小白帖子，大牛勿拍
实验二进制代码见附件
该实验含有驱动，采用双机调试，需要配置虚拟机Vmware 和Windbg，具体配置方法可以google，此处不再赘述。下面主要捞干滴~
用户层代码分析：
上OD代码：
00401000 /$ 83EC 1C SUB ESP,1C
00401003 |. 57 PUSH EDI
00401004 |. 68 3F000F00 PUSH 0F003F
00401009 |. 6A 00 PUSH 0
0040100B |. 6A 00 PUSH 0
0040100D |. FF15 0C404000 CALL DWORD PTR DS:[<&ADVAPI32.OpenSCMana>; ADVAPI32.OpenSCManagerA
00401013 |. 8BF8 MOV EDI,EAX
00401015 |. 85FF TEST EDI,EDI
00401017 |. 75 07 JNZ SHORT Lab10-01.00401020
00401019 |. 5F POP EDI
0040101A |. 83C4 1C ADD ESP,1C
0040101D |. C2 1000 RETN 10
00401020 |> 56 PUSH ESI
00401021 |. 6A 00 PUSH 0 ; /Password = NULL
00401023 |. 6A 00 PUSH 0 ; |ServiceStartName = NULL
00401025 |. 6A 00 PUSH 0 ; |pDependencies = NULL
00401027 |. 6A 00 PUSH 0 ; |pTagId = NULL
00401029 |. 6A 00 PUSH 0 ; |LoadOrderGroup = NULL
0040102B |. 68 3C504000 PUSH Lab10-01.0040503C ; |BinaryPathName = "C:\Windows\System32\Lab10-01.sys"
00401030 |. 6A 01 PUSH 1 ; |ErrorControl = SERVICE_ERROR_NORMAL
00401032 |. 6A 03 PUSH 3 ; |StartType = SERVICE_DEMAND_START
00401034 |. 6A 01 PUSH 1 ; |ServiceType = SERVICE_KERNEL_DRIVER
00401036 |. 68 FF010F00 PUSH 0F01FF ; |DesiredAccess = SERVICE_ALL_ACCESS
0040103B |. 68 30504000 PUSH Lab10-01.00405030 ; |DisplayName = "Lab10-01"
00401040 |. 68 30504000 PUSH Lab10-01.00405030 ; |ServiceName = "Lab10-01"
00401045 |. 57 PUSH EDI ; |hManager
00401046 |. FF15 08404000 CALL DWORD PTR DS:[<&ADVAPI32.CreateServ>; \CreateServiceA
0040104C |. 8BF0 MOV ESI,EAX
0040104E |. 85F6 TEST ESI,ESI
00401050 |. 75 17 JNZ SHORT Lab10-01.00401069
00401052 |. 68 FF010F00 PUSH 0F01FF
00401057 |. 68 30504000 PUSH Lab10-01.00405030 ; ASCII "Lab10-01"
0040105C |. 57 PUSH EDI
0040105D |. FF15 04404000 CALL DWORD PTR DS:[<&ADVAPI32.OpenServic>; ADVAPI32.OpenServiceA
00401063 |. 8BF0 MOV ESI,EAX
00401065 |. 85F6 TEST ESI,ESI
00401067 |. 74 1D JE SHORT Lab10-01.00401086
00401069 |> 6A 00 PUSH 0
0040106B |. 6A 00 PUSH 0
0040106D |. 56 PUSH ESI
0040106E |. FF15 00404000 CALL DWORD PTR DS:[<&ADVAPI32.StartServi>; ADVAPI32.StartServiceA
00401074 |. 85F6 TEST ESI,ESI
00401076 |. 74 0E JE SHORT Lab10-01.00401086
00401078 |. 8D4424 08 LEA EAX,DWORD PTR SS:[ESP+8]
0040107C |. 50 PUSH EAX
0040107D |. 6A 01 PUSH 1
0040107F |. 56 PUSH ESI
00401080 |. FF15 10404000 CALL DWORD PTR DS:[<&ADVAPI32.ControlSer>; ADVAPI32.ControlService
由0x00401046 处的CreateService函数中的BinaryPathName可知调用的驱动文件在C:\Windows\System32\Lab10-01.sys，在Vmware 内运行完程序后，在host中运行windbg 的lm命令发现，Lab10-01已经卸载了。
kd> lm
start end module name
804d8000 806d0480 nt (pdb symbols) f:\windbgsymbol\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
........//省略n多加载模块
Unloaded modules:
f8dc5000 f8dc6000 Lab10-01.sys
b2009000 b2034000 kmixer.sys
f8db9000 f8dba000 Lab10-01.sys
b2009000 b2034000 kmixer.sys
b2009000 b2034000 kmixer.sys
b2674000 b269f000 kmixer.sys
b273f000 b2762000 aec.sys
f8ced000 f8cee000 drmkaud.sys
b27f3000 b2800000 DMusic.sys
b2803000 b2811000 swmidi.sys
f8bee000 f8bf0000 splitter.sys
f888a000 f8895000 imapi.sys
f899a000 f899f000 Cdaudio.SYS
f838b000 f838e000 Sfloppy.SYS
查看0x00401080 处的ControlService函数第二个参数dwControl=0x1（SERVICE_CONTROL_STOP）通知服务停止，此处可能是驱动卸载点。
所以在函数运行该函数前获取sys的信息。
使用OD运行程序，使程序断在ControlService之前，转至host机上的Windbg调试器。
运行lm命令，查看
f8dce000 f8dcee80 Lab10_01 (deferred)
可以看出Lab10-01从0xf8dce000加载
查看Lab10-01内核对象的地址：
kd> !drvobj Lab10-01
Driver object (81f9d5f0) is for:
*** ERROR: Module load completed but symbols could not be loaded for Lab10-01.sys
\Driver\Lab10-01
Driver Extension List: (id , addr)
Device Object list:
可以看出Lab10-01内核对象的地址为0x81f9d5f0
查看对象的结构：
kd> dt _DRIVER_OBJECT 81f9d5f0
nt!_DRIVER_OBJECT
+0x000 Type : 0n4
+0x002 Size : 0n168
+0x004 DeviceObject : (null)
+0x008 Flags : 0x12
+0x00c DriverStart : 0xf8dce000 Void
+0x010 DriverSize : 0xe80
+0x014 DriverSection : 0x81f79b00 Void
+0x018 DriverExtension : 0x81f9d698 _DRIVER_EXTENSION
+0x01c DriverName : _UNICODE_STRING "\Driver\Lab10-01"
+0x024 HardwareDatabase : 0x80671ae0 _UNICODE_STRING "\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM"
+0x028 FastIoDispatch : (null)
+0x02c DriverInit : 0xf8dce959 long +0
+0x030 DriverStartIo : (null)
+0x034 DriverUnload : 0xf8dce486 void +0
+0x038 MajorFunction : [28] 0x804f454a long nt!IopInvalidDeviceRequest+0
根据加载地址为0xf8dce000知DriverInit 函数的偏移地址为0xf8dce959-0x0xf8dce000=0x959
DriverUnload的偏移地址为 0xf8dce486-0x0xf8dce000=0x486
Windbg设置断点bp 0xf8dce486，在虚拟机内重启程序，会断在断点处，使用Windbg跟踪部分数据信息。
用IDA分析sys的代码，可知0x486偏移量处的代码：
.text:00010486 sub_10486 proc near ; DATA XREF: sub_10906+8o
.text:00010486
.text:00010486 ValueData = dword ptr -4
.text:00010486
.text:00010486 mov edi, edi
.text:00010488 push ebp
.text:00010489 mov ebp, esp
.text:0001048B push ecx
.text:0001048C push ebx
.text:0001048D push esi
.text:0001048E mov esi, ds:RtlCreateRegistryKey
.text:00010494 push edi
.text:00010495 xor edi, edi
.text:00010497 push offset Path ; "\\Registry\\Machine\\SOFTWARE\\Policies\\Mic"...
.text:0001049C push edi ; RelativeTo
.text:0001049D mov [ebp+ValueData], edi
.text:000104A0 call esi ; RtlCreateRegistryKey
.text:000104A2 push offset aRegistryMach_0 ; "\\Registry\\Machine\\SOFTWARE\\Policies\\Mic"...
.text:000104A7 push edi ; RelativeTo
.text:000104A8 call esi ; RtlCreateRegistryKey
.text:000104AA push offset aRegistryMach_1 ; "\\Registry\\Machine\\SOFTWARE\\Policies\\Mic"...
.text:000104AF push edi ; RelativeTo
.text:000104B0 call esi ; RtlCreateRegistryKey
.text:000104B2 mov ebx, offset aRegistryMach_2 ; "\\Registry\\Machine\\SOFTWARE\\Policies\\Mic"...
.text:000104B7 push ebx ; Path
.text:000104B8 push edi ; RelativeTo
.text:000104B9 call esi ; RtlCreateRegistryKey
.text:000104BB mov esi, ds:RtlWriteRegistryValue
.text:000104C1 push 4 ; ValueLength
.text:000104C3 lea eax, [ebp+ValueData]
.text:000104C6 push eax ; ValueData
.text:000104C7 push 4 ; ValueType
.text:000104C9 mov edi, offset ValueName
.text:000104CE push edi ; ValueName
.text:000104CF push offset aRegistryMach_1 ; "\\Registry\\Machine\\SOFTWARE\\Policies\\Mic"...
.text:000104D4 push 0 ; RelativeTo
.text:000104D6 call esi ; RtlWriteRegistryValue
.text:000104D8 push 4 ; ValueLength
.text:000104DA lea eax, [ebp+ValueData]
.text:000104DD push eax ; ValueData
.text:000104DE push 4 ; ValueType
.text:000104E0 push edi ; ValueName
.text:000104E1 push ebx ; Path
.text:000104E2 push 0 ; RelativeTo
.text:000104E4 call esi ; RtlWriteRegistryValue
.text:000104E6 pop edi
.text:000104E7 pop esi
.text:000104E8 pop ebx
.text:000104E9 leave
.text:000104EA retn 4
.text:000104EA sub_10486 endp
主要为创建注册表项和设定值：
创建注册表：
\Registry\Machine\SOFTWARE\Policies\Microsoft
\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsFirewall
\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
创建注册表信息不在仔细分析，现分析第一个RtlWriteRegistryValue，Windbg 相关命令：
p 单步执行 pc 执行至下一个call r查看寄存器值 du 查看内存单元起始的UNICODE字符串
kd> pc
Lab10_01+0x4d6:
f8cb64d6 ffd6 call esi
kd> r
eax=f8af5d54 ebx=f8cb650c ecx=00000008 edx=804fef9d esi=805dea74 edi=f8cb64ee
eip=f8cb64d6 esp=f8af5d30 ebp=f8af5d58 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
Lab10_01+0x4d6:
f8cb64d6 ffd6 call esi {nt!RtlWriteRegistryValue (805dea74)}
kd> du f8cb64ee //ValueName
f8cb64ee "EnableFirewall"
kd> dd f8af5d54 //ValueData
f8af5d54 00000000 f8af5d74 80577863 81f9dda0
f8af5d64 b279ab84 8055c0fc 821b7640 b279ab84
f8af5d74 f8af5dac 80535c02 b279ab84 00000000
f8af5d84 821b7640 00000000 00000000 00000000
f8af5d94 00000001 8055c134 00000000 821b7640
f8af5da4 00000000 8057784a f8af5ddc 805c7160
f8af5db4 b279ab84 00000000 00000000 00000000
f8af5dc4 f8af5db8 00000000 ffffffff 80536e40
ValueLength=4,知EnableFirewall被设为0；Path=\Registry\Machine\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
第二个RtlWriteRegistryValue设置\Registry\Machine\SOFTWARE\Policies\Microsoft下的EnableFirewall=0。
[培训]科锐逆向工程师培训第53期2025年7月8日开班！
上传的附件：
