首页
社区
课程
招聘
7
[学习]简单分析一下Execryptor One-touch窗口的漏洞
发表于: 2007-11-22 15:53 7969

[学习]简单分析一下Execryptor One-touch窗口的漏洞

2007-11-22 15:53
7969

先简单把Execryptor One-touch 的窗口过程反一下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
#include <windows.h>
#pragma comment (linker, "/subsystem:windows")
#pragma comment (linker, "/entry:start")
#pragma comment (linker, "/filealign:0x200")
 
HFONT       hFont1;
HFONT       hFont2;
HWND        hEdit;
char        *szButtonName[5] = {"Evalute", "Order", "Order", "Enter Serial"};
 
LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
{
    int     i;
    HDC     hDC;
    RECT    rt;
    PAINTSTRUCT ps;
 
    switch (message)
    {
        case WM_CREATE:
            SendMessage(hWnd, WM_SETFONT, (WPARAM)hFont1, (LPARAM)TRUE);
            hEdit = CreateWindowEx(WS_EX_CLIENTEDGE,
                "EDIT",
                NULL,
                WS_CHILD|WS_TABSTOP|WS_VISIBLE|WS_EX_TOOLWINDOW,
                122,
                82,
                200,
                22,
                hWnd,
                (HMENU)100,
                GetModuleHandle(NULL),
                NULL
                );
            SendMessage(hEdit, WM_SETFONT, (WPARAM)hFont1, (LPARAM)TRUE);
            hEdit = CreateWindowEx(WS_EX_CLIENTEDGE,
                "EDIT",
                NULL,
                WS_CHILD|WS_TABSTOP|WS_VISIBLE|WS_EX_TOOLWINDOW|WS_EX_TOPMOST,
                122,
                112,
                200,
                22,
                hWnd,
                (HMENU)100,
                GetModuleHandle(NULL),
                NULL
                );
            SendMessage(hEdit, WM_SETFONT, (WPARAM)hFont1, (LPARAM)TRUE);
            SendMessage(hEdit, EM_LIMITTEXT, (WPARAM)20, (LPARAM)0);
 
            for (i=0; i<4; i++)
            {
                hEdit = CreateWindowEx(0,
                    "BUTTON",
                    szButtonName[i],
                    WS_CHILD|WS_TABSTOP|WS_VISIBLE,
                    8+i*80,
                    142,
                    75,
                    25,
                    hWnd,
                    (HMENU)(0x600+i),
                    GetModuleHandle(NULL),
                    NULL
                    );
                SendMessage(hEdit, WM_SETFONT, (WPARAM)hFont1, (LPARAM)TRUE);
            }
            break ;
 
        case WM_DESTROY:
            PostQuitMessage(0);
            break;
 
        case WM_PAINT:
            hDC = BeginPaint(hWnd, &ps);
            SetBkColor(hDC, GetSysColor(COLOR_BTNFACE));
            SelectObject(hDC, hFont2);
            rt.left = 8;
            rt.top = 8;
            rt.right = 324;
            rt.bottom = 40;
            DrawText(hDC, "MyProduct 1.0", -1, &rt, DT_CENTER|DT_TOP|DT_SINGLELINE|DT_NOPREFIX);
            SelectObject(hDC, hFont1);
            rt.left = 8;
            rt.top = 36;
            rt.right = 328;
            rt.bottom = 54;
            DrawText(hDC, "Unregistered 0-days, 0-runs evaluation copy", -1, &rt, DT_CENTER|DT_TOP|DT_SINGLELINE|DT_NOPREFIX);
            rt.left = 8;
            rt.top = 58;
            rt.right = 324;
            rt.bottom = 80;
            DrawText(hDC, "You have 0 days and 0 runs left", -1, &rt, DT_CENTER|DT_TOP|DT_SINGLELINE|DT_NOPREFIX);
            rt.left = 8;
            rt.top = 86;
            rt.right = 150;
            rt.bottom = 104;
            DrawText(hDC, "Registration name:", -1, &rt, DT_LEFT|DT_TOP|DT_SINGLELINE|DT_NOPREFIX);
            rt.left = 8;
            rt.top = 116;
            rt.right = 150;
            rt.bottom = 134;
            DrawText(hDC, "Serial number:", -1, &rt, DT_LEFT|DT_TOP|DT_SINGLELINE|DT_NOPREFIX);
            EndPaint(hWnd, &ps);
            break;
 
        case WM_COMMAND:
            wParam -= 0x600;
            if (wParam == 0)  //点击Evalute
            {
                SendMessage(hWnd, WM_CLOSE, 0, 0);
            }
            else if (wParam ==1 || wParam == 2) //点击Order
            {
                ShellExecute(NULL, "open", "http://www.google.cn", NULL, NULL, SW_SHOWDEFAULT);
            }
            else if (wParam == 3) //点击Enter Serial
            {
                MessageBox(hWnd, "For complete registration you must restart application.", "MyProduct 1.0", MB_OK|MB_ICONASTERISK|MB_TASKMODAL);
                ExitProcess(0);
            }
            break ;
 
        default:
            return DefWindowProc(hWnd, message, wParam, lParam);
   }
   return 0;
}
 
 
void start()
{
    char        szClassName[13];
    int         i;
    WNDCLASSEX  wndclass;
    HWND        hWnd;
    MSG         msg;
 
    hFont1 = CreateFont(-12,
        0,
        0,
        0,
        FW_DONTCARE,
        FALSE,
        FALSE,
        FALSE,
        DEFAULT_CHARSET,
        OUT_DEFAULT_PRECIS,
        CLIP_DEFAULT_PRECIS,
        DEFAULT_QUALITY,
        VARIABLE_PITCH | FF_DONTCARE,
        "Arial"
        );
 
    hFont2 = CreateFont(-18,
        0,
        0,
        0,
        FW_DONTCARE,
        FALSE,
        FALSE,
        FALSE,
        DEFAULT_CHARSET,
        OUT_DEFAULT_PRECIS,
        CLIP_DEFAULT_PRECIS,
        DEFAULT_QUALITY,
        VARIABLE_PITCH | FF_DONTCARE,
        "Times New Roman"
        );
 
    srand(GetTickCount());
    for (i=0; i<12; i++)
    {
        szClassName[i] = 'a' + rand()%27;
    }
    szClassName[12] = 0;
 
    wndclass.cbSize = sizeof(WNDCLASSEX);
    wndclass.style = CS_NOCLOSE | CS_VREDRAW | CS_HREDRAW;
    wndclass.lpfnWndProc = WndProc;
    wndclass.cbClsExtra = 0;
    wndclass.cbWndExtra = 0;
    wndclass.hInstance = GetModuleHandle(NULL);
    wndclass.hIcon = NULL;
    wndclass.hCursor = LoadCursor(NULL, IDC_ARROW);
    wndclass.hbrBackground = HBRUSH(COLOR_BTNSHADOW);
    wndclass.lpszMenuName = NULL;
    wndclass.lpszClassName = szClassName;
    wndclass.hIconSm = NULL;
    if (RegisterClassEx(&wndclass) == 0)
    {
        ExitProcess(0);
    }
 
    hWnd = CreateWindowEx(WS_EX_DLGMODALFRAME | WS_EX_CONTROLPARENT,
        szClassName,
        NULL,
        WS_POPUP | WS_MAXIMIZEBOX | WS_VISIBLE,
        (GetSystemMetrics(SM_CXSCREEN)-336)/2,
        (GetSystemMetrics(SM_CYSCREEN)-178)/2,
        336,
        178,
        NULL,
        NULL,
        GetModuleHandle(NULL),
        NULL
        );
    if (hWnd == 0)
    {
        ExitProcess(0);
    }
    while (GetMessage(&msg, NULL, 0, 0))
    {
        TranslateMessage(&msg);
        DispatchMessage(&msg);
    }
 
    DeleteObject(hFont1);
    DeleteObject(hFont2);
 
    MessageBox(0, "Evalute Run", "Evalute", 0);
 
    ExitProcess(0);
}

[注意]看雪招聘,专注安全领域的专业人才平台!

上传的附件:
收藏
免费 7
支持
分享
赞赏记录
参与人
雪币
留言
时间
Youlor
为你点赞~
2023-12-26 00:03
伟叔叔
为你点赞~
2023-9-25 00:00
PLEBFE
为你点赞~
2023-7-3 00:21
QinBeast
为你点赞~
2023-6-29 00:00
shinratensei
为你点赞~
2023-6-4 01:21
心游尘世外
为你点赞~
2023-5-30 00:18
飘零丶
为你点赞~
2023-5-20 05:43
最新回复 (14)
雪    币: 233
活跃值: (10)
能力值: ( LV6,RANK:90 )
在线值:
发帖
回帖
粉丝
2
exec加壳不稳定的毛病才要命
2007-11-22 16:39
0
雪    币: 116
活跃值: (220)
能力值: ( LV12,RANK:370 )
在线值:
发帖
回帖
粉丝
3
好帖如美人,我得使劲顶
2007-11-22 16:54
0
雪    币: 224
活跃值: (147)
能力值: ( LV9,RANK:970 )
在线值:
发帖
回帖
粉丝
4
支持,有代码看着舒服,嘎嘎
2007-11-22 17:34
0
雪    币: 6075
活跃值: (2236)
能力值: (RANK:1060 )
在线值:
发帖
回帖
粉丝
5
想了想,无码片还是不贴出来好。

写 unpacker 时发现 OneTouch 更容易脱,没有这个反而不会了,作者惊天动地异于常人地在妙不可言的地方解码了……
2007-11-22 18:03
0
雪    币: 66
活跃值: (15)
能力值: ( LV9,RANK:330 )
在线值:
发帖
回帖
粉丝
6
把整个硬盘都贴出来那就天下无码了
2007-11-22 18:11
0
雪    币: 124
活跃值: (70)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
7
来晚了,没看到fg的无码片
2007-11-22 20:56
0
雪    币: 331
活跃值: (56)
能力值: ( LV13,RANK:410 )
在线值:
发帖
回帖
粉丝
8
无码确实过瘾.
2007-11-23 12:28
0
雪    币: 212
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
9
支持  :)
2007-11-23 18:01
0
雪    币: 494
活跃值: (629)
能力值: ( LV9,RANK:1210 )
在线值:
发帖
回帖
粉丝
10
f的没看见,鄙视打码
2007-11-23 18:13
0
雪    币: 716
活跃值: (162)
能力值: ( LV9,RANK:250 )
在线值:
发帖
回帖
粉丝
11
代码很好看,谢谢~~~
2007-11-23 19:00
0
雪    币: 239
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
12
无码 代码 一个都不能少
2007-11-25 16:01
0
雪    币: 219
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
13
good,execrptor的BUG确实不少.但是我们还是要一脱到底.
2007-12-7 10:44
0
雪    币: 264
活跃值: (44)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
14
无码更有意境
2007-12-7 13:31
0
雪    币: 707
活跃值: (1301)
能力值: ( LV9,RANK:190 )
在线值:
发帖
回帖
粉丝
15
呵呵,这可是好东东哦!!

贴个发送消息的ASM

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Sample code for < Win32ASM Programming 2nd Edition>
; by 罗云彬, http://asm.yeah.net
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Send.asm
; 从一个程序向另一个窗口程序发送消息 之 发送程序
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 使用 nmake 或下列命令进行编译和链接:
; ml /c /coff Send.asm
; Link /subsystem:windows Send.obj
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
                .386
                .model flat,stdcall
                option casemap:none
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Include 文件定义
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
include                windows.inc
include                user32.inc
includelib        user32.lib
include                kernel32.inc
includelib        kernel32.lib
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 数据段
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
                .data
hWnd                dd        ?
szBuffer        db        256 dup (?)

                .const
szCaption        db        'SendMessage',0
szStart                db        'Press OK to start SendMessage, param: %08x!',0
szReturn        db        'SendMessage returned!',0
szDestClass        db        'nkooaquo{xlf',0        ;目标窗口的窗口类
szText                db        'Text send to other windows',0
szNotFound        db        'Receive Message Window not found!',0
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 代码段
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
                .code
start:
                invoke        FindWindow,addr szDestClass,NULL
                .if        eax
                        mov        hWnd,eax        ;找到目标窗口则发送消息
                        invoke        wsprintf,addr szBuffer,addr szStart,addr szText
                        invoke        MessageBox,NULL,offset szBuffer,offset szCaption,MB_OK
                        invoke        SendMessage,hWnd, WM_SYSCOMMAND, SC_CLOSE, 0
                        invoke        MessageBox,NULL,offset szReturn,offset szCaption,MB_OK
                .else
                        invoke        MessageBox,NULL,offset szNotFound,offset szCaption,MB_OK
                .endif
                invoke        ExitProcess,NULL
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
                end        start
2008-1-6 10:32
0
游客
登录 | 注册 方可回帖
返回

账号登录
验证码登录

忘记密码?
没有账号?立即免费注册