逆向一个病毒,系统重做了N回,终于走到最后,却很郁闷,
如果哪位大侠肯指导一下,在这里先谢谢了!!!!!!!
病毒原文件以前贴过.
开始的过程就不贴了,一直是在对一些字串的操作,
很烦人,主要就是申请空间(在vista下是00CCXXXX这样的值，2ksp4是00D2XXXX),
把.exe和它定义好的字串(盘符,注册表,和几个系统目录)连接,
再把接好的字串存入栈，同时上面的地址也在不断的变大，
(想到最后栈会清掉,里面会不会就是病毒什么重要数据呀？？？？？瞎猜呢，)
开了几个服务，要了电脑名，
为下面准备,
还要变大写(俺不懂,变大写有用吗?),罗嗦的很,
当然本人很菜,很多call也不知它在作甚,
大部分是猜的,说得不对,让大家见笑了.
病毒是先要更新换代的,主要是两个系统目录.
把原文件复制到下面两个目录中并执行,
同时还把名字改没了(.exe).
C:\Program Files\Common Files\Microsoft Shared\
C:\Program Files\Common Files\System\
0040FBE7 |. 50 push eax ; |ExistingFileName
0040FBE8 |. E8 974AFFFF call <jmp.&kernel32.CopyFileA> ; \CopyFileA
0040FBED |. 6A FF push -1 ; 把原程序拷贝到目标路径,并改名
0040FBEF |. 8D85 E0FEFFFF lea eax, dword ptr ss:[ebp-120]
0040FBF5 |. E8 D67EFFFF call 00407AD0 ; shared
0040FBFA |. FFB5 E0FEFFFF push dword ptr ss:[ebp-120]
0040FC00 |. A1 3C154100 mov eax, dword ptr ds:[41153C]
0040FC05 |. FF30 push dword ptr ds:[eax]
0040FC07 |. FF37 push dword ptr ds:[edi]
0040FC09 |. 8D85 E4FEFFFF lea eax, dword ptr ss:[ebp-11C]
0040FC0F |. BA 03000000 mov edx, 3
0040FC14 |. E8 3F41FFFF call 00403D58
0040FC19 |. 8B85 E4FEFFFF mov eax, dword ptr ss:[ebp-11C]
0040FC1F |. E8 7442FFFF call 00403E98
0040FC24 |. 50 push eax
0040FC25 |. A1 34154100 mov eax, dword ptr ds:[411534]
0040FC2A |. 8B00 mov eax, dword ptr ds:[eax]
0040FC2C |. E8 6742FFFF call 00403E98
0040FC31 |. 50 push eax ; |ExistingFileName
0040FC32 |. E8 4D4AFFFF call <jmp.&kernel32.CopyFileA> ; \CopyFileA
0040FC37 |. 6A 01 push 1 ;它完成后我就把它换了别的程序
0040FC39 |. 8D85 D8FEFFFF lea eax, dword ptr ss:[ebp-128]
0040FC3F |. E8 DC7DFFFF call 00407A20
0040FC44 |. FFB5 D8FEFFFF push dword ptr ss:[ebp-128]
0040FC4A |. A1 5C144100 mov eax, dword ptr ds:[41145C]
0040FC4F |. FF30 push dword ptr ds:[eax]
0040FC51 |. FF37 push dword ptr ds:[edi]
0040FC53 |. 8D85 DCFEFFFF lea eax, dword ptr ss:[ebp-124]
0040FC59 |. BA 03000000 mov edx, 3
0040FC5E |. E8 F540FFFF call 00403D58
0040FC63 |. 8B85 DCFEFFFF mov eax, dword ptr ss:[ebp-124]
0040FC69 |. E8 2A42FFFF call 00403E98
0040FC6E |. 50 push eax ; |CmdLine
0040FC6F |. E8 304BFFFF call <jmp.&kernel32.WinExec> ; \WinExec ;在此之前可以放心的跟,
0040FC74 |. 6A 01 push 1
0040FC76 |. 8D85 D0FEFFFF lea eax, dword ptr ss:[ebp-130]
0040FC7C |. E8 4F7EFFFF call 00407AD0
0040FC81 |. FFB5 D0FEFFFF push dword ptr ss:[ebp-130]
0040FC87 |. A1 3C154100 mov eax, dword ptr ds:[41153C]
0040FC8C |. FF30 push dword ptr ds:[eax]
0040FC8E |. FF37 push dword ptr ds:[edi]
0040FC90 |. 8D85 D4FEFFFF lea eax, dword ptr ss:[ebp-12C]
0040FC96 |. BA 03000000 mov edx, 3
0040FC9B |. E8 B840FFFF call 00403D58
0040FCA0 |. 8B85 D4FEFFFF mov eax, dword ptr ss:[ebp-12C]
0040FCA6 |. E8 ED41FFFF call 00403E98
0040FCAB |. 50 push eax ; |CmdLine
0040FCAC |. E8 F34AFFFF call <jmp.&kernel32.WinExec> ; \WinExec
列举d到z
执行原程序
0040FCBC |> /A1 58154100 /mov eax, dword ptr ds:[411558]
0040FCC1 |. |8B13 |mov edx, dword ptr ds:[ebx]
0040FCC3 |. |E8 A03EFFFF |call 00403B68
0040FCC8 |. |8D95 CCFEFFFF |lea edx, dword ptr ss:[ebp-134]
0040FCCE |. |A1 34154100 |mov eax, dword ptr ds:[411534]
0040FCD3 |. |8B00 |mov eax, dword ptr ds:[eax]
0040FCD5 |. |E8 2667FFFF |call 00406400
0040FCDA |. |8B85 CCFEFFFF |mov eax, dword ptr ss:[ebp-134]
0040FCE0 |. |50 |push eax
0040FCE1 |. |A1 58154100 |mov eax, dword ptr ds:[411558]
0040FCE6 |. |FF30 |push dword ptr ds:[eax]
0040FCE8 |. |A1 50154100 |mov eax, dword ptr ds:[411550]
0040FCED |. |FF30 |push dword ptr ds:[eax]
0040FCEF |. |FF37 |push dword ptr ds:[edi]
0040FCF1 |. |8D85 C4FEFFFF |lea eax, dword ptr ss:[ebp-13C]
0040FCF7 |. |BA 03000000 |mov edx, 3
0040FCFC |. |E8 5740FFFF |call 00403D58
0040FD01 |. |8B85 C4FEFFFF |mov eax, dword ptr ss:[ebp-13C]
0040FD07 |. |8D95 C8FEFFFF |lea edx, dword ptr ss:[ebp-138]
0040FD0D |. |E8 EE66FFFF |call 00406400
0040FD12 |. |8B95 C8FEFFFF |mov edx, dword ptr ss:[ebp-138]
0040FD18 |. |58 |pop eax
0040FD19 |. |E8 C640FFFF |call 00403DE4
0040FD1E |. |74 05 |je short 0040FD25
0040FD20 |. |E8 A761FFFF |call 00405ECC ; 执行call
0040FD25 |> |83C3 04 |add ebx, 4
0040FD28 |. |4E |dec esi
0040FD29 |.^\75 91 \jnz short 0040FCBC
00405ECC /$ 55 push ebp
00405ECD |. 8BEC mov ebp, esp
00405ECF |. 81C4 ECFEFFFF add esp, -114
00405ED5 |. 33C0 xor eax, eax
00405ED7 |. 8985 F4FEFFFF mov dword ptr ss:[ebp-10C], eax
00405EDD |. 8985 F0FEFFFF mov dword ptr ss:[ebp-110], eax
00405EE3 |. 8985 ECFEFFFF mov dword ptr ss:[ebp-114], eax
00405EE9 |. 33C0 xor eax, eax
00405EEB |. 55 push ebp
00405EEC |. 68 875F4000 push 00405F87
00405EF1 |. 64:FF30 push dword ptr fs:[eax]
00405EF4 |. 64:8920 mov dword ptr fs:[eax], esp
00405EF7 |. 68 04010000 push 104 ; /BufSize = 104 (260.)
00405EFC |. 8D85 FBFEFFFF lea eax, dword ptr ss:[ebp-105] ; |
00405F02 |. 50 push eax ; |Buffer
00405F03 |. 68 945F4000 push 00405F94 ; |VarName = "Comspec"
00405F08 |. E8 FFE7FFFF call <jmp.&kernel32.GetEnvironmentVar>; \GetEnvironmentVariableA
00405F0D |. 6A 00 push 0
00405F0F |. 8D85 F0FEFFFF lea eax, dword ptr ss:[ebp-110]
00405F15 |. 8D95 FBFEFFFF lea edx, dword ptr ss:[ebp-105] ; 堆栈地址=0012FCE7, (ASCII "C:\Windows\system32\cmd.exe")
00405F1B |. B9 05010000 mov ecx, 105
00405F20 |. E8 5BDDFFFF call 00403C80
00405F25 |. FFB5 F0FEFFFF push dword ptr ss:[ebp-110]
00405F2B |. 68 A45F4000 push 00405FA4 ; 00405FA4=00405FA4 (ASCII " /c del """)
00405F30 |. 8D95 ECFEFFFF lea edx, dword ptr ss:[ebp-114]
00405F36 |. 33C0 xor eax, eax
00405F38 |. E8 CBC7FFFF call 00402708
00405F3D |. FFB5 ECFEFFFF push dword ptr ss:[ebp-114]
00405F43 |. 68 B85F4000 push 00405FB8
00405F48 |. 8D85 F4FEFFFF lea eax, dword ptr ss:[ebp-10C]
00405F4E |. BA 04000000 mov edx, 4
00405F53 |. E8 00DEFFFF call 00403D58
00405F58 |. 8B85 F4FEFFFF mov eax, dword ptr ss:[ebp-10C] ; 堆栈 ss:[0012FCE0]=010D1480, (ASCII "C:\Windows\system32\cmd.exe /c del ""D:\1.exe""")
00405F5E |. E8 35DFFFFF call 00403E98
00405F63 |. 50 push eax ; |CmdLine
00405F64 |. E8 3BE8FFFF call <jmp.&kernel32.WinExec> ; \WinExec
00405F69 |. 33C0 xor eax, eax ; 堆栈 ss:[0012FCE0]=010D1480, (ASCII "C:\Windows\system32\cmd.exe /c del ""D:\1.exe""")
00405F6B |. 5A pop edx
00405F6C |. 59 pop ecx
00405F6D |. 59 pop ecx
00405F6E |. 64:8910 mov dword ptr fs:[eax], edx
00405F71 |. 68 8E5F4000 push 00405F8E
00405F76 |> 8D85 ECFEFFFF lea eax, dword ptr ss:[ebp-114]
00405F7C |. BA 03000000 mov edx, 3
00405F81 |. E8 B2DBFFFF call 00403B38
00405F86 \. C3 retn
不知是不是因为我这只有D盘,最后执行的总是D
0040FD2B /E9 C0050000 jmp 004102F0 ;完成后跑去清理栈里的数据了.
004102F0 |> \33C0 xor eax, eax
004102F2 |. 5A pop edx
004102F3 |. 59 pop ecx
004102F4 |. 59 pop ecx
004102F5 |. 64:8910 mov dword ptr fs:[eax], edx
004102F8 |. 68 25034100 push 00410325
004102FD |> 8D85 6CFEFFFF lea eax, dword ptr ss:[ebp-194]
00410303 |. BA 39000000 mov edx, 39
00410308 |. E8 2B38FFFF call 00403B38 ; 把栈数据清空
0041030D |. 8D85 78FFFFFF lea eax, dword ptr ss:[ebp-88]
00410313 |. BA 1E000000 mov edx, 1E
00410318 |. E8 1B38FFFF call 00403B38
0041031D \. C3 retn
下面是要清除的栈数据
0012FE64 01041A18 ASCII "z:\.exe"
0012FE68 01041A2C ASCII "Z:\.EXE"
0012FE6C 01040AD8 ASCII "D:\1.EXE" ;这是病毒原件
0012FE70 010413B4 ASCII "C:\Program Files\Common Files\Microsoft Shared\"
0012FE74 010413F0 ASCII "C:\Program Files\Common Files\Microsoft Shared\.exe"
0012FE78 01041320 ASCII "C:\Program Files\Common Files\System\"
0012FE7C 01041354 ASCII "C:\Program Files\Common Files\System\.exe"
0012FE80 0104127C ASCII "C:\Program Files\Common Files\Microsoft Shared\"
0012FE84 010412B8 ASCII "C:\Program Files\Common Files\Microsoft Shared\.exe"
0012FE88 010411E8 ASCII "C:\Program Files\Common Files\System\"
0012FE8C 0104121C ASCII "C:\Program Files\Common Files\System\.exe"
0012FE90 00000000
0012FE94 00000000
0012FE98 01041104 ASCII "C:\Program Files\Common Files\Microsoft Shared\"
0012FE9C 01041140 ASCII "C:\Program Files\Common Files\Microsoft Shared\.exe"
0012FEA0 01041180 ASCII "C:\Program Files\Common Files\Microsoft Shared\.exe"
0012FEA4 01041054 ASCII "C:\Program Files\Common Files\Microsoft Shared\dlvmiq"
0012FEA8 01041098 ASCII "C:\Program Files\Common Files\Microsoft Shared\dlvmiq"
0012FEAC 01040F88 ASCII "C:\Program Files\Common Files\System\"
0012FEB0 01040FBC ASCII "C:\Program Files\Common Files\System\.exe"
0012FEB4 01040FF4 ASCII "C:\Program Files\Common Files\System\.exe"
0012FEB8 01040EF0 ASCII "C:\Program Files\Common Files\System\dlvmiq"
0012FEBC 01040F28 ASCII "C:\Program Files\Common Files\System\dlvmiq"
0012FEC0 01040E4C ASCII "C:\Program Files\Common Files\Microsoft Shared\"
0012FEC4 01040E88 ASCII "C:\Program Files\Common Files\Microsoft Shared\.exe"
0012FEC8 01040DB8 ASCII "C:\Program Files\Common Files\System\"
0012FECC 01040DEC ASCII "C:\Program Files\Common Files\System\.exe"
0012FED0 01040D14 ASCII "C:\Program Files\Common Files\Microsoft Shared\"
0012FED4 01040D50 ASCII "C:\Program Files\Common Files\Microsoft Shared\.exe"
0012FED8 01040B08 ASCII "C:\Program Files\Common Files\System\"
0012FEDC 01040CB4 ASCII "C:\Program Files\Common Files\System\.exe"
0012FEE0 01040C38 ASCII "C:\Program Files\Common Files\Microsoft Shared\"
0012FEE4 01040C74 ASCII "C:\Program Files\Common Files\Microsoft Shared\.exe"
0012FEE8 01040A8C ASCII "C:\Program Files\Common Files\System\"
0012FEEC 01040BD8 ASCII "C:\Program Files\Common Files\System\.exe"
0012FF18 01040BB4 ASCII "&&&"
0012FF1C 01040AF0 ASCII "LENOVO-PC"
0012FF20 01040B3C ASCII "DBFH^H%WK&&&"
0012FF24 01040A74 ASCII "LENOVO-PC"
0012FF28 01040AC0 ASCII "DBFH^H%WK"
0012FF2C 01040A4C ASCII "###DBFH^H%WK"
0012FF30 01040930 ASCII "C:\Program Files\Common Files\Microsoft Shared\"
0012FF34 0104096C ASCII "C:\Program Files\Common Files\Microsoft Shared\.exe"
0012FF38 010409AC ASCII "C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\.EXE"
0012FF3C 010408F0 ASCII "D:\1.EXE"
0012FF40 0104084C ASCII "C:\Program Files\Common Files\System\"
0012FF44 01040880 ASCII "C:\Program Files\Common Files\System\.exe"
0012FF48 010408B8 ASCII "C:\PROGRAM FILES\COMMON FILES\SYSTEM\.EXE"
0012FF4C 0104080C ASCII "D:\1.EXE"
0012FF50 010407B0 ASCII "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\.exe"
0012FF54 01040754 ASCII "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\.exe"
很郁闷,到最后只看到了这些,深层的一点也没看到,主要是本人的水平太差,
在查找参考字串中可以知道,
病毒还有很多的动作,
对付杀软,病毒所在的系统目录打开就会被关闭,winrar被关,等等\\\\\\
可一路下来,没看见一点迹象,
试了试把参考里找出来的地址指定为新的eip,
却觉得自己这样没头没脑的.
请教高人 ,
自己是不是做的哪有问题呀,
1,病毒自己运行起来做的事,为什么我在OD里却追不到.
2,在一段我猜是申请空间的程序后返回的是 00CCXXXX(2ksp4是00D2XXXX)这样的地址,这属于哪一段,如果说错了请批评.
3,不知是Delphi难逆向还是病毒写的好,总是call里有call要进好几个子过程才能猜出它的功能.
由于没有任病毒运行成功,所以在执行后的跟踪很没把握.
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
在vista下调试，病毒的活动uac也没见反应，倒是我替换病毒时反应强烈，
再有这个昨天发现金山升级到最新已经可以干掉这种病毒了，
这次学到了不少，从脱壳到跑完全程，可能有一个月了。
相比最后得到的，还是值得的，
抽时间再把程序整理一下，肯定还有更多发现！！
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
