好友 阅读权限 25
听众 最后登录 1970-1-1
本帖最后由 demoscene 于 2010-6-16 14:37 编辑 据说这里某BOSS身上掉下来的装备。BOSS是谁?不清楚，貌似程序的区段名中有一个神奇的字符串 1.分析 入口。貌似是一堆垃圾指令，直接F7。 入口: call 0040CD8D jnz short 0000CDDBimul edi , dword ptr [edx +61], 70ins byte ptr es :[edi ], dx imul ebp , dword ptr [esi +65], 796200jbe short 0040CDEC jb short 0040CE02F7走一小段后到下面这里， push ebp mov ebp , esp sub esp , 19Cpush ebx push esi push edi call 0040C000mov esi , eax ; ;获取Kernel32.dll基址 push 0push esi xor eax , eax mov eax , dword ptr fs :[eax +30] ; ;PEB mov eax , dword ptr [eax +C] ; ;PEB_LDR_DATA mov esi , dword ptr [eax +1C]lods dword ptr [esi ] ; ;InInitializationOrderModuleList mov eax , dword ptr [eax +8] ; ;Kernel32.dll->BaseAddress pop esi retn 返回继续 push C97C1FFF ; ;hash值 push esi push 1call 0040C5F0 ; 获取GetProcAddress地址 test eax , eax ; ;获取成功? mov dword ptr [ebp -2C], eax sub esp , 0Cpush ebx push ebp mov ebp , dword ptr [esp +1C]push esi test ebp , ebp push edi mov dword ptr [esp +10], 0je 0040C71Emov eax , dword ptr [esp +20]test eax , eax je short 0040C621mov eax , dword ptr [esp +28]test eax , eax je 0040C71Ejmp short 0040C62Dmov eax , dword ptr [esp +2C]test eax , eax je 0040C71Ecmp word ptr [ebp ], 5A4D ; ;'ZM' jnz 0040C71Emov eax , dword ptr [ebp +3C]add eax , ebp cmp dword ptr [eax ], 4550 ; ;'EP' jnz 0040C71Emov eax , dword ptr [eax +78] ; ;IMAGE_EXPORT_DESCRIPTOR RVA add eax , ebp cmp eax , ebp je 0040C71E ; ;导出表是否为0 mov ecx , dword ptr [eax +1C] ; ;-> AddressOfFunctions mov ebx , dword ptr [eax +20] ; ;--AddressOfNames mov esi , dword ptr [eax +18] ; ;--NumberOfNames add ecx , ebp mov dword ptr [esp +18], ecx mov ecx , dword ptr [eax +24] ; ;--AddressOFNameOrdinals add ebx , ebp add ecx , ebp mov eax , esi dec esi test eax , eax mov dword ptr [esp +24], ecx mov dword ptr [esp +14], esi je 0040C71E ; 0040C71E mov edx , dword ptr [ebx ] ; ;edx ->AddressOfNames RVA mov eax , dword ptr [esp +20]add edx , ebp ; ;VA test eax , eax ; ;这里的eax是一个标志位，上层函数传进来的，如果是1表明是壳要调用的函数。采用hash扫描的方式获取函数地址 je short 0040C6AC ; ;否则肢解通过API名字获取函数地址 mov edi , edx or ecx , FFFFFFFFxor eax , eax repne scas byte ptr es :[edi ] ; ;计算API名字的长度 not ecx dec ecx push ecx push edx ; ;edx =API名字 call 0040C570 ; ;根据API名字计算出一个hash值 mov ecx , dword ptr [esp +30]add esp , 8cmp ecx , eax ; ;比较是否是要找的函数 je short 0040C708jmp short 0040C6E1mov esi , dword ptr [esp +2C] ; ;ESI ＝ API名字 mov cl , byte ptr [edx ]mov al , cl cmp cl , byte ptr [esi ] ; ;比较是否相等 jnz short 0040C6D4test al , al je short 0040C6D0mov cl , byte ptr [edx +1]mov al , cl cmp cl , byte ptr [esi +1]jnz short 0040C6D4 ; ;继续比较下一个字符 add edx , 2 ; ;加2，它隔了一个字符没比较 add esi , 2test al , al jnz short 0040C6B0 ; ;是否字符串末尾 xor eax , eax ; ;找到后会到这里 jmp short 0040C6D9 ; 0040C6D9 sbb eax , eax sbb eax , -1test eax , eax je short 0040C708 ; ;找到相同的API名字，跳 mov esi , dword ptr [esp +14]mov edx , dword ptr [esp +24]add ebx , 4 ; AddressOfNames +4 add edx , 2mov dword ptr [esp +24], edx mov edx , esi dec esi test edx , edx mov dword ptr [esp +14], esi jnz short 0040C680mov eax , dword ptr [esp +10]pop edi pop esi pop ebp pop ebx add esp , 0Cretn 10mov ecx , dword ptr [esp +24] ; ;跳到这 mov edx , dword ptr [esp +18] ; ;edx = AddressOfFunctions xor eax , eax mov ax , word ptr [ecx ] ; ;ax =引出序数 mov eax , dword ptr [edx +eax *4] ; eax = API 函数rva 0040C718 03C5 add eax, ebp ; ;加基址 mov dword ptr [esp +10], eax mov eax , dword ptr [esp +10] ; 通过EAX返回 pop edi pop esi pop ebp pop ebx add esp , 0Cretn 10返回继续 call 0040C5F0 ; 获取GetProcAddress地址 test eax , eax ; ;获取成功? mov dword ptr [ebp -2C], eax je 0040CD51push 0push B1866570push esi push 1call 0040C5F0mov ebx , eax ; ;获取GetModuleHandleA地址 test ebx , ebx mov dword ptr [ebp -30], ebx je 0040CD51push 0push 3FC1BD8Dpush esi push 1call 0040C5F0 ; ;获取LoadLibraryA test eax , eax mov dword ptr [ebp -24], eax je 0040CD51push 0push 9CE0D4Apush esi push 1call 0040C5F0mov edi , eax ; ;获取VirtualAlloc地址 test edi , edi mov dword ptr [ebp -20], edi je 0040CD51push 0push CD53F5DDpush esi push 1call 0040C5F0test eax , eax ; 获取VirtualFree地址 mov dword ptr [ebp -C], eax je 0040CD51call 0040C4C0 ; 0040C4C0 and eax , 0FF ; ;里面有个SEH，不知道是干什么的。直接在下面F4 push 0mov dword ptr [ebp -28], eax call ebx ; ;GetModuleHandleA mov ebx , eax test ebx , ebx je 0040CD51 ; 0040CD51 push 1Cpush edi ; ;kernel32.VirtualAlloc call 0040C540 ; ;检测VirtualAlloc前1C个字节是否被下断 push esi mov esi , dword ptr [esp +C]xor ecx , ecx test esi , esi jle short 0040C55F ; 0040C55F mov eax , dword ptr [esp +8]mov dl , byte ptr [eax ]xor dl , 55cmp dl , 99 ; ;99^55 =CC je short 0040C563 ; 0040C563 inc ecx inc eax cmp ecx , esi jl short 0040C54F ; 0040C54F xor eax , eax pop esi retn mov eax , 1pop esi 返回继续 mov dword ptr [ebp -1C], eax mov eax , dword ptr [ebp -24]push 32push eax call 0040C540 ; ;检测LoadLibraryA mov esi , dword ptr [ebp -1C]xor ecx , ecx add esi , eax mov eax , dword ptr [ebx +3C]add eax , ebx ; ;PE头 mov dword ptr [ebp -1C], esi mov cx , word ptr [eax +14] ; ;SizeOfoptionalHeader mov esi , dword ptr [ecx +eax +2C] ; 代码段->PointerToRawData mov edx , dword ptr [ecx +eax +28] ; ;SizeOfRawData lea eax , dword ptr [ecx +eax +18] ; ;Name add esi , ebx push esi mov dword ptr [ebp -10], eax mov dword ptr [ebp -18], edx call 0040C020 ; 0040C020 add esp , 14mov edi , eax push 4push 1000push edi push 0call dword ptr [ebp -20] ; ;VirtualAlloc申请内存 test eax , eax mov dword ptr [ebp -4], eax je 0040CD51push edi push eax mov eax , dword ptr [ebp -18]push eax push esi call 0040C430 ; 0040C430 mov edx , dword ptr [ebp -10]mov esi , dword ptr [ebp -4]lea ecx , dword ptr [edi -1]add esp , 10mov edi , dword ptr [edx +C]mov eax , ecx add edi , ebx push 8000shr ecx , 2rep movs dword ptr es :[edi ], dword ptr [esi ]mov ecx , eax push 0and ecx , 3rep movs byte ptr es :[edi ], byte ptr [esi ]mov ecx , dword ptr [ebp -4]push ecx call dword ptr [ebp -C]push 40D500call 0040C020 ; 0040C020 add esp , 4mov edi , eax push 40push 1000push 84push 0call dword ptr [ebp -20]mov esi , eax test esi , esi mov dword ptr [ebp -4], esi je 0040CD51 ; 0040CD51 push edi push esi push 0BApush 40D500call 0040C430 ; 貌似是处理OEP add esp , 10mov edx , 402018sub edx , esi push 40push 1000push 1000push 0mov dword ptr [esi +97], edx call dword ptr [ebp -20] ;VirtualAlloc lea ecx , dword ptr [ebx +6000]mov dword ptr [ebp -10], eax mov dword ptr [ebp -8], ecx mov eax , dword ptr [ecx +C]test eax , eax je 0040CD4C jmp short 0040CB38 mov ecx , dword ptr [ebp -8]mov eax , dword ptr [ecx ]test eax , eax jnz short 0040CB41 mov eax , dword ptr [ecx +10]mov edi , dword ptr [ecx +C]add eax , ebx mov dword ptr [ebp -14], eax mov eax , ebx add eax , edi push eax call dword ptr [ebp -24] ; ;LoadLibraryA mov esi, eax push 4push 1000mov dword ptr [ebp -34], esi mov eax , dword ptr [esi +3C]mov edi , dword ptr [eax +esi +50] ; SizeOfImage push edi push 0call dword ptr [ebp -20] ; VirtualAlloc test eax , eax mov dword ptr [ebp -18], eax je 0040CD51lea ecx , dword ptr [edi -1]mov edi , eax mov edx , ecx shr ecx , 2 ; ecx =循环次数 rep movs dword ptr es :[edi ], dword ptr [esi ] ; ;复制数据到申请的内存中 mov ecx , edx and ecx , 3rep movs byte ptr es :[edi ], byte ptr [esi ]mov esi , dword ptr [ebp -14]mov eax , dword ptr [esi ]test eax , eax je 0040CD38 ; 0040CD38 test eax , 80000000je short 0040CBC4 ; ;跳 mov ecx , dword ptr [ebp -1C]mov edx , dword ptr [ebp -28]xor eax , eax mov ax , word ptr [esi ]add eax , ecx add eax , edx mov edx , dword ptr [ebp -34]push eax push edx call dword ptr [ebp -2C]mov ecx , dword ptr [ebp -8]mov edi , dword ptr [ebp -10]mov edx , dword ptr [ecx +10]mov dword ptr [ebx +edx ], eax jmp 0040CD19 ; 0040CD19 lea esi , dword ptr [eax +ebx +2] ; ;跳到这 or ecx , FFFFFFFFmov edi , esi xor eax , eax repne scas byte ptr es :[edi ] ; ;strlen not ecx dec ecx lea edi , dword ptr [ebp -97]mov edx , ecx mov ecx , 18mov byte ptr [ebp -98], al rep stos dword ptr es :[edi ]stos word ptr es :[edi ]stos byte ptr es :[edi ]mov eax , 0je short 0040CC16 ; 0040CC16 mov edi , esi lea ecx , dword ptr [ebp -98]sub edi , ecx lea esi , dword ptr [ebp +eax -98] ; ;下面解密函数名字 mov cl , byte ptr [edi +esi ]sub cl , byte ptr [ebp -1C]sub cl , byte ptr [ebp -28]dec cl inc eax cmp eax , edx mov byte ptr [esi ], cl ; ;保存到堆栈 jb short 0040CBFD ; 0040CBFD mov eax , dword ptr [ebp -18] ; ;申请到的地址 lea edx , dword ptr [ebp -98] ; ;解密后的API名字 push edx push 0push eax push 0call 0040C5F0 ; ;获取API地址，注意是在申请的内存中的地址，这个函数前面已经说了 mov ecx , dword ptr [ebp -18]mov esi , eax mov eax , dword ptr [ecx +3C]add eax , ecx ; ;PE header mov edx , dword ptr [eax +78]add edx , ecx ; ;IMAGE_EXPORT_DESCRIPTOR test esi , esi je short 0040CCB9cmp esi , edx ; ;下面测试是否是转向函数 jb short 0040CCB9mov ecx , dword ptr [eax +7C]add ecx , edx cmp esi , ecx jnb short 0040CCB9 ; ;非转向函数，跳 mov al , byte ptr [esi ] ; ;如果是转向函数会运行到这里 mov edx , esi test al , al mov dword ptr [ebp -C], edx je short 0040CCB9cmp al , 2E ; 2E = '.' je short 0040CC66mov al , byte ptr [edx +1]inc edx test al , al jnz short 0040CC55 ; 循环在API名字中搜索 '.' mov dword ptr [ebp -C], edx jmp short 0040CCB9mov ecx , 40xor eax , eax lea edi , dword ptr [ebp -19B]mov byte ptr [ebp -19C], 0rep stos dword ptr es :[edi ]mov ecx , edx mov dword ptr [ebp -C], edx stos word ptr es :[edi ]sub ecx , esi test ecx , ecx stos byte ptr es :[edi ]jle short 0040CCB9 ; 0040CCB9 mov edx , ecx lea edi , dword ptr [ebp -19C] ; ;edi =API 名字 shr ecx , 2rep movs dword ptr es :[edi ], dword ptr [esi ]mov ecx , edx lea eax , dword ptr [ebp -19C]and ecx , 3push eax ; ;DLL 名字 rep movs byte ptr es :[edi ], byte ptr [esi ]call dword ptr [ebp -30] ; ;LoadLibraryA加载转向函数所在的DLL 0040CCA8 8B4D F4 mov ecx, dword ptr [ebp-C] inc ecx push ecx push 0push eax push 0call 0040C5F0 ; ;获取函数地址 mov esi , eax mov edi , dword ptr [ebp -10]mov edx , 40D420mov eax , edi xor esi , 2010 ; ;加密一下函数地址 mov ecx , dword ptr [edx ]push 4000mov dword ptr [eax ], ecx ;下面生成push xxxx ,jmp [xxxx]类型的跳到解密函数的指令 push 1000mov ecx , dword ptr [edx +4]push edi mov dword ptr [eax +4], ecx mov edx , dword ptr [edx +8]mov dword ptr [eax +8], edx mov dword ptr [edi +1], esi mov esi , dword ptr [ebp -8]mov eax , ebx add eax , dword ptr [esi +10] ; ;eax = IMAGE_THUNK_DATA push eax push ebx push ebx call 0040C870 ; 修改函数调用 mov eax , dword ptr [esi +10]mov edx , dword ptr [ebp -4]mov ecx , dword ptr [esp +14]push ebx push ebp mov ebp , dword ptr [esp +20]push esi mov esi , dword ptr [esp +1C]push edi mov edi , dword ptr [esp +14] ; ;edi = 基址 mov bl , 90mov edx , dword ptr [esp +1C] ; ;edx= IMAGE_THUNK_DATA lea eax , dword ptr [esp +28]push eax mov eax , dword ptr [esp +1C] ; ;eax = 基址 push edx push ebp push ecx push eax push edi call 0040C730 ; 0040C730 add esp , 18test eax , eax ; ;比较这个DLL是否已经处理完毕 mov ecx , dword ptr [esp +C] ; ;代码段大小 mov eax , dword ptr [esp +10]push ebx push ebp push esi push edi add eax , ecx xor edi , edi cmp ecx , eax mov esi , ecx jnb 0040C866 ; 0040C866 mov ebp , dword ptr [esp +14]add ecx , ebp ; ;ecx 代码段基址 mov edx , dword ptr [esp +24]mov ebx , dword ptr [ecx ]cmp ebx , edx ; ;循环搜索调用API的地方 jnz short 0040C7B8mov dl , byte ptr [ecx -2] ; ;下面一段比较调用API的方式 cmp dl , 0FFjnz short 0040C76Fmov bl , byte ptr [ecx -1]cmp bl , 15je short 0040C7C5 ; ;FF15 cmp bl , 25je short 0040C7DA ; ;FF25 cmp dl , 8Bjnz short 0040C7AE ; 0040C7AE mov bl , byte ptr [ecx -1]cmp bl , 1Dje short 0040C7EF ; ;8B1D cmp dl , dl jnz short 0040C7AEcmp bl , 0Dje short 0040C804 ; ;8B0D cmp dl , dl jnz short 0040C7AEcmp bl , 15je 0040C819 ; ;8B15 cmp dl , dl jnz short 0040C7AEcmp bl , 35je 0040C82E ; ;8B35 cmp dl , dl jnz short 0040C7AEmov dl , bl cmp dl , 3Dje 0040C843 ; ;8B3D cmp byte ptr [ecx -1], 0A1je 0040C858 ; ;A1 inc esi inc ecx cmp esi , eax jb short 0040C750mov eax , edi pop edi pop esi pop ebp pop ebx retn mov eax , dword ptr [esp +28]lea edi , dword ptr [esi +ebp -2]mov dword ptr [eax ], 1 ; ;FF15,返回1 mov eax , edi pop edi pop esi pop ebp pop ebx retn mov ecx , dword ptr [esp +28]lea edi , dword ptr [esi +ebp -2]mov eax , edi pop edi pop esi pop ebp mov dword ptr [ecx ], 2 ; ;FF125,返回2 pop ebx retn mov edx , dword ptr [esp +28]lea edi , dword ptr [esi +ebp -2]mov eax , edi pop edi pop esi pop ebp mov dword ptr [edx ], 3 ; ;8B1D 返回3 pop ebx retn mov eax , dword ptr [esp +28]lea edi , dword ptr [esi +ebp -2]mov dword ptr [eax ], 4 ; ;8B0D 返回4 mov eax , edi pop edi pop esi pop ebp pop ebx retn mov ecx , dword ptr [esp +28]lea edi , dword ptr [esi +ebp -2]mov eax , edi pop edi pop esi pop ebp mov dword ptr [ecx ], 5 ; ;8B15 返回5 pop ebx retn mov edx , dword ptr [esp +28]lea edi , dword ptr [esi +ebp -2]mov eax , edi pop edi pop esi pop ebp mov dword ptr [edx ], 6 ; ;8B35 返回6 pop ebx retn mov eax , dword ptr [esp +28]lea edi , dword ptr [esi +ebp -2]mov dword ptr [eax ], 7 ; ;8B3D 返回7 mov eax , edi pop edi pop esi pop ebp pop ebx retn mov ecx , dword ptr [esp +28]lea edi , dword ptr [esi +ebp -1]mov dword ptr [ecx ], 8 ; ;A1 返回8 mov eax , edi pop edi pop esi pop ebp pop ebx retn call 0040C730add esp , 18test eax , eax ; ;比较这个DLL是否已经处理完毕 je 0040C94Amov edx , dword ptr [esp +28] ; ;edx =返回的数字 mov ecx , eax sub ecx , edi ; ;减去基址，得到调用API处的 RVA add ecx , 6cmp edx , 1 ; ;返回的数字是否为1 jnz short 0040C8C8mov edx , esi ; ;edx =要指向的地址 mov byte ptr [eax ], 0E8 ; ;修改FF15为E8 0040C8BD 2BD0 sub edx, eax ; ;距离偏移 mov byte ptr [eax +5], bl ; ;填充一个字节 sub edx , 5mov dword ptr [eax +1], edx ; ;修改目的地址 cmp dword ptr [esp +28], 2 ; ;是否是FF25? jnz short 0040C8DFmov edx , esi 0040C8D1 C600 E9 mov byte pt [eax], 0E9 ;FF15改成E9 sub edx , eax mov byte ptr [eax +5], bl sub edx , 5mov dword ptr [eax +1], edx cmp dword ptr [esp +28], 3jnz short 0040C8F00040C8E6 C600 43 mov byte ptr [eax], 43 ;8B1D改成 43 mov byte ptr [eax +1], 0BBmov dword ptr [eax +2], esi cmp dword ptr [esp +28], 4jnz short 0040C901mov byte ptr [eax ], 41 ; ;8B0D改成41 mov byte ptr [eax +1], 0B9mov dword ptr [eax +2], esi cmp dword ptr [esp +28], 5jnz short 0040C912mov byte ptr [eax ], 42 ; ;8B15改成 42 mov byte ptr [eax +1], 0BAmov dword ptr [eax +2], esi cmp dword ptr [esp +28], 6jnz short 0040C9230040C919 C600 46 mov byte ptr eax], 46 ;8B35改成46 mov byte ptr [eax +1], 0BEmov dword ptr [eax +2], esi cmp dword ptr [esp +28], 7jnz short 0040C9340040C92A C600 47 mov byte ptr [eax], 47 ;8B3D 改成 47 mov byte ptr [eax +1], 0BFmov dword ptr [eax +2], esi cmp dword ptr [esp +28], 8jnz 0040C886 ; 0040C886 mov byte ptr [eax ], 0B8 ; ;A1改成B8 mov dword ptr [eax +1], esi jmp 0040C886 ; 0040C886 pop edi pop esi pop ebp pop ebx retn nop ;这里解密函数。加壳后的程序的API调用通过pu xxxx然后来到这里解密地址 pushad push eax mov eax , dword ptr [esp +24]xor eax , 2010mov dword ptr [esp +24], eax pop eax popad retn 继续返回继续 call 0040C870 ; 修改函数调用 mov eax , dword ptr [esi +10]mov edx , dword ptr [ebp -4]mov ecx , ebx push 200push 0add ecx , eax push edi push ecx push ebx push edx call 0040C870 ; 0040C870 mov ecx , esi mov esi , dword ptr [ebp -14]add esp , 30mov edx , dword ptr [ecx +10]add esi , 4 ; ;下一个IID add edx , 4add edi , 0Cmov dword ptr [ecx +10], edx mov eax , dword ptr [esi ]test eax , eax mov dword ptr [ebp -14], esi mov dword ptr [ebp -10], edi jnz 0040CB95 ; ;循环 mov eax , dword ptr [ebp -8]add eax , 14mov dword ptr [ebp -8], eax mov ecx , dword ptr [eax +C]test ecx , ecx jnz 0040CB35 ; ;循环 mov eax , dword ptr [ebp -4]call eax ; ;跳到OEP popad jnz short 0040CD5C ; 0040CD5C mov eax , 1retn 0Cpush 402000call 00400950 ; 00400950 retn 2.脱壳 先来总结一下对我们脱壳有用的信息。 。mov DLL_BASE, 0040cB51 //在这里mov RE_DLL_BASE, 0040cca8mov API_ADDR, 0040c718mov OEP, 003a0002bp 0040C8BD //1 FF15 bp 0040C8D1 //2 FF25bp 0040C8E6 //3 8B1Dbp 0040C919 //6 8b35bp 0040C92A //7 8B3D"x" //下硬件执行断点"x" "x" "x" loop :cmp eip ,0040cB51je dll_addresscmp eip ,0040cca8je dll_redirectcmp eip ,0040c718je api_addresscmp eip ,0040C8BDje handler1cmp eip ,0040C8D1je handler2cmp eip ,0040C8E6je handler3cmp eip ,0040C919je handler6cmp eip ,0040C92Aje handler7cmp eip ,003a0002je exitmov api_address,edx jmp loop mov dll_address,eax //保存DLL基址jmp loop mov dll_readdress,eax //保存转向API所在DLL基址mov re_flag,1 //设置DLL转向函数标志jmp loop mov api_address,eax //保存API函数RVAcmp re_flag,1 //判断是否是转向函数je re_api_addr add api_address,dll_address //加上DLL基址jmp loop add api_address,dll_readdress //加上转向函数所在DLL基址jmp loop mov re_flag,0 //清除转向函数标志mov edx ,api_address //修改edx 为正确的API地址jmp loop mov re_flag,0 //清除转向函数标志mov edx ,api_address //修改edx 为正确的API地址jmp loop mov re_flag,0 //清除转向函数标志 eip ,A,90 //用nop 填充掉原来的指令eip //下面要修改这里的指令，为防止这里的CC断点消失，我们暂时清除断点eip ,"mov byte ptr [eax], 0BB" //修改指令，改成 B8的形式mov tmpaddr,eip add tmpaddr,3 //tmpaddr指向下一条指令"mov dword ptr [eax+1], esi" //修改指令bp eip //重新下断mov esi ,api_addressjmp loop mov re_flag,0 //清除转向函数标志 mov esi ,api_address //修改esi 为正确的函数地址eip ,A,90 //nop 填充原始指令eip eip ,"mov byte ptr [eax], 0BE" //修改指令mov tmpaddr,eip add tmpaddr,3"mov dword ptr [eax+1], esi" //修改指令bp eip jmp loop mov re_flag,0eip eip ,A,90eip ,"mov byte ptr [eax], 0BF" //修改指令mov tmpaddr,eip add tmpaddr,3"mov dword ptr [eax+1], esi" //修改指令bp eip mov esi ,api_addresseax jmp loop ret 现在重载程序直接跑这个脚本。程序就会停在OEP处，当然这个OEP并不是我们想要的OEP 看一下OEP的代码 xor eax , eax pushfd mov dword ptr [esp ], ebp sub esp , 4mov dword ptr [esp ], esp pop ebp sub esp , 44mov eax , ecx sub eax , 14and eax , 0F8push eax add esp , -4mov dword ptr [esp ], esi pop eax call 7C812FBD ; kernel32.GetCommandLineA nop push esi push eax pop esi add esp , 4mov al , byte ptr [eax ]cmp al , 22jnz short 003A0047inc esi mov al , byte ptr [esi ]test al , al je short 003A003Fcmp al , 22jnz short 003A0034cmp byte ptr [esi ], 22jnz short 003A0051inc esi jmp short 003A0051cmp al , 20jle short 003A0051inc esi cmp byte ptr [esi ], 20jg short 003A004Bcmp byte ptr [esi ], 0je short 003A0061cmp byte ptr [esi ], 20jg short 003A0061inc esi cmp byte ptr [esi ], 0jnz short 003A0056xor ecx , ecx mov dword ptr [ebp -18], ecx inc ecx lea ecx , dword ptr [ebp -44]sub esp , 8mov dword ptr [esp +4], ecx add esp , 4call 7C801EF2 ; kernel32.GetStartupInfoA nop test byte ptr [ebp -18], 1mov eax , 0Aje short 003A0089movzx eax , word ptr [ebp -14]push eax push esi push 0push 0call 7C80B741 ; kernel32.GetModuleHandleA nop push eax call 004020B3 ; fuck_fix.004020B3 push eax push eax add esi , 8pop esi call 7C81CB12 ; kernel32.ExitProcess nop mov eax , esi mov esi , dword ptr [esp ]add esp , 4mov esp , ebp pop ebp retn API都已经修复成直接调用了。 还有一个 CharNextA函数被它直接模拟了，我们不管它，这对我们的程序没有影响。 而且这些代码类似于Aspr 的多态代码，当然这里没有花指令，如果再加点花指令估计代码很难读懂。 看下OEP的地址。003A0002显然不是我们的地址，这还是在申请的内存中。 我们把这些代码先复制一分保存，然后二进制复制一分。 到代码段找个空的地方把这段二进制粘贴进去。我这里找的是00405300 00405300新建个EIP， 然后对比刚才复制的保存代码，修正CALL的调用地址为保存的地址 xor eax , eax pushfd mov dword ptr [esp ], ebp sub esp , 4mov dword ptr [esp ], esp pop ebp sub esp , 44mov eax , ecx sub eax , 14and eax , 0F8push eax add esp , -4mov dword ptr [esp ], esi pop eax call 7C812FBD ; kernel32.GetCommandLineA nop push esi push eax pop esi add esp , 4mov al , byte ptr [eax ]cmp al , 22jnz short 00405347 ; 00405347 inc esi mov al , byte ptr [esi ]test al , al je short 0040533F ; 0040533F cmp al , 22jnz short 00405334 ; 00405334 cmp byte ptr [esi ], 22jnz short 00405351 ; 00405351 inc esi jmp short 00405351 ; 00405351 cmp al , 20jle short 00405351 ; 00405351 inc esi cmp byte ptr [esi ], 20jg short 0040534B ; 0040534B cmp byte ptr [esi ], 0je short 00405361 ; 00405361 cmp byte ptr [esi ], 20jg short 00405361 ; 00405361 inc esi cmp byte ptr [esi ], 0jnz short 00405356 ; 00405356 xor ecx , ecx mov dword ptr [ebp -18], ecx inc ecx lea ecx , dword ptr [ebp -44]sub esp , 8mov dword ptr [esp +4], ecx add esp , 4call 7C801EF2 ; kernel32.GetStartupInfoA nop test byte ptr [ebp -18], 1mov eax , 0Aje short 00405389 ; 00405389 movzx eax , word ptr [ebp -14]push eax push esi push 0push 0call 7C80B741 ; kernel32.GetModuleHandleA nop push eax call 004020B3 ; 004020B3 push eax push eax add esi , 8pop esi call 7C81CB12 ; kernel32.ExitProcess nop mov eax , esi mov esi , dword ptr [esp ]add esp , 4mov esp , ebp pop ebp retn 修复后，用UIF修复直接调用为间接调用 然后 Lordpe来dump .ImportRec修复就行了，。提醒下ImportRec不要先"按序号重建输入表".会造成不能跨平台的问题，多谢HyperChem的提醒 剩下的我就不演示了。 该收工了。哇咔咔
fuck_fix.rar
(20.45 KB, 下载次数: 27)
查看全部评分
[复制链接]
发表于 2010-6-16 14:22
发表于 2010-6-16 14:24
发表于 2010-6-16 14:25
发表于 2010-6-16 14:26
发表于 2010-6-16 14:33
