|
请教关于INT3的问题?
第一条指令就是CC,程序是不能运行的。因为SEH没有办法安装。自然就不能忽略处理了。用OD载入程序到是会在程序入口处加一个CC,但用SOFTICE的LOADER载入程序只会产生一个DRX中断,也就是硬件中断,它并没有在入口点处加INT 3来产生中断异常。 |
|
蓝屏救星――IDT Protector v1.0 ( Updated )
不懂在虚拟机中弄坏了什么,都不会影响主系统,因为在虚拟机中的一切都是虚拟的 |
|
Armadillo3.60 加壳的EXE文件脱壳全过程
好贴,美文。好看 |
|
step by step unpacking Xprotector
好象只讲了DUMP部分。有谁能讲解一下吗? |
|
蓝屏救星――IDT Protector v1.0 ( Updated )
DUMP IAT???应该是IDT吧!快改 |
|
做个UnpackMe,试试看
能讲讲脱壳的方法吗? |
|
|
|
做个UnpackMe,试试看
我怎么找遍论坛都没有找到VCASM的教程啊 |
|
蓝屏救星――IDT Protector v0.9 for Win2k by cyclotron
http://www.security.org.sg/code/sdtrestore.html : Win2K/XP SDT Restore 0.2 (Proof-Of-Concept) by Tan Chew Keong Released : 06 Jul 2004 Updated : 13 Aug 2004 Download Version 0.2 Download Version 0.1 Introduction Win32 Kernel Rootkits modify the behaviour of the system by Kernel Native API hooking. This technique is typically implemented by modifying the ServiceTable entries in the Service Descriptor Table (SDT). Such modification ensures that a replacement (detour) function installed by a rootkit is called prior to the original native API. The replacement function usually calls the original native API and modifies the output before returning the results to the user-space program. This technique allows kernel rootkits to hide files, processes, and to prevent process termination. This proof-of-concept tool demonstrates the possibility of defeating such rootkits by removing Kernel Native APIs hooks and restoring the SDT back to its original state. Kernel Native API Hooking by Service Descriptor Table Modification In Windows, user-space applications request for system services by calling the APIs exported by the various DLLs. For example, to write data to an open file, pipe or device, the WriteFile API that is exported by kernel32.dll is usually used. Within kernel32.dll, the implementation of WriteFile API in turn calls the ZwWriteFile native API that is exported by ntdll.dll. The work done by ZwWriteFile is actually performed in kernel-space. Hence, the implementation of ZwWriteFile in ntdll.dll contains only minimal code to transit into kernel-space using interrupt 0x2E. The disassembly of ZwWriteFile is shown below. 1- MOV EAX, 0ED 2- LEA EDX, DWORD PTR SS:[ESP+4] 3- INT 2E 4- RETN 24 The magic number 0ED in line 1 is the Service Number for ZwWriteFile. It will be used to offset into the Service Table in kernel-space to locate the address of the function that implements the writefile service. The Service Descriptor Table can be referenced using the exported KeServiceDescriptorTable symbol. This is a structure with the following definition. typedef struct ServiceDescriptorEntry { PDWORD ServiceTable; PDWORD CounterTableBase; DWORD ServiceLimit; PBYTE ArgumentTable; } SDT; The first member of the structure, ServiceTable, is an array of function pointers to the service functions. The DWORD value at ServiceTable[0xED] is a function pointer to NtWriteFile, which contains the actual code to write to files, pipes or devices. Hence, to modify the behaviour of the user-space WriteFile API, one simply needs to write a replacement function, load it into kernel space as a driver, and modify ServiceTable[0xED] to point to the replacement function. The replacement function needs to keep the original function pointer (original value of ServiceTable[0xED]) so that it can be called to perform the original defined function. Example One - Process Hiding by Hooking ZwQuerySystemInformation User-space programs can use the ToolHelp APIs to obtain a list of all running processes. The ToolHelp APIs in turn calls the ZwQuerySystemInformation native API exported by ntdll.dll to obtain the list. To hide processes, a kernel-space rootkit, which is loaded as a driver, can modify the function pointer at ServiceTable[0x97] (ZwQuerySystemInformation) to redirect the call to a replacement function. The replacement function first calls the original ZwQuerySystemInformation API to obtain an array containing information of all running process. The returned array is then modified to remove the entry containing the process to be hidden. Finally, the modified result is returned to the user-space program. This effectively prevents the user-space program from "seeing" the hidden process. Example Two - Driver/Module Hiding by Hooking ZwQuerySystemInformation User-space programs can obtain a list of all loaded drivers using the ZwQuerySystemInformation native API, specifying SystemModuleInformation as its first parameter. As mentioned earlier, ZwQuerySystemInformation is exported by ntdll.dll and can be called directly by user-space programs. In kernel-space, the ZwQuerySystemInformation native API obtains the list of loaded drivers by traversing the PsLoadedModuleList. A kernel-space rootkit can manipulate the results returned by ZwQuerySystemInformation by modifying ServiceTable[0x97] (ZwQuerySystemInformation) to point to a replacement fnuction. The replacement function will first call the original ZwQuerySystemInformation to get an array of all loaded drivers. The driver to be hidden (i.e. the rootkit) is then removed from the array. This manipulated array is returned to the user-space program. SDT Restoring Technique Used by POC Code This POC code restores the values of SDT entries by writing directly to \device\physicalmemory. Hence, it works entirely in user-space and do not need to load a driver. The following steps describe how the code works. Use NtOpenSection to get a handle to \device\physicalmemory with SECTION_MAP_READ | SECTION_MAP_WRITE access. If this fails, modify the DACL of \device\physicalmemory by adding SECTION_MAP_WRITE access permission to the current user. Try to open \device\physicalmemory again. Load ntoskrnl.exe into memory with proper alignment and locate the address of KeServiceDescriptorTable from the export table of ntoskrnl.exe Use NtMapViewOfSection to map in the physical memory page at the address of KeServiceDescriptorTable. Get the address of KeServiceDescriptorTable.ServiceTable from the page. Use NtMapViewOfSection to map in the physical memory page containing the running kernel's SerivceTable. This address is available at KeServiceDescriptorTable.ServiceTable. Use the address of KeServiceDescriptorTable.ServiceTable to offset into the loaded ntoskrnl.exe Loop through all entries in KeServiceDescriptorTable.ServiceTable, comparing the copy in the kernel memory with the copy in the loaded ntoskrnl.exe. Restore to kernel memory (i.e. into the mapped page) any discrepancies that are detected. This code works based on the fact that a complete original copy of the ServiceTable exists in ntoskrnl.exe. Screen Dump C:\>sdtrestore SDTrestore Version 0.1 Proof-of-Concept by SIG^2 G-TEC (www.security.org.sg) KeServiceDescriptorTable 8046DFA0 KeServiceDecriptorTable.ServiceTable 804742B8 KeServiceDescriptorTable.ServiceLimit 248 ZwAllocateVirtualMemory 10 --[hooked by unknown at F754CE74]-- ZwCreateFile 20 --[hooked by unknown at F754CA85]-- ZwCreateKey 23 --[hooked by unknown at F754CC5E]-- ZwCreateProcess 29 --[hooked by unknown at F754CDB7]-- ZwDeleteFile 34 --[hooked by unknown at F754C80C]-- ZwGetTickCount 4C --[hooked by unknown at F754CE27]-- ZwLoadDriver 55 --[hooked by unknown at F754CBF2]-- ZwQueryDirectoryFile 7D --[hooked by unknown at F754C6E8]-- ZwQuerySystemInformation 97 --[hooked by unknown at F754C623]-- ZwSetInformationFile C2 --[hooked by unknown at F754C8A8]-- Number of Service Table entries hooked = 10 WARNING: THIS IS EXPERIMENTAL CODE. FIXING THE SDT MAY HAVE GRAVE CONSEQUENCES, SUCH AS SYSTEM CRASH, DATA LOSS OR SYSTEM CORRUPTION. PROCEED AT YOUR OWN RISK. YOU HAVE BEEN WARNED. Fix SDT Entries (Y/N)? : y [+] Patched SDT entry 10 to 804A257F [+] Patched SDT entry 20 to 80497EF9 [+] Patched SDT entry 23 to 804B2483 [+] Patched SDT entry 29 to 804A9212 [+] Patched SDT entry 34 to 804D0584 [+] Patched SDT entry 4C to 80463FF2 [+] Patched SDT entry 55 to 8052DC72 [+] Patched SDT entry 7D to 80498541 [+] Patched SDT entry 97 to 80493B5B [+] Patched SDT entry C2 to 80498C08 Limitations This version is tested only on English Win2K SP2 and SP4, WinXP SP0 and SP1. THIS IS EXPERIMENTAL CODE. FIXING THE SDT MAY HAVE GRAVE CONSEQUENCES, SUCH AS SYSTEM CRASH, DATA LOSS OR SYSTEM CORRUPTION. IT IS RECOMMENDED THAT YOU USE THIS CODE ONLY ON A TEST SYSTEM. PROCEED AT YOUR OWN RISK. |
|
脱XtremeProtector 这个壳真是麻烦。。
你功力这么高,谁能帮你?老弟不是开玩笑吧。对了,问一下,你破这个多久了? |
|
蓝屏救星――IDT Protector v0.9 for Win2k by cyclotron
找遍INTEL开发BOOK 1.2.3都没找到SST是什么,不知道你说的是什么 |
|
|
|
Help...About DAEMON Protect 0.6.8
好厉害呀大大。能讲讲你是怎么样还原代码的吗? |
|
一段邪恶代码……
看不懂,高手讲解一下啊 |
|
|
|
各位脱壳高手,本人想购买老王的epe,不知能脱epe壳的人多不?
试用了一下,它的兼容性还不不错的,有些用其它壳不能加壳的程序用它都能加。就是调试的时候死机太多了不好 |
操作理由
RANk
{{ user_info.golds == '' ? 0 : user_info.golds }}
雪币
{{ experience }}
课程经验
{{ score }}
学习收益
{{study_duration_fmt}}
学习时长
基本信息
荣誉称号:
{{ honorary_title }}
能力排名:
No.{{ rank_num }}
等 级:
LV{{ rank_lv-100 }}
活跃值:
在线值:
浏览人数:{{ visits }}
最近活跃:{{ last_active_time }}
注册时间:{{ user_info.create_date_jsonfmt }}
勋章
兑换勋章
证书
证书查询 >
能力值