Èí¼þ´óС£º 2388 KB
Èí¼þÓïÑÔ£º Ó¢ÎÄ
Èí¼þÀà±ð£º ¹ú²úÈí¼þ / ¹²Ïí°æ / ͼÏñת»»
Ó¦ÓÃƽ̨£º Win9x/NT/2000/XP
¼ÓÈëʱ¼ä£º 2005-04-25 11:48:30
ÏÂÔØ´ÎÊý£º 209670
ÍƼöµÈ¼¶£º ****
¿ª ·¢ ÉÌ£º http://www.keksoft.com/
Èí¼þ½éÉÜ£º ħ·¨×ª»» ÊÇÒ»¸ö¹¦ÄÜÇ¿´óµÄͼÏñÅúÁ¿´¦Àíת»»Èí¼þ¡£Ëü°üÀ¨Í¼Ïñä¯ÀÀ¡¢ÅúÁ¿×ª»»(¿É×Ô¶¨Òå½Å±¾)¡¢×Ö·û»×ª»»¡¢Í¼ÏñÓÅ»¯¡¢²¶×½Í¼ÏñºÍ´´½¨EXE¿ÉÖ´ÐÐÎļþÁù´ó²¿·Ö¡£Ê¹ÓÃËü¿ÉÒÔÈÃÄãÖƶ¨×ª»»½Å±¾£¬È»ºó¸ù¾Ý½Å±¾¶ÔͼÏñ½øÐÐÅúÁ¿´¦Àíת»»¡£Ëü»¹Ö§³ÖWINDOWSÓÒ¼ü²Ëµ¥½øÐÐת»»²Ù×÷£¬Ä㻹¿ÉÒÔ×Ô¶¨ÒåWINDOWSÓÒ¼ü²Ëµ¥¡£Í¬Ê±Ëü»¹Äܽ«Í¼Ïñ´ò°üÉú³É.EXE¿ÉÖ´ÐÐÎļþ£¬È»ºó¿ÉÒÔÍÑÀëͼÏñä¯ÀÀÆ÷½øÐÐ×Ô¶¯²¥·Å¡£Ä§·¨×ª»»ÄÜÖ§³ÖÄ¿Ç°ËùÓÐÁ÷ÐеÄͼÏñ¸ñʽ£¬ËüµÄÊä³ö¸ñʽΪ£ºbmp¡¢jpg¡¢gif¡¢png¡¢tif¡¢pcx¡¢wmf¡¢emf¡¢tga¡¢ico¡¢wbmp£¬»¹°üÀ¨txt¡¢rtf¡¢htmµÈ×Ö·û»¸ñʽ¡£
¡¾×÷ÕßÉùÃ÷¡¿£ºÖ»ÊǸÐÐËȤ£¬Ã»ÓÐÆäËûÄ¿µÄ¡£Ê§ÎóÖ®´¦¾´ÇëÖîλ´óÏÀ´Í½Ì£¡
¡¾µ÷ÊÔ»·¾³¡¿£ºWinXP¡¢flyODBG¡¢PEiD¡¢LordPE¡¢ImportREC
¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª
¡¾Íѿǹý³Ì¡¿£º
ÕâÀïʹÓÃÐ޸İæOllyDbg£¬Èç¹ûʹÓÃ԰棬ÐèÒª´¦ÀíOutputDebugStringAÎÊÌâ
ÉèÖÃOllyDbgºöÂÔËùÓÐÆäËüÒ쳣ѡÏî¡£ÓÃIsDebug²å¼þÈ¥µôOllyDbgµÄµ÷ÊÔÆ÷±êÖ¾¡£
¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª
Ò»¡¢Ñ°ÕÒOEP+½âÂëDump
0061F743 55 push ebp
//½øÈëOllyDbgºóÔÝÍ£ÔÚÕâ
0061F744 8BEC mov ebp,esp
0061F746 6A FF push -1
0061F748 68 209B6400 push 00649B20
0061F74D 68 80F46100 push 0061F480
0061F752 64:A1 00000000 mov eax,dword ptr fs:[0]
0061F758 50 push eax
0061F759 64:8925 0000000>mov dword ptr fs:[0],esp
0061F760 83EC 58 sub esp,58
0061F763 53 push ebx
0061F764 56 push esi
0061F765 57 push edi
0061F766 8965 E8 mov dword ptr ss:[ebp-18],esp
0061F769 FF15 88416400 call dword ptr ds:[<&KERNEL32.GetVersion>]
BP WaitForDebugEvent
ÖжϺóÈ¡Ïû¶Ïµã£¬¿´¶ÑÕ»£º
0012BCB8 0060F8BF /CALL µ½ WaitForDebugEvent À´×Ô MAGCT.0060F8B9
0012BCBC 0012CD90 |pDebugEvent = 0012CD90
0012BCC0 000003E8 \Timeout = 1000. ms
ÔÚÊý¾Ý´°¿Ú¶¨Î»µ½0012CD90´¦£¬×¼±¸¿´OEPÖµ
½Ó×Å϶ϣºBP WriteProcessMemory
ÏÖÔÚÈ¥´úÂë´°¿ÚCtrl+G£º0060F8BF
Ctrl+FÔÚµ±Ç°Î»ÖÃÏÂËÑË÷ÃüÁor eax,0FFFFFFF8
ÕÒµ½µÚÒ»´¦ÔÚ0060FE8F´¦£¬ÔÚÆäÉÏcmp dword ptr ss:[ebp-A34],0´¦ÉèÖöϵ㡣
0060FE43 83BD CCF5FFFF 0>cmp dword ptr ss:[ebp-A34],0
//϶ϣ¬Shift+F9ÖжÏÏÂÀ´ °Ñ[ebp-A34]£½[0012CD7C]=000001B7Çå0 ¡ï
0060FE4A 0F8C A8020000 jl 006100F8
0060FE50 8B8D CCF5FFFF mov ecx,dword ptr ss:[ebp-A34]
0060FE56 3B0D 48AF6400 cmp ecx,dword ptr ds:[64AF48]
//×¢Òâ[64AF48] ¡ï
0060FE5C 0F8D 96020000 jge 006100F8
//½âÂë½áÊøºóÌøת006100F8 ÔÚ006100F8´¦ÏÂ¶Ï ¡ï
0060FE62 8B95 40F6FFFF mov edx,dword ptr ss:[ebp-9C0]
0060FE68 81E2 FF000000 and edx,0FF
0060FE6E 85D2 test edx,edx
0060FE70 0F84 AD000000 je 0060FF23
0060FE76 6A 00 push 0
0060FE78 8BB5 CCF5FFFF mov esi,dword ptr ss:[ebp-A34]
0060FE7E C1E6 04 shl esi,4
0060FE81 8B85 CCF5FFFF mov eax,dword ptr ss:[ebp-A34]
0060FE87 25 07000080 and eax,80000007
0060FE8C 79 05 jns short 0060FE93
0060FE8E 48 dec eax
0060FE8F 83C8 F8 or eax,FFFFFFF8
//ÕÒµ½ÕâÀï
0060FE92 40 inc eax
0060FE93 33C9 xor ecx,ecx
0060FE95 8A88 1C896400 mov cl,byte ptr ds:[eax+64891C]
0060FE9B 8B95 CCF5FFFF mov edx,dword ptr ss:[ebp-A34]
0060FEA1 81E2 07000080 and edx,80000007
0060FEA7 79 05 jns short 0060FEAE
0060FEA9 4A dec edx
0060FEAA 83CA F8 or edx,FFFFFFF8
0060FEAD 42 inc edx
0060FEAE 33C0 xor eax,eax
0060FEB0 8A82 1D896400 mov al,byte ptr ds:[edx+64891D]
0060FEB6 8B3C8D 70436400 mov edi,dword ptr ds:[ecx*4+644370]
0060FEBD 333C85 70436400 xor edi,dword ptr ds:[eax*4+644370]
0060FEC4 8B8D CCF5FFFF mov ecx,dword ptr ss:[ebp-A34]
0060FECA 81E1 07000080 and ecx,80000007
0060FED0 79 05 jns short 0060FED7
0060FED2 49 dec ecx
0060FED3 83C9 F8 or ecx,FFFFFFF8
0060FED6 41 inc ecx
0060FED7 33D2 xor edx,edx
0060FED9 8A91 1E896400 mov dl,byte ptr ds:[ecx+64891E]
0060FEDF 333C95 70436400 xor edi,dword ptr ds:[edx*4+644370]
0060FEE6 8B85 CCF5FFFF mov eax,dword ptr ss:[ebp-A34]
0060FEEC 99 cdq
0060FEED B9 1C000000 mov ecx,1C
0060FEF2 F7F9 idiv ecx
0060FEF4 8BCA mov ecx,edx
0060FEF6 D3EF shr edi,cl
0060FEF8 83E7 0F and edi,0F
0060FEFB 03F7 add esi,edi
0060FEFD 8B15 2CAF6400 mov edx,dword ptr ds:[64AF2C]
0060FF03 8D04B2 lea eax,dword ptr ds:[edx+esi*4]
0060FF06 50 push eax
0060FF07 8B8D CCF5FFFF mov ecx,dword ptr ss:[ebp-A34]
0060FF0D 51 push ecx
0060FF0E E8 2F210000 call 00612042
0060FF13 83C4 0C add esp,0C
0060FF16 25 FF000000 and eax,0FF
//ÕâÀïPatch ¡ï
0060FF1B 85C0 test eax,eax
0060FF1D 0F84 D5010000 je 006100F8
Patch´úÂ룺
0060FF16 FF85 CCF5FFFF inc dword ptr ss:[ebp-0A34]
0060FF1C C705 4CAF6400 0>mov dword ptr ds:[64AF48+4],1
0060FF26 E9 18FFFFFF jmp 0060FE43
Shift+F9£¬ÖжÏÔÚÉÏÃæBP WriteProcessMemory¶Ïµã´¦¡£¿´Êý¾Ý´°¿Ú£º
0012CD90 01 00 00 00 A8 0B 00 00 40 0E 00 00 01 00 00 80 ...?..@....€
0012CDA0 00 00 00 00 00 00 00 00 BC 83 5B 00 02 00 00 00 ........¼ƒ[....
0012CDB0 00 00 00 00 BC 83 5B 00 BC 83 5B 00 0C AD 4D B2 ....¼ƒ[.¼ƒ[..M
ºÜÃ÷ÏÔ¿ÉÒÔ¿´µ½OEP=005B83BC
È¡ÏûWriteProcessMemory´¦¶Ïµã£¬¼ÌÐøShift+F9£¬ÖжÏÔÚ006100F8´¦
´Ëʱ×Ó½ø³Ì´úÂëÒѾ½â¿ª£¬ÔËÐÐLordPE£¬ÍêÈ«Dump³ö×Ó½ø³Ì
¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª
¶þ¡¢¸ã¶¨ÊäÈë±í
¿ÉÒÔÍêÃÀ»¹ÔIAT£¬²»¹ýÐ޸ĵĴúÂëÂé·³£¬¾Í²»Ð´ÁË¡£
ÔÙ´ÎÔØÈëÖ÷³ÌÐòMAGCT.EXE
϶ϣºBP DebugActiveProcess ÖжϺ󿴶ÑÕ»£º
0013BCBC 0060F71A /CALL µ½ DebugActiveProcess À´×Ô MAGCT.0060F714
0013BCC0 00000DEC \ProcessId = DEC пªÒ»¸öOllyDbg£¬¸½¼Ó½ø³ÌID DECµÄ×Ó½ø³Ì
F9£¬ÔÙF12£¬»áÔÝÍ£ÔÚEP´¦
0061F743 EB FE jmp short 0061F743
//×Ó½ø³ÌÔÚEP´¦ËÀÑ»· »Ö¸´ÔÀ´EP´¦µÄ´úÂ룺55 8B
Çл»µ¥½ø³Ì¡£BP OpenMutexA Shift+F9£¬ÖжϺ󿴶ÑÕ»£º
0013D7AC 0060B321 /CALL µ½ OpenMutexA À´×Ô MAGCT.0060B31B
0013D7B0 001F0001 |Access = 1F0001
0013D7B4 00000000 |Inheritable = FALSE
0013D7B8 0013DDEC \MutexName = "DEC::DADD467F84" ¡ï ×¢Òâ0013DDEC
Ctrl+G£º401000 ¼üÈëÒÔÏ·ÖÀë´úÂë
00401000 60 pushad
00401001 9C pushfd
00401002 68 ECDD1300 push 13DDEC ¡ï ¶ÑÕ»Àï¿´µ½µÄÖµ
00401007 33C0 xor eax,eax
00401009 50 push eax
0040100A 50 push eax
0040100B E8 2FDB407C call 7C80EB3F ; kernel32.CreateMutexA
00401010 9D popfd
00401011 61 popad
00401012 E9 04DC407C jmp 7C80EC1B ; kernel32.OpenMutexA
60 9C 68 EC DD 13 00 33 C0 50 50 E8 2F DB 40 7C 9D 61 E9 04 DC 40 7C
ÔÚ401000´¦Ð½¨EIP£¬F9ÔËÐУ¬ÔÙ´ÎÖжÏÔÚOpenMutexA´¦¡£
·µ»Ø401000´¦£¬¡°³·ÏúÑ¡Ôñ¡±£¬ÇåµôдÈëµÄ´úÂë¡£ÔÙÈ¡ÏûOpenMutexA¶Ïµã¡£
϶ϣºHE GetModuleHandleA Shift+F9£¬×¢Òâ¿´¶ÑÕ»£º
00136884 00E8372E /CALL µ½ GetModuleHandleA À´×Ô 00E83728
00136888 00E97474 \pModule = "kernel32.dll"
0013688C 00E98744 ASCII "VirtualAlloc"
00136884 00E8374B /CALL µ½ GetModuleHandleA À´×Ô 00E83745
00136888 00E97474 \pModule = "kernel32.dll"
0013688C 00E98738 ASCII "VirtualFree"
001365F4 00E6ACC1 /CALL µ½ GetModuleHandleA À´×Ô 00E6ACBB
001365F8 00136738 \pModule = "kernel32.dll"
¶ÑÕ»ÈçÉϱ仯ʱ,È¡ÏûGetModuleHandleA´¦¶Ïµã£¬Alt+F9·µ»Ø
00E6ACBB FF15 D820E900 call dword ptr ds:[E920D8] ; kernel32.GetModuleHandleA
00E6ACC1 8B0D E4C9E900 mov ecx,dword ptr ds:[E9C9E4]
//·µ»ØÕâÀï
00E6ACC7 89040E mov dword ptr ds:[esi+ecx],eax
00E6ACCA A1 E4C9E900 mov eax,dword ptr ds:[E9C9E4]
00E6ACCF 391C06 cmp dword ptr ds:[esi+eax],ebx
00E6ACD2 75 16 jnz short 00E6ACEA
00E6ACD4 8D85 B4FEFFFF lea eax,dword ptr ss:[ebp-14C]
00E6ACDA 50 push eax
00E6ACDB FF15 E020E900 call dword ptr ds:[E920E0] ; kernel32.LoadLibraryA
00E6ACE1 8B0D E4C9E900 mov ecx,dword ptr ds:[E9C9E4]
00E6ACE7 89040E mov dword ptr ds:[esi+ecx],eax
00E6ACEA A1 E4C9E900 mov eax,dword ptr ds:[E9C9E4]
00E6ACEF 391C06 cmp dword ptr ds:[esi+eax],ebx
00E6ACF2 0F84 32010000 je 00E6AE2A
//Magic Jump£¡ ÐÞ¸ÄΪ£ºjmp 00E6AE2A ¡ï
Õâ¸ö¶«¶«ÔÚ´¦ÀíÊäÈë±íµÄʱºò»¹ÓÐʱ¼äУÑ飬²»´¦ÀíµÄ»°»áµ¼ÖÂijЩº¯Êý±»¼ÓÃÜ
϶ϣºBP GetTickCount ÖжϺóÈ¡Ïû¶Ïµã·µ»Ø
00E88D57 FF15 AC22E900 call dword ptr ds:[E922AC] ; kernel32.GetTickCount
00E88D5D 8985 8CC3FFFF mov dword ptr ss:[ebp-3C74],eax
//·µ»ØÕâÀï
00E88D63 6A 01 push 1
00E88D65 58 pop eax
00E88D66 85C0 test eax,eax
00E88D68 0F84 A8030000 je 00E89116
ÏÂÃ滹ÓÐÒ»´¦GetTickCountȡʱ¼ä
00E89100 8908 mov dword ptr ds:[eax],ecx
//º¯ÊýдÈë¡£ÔÚÕâÀï¿ÉÒÔ¿´¼ûÊäÈë±íº¯Êý¿ªÊ¼µØÖ·005D7208£¬ÊäÈë±í´¦Àí½áÊøºó¿ÉÒÔ¼ÆËã³ö´óС=8B4
00E89102 8B85 FCC7FFFF mov eax,dword ptr ss:[ebp-3804]
00E89108 83C0 04 add eax,4
00E8910B 8985 FCC7FFFF mov dword ptr ss:[ebp-3804],eax
00E89111 E9 4DFCFFFF jmp 00E88D63
00E89116 FF15 AC22E900 call dword ptr ds:[E922AC] ; kernel32.GetTickCount
00E8911C 2B85 8CC3FFFF sub eax,dword ptr ss:[ebp-3C74]
00E89122 8B8D 90C3FFFF mov ecx,dword ptr ss:[ebp-3C70]
00E89128 6BC9 32 imul ecx,ecx,32
00E8912B 81C1 D0070000 add ecx,7D0
00E89131 3BC1 cmp eax,ecx
//ʱ¼äУÑé
00E89133 76 07 jbe short 00E8913C
//ÐÞ¸ÄΪ£ºJMP 00E8913C ¡ï
00E89135 C685 20C8FFFF 0>mov byte ptr ss:[ebp-37E0],1
00E8913C 83BD D0C6FFFF 0>cmp dword ptr ss:[ebp-3930],0
00E89143 0F85 8A000000 jnz 00E891D3
00E891B8 83C4 0C add esp,0C
00E891BB 8B85 58C8FFFF mov eax,dword ptr ss:[ebp-37A8]
00E891C1 8985 A49EFFFF mov dword ptr ss:[ebp+FFFF9EA4],eax
00E891C7 FFB5 A49EFFFF push dword ptr ss:[ebp+FFFF9EA4]
00E891CD E8 64820000 call 00E91436 ; jmp to msvcrt.operator delete
00E891D2 59 pop ecx
00E891D3 E9 05F7FFFF jmp 00E888DD
00E891D8 8B85 DCC6FFFF mov eax,dword ptr ss:[ebp-3924]
//ÕâÀï϶ϣ¬ÖжϺóÊäÈë±í´¦ÀíÍê±Ï
ÔËÐÐImportREC£¬Ñ¡ÔñÕâ¸ö½ø³Ì¡£ÌîÈëRVA=001D7208¡¢Size=000008B4£¬Get Import¼ôÇеôÎÞЧº¯Êý£¬ÐÞ¸ÄOEP RVA=001B83BC£¬FixDump£¬Õý³£ÔËÐУ¡
¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª
, _/
/| _.-~/ \_ , Çà´º¶¼Ò»ÉÎ
( /~ / \~-._ |\
`\\ _/ \ ~\ ) Ḛ̀Ѹ¡Ãû
_-~~~-.) )__/;;,. \_ //¡¯
/¡¯_,\ --~ \ ~~~- ,;;\___( (.-~~~-. »»ÁËÆƽâÇá¿ñ
`~ _( ,_..--\ ( ,;¡¯ / ~-- /._`\
/~~//¡¯ /¡¯ `~\ ) /--.._, )_ `~
" `~" " `" /~¡¯`\ `\\~~\
" " "~¡¯ ""
UnPacKed By : fly |
