<span class="pediy"><span class="pediy">
[part 7]输入表处理
; ***********************************************************************************
; 阿 赖 耶 识 —— 输 入 表 处 理 觉 醒
; ***********************************************************************************
003B0FC4 E8 34140000 call 003B23FD ; 当然要进去了
003B242F 60 pushad
003B2474 FF95 1BCF4100 call dword ptr ss:[ebp+41CF1B] ; kernel32.GetCurrentProcessId
003B24A8 8985 20FA4100 mov dword ptr ss:[ebp+41FA20], eax ; save process Id
003B24B3 8B85 1BCF4100 mov eax, dword ptr ss:[ebp+41CF1B] ; kernel32.GetCurrentProcessId
003B24D0 8985 24FA4100 mov dword ptr ss:[ebp+41FA24], eax ; kernel32.GetCurrentProcessId
; 不知道搞什么名堂
003B2508 B8 B8FA4100 mov eax, 41FAB8
003B2512 03C5 add eax, ebp
003B2519 8985 ACDC4100 mov dword ptr ss:[ebp+41DCAC], eax
003B254C 8B9D 08D64100 mov ebx, dword ptr ss:[ebp+41D608] ; Import Table RVA
-------------------
0041F023 78750000
0041F027 00000000
0041F02B 00000000
0041F02F 82750000
0041F033 7D910000
0041F037 25350000
............
-------------------
003B2557 83FB 00 cmp ebx, 0 ; 没有import么？
003B2587 /0F84 1F0A0000 je 003B2FAC ; 当然有，不跳
003B25D1 039D DCD34100 add ebx, dword ptr ss:[ebp+41D3DC] ; +ImageBase,得到IT VA
; ebx -> IID(s)
003B25E6 8B43 0C mov eax, dword ptr ds:[ebx+C] ;pointer to DLL asciz name
003B25EE 83F8 00 cmp eax, 0
003B25F6 /0F84 B0090000 je 003B2FAC ; Game Over?
003B2601 53 push ebx ; Try.0041F023
003B262F 51 push ecx
003B2647 52 push edx
003B2648 33D2 xor edx, edx
003B264F B9 20000000 mov ecx, 20
003B2654 33DB xor ebx, ebx ; Try.0041F023
003B2656 D1F8 sar eax, 1
003B265D 0F92C3 setb bl
003B2660 D3E3 shl ebx, cl
003B2667 03D3 add edx, ebx
003B2669 ^\E2 E9 loopd short 003B2654
; DLL Name 的RVA解码,结果在edx输出
003B266B 8BC2 mov eax, edx ; eax = edx = dll name rva
003B2684 5A pop edx
003B2685 59 pop ecx
003B268B 5B pop ebx
003B2696 0385 DCD34100 add eax, dword ptr ss:[ebp+41D3DC] ; +ImageBase = VA
003B26C9 8BF0 mov esi, eax
003B26D5 C685 78894100 0>mov byte ptr ss:[ebp+418978], 0
; -------------- 是否是特殊 DLL, 包括 Windows Kernel32 & User32, 与 VB 的MSVB ------------------------
003B2709 50 push eax
003B270F 8B00 mov eax, dword ptr ds:[eax]; 取dll name开头4个字节
003B2716 25 DFDFDFDF and eax, DFDFDFDF; 转换为大写
003B2720 3D 4B45524E cmp eax, 4E52454B ; KERN****
003B2725 74 07 je short 003B272E
003B2727 3D 55534552 cmp eax, 52455355 ; USER****
003B272C 75 11 jnz short 003B273F
003B2733 C685 78894100 0>mov byte ptr ss:[ebp+418978], 1 ; 特殊dll标记
003B2744 58 pop eax
003B2777 50 push eax ; Try.00415C82
003B277D 8B00 mov eax, dword ptr ds:[eax]
003B2784 25 DFDFDFDF and eax, DFDFDFDF
003B278E 3D 4D535642 cmp eax, 4256534D ; MSVB****
003B2793 75 11 jnz short 003B27A6
003B279A C685 78894100 0>mov byte ptr ss:[ebp+418978], 1 ; 特殊dll标记
003B27D3 58 pop eax ; Try.00415C82
; 为何不一起判断? D.boy大概写到这里喝多了:0
; ----------------------------------------------------------------------------------------------------
003B27DE 50 push eax
003B27DF FF95 C13D4200 call dword ptr ss:[ebp+423DC1] ; kernel32.LoadLibraryA
; 载入dll
003B27EA 8985 7FCC4100 mov dword ptr ss:[ebp+41CC7F], eax ; 保存dll module base
003B2822 33C0 xor eax, eax
003B2851 8703 xchg dword ptr ds:[ebx], eax ; 清掉IID的OriginalFirstThunk,然后把它读到eax
; 如果改为mov eax, dword ptr [ebx]可以避免...我偷懒,不改了,下面也是这样
003B2858 53 push ebx
003B2886 51 push ecx
003B289E 52 push edx
003B289F 33D2 xor edx, edx
003B28A6 B9 20000000 mov ecx, 20
003B28AB 33DB xor ebx, ebx
003B28AD D1F8 sar eax, 1
003B28B4 0F92C3 setb bl
003B28B7 D3E3 shl ebx, cl
003B28BE 03D3 add edx, ebx
003B28C0 ^\E2 E9 loopd short 003B28AB
003B28C2 8BC2 mov eax, edx
003B28DB 5A pop edx
003B28DC 59 pop ecx
003B28E2 5B pop ebx
003B28E8 8BF0 mov esi, eax
; OriginalFirstThunk解码 -> esi
003B292E 33C0 xor eax, eax
003B295D 8743 10 xchg dword ptr ds:[ebx+10], eax ; eax -> FirstThunk, & erase rva
003B2965 53 push ebx
003B2993 51 push ecx
003B29AB 52 push edx
003B29AC 33D2 xor edx, edx
003B29B3 B9 20000000 mov ecx, 20
003B29B8 33DB xor ebx, ebx
003B29BA D1F8 sar eax, 1
003B29C1 0F92C3 setb bl
003B29C4 D3E3 shl ebx, cl
003B29CB 03D3 add edx, ebx
003B29CD ^\E2 E9 loopd short 003B29B8
003B29CF 8BC2 mov eax, edx
003B29E8 5A pop edx
003B29E9 59 pop ecx
003B29EF 5B pop ebx
003B29F5 8BF8 mov edi, eax
; FirstThunk解码 -> edi
003B2A01 83FE 00 cmp esi, 0 ; OriginalFirstThunk不能用?
003B2A04 /75 34 jnz short 003B2A3A; 能就走
003B2A33 8BF7 mov esi, edi ; 它不行就使用第二个表 FirstThunk
003B2A67 03B5 DCD34100 add esi, dword ptr ss:[ebp+41D3DC] ; +ImageBase,Get VA
003B2A72 03BD DCD34100 add edi, dword ptr ss:[ebp+41D3DC] ; +ImageBase,Get VA
; offset to function name ( and hint)
003B2A99 8B06 mov eax, dword ptr ds:[esi]; 要do hint...
003B2AA0 83F8 00 cmp eax, 0
003B2AA3 /75 29 jnz short 003B2ACE ; 未完?
003B2ABC 83C3 14 add ebx, 14
003B2AC4 ^\E9 13FBFFFF jmp 003B25DC ; 下一个IID
003B2B00 807E 03 80 cmp byte ptr ds:[esi+3], 80 ; is imported by ordinal?
003B2B04 75 6C jnz short 003B2B72
; ord...
003B2B0B 33C0 xor eax, eax
003B2B12 66:8706 xchg word ptr ds:[esi], ax
003B2B42 50 push eax
003B2B43 FFB5 7FCC4100 push dword ptr ss:[ebp+41CC7F]
003B2B49 FF95 C53D4200 call dword ptr ss:[ebp+423DC5]
003B2B54 8BC8 mov ecx, eax
003B2B6D /E9 84000000 jmp 003B2BF6
; str...
003B2B77 33C0 xor eax, eax
003B2B7E 8706 xchg dword ptr ds:[esi], eax
003B2B85 0385 DCD34100 add eax, dword ptr ss:[ebp+41D3DC] ; +ImageBase,这句话打过无数次了,累!!!
003B2BA2 83C0 02 add eax, 2 ; 跳过hint值(sizeof word == 2)
003B2BD2 50 push eax
003B2BD3 FFB5 7FCC4100 push dword ptr ss:[ebp+41CC7F]
003B2BD9 FF95 C53D4200 call dword ptr ss:[ebp+423DC5] ; kernel32.GetProcAddress
003B2C00 80BD 78894100 0>cmp byte ptr ss:[ebp+418978], 1 ; 特殊函数?
003B2C07 /0F85 87020000 jnz 003B2E94 ; magic jump...改为jmp吧,省得心烦
; --------------------------- 加密输入表 ----------------------------------------
; 具体不说了,跟到这里有点筋疲力尽了
003B2C3F 60 pushad
003B2C45 8BF8 mov edi, eax
003B2C63 8B85 A7DC4100 mov eax, dword ptr ss:[ebp+41DCA7]
003B2C6E 3D F4010000 cmp eax, 1F4
003B2C73 /75 1A jnz short 003B2C8F
003B2C7A 89BD 70894100 mov dword ptr ss:[ebp+418970], edi
003B2C85 /E9 C9010000 jmp 003B2E53
003B2CC1 B9 04000000 mov ecx, 4
003B2CCB 33D2 xor edx, edx
003B2CD2 F7E1 mul ecx
003B2CD9 BE B1DC4100 mov esi, 41DCB1
003B2CE3 03F5 add esi, ebp
003B2CFC 33BD 20FA4100 xor edi, dword ptr ss:[ebp+41FA20]
003B2D07 893C06 mov dword ptr ds:[esi+eax], edi
003B2D26 8B85 A7DC4100 mov eax, dword ptr ss:[ebp+41DCA7]
003B2D31 B9 0B000000 mov ecx, 0B
003B2D3B 33D2 xor edx, edx
003B2D42 F7E1 mul ecx
003B2D49 BF 85E44100 mov edi, 41E485
003B2D7B 03FD add edi, ebp
003B2DAA 03F8 add edi, eax
003B2DB6 89BD 70894100 mov dword ptr ss:[ebp+418970], edi
003B2DEE BE A6DC4100 mov esi, 41DCA6
003B2DF8 03F5 add esi, ebp
003B2E27 B9 0B000000 mov ecx, 0B
003B2E31 F3:A4 rep movs byte ptr es:[edi], byte ptr ds:[esi]
003B2E38 FF85 A7DC4100 inc dword ptr ss:[ebp+41DCA7] ; 计数器,被加密的应该是push count...push address...ret
003B2E43 8BBD 70894100 mov edi, dword ptr ss:[ebp+418970]
003B2E6A 61 popad
003B2E70 8B8D 70894100 mov ecx, dword ptr ss:[ebp+418970]
003B2E92 /EB 1E jmp short 003B2EB2
; -----------------------------------------------------------------------------
003B2EAB 8BC8 mov ecx, eax ; NETAPI32.Netbios
; 函数地址
003B2ECE 39BD 33D64100 cmp dword ptr ss:[ebp+41D633], edi
003B2ED4 76 10 jbe short 003B2EE6 ; 不知道,没跳
003B2EDB 89BD 33D64100 mov dword ptr ss:[ebp+41D633], edi
003B2EEB 39BD 2FD64100 cmp dword ptr ss:[ebp+41D62F], edi
003B2EF1 73 10 jnb short 003B2F03; 不知道,还是没跳
003B2EF8 89BD 2FD64100 mov dword ptr ss:[ebp+41D62F], edi
003B2F24 890F mov dword ptr ds:[edi], ecx ; 填充IAT
003B2F3D 83C6 04 add esi, 4
003B2F45 83C7 04 add edi, 4
; 移动Thunk指针
003B2F4D ^\E9 42FBFFFF jmp 003B2A94; 循环---
; ---------------------------------------------------------------------------------------------------
; 从老上边的003B25F6 /0F84 B0090000 je 003B2FAC出来,完成patch iat
003B2FB1 E8 16000000 call 003B2FCC ; 取User32.GetClassNameA...居然专门弄个call...
003B2FBB 61 popad ; 解放了
003B2FC1 C3 ret
