首页
社区
课程
招聘
[学习]简单分析一下Execryptor One-touch窗口的漏洞
发表于: 2007-11-22 15:53 7842

[学习]简单分析一下Execryptor One-touch窗口的漏洞

2007-11-22 15:53
7842

先简单把Execryptor One-touch 的窗口过程反一下

#include <windows.h>
#pragma comment (linker, "/subsystem:windows")
#pragma comment (linker, "/entry:start")
#pragma comment (linker, "/filealign:0x200")

HFONT		hFont1;
HFONT		hFont2;
HWND		hEdit;
char		*szButtonName[5] = {"Evalute", "Order", "Order", "Enter Serial"};

LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
{
	int		i;
	HDC		hDC;
	RECT	rt;
	PAINTSTRUCT ps;

	switch (message) 
	{
		case WM_CREATE:
			SendMessage(hWnd, WM_SETFONT, (WPARAM)hFont1, (LPARAM)TRUE);
			hEdit = CreateWindowEx(WS_EX_CLIENTEDGE, 
				"EDIT", 
				NULL, 
				WS_CHILD|WS_TABSTOP|WS_VISIBLE|WS_EX_TOOLWINDOW,
				122,
				82,
				200,
				22,
				hWnd,
				(HMENU)100,
				GetModuleHandle(NULL),
				NULL
				);
			SendMessage(hEdit, WM_SETFONT, (WPARAM)hFont1, (LPARAM)TRUE);
			hEdit = CreateWindowEx(WS_EX_CLIENTEDGE, 
				"EDIT", 
				NULL, 
				WS_CHILD|WS_TABSTOP|WS_VISIBLE|WS_EX_TOOLWINDOW|WS_EX_TOPMOST,
				122,
				112,
				200,
				22,
				hWnd,
				(HMENU)100,
				GetModuleHandle(NULL),
				NULL
				);
			SendMessage(hEdit, WM_SETFONT, (WPARAM)hFont1, (LPARAM)TRUE);
			SendMessage(hEdit, EM_LIMITTEXT, (WPARAM)20, (LPARAM)0);

			for (i=0; i<4; i++)
			{
				hEdit = CreateWindowEx(0, 
					"BUTTON", 
					szButtonName[i], 
					WS_CHILD|WS_TABSTOP|WS_VISIBLE,
					8+i*80,
					142,
					75,
					25,
					hWnd,
					(HMENU)(0x600+i),
					GetModuleHandle(NULL),
					NULL
					);
				SendMessage(hEdit, WM_SETFONT, (WPARAM)hFont1, (LPARAM)TRUE);
			}
			break ;

		case WM_DESTROY:
			PostQuitMessage(0);
			break;

		case WM_PAINT:
			hDC = BeginPaint(hWnd, &ps);
			SetBkColor(hDC, GetSysColor(COLOR_BTNFACE));
			SelectObject(hDC, hFont2);
			rt.left = 8;
			rt.top = 8;
			rt.right = 324;
			rt.bottom = 40;
			DrawText(hDC, "MyProduct 1.0", -1, &rt, DT_CENTER|DT_TOP|DT_SINGLELINE|DT_NOPREFIX);
			SelectObject(hDC, hFont1);
			rt.left = 8;
			rt.top = 36;
			rt.right = 328;
			rt.bottom = 54;
			DrawText(hDC, "Unregistered 0-days, 0-runs evaluation copy", -1, &rt, DT_CENTER|DT_TOP|DT_SINGLELINE|DT_NOPREFIX);
			rt.left = 8;
			rt.top = 58;
			rt.right = 324;
			rt.bottom = 80;
			DrawText(hDC, "You have 0 days and 0 runs left", -1, &rt, DT_CENTER|DT_TOP|DT_SINGLELINE|DT_NOPREFIX);
			rt.left = 8;
			rt.top = 86;
			rt.right = 150;
			rt.bottom = 104;
			DrawText(hDC, "Registration name:", -1, &rt, DT_LEFT|DT_TOP|DT_SINGLELINE|DT_NOPREFIX);
			rt.left = 8;
			rt.top = 116;
			rt.right = 150;
			rt.bottom = 134;
			DrawText(hDC, "Serial number:", -1, &rt, DT_LEFT|DT_TOP|DT_SINGLELINE|DT_NOPREFIX);
			EndPaint(hWnd, &ps);
			break;

		case WM_COMMAND:
			wParam -= 0x600;
			if (wParam == 0)  //点击Evalute
			{
				SendMessage(hWnd, WM_CLOSE, 0, 0);
			}
			else if (wParam ==1 || wParam == 2) //点击Order
			{
				ShellExecute(NULL, "open", "http://www.google.cn", NULL, NULL, SW_SHOWDEFAULT);
			}
			else if (wParam == 3) //点击Enter Serial
			{
				MessageBox(hWnd, "For complete registration you must restart application.", "MyProduct 1.0", MB_OK|MB_ICONASTERISK|MB_TASKMODAL);
				ExitProcess(0);
			}
			break ;

		default:
			return DefWindowProc(hWnd, message, wParam, lParam);
   }
   return 0;
}


void start()
{
	char		szClassName[13];
	int			i;
	WNDCLASSEX	wndclass;
	HWND		hWnd;
	MSG			msg;

	hFont1 = CreateFont(-12, 
		0, 
		0, 
		0, 
		FW_DONTCARE, 
		FALSE, 
		FALSE, 
		FALSE, 
		DEFAULT_CHARSET, 
		OUT_DEFAULT_PRECIS,
		CLIP_DEFAULT_PRECIS,
		DEFAULT_QUALITY,
		VARIABLE_PITCH | FF_DONTCARE,
		"Arial"
		);

	hFont2 = CreateFont(-18, 
		0, 
		0, 
		0, 
		FW_DONTCARE, 
		FALSE, 
		FALSE, 
		FALSE, 
		DEFAULT_CHARSET, 
		OUT_DEFAULT_PRECIS,
		CLIP_DEFAULT_PRECIS,
		DEFAULT_QUALITY,
		VARIABLE_PITCH | FF_DONTCARE,
		"Times New Roman"
		);

	srand(GetTickCount());
	for (i=0; i<12; i++)
	{
		szClassName[i] = 'a' + rand()%27;
	}
	szClassName[12] = 0;

	wndclass.cbSize = sizeof(WNDCLASSEX);
	wndclass.style = CS_NOCLOSE | CS_VREDRAW | CS_HREDRAW;
	wndclass.lpfnWndProc = WndProc;
	wndclass.cbClsExtra = 0;
	wndclass.cbWndExtra = 0;
	wndclass.hInstance = GetModuleHandle(NULL);
	wndclass.hIcon = NULL;
	wndclass.hCursor = LoadCursor(NULL, IDC_ARROW);
	wndclass.hbrBackground = HBRUSH(COLOR_BTNSHADOW);
	wndclass.lpszMenuName = NULL;
	wndclass.lpszClassName = szClassName;
	wndclass.hIconSm = NULL;
	if (RegisterClassEx(&wndclass) == 0)
	{
		ExitProcess(0);
	}

	hWnd = CreateWindowEx(WS_EX_DLGMODALFRAME | WS_EX_CONTROLPARENT,
		szClassName,
		NULL,
		WS_POPUP | WS_MAXIMIZEBOX | WS_VISIBLE,
		(GetSystemMetrics(SM_CXSCREEN)-336)/2,
		(GetSystemMetrics(SM_CYSCREEN)-178)/2,
		336,
		178,
		NULL,
		NULL,
		GetModuleHandle(NULL),
		NULL
		);
	if (hWnd == 0)
	{
		ExitProcess(0);
	}
	while (GetMessage(&msg, NULL, 0, 0))
	{
		TranslateMessage(&msg);
		DispatchMessage(&msg);
	}

	DeleteObject(hFont1);
	DeleteObject(hFont2);

	MessageBox(0, "Evalute Run", "Evalute", 0);

	ExitProcess(0);
}

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!

上传的附件:
收藏
免费 7
支持
分享
最新回复 (14)
雪    币: 233
活跃值: (10)
能力值: ( LV6,RANK:90 )
在线值:
发帖
回帖
粉丝
2
exec加壳不稳定的毛病才要命
2007-11-22 16:39
0
雪    币: 116
活跃值: (220)
能力值: ( LV12,RANK:370 )
在线值:
发帖
回帖
粉丝
3
好帖如美人,我得使劲顶
2007-11-22 16:54
0
雪    币: 224
活跃值: (147)
能力值: ( LV9,RANK:970 )
在线值:
发帖
回帖
粉丝
4
支持,有代码看着舒服,嘎嘎
2007-11-22 17:34
0
雪    币: 6075
活跃值: (2236)
能力值: (RANK:1060 )
在线值:
发帖
回帖
粉丝
5
想了想,无码片还是不贴出来好。

写 unpacker 时发现 OneTouch 更容易脱,没有这个反而不会了,作者惊天动地异于常人地在妙不可言的地方解码了……
2007-11-22 18:03
0
雪    币: 66
活跃值: (15)
能力值: ( LV9,RANK:330 )
在线值:
发帖
回帖
粉丝
6
把整个硬盘都贴出来那就天下无码了
2007-11-22 18:11
0
雪    币: 124
活跃值: (70)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
7
来晚了,没看到fg的无码片
2007-11-22 20:56
0
雪    币: 331
活跃值: (56)
能力值: ( LV13,RANK:410 )
在线值:
发帖
回帖
粉丝
8
无码确实过瘾.
2007-11-23 12:28
0
雪    币: 212
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
9
支持  :)
2007-11-23 18:01
0
雪    币: 494
活跃值: (629)
能力值: ( LV9,RANK:1210 )
在线值:
发帖
回帖
粉丝
10
f的没看见,鄙视打码
2007-11-23 18:13
0
雪    币: 716
活跃值: (162)
能力值: ( LV9,RANK:250 )
在线值:
发帖
回帖
粉丝
11
代码很好看,谢谢~~~
2007-11-23 19:00
0
雪    币: 239
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
12
无码 代码 一个都不能少
2007-11-25 16:01
0
雪    币: 219
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
13
good,execrptor的BUG确实不少.但是我们还是要一脱到底.
2007-12-7 10:44
0
雪    币: 264
活跃值: (44)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
14
无码更有意境
2007-12-7 13:31
0
雪    币: 707
活跃值: (1301)
能力值: ( LV9,RANK:190 )
在线值:
发帖
回帖
粉丝
15
呵呵,这可是好东东哦!!

贴个发送消息的ASM

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Sample code for < Win32ASM Programming 2nd Edition>
; by 罗云彬, http://asm.yeah.net
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Send.asm
; 从一个程序向另一个窗口程序发送消息 之 发送程序
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 使用 nmake 或下列命令进行编译和链接:
; ml /c /coff Send.asm
; Link /subsystem:windows Send.obj
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
                .386
                .model flat,stdcall
                option casemap:none
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Include 文件定义
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
include                windows.inc
include                user32.inc
includelib        user32.lib
include                kernel32.inc
includelib        kernel32.lib
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 数据段
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
                .data
hWnd                dd        ?
szBuffer        db        256 dup (?)

                .const
szCaption        db        'SendMessage',0
szStart                db        'Press OK to start SendMessage, param: %08x!',0
szReturn        db        'SendMessage returned!',0
szDestClass        db        'nkooaquo{xlf',0        ;目标窗口的窗口类
szText                db        'Text send to other windows',0
szNotFound        db        'Receive Message Window not found!',0
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 代码段
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
                .code
start:
                invoke        FindWindow,addr szDestClass,NULL
                .if        eax
                        mov        hWnd,eax        ;找到目标窗口则发送消息
                        invoke        wsprintf,addr szBuffer,addr szStart,addr szText
                        invoke        MessageBox,NULL,offset szBuffer,offset szCaption,MB_OK
                        invoke        SendMessage,hWnd, WM_SYSCOMMAND, SC_CLOSE, 0
                        invoke        MessageBox,NULL,offset szReturn,offset szCaption,MB_OK
                .else
                        invoke        MessageBox,NULL,offset szNotFound,offset szCaption,MB_OK
                .endif
                invoke        ExitProcess,NULL
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
                end        start
2008-1-6 10:32
0
游客
登录 | 注册 方可回帖
返回
//