腾讯QQ珊瑚虫外挂原理分析(6)

中华网科技 http://tech.china.com 2005-06-23 10:38:15

【进入BBS】【进入聊天室】【 推荐给朋友 】【浏览字号：大 中 小】【关闭窗口】

　　
mov wrisize,codeend-codewrite
mov wriaddr,080000000h
sub wriaddr,1000h
again:
add wriaddr,1000h
mov wribase,codewrite
invoke WriteProcessMemory,stProcInfo.hProcess,wriaddr,
wribase,wrisize,addr num ;写入代码
mov eax,wrisize
cmp eax,num
jnz again

mov eax,wriaddr
mov ebx,chan0-4
mov [ebx],eax
invoke VirtualProtectEx,stProcInfo.hProcess,0464b58h,7,
PAGE_EXECUTE_READWRITE,addr oldpro ;改变QQ.exe的oep处的属性
mov wribase,oepwrite
invoke WriteProcessMemory,stProcInfo.hProcess,0464b58h, wribase,7,
addr num ;写入数据

mov eax,dllin
mov ebx,chan2-4
mov [ebx],eax
mov eax,codeend-codewrite
add eax,wriaddr
mov ebx,chan1-4
mov [ebx],eax
mov wribase,codewrite
mov wrisize,codeend-codewrite
invoke WriteProcessMemory,stProcInfo.hProcess,wriaddr,
wribase,wrisize,addr num

mov eax,codeend-codewrite
add eax,wriaddr
mov lastwri,eax
invoke WriteProcessMemory,stProcInfo.hProcess,lastwri,offset dllname,
sizeof dllname,addr num

invoke ResumeThread,stProcInfo.hThread ;让QQ继续执行
exit:
invoke ExitProcess,0
ret


main endp

;下面的都是要写入到QQ.exe的内存的附加代码,但有些数值在写入前要实时修正

oepwrite:
mov eax,0
chan0: jmp eax

codewrite:
mov eax,0464b58h
push 6aec8b55h
pop [eax]
mov eax,0464b5ch
push 101868ffh
pop [eax]
push 080000000
chan1:
push 464b58h
mov eax,0
chan2:
jmp eax
codeend:

end start

首页 上页 | ...3| 4 | 5 | 6 | 下页 尾页  共 6 页