<-------------Code Snippet------------->

typedef void (*fcnPatchCallBack) (DWORD addr);

fcnPatchCallBack fcn(DWORD addr) {

char str[256];

sprintf(str,”Patch applied at address %X”, addr);

::MessageBox(NULL, str, DEFAULT_MSG_CAPTION,

MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL);

}

BYTE iPatchDataInj[87] ={

0x90, 0x90, 0x90, 0x90, 0x90, 0xE9, 0x01, 0x00, 0x00, 0x00, 0xBC, 0x8B, 0x45, 0xFC, 0x8B,

0x40, 0x14, 0xE8, 0xC2, 0x21, 0xED, 0xFF, 0x8B, 0x45, 0xFC, 0x8B, 0x58, 0x1C, 0x85, 0xDB,

0x74, 0x10, 0x8B, 0xC3, 0xE8, 0x01, 0xB1, 0xF5, 0xFF, 0x8B, 0xD0, 0x8B, 0xC3, 0xE8, 0x84,

0xB3, 0xF5, 0xFF, 0x8B, 0x45, 0xFC, 0x8B, 0x40, 0x20, 0x85, 0xC0, 0x74, 0x07, 0x33, 0xD2,

0xE8, 0x17, 0x7C, 0xE8, 0xFF, 0xC6, 0x45, 0xFB, 0x01, 0x8B, 0x45, 0xFC, 0xC6, 0x40, 0x19,

0x00, 0xEB, 0x04, 0x80, 0x8E, 0x8C, 0x06, 0x90, 0x90, 0x90, 0x90, 0x90 };

PushPatchVector(stkPatches, 0x005C684C, NULL, iPatchDataInj, 87, fcn);

<-------------End Code Snippet------------->

005EFD7F

90 90 90 90 90 E9 01 00 00 00 B5 8B C3 E8 0B D2

 _____é_...μ‹ÃèÒ

005EFD8F

FF FF EB 04 EA 04 86 E6 90 90 90 90 90

 ÿÿë_ê_†æ_____

<-------------Code Snippet------------->

// =======================================

// Olly File Translator 1.0 by ThunderPwr

// 03/03/2005 22.02.03

// translating file utility

// =======================================

#define IMAXINDEXINJ 29// Patch size

// --------------------------------------------------------------------------------------

// Definition about the addresses where to apply the patches.

// --------------------------------------------------------------------------------------

DWORD dwPatchaddrInj[IMAXINDEXINJ] = { 0x005EFD7F, 0x005EFD80, 0x005EFD81, 0x005EFD82,

0x005EFD83, 0x005EFD84, 0x005EFD85, 0x005EFD86,

0x005EFD87, 0x005EFD88, 0x005EFD89, 0x005EFD8A,

0x005EFD8B, 0x005EFD8C, 0x005EFD8D, 0x005EFD8E,

0x005EFD8F, 0x005EFD90, 0x005EFD91, 0x005EFD92,

0x005EFD93, 0x005EFD94, 0x005EFD95, 0x005EFD96,

0x005EFD97, 0x005EFD98, 0x005EFD99, 0x005EFD9A,

0x005EFD9B };

// --------------------------------------------------------------------------------------

// Definition about the patching value

// --------------------------------------------------------------------------------------

int iPatchDataInj[IMAXINDEXINJ] ={ 0x90, 0x90, 0x90, 0x90,

0x90, 0xE9, 0x01, 0x00,

0x00, 0x00, 0xB5, 0x8B,

0xC3, 0xE8, 0x0B, 0xD2,

0xFF, 0xFF, 0xEB, 0x04,

0xEA, 0x04, 0x86, 0xE6,

0x90, 0x90, 0x90, 0x90,

0x90 };

<-------------End Code Snippet------------->

<-------------Code Snippet------------->

#include "Loader.h"

int main(int argc, char** argv)

{

Loader loader;

int nRetCode=loader.DoMyJob(argc, argv);

return nRetCode;

}

<-------------End Code Snippet------------->

<-------------Code Snippet LoaderActions.h------------->

#include "ShubLoaderCore.h"

class Loader: public ShubLoaderCore {

public:

Loader();

~Loader();

BOOL SetVictimDetails(/*OUT*/ TextString &victimFileName);

BOOL InitializePatchStack(/*OUT*/ growing_arraystack<Patch> &stkPatches);

BOOL ActionsBeforeCreateProc();

BOOL ActionsAfterCreateProc();

BOOL ActionsBeforeGateProcedure();

BOOL GateProcedure();

BOOL ActionsAfterGateProcedure();

BOOL ActionsBeforeClosingLoader();

};

<-------------End Code Snippet LoaderActions.h------------->

<-------------Code Snippet LoaderActions.cpp------------->

#include "LoaderActions.h"

//////////////////////////////////////////////////////////////////////////

Loader::Loader()

{

//TODO: insert specific actions if you require additional initialization

SetStartingMsg("Loader working...wait a little\nCreditz 2 Shub-Nigurrath & ThunderPwr [at] ARTEam");

}

Loader::~Loader()

{

//TODO: insert specific actions if you require additional de-initialization

}

//////////////////////////////////////////////////////////////////////////

//Receives

//- the Stack of Patch elements that must be properly filled. The variable to use is stkPatches!

//- the victim file name, containing a valid path to the patched file

BOOL Loader::InitializePatchStack(growing_arraystack<Patch> &stkPatches)

{

//////////////////////////////////////////////////////////////////////////

// This is the filling of the patches stack.

// you can use one of the constructors available.

// - The first only requires the patch address and the new byte so no controls will be

// performed later, the loader will only do a simply write to that memory section,

// regardless of the read value.

// - The second way, used here is to also add the original bytes, doing so the loader

// will also check if the byte read at the memory location specified is equal to the

// original byte you expected to be there. If not the patch is not applied and the msg

// buffer is set according.

// - The third one allows to specify a callback which is called when trying to perform

// the patch.

// Note that the patches are all applied subsequently after the gate condition is met

// (see GateProcedure())

//NB 0x00 must explicitly be casted to BYTE because otherwise the complier confuses

//it with a NULL pointer and doesn't know which constructor of class Patch to use.

// Example patches which also checks against the original bytes. If the original byte is

// different the Loader will issue and error BEFORE applying the patch

stkPatches.push(Patch(0x0044337C, 0x74, 0xEB));

stkPatches.push(Patch(0x005E5669, 0x75, 0xEB));

stkPatches.push(Patch(0x005F1552, 0x75, 0xEB));

stkPatches.push(Patch(0x005E626E, 0x75, 0xEB));

stkPatches.push(Patch(0x005E67D0, 0x75, 0xEB));

stkPatches.push(Patch(0x005E6921, 0x7E, 0xEB));

//Example of patches which don’t check against the original bytes

stkPatches.push(Patch(0x005F3898, 0x41)); //A

stkPatches.push(Patch(0x005F3899, 0x52)); //R

stkPatches.push(Patch(0x005F389A, 0x54)); //T

stkPatches.push(Patch(0x005F389B, 0x65)); //e

stkPatches.push(Patch(0x005F389C, 0x61)); //a

stkPatches.push(Patch(0x005F389D, 0x6D)); //m

stkPatches.push(Patch(0x005F389E,(BYTE)0x00)); //end string

//0x00 must explicitly be casted to BYTE because otherwise the complier confuses

//it with a NULL pointer and doesn't know which constructor of class Patch to use.

stkPatches.push(Patch(0x005F37C2, 0x75, (BYTE)0x00));

//Injected code sections.

BYTE iPatchDataInj[87] ={

0x90, 0x90, 0x90, 0x90, 0x90, 0xE9, 0x01, 0x00, 0x00, 0x00, 0xBC, 0x8B, 0x45, 0xFC,

0x8B, 0x40, 0x14, 0xE8, 0xC2, 0x21, 0xED, 0xFF, 0x8B, 0x45, 0xFC, 0x8B, 0x58, 0x1C,

0x85, 0xDB ,0x74, 0x10, 0x8B, 0xC3, 0xE8, 0x01, 0xB1, 0xF5, 0xFF, 0x8B, 0xD0, 0x8B,

0xC3, 0xE8, 0x84, 0xB3, 0xF5, 0xFF, 0x8B, 0x45, 0xFC, 0x8B, 0x40, 0x20, 0x85, 0xC0,

0x74, 0x07, 0x33, 0xD2, 0xE8, 0x17, 0x7C, 0xE8, 0xFF, 0xC6, 0x45, 0xFB, 0x01, 0x8B,

0x45, 0xFC, 0xC6, 0x40, 0x19, 0x00, 0xEB, 0x04, 0x80, 0x8E, 0x8C, 0x06, 0x90, 0x90,

0x90, 0x90, 0x90 };

PushPatchVector(stkPatches, 0x005C684C, NULL, iPatchDataInj, 87, NULL);

return TRUE;

}

//////////////////////////////////////////////////////////////////////////

//////////////////////////////////////////////////////////////////////////

//Simply used to specify the victim's filename, received the storing variable.

BOOL Loader::SetVictimDetails(TextString &victimFileName)

{

victimFileName=TextString(".\\_TargetProgram.exe");

//Set this parameter to true when you want the loader to check the CRC of the file!

SetVictimCRC(0x8281dfe6);

return TRUE;

}

// It is called just before calling the GateProceduce, then should contain steps required to perform the action or special settings..

BOOL Loader::ActionsBeforeGateProcedure()

{

return TRUE;

}

// The function GateProcedure must always be defined with this prototype.

// Returned value is TRUE when the matching condition required to start the patch is met.

// Often this function simply checks against a specified DWORD value in a specified

// memory location or the presence of a specific window, after which the patch can be successfully

// applied.

BOOL Loader::GateProcedure()

{

BOOL bRet=FALSE;

//Enum all the windows starting from the desktop, one by one, also the

//hidden windows. Each handle is passed to EnumWindowsProc which decides

//what to do with that handle. Actually it returns if it's the victim's window.

EnumDesktopWindows(NULL, EnumWindowsProc, (LPARAM)&bRet);

return bRet;

}

BOOL Loader::ActionsAfterGateProcedure()

{

//Stop debugger action and let program run freely

DWORD dwProcessId = GetProcessId(GetPI()->hProcess);

BOOL bDbgStopFlag = DebugActiveProcessStop(dwProcessId);

return TRUE;

}

//This function is called just before the call to CreateProcess. Could be left empty.

BOOL Loader::ActionsBeforeCreateProc()

{

return TRUE;

}

//This function is called just before the process has been created but it is still in waiting mode

BOOL Loader::ActionsAfterCreateProc()

{

HideDebugger(GetPI()->hThread, GetPI()->hProcess);

return TRUE;

}

//This function is called just before closing the loader, after all the actions have been performed.

BOOL Loader::ActionsBeforeClosingLoader()

{

return TRUE;

}

//////////////////////////////////////////////////////////////////////////////////

//Callback of EnumDesktopWindows

BOOL CALLBACK EnumWindowsProc(

HWND hWnd, // handle to parent window

LPARAM lParam // application-defined value

)

{

char ClassName[256];

//Retrieve the classname of the given handle

GetClassName(hWnd,ClassName, 256);

char caption[256];

//Retrieve the caption of the given handle

GetWindowText(hWnd, caption,256);

//Check of the window I want to find, It's specific of the application

//We have to wait till the window is visible because all the checks happens before

//this point.

if(strstr(caption,"Application titlebar")!=0 &&

IsWindowVisible(hWnd) &&

_stricmp(ClassName,"TMainForm")==0)

{

//a little of tricky casting required to return the final BOOL to the caller,

//via an LPARAM parameter, which after all is a generic LPVOID.

BOOL *flag=(BOOL*)lParam;

*flag=TRUE;

return FALSE;

}

return TRUE;

}

<-------------End Code Snippet LoaderActions.cpp------------->

注意

我们成功地在几个用AsProtect壳保护的目标上测试了这个技巧 (在打补丁之前等待某个给定的窗口)。因为所使用的API函数在Windows 9x及其后版本上是可用的，所以我们做的装载器相当小而且对所有Windows版本兼容。调试器装载器在老的Windows版本上可能会有一些问题。我们做的框架负责处理所有兼容性问题，而它只是在不支持的Windows版本上不执行特定操作。如此，装载器不会使系统当机，但是可能会失效。

<-------------Code Snippet LoaderActions.cpp------------->

//Simply used to specify the victim's filename, received the storing variable.

BOOL Loader::SetVictimDetails(TextString &victimFileName)

{

victimFileName=TextString(".\\_TargetProgram.exe");

//Set this parameter to true when you want the loader to check the CRC of the file!

SetVictimCRC(0x8281dfe6);

SetCreateProcessFlags(DEBUG_PROCESS | DEBUG_ONLY_THIS_PROCESS | CREATE_NEW_CONSOLE);

return TRUE;

}

<-------------End Code Snippet LoaderActions.cpp------------->

<-------------Code Snippet LoaderActions.cpp------------->

BOOL Loader::GateProcedure()

{

BOOL bRet=FALSE;

DEBUG_EVENT DebugEv; // debugging event information

DWORD dwContinueStatus = DBG_CONTINUE; // exception continuation

// Define the CONTEXT structure used to load the victim process context

// when debugged process break due to exception event

CONTEXT victimContext;

int iExceptionCounter = 0;

BYTE OridataRead[2];

try {

for(;;)

{

// Wait for a debugging event to occur. The second parameter indicates

// that the function does not return until a debugging event occurs.

// We are waiting for infinite time, then wait for each Debug Event.

WaitForDebugEvent(&DebugEv, INFINITE);

// Process the debugging event code.

switch (DebugEv.dwDebugEventCode)

{

case EXCEPTION_DEBUG_EVENT: {

// Process the exception code. When handling

// exceptions, remember to set the continuation

// status parameter (dwContinueStatus). This value

// is used by the ContinueDebugEvent function.

// Increment exception counter (not used)

iExceptionCounter++;

#ifdef _DEBUG

// Show the current exception number

char str[256];

sprintf(str,"Exception number %d", iExceptionCounter);

::MessageBox(NULL, str, DEFAULT_MSG_CAPTION, MB_OK);

#endif

// Check if this is the right exception by reading the context

// structure for the victim process. Before to do it set the

// ContextFlags to READ_ALL

victimContext.ContextFlags = 0x1003F;

// Fill the process CONTEXT with the process information

GetThreadContext(GetPI()->hThread , &victimContext);

// Now I've to scan the process memory in order to see if I

// can found the PUSH 0C instruction (19 byte after exception)

ReadProcessMemory(GetPI()->hProcess,

(LPVOID)((victimContext.Eip) + 19),

OridataRead, 2, NULL);

//6A 0C PUSH 0C

if ((OridataRead[0] == 0x6A) && (OridataRead[1] == 0x0C))

{

// Key location found, now we can apply the patch

#ifdef _DEBUG

char str[256];

sprintf(str,"Found PUSH 0C location");

MessageBox(NULL, str, DEFAULT_MSG_CAPTION, MB_OK);

#endif

throw TRUE; //jump to the catch block at the end

}

// Debugger’s Exception handler

switch(DebugEv.u.Exception.ExceptionRecord.ExceptionCode)

{

case EXCEPTION_ACCESS_VIOLATION: {

// First chance: Pass this on to the system.

// Last chance: Display an appropriate error.

dwContinueStatus = DBG_EXCEPTION_NOT_HANDLED;

}

break;

case EXCEPTION_BREAKPOINT: {

// First chance: Display the current

// instruction and register values.

}

break;

case EXCEPTION_DATATYPE_MISALIGNMENT: {

// First chance: Pass this on to the system.

// Last chance: Display an appropriate error.

}

break;

case EXCEPTION_SINGLE_STEP: {

// First chance: Update the display of the

// current instruction and register values.

}

break;

case DBG_CONTROL_C: {

// First chance: Pass this on to the system.

// Last chance: Display an appropriate error.

}

break;

default: {

// Handle other exceptions.

}

break;

}

}

case CREATE_THREAD_DEBUG_EVENT: {

// As needed, examine or change the thread's registers

// with the GetThreadContext and SetThreadContext functions;

// and suspend and resume thread execution with the

// SuspendThread and ResumeThread functions.

}

break;

case CREATE_PROCESS_DEBUG_EVENT: {

// As needed, examine or change the registers of the

// process's initial thread with the GetThreadContext and

// SetThreadContext functions; read from and write to the

// process's virtual memory with the ReadProcessMemory and

// WriteProcessMemory functions; and suspend and resume

// thread execution with the SuspendThread and ResumeThread

// functions. Be sure to close the handle to the process image

// file with CloseHandle.

dwContinueStatus = DBG_CONTINUE;

}

break;

case EXIT_THREAD_DEBUG_EVENT: {

// Display the thread's exit code.

}

break;

case EXIT_PROCESS_DEBUG_EVENT: {

// Target Process is closed from user, then we have

// to stop the debugger work and exit from loader

// Exit form loader

ContinueDebugEvent(DebugEv.dwProcessId,DebugEv.dwThreadId,

DBG_CONTINUE);

throw FALSE;

}

break;

case LOAD_DLL_DEBUG_EVENT: {

// Read the debugging information included in the newly

// loaded DLL. Be sure to close the handle to the loaded DLL

// with CloseHandle.

}

break;

case UNLOAD_DLL_DEBUG_EVENT: {

// Display a message that the DLL has been unloaded.

}

break;

case OUTPUT_DEBUG_STRING_EVENT: {

// Display the output debugging string.

}

break;

}

// Resume executing the thread that reported the debugging event.

ContinueDebugEvent(DebugEv.dwProcessId,DebugEv.dwThreadId, dwContinueStatus);

} //end for(;;)

} //end try

catch(BOOL bRet) {

return bRet; //gate condition met, returns to the framework!

}

}

<-------------End Code Snippet LoaderActions.cpp------------->

<-------------Code Snippet------------->

// Process the exception code. When handling

// exceptions, remember to set the continuation

// status parameter (dwContinueStatus). This value

// is used by the ContinueDebugEvent function.

// Increment exception counter (not used)

iExceptionCounter++;

#ifdef _DEBUG

// Show the current exception number

char str[256];

sprintf(str,"Exception number %d", iExceptionCounter);

::MessageBox(NULL, str, DEFAULT_MSG_CAPTION, MB_OK);

#endif

// Check if this is the right exception by reading the context

// structure for the victim process. Before to do it set the

// ContextFlags to READ_ALL

victimContext.ContextFlags = 0x1003F;

// Fill the process CONTEXT with the process information

GetThreadContext(GetPI()->hThread , &victimContext);

// Now I've to scan the process memory in order to see if I

// can found the PUSH 0C instruction (19 byte after exception)

ReadProcessMemory(GetPI()->hProcess, (LPVOID)((victimContext.Eip) + 19), OridataRead, 2, NULL);

//6A 0C PUSH 0C

if ((OridataRead[0] == 0x6A) && (OridataRead[1] == 0x0C))

{

// Key location found, now we can apply the patch

#ifdef _DEBUG

char str[256];

sprintf(str,"Found PUSH 0C location");

MessageBox(NULL, str, DEFAULT_MSG_CAPTION, MB_OK);

#endif

throw TRUE; //jump to the catch block at the end

}

<-------------End Code Snippet LoaderActions.cpp------------->

注意

你也许对于这个方式的可应用性有一点困惑，那么我们告诉你一个普遍原则：即使目标使用一些内存反窜改保护或者检查其自身代码的内存CRC以防轻易地修改进程内存，你还是能够给程序打补丁。API函数Set/GetThreadContext让你可以在一个给定的异常点上读取和设定所有的标志位和寄存器。例如，我们可以用它们若干次改变TEST或CMP指令的执行结果，即操纵上下文 (恰如你在OllyDbg中所做的那样)。关键是要在适当的时机挂起目标程序、把控制权交给装载器。其具体做法不在本教程的讨论范围之列，总之一句话，用于复杂程序的智能装载器既不需要在磁盘上也不需要在内存中修改任何目标代码。