能力值：
( LV12，RANK：210 )
|
-
-
2 楼
第一部分： 花指令
以下是svkp常用的花指令. 可以直接在花指令后f4跳过.
注: 凡是db掉的, 表示不会被执行, 但里面的字节数不一定就是该值
由于rdtsc的泛用, 可以用个让edx:eax递增的插件来解决.
===============================
花指令0_2:
jmp +2
db ?? ??
花指令0_3:
jmp +3
db ?? ?? ??
花指令0_4:
jmp +4
db ?? ?? ?? ??
===============================
花指令1:
call +1
db e8h
call +2
db cdh, 20h
add dword ptr[esp], 0bh
add dword ptr[esp+4], 13h
ret
db e9h
===============================
花指令2:
call +1
db 9ah
add esp, 4
================================
花指令3:
pushad
call @1
db d2h
jmp @4
@1:
pop eax
jmp @2
db 48h
@2:
inc eax
jmp @3
db 35h
@3:
jmp eax
@4:
popad
================================
花指令4:
jl @1
@2:
jmp @3
db 8bh
@1:
je @2
@3:
=================================
花指令5:
call +2
db cdh, 02h
add dword ptr[esp], 8
ret
db e8h
==================================
花指令6: 带rdtsc 长df字节 == push ecx
push eax
push edx
[花指令0_2]
rdtsc
[花指令0_2]
[花指令0_2]
call @sub_eip_add_1
db c3h
[花指令0_4]
push eax
push ebx
call +4
db 8dh, b5h, d4h, 46h
pop ax
cmp esi, esi
pop bx
jnz ??? = nop
[花指令2]
pop eax
[花指令0_3]
call @sub_eip_add_2
db ffh, e4h
cmp edi, edi
pop ebx
xchg eax, ebx
jnz ??? = nop
push ebx
[花指令0_2]
mov ebx, edx
[花指令5]
;执行到这, rdtsc的edx保存在ebx里面, ebx给压栈保存了. 下面再次rdtsc比较
rdtsc
[花指令2]
sub edx, ebx ; 这里需要注意, edx-ebx只能为0或者1, 要不然就飞了
[花指令0_3]
pop ebx
[花指令4]
sub edx, 2
[花指令4]
jns ??? ;这里跳就飞了
[花指令4]
pop edx
[花指令0_3]
pop eax
[花指令0_3]
[花指令4]
pop ebp
jmp over
//////////////////
@sub_eip_add_1:
call @eip_inc
db ffh
inc dword ptr[esp]
[花指令0_2]
ret
//////////////////
eip_inc:
push ebp
mov ebp, esp
sub ebp, 80
jnz +1 = jmp
db ffh
add dword ptr[esp+84], 1
jnz +2 = jmp
db 68h, 58h
mov esp, ebp
pop ebp
ret
//////////////////
@sub_eip_add_2:
call eip_inc
db ffh
sub dword ptr[esp], -2
jnz +2 = jmp
db 8dh, 87h
[花指令0_2]
ret
///////////////////
over:
==================================
花指令7: 长68字节
push eax
push ebx
call +4
db ?? ?? ?? ??
pop ax
cmp esi, esi
pop bx
jnz ?? = nop
pop eax
jmp +3
db ?? ?? ??
add_eip_2
db ?? ??
cmp edi, edi
pop ebx
xchg eax, ebx
jnz ?? = nop
jmp add_eip_2_over
add_eip_2
add_eip_2_over:
====================================
花指令8: 带rtdsc和自修改功能 长度137 ==push eax
9c9c93:
pushad
call +0 ;ebp
pop ebp
------------------------------
call +2 |
db ?? ?? |
add dword ptr [esp], 8 |
ret |
db ?? |
------------------------------
sub ebp, 5
------------------------------
jmp +2 |
db ?? ?? |
------------------------------
------------------------------
jmp +2 |
db ?? ?? |
------------------------------
rdtsc
------------------------------
call +2 |
db ?? ?? |
add dword ptr[esp], 8 |
ret |
db ?? |
------------------------------
mov eax, 5c
------------------------------
jl +3 |
jmp +3 |
db ?? |
je -5 |
------------------------------
add eax, ebp
------------------------------
call +1 |
db ?? |
add esp, 4 |
------------------------------
mov ecx, 5e; 0 <-----------------
| |
------------------------------ | |
jmp +3 | | |
db ?? ?? ?? | | |
------------------------------ | |
| |
------------------------------ | |
jl +3 | | |
jmp +3 | | |
db ?? | | |
je -5 | | |
------------------------------ | |
| |
mov dword ptr[eax], ecx 5e,0---> | |
| | |
------------------------------ | | |
jmp +2 | | | |
db ?? ?? | | | |
------------------------------ | | |
| | |
call +5e == @1;0 <------ | |
| |
pop eax | |
| |
------------------------------ | |
jl +3 | | |
jmp +3 | | |
db ?? | | |
je -5 | | |
------------------------------ | |
| |
mov ecx, edx | |
| |
------------------------------ | |
call +1 | | |
db ?? | | |
add esp, 4 | | |
------------------------------ | |
| |
rdtsc | |
| |
------------------------------ | |
jl +3 | | |
jmp +3 | | |
db ?? | | |
je -5 | | |
------------------------------ | |
| |
sub edx, ecx | |
| |
------------------------------ | |
jmp +2 | | |
db ?? ?? | | |
------------------------------ | |
| |
sub edx, 2 | |
| |
------------------------------ | |
jmp +3 | | |
db ?? ?? ?? | | |
------------------------------ | |
| |
------------------------------ | |
jmp +2 | | |
db ?? ?? | | |
------------------------------ | |
| |
| |
------------------------------ | |
jmp +3 | | |
db ?? ?? ?? | | |
------------------------------ | |
| |
js +5 这里应该跳, 要不就挂了 | |
| |
------------------------------ | |
jmp +2 | | |
db ?? ?? | | |
------------------------------ | |
pop edx | |
| |
------------------------------ | |
call +1 | | |
db ?? | | |
add esp, 4 | | |
------------------------------ | |
| |
push eax | |
| |
------------------------------ | |
pushad | | |
call +3 | | |
db ?? | | |
jmp +a | | |
pop eax | | |
jmp +1 | | |
db ?? | | |
inc eax | | |
jmp +1 | | |
db ?? | | |
jmp eax | | |
popad | | |
------------------------------ | |
jmp over | |
| |
------------------------------ | |
jmp +2 | | |
db ?? ?? | | |
------------------------------ | |
| |
@1: | |
mov ecx, 45 | |
| |
------------------------------ | |
call +1 | | |
db ?? | | |
call +2 | | |
db ?? ?? | | |
add dword ptr[esp], 0b | | |
add dword ptr[esp+4], 13 | | |
ret | | |
db ?? | | |
------------------------------ | |
| |
add ecx, ebp | |
| |
------------------------------ | |
call +2 | | |
db ?? ?? | | |
add dword ptr[esp], 8 | | |
ret | | |
db ?? | | |
------------------------------ | |
| |
mov dword ptr [ecx], 0 ----------> |
|
------------------------------ |
pushad | |
call +3 | |
db ?? | |
jmp +a | |
pop eax | |
jmp +1 | |
db ?? | |
inc eax | |
jmp +1 | |
db ?? | |
jmp eax | |
popad | |
------------------------------ |
|
pop ebx |
|
------------------------------ |
call +1 | |
db ?? | |
call +2 | |
db ?? ?? | |
add dword ptr[esp], 0b | |
add dword ptr[esp+4], 13 | |
ret | |
db ?? | |
------------------------------ |
|
dec ecx |
|
------------------------------ |
call +2 | |
db ?? ?? | |
add dword ptr[esp], 8 | |
ret | |
db ?? | |
------------------------------ |
|
jmp ecx---------------------------->
------------------------------
call +1 |
db ?? |
add esp, 4 |
------------------------------
to be continued.
|
能力值：
( LV12，RANK：370 )
|
-
-
14 楼
最初由 forgot 发布
期待下文，特别是驱动分析
先停止原来的驱动，可以在xp的cmd下输入：
sc stop svkp
把svkp.sys复制到windows\system32目录下，覆盖原来的svkp.sys驱动。。。
再:
sc start svkp
运行加壳的程序可以在DebugViewNt中看到我们的输出：
00000000 0.00000000 Our's SVKP Driver Start.
00000001 2.40722394 ControlCode: 00222000
00000002 2.40741467 ControlCode: 00222004
00000003 2.40751123 ControlCode: 00222014
00000004 2.40764880 ControlCode: 0022200c
00000005 2.61064625 ControlCode: 00222008
驱动里面没什么内容。。。
就是返回一些固定的值和状态。。。所以脱壳时我们可以忽略svkp的驱动。。。
|
