Èí¼þÃû³Æ£º Ó×¶ùƴͼʶÎï
ÏÂÔØµØÖ·£º http://yingjia.hostrocket.com/jigsaw/index.htm
Èí¼þ´óС£º 2.6 MB
Èí¼þÓïÑÔ£º ÖÐÎÄ
Èí¼þÀà±ð£º ¹úÄÚÈí¼þ / ¹²Ïí°æ
Ó¦ÓÃÆ½Ì¨£º Win9x/NT/2000/XP
¼ò½é£º ͨ¹ýÕâ¸öÈí¼þ²»½ö¿ÉÒÔ¶ÍÁ¶º¢×ӵĹ۲ìÁ¦¡¢ÄÍÐÔ¡¢¼ÇÒäÁ¦£¬¶øÇÒ»¹¿ÉÒÔÁ˽â¸ü¶àµÄÊÂÎï¡£ÊʺÏÓÚ3µ½10ËêµÄ¶ùͯʹÓá£
µ÷ÊÔ»·¾³£ºWin2003¡¢OllyDBG¡¢PEiD¡¢LordPE¡¢ImportREC
×÷ÕßÉùÃ÷£ºÖ»ÊǸÐÐËȤ£¬Ã»ÓÐÆäËûÄ¿µÄ£¬Ê§ÎóÖ®´¦Çë´óÏÀ¶à¶à´Í½Ì¡£ÓÉÓÚARMÍÑÎÄ½Ï¶à£¬Ç°Ãæ¹ý³Ì´ÓÂÔ£¬ÒªµãÔÚºóÃæÍѿǺóµÄÊäÈë±íÐÞ¸´¡£
Íѿǹý³Ì£º
Ò»¡¢Ñ°ÕÒOEPºÍDUMP½ø³Ì
϶ÏBP WaitForDebugEvent£¬¶ÏϺó¶ÑÕ»ÈçÏ£º
´úÂë:
0012DAA8 004E1DD7 /CALL µ½ WaitForDebugEvent À´×Ô jigsaw.004E1DD1
0012DAAC 0012EB84 |pDebugEvent = 0012EB84
0012DAB0 000003E8 \Timeout = 1000. ms
ÔÙBP WriteProcessMemory
¾¹ýÒ»¸ö¶Ô»°¿òºóÊÇ:
´úÂë:
0012EB8C E4 0E 00 00 01 00 00 80 ?....€
0012EB94 00 00 00 00 00 00 00 00 ........
0012EB9C EC F7 4A 00 02 00 00 00 ì÷J....
0012EBA4 00 00 00 00 EC F7 4A 00 ....ì÷J.
¹Êoep=004AF7EC
ALT£«F9·µ»Ø,ËÑË÷ËùÓÐÃüÁî¡°or eax,FFFFFFF8¡±£¬ÏòÉÏÕÒµ½ÕâÀ
´úÂë:
004E23FA > \83BD D0F5FFFF>CMP DWORD PTR SS:[EBP-A30],0 //Çå0
004E2401 . 0F8C A9020000 JL jigsaw.004E26B0
004E2407 . 8B8D D0F5FFFF MOV ECX,DWORD PTR SS:[EBP-A30]
004E240D . 3B0D BCE75000 CMP ECX,DWORD PTR DS:[50E7BC]
004E2413 . 0F8D 97020000 JGE jigsaw.004E26B0
¡¡
004E24CD . 25 FF000000 AND EAX,0FF //ÕâÀ↑ʼPATCH
004E24D2 . 85C0 TEST EAX,EAX
²¹¶¡´úÂëΪ£º
´úÂë:
004E24CD FF85 D0F5FFFF INC DWORD PTR SS:[EBP-A30]
004E24D3 C705 C0E75000>MOV DWORD PTR DS:[50E7C0],1
004E24DD ^ E9 18FFFFFF JMP jigsaw1.004E23FA
ÔÚ4E26B0϶Ϻó£¬ÔËÐУ¬DUMP
¶þ¡¢IATÐÞ¸´£º
½«DUMP³öÀ´µÄ³ÌÐòOEP¸ÄΪAF7EC£¬È»ºóÓÃODÔØÈ룬¸ú×Ù¼¸²½¾Í¿ÉÒÔÕÒµ½IAT
´úÂë:
00401278 - FF25 28824B00 JMP DWORD PTR DS:[4B8228]
0040127E 8BC0 MOV EAX,EAX
00401280 - FF25 24824B00 JMP DWORD PTR DS:[4B8224]
00401286 8BC0 MOV EAX,EAX
00401288 - FF25 20824B00 JMP DWORD PTR DS:[4B8220]
IATµØÖ·4B817C£¬RVA=B817C
ÖØÐÂÔØÈëÖ÷³ÌÐò£¬BP DebugActiveProcess ÖжϺ󿴶ÑÕ»£º
´úÂë:
0012DAC4 004C1BDB /CALL µ½ DebugActiveProcess À´×Ô jigsaw.004C1BD5
0012DAC8 00000F2C \ProcessId = F2C
пªÒ»¸öOllyDbg£¬¸½¼Ó½ø³ÌID F2CµÄ×Ó½ø³Ì£¨Ã¿´Î×Ó½ø³ÌID»á²»Í¬£©
F9£¬ÔÙF12£¬»áÔÝÍ£ÔÚEP´¦£º
´úÂë:
004AF7EC >- EB FE JMP SHORT dumped_.004AF7EC //¸ÄΪ 55 8B
004AF7EE EC IN AL,DX
004AF7EF 83C4 EC ADD ESP,-14
Óýű¾×ª³Éµ¥½ø³Ì(Õâ½Å±¾²»´í£¬ºÜ·½±ãÓã¬×ª×Ô¿´Ñ©csjwamanµÄÎÄÕ£©
´úÂë:
//תµ¥½ø³Ì½Å±¾
msg "ÇëºöÂÔËùÓÐÒì³££¬²¢Ìí¼ÓºöÂÔC000001EÒì³££¬È»ºóÔËÐб¾½Å±¾£¡"
gpa "OpenMutexA","kernel32.dll"
bp $RESULT
esto
exec
pushad
pushfd
push edx
xor eax,eax
push eax
push eax
call kernel32.CreateMutexA
popfd
popad
jmp kernel32.OpenMutexA
ende
bc eip
msg "ÏÖÒÑת»»³Éµ¥½ø³Ì£¡"
ret
ÏÂÃæF9һϣ¬³öÏÖ¶Ô»°¿òʱHE GetModuleHandleA£¬ ÔÙµãÈ·¶¨£¬Shift+F9ÔËÐÐһϣ¬¶ÏϺóÐÞ¸ÄħÊõÌø×ª
´úÂë:
00CA97CD 8B0D C04CCD00 MOV ECX,DWORD PTR DS:[CD4CC0]
00CA97D3 89040E MOV DWORD PTR DS:[ESI+ECX],EAX
00CA97D6 A1 C04CCD00 MOV EAX,DWORD PTR DS:[CD4CC0]
00CA97DB 393C06 CMP DWORD PTR DS:[ESI+EAX],EDI
00CA97DE 75 16 JNZ SHORT 00CA97F6
00CA97E0 8D85 B4FEFFFF LEA EAX,DWORD PTR SS:[EBP-14C]
00CA97E6 50 PUSH EAX
00CA97E7 FF15 D0B0CC00 CALL DWORD PTR DS:[CCB0D0] ; kernel32.LoadLibraryA
00CA97ED 8B0D C04CCD00 MOV ECX,DWORD PTR DS:[CD4CC0]
00CA97F3 89040E MOV DWORD PTR DS:[ESI+ECX],EAX
00CA97F6 A1 C04CCD00 MOV EAX,DWORD PTR DS:[CD4CC0]
00CA97FB 393C06 CMP DWORD PTR DS:[ESI+EAX],EDI
00CA97FE 0F84 AD000000 JE 00CA98B1 //ÐÞ¸ÄÕâÀïΪJMP
F9ÔËÐУ¬Òì³£ÔÝÍ£
ÓÃIMRÐÞ¸´Ò»ÏÂIAT £¬RVA=B817C£¬Size=1000,Oep=F7EC£¬¼ôÈ¥ÎÞЧָÕëºóµÃµ½IAT±í£¬È»ºó±£´æÊ÷Îļþ£¨ÏÂÃæÒªÓõ½£©ÐÞ¸´DUMP¡£
Èý¡¢ÐÞ¸´
ÔËÐкó³öÏÖ´íÎ󣬸ú×ÙÁËÒ»ÏÂ,ÔËÐе½ÕâÀï³ö´í£¬
´úÂë:
004A69FC - FF25 7C884B00 JMP DWORD PTR DS:[4B887C]
´úÂë:
004B886C 00CAA6CA
004B8870 774EEA5C ole32.CoCreateGuid
004B8874 774ED78D ole32.StringFromGUID2
004B8878 00CAA742
004B887C 00CC6ED5//͉˕
004B8880 00CC7184//»¹ÓÐÕâÀï,Á½¸öº¯ÊýÖ¸Õë²»ÕýÈ·
004B8884 00CAA73D
004B8888 6E72656B
004B888C 32336C65
004B8890 6C6C642E
°´µÚ¶þ²½ÖØÀ´Ò»´Î£¬ÐÞ¸ÄÍêħÊõÌø×ªºó²»È¡ÏûGetModuleHandleA¶Ïµã£¬Êý¾Ý´°¿Ú¶¨Î»µ½004B8870£¬²»¶Ï°´F9Ö±µ½Ð´ÈëÊäÈë±íÖ¸Õë004B8870 Íê³É£¬µ«004B887CδдÈëÖ¸ÕëʱͣÏ£¬´Ëʱ°´Alt+M,´ò¿ªÄÚ´æ´°¿Ú£¬ËÑË÷×Ö´®CoCreateGuid»áÕÒµ½Ð´ÊäÈë±íÓõ½µÄº¯ÊýÃû£¬¿ÉÒÔÕÒµ½Á½¸öº¯ÊýEnvironºÍExpireCurrentKey£¬ÕâÁ½¸öÖ¸ÕëÊǵ÷ÓÃArmAccess.dllµÄÁ½¸öº¯Êý£¬ÎÒÒÔǰװ¹ý Armadillo4£¬ÓÚÊǰÑArmAccess.dll¸´ÖƵ½ÎļþËùÔÚĿ¼
´úÂë:
00D7B9E9 00 00 00 43 6F 43 72 65 61 74 65 47 75 69 64 00 ...CoCreateGuid.
00D7B9F9 53 74 72 69 6E 67 46 72 6F 6D 47 55 49 44 32 00 StringFromGUID2.
00D7BA09 00 61 72 6D 61 63 63 65 73 73 2E 64 6C 6C 00 7C .armaccess.dll.|
00D7BA19 88 0B 00 02 00 00 00 45 6E 76 69 72 6F 6E 00 45 ?....Environ.E
00D7BA29 78 70 69 72 65 43 75 72 72 65 6E 74 4B 65 79 00 xpireCurrentKey.
ÓüÇʱ¾´ò¿ªÒÔǰ±£´æµÄIATÎļþ£¬ÔÚ×îºóÌíÉÏÁ½¸öÖ¸ÕëÃû£¬ÖØÐÂÔØÈëÊ÷Îļþ£¬ÔÙÐÞ¸´×ª´¢Îļþ£¬OKÁË¡£
´úÂë:
FThunk: 000B887C NbFunc: 00000002
1 000B887C ArmAccess.dll 0011 Environ
1 000B8880 ArmAccess.dll 0144 ExpireCurrentKey
×îºó£¬ÔٴθÐлFLYµÄÖ¸µ¼¡£