能力值：
( LV9，RANK：410 )
|
-
-
2 楼
00408DA6 |. 50 push eax ; |pBaseAddress
00408DA7 |. 8B55 08 mov edx,dword ptr ss:[ebp+8] ; |
00408DAA |. 52 push edx ; |hProcess
00408DAB |. E8 782A0D00 call <jmp.&kernel32.ReadProcessMemo>; \ReadProcessMemory
00408DB0 |. 85C0 test eax,eax ; 是否读取成功？
00408DB2 |. 75 0E jnz short avprp.00408DC2 ; 成功，跳
00408DB4 |. 56 push esi ; /Arg1
00408DB5 |. E8 12730C00 call avprp.004D00CC ; \avprp.004D00CC
00408DBA |. 59 pop ecx
00408DBB |. 33C0 xor eax,eax
00408DBD |. E9 13010000 jmp avprp.00408ED5
00408DC2 |> 83EF 19 sub edi,19 ; 跳到这里
00408DC5 |. 8D9E 00060000 lea ebx,dword ptr ds:[esi+600]
00408DCB |. EB 3A jmp short avprp.00408E07 ; 再跳
00408DCD |> 6A 02 /push 2 ; /Arg3 = 00000002
00408DCF |. 8D45 E6 |lea eax,dword ptr ss:[ebp-1A] ; |
00408DD2 |. 50 |push eax ; |Arg2
00408DD3 |. 8D53 0C |lea edx,dword ptr ds:[ebx+C] ; |
00408DD6 |. 52 |push edx ; |Arg1
00408DD7 |. E8 E87E0C00 |call avprp.004D0CC4 ; \avprp.004D0CC4
00408DDC |. 83C4 0C |add esp,0C
00408DDF |. 85C0 |test eax,eax
00408DE1 |. 75 23 |jnz short avprp.00408E06
00408DE3 |. 6A 01 |push 1 ; /Arg3 = 00000001
00408DE5 |. 8D4D D8 |lea ecx,dword ptr ss:[ebp-28] ; |
00408DE8 |. 51 |push ecx ; |Arg2
00408DE9 |. 8D43 FE |lea eax,dword ptr ds:[ebx-2] ; |
00408DEC |. 50 |push eax ; |Arg1
00408DED |. E8 D27E0C00 |call avprp.004D0CC4 ; \avprp.004D0CC4
00408DF2 |. 83C4 0C |add esp,0C
00408DF5 |. 85C0 |test eax,eax
00408DF7 |. 75 0D |jnz short avprp.00408E06
00408DF9 |. FF45 FC |inc dword ptr ss:[ebp-4]
00408DFC |. 8BD3 |mov edx,ebx
00408DFE |. 2BD6 |sub edx,esi
00408E00 |. 83C2 FE |add edx,-2
00408E03 |. 8955 F4 |mov dword ptr ss:[ebp-C],edx
00408E06 |> 43 |inc ebx
00408E07 |> 6A 09 push 9 ; /Arg4 = 00000009
00408E09 |. 8D4D DA |lea ecx,dword ptr ss:[ebp-26] ; |
00408E0C |. 51 |push ecx ; |ecx=023BFB5E
00408E0D |. 8BC3 |mov eax,ebx ; |ebx=023C0620
00408E0F |. 2BC6 |sub eax,esi ; |
00408E11 |. 8BD7 |mov edx,edi ; |
00408E13 |. 2BD0 |sub edx,eax ; |eax=00000600
00408E15 |. 52 |push edx ; |edx=002629E7
00408E16 |. 53 |push ebx ; |ebx=023C0620
00408E17 |. E8 88FEFFFF |call avprp.00408CA4 ; \avprp.00408CA4
00408E1C |. 83C4 10 |add esp,10
00408E1F |. 8BD8 |mov ebx,eax
00408E21 |. 85C0 |test eax,eax
00408E23 |.^ 75 A8 \jnz short avprp.00408DCD
00408E25 |. 8D9E 00060000 lea ebx,dword ptr ds:[esi+600]
00408E2B |. EB 0B jmp short avprp.00408E38
00408E2D |> FF45 F8 /inc dword ptr ss:[ebp-8]
00408E30 |. 8BC3 |mov eax,ebx
00408E32 |. 2BC6 |sub eax,esi
00408E34 |. 43 |inc ebx
00408E35 |. 8945 F0 |mov dword ptr ss:[ebp-10],eax
00408E38 |> 6A 19 push 19 ; /Arg4 = 00000019
00408E3A |. 8D55 BC |lea edx,dword ptr ss:[ebp-44] ; |
00408E3D |. 52 |push edx ; |Arg3
00408E3E |. 8BCB |mov ecx,ebx ; |
00408E40 |. 2BCE |sub ecx,esi ; |
00408E42 |. 8BC7 |mov eax,edi ; |
00408E44 |. 2BC1 |sub eax,ecx ; |
00408E46 |. 50 |push eax ; |Arg2
00408E47 |. 53 |push ebx ; |Arg1
00408E48 |. E8 57FEFFFF |call avprp.00408CA4 ; \avprp.00408CA4
00408E4D |. 83C4 10 |add esp,10
00408E50 |. 8BD8 |mov ebx,eax
00408E52 |. 85C0 |test eax,eax
00408E54 |.^ 75 D7 \jnz short avprp.00408E2D
00408E56 |. 56 push esi ; /hMem
00408E57 |. E8 2A290D00 call <jmp.&kernel32.GlobalFree> ; \GlobalFree
00408E5C |. 837D FC 01 cmp dword ptr ss:[ebp-4],1 ;判断
00408E60 |. 75 06 jnz short avprp.00408E68 ;不跳
00408E62 |. 837D F8 01 cmp dword ptr ss:[ebp-8],1 ;跳
00408E66 |. 74 04 je short avprp.00408E6C
00408E68 |> 33C0 xor eax,eax
00408E6A |. EB 69 jmp short avprp.00408ED5
00408E6C |> 6A 00 push 0 ; /pBytesWritten = NULL
这一大块功能不清楚，不会分析。估计是做准备。如果一切顺利，到了这里：
00408E6C |> \6A 00 push 0 ; /pBytesWritten = NULL
00408E6E |. 8D55 EF lea edx,dword ptr ss:[ebp-11] ; |
00408E71 |. 6A 01 push 1 ; |BytesToWrite = 1
00408E73 |. 52 push edx ; |edx=023BFB73这里是 EB
00408E74 |. 8B4D F4 mov ecx,dword ptr ss:[ebp-C] ; |
00408E77 |. 8B5D 0C mov ebx,dword ptr ss:[ebp+C] ; |
00408E7A |. 03CB add ecx,ebx ; |
00408E7C |. 51 push ecx ; |ecx=6511F408
00408E7D |. 8B45 08 mov eax,dword ptr ss:[ebp+8] ; |
00408E80 |. 50 push eax ; |eax=000001C0
00408E81 |. E8 802A0D00 call <jmp.&kernel32.WriteProcessMem>; \WriteProcessMemory
00408E86 |. 85C0 test eax,eax ; 写第一个地方
00408E88 |. 75 04 jnz short avprp.00408E8E ; 是否成功？
00408E8A |. 33C0 xor eax,eax
00408E8C |. EB 47 jmp short avprp.00408ED5
00408E8E |> 6A 00 push 0 ; /pBytesWritten = NULL
00408E90 |. 8D55 E8 lea edx,dword ptr ss:[ebp-18] ; |
00408E93 |. 6A 06 push 6 ; |BytesToWrite = 6
00408E95 |. 52 push edx ; |edx=023BFB6C这里是 9090909090
00408E96 |. 8B4D F0 mov ecx,dword ptr ss:[ebp-10] ; |
00408E99 |. 03CB add ecx,ebx ; |
00408E9B |. 51 push ecx ; |ecx=6511F0D3
00408E9C |. 8B45 08 mov eax,dword ptr ss:[ebp+8] ; |
00408E9F |. 50 push eax ; |hProcess
00408EA0 |. E8 612A0D00 call <jmp.&kernel32.WriteProcessMem>; \WriteProcessMemory
00408EA5 |. 85C0 test eax,eax ; 是否成功？
00408EA7 |. 75 04 jnz short avprp.00408EAD
00408EA9 |. 33C0 xor eax,eax
00408EAB |. EB 28 jmp short avprp.00408ED5
00408EAD |> 6A 00 push 0 ; /pBytesWritten = NULL
00408EAF |. 8D55 E8 lea edx,dword ptr ss:[ebp-18] ; |
00408EB2 |. 6A 06 push 6 ; |BytesToWrite = 6
00408EB4 |. 52 push edx ; |edx=023BFB6C 还是 9090909090
00408EB5 |. 8B4D F0 mov ecx,dword ptr ss:[ebp-10] ; |
00408EB8 |. 034D 0C add ecx,dword ptr ss:[ebp+C] ; |
00408EBB |. 83C1 13 add ecx,13 ; |
00408EBE |. 51 push ecx ; |ecx=6511F0E6
00408EBF |. 8B45 08 mov eax,dword ptr ss:[ebp+8] ; |
00408EC2 |. 50 push eax ; |hProcess
00408EC3 |. E8 3E2A0D00 call <jmp.&kernel32.WriteProcessMem>; \WriteProcessMemory
00408EC8 |. 85C0 test eax,eax
00408ECA |. 75 04 jnz short avprp.00408ED0
00408ECC |. 33C0 xor eax,eax
00408ECE |. EB 05 jmp short avprp.00408ED5
00408ED0 |> B8 01000000 mov eax,1 ; 三次都成功，置标志 位
00408ED5 |> 5F pop edi
00408ED6 |. 5E pop esi
00408ED7 |. 5B pop ebx
00408ED8 |. 8BE5 mov esp,ebp
00408EDA |. 5D pop ebp
00408EDB \. C3 retn
三次堆栈情况：
0246FB20 000001E0 |hProcess = 000001E0 (window)
0246FB24 6511F408 |Address = 6511F408
0246FB28 0246FB73 |Buffer = 0246FB73
0246FB2C 00000001 |BytesToWrite = 1
0246FB30 00000000 \pBytesWritten = NULL
0246FB34 00000000
0246FB20 000001E0 |hProcess = 000001E0 (window)
0246FB24 6511F0D3 |Address = 6511F0D3
0246FB28 0246FB6C |Buffer = 0246FB6C
0246FB2C 00000006 |BytesToWrite = 6
0246FB30 00000000 \pBytesWritten = NULL
0246FB20 000001E0 |hProcess = 000001E0 (window)
0246FB24 6511F0E6 |Address = 6511F0E6
0246FB28 0246FB6C |Buffer = 0246FB6C
0246FB2C 00000006 |BytesToWrite = 6
0246FB30 00000000 \pBytesWritten = NULL
对应的操作句柄：
句柄，项目 119
句柄=000001E0
类型=Process
参考= 58.
访问=001F0FFF SYNCHRONIZE|WRITE_OWNER|WRITE_DAC|READ_CONTROL|DELETE|QUERY_STATE|MODIFY_STATE|FFC
是不是什么都明白了？程序对VBE6.DLL读写了三次，第一次写了6511F408，改成EB,第二次6511F0D3和第 三次6511F0E6都改成了9090909090。
=========================================================================================== =======
一切清楚了，下面是输出成功字样。
004084FD |. E8 DA090000 |call avprp.00408EDC ; \avprp.00408EDC
00408502 |. 83C4 0C |add esp,0C
00408505 |. 8BF8 |mov edi,eax
00408507 |. EB 0C |jmp short avprp.00408515
00408509 |> A1 5CE54D00 |mov eax,dword ptr ds:[4DE55C]
0040850E |. 50 |push eax
0040850F |. E8 A4E6FFFF |call avprp.00406BB8
00408514 |. 59 |pop ecx
00408515 |> 83FF FF |cmp edi,-1
00408518 |. 74 20 |je short avprp.0040853A
0040851A |. 85FF |test edi,edi
0040851C |. 74 0F |je short avprp.0040852D
0040851E |. 8B15 7CE54D00 |mov edx,dword ptr ds:[4DE57C]
00408524 |. 52 |push edx ; /Arg1 => 00E33550 ASCII "VBA Memory Patch successfully applied"
00408525 |. E8 06E6FFFF |call avprp.00406B30 ; \avprp.00406B30
0040852A |. 59 |pop ecx
0040852B |. EB 0D |jmp short avprp.0040853A
【破解总结】
虽然不知道这样操作的原理，但是至少分析了AVPR的操作原理，高兴呀～
分析结果能干什么我就不说了。可以来个FILE PATCH，也可以做自己的VBA BACKDOOR。但是关于dll的读 操作我还是有个疑问，我只知道通过一系列API找到窗口，得到进程，打开，写。FindWindow- >GetWindowThreadProcessId->OpenProcess->WriteProcessMemory那样的话内存地址不固定，请各位指 点。
在刚开始的对话框之前有如下代码，请问是否有关系呢？
00408113 |. E8 083D0D00 call <jmp.&user32.GetFocus> ; |[GetFocus
00408118 |. 50 push eax ; |hOwner
00408119 |. E8 8E3E0D00 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
0040811E |. E8 219FFFFF call avprp.00402044
00408123 |> 6A FF /push -1 ; /Timeout = INFINITE
00408125 |. 8D85 0CFDFFFF |lea eax,dword ptr ss:[ebp-2F4] ; |
0040812B |. 50 |push eax ; |pDebugEvent
0040812C |. E8 B7370D00 |call <jmp.&kernel32.WaitForDebugEv>; \WaitForDebugEvent
00408131 |. 85C0 |test eax,eax
00408133 |. 75 12 |jnz short avprp.00408147
|
