首页
社区
课程
招聘
[注意]Win8中 另类链表检测 DLL
发表于: 2014-4-25 19:19 6258

[注意]Win8中 另类链表检测 DLL

2014-4-25 19:19
6258
详情见
FreeLibrary ->LdrUnloadDll  ->LdrpFindLoadedDllByAddress ->LdrpModuleBaseAddressIndex

LdrpFindLoadedDllByAddress:
77DB1900   .  55            PUSH EBP
77DB1901   .  8BEC          MOV EBP,ESP
77DB1903   .  53            PUSH EBX
77DB1904   .  56            PUSH ESI
77DB1905   .  57            PUSH EDI
77DB1906   .  8BF0          MOV ESI,EAX
77DB1908   .  33FF          XOR EDI,EDI
77DB190A   .  33DB          XOR EBX,EBX
77DB190C   .  85F6          TEST ESI,ESI
77DB190E   .^ 0F84 18A3FCFF JE ntdll.77D7BC2C
77DB1914   .  3B35 CCA0E477 CMP ESI,DWORD PTR DS:[77E4A0CC]          ;  ntdll.<ModuleEntryPoint>
77DB191A   .  0F84 402B0100 JE ntdll.77DC4460
77DB1920   .  E8 A1EBFFFF   CALL ntdll.77DB04C6
77DB1925   .  A1 70FBE477   MOV EAX,DWORD PTR DS:[77E4FB70]//LdrpModuleBaseAddressIndex
77DB192A   >  85C0          TEST EAX,EAX
77DB192C   .  74 2C         JE SHORT ntdll.77DB195A
77DB192E   .  3B70 B0       CMP ESI,DWORD PTR DS:[EAX-50]
77DB1931   .  0F82 99010000 JB ntdll.77DB1AD0
77DB1937   .  76 05         JBE SHORT ntdll.77DB193E
77DB1939   .  8B40 04       MOV EAX,DWORD PTR DS:[EAX+4]
77DB193C   .^ EB EC         JMP SHORT ntdll.77DB192A
77DB193E   >  85C0          TEST EAX,EAX
77DB1940   .  74 18         JE SHORT ntdll.77DB195A
77DB1942   .  FF75 08       PUSH DWORD PTR SS:[EBP+8]
77DB1945   .  8D78 98       LEA EDI,DWORD PTR DS:[EAX-68]
77DB1948   .  8B5F 50       MOV EBX,DWORD PTR DS:[EDI+50]
77DB194B   .  8BF3          MOV ESI,EBX

LdrpModuleBaseAddressIndex 指向链表首位置

77DB192E   .  3B70 B0       CMP ESI,DWORD PTR DS:[EAX-50] 中
DWORD PTR DS:[EAX-50] 处存放DLLBASE

[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)

收藏
免费 0
支持
分享
最新回复 (3)
雪    币: 1556
活跃值: (878)
能力值: ( LV9,RANK:320 )
在线值:
发帖
回帖
粉丝
2
受教了.....
2014-4-25 20:57
0
雪    币: 8835
活跃值: (2404)
能力值: ( LV12,RANK:760 )
在线值:
发帖
回帖
粉丝
3
还真没注意到~
2014-4-25 22:42
0
雪    币: 193
活跃值: (26)
能力值: ( LV9,RANK:210 )
在线值:
发帖
回帖
粉丝
4
win8 win8.1隐藏 修改注意

   ldm^.InLoadOrderModuleList.Blink^.Flink := ldm^.InLoadOrderModuleList.Flink;
   ldm^.InLoadOrderModuleList.Flink^.Blink := ldm^.InLoadOrderModuleList.Blink;
   ldm^.InInitializationOrderModuleList.Blink^.Flink := ldm^.InInitializationOrderModuleList.Flink;
   ldm^.InInitializationOrderModuleList.Flink^.Blink := ldm^.InInitializationOrderModuleList.Blink;
   ldm^.InMemoryOrderModuleList.Blink^.Flink := ldm^.InMemoryOrderModuleList.Flink;
   ldm^.InMemoryOrderModuleList.Flink^.Blink := ldm^.InMemoryOrderModuleList.Blink;

   //ldm^.BaseAddress:=nil;  //如果设置nil  loadlibrary会显示失败


   if (Win32MajorVersion>=6) and (Win32MinorVersion>=2) then  //win8 win8.1
   begin
    // ldm+$68 为ldm^.BaseAddressIndexNode地址
    hide_InNode(Pointer(   DWORD(ldm)+$68   ));
   end;

function GetLdrpModuleBaseAddressIndex:DWORD;
var
 ntdll:THandle;
 I,curAdd:Cardinal;
 LdrDisableThreadCalloutsForDll,    //LdrDisableThreadCalloutsForDll win8 win8.1都存在
 LdrpFindLoadedDllByHandle:Cardinal;
 findAsmKey:TarrasmCodeKey;
begin
 Result:=0;
 ntdll:=GetModuleHandle('ntdll.dll');   LdrpFindLoadedDllByHandle:=0;
 if ntdll<>0 then
 begin
   LdrDisableThreadCalloutsForDll:=Cardinal(GetProcAddress(ntdll,'LdrDisableThreadCalloutsForDll'));
   if LdrDisableThreadCalloutsForDll>0 then
   begin
    SetLength(findAsmKey,1);
    findAsmKey[0]:='call';          //硬编码
    curAdd:=FindAsmCode(LdrDisableThreadCalloutsForDll,0,findAsmKey);
    if curAdd>0 then
    begin
      LdrpFindLoadedDllByHandle:=PULONG(curAdd+1)^+5+curAdd;
    end;
   end;
   if LdrpFindLoadedDllByHandle>0 then
   begin
     SetLength(findAsmKey,2);
     findAsmKey[0]:='mov     eax,';         //硬编码
     findAsmKey[1]:='test    eax, eax';     //硬编码
     curAdd:=FindAsmCode(LdrpFindLoadedDllByHandle,0,findAsmKey);
     if curAdd>0 then
     begin
       Result:=PULONG(curAdd+1)^;
     end;
   end;  
   
 end;
end;

function hide_InNode(NeedDeleteNode:Pointer):Cardinal;stdcall;
var
 LdrpModuleBaseAddressIndex:DWORD;
 RtlRbRemoveNode:Pointer;
begin
 RtlRbRemoveNode:=GetProcAddress(GetModuleHandle('ntdll.dll'),'RtlRbRemoveNode');
 if RtlRbRemoveNode<>nil then
 begin
  LdrpModuleBaseAddressIndex:=GetLdrpModuleBaseAddressIndex;
  if LdrpModuleBaseAddressIndex>0 then
  begin
   TRtlRbRemoveNode(RtlRbRemoveNode)(Pointer(LdrpModuleBaseAddressIndex),NeedDeleteNode);
  end;
 end;  
end;
2014-4-26 06:17
0
游客
登录 | 注册 方可回帖
返回
//