹ý2¸öÄÚ´æÒì³£ºó£¬bp 00403688 Éè¶Ï£¬»áÖжϣº
00403688 6A 00 push 0
0040368A 6A 56 push 56
0040368C 6A 00 push 0
0040368E 68 4A0DCE09 push 9CE0D4A
00403693 FFB6 98000000 push dword ptr [esi+98]
00403699 FF56 54 call [esi+54]
È¡Ïû¶Ïµã£¬°´F7½øÈë00403699 Õâ¸öCALL£º
0040AC80 55 push ebp
0040AC81 8BEC mov ebp, esp
0040AC83 81EC 18010000 sub esp, 118
¡¡
0040ADA9 8B0483 mov eax, [ebx+eax*4]
0040ADAC 03C1 add eax, ecx
0040ADAE EB 57 jmp short 0040AE07
¡¡
0040AE88 5F pop edi
0040AE89 5E pop esi
0040AE8A 5B pop ebx
0040AE8B 8BE5 mov esp, ebp
0040AE8D 5D pop ebp
0040AE8E C2 1400 retn 14 //º¯ÊýµØÖ·Í¨¹ýEAX·µ»Ø
ÉÏÃæÕâ¶Î´úÂë¾ÍÊÇObsidium×Ô¼ºÊµÏÖµÄGetProcAddress´úÂ룬Õû¸öÍâ¿Ç³ÌÐòµ÷ÓõÄAPiº¯Êý¼¸ºõ¶¼ÊÇͨ¹ýÕâ¸öº¯ÊýµÃµ½¡£
¿ÉÒÔ½«¶ÏµãÉèÔÚ0040AE8EÕâÒ»ÐУ¬Ö±½ÓÔËÐÐÍâ¿Ç³ÌÐò£¬¹Û²ìEAXÖ¸ÏòµÄ×Ö·û´®£¬ÕâЩ¾ÍÊÇÍâ¿Ç½«Òªµ÷ÓõÄAPIº¯Êý¡£
¶þ.ѰÕÒOEP
ÉèÖÃÄÚ´æ·ÃÎÊÒì³££¬¼ÓÔØ³ÌÐò´ÓÍ·¸ú×Ù£º
µÚ1´ÎÒì³££º00403055 8B00 mov eax, [eax]
µÚ11´ÎÒì³£ 00404D73 8B00 mov eax, [eax]
ΪÁËÄÜÉÙ¸ú×ÙЩ´úÂ룬ÎÒÃǾ¡Á¿ÕÒµ½ÀëOEP×î½üµÄÒì³££¬ÔÙÉèÖÃÕû³ýÒì³££¬Ò»´ÎºóÀ´µ½£º
£¨ÒòΪÁ½´ÎÕû³ýÒì³£ºó³ÌÐò½çÃæ¼º³öÀ´£¬Òò´ËÒ»´Î¾ÍÐÐÁË£¬´ËʱÔÙ½«Õû³ýÒ쳣ȡÏû£©
00405354 F7F2 div edx //Õû³ý³ýÒì³£
²é¿´¶ÑÕ»´°¿Ú£º
0012FF88 0012FFE0
0012FF8C 00405391 //×¢ÒâÕâÀï
ÔÚÃüÁîÐÐÉè¶Ï£ºbp 00405391
°´Shift£«F9Ìø¹ýÒì³£À´µ½£º
00405391 55 push ebp
00405392 8BEC mov ebp, esp
00405394 90 nop
00405395 90 nop
00405396 90 nop
00405397 90 nop
00405398 8B4D 08 mov ecx, [ebp+8]
0040539B 90 nop
0040539C 90 nop
0040539D 90 nop
0040539E 90 nop
0040539F 8B01 mov eax, [ecx]
004053A1 90 nop
004053A2 90 nop
004053A3 90 nop
004053A4 90 nop
004053A5 90 nop
004053A6 90 nop
004053A7 90 nop
004053A8 90 nop
¡¡¡¡¡¡
00405431 8D940A EFAB0CFF lea edx, [edx+ecx+FF0CABEF]
00405438 90 nop
00405439 90 nop
0040543A 90 nop
0040543B 90 nop
0040543C 90 nop
0040543D 90 nop
0040543E 8990 B8000000 mov [eax+B8], edx //¼ÇÏÂEDXÖµ£¬Éè¶Ï¸ú½ø
0040543EÕâ¾äÖУ¬EDXÖоÍÊÇ CONTEXT.EIPµÄÖµ£¬¼ÇEDXµÄÖµ00405563£¬¶ÔÆäÉè¶Ï£¬À´µ½£º
00405563 E8 CB000000 call 00405633 ; ÕâÊÇÒ»¸ö¼ÓÃÜCALL£¬°´F7½øÈ¥
{
¡¡¡¡
00405692 8BEC mov ebp, esp
00405694 49 dec ecx
00405695 C061 F9 72 shl byte ptr [ecx-7], 72
00405699 0224FE add ah, [esi+edi*8]
0040569C C3 retn //°´F4,×ß³öÕâ¶ÎÑ»·´úÂë
}
×ß³öÉÏÃæµÄ´úÂë£¬ÖØÐÂÀ´µ½00405563Õâ¸öµØÖ·´¦£¬´úÂ뼺±»SMC´¦Àí³ÉÒ»¸öÌø×ª£º
00405563 /EB 04 jmp short 00405569 //ËùÒÔ¿ªÊ¼ÕâÒ²¿É°´Ò»ÏÂF4¼´¿É
¡¡¡¡¡¡ £¨°´F8µ¥²½×ߣ¬Õâ¶ÎÓл¨Ö¸Áî,²»ÒªÈ¥³ý£¬»áÓÐ×Ô¼ìÑ飩
00405612 FFE7 jmp edi //À´µ½´Ë´¦£¬¸ú½ø
À´µ½£º
008FB40D E8 00000000 call 008FB412
008FB412 EB 01 jmp short 008FB415
008FB414 2F das
008FB415 5D pop ebp
008FB416 EB 03 jmp short 008FB41B
¡¡¡¡
//1.304¼ºÃ»Óн«Stole code·ÅÔÚÕâÀï
008FB480 - E9 4A5FAFFF jmp 009513CF//À´µ½ÕâÀï£¬Ìøµ½Î±OEP
{
009513CF 64:A1 00000000 mov eax, fs:[0]//αOEP
009513D5 50 push eax
009513D6 64:8925 0000000>mov fs:[0], esp
009513DD 83EC 58 sub esp, 58
009513E0 53 push ebx
009513E1 56 push esi
009513E2 57 push edi
009513E3 8965 E8 mov dword ptr ss:[ebp-18],esp
009513E6 FF15 44503F00 call dword ptr ds:[955044]
}
µ½OEPºó£¬´ËʱµÄ»ùÖ·¼º²»ÊǼӿÇǰµÄ00400000£¬Obsidium¼º½«³ÌÐò´úÂëÖØ¶¨Î»ÁË£¬ÕâÀïµÄ³ÌÐò»ùÖ·ÊÇ950000£¬²»Í¬µÄϵͳ´ËÖµ²»Í¬£¬Õâ
¸öÖµÊÇObsidiumÍâ¿Çµ÷ÓÃVirtualAllocº¯Êý·ÖÅäµÄÒ»¿Õ¼ä¡£µ«Í¬Ò»ÏµÍ³£¬Öظ´ÔËÐÐʵÀý³ÌÐò£¬Æä»ùÖ·¶¼ÊÇÏàͬµÄ¡£Õâ¾Í¸øÎÒÃǸú×Ùµ÷ÊÔ´øÀ´
·½±ãÁË¡£
Í£µ½009513CFαOEPºó£¬²é¿´¶ÑÕ»£º
0012FFB4 0095208C
0012FFB8 009550D8
0012FFBC FFFFFFFF
´ËʱֻҪ¸ù¾ÝVC6ÎļþµÄÍ·²¿ÌØÕ÷¾Í¿É»¹Ô³ö±»³éÈ¡µÄ´úÂ룺
push ebp
mov ebp, esp
push -1
push 009550D8
push 0095208C
½ÓÏÂÀ´·ÖÎöIATµÄλÖã¬Õâ¾ä"009513E6 call dword ptr ds:[955044] "¾ÍÊǵ÷ÓÃϵͳµÄij¸öAPI£¬ÔÚÊý¾Ý´°¿ÚÏÂÃüÁ
d 955044
00954FF4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B6 00 ..............?
00955004 0C 00 B6 00 18 00 B6 00 24 00 B6 00 30 00 B6 00 ..?.?$.?0.?
00955014 3C 00 B6 00 48 00 B6 00 54 00 B6 00 60 00 B6 00 <.?H.?T.?`.?
00955024 6C 00 B6 00 78 00 B6 00 84 00 B6 00 90 00 B6 00 l.?x.?????
00955034 9C 00 B6 00 A8 00 B6 00 B4 00 B6 00 18 02 B6 00 ???????
00955044 22 02 B6 00 D8 00 B6 00 E4 00 B6 00 2C 02 B6 00 "?????,?
00955054 FC 00 B6 00 08 01 B6 00 14 01 B6 00 20 01 B6 00 ???? ?
00955064 2C 01 B6 00 38 01 B6 00 44 01 B6 00 50 01 B6 00 ,?8?D?P?
00955074 5C 01 B6 00 68 01 B6 00 74 01 B6 00 80 01 B6 00 \?h?t?€?
00955084 8C 01 B6 00 98 01 B6 00 A4 01 B6 00 B0 01 B6 00 ????????
00955094 BC 01 B6 00 C8 01 B6 00 D4 01 B6 00 E0 01 B6 00 ????????
009550A4 36 02 B6 00 42 02 B6 00 4E 02 B6 00 5A 02 B6 00 6?B?N?Z?
009550B4 66 02 B6 00 72 02 B6 00 7E 02 B6 00 8A 02 B6 00 f?r?~???
009550C4 96 02 B6 00 A2 02 B6 00 AE 02 B6 00 BA 02 B6 00 ????????
009550D4 C6 02 B6 00 FF FF FF FF 97 14 95 00 AB 14 95 00 ??ÿÿÿÿ??.??.
³õ²½²Â²âIATµÄ·¶Î§¾ÍÔÚ955000¡«9550D8Õâ¸ö·¶Î§¡£
ÐÞ¸´OEPºó£¬Õâʱ¿ÉÒÔDumpÈ¡Îļþ£¬È»ºóÖØ½¨ÊäÈë±íºó¼´¿ÉÍÑ¿ÇÍê±Ï£¬ÓÉÓÚÊÇÔÚ»ùַΪ955000Õâ¸ö»ùÖ·DumpÈ¡µÄ£¬ÍѿǺóµÄÎļþ»ùÖ·Ò²µÃΪÕâ¸öÖµ¡£Òò´Ë×ܸоõ²»ÍêÃÀ£¬³ÌÐòÔÀ´»ùÖ·ÊÇ400000Õâ¸öÖµ£¬ÎÒÃÇ¿ÉÒÔ¶ÔÍâ¿Ç¶¯µãÊֽţ¬ÈÃÆä´úÂë²»ÖØ¶¨Î»£¬ÕâÑù¾Í¿ÉµÃµ½»ùÖ·ÊÇ400000µÄÎļþ£¬ÏÂÃæÎÒÃǾÍÀ´Ìø¹ýÍâ¿ÇµÄÖØ¶¨Î»¡£
Èý.ѰÕÒStole code
ÓÉÓÚÉÏÒ»²½¼º¹¹ÔìºÃOEP´¦µÄ´úÂëÁË£¬ÕâÒ»²½¿ÉÒÔÊ¡ÂÔ£¬µ«ÎªÁ˽ÌѧÍêÕûÐÔ£¬ÔÚÕ⽫Obsidium 1.304´¦ÀíStole codeµÄ¹ý³ÌÁгö¡£
Ç°ÃæËµ¹ý£¬µ½´ïαOEPʱ£¬¶ÑÕ»´úÂ룺
0012FFB4 0095208C
0012FFB8 009550D8
0012FFBC FFFFFFFF
¶¨Î»´¦ÀíStole code·½·¨¾ÍÊǸù¾ÝÍâ¿Ç³ÌÐòÊǺÎʱÉú³ÉÕâÈý¸ö¶ÑÕ»Êý¾Ý¶ø¸ú×ٵġ£¾¹ý¸ú×Ù£¬ÊÇÔÚµÚ10´ÎÒì³£ºó¿ªÊ¼´¦ÀíStole code´úÂëµÄ¡£
ÉèÖÃÄÚ´æ·ÃÎÊÒì³££¬ÖØÐ¼ÓÔØ³ÌÐò£¬10´ÎÄÚ´æ·ÃÎÊÒì³££º
008F6F91 8B02 mov eax, [edx] //µÚ10´ÎÒì³£Öжϴ˴¦
²é¿´¶ÑÕ»Êý¾Ý£º
0012FE40 0012FE60 Ö¸Õëµ½ÏÂÒ»¸ö SEH ¼Ç¼
0012FE44 008F7034 SE ¾ä±ú //Òì³£ºó½«Ìøµ½008F7034µØÖ·´¦
Òò´Ë£¬Ìøµ½008F7034µØÖ·£¬°´F2Éè¶Ï£¬ÔÙ°´Shift F9ÔËÐгÌÐò£¬ÖжÏÕâÀ£¨ÏÂÃæ´úÂ뻨ָÁȡÏû£©
008F7034 55 push ebp
008F7035 8BEC mov ebp, esp
008F7037 90 nop
008F7038 90 nop
008F7039 90 nop
008F703A 90 nop
008F703B 90 nop
008F703C 90 nop
008F703D E8 00000000 call 008F7042
008F7042 90 nop
008F7043 90 nop
008F7044 90 nop
008F7045 90 nop
008F7046 58 pop eax
008F7047 90 nop
008F7048 90 nop
008F7049 90 nop
008F704A 90 nop
008F704B 8B55 10 mov edx, [ebp+10]
008F704E 90 nop
008F704F 90 nop
008F7050 90 nop
008F7051 90 nop
008F7052 90 nop
008F7053 8D40 87 lea eax, [eax-79]
008F7056 90 nop
008F7057 90 nop
008F7058 90 nop
008F7059 8982 B8000000 mov [edx+B8], eax//contex.eip¹Ø¼üµã,¶ÔEAXÉè¶Ï
ÔËÐе½008F7059Ò»ÐУ¬¶ÔEAXµØÖ·Éè¶Ï£¬ÖжϺóµ½ÕâÀ
008F6FC9 /EB 04 jmp short 008F6FCF
¡¡¡¡
008F6FE4 5B pop ebx
008F6FE5 5E pop esi
008F6FE6 8BE5 mov esp, ebp
008F6FE8 5D pop ebp
008F6FE9 C3 retn //´Ó×ßÕâ³öÕâ¸öCALL
À´µ½£º£¨ÒÔÏ´úÂ뻨ָÁȥ³ý£©
00404A7B 90 nop
00404A7C 90 nop
00404A7D 90 nop
00404A7E F747 0C 0400000>test dword ptr [edi+C], 4
00404A85 90 nop
00404A86 90 nop
00404A87 90 nop
00404A88 74 26 je short 00404AB0
00404A8A 90 nop
00404A8B 90 nop
¡¡¡¡
00404AE7 8D7C07 14 lea edi, [edi+eax+14]
00404AEB 90 nop
00404AEC 90 nop
00404AED 90 nop
00404AEE 90 nop
00404AEF 90 nop
00404AF0 ^ E9 75FBFFFF jmp 0040466A//¸ú½ø
À´µ½£º£¨ÒÔÏ´úÂ뻨ָÁȥ³ý£©
0040466A 90 nop
0040466B 90 nop
0040466C 90 nop
0040466D 90 nop
0040466E 90 nop
0040466F 90 nop
00404670 90 nop
00404671 90 nop
00404672 90 nop
00404673 90 nop
00404674 90 nop
00404675 90 nop
00404676 8B45 0C mov eax, [ebp+C]
00404679 90 nop
0040467A 90 nop
0040467B 90 nop
0040467C 90 nop
0040467D 90 nop
0040467E 90 nop
0040467F 8B80 A02AEE00 mov eax, [eax+EE2AA0]
¡¡¡¡
00404A6E /74 40 je short 00404AB0
00404A70 |90 nop
00404A71 |90 nop
00404A72 |90 nop
00404A73 |90 nop
00404A74 |90 nop
00404A75 |90 nop
00404A76 |90 nop
00404A77 |90 nop
00404A78 |FF55 FC call [ebp-4] ; ¹Ø¼ü£¬¸ú½ø
{
//Õâ¶Î´úÂë²»µÃ¸Ä¶¯£¬ÓÐ×ÔУÑ飬°´F8¸ú
008F6F28 E8 1F040000 call 008F734C
008F6F2D 6B99 161A9156 A>imul ebx, [ecx+56911A16], -5B
008F6F34 4F dec edi
¡¡
008F73DA ^\0F85 AAFFFFFF jnz 008F738A
008F73E0 EB 03 jmp short 008F73E5
008F73E2 5B pop ebx
008F73E3 216F 61 and [edi+61], ebp
008F73E6 C3 retn//Èç¹û¿´µ½ÕâÀ°´F4Éè¶Ï£¬¿ÉÀ´µ½ÕâÀï
}
008F73E6·µ»Øºó£¬À´µ½£º£¨ÒÔÏ´úÂ뻨ָÁȥ³ý£©
008F6F28 90 nop
008F6F29 90 nop
008F6F2A 90 nop
008F6F2B 90 nop
008F6F2C 90 nop
008F6F2D E8 00000000 call 008F6F32
008F6F32 90 nop
008F6F33 90 nop
008F6F34 90 nop
008F6F35 90 nop
008F6F36 90 nop
¡¡¡¡¡¡
008F701B 61 popad
008F701C 90 nop
008F701D 90 nop
008F701E 90 nop
008F701F 9D popfd
008F7020 90 nop
008F7021 90 nop
008F7022 90 nop
008F7023 90 nop
008F7024 90 nop
008F7025 90 nop
008F7026 90 nop
008F7027 90 nop
008F7028 90 nop
008F7029 90 nop
008F702A 55 push ebp //stolen codeµÚÒ»¾ä
008F702B 90 nop
008F702C 90 nop
008F702D 90 nop
008F702E 90 nop
008F702F 90 nop
008F7030 90 nop
008F7031 8BEC mov ebp, esp //stolen codeµÚ¶þ ¾ä
008F7033 90 nop
008F7034 90 nop
008F7035 90 nop
008F7036 90 nop
008F7037 6A FF push -1 //stolen codeµÚÈý¾ä
008F7039 90 nop
008F703A 90 nop
008F703B 90 nop
008F703C 90 nop
008F703D 68 D8503F00 push 9550D8 //stolen codeµÚËľä
008F7042 90 nop
008F7043 90 nop
008F7044 90 nop
008F7045 68 8C203F00 push 95208C //stolen codeµÚÎå¾ä
008F704A 90 nop
008F704B 90 nop
008F704C 90 nop
008F704D 90 nop
008F704E 90 nop
008F704F 9C pushfd
008F7050 60 pushad
ËÄ.Ìø¹ý»ùÖ·ÖØ¶¨Î»£¬ÐÞ¸´ÄÚ´æÓ³ÏñÎļþ
ÖØÐ¼ÓÔØ³ÌÐò£¬°´Ctrl£«GÌøµ½VirtualAlloc£º
7C809A81 ker> 8BFF mov edi,edi
7C809A83 55 push ebp
7C809A84 8BEC mov ebp,esp
7C809A86 FF75 14 push dword ptr ss:[ebp+14]
7C809A89 FF75 10 push dword ptr ss:[ebp+10]
7C809A8C FF75 0C push dword ptr ss:[ebp+C]
7C809A8F FF75 08 push dword ptr ss:[ebp+8]
7C809A92 6A FF push -1
7C809A94 E8 09000000 call kernel32.VirtualAllocEx
7C809A99 5D pop ebp
7C809A9A C2 1000 retn 10 //ÕâÀï°´F2Éè¶Ï
ͬһϵͳ¶à´ÎÔËÐÐʵÀý³ÌÐò£¬Íâ¿ÇÉêÇëµÄÓ³Ïñ¿Õ¼äµÄµØÖ·ÊÇÒ»ÑùµÄ£¬±ÊÕß»ú×Óµ±Ê±»ùÖ·ÊÇ£º9500000£¬ÉèºÃVirtualAlloc¶Ïµãºó£¬
ÔËÐгÌÐò£¬µ±µÚÈý´Îµ÷ÓÃVirtualAllocº¯Êýʱ£¬·µ»ØµÄÖµÊÇ9500000¡£
00404EEF FF93 84000000 call [ebx+84] //VirtualAlloc
00404EF5 90 nop ·µ»ØÕâÀeax=950000
00404EF6 90 nop
00404EF7 90 nop
00404EF8 90 nop
00404EF9 90 nop
00404EFA 90 nop
00404EFB 85C0 test eax, eax
00404EFD 90 nop
00404EFE 90 nop
00404EFF 90 nop
00404F00 90 nop
00404F01 90 nop
00404F02 90 nop
00404F03 0F84 B2030000 je 004052BB
ÏÂÃæ¿ªÊ¼½âÂë¹ý³Ì¡£
½âÂëºóÕâÀï´¦Àíreloc:
00405234 8B43 10 mov eax, [ebx+10] ; ÐÂimagebase
00405237 90 nop
00405238 90 nop
00405239 90 nop
0040523A 90 nop
0040523B 90 nop
0040523C 2B43 40 sub eax, [ebx+40] ; ÇóÓëÔÀ´µÄ»ùÖ·²îÖµ£¬ÒÔÖØ¶¨Î»Ïà¹Ø´úÂëÒª£¬¸Ä³É xor eax,eax
0040523F 90 nop
00405240 90 nop
00405241 90 nop
00405242 90 nop
00405243 FF77 08 push dword ptr [edi+8]
00405246 FF77 04 push dword ptr [edi+4]
00405249 FF73 7C push dword ptr [ebx+7C]
0040524C 50 push eax
0040524D FF73 10 push dword ptr [ebx+10]
00405250 FF53 74 call [ebx+74]
ΪÁËÍѿǺóʹbase¶¨Î»ÔÚ400000h,½«0040523CÕâ¾ä¸Ä³É£º
0040523C 33C0 xor eax,eax
½ÓÏÂÀ´¾Íµ½OEP´¦£¬ÐÞ¸´Stole codeÔÙDumpÈ¡³ÌÐò¡£
´ËʱȡÏûVirtualAlloc¶Ïµã£¬ÔÙ¾¹ý7´ÎÄÚ´æ·ÃÎÊÒì³££¬ÔÙµ¥²½¸ú×پͿɵ½Î±OEPÁË£º
009513CF 64:A1 00000000 mov eax,dword ptr fs:[0]
009513D5 50 push eax
009513D6 64:8925 00000000 mov dword ptr fs:[0],esp
009513DD 83EC 58 sub esp,58
009513E0 53 push ebx
009513E1 56 push esi
009513E2 57 push edi
009513E3 8965 E8 mov dword ptr ss:[ebp-18],esp
009513E6 FF15 44504000 call dword ptr ds:[405044]
´Ëʱ²é¿´ÉÏÃæµÄºì×Ö[405044]£¬¼º²»ÊÇ¿ªÊ¼µÄ[955044]ÁË£¬Íâ¿ÇûÓÐÔÙÖØ¶¨Î»Ïà¹Ø´úÂëÓëÊý¾Ý¡£
ÔÚÐÞ¸´¼üÈëOEP´úÂëǰ£¬ÏȰ´Alt£«M´ò¿ªÄÚ´æÓ³Éä´°¿Ú£¬ÕÒµ½»ùÖ·Õâ¸öµØÖ·£¨ÎÒµ±Ç°µÄ»ùÖ·950000£©£¬Í¬Ê±¼ÇÏÂÓ³ÏñµÄ´óС0xB000£¬µã»÷ÓÒ¼ü/ÉèÖÃȨÏÞ/ÍêÕûȨÏÞ£¬ÕâÑù²Ù×÷ºó£¬¾Í¿ÉÔÚODÀï¼üÈë´úÂëÁË¡£
ÔËÐÐLordPE£¬Ñ¡ÖÐʵÀý½ø³Ì£¬ÏÈÓà Dump Full¹¦ÄÜץȡӳÏñ£¬´æÎªdumpedfull.exe¡£±ðÍüÉèÖÃLordPEµÄOptions/Full dump:paste header from diskÕâÏ´Ó´ÅÅÌÎļþÀïÈ¡PEµÄ¸÷ÏîÐÅÏ¢¡£²»È»dumped.exeµÄ³ÌÐòһЩPEÍ·Êý¾ÝÊÇ´íÎóµÄ£¬ÀýÈçûͼ±êµÈ¡£
½ÓÏÂÀ´ÔÙץȡ950000Õâ¸ö»ùÖ·£¬´óСÊÇ0xB000µÄÓ³Ïñ£¬Õâ¸öÓ³Ïñ¾ÍÊdzÌÐòµÄ´úÂë¶Î¡¢Êý¾Ý¶Î¡£Í¬ÑùÓÃLordPE£¬ÔÚÓÒ¼üÑ¡Dump partial£¬½«Äã³ÌÐòOEP´¦µÄ»ùÖ·Ìî½ø£¬´óСÊÇ0xB000¡£±£´æÎªdumppartial.dmpÎļþ¡£
ÏÂÃæ¾ÍÀûÓÃdumpedfull.exeºÍdumppartial.dmp¹¹ÔìÒ»¸öÍêÕûµÄdumped.exe¡£
1).ÐÞÕýPEÍ·
ÓÃLordPE´ò¿ªdumpedfull.exe£¬²é¿´Çø¿é£º
¨TNumber Name VirtSize RVA PhysSize Offset Flag¨T
1 00001000 00001000 00001000 00001000 C0000040
2 .rsrc 00001000 00002000 00001000 00002000 C0000040
3 0000C000 00003000 0000C000 00003000 E0000060
ÎÒÃÇÖ»ÐèÒªPEÍ·Õⲿ·ÖµÄÊý¾Ý£¬¾ÍÊÇ0x1000ÒÔǰµÄÊý¾Ý£¬ÓÃHex WorkshopÊ®Áù½øÖƹ¤¾ß´ò¿ªdumpedfull.exe£¬½«¹â±ê¶¨ÔÚÎļþÍ·£¬²Ëµ¥Ö´ÐÐEdit/Select Block£¬ÊäÈë1000£¬Ñ¡ÖÐPEÍ·²¿·Ö£¬µã»÷¸´ÖÆ¡£
ÔÙÓÃHex Workshop½Ó×Å´ò¿ªdumppartial.dmpÎļþ£¬Õâ¸öÎļþǰ0x1000×Ö½Ú¼º±»Çå¿Õ£¬ÎÒÃÇÒª×öµÄ¾ÍÊǽ«dumpedfull.exeÎļþÍ·²¿·Ö¸´ÖƹýÀ´¡£
ͬÑùµÄ²Ù×÷£¬½«¹â±ê¶¨ÔÚÎļþÍ·£¬²Ëµ¥Ö´ÐÐEdit/Select Block£¬ÊäÈë1000£¬Ñ¡ÖÐPEÍ·²¿·Ö£¬µã»÷Õ³Ìù£¬½«¸Õ²Å¸´ÖƵÄÍ·²¿Êý¾ÝÕ³Ìù¹ýÀ´¡£
½«dumppartial.dmp¸ÄÃûΪdumped.exe¡£
ÓÃLordPE´ò¿ªÐÞÕý¹ýµÄdumped.exe£¬²é¿´Çø¿é£¬µã»÷ÓÒ¼üwipe section header£¬½«µÚ2¡¢3Ïîɾ³ý¡£
ͬʱ½«µÚ1ÏîÐÞÕý£¬´óС¸ÄΪ0xb000,ÊôÐÔÑ¡ÉÏ¡°Ö´ÐдúÂ롱£¬E0000040¡£
¨TNumber Name VirtSize RVA PhysSize Offset Flag¨T
1 .text 0000B000 00001000 0000B000 00001000 E0000040
2).×ÊÔ´ÐÞ¸´
ÓÃdREAMtHEATERµÄDT_FixRes¹¤¾ß´ò¿ªdumpedfull.exe£¬µã»÷Dump±êÇ©£¬NewRVAÌîÉÏC000,FileAlignmentÌîÉÏ1000,µã»÷Dump Resource£¬½«×ÊÔ´ÎļþÌáÈ¡³öÀ´rsrc.bin¡£
ÔÙÓÃLordPE´ò¿ªdumped.exe£¬²é¿´Çø¿é£¬ÓÒ¼üÖ´ÐÐLoad section from disk£¬½«×ÊÔ´rsrc.binµ¼È룬ͬʱÔÚÊý¾ÝĿ¼±íÀïÐÞÕý×ÊÔ´ÏîµÄRVAΪC000.
¨TNumber Name VirtSize RVA PhysSize Offset Flag¨T
1 .text 0000B000 00001000 0000B000 00001000 E0000040
2 rsrc.bin 00002000 0000C000 00002000 0000C000 E00000E0
½«ÐÞ¸´ºÃµÄdumped.exeÏÈ·ÅÒ»±ß£¬µÈ»ñµÃÕýÈ·µÄÊäÈë±íÔÙÐÞ¸´¾Í¿ÉÔËÐÐÁË¡£
Îå.ÊäÈë±íµÄÐÞ¸´
ÖØÐ¼ÓÔØ³ÌÐò£¬½öÉèÖÃÄÚ´æ·ÃÎÊÒì³£¡£µ±Íâ¿Ç³ÌÐòVirtualAllocµ÷ÓÃΪӳÏñÉêÇëÄÚ´æºó£¬¾Í¿ÉÒÔÓÃÃüÁ
D 955000 ²é¿´IATµÄÊý¾ÝÁË¡£
×¢Ò⣺²»Í¬»ú×Ó£¬VirtualAllocÉêÇëµÄÖµ»á²»Í¬£¬¸ù¾ÝÇ°ÃæµÄ·ÖÎöµÃÖª£¬»ùÖ·£«5000 ¾ÍÊÇIATµÄÆðʼµØÖ·¡£
µ±µÚ11´ÎÒì³£ºó£¬D 955000 ²é¿´µÄÊý¾Ý¼ºÓÐÖµ£¬Òò´ËÖØÐÂÀ´¹ý£¬µ±µÚ10´ÎÒì³£ºó£¬Í£Ï£º
008F6F29 8B02 mov eax, [edx]
ÖжϺóÊý¾Ý´°¿Ú£º
00955000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00955010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
ÔÚ 00955000Ñ¡Öм¸¸ö×Ö½Ú£¬µã»÷Êó±êÓÒ¼ü£¬ÉèÖᰶϵã/ÄÚÔÚдÈ롱
ÔÙ°´Shift+F9ͨ¹ýÒì³£¼ÌÐøÖ´ÐгÌÐò£¨Çë²»Òª°´F9,·ñÔòÒÔºó³ÌÐò¿ÉÄÜ»á³ö´íµÄ£©£¬Í£ÔÚÈçÏ£º
008F76E2 893E mov [esi], edi
±ðÍüÈ¡ÏûÄÚ´æ¶Ïµã¡£ÎªÁËÈôó¼Ò¿´µÄÃ÷°×£¬Óû¨Ö¸ÁîÈ¥³ýÁËÀ¬»ø´úÂ룬²¢ÇÒ½«¶àÓàµÄNOPҲʡÂÔ£¬Ê£ÏµĴúÂëΪ£º
008F76E2 893E mov [esi], edi//²»¶ÏÕâÀ½«IATÀïÌî³äÊý¾Ý
008F76E7 83C7 0C add edi, 0C
008F76EE 83C6 04 add esi, 4
008F76F7 41 inc ecx
008F76FD 3B4D 0C cmp ecx, [ebp+C]
008F7704 ^ 0F82 68FFFFFF jb 008F7672
008F7712 833E 00 cmp dword ptr [esi], 0
008F771B 0F85 7D000000 jnz 008F779E
008F7726 C607 60 mov byte ptr [edi], 60
008F772D 66:895F 01 mov [edi+1], bx
008F7734 8BC1 mov eax, ecx
008F773C 3345 FC xor eax, [ebp-4]
008F7743 66:8947 03 mov [edi+3], ax
008F774A C1CB 10 ror ebx, 10
008F7753 8857 06 mov [edi+6], dl
008F775B 885F 05 mov [edi+5], bl
008F7762 C647 07 E9 mov byte ptr [edi+7], 0E9
008F776A C1CB 10 ror ebx, 10
008F7772 8B45 14 mov eax, [ebp+14]
008F777A 2BC7 sub eax, edi
008F7781 83E8 0C sub eax, 0C
008F7787 8947 08 mov [edi+8], eax
008F7790 893E mov [esi], edi
008F7798 83C7 0C add edi, 0C
008F77A2 8BC7 mov eax, edi
008F77A8 2B45 18 sub eax, [ebp+18]
008F77AF 5F pop edi
008F77B0 5E pop esi
008F77B1 5B pop ebx
008F77B2 8BE5 mov esp, ebp//ÏÂÃæÕ⼸¾äûÓл¨Ö¸ÁÖжϿÉÒÔÏòÏ·£¬Ö±½ÓF4×ß³öÕâ¶Î´úÂë
008F77B4 5D pop ebp
008F77B5 C2 1400 retn 14
×ß³öÉÏÃæ´úÂ룬À´µ½ÈçÏ£¨»¨Ö¸Áȥ³ý£¬´úÂëÖØÐÂÅŰæÕûÀí£©£º
008F738D FF73 34 push dword ptr [ebx+34]
008F7390 50 push eax
008F7391 FF76 0C push dword ptr [esi+C]
008F7394 FF75 F8 push dword ptr [ebp-8]
008F7397 E8 09040000 call 008F77A5 //ÎÒÃÇ´ÓÕâ¸öCALL³öÀ´
008F739F 0145 EC add [ebp-14], eax
008F73AF 8B46 10 mov eax, [esi+10]
008F73B5 8B56 14 mov edx, [esi+14]
008F73BE 0343 10 add eax, [ebx+10]
008F73C4 0353 48 add edx, [ebx+48]
008F73CB FF36 push dword ptr [esi]
008F73CD 53 push ebx
008F73CE 52 push edx
008F73CF 50 push eax
008F73D0 FF76 0C push dword ptr [esi+C]
008F73D3 E8 E4010000 call 008F75BC //ÆÕͨ¼ÓÃܺ¯Êý
008F73DE 85C0 test eax, eax
008F73E3 0F84 18010000 je 008F7501
008F73F2 837D F0 00 cmp dword ptr [ebp-10], 0
008F73F9 74 43 je short 008F743E //ÈçÌø£¬ÔòÕâ¸öDLLÀïûÓÐÌØÊ⺯Êý
008F7405 8B46 10 mov eax, [esi+10]
008F740D 8B56 14 mov edx, [esi+14]
008F7414 0343 10 add eax, [ebx+10]
008F741D 0353 48 add edx, [ebx+48]
008F7426 FF75 EC push dword ptr [ebp-14]
008F7429 53 push ebx
008F742A 52 push edx
008F742B 50 push eax
008F742C FF76 0C push dword ptr [esi+C]
008F742F E8 A5020000 call 008F76D9 //ÌØÊâ¼ÓÃܺ¯Êý
008F7438 0145 EC add [ebp-14], eax
008F7445 33C0 xor eax, eax
008F744D 8946 0C mov [esi+C], eax
008F7455 8946 10 mov [esi+10], eax
008F745B 83C6 18 add esi, 18
008F7461 FF45 F8 inc dword ptr [ebp-8]
008F7467 FF4D FC dec dword ptr [ebp-4]
008F746F ^ 0F85 05FDFFFF jnz 008F717A
008F747B 33C0 xor eax, eax
008F7481 5F pop edi
008F7482 5E pop esi
008F7483 5B pop ebx
008F7484 8BE5 mov esp, ebp
008F7486 5D pop ebp
008F7487 C3 retn
1.´¦ÀíÆÕͨ¼ÓÃܺ¯Êý
°´F7½øÈë008F73D3 call 008F75BC £¬Õâ¶Î´úÂë¾ÍÊÇÍâ¿ÇΪÁË·ÀֹijЩº¯ÊýÖ¸Õë¼ÓÃܳö´í£¬ÕâÀォ¼ÓÃܵÄÖ¸Õ뻹Եġ£
°´ÕÕÒÔǰ°æ±¾µÄͨÓÃÐ޸ķ½·¨ÈçÏ£º£¨»¨Ö¸Á³ý¼°ÖмäµÄNOPÖ¸ÁºöÂÔ£©
008F75BC 55 push ebp
008F75BD 8BEC mov ebp, esp
008F75BF 53 push ebx
008F75C0 56 push esi
008F75C1 57 push edi
008F75C7 8B75 10 mov esi, [ebp+10]
008F75D0 8B7D 0C mov edi, [ebp+C]
008F75D7 8B5D 14 mov ebx, [ebp+14]
008F75E4 test word ptr [esi], 20 // test [esi],8
008F75EC je 008F7685 // jnz 008F7685
008F75F8 66:F706 0200 test word ptr [esi], 2
008F7602 75 47 jnz short 008F764B
008F760E 33C0 xor eax, eax
008F7613 66:C706 0400 mov word ptr [esi], 4
008F761E 6A 01 push 1
008F7620 50 push eax
008F7621 FF76 04 push dword ptr [esi+4]
008F7624 50 push eax
008F7625 FF75 18 push dword ptr [ebp+18]
008F7628 FF53 54 call [ebx+54]
008F762F 85C0 test eax, eax
008F7635 0F84 86000000 je 008F76C1 // je 008F7685
008F7641 8907 mov [edi], eax
008F7646 EB 3D jmp short 008F7685
008F7650 66:C706 0400 mov word ptr [esi], 4
008F7659 0FB756 02 movzx edx, word ptr [esi+2]
008F7661 6A 01 push 1
008F7663 52 push edx
008F7664 6A 00 push 0
008F7666 FF76 04 push dword ptr [esi+4]
008F7669 FF75 18 push dword ptr [ebp+18]
008F766C FF53 54 call [ebx+54]
008F7674 85C0 test eax, eax
008F7679 74 0A je short 008F76C1 //je 008F7685
008F767E 8907 mov [edi], eax
008F7688 83C6 08 add esi, 8
008F768F 83C7 04 add edi, 4
008F7698 FF4D 08 dec dword ptr [ebp+8]
008F769E ^ 0F85 3CFFFFFF jnz 008F75E0
ÕâÖÖ·½·¨ÔÚÒÔǰ°æ±¾ÓÐЧ£¬µ«ÔÚÕâ¸ö°æ±¾¾ÍʧЧÁË£¬Éú³ÉµÄIATÖÐÓв¿·Öº¯Êý³ö´í£º(ÔÚÊý¾Ý´°¿Ú£¬ÓÒ¼ü/³¤ÐÍ/µØÖ·ÏÔʾ£º)
00405000 >7C80C729 kernel32.lstrcpyA
00405004 >7C81EE79 kernel32.lstrcmpA
00405008 >7C838CB9 kernel32.GetStringTypeA
0040500C >7C80CEC4 kernel32.LCMapStringW
00405010 >7C832E2B kernel32.LCMapStringA
00405014 >7C809CAD kernel32.MultiByteToWideChar
00405018 >00B60048 <====ÕâÀï·ÅÉϵÄÊÇ´íÎóº¯Êý
0040501C >00B60054 <====ÕâÀï·ÅÉϵÄÊÇ´íÎóº¯Êý
00405020 >7C9379FD ntdll.RtlReAllocateHeap
00405024 >7C809A81 kernel32.VirtualAlloc
00405028 >7C9305D4 ntdll.RtlAllocateHeap
0040502C >7C81E82A kernel32.GetOEMCP
00405030 >7C809943 kernel32.GetACP
00405034 >7C812BE6 kernel32.GetCPInfo
00405038 >7C80B529 kernel32.GetModuleHandleA
0040503C >7C801EEE kernel32.GetStartupInfoA
00955040 00B6021B <====ÌØÊ⺯Êý£¬ÉÏÃæµÄ008F729F call 008F7549 Õâ¸öº¯Êý´¦Àí
00955044 00B60225 <====ÌØÊ⺯Êý
00405048 >00B600D8 <====ÕâÀï·ÅÉϵÄÊÇ´íÎóº¯Êý
0040504C >7C801E16 kernel32.TerminateProcess
00955050 00B6022F <====ÌØÊ⺯Êý
00405054 >7C862B8A kernel32.UnhandledExceptionFilter
00405058 >7C80B357 kernel32.GetModuleFileNameA
0040505C >00B60114 <====ÕâÀï·ÅÉϵÄÊÇ´íÎóº¯Êý
00405060 >00B60120 <====ÕâÀï·ÅÉϵÄÊÇ´íÎóº¯Êý
00405064 >7C80A0C7 kernel32.WideCharToMultiByte
00405068 >00B60138 <====ÕâÀï·ÅÉϵÄÊÇ´íÎóº¯Êý
0040506C >00B60144 <====ÕâÀï·ÅÉϵÄÊÇ´íÎóº¯Êý
00405070 >7C80C6CF kernel32.SetHandleCount
00405074 >7C812CA9 kernel32.GetStdHandle
00405078 >7C811069 kernel32.GetFileType
0040507C >00B60174
00405080 >7C812851 kernel32.GetVersionExA
00405084 >7C811110 kernel32.HeapDestroy
00405088 >7C812929 kernel32.HeapCreate
0040508C >7C809B14 kernel32.VirtualFree
00405090 >7C93043D ntdll.RtlFreeHeap
00405094 >7C957A40 ntdll.RtlUnwind
00405098 >00B601C8 <====ÕâÀï·ÅÉϵÄÊÇ´íÎóº¯Êýs
0040509C >7C80A480 kernel32.GetStringTypeW
¾¹ý·ÖÎö£¬ÎÊÌâ³öÔÚÕ⣺
008F75F8 66:F706 0200 test word ptr [esi], 2
008F7602 75 47 jnz short 008F764B
²é¿´ESIÖ¸ÏòµÄÊý¾ÝÈçÏ£º
008F0984 02 00 6C 00 10 E4 37 3D 02 00 6C 00 16 68 FD 1F lý§?lÆÜ>
008F0994 02 00 47 00 FA FD D2 A4 02 00 4C 00 2A 39 97 BA G??L??
008F09A4 02 00 4C 00 89 69 EB 25 02 00 4D 00 D6 68 87 83 Lé·?M—–>
008F09B4 80 00 00 00 04 00 00 00 80 00 00 00 0A 00 00 00 ?..?...
008F09C4 02 00 48 00 25 3C 50 91 02 00 56 00 28 A7 07 B5 H?ôûV??
008F09D4 02 00 48 00 5A 56 8D 4C 02 00 47 00 4B AB 0D 19 H‡x?G??
008F09E4 02 00 47 00 6D 2F CD E2 02 00 47 00 BA 5B 49 4E G?ùÜGŒr>
008F09F4 02 00 47 00 ED 52 B7 AF 02 00 47 00 8C 68 8D A0 G„ç?G—^>
008F0A04 08 00 00 00 03 00 00 00 08 00 00 00 00 00 00 00 .....
008F0A14 40 00 00 00 03 00 00 00 02 00 54 00 11 04 59 C8 @..T§¢?
02£ºÆÕͨº¯Êý±êÖ¾£¬ÓÃ008F73D3 call 008F75BCº¯Êý½âÃÜ
08£ºÌØÊ⺯Êý±êÖ¾£¬ÓÃ008F742F call 008F76D9º¯Êý»Ö¸´
80£ºÌØÊ⺯Êý±êÖ¾
¶ÔÓÚ80Õâ¸ö±êÖ¾£¬Óá°008F7498 call [ebx+54]¡±Õâ¸öº¯ÊýÒ²´¦Àí£¬µ«µÃµ½µÄ½á¹ûÊÇ´íÎó£¬
²Â²â×÷ÕßÔÚObsidium1.3ÀïÐÂÔöÁËÒ»ÖÖ´¦Àíº¯Êý·½·¨¡£
ÔÚÕ⣬ÎÒÃÇ»¹ÊÇÓÃÒÔǰµÄ·½·¨£¬½«¼¸´¦´úÂëÐ޸ĺãº
008F75E4 test [esi],8
008F75EC jnz 008F7685
008F75F8 66:F706 0200 test word ptr [esi], 2
008F7602 /75 47 jnz short 008F764B
008F760E 33C0 xor eax, eax //Éè¶Ï£¬ÈóÌÐòÖ´ÐУ¬²é¿´Êý¾ÝÃæ°å´°¿Ú
008F7613 66:C706 0400 mov word ptr [esi], 4
008F761E 6A 01 push 1
008F7620 50 push eax
008F7621 FF76 04 push dword ptr [esi+4]
008F7624 50 push eax
008F7625 FF75 18 push dword ptr [ebp+18]
008F7628 FF53 54 call [ebx+54]
008F762F 85C0 test eax, eax
008F7635 je 008F7685
008F7641 8907 mov [edi], eax
008F7646 EB 3D jmp short 008F7685
008F7650 66:C706 0400 mov word ptr [esi], 4
008F7659 0FB756 02 movzx edx, word ptr [esi+2]
008F7661 6A 01 push 1
008F7663 52 push edx
008F7664 6A 00 push 0
008F7666 FF76 04 push dword ptr [esi+4]
008F7669 FF75 18 push dword ptr [ebp+18]
008F766C FF53 54 call [ebx+54]
008F7674 85C0 test eax, eax
008F7679 74 0A je 008F7685
008F760EÖжϺ󣬲鿴Êý¾ÝÃæ°å´°¿Ú£º
00955000 7C80C729 kernel32.lstrcpyA
00955004 7C81EE79 kernel32.lstrcmpA
00955008 7C838CB9 kernel32.GetStringTypeA
0095500C 7C80CEC4 kernel32.LCMapStringW
00955010 7C832E2B kernel32.LCMapStringA
00955014 7C809CAD kernel32.MultiByteToWideChar
00955018 00B60048 //Õâ¸öÊÇ80±êÖ¾µÄº¯Êý
¡¡
ΪÁËÁ˽â´úÂëÊÇÈçºÎ´¦Àí80±êÖ¾µÄº¯Êý£¬ÎÒÃǸú½ø00955018Õâ¸öIATµØÖ·ËùÖ¸µÄ 00B60048º¯Êý¡£°´Ctrl£«G´ò¿ªµØÖ·¿ò£¬
ÊäÈë0B60048£¨×¢Ò⣺µØÖ·Ê×λÈç¹ûÊÇ×Öĸ£¬±ðÍü¼Ó¸ö0£©£º
00B60048 60 pushad //ÔÚÕâ°´ÓÒ¼üн¨EIPÔ´£¬½«µ±Ç°EIPÖ¸ÕëÖ¸µ½´Ë´¦
00B60049 66:BF B55B mov di, 5BB5
00B6004D B2 80 mov dl, 80
00B6004F - E9 E350D9FF jmp 008F5137
³ýÈ¥»¨Ö¸ÁîºóµÄ´úÂ룺
008F52C7 90 nop
008F52C8 90 nop
008F52C9 90 nop
008F52CA 90 nop
008F52CB 90 nop
008F52CC 0FB6D2 movzx edx, dl
008F52CF 90 nop
008F52D0 90 nop
008F52D1 90 nop
008F52D2 0FB7C7 movzx eax, di
¡¡
008F5399 8D34C6 lea esi, [esi+eax*8] //À´µ½ÕâÀ²é¿´ESI
008F53A0 0FB706 movzx eax, word ptr [esi]
008F53AC 83F8 04 cmp eax, 4
008F53B5 0F84 78010000 je 008F5533
008F53C4 83F8 01 cmp eax, 1
008F53CA 0F84 11010000 je 008F54E1
008F53DA 3D 80000000 cmp eax, 80
008F53E3 /0F84 AE070000 je 008F5B97//ÕâÀï»áÌø
µ½008F5209Õâ¾ä²é¿´ESI£º
008F09B4 80 00 00 00 04 00 00 00 80 00 00 00 0A 00 00 00 ?..?...
Õâ¸ö¾ÍÊÇÉÏÃæµÄÄǸöÊý¾Ý±í£¬80¾ÍÊÇÌØÊ⺯Êý±êÖ¾£¬ºóÃæµÄ04¾ÍÊÇÓ뺯ÊýÃûÓйصIJÎÊý¡£
008F5BBB 8BD5 mov edx, ebp
008F5BBD 90 nop
008F5BBE 90 nop
008F5BBF 90 nop
008F5BC0 90 nop
008F5BC1 90 nop
008F5BC2 90 nop
008F5BC3 039485 9401EC00 add edx, [ebp+eax*4+EC0194]
008F5BCA 90 nop
008F5BCB 90 nop
008F5BCC 90 nop
008F5BCD 90 nop
008F5BCE FFE2 jmp edx
¼ÌÐø×ߣ¬À´µ½ÈçÏ£º
008F5D23 90 nop
008F5D24 90 nop
008F5D25 90 nop
008F5D26 8B83 C4010000 mov eax, [ebx+1C4]
008F5D2C 90 nop
008F5D2D 90 nop
008F5D2E 90 nop
008F5D2F 90 nop
008F5D30 90 nop
008F5D31 90 nop
008F5D32 ^ E9 E7FDFFFF jmp 008F5B1E
²é¿´ ebx+1C4£¬»á·¢ÏÖÒ»×é´úÂëµÄµØÖ·£¬ÔÀ´³ÌÐòÊǸù¾Ý²»Í¬µÄº¯Êý²ÎÊýÈ·¶¨º¯ÊýÃû£¬Äã¿ÉÒÔCtrl£«GÊäÈëÏÂÃæµÄµØÖ·²é¿´´úÂ룺
008F0390 008F223D 008F22C7 008F23AB 008F232D
008F03A0 008F2423 008F2489 008F24EF 008F2555
008F03B0 008F2633 008F269F 008F2705 008F27E9
008F03C0 008F285B 008F25C1 008F2777 008F28C7
008F03D0 008F2159 008F21CB 008F20A1 008F20FD
008F03E0 008F1FD5 008F203B 008F1E73 008F1EF1
008F03F0 008F1F63 008F2951 008F29C3 008F2A47
008F0400 008F2AC5 008F2B2B 008F1C98 00000000
ÉÏÃæÃ¿¸öµØÖ·ÊÇÒ»¶Î´úÂëµÄÈë¿Ú£¬´¦Àíij¸öAPIº¯Êý£¬ÏÂÃæÒª×öµÄ¾ÍÊÇÕÒµ½ÕâЩ´úÂ빲ͬ³ö¿Úµã£¬Îª²¹¶¡³ÌÐò×ö×¼±¸¡£¼ÌÐø£º
008F5B26 8038 CC cmp byte ptr [eax], 0CC
008F5B2E 74 1B je short 008F5B4B
008F5B38 894424 1C mov [esp+1C], eax
008F5B3C 90 nop
008F5B3D 90 nop
008F5B3E 90 nop
008F5B3F 90 nop
008F5B40 61 popad
008F5B41 90 nop
008F5B42 90 nop
008F5B43 90 nop
008F5B44 90 nop
008F5B45 FFE0 jmp eax //¸ù¾Ý²ÎÊý²»Í¬£¬Ìøµ½²»Í¬´úÂëÀï»ñÈ¡º¯ÊýµØÖ·
Õâ´Î¸ú½øeaxΪ008F2423Öµ£¬jmp 008F2423µØÖ·£¬À´µ½£º
008F2423 55 push ebp
008F2424 8BEC mov ebp, esp
008F2426 83EC 08 sub esp, 8
008F2429 53 push ebx
008F242A 56 push esi
008F242B 57 push edi
008F242C E8 00000000 call 008F2431
008F2431 5B pop ebx
008F2432 8BF3 mov esi, ebx
008F2434 8B9B 4FF4FFFF mov ebx, [ebx-BB1]
008F243A 8975 F8 mov [ebp-8], esi
008F243D 8DBE A7070000 lea edi, [esi+7A7]
008F2443 BE 04000000 mov esi, 4
008F2448 8B07 mov eax, [edi]
008F244A 85C0 test eax, eax
008F244C 74 14 je short 008F2462
008F244E 8D55 FC lea edx, [ebp-4]
008F2451 FF75 08 push dword ptr [ebp+8]
008F2454 52 push edx
008F2455 FFD0 call eax
008F2457 83F8 01 cmp eax, 1
008F245A 74 21 je short 008F247D
008F245C 83C7 04 add edi, 4
008F245F 4E dec esi
008F2460 ^ 75 E6 jnz short 008F2448
008F2462 8B75 F8 mov esi, [ebp-8]
008F2465 FF75 08 push dword ptr [ebp+8]
008F2468 FFB6 57090000 push dword ptr [esi+957] //esi+957Ö¸ÏòµÄ¾ÍÊÇÕýÈ·µÄº¯ÊýÃû£¬°´F7¸ú½ø
008F246E FF93 84000000 call [ebx+84]
008F2474 5F pop edi
008F2475 5E pop esi
008F2476 5B pop ebx
008F2477 8BE5 mov esp, ebp
008F2479 5D pop ebp
008F247A C2 0400 retn 4
008F2468Õâ¸öCALL½øÈë»áÀ´µ½Íâ¿Ç×Ô¼ºµÄÁì¿Õ£¬ÆäµØÖ·ÊÇ4xxxxx£º
0040C633 /EB 01 jmp short 0040C636 //ÔÚÕâ¿ÉÒÔÓÃmov eax, [esp+4] Ö¸ÁîÈ¡µÃº¯ÊýµÄµØÖ·
0040C635 |5D pop ebp
0040C636 \EB 01 jmp short 0040C639
0040C638 04 60 add al, 60
0040C63A EB 04 jmp short 0040C640
Õâ¾ÍÒâζ×Ų»Í¬µÄº¯Êý£¬×îÖÕ¶¼»áÀ´µ½ÕâÀÕâΪ²¹¶¡³ÌÐòÈ¡µÃº¯ÊýÃûµØÖ·ÌṩÁË¿ÉÄÜ¡£
²¹¶¡Ë¼Â·£º
1.´¦Àí±ê־Ϊ80º¯Êýʱ£¬Ìøµ½IATÖ¸¶¨µÄµØÖ·´¦Ö´ÐÐ
2.²¹¶¡0040C633£¬ÈÃÆäÌø»áIATÆÕͨº¯Êý´¦Àí´úÂëÀï¡£
µ±È»Èç¹ûÌØÊ⺯Êý²»¶à£¬Äã²»ÅÂÂé·³¿ÉÒÔ²»ÓÃÕâ·½·¨À´´¦Àí£¬ÊÖ¶¯¸ú×ÙÄÇЩû±»Ê¶±ð³öµÄº¯Êý£¬ÕÒµ½ÕýÈ·µÄº¯ÊýÖ¸Õë¡£
°´Õâ˼·¹¹ÔìµÄ´úÂëÈçÏ£¬ºìÉ«²¿·ÖÊÇ´¦Àí±ê־Ϊ80µÄº¯Êý£º
£¨ÓÉÓÚÿ´Î¸ú×Ù£¬Íâ¿ÇÕâ¶Î´úÂëµØÖ·²»Í¬£¬ÏÂÃæÕâ¶Î´úÂëÊǵڶþ´ÎÔËÐÐץȡµÄ£¬Òò´ËͬһָÁîºÍÉÏÎÄÌṩµÄµØÖ·²»Í¬£¬´ó¼ÒÒÔ»ã±à´úÂëÀ´Ê¶±ð£©
008F7564 test word ptr ds:[esi],8
008F756C jnz 008F7605
008F7578 test word ptr ds:[esi],2
008F7582 jnz short 008F75CB
008F7584 test word ptr ds:[esi],80 //ÈçÊÇ80±êÖ¾µÄº¯Êý¾Í´¦Àí
008F7589 je short 008F7605
008F758B mov eax,dword ptr ds:[esi+4]
008F758E pushad
008F758F mov edx,954FF8 //954FF8µØÖ·ÊÇÄÚ´æÖеÄÒ»¿Õ°×£¬ÕâÀïÊÇIATÇ°Ãæ²¿·Ö£¬ÓÃÒÔ±£´æÁÙʱ±äÁ¿
008F7594 mov dword ptr ds:[edx],esp //½«espµÄÖµ±£´æÔÚ954FF8Õâ¸öµØÖ·±äÁ¿Àï
008F7596 jmp dword ptr ds:[edi] //Ìøµ½IATÖ¸¶¨µÄµØÖ·ÔËÐÐ
008F7598 nop
008F7599 nop
008F759A nop //IATÖ¸¶¨µØÖ·ÔËÐнáÊøºó£¬ÈÃËü·µ»Øµ½ÕâÀï
008F759B mov eax,dword ptr ss:[esp+4] //È¡µÃº¯ÊýµØÖ·
008F759F mov esp,dword ptr ds:[954FF8] //»Ö¸´¶ÑÕ»
008F75A5 mov dword ptr ss:[esp+1C],eax //eaxµÄ½á¹û·Å½ø¶ÑÕ»ÀÒÔ±ãpopadʱ£¬»á·Åµ½eax¼Ä´æÆ÷Àï
008F75A9 popad
008F75AA mov word ptr ds:[esi],4
008F75AF mov dword ptr ds:[edi],eax //½«µÃµ½µÄº¯ÊýµØÖ··Å½øIAT
008F75B1 nop
008F75B2 nop
¡¡£¨ÖмäÈ«ÊÇNOPÖ¸Á
008F75C6 EB 3D jmp short 008F7605 //¼ÌÐø´¦ÀíÏÂÒ»¸öº¯Êý
008F75D0 66:C706 0400 mov word ptr ds:[esi],4
008F75D9 0FB756 02 movzx edx,word ptr ds:[esi+2]
008F75E1 6A 01 push 1
008F75E3 52 push edx
008F75E4 6A 00 push 0
008F75E6 FF76 04 push dword ptr ds:[esi+4]
008F75E9 FF75 18 push dword ptr ss:[ebp+18]
008F75EC FF53 54 call dword ptr ds:[ebx+54]
008F75F4 85C0 test eax,eax
008F75F9 74 0A je short 008F7605
008F75FE 8907 mov dword ptr ds:[edi],eax
008F7608 83C6 08 add esi,8
008F760F 83C7 04 add edi,4
008F7618 FF4D 08 dec dword ptr ss:[ebp+8]
008F761E ^ 0F85 3CFFFFFF jnz 008F7560
008F7629 33C0 xor eax,eax //ÔÚÕâÉè¸ö¶Ïµã£¬Ö´ÐÐÍêÉÏÊö´úÂ룬80±êÖ¾µÄº¯Êý¾Í»¹ÔÁË
008F762F 40 inc eax
008F7636 5F pop edi
008F7637 5E pop esi
008F7638 5B pop ebx
008F7639 5D pop ebp
008F763A C2 1400 retn 14
ÉÏÃæÕâ¶Î´úÂëÓм¸µãҪעÒâµÄ£º
µÚÒ»¸ö¾ÍÊÇ954FF8µØÖ·£¬ÎÒÕâÈ¡µÄÊÇIAT£¨IATÆðʼµØÖ·ÊÇ955000£©Ç°ÃæÄǸö¿Õ¼ä£¬
ÓÉÓÚ²»Í¬ÏµÍ³·ÖÅäµÄÄÚ´æµØÖ·¿ÉÄܲ»Í¬£¬ËùÒÔÄãµÃ¸ù¾ÝÄãµÄÇé¿ö½«Õâ¸öÖµ¶¨ºÃ¡£
µÚ¶þ¸ö¾ÍÊÇ008F7582¡«008F75C6Ö®¼ä´úÂë±ðÍüÈ«²¿NOPµô£¬ÓÃÐÂÔöµÄ´úÂëÌæ»»¡£
µÚÈý¾ÍÊÇ´¦Àíº¯ÊýµÄÿ¸ö´úÂëÈë¿Ú²ÎÊý²»Ò»Ñù£¬Òò´Ë±ØÐ뽫ESP±£´æµ½Ò»±äÁ¿ÁË¡£
ÉÏÃæÐ޸ĴúÂë¶þ½øÖÆÈçÏ£¬Êµ¼Ê²Ù×÷ʱ£¬¿ÉÒÔÓÃODµÄ¶þ½øÖÆÕ³Ìù¹¦Äܽ«´úÂë¸´ÖÆ¹ýÈ¥£¬±ðÍüÁË»¹Òª¸ù¾ÝÄãµÄÇé¿öÐÞÕý954FF8±äÁ¿µØÖ·¡£
66 F7 06 80 00 74 7A 8B 46 04 60 BA F8 4F 95 00 89 22 FF 27 90 90 90 8B 44 24 04 8B 25 F8 4F 95 00 89 44 24 1C 61 66 C7 06 04 00 89 07
ÁíÍ⣬ÔÙ°´Ctrl+GÌøµ½0040C633 £¬ÕâÊÇËùÓдúÂëµÄ³ö¿Ú£¬½«Æä¸Ä³É£º
0040C633 - E9 62AF4E00 jmp 008F759 //±ðÍüÉè¸ö¶Ï£¬ËùÓк¯Êý´¦ÀíÍê±Ï»Øµ÷ÓÃÕâÀïµÄ´úÂ룬ÄãÔÙ³·ÏûÑ¡Ôñ½«Æä»¹Ô
2.´¦ÀíÌØÊâ¼ÓÃܺ¯Êý
×ß³öÉÏÃæµÄÆÕͨº¯Êý£¬½øÈëÌØÊ⺯Êý´¦ÀíµÄCALL:
008F7424 90 nop
008F7425 90 nop
008F7426 FF75 EC push dword ptr [ebp-14]
008F7429 53 push ebx
008F742A 52 push edx
008F742B 50 push eax
008F742C FF76 0C push dword ptr [esi+C]
008F742F E8 A5020000 call 008F76D9//½øÈëÕâ¸ö´¦ÀíÌØÊ⺯ÊýµÄCALL
F7×ß½ø£º
008F76D9 55 push ebp
008F76DA 8BEC mov ebp, esp
008F76DC 53 push ebx
008F76DD 56 push esi
008F76DE 57 push edi
008F76DF 8B75 10 mov esi, [ebp+10]
¡¡¡¡
008F771A 83F8 03 cmp eax, 3
008F771D 74 12 je short 008F7731
008F771F 83F8 04 cmp eax, 4
008F7722 ^ 75 CA jnz short 008F76EE
008F7724 8B45 14 mov eax, [ebp+14]
008F7727 8B90 E8000000 mov edx, [eax+E8]
008F772D 8917 mov [edi], edx
008F772F ^ EB BD jmp short 008F76EE
008F7731 8B45 14 mov eax, [ebp+14]
008F7734 68 C5B1662D push 2D66B1C5
008F7739 6A 00 push 0
008F773B FF50 18 call [eax+18]
008F773E 50 push eax
008F773F 53 push ebx
008F7740 E8 98020000 call 008F79DD
008F7745 53 push ebx
008F7746 E8 19020000 call 008F7964
008F774B 8BCB mov ecx, ebx
008F774D 8D5C03 01 lea ebx, [ebx+eax+1]
008F7751 8BC1 mov eax, ecx
008F7753 EB 2B jmp short 008F7780
008F7755 8B45 14 mov eax, [ebp+14]
008F7758 68 0F1ACF4C push 4CCF1A0F
008F775D 6A 00 push 0
008F775F FF50 18 call [eax+18] //½âÃܺ¯Êý£¬°´F7½øÈë
{
0040CE93 90 nop
0040CE94 90 nop
0040CE95 90 nop
0040CE96 60 pushad
0040CE9B 83EC 04 sub esp, 4
0040CEA3 E8 00000000 call 0040CEA8
0040CEAC 5B pop ebx
0040CEB1 8BEB mov ebp, ebx
0040CEB7 8B5B E7 mov ebx, [ebx-19]
0040CEC4 8B4424 28 mov eax, [esp+28]
0040CED4 33C9 xor ecx, ecx
0040CEDC 8B8483 98000000 mov eax, [ebx+eax*4+98]
0040CEE9 8B5424 2C mov edx, [esp+2C]
0040CEF3 51 push ecx
0040CEF4 51 push ecx
0040CEF5 51 push ecx
0040CEF6 52 push edx
0040CEF7 50 push eax
0040CEF8 FF53 54 call [ebx+54] //Obsidium×Ô¼ºÊµÏÖµÄGetProcAddress
0040CF01 85C0 test eax, eax
0040CF06 0F84 56020000 je 0040D162
0040CF0C 90 nop //¸Ä³É MOV [EDI], EAX ͬʱÉè¶Ï
0040CF0D 90 nop
0040CF11 8BF0 mov esi, eax
}
008F7762 /EB 1C jmp short 008F7780
008F7764 |8B45 14 mov eax, [ebp+14]
008F7767 |68 A41A86D0 push D0861AA4
008F776C |6A 00 push 0
008F776E |FF50 18 call [eax+18]
008F7771 |EB 0D jmp short 008F7780
008F7773 |8B45 14 mov eax, [ebp+14]
008F7776 |68 E313B41D push 1DB413E3
008F777B |6A 00 push 0
008F777D |FF50 18 call [eax+18]
008F7780 \C603 B8 mov byte ptr [ebx], 0B8
008F7783 8943 01 mov [ebx+1], eax
008F7786 8B45 14 mov eax, [ebp+14]
008F7789 8B90 A4010000 mov edx, [eax+1A4]
008F778F 8D43 0A lea eax, [ebx+A]
008F7792 2BD0 sub edx, eax
008F7794 C643 05 E9 mov byte ptr [ebx+5], 0E9
008F7798 8953 06 mov [ebx+6], edx
008F779B 891F mov [edi], ebx //Õâ¾äNOPµô£¬ÒòΪ´¦ÀíÍ꣬»áÓÃÆäµØÖ·¸²¸Ç[edi](ediÖ¸ÏòIAT)
ÔÚ£º0040CF0C 90 nop //¸Ä³É MOV [EDI], EAX //ͬʱÉè¶Ï
ÕâÒ»ÐУ¬»áÖжÏÈý´Î£¬µÃµ½Èý¸öÌØÊ⺯Êý£º
GetCommandLineA
GetVersion
GetCurrentProcess
ËùÓеÄÌØÊ⺯Êý´¦ÀíÍê±Ïºó£¬ÔÙÖ´ÐУ¬³ÌÐò·µ»ØµÄEDIÖµ¼º²»Ö¸ÏòIATÁË£¬Òò´Ë±ØÐ뽫MOV [EDI], EAX Õâ¾äɾ³ý£¬»¹Ô´úÂë¡£
´¦ÀíÍêkernel32.dllºó½«´¦Àíuser32.dll£¬³ÌÐò»áÔÙÑ»·»Øµ½ÄǸö½âÃÜÆÕͨº¯ÊýµÄCALL³ÌÐòÔÙ´ÎÖ´Ðеġ£user32.dllûÓÐÌØÊ⺯Êý£¬³öÀ´ºó£º
08F73D3 E8 E4010000 call 008F75BC //ÆÕͨ¼ÓÃܺ¯Êý
008F73DE 85C0 test eax, eax
008F73E3 0F84 18010000 je 008F7501
008F73F2 837D F0 00 cmp dword ptr [ebp-10], 0
008F73F9 74 43 je short 008F743E //ÈçÌø£¬ÔòÕâ¸öDLLÀïûÓÐÌØÊ⺯Êý
008F7405 8B46 10 mov eax, [esi+10]
008F740D 8B56 14 mov edx, [esi+14]
008F7414 0343 10 add eax, [ebx+10]
008F741D 0353 48 add edx, [ebx+48]
008F7426 FF75 EC push dword ptr [ebp-14]
008F7429 53 push ebx
008F742A 52 push edx
008F742B 50 push eax
008F742C FF76 0C push dword ptr [esi+C]
008F742F E8 A5020000 call 008F76D9 //ÌØÊâ¼ÓÃܺ¯Êý
008F7438 0145 EC add [ebp-14], eax
008F7445 33C0 xor eax, eax
008F744D 8946 0C mov [esi+C], eax
008F7455 8946 10 mov [esi+10], eax
008F745B 83C6 18 add esi, 18
008F7461 FF45 F8 inc dword ptr [ebp-8]
008F7467 FF4D FC dec dword ptr [ebp-4]
008F746F ^ 0F85 05FDFFFF jnz 008F717A
008F747B 33C0 xor eax, eax //½«¶ÏµãÉèÔÚ£¬´¦ÀíËùÓеÄDLL¾Í»áÖжÏÔÚÕâ
008F7481 5F pop edi
008F7482 5E pop esi
008F7483 5B pop ebx
008F7484 8BE5 mov esp, ebp
008F7486 5D pop ebp
008F7487 C3 retn
ËùÓеÄDLL´¦ÀíÍê±Ï²é¿´Ò»ÏÂIAT£º
00955000 7C80C729 kernel32.lstrcpyA
00955004 7C81EE79 kernel32.lstrcmpA
00955008 7C838CB9 kernel32.GetStringTypeA
0095500C 7C80CEC4 kernel32.LCMapStringW
00955010 7C832E2B kernel32.LCMapStringA
00955014 7C809CAD kernel32.MultiByteToWideChar
00955018 7C801D77 kernel32.LoadLibraryA
0095501C 7C80AC28 kernel32.GetProcAddress
00955020 7C9379FD ntdll.RtlReAllocateHeap
00955024 7C809A81 kernel32.VirtualAlloc
00955028 7C9305D4 ntdll.RtlAllocateHeap
0095502C 7C81E82A kernel32.GetOEMCP
00955030 7C809943 kernel32.GetACP
00955034 7C812BE6 kernel32.GetCPInfo
00955038 7C80B529 kernel32.GetModuleHandleA
0095503C 7C801EEE kernel32.GetStartupInfoA
00955040 7C812C8D kernel32.GetCommandLineA
00955044 7C8114AB kernel32.GetVersion
00955048 00B600D8 //Õâ¸öûÕÒ³ö£¬Õâ¸öº¯ÊýµÄÌØÊâ±êÖ¾ÊÇ40
0095504C 7C801E16 kernel32.TerminateProcess
00955050 7C80E00D kernel32.GetCurrentProcess
00955054 7C862B8A kernel32.UnhandledExceptionFilter
00955058 7C80B357 kernel32.GetModuleFileNameA
0095505C 7C81DC3F kernel32.FreeEnvironmentStringsA
00955060 7C81485F kernel32.FreeEnvironmentStringsW
00955064 7C80A0C7 kernel32.WideCharToMultiByte
00955068 7C81CC23 kernel32.GetEnvironmentStringsA
0095506C 7C812C78 kernel32.GetEnvironmentStringsW
00955070 7C80C6CF kernel32.SetHandleCount
00955074 7C812CA9 kernel32.GetStdHandle
00955078 7C811069 kernel32.GetFileType
0095507C 7C81486A kernel32.GetEnvironmentVariableA
00955080 7C812851 kernel32.GetVersionExA
00955084 7C811110 kernel32.HeapDestroy
00955088 7C812929 kernel32.HeapCreate
0095508C 7C809B14 kernel32.VirtualFree
00955090 7C93043D ntdll.RtlFreeHeap
00955094 7C957A40 ntdll.RtlUnwind
00955098 7C810F9F kernel32.WriteFile
0095509C 7C80A480 kernel32.GetStringTypeW
009550A0 00B601E0
009550A4 77D1A8AD USER32.wsprintfA
009550A8 77D6AC1E USER32.GetDlgItemTextA
009550AC 77D1BE71 USER32.EnableWindow
009550B0 77D1DA60 USER32.SetFocus
009550B4 77D31F4C USER32.MessageBeep
009550B8 77D21324 USER32.LoadIconA
009550BC 77D3C2BF USER32.SendDlgItemMessageA
009550C0 77D1DAEA USER32.DestroyWindow
009550C4 77D24816 USER32.GetDlgItem
009550C8 77D2F39A USER32.SendMessageA
009550CC 77D26250 USER32.EndDialog
009550D0 77D3B11C USER32.DialogBoxParamA
×îºó»¹ÓÐÒ»¸öº¯Êýû»ñµÃ£º00955048 00B600D8
Òò´ËÊÖ¹¤¸ú¡£ÔÚ00B600D8н¨EIP£º
00B600D8 60 pushad
00B600D9 66:BF A15B mov di, 5BA1
00B600DD B2 80 mov dl, 80
00B600DF - E9 C351D9FF jmp 008F52A7
¡¡
008F53D2 83F8 40 cmp eax, 40
008F53D5 90 nop
008F53D6 90 nop
008F53D7 90 nop
008F53D8 0F84 AB010000 je 008F5589
008F57E9 6A 00 push 0
008F57EB 6A 45 push 45
008F57ED 6A 00 push 0
008F57EF 68 CC971025 push 251097CC
008F57F4 FF37 push dword ptr [edi]
008F57F6 FF53 54 call [ebx+54]//¾¹ýÕâ¸öCALL£¬»ñµÃEAX 7C81CAA2 kernel32.ExitProcess
Ö´Ðе½008F747B 33C0 xor eax, eax Õâ¾äºó£¬¾Í¿É²»Ö´ÐÐÁË£¬½ÓÏÂÀ´ÔËÐÐImportRECÐÞ¸´ÊäÈë±í¡£
½«IATµÄµØÖ·RVA£º555000,´óСD4Ìî½ø£¬Get Importsºó¾ÍÄܵõ½ÕýÈ·µÄÊäÈë±í¡£
ObsidiumÕâÖÖÖØ¶¨Î»µÄ¿Ç£¬ImportREC¼ÆËãÊǰ´ÍÑ¿ÇǰÎļþµÄ»ùÖ·£¬ÀýÈçÕâ¸öʵÀýÍÑ¿ÇǰµÄ»ùÖ·ÊÇ00400000£¬IATµÄVAµØÖ·ÊÇ955000£¬ÔòImportRECÀïµÄRVAÌî955000-400000=555000¡£
Èç¹ûÍâ¿ÇÖØ¶¨Î»µÄ»ùÖ·µÍÓÚÍâ¿Ç»ùÖ·£¬¼ÆËã·½·¨»¹ÊÇÒ»ÑùµÄ¡£Àý¼ÙÉèÕâ¸öʵÀýÖØ¶¨Î»ºóµÄÓ³Ïñ»ùÖ·ÊÇ3F0000£¬ÔòIATµÄVAΪ3F5000£¬ImportRECÀïµÄRVAÌî3F5000-00400000£½FFFF5000£¨¶àÓàµÄFÉáÈ¥£©¡£
ÕâÑùImportREC¾ÍÄܹ¤×÷ÁË£¬µ«×îºóFix Dump»á³ö´í£¬Ìáʾ¡°Invalid dump file!Can't match RVA to Offset in the dump file¡±
½â¾ö°ì·¨ºÜ¼òµ¥£¬´Ëʱµã»÷Save Tree£¬½«IAT±£´æµ½ÎļþÀ´ò¿ªÕâ¸öÎı¾Îļþ£º
FThunk: FFFF5000 NbFunc: 00000028
1 FFFF5000 kernel32.dll 03AD lstrcpy
1 FFFF5004 kernel32.dll 03A7 lstrcmp
1 FFFF5008 kernel32.dll 01B0 GetStringTypeA
1 FFFF500C kernel32.dll 0235 LCMapStringW
½«FFFFÓÃ0000È«²¿Ìæ»»£º
FThunk: 00005000 NbFunc: 00000028
1 00005000 kernel32.dll 03AD lstrcpy
1 00005004 kernel32.dll 03A7 lstrcmp
1 00005008 kernel32.dll 01B0 GetStringTypeA
×îºóImportREC´ò¿ª½ø³Ì£¬µã»÷Load Tree£¬Õâ´ÎFix Dump¾ÍÄܳɹ¦ÐÞ¸´ÎļþÁË¡£
kanxue
¿´Ñ©¼¼ÊõÂÛ̳ www.pediy.com
2005.12.18