木马利用setusermatherr callback 反调，并解密callback。
1. 默认 setusermatherr callback中只是 Xor ECX,ECX ； Ret；，而这个callback 0x00407C6C是一些dword
.data:00407C6C 3C 70 B2 A7 callback dd 0A7B2703Ch ; DATA XREF: start+77o
.data:00407C6C ; sub_4043F4+70o
.data:00407C6C ; sub_4043F4+CBw
.data:00407C70 D7 85 D2 3F dword_407C70 dd 3FD285D7h ; DATA XREF: sub_4043F4+B8w
.data:00407C74 6A 0F DF C4 dword_407C74 dd 0C4DF0F6Ah ; DATA XREF: sub_4043F4+E4w
.data:00407C78 E2 71 F1 AC dword_407C78 dd 0ACF171E2h ; DATA XREF: sub_4043F4+F8w
.data:00407C7C 61 02 CB DD dword_407C7C dd 0DDCB0261h ; DATA XREF: sub_4043F4+115w
.data:00407C80 00 10 A7 AE dword_407C80 dd 0AEA71000h ; DATA XREF: sub_4043A4+9w
.data:00407C84 02 FA B7 A5 dword_407C84 dd 0A5B7FA02h ; DATA XREF: sub_4043F4+128w
.data:00407C88 8B db 8Bh ; ?
////////////////////////////////////////////////////////////////////////////////////////
.text:00404244 55 push ebp
.text:00404245 8B EC mov ebp, esp
.text:00404247 6A FF push 0FFFFFFFFh
.text:00404249 68 F0 7A 40 00 push offset dword_407AF0
.text:0040424E 68 44 46 40 00 push offset loc_404644
.text:00404253 64 A1 00 00 00 00 mov eax, large fs:0
.text:00404259 50 push eax
.text:0040425A 64 89 25 00 00 00 00 mov large fs:0, esp
.text:00404261 83 EC 6C sub esp, 6Ch
.text:00404264 53 push ebx
.text:00404265 56 push esi
.text:00404266 57 push edi
.text:00404267 89 65 E8 mov [ebp+var_18], esp
.text:0040426A 33 DB xor ebx, ebx
.text:0040426C 89 5D FC mov [ebp+var_4], ebx
.text:0040426F 6A 02 push 2
.text:00404271 FF 15 24 10 40 00 call ds:__set_app_type
.text:00404277 59 pop ecx
.text:00404278 83 0D FC 7A 40 00 FF or dword_407AFC, 0FFFFFFFFh
.text:0040427F 83 0D 28 7B 40 00 FF or dword_407B28, 0FFFFFFFFh
.text:00404286 FF 15 10 10 40 00 call ds:__p__fmode
.text:0040428C 8B 0D 14 7B 40 00 mov ecx, dword_407B14
.text:00404292 89 08 mov [eax], ecx
.text:00404294 FF 15 20 10 40 00 call ds:__p__commode
.text:0040429A 8B 0D 2C 7B 40 00 mov ecx, dword_407B2C
.text:004042A0 89 08 mov [eax], ecx
.text:004042A2 A1 14 10 40 00 mov eax, ds:_adjust_fdiv
.text:004042A7 8B 00 mov eax, [eax]
.text:004042A9 A3 0C 7B 40 00 mov dword_407B0C, eax
.text:004042AE E8 E3 00 00 00 call nullsub_1
.text:004042B3 39 1D 68 7B 40 00 cmp dword_407B68, ebx
.text:004042B9 75 0C jnz short loc_4042C7
.text:004042BB 68 6C 7C 40 00
push offset callback ; handle math error exception
.text:004042C0 FF 15 34 10 40 00 call ds:__setusermatherr
.text:004042C6 59 pop ecx
.text:004042C7
2. 改变callback 地址保护模式为可读可写可执行
.text:00404438 6A 40 push 40h
.text:00404464 68 6C 7C 40 00 push offset callback ; lpAddress
.text:0040447E E8 01 02 00 00 call VirtualProtect ; change callback protect mode to RWE
3. 解密callback
.text:004044BF 81 05 6C 7C 40 00 AC 90 4D 58 add callback, 584D90ACh ;
callback地址0x00407C6C为 0x0A7B2703Ch
add callback, 584D90ACh ; 0x0A7B2703Ch + 0x584D90ACh = 00 00 00 E8; call $+1;
下面是继续解密callback 代码：
.text:004044C9 C7 05 24 7B 40 00 60 7A CC 00 mov dword_407B24, 0CC7A60h
.text:004044D3 A1 14 7B 40 00 mov eax, dword_407B14
.text:004044D8 81 35 74 7C 40 00 48 3C 16 45 xor dword_407C74, 45163C48h
.text:004044E2 29 4D F4 sub [ebp+var_C], ecx
.text:004044E5 66 33 0D 1A 7B 40 00 xor cx, word_407B1A
.text:004044EC 81 05 78 7C 40 00 52 16 5A C0 add dword_407C78, 0C05A1652h
.text:004044F6 09 45 F4 or [ebp+var_C], eax
.text:004044F9 C7 05 3C 7B 40 00 00 00 00 00 mov dword_407B3C, 0
.text:00404503 89 1D 34 7B 40 00 mov flOldProtect, ebx
.text:00404509 81 35 7C 7C 40 00 4F 96 8A 5C xor dword_407C7C, 5C8A964Fh
.text:00404513 01 1D DC 7A 40 00 add dword_407ADC, ebx
.text:00404519 0F BE C9 movsx ecx, cl
.text:0040451C 81 35 84 7C 40 00 02 86 47 35 xor dword_407C84, 35478602h
.text:00404526 66 89 75 F0 mov [ebp+var_10], si
.text:0040452A C7 05 1C 7B 40 00 FF FF FF FF mov dword_407B1C, 0FFFFFFFFh
.text:00404534 2D 6C 63 10 00 sub eax, 10636Ch
.text:00404539 89 45 F4 mov [ebp+var_C], eax
4. 触发math error， 在callback 0x00407C6C下断，才能拦住
ext:0040457B 8B 15 1C 7B 40 00 mov edx, dword_407B1C
.text:00404581 F7 D1 not ecx
.text:00404583 8B 1D E4 7A 40 00 mov ebx, dword_407AE4
.text:00404589 89 0D 08 7B 40 00 mov dword_407B08, ecx
.text:0040458F 89 4D E0 mov [ebp+var_20], ecx
.text:00404592 E8 DD 00 00 00 call log10
.text:00404597 88 55 E8 mov [ebp+var_18], dl
.text:0040459A 89 45 E4 mov [ebp+var_1C], eax
.text:0040459D 89 45 E0 mov [ebp+var_20], eax
.text:004045A0 66 09 3D 22 7B 40 00 or word_407B22, di
.text:004045A7 81 35 E0 7A 40 00 48 2B 0A 00 xor dword_407AE0, 0A2B48h
.text:004045B1 66 8B 15 1A 7B 40 00 mov dx, word_407B1A
.text:004045B8 18 15 07 7B 40 00 sbb byte_407B07, dl
.text:004045BE C7 05 10 7B 40 00 01 00 00 00 mov dword_407B10, 1
.text:004045C8 59 pop ecx
.text:004045C9 23 05 EC 7A 40 00 and eax, dword_407AEC
.text:004045CF 89 0D 30 7B 40 00 mov dword_407B30, ecx
.text:004045D5 8A 65 E9 mov ah, [ebp+var_17]
.text:004045D8 0F B6 C8 movzx ecx, al
.text:004045DB A3 F0 7A 40 00 mov dword_407AF0, eax
.text:004045E0 59 pop ecx
.text:004045E1 66 33 1D 18 7B 40 00 xor bx, word_407B18
.text:004045E8 A3 F8 7A 40 00 mov dword_407AF8, eax
.text:004045ED F6 DE neg dh
.text:004045EF 66 1B 0D 42 7B 40 00 sbb cx, word_407B42
.text:004045F6 68 44 7B 40 00 push offset WindowName ;
.text:004045FB 68 54 7B 40 00 push offset ClassName ;
.text:00404600 E8 8F 00 00 00 call FindWindowA
.text:00404605 66 F7 D1 not cx
.text:00404608 8B 4D DC mov ecx, [ebp+var_24]
.text:0040460B 66 0F BE FC movsx di, ah
.text:0040460F 81 C6 AA 07 00 00 add esi, 7AAh
.text:00404615 8B 7D D8 mov edi, [ebp+var_28]
.text:00404618 81 D7 E0 10 C5 00 adc edi, 0C510E0h
.text:0040461E A3 E8 7A 40 00 mov dword_407AE8, eax
.text:00404623 66 C7 45 D4 14 DC mov [ebp+var_2C], 0DC14h
.text:00404629 09 F6 or esi, esi
.text:0040462B 0F 85 3C FF FF FF jnz loc_40456D
5. 解码后callback
00407C6C E8 00000000 call 06CF7D26.00407C71
00407C71 58 pop eax
00407C72 83C0 22 add eax,22
00407C75 33C9 xor ecx,ecx
00407C77 813488 4B6D2E94 xor dword ptr ds:[eax+ecx*4],942E6D4B
00407C7E 41 inc ecx
00407C7F 81F9 CC020000 cmp ecx,2CC
00407C85 ^ 7C F0 jl short 06CF7D26.00407C77
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
