-
-
[旧帖] [原创]某游戏的协议明文还原 0.00雪花
-
发表于: 2013-9-3 15:44
-
前段日子有些时间，分析了某游戏且对其进行了协议的还原，还原后可在反外挂和外挂中使用
，流程如下图所示：
1. 解除游戏保护：
脱壳、反调试见看雪文章。
2. 还原游戏主程序：
先介绍下LoadAndRun技术，就是替换一个进程的内存空间为另一个程序，主用用作免杀和反调试。代码如下所示：
CreateProcess(nil, pchar(ParamStr(0)), nil, nil, False, CREATE_SUSPENDED, nil, nil, StartInfo, ProcInfo);
Context.ContextFlags := CONTEXT_FULL;
GetThreadContext(ProcInfo.hThread, Context);
ReadProcessMemory(ProcInfo.hProcess, pointer(Context.Ebx + 8), @BaseAddress, 4, Bytes);
VirtualAllocEx(ProcInfo.hProcess, pointer(ImageNtHeaders.OptionalHeader.ImageBase),InjectSize, MEM_RESERVE or MEM_COMMIT, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(ProcInfo.hProcess, pointer(ImageNtHeaders.OptionalHeader.ImageBase),InjectMemory,InjectSize, Bytes);
WriteProcessMemory(ProcInfo.hProcess, pointer(Context.Ebx + 8), @ImageNtHeaders.OptionalHeader.ImageBase, 4, Bytes);
Context.Eax := ImageNtHeaders.OptionalHeader.ImageBase + ImageNtHeaders.OptionalHeader.AddressOfEntryPoint;
SetThreadContext(ProcInfo.hThread, Context);
ResumeThread(ProcInfo.hThread);
while (GetMessage(&msg,0,0,0))
{
TranslateMessage(&msg);
DispatchMessage(&msg);
}
00AB00F0 sub_AB00F0 proc near ; CODE XREF: sub_AB0140+13F p .text:00AB00F0 .text:00AB00F0 var_28 = dword ptr -28h .text:00AB00F0 var_24 = dword ptr -24h .text:00AB00F0 var_20 = dword ptr -20h .text:00AB00F0 var_1C = dword ptr -1Ch .text:00AB00F0 var_18 = dword ptr -18h .text:00AB00F0 var_14 = dword ptr -14h .text:00AB00F0 var_10 = dword ptr -10h .text:00AB00F0 var_C = dword ptr -0Ch .text:00AB00F0 var_8 = dword ptr -8 .text:00AB00F0 var_4 = dword ptr -4 .text:00AB00F0 .text:00AB00F0 sub esp, 28h .text:00AB00F3 mov ecx, [ecx+0Ch] .text:00AB00F6 xor eax, eax .text:00AB00F8 lea edx, [esp+28h+var_28] .text:00AB00FB push edx ; lpWndClass .text:00AB00FC mov [esp+2Ch+var_28], eax .text:00AB0100 mov [esp+2Ch+var_24], offset lpfnWndProc ; 消息循环 .text:00AB0108 mov [esp+2Ch+var_20], eax .text:00AB010C mov [esp+2Ch+var_1C], eax .text:00AB0110 mov [esp+2Ch+var_18], ecx .text:00AB0114 mov [esp+2Ch+var_14], eax .text:00AB0118 mov [esp+2Ch+var_10], eax .text:00AB011C mov [esp+2Ch+var_C], eax .text:00AB0120 mov [esp+2Ch+var_8], eax .text:00AB0124 mov [esp+2Ch+var_4], offset off_C21AA4 .text:00AB012C call ds:RegisterClassW ; 注册窗口类 .text:00AB0132 neg ax .text:00AB0135 sbb eax, eax .text:00AB0137 neg eax .text:00AB0139 add esp, 28h .text:00AB013C retn .text:00AB013C sub_AB00F0 endp
00AAFEE0 lpfnWndProc: .text:00AAFEE0 mov ecx, [esp+8] ; wMsg .text:00AAFEE4 push ebx .text:00AAFEE5 push ebp .text:00AAFEE6 mov eax, ecx .text:00AAFEE8 sub eax, 1 .text:00AAFEEB push esi .text:00AAFEEC push edi .text:00AAFEED jz loc_AB0095 .text:00AAFEF3 sub eax, 9C3Fh .text:00AAFEF8 jz loc_AAFFCC ; wMsg=9C40h .text:00AAFEFE sub eax, 1 .text:00AAFF01 jz short loc_AAFF11 .text:00AAFF03 pop edi .text:00AAFF04 pop esi .text:00AAFF05 pop ebp .text:00AAFF06 pop ebx .text:00AAFF07 mov [esp+8], ecx .text:00AAFF0B jmp ds:DefWindowProcW ...... .text:00AAFFCC loc_AAFFCC: .text:00AAFFCC mov ebx, [esp+20h] .text:00AAFFD0 mov ebp, [esp+14h] .text:00AAFFD4 push 0FFFFFFEBh ;GWL_USERDATA .text:00AAFFD6 mov edi, ebx .text:00AAFFD8 push ebp .text:00AAFFD9 shr edi, 10h .text:00AAFFDC call ds:GetWindowLongW .text:00AAFFE2 mov esi, eax ; 返回值会传入00AB0073 .text:00AAFFE4 push esi .text:00AAFFE5 call sub_AAEA30 .text:00AAFFEA add esp, 4 .text:00AAFFED test al, al .text:00AAFFEF jz loc_AB00A9 .text:00AAFFF5 movzx eax, bx .text:00AAFFF8 add eax, 0FFFFFFFFh .text:00AAFFFB cmp eax, 1Fh .text:00AAFFFE .text:00AAFFFE loc_AAFFFE: .text:00AAFFFE ja loc_AB00A9 .text:00AB0004 movzx eax, ds:byte_AB00C8[eax] .text:00AB000B jmp ds:off_AB00B4[eax*4] ...... .text:00AB006A loc_AB006A: .text:00AB006A .text:00AB006A cmp byte ptr [esi+8], 0 .text:00AB006E jz short loc_AB00A9 ; default .text:00AB0070 push edi .text:00AB0071 mov ecx, esi .text:00AB0073 call _SendData ; 会调用WSASend
mov edi,ecx mov edx, [edi+2880h] mov ebx, [edx] mov eax, [ebx+8] mov [edi+2888h], eax mov ebx, [edi+2888h] mov esi, [ebx+4] mov [esp+24h+Buffers.buf], esi call WSASend
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
