-
-
[原创]IDA 驱动vmp变异 去花指令 IDC脚本
-
发表于: 2022-9-6 07:00
-
变异1:
变异2:
变异3:
这三种变异都是伪跳转,阻碍IDA静态识别的主要特征模型
**看代码前先给大家讲一下IDC脚本代码中的几个函数
FindBinary 搜索二进制
MinEA 最小地址
MakeCode 转换为代码
PatchByte 字节补丁
Byte 读取字节
Dword 读取整数
AnalyzeArea 分析指定块
去花指令后效果
**
IDC脚本代码
#include <idc.idc>static memset(x,val,len)
{ auto i;
for(i = 0; i < len; i++)
{
PatchByte(x + i,val);
}
}//是否为堆栈平衡 0不为堆栈平衡 为堆栈平衡返回代码字节数
static IsStackBalance(x) { auto bsx;
bsx = Byte(x);
if(bsx == 0x48 && Dword(x + 1) == 0x0824648D)//lea rsp,[rsp+8]
{
return 5;
}
else if(bsx >= 0x58 && bsx <= 0x5F)//pop rax -> rdi
{
return 1;
}
else if(bsx == 0x41 && Byte(x + 1) >= 0x58 && Byte(x + 1) <= 0x5F)//pop r8 -> r15
{
return 2;
}
return 0;
}static IsFalseJump(x){ auto bsx,op,base,len;
bsx = Byte(x);
op = Byte(x + 1);
if((bsx == 0x48 || bsx == 0x49)&& op >= 0xB8 && op <= 0xBF &&
(
(Byte(x + 10) >= 0x50 && Byte(x + 10) <= 0x57 && Byte(x + 11) == 0xC3) ||
(Byte(x + 10) == 0x41 && Byte(x + 11) >= 0x50 && Byte(x + 11) <= 0x57 && Byte(x + 12) == 0xC3)
)
)//mov rax -> r15 push rax -> r15 ret
{
base = Dword(x + 2);
base = base + (Dword(x + 2 + 4) << 32);
if(base > x)
{
len = base - x ;
if(len <= (9 + 12))
{
return len;
}
else
{
//Message("find base:%X \n",x);
}
}
}
return 0;
}static main() { auto x,FBin,ProcRange,StaclBytelen;
FBin = "E8 04 00 00 00"; //call +4
for (x = FindBinary(MinEA(),0x03,FBin);x != BADADDR;x = FindBinary(x,0x03,FBin))
{
StaclBytelen = IsStackBalance(x + 9);
if(StaclBytelen != 0)
{
MakeCode(x+9+StaclBytelen);
memset(x,0x90,9+StaclBytelen);
}
}
FBin = "E9 04 00 00 00"; //jmp +4
for (x = FindBinary(MinEA(),0x03,FBin);x != BADADDR;x = FindBinary(x,0x03,FBin))
{
MakeCode(x+9);
memset(x,0x90,9);
}
FBin = "C3"; //mov rax -> r15
for (x = FindBinary(MinEA(),0x03,FBin);x != BADADDR;x = FindBinary(x,0x03,FBin))
{
StaclBytelen = IsFalseJump(x - 11);
if(StaclBytelen != 0)
{
MakeCode(x-11+StaclBytelen);
memset(x-11,0x90,StaclBytelen);
}
StaclBytelen = IsFalseJump(x - 12);
if(StaclBytelen != 0)
{
MakeCode(x-12+StaclBytelen);
memset(x-12,0x90,StaclBytelen);
}
}
AnalyzeArea (MinEA(),MaxEA());
}#include <idc.idc>static memset(x,val,len)
{ auto i;
for(i = 0; i < len; i++)
{
PatchByte(x + i,val);
}
}//是否为堆栈平衡 0不为堆栈平衡 为堆栈平衡返回代码字节数
static IsStackBalance(x) { auto bsx;
bsx = Byte(x);
if(bsx == 0x48 && Dword(x + 1) == 0x0824648D)//lea rsp,[rsp+8]
{
return 5;
}
else if(bsx >= 0x58 && bsx <= 0x5F)//pop rax -> rdi
{
return 1;
}
else if(bsx == 0x41 && Byte(x + 1) >= 0x58 && Byte(x + 1) <= 0x5F)//pop r8 -> r15
{
return 2;
}
return 0;
}static IsFalseJump(x){ auto bsx,op,base,len;
bsx = Byte(x);
op = Byte(x + 1);
if((bsx == 0x48 || bsx == 0x49)&& op >= 0xB8 && op <= 0xBF &&
(
(Byte(x + 10) >= 0x50 && Byte(x + 10) <= 0x57 && Byte(x + 11) == 0xC3) ||
(Byte(x + 10) == 0x41 && Byte(x + 11) >= 0x50 && Byte(x + 11) <= 0x57 && Byte(x + 12) == 0xC3)
)
)//mov rax -> r15 push rax -> r15 ret
{
base = Dword(x + 2);
base = base + (Dword(x + 2 + 4) << 32);
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
