腾讯QQ珊瑚虫外挂原理分析(2)

中华网科技 http://tech.china.com 2005-06-23 10:38:15

【进入BBS】【进入聊天室】【 推荐给朋友 】【浏览字号：大 中 小】【关闭窗口】

　　
留意第三次中断: 77F84BC0 对应着: NtTestAlert 所在库：ntdll.dll

程序每次执行前都要经过 ntdll.dll 的 NtTestAlert函数,它使函数首句跳到某个
地方,从而改变程序流程.
00417E7E 8B45 F4 mov eax,dword ptr ss:[ebp-C]
00417E81 50 push eax
00417E82 E8 DDCDFEFF call ;使得QQ的主线程继续执行

把 0012efc3 处的E9改为CC,再在softice中bpint 3 ,让其中断后跟踪:
001B:77F84BC0 E93BB408E7 JMP 5F010000

单步执行跟踪

001B:5F010000 B80000015F MOV EAX,5F010000
001B:5F010005 B90000005F MOV ECX,5F000000
001B:5F01000A FFD1 CALL ECX

此时ecx的值为5F000000

001B:5F000000 55 PUSH EBP
001B:5F000001 8BEC MOV EBP,ESP
001B:5F000003 83C4EC ADD ESP,-14
001B:5F000006 53 PUSH EBX
001B:5F000007 56 PUSH ESI
001B:5F000008 8BD8 MOV EBX,EAX
001B:5F00000A 896DFC MOV [EBP-04],EBP
001B:5F00000D 8B431C MOV EAX,[EBX+1C]
001B:5F000010 8B55FC MOV EDX,[EBP-04]
001B:5F000013 83C204 ADD EDX,04
001B:5F000016 8902 MOV [EDX],EAX
001B:5F000018 8B431C MOV EAX,[EBX+1C]
001B:5F00001B 8945EC MOV [EBP-14],EAX
001B:5F00001E C745FC05000000 MOV DWORD PTR [EBP-04],00000005
001B:5F000025 8D45F8 LEA EAX,[EBP-08]
001B:5F000028 50 PUSH EAX
001B:5F000029 6A40 PUSH 40
001B:5F00002B 8D45FC LEA EAX,[EBP-04]
001B:5F00002E 50 PUSH EAX
001B:5F00002F 8D45EC LEA EAX,[EBP-14]
001B:5F000032 50 PUSH EAX
001B:5F000033 6AFF PUSH FF
001B:5F000035 FF15C600005F CALL [5F0000C6]
001B:5F00003B 8B431C MOV EAX,[EBX+1C]
001B:5F00003E 8B5320 MOV EDX,[EBX+20]
001B:5F000041 8910 MOV [EAX],EDX ;恢复Ntdll.NtTestAlert入口处
001B:5F000043 8A5324 MOV DL,[EBX+24]
001B:5F000046 885004 MOV [EAX+04],DL
001B:5F000049 C745FC05000000 MOV DWORD PTR [EBP-04],00000005
001B:5F000050 8D45F8 LEA EAX,[EBP-08]
001B:5F000053 50 PUSH EAX
001B:5F000054 8B45F8 MOV EAX,[EBP-08]
001B:5F000057 50 PUSH EAX
001B:5F000058 8D45FC LEA EAX,[EBP-04]
001B:5F00005B 50 PUSH EAX
001B:5F00005C 8D45EC LEA EAX,[EBP-14]
001B:5F00005F 50 PUSH EAX
001B:5F000060 6AFF PUSH FF
001B:5F000062 FF15CA00005F CALL [5F0000CA]
001B:5F000068 8B7318 MOV ESI,[EBX+18]
001B:5F00006B 4E DEC ESI
001B:5F00006C 85F6 TEST ESI,ESI
001B:5F00006E 7C4C JL 5F0000BC
001B:5F000070 46 INC ESI
001B:5F000071 8D4325 LEA EAX,[EBX+25]
001B:5F000074 8BD8 MOV EBX,EAX
001B:5F000076 33D2 XOR EDX,EDX
001B:5F000078 8BC3 MOV EAX,EBX
001B:5F00007A 66833800 CMP WORD PTR [EAX],00
001B:5F00007E 740C JZ 5F00008C
001B:5F000080 42 INC EDX
001B:5F000081 83C002 ADD EAX,02
001B:5F000084 81FA03010000 CMP EDX,00000103
001B:5F00008A 75EE JNZ 5F00007A
001B:5F00008C 8BC2 MOV EAX,EDX
001B:5F00008E 03C0 ADD EAX,EAX
001B:5F000090 668945F0 MOV [EBP-10],AX
001B:5F000094 6683C002 ADD AX,02
001B:5F000098 668945F2 MOV [EBP-0E],AX
001B:5F00009C 8BC3 MOV EAX,EBX
001B:5F00009E 8945F4 MOV [EBP-0C],EAX
001B:5F0000A1 8D45FC LEA EAX,[EBP-04]
001B:5F0000A4 50 PUSH EAX
001B:5F0000A5 8D45F0 LEA EAX,[EBP-10]
001B:5F0000A8 50 PUSH EAX
001B:5F0000A9 6A00 PUSH 00
001B:5F0000AB 6A00 PUSH 00
001B:5F0000AD FF15CE00005F CALL [5F0000CE] ;call LoadLibraryA
001B:5F0000B3 81C308020000 ADD EBX,00000208
001B:5F0000B9 4E DEC ESI
001B:5F0000BA 75BA JNZ 5F000076
001B:5F0000BC 5E POP ESI
001B:5F0000BD 5B POP EBX
001B:5F0000BE 8BE5 MOV ESP,EBP
001B:5F0000C0 5D POP EBP
001B:5F0000C1 C3 RET
001B:5F0000C2 0000 ADD [EAX],AL
001B:5F0000C4 0000 ADD [EAX],AL
001B:5F0000C6 C4BFF877C4BF LES EDI,[EDI+BFC477F8]
001B:5F0000CC F8 CLC
001B:5F0000CD 7761 JA 5F000130
001B:5F0000CF 32F8 XOR BH,AL
001B:5F0000D1 7700 JA 5F0000D3

首页 上页 | 1 | 2 | 3 | 4 | 5... 下页 尾页  共 6 页