-
-
ShellExecute简单流程
-
发表于: 2008-9-4 01:25
-
【求助】钩住了ZwCreateProcessEx,拦不住ShellExecute？
XP下SSDT钩住了ZwCreateProcessEx (2K下ZwCreateProcess),
点击打开的进程可以监控
拦不住程序中ShellExecute创建的进程。
已解决, 是可以拦住ShellExecute, 挥泪感谢各位大侠的提点!!
看到这个帖子的回复,感觉很温暖,谢谢!
下边是ShellExecute简单流程：
ShellExecute->ShellExecuteEx->ShellExecuteExA->ShellExecuteExW->ShellExecuteNormal->SHELL32!CShellExecute::ExecuteNormal->SHELL32!CShellExecute::_TryInvokeApplication->SHELL32!CShellExecute::_DoExecCommand->SHELL32!_SHCreateProcess->SHELL32!_imp__CreateProcessW
ShellExecute:
7D610F40 > 8BFF mov edi, edi
7D610F42 55 push ebp
7D610F43 8BEC mov ebp, esp
7D610F45 83EC 3C sub esp, 3C
7D610F48 8B45 08 mov eax, dword ptr [ebp+8]
7D610F4B 8365 E4 00 and dword ptr [ebp-1C], 0
7D610F4F 8945 CC mov dword ptr [ebp-34], eax
7D610F52 8B45 0C mov eax, dword ptr [ebp+C]
7D610F55 8945 D0 mov dword ptr [ebp-30], eax
7D610F58 8B45 10 mov eax, dword ptr [ebp+10]
7D610F5B 8945 D4 mov dword ptr [ebp-2C], eax
7D610F5E 8B45 14 mov eax, dword ptr [ebp+14]
7D610F61 56 push esi
7D610F62 8945 D8 mov dword ptr [ebp-28], eax
7D610F65 8B45 18 mov eax, dword ptr [ebp+18]
7D610F68 57 push edi
7D610F69 8945 DC mov dword ptr [ebp-24], eax
7D610F6C 8B45 1C mov eax, dword ptr [ebp+1C]
7D610F6F 6A 06 push 6
7D610F71 8945 E0 mov dword ptr [ebp-20], eax
7D610F74 59 pop ecx
7D610F75 33C0 xor eax, eax
7D610F77 8D7D E8 lea edi, dword ptr [ebp-18]
7D610F7A BE 00020000 mov esi, 200
7D610F7F C745 C4 3C00000>mov dword ptr [ebp-3C], 3C
7D610F86 F3:AB rep stos dword ptr es:[edi]
7D610F88 56 push esi
7D610F89 BF 00140000 mov edi, 1400
7D610F8E FF15 DC1B597D call dword ptr [<&SHLWAPI.#461>] ; SHLWAPI.#461
7D610F94 85C6 test esi, eax
7D610F96 75 05 jnz short 7D610F9D
7D610F98 BF 00150000 mov edi, 1500
7D610F9D 8D45 C4 lea eax, dword ptr [ebp-3C]
7D610FA0 50 push eax
7D610FA1 897D C8 mov dword ptr [ebp-38], edi
7D610FA4 E8 6CFCFFFF call ShellExecuteExA <<<<-----
7D610FA9 8B45 E4 mov eax, dword ptr [ebp-1C]
7D610FAC 5F pop edi
7D610FAD 5E pop esi
7D610FAE C9 leave
7D610FAF C2 1800 retn 18
XP下SSDT钩住了ZwCreateProcessEx (2K下ZwCreateProcess),
点击打开的进程可以监控
拦不住程序中ShellExecute创建的进程。
已解决, 是可以拦住ShellExecute, 挥泪感谢各位大侠的提点!!
看到这个帖子的回复,感觉很温暖,谢谢!
下边是ShellExecute简单流程：
ShellExecute->ShellExecuteEx->ShellExecuteExA->ShellExecuteExW->ShellExecuteNormal->SHELL32!CShellExecute::ExecuteNormal->SHELL32!CShellExecute::_TryInvokeApplication->SHELL32!CShellExecute::_DoExecCommand->SHELL32!_SHCreateProcess->SHELL32!_imp__CreateProcessW
ShellExecute:
7D610F40 > 8BFF mov edi, edi
7D610F42 55 push ebp
7D610F43 8BEC mov ebp, esp
7D610F45 83EC 3C sub esp, 3C
7D610F48 8B45 08 mov eax, dword ptr [ebp+8]
7D610F4B 8365 E4 00 and dword ptr [ebp-1C], 0
7D610F4F 8945 CC mov dword ptr [ebp-34], eax
7D610F52 8B45 0C mov eax, dword ptr [ebp+C]
7D610F55 8945 D0 mov dword ptr [ebp-30], eax
7D610F58 8B45 10 mov eax, dword ptr [ebp+10]
7D610F5B 8945 D4 mov dword ptr [ebp-2C], eax
7D610F5E 8B45 14 mov eax, dword ptr [ebp+14]
7D610F61 56 push esi
7D610F62 8945 D8 mov dword ptr [ebp-28], eax
7D610F65 8B45 18 mov eax, dword ptr [ebp+18]
7D610F68 57 push edi
7D610F69 8945 DC mov dword ptr [ebp-24], eax
7D610F6C 8B45 1C mov eax, dword ptr [ebp+1C]
7D610F6F 6A 06 push 6
7D610F71 8945 E0 mov dword ptr [ebp-20], eax
7D610F74 59 pop ecx
7D610F75 33C0 xor eax, eax
7D610F77 8D7D E8 lea edi, dword ptr [ebp-18]
7D610F7A BE 00020000 mov esi, 200
7D610F7F C745 C4 3C00000>mov dword ptr [ebp-3C], 3C
7D610F86 F3:AB rep stos dword ptr es:[edi]
7D610F88 56 push esi
7D610F89 BF 00140000 mov edi, 1400
7D610F8E FF15 DC1B597D call dword ptr [<&SHLWAPI.#461>] ; SHLWAPI.#461
7D610F94 85C6 test esi, eax
7D610F96 75 05 jnz short 7D610F9D
7D610F98 BF 00150000 mov edi, 1500
7D610F9D 8D45 C4 lea eax, dword ptr [ebp-3C]
7D610FA0 50 push eax
7D610FA1 897D C8 mov dword ptr [ebp-38], edi
7D610FA4 E8 6CFCFFFF call ShellExecuteExA <<<<-----
7D610FA9 8B45 E4 mov eax, dword ptr [ebp-1C]
7D610FAC 5F pop edi
7D610FAD 5E pop esi
7D610FAE C9 leave
7D610FAF C2 1800 retn 18
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
你逆向看看ShellExecute就知道了
|
|
|
特地亲自测试了一下， 对于XP SP3下只须ZwCreateProcessEx足以， 绝对能够拦住ShellExecute创建的进程
就用下面的代码来测试的  .386
.model flat, stdcall
option casemap:none
include windows.inc
include kernel32.inc
include shell32.inc
includelib kernel32.lib
includelib shell32.lib
.data
szFileName db "C:\WINDOWS\NOTEPAD.exe",0
szCmdline db "c:\boot.ini",0
.code
start:
push SW_SHOWNORMAL
push 0
push offset szFileName
push offset szCmdline
push 0
push 0
call ShellExecute
ret
end start  |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
先帮楼主解决问题，再提学习意见
 尊重，都是一点一滴过来的，真没必要BS人
|
