能力值:
( LV2,RANK:10 )
3 楼
这个是要要植入的代码:
CODESTART equ this byte
_LoadLibrary dd ?
_GetProcAddress dd ?
_GetModuleHandle dd ?
_MessageBox dd ?
_hInstance dd ?
szmessagebox db 'MessageBox',0
szuser32 db 'User32.dll',0 _getaddress proc uses ebx esi edi lparam
LOCAL @hmodule:dword
call @F
@@:
pop ebx
sub ebx,offset @B
_invoke [ebx+_GetModuleHandle],NULL
mov [ebx+_hInstance],eax
lea eax,[ebx+offset szuser32]
_invoke [ebx+_GetModuleHandle],eax
mov @hmodule,eax
lea edi,[ebx+szmessagebox]
_invoke [ebx+_GetProcAddress],@hmodule,edi
mov [ebx+_MessageBox],eax
_invoke [ebx+_MessageBox],NULL,0,0,MB_OK
ret
_getaddress endp
CODEEND equ this byte
CODELENGTH equ offset CODEEND-OFFSET CODESTART 下面是向程序插入代码的代码:
.386
.model flat,stdcall
option casemap:none
include windows.inc
include user32.inc
include kernel32.inc
includelib user32.lib
includelib kernel32.lib
include Macro.inc .data?
lploadlibrary dd ?
lpaddress dd ?
lpgetmodulehandle dd ?
dwprocessid dd ?
dwthreadid dd ?
hprocess dd ?
lpviraddress dd ?
.const
szkerneldll db 'Kernel32.dll',0
szgetprocaddress db 'GetProcAddress',0
szgetmodulehandle db 'GetModuleHandle',0
szloadlibrary db 'LoadLibrary',0
szclassname db 'Notepad',0
szwindowname db '无标题 - 记事本',0
szerror db '打开进程失败',0
.code
include 要植入的代码.asm
start:
invoke GetModuleHandle,addr szkerneldll
mov ebx,eax
invoke GetProcAddress,ebx,offset szloadlibrary
mov lploadlibrary,eax
invoke GetProcAddress,ebx,offset szgetprocaddress
mov lpaddress,eax
invoke GetProcAddress,ebx,offset szgetmodulehandle
mov lpgetmodulehandle,eax invoke FindWindow,addr szclassname,addr szwindowname
invoke GetWindowThreadProcessId,eax,offset dwprocessid
mov dwthreadid,eax
invoke OpenProcess,PROCESS_CREATE_THREAD or PROCESS_VM_WRITE or PROCESS_VM_OPERATION,FALSE,dwprocessid
.if eax
mov hprocess,eax
invoke VirtualAllocEx,hprocess,NULL,CODELENGTH,MEM_COMMIT,PAGE_EXECUTE_READWRITE
.if eax
mov lpviraddress,eax
invoke WriteProcessMemory,hprocess,lpviraddress,offset CODESTART,CODELENGTH,NULL
invoke WriteProcessMemory,hprocess,lpviraddress,offset lploadlibrary,sizeof dword*3,NULL
mov eax,lpviraddress
add eax,offset _getaddress - offset CODESTART
invoke CreateRemoteThread,hprocess,NULL,0,EAX,0,NULL,NULL
invoke CloseHandle,eax
.endif
invoke CloseHandle,hprocess
.else
invoke MessageBox,0,addr szerror,0,MB_OK
.endif
invoke ExitProcess,NULL
end start _invoke 是一个编好的宏定义。
这个代码看了两天了,不知道怎么回事 就是有错误。提示“0x00000000”内存不能为“written”
还有我要向调试virtualallocex分配的内存块 改怎么办。返回的是内存块的指针,我附加notepad 打开后 根本找不到那个指针的位置。提示 指定地址无内存。 请指导下。
能力值:
( LV2,RANK:10 )
11 楼
0040110A . 81EB 09114000 SUB EBX,11111.00401109 ; 入口地址
00401110 . 68 59304000 PUSH 11111.00403059 ; /Title = "无标题 - 记事本"
00401115 . 68 51304000 PUSH 11111.00403051 ; |Class = "Notepad"
0040111A . E8 55010000 CALL <JMP.&user32.FindWindowA> ; \FindWindowA
0040111F . 0BC0 OR EAX,EAX
00401121 . 0F84 DC000000 JE 11111.00401203
00401127 . 68 AC304000 PUSH 11111.004030AC ; /pProcessID = 11111.004030AC
0040112C . 50 PUSH EAX ; |hWnd
0040112D . E8 48010000 CALL <JMP.&user32.GetWindowThreadProcess>; \GetWindowThreadProcessId
00401132 . A3 B0304000 MOV DWORD PTR DS:[4030B0],EAX
00401137 . FF35 AC304000 PUSH DWORD PTR DS:[4030AC] ; /ProcessId = 82C
0040113D . 6A 00 PUSH 0 ; |Inheritable = FALSE
0040113F . 6A 2A PUSH 2A ; |Access = CREATE_THREAD|VM_OPERATION|VM_WRITE
00401141 . E8 10010000 CALL <JMP.&kernel32.OpenProcess> ; \OpenProcess
00401146 . 0BC0 OR EAX,EAX
00401148 . 0F84 A3000000 JE 11111.004011F1
0040114E . A3 B4304000 MOV DWORD PTR DS:[4030B4],EAX
00401153 . 6A 40 PUSH 40
00401155 . 68 00100000 PUSH 1000
0040115A . 68 75000000 PUSH 75
0040115F . 6A 00 PUSH 0
00401161 . FF35 B4304000 PUSH DWORD PTR DS:[4030B4]
00401167 . E8 F0000000 CALL <JMP.&kernel32.VirtualAllocEx>
0040116C . 0BC0 OR EAX,EAX
0040116E . 74 64 JE SHORT 11111.004011D4
00401170 . A3 B8304000 MOV DWORD PTR DS:[4030B8],EAX
00401175 . 6A 00 PUSH 0 ; /pBytesWritten = NULL
00401177 . 68 75000000 PUSH 75 ; |BytesToWrite = 75 (117.)
0040117C . 68 00104000 PUSH 11111.00401000 ; |Buffer = 11111.00401000
00401181 . FF35 B8304000 PUSH DWORD PTR DS:[4030B8] ; |Address = AE0000
00401187 . FF35 B4304000 PUSH DWORD PTR DS:[4030B4] ; |hProcess = 00000088 (window)
0040118D . E8 D0000000 CALL <JMP.&kernel32.WriteProcessMemory> ; \WriteProcessMemory
00401192 . 6A 00 PUSH 0 ; /pBytesWritten = NULL
00401194 . 6A 08 PUSH 8 ; |BytesToWrite = 8
00401196 . 68 00104000 PUSH 11111.00401000 ; |Buffer = 11111.00401000
0040119B . FF35 B8304000 PUSH DWORD PTR DS:[4030B8] ; |Address = AE0000
004011A1 . FF35 B4304000 PUSH DWORD PTR DS:[4030B4] ; |hProcess = 00000088 (window)
004011A7 . E8 B6000000 CALL <JMP.&kernel32.WriteProcessMemory> ; \WriteProcessMemory
004011AC . A1 B8304000 MOV EAX,DWORD PTR DS:[4030B8]
004011B1 . 05 23000000 ADD EAX,23
004011B6 . 6A 00 PUSH 0
004011B8 . 6A 00 PUSH 0
004011BA . 6A 00 PUSH 0
004011BC . 50 PUSH EAX
004011BD . 6A 00 PUSH 0
004011BF . 6A 00 PUSH 0
004011C1 . FF35 B4304000 PUSH DWORD PTR DS:[4030B4]
004011C7 . E8 72000000 CALL <JMP.&kernel32.CreateRemoteThread>
004011CC . 50 PUSH EAX ; /hObject
004011CD . E8 66000000 CALL <JMP.&kernel32.CloseHandle> ; \CloseHandle
上面的004011C7 . E8 72000000 CALL <JMP.&kernel32.CreateRemoteThread>
如何跟进??????????????????????????????????????????????????????????????????????????????????????
在线等
能力值:
( LV2,RANK:10 )
13 楼
谢谢yuansunxue。
我按照你说的方法都试了,重新编写了一遍,使植入代码在本进程中实现。然后逐步把他移动到本进程的新线程中,再然后移动到其他进程的新线程中,终于一步一步都成功了。多遍的写,现在回头看看上面发的代码有好几个地方都是错的。
调试上,因为先前的代码重定位是错的,所以在调试的时候在别的进程中老是定位不到新进程的位置。后来修改正确后,打开被植入代码的进程。然后OD设置 暂停在新线程中,再单步走几步就可以直接到达新进程的代码中了。到这儿以后就可以跟踪了。
再次谢谢yuansunxue。