<span class="pediy"><span class="pediy">
[最后的战役]:)
; ------------------------------------------------------最后的战役
003B174E 8B85 DBCE4100 mov eax, dword ptr ss:[ebp+41CEDB] ; kernel32.CreateFileA
003B1759 8985 A0FA4100 mov dword ptr ss:[ebp+41FAA0], eax ; kernel32.CreateFileA
003B177B 8B85 CFCE4100 mov eax, dword ptr ss:[ebp+41CECF] ; kernel32.ReadFile
003B1786 8985 A4FA4100 mov dword ptr ss:[ebp+41FAA4], eax ; kernel32.ReadFile
003B1796 8B85 DFCE4100 mov eax, dword ptr ss:[ebp+41CEDF] ; kernel32.WriteFile
003B17A1 8985 A8FA4100 mov dword ptr ss:[ebp+41FAA8], eax ; kernel32.WriteFile
003B17D9 8B85 CBCE4100 mov eax, dword ptr ss:[ebp+41CECB] ; kernel32.SetFilePointer
003B17F6 8985 ACFA4100 mov dword ptr ss:[ebp+41FAAC], eax ; kernel32.SetFilePointer
003B182E 8B85 E3CE4100 mov eax, dword ptr ss:[ebp+41CEE3] ; kernel32.CloseHandle
003B184B 8985 B0FA4100 mov dword ptr ss:[ebp+41FAB0], eax ; kernel32.CloseHandle
003B1895 8B85 EFCE4100 mov eax, dword ptr ss:[ebp+41CEEF] ; kernel32.DeleteFileA
003B18A0 8985 B4FA4100 mov dword ptr ss:[ebp+41FAB4], eax ; kernel32.DeleteFileA
003B18F4 8D85 DC5C4000 lea eax, dword ptr ss:[ebp+405CDC]
; 最后来个int3,还原中断向量
003B1949 60 pushad
003B194F B8 534E5552 mov eax, 52554E53
003B1959 BB 0ECA4100 mov ebx, 41CA0E
003B1975 03DD add ebx, ebp
003B197C CC int3; 收尾
003B1982 61 popad
003B198D 80BD F0344200 0>cmp byte ptr ss:[ebp+4234F0], 1 ; NT? 释放驱动，我们用来夺取ring0的嘛
003B1994 /0F85 93010000 jnz 003B1B2D
003B19C7 8D85 E35C4000 lea eax, dword ptr ss:[ebp+405CE3]; 垃圾
003B1A37 FFB5 546C4000 push dword ptr ss:[ebp+406C54] ; 驱动句柄
003B1A3D FF95 50724000 call dword ptr ss:[ebp+407250] ; kernel32.CloseHandle
003B1A89 FFB5 586C4000 push dword ptr ss:[ebp+406C58] ; 服务
003B1A8F FF95 DD724000 call dword ptr ss:[ebp+4072DD] ; advapi32.CloseServiceHandle
003B1AEF FFB5 3A6C4000 push dword ptr ss:[ebp+406C3A]
003B1AF5 FF95 DD724000 call dword ptr ss:[ebp+4072DD] ; advapi32.CloseServiceHandle
; 解密OEP~~~
003B1B5F 8B85 F8D54100 mov eax, dword ptr ss:[ebp+41D5F8]
003B1B81 53 push ebx ; Try.00418000
003B1BAF 51 push ecx ; advapi32.77DA214E
003B1BC7 52 push edx
003B1BC8 33D2 xor edx, edx
003B1BCF B9 20000000 mov ecx, 20
003B1BD4 33DB xor ebx, ebx ; Try.00418000
003B1BD6 D1F8 sar eax, 1
003B1BDD 0F92C3 setb bl
003B1BE0 D3E3 shl ebx, cl
003B1BE7 03D3 add edx, ebx
003B1BE9 ^\E2 E9 loopd short 003B1BD4
003B1BEB 8BC2 mov eax, edx
003B1C04 5A pop edx
003B1C05 59 pop ecx
003B1C0B 5B pop ebx ; Try.00418000
003B1C43 8B9D DCD34100 mov ebx, dword ptr ss:[ebp+41D3DC] ; Try.00400000
003B1C76 03C3 add eax, ebx ; Try.00400000
; now eax is 0040E2FD, the OEP :),可以直接Dump修正...我们走完吧
003B1C7D 8985 3BD64100 mov dword ptr ss:[ebp+41D63B], eax ; Try.0040E2FD
003B1CD1 80BD 24D64100 0>cmp byte ptr ss:[ebp+41D624], 1
003B1CD8 0F85 04010000 jnz 003B1DE2 ; 跳了，不知道跳过什么冬冬
003B1DF9 /E9 C4000000 jmp 003B1EC2
003B1EE3 8D85 E45C4000 lea eax, dword ptr ss:[ebp+405CE4]
003B1F0B C785 55384200 0>mov dword ptr ss:[ebp+423855], 0
003B1F1A 8BC5 mov eax, ebp
003B1F21 5B pop ebx
003B1F22 59 pop ecx
003B1F23 5A pop edx
003B1F24 5E pop esi
003B1F25 5F pop edi
003B1F26 5D pop ebp
003B1F3E 9D popfd
003B1F6D FFB0 3BD64100 push dword ptr ds:[eax+41D63B]
003B1F78 C780 3BD64100 0>mov dword ptr ds:[eax+41D63B], 0
003B1FAF /E9 CE620000 jmp 003B8282
003B8287 56 push esi ; ntdll.77F57D70
003B82B5 51 push ecx
003B82BB BE CD584000 mov esi, 4058CD
003B82C5 03F0 add esi, eax
003B82CC B9 82820100 mov ecx, 18282
003B8330 C606 00 mov byte ptr ds:[esi], 0 ; erase the loader
003B8338 46 inc esi
003B833E 49 dec ecx
003B8356 83F9 00 cmp ecx, 0
003B8359 ^ 75 A8 jnz short 003B8303
003B839F 59 pop ecx ; 0012FFB0
003B83B7 5E pop esi
003B83CF /E9 81390000 jmp 003BBD55
003BBD55 60 pushad
003BBD56 8BF0 mov esi, eax
003BBD58 B8 4A344200 mov eax, 42344A
003BBD5D 03C6 add eax, esi
003BBD5F BB 59384200 mov ebx, 423859
003BBD64 03DE add ebx, esi
003BBD66 803B 00 cmp byte ptr ds:[ebx], 0
003BBD69 74 0C je short 003BBD77
003BBD6B 6A 00 push 0
003BBD6D 50 push eax
003BBD6E 53 push ebx
003BBD6F 6A 00 push 0
003BBD71 FF96 55384200 call dword ptr ds:[esi+423855]
003BBD77 61 popad
003BBD78 58 pop eax
003BBD79 83F8 FF cmp eax, -1
003BBD7C 75 05 jnz short 003BBD83
003BBD7E 33C0 xor eax, eax
003BBD80 C2 0C00 retn 0C
003BBD83 FFE0 jmp eax ; 飞向光明之巅！！！
0040E2FD 55 push ebp ; Dump & Fix Dump .优化一下即可
0040E2FE 8BEC mov ebp, esp
0040E300 6A FF push -1
0040E302 68 F83A4100 push Try.00413AF8
0040E307 68 84E44000 push Try.0040E484 ; jmp to msvcrt._except_handler3
0040E30C 64:A1 00000000 mov eax, dword ptr fs:[0]
.........
; 这是IAT,ImportRec可以全部找到,因为修改了Magic Jump,所以都有效。
OEP: 0000E2FD IATRVA: 00011000 IATSize: 000003B8
FThunk: 00011000 NbFunc: 00000005
1 00011000 advapi32.dll 01CD RegCreateKeyExA
1 00011004 advapi32.dll 01E2 RegOpenKeyExA
1 00011008 advapi32.dll 01D9 RegEnumValueA
1 0001100C advapi32.dll 01F9 RegSetValueExA
1 00011010 advapi32.dll 01C9 RegCloseKey
FThunk: 00011018 NbFunc: 00000003
1 00011018 gdi32.dll 0196 GetObjectA
1 0001101C gdi32.dll 002E CreateCompatibleDC
1 00011020 gdi32.dll 0013 BitBlt
FThunk: 00011028 NbFunc: 00000017
1 00011028 kernel32.dll 0385 WriteFile
1 0001102C kernel32.dll 0374 WaitForSingleObject
1 00011030 kernel32.dll 0185 GetOverlappedResult
1 00011034 kernel32.dll 004A CreateEventA
1 00011038 kernel32.dll 0030 CloseHandle
1 0001103C kernel32.dll 004E CreateFileA
1 00011040 kernel32.dll 0162 GetLastError
1 00011044 kernel32.dll 00AF EscapeCommFunction
1 00011048 kernel32.dll 0101 GetCommState
1 0001104C kernel32.dll 0284 PurgeComm
1 00011050 kernel32.dll 02CB SetCommMask
1 00011054 kernel32.dll 02CC SetCommState
1 00011058 kernel32.dll 02CD SetCommTimeouts
1 0001105C kernel32.dll 0334 SetupComm
1 00011060 kernel32.dll 0084 DeviceIoControl
1 00011064 kernel32.dll 01D5 GetVersionExA
1 00011068 kernel32.dll 016D GetModuleFileNameA
1 0001106C kernel32.dll 016F GetModuleHandleA
1 00011070 kernel32.dll 01D7 GetVolumeInformationA
1 00011074 kernel32.dll 01B5 GetSystemTime
1 00011078 kernel32.dll 01A6 GetStartupInfoA
1 0001107C kernel32.dll 002E ClearCommError
1 00011080 kernel32.dll 029D ReadFile
FThunk: 00011088 NbFunc: 0000009D
1 00011088 mfc42.dll 0BA9
1 0001108C mfc42.dll 0BA6
1 00011090 mfc42.dll 13C9
1 00011094 mfc42.dll 06BF
1 00011098 mfc42.dll 148D
1 0001109C mfc42.dll 098E
1 000110A0 mfc42.dll 084C
1 000110A4 mfc42.dll 1479
1 000110A8 mfc42.dll 0BA6
1 000110AC mfc42.dll 0BA6
1 000110B0 mfc42.dll 0BA6
1 000110B4 mfc42.dll 06F0
1 000110B8 mfc42.dll 0C40
1 000110BC mfc42.dll 0807
1 000110C0 mfc42.dll 18E8
1 000110C4 mfc42.dll 0C09
1 000110C8 mfc42.dll 0BA0
1 000110CC mfc42.dll 0EF6
1 000110D0 mfc42.dll 0EF1
1 000110D4 mfc42.dll 0EF1
1 000110D8 mfc42.dll 0BA6
1 000110DC mfc42.dll 0FF0
1 000110E0 mfc42.dll 1213
1 000110E4 mfc42.dll 1149
1 000110E8 mfc42.dll 0E0D
1 000110EC mfc42.dll 0144
1 000110F0 mfc42.dll 0281
1 000110F4 mfc42.dll 108A
1 000110F8 mfc42.dll 0CBE
1 000110FC mfc42.dll 08F1
1 00011100 mfc42.dll 1021
1 00011104 mfc42.dll 03AB
1 00011108 mfc42.dll 0B02
1 0001110C mfc42.dll 0A36
1 00011110 mfc42.dll 0490
1 00011114 mfc42.dll 0219
1 00011118 mfc42.dll 0486
1 0001111C mfc42.dll 03AD
1 00011120 mfc42.dll 1613
1 00011124 mfc42.dll 0C37
1 00011128 mfc42.dll 0E20
1 0001112C mfc42.dll 0299
1 00011130 mfc42.dll 07BB
1 00011134 mfc42.dll 18F1
1 00011138 mfc42.dll 1442
1 0001113C mfc42.dll 015E
1 00011140 mfc42.dll 0162
1 00011144 mfc42.dll 04B0
1 00011148 mfc42.dll 18BE
1 0001114C mfc42.dll 16E0
1 00011150 mfc42.dll 0A52
1 00011154 mfc42.dll 175D
1 00011158 mfc42.dll 0C14
1 0001115C mfc42.dll 1542
1 00011160 mfc42.dll 1837
1 00011164 mfc42.dll 1A7A
1 00011168 mfc42.dll 188B
1 0001116C mfc42.dll 19F8
1 00011170 mfc42.dll 0942
1 00011174 mfc42.dll 12E5
1 00011178 mfc42.dll 10B2
1 0001117C mfc42.dll 18E7
1 00011180 mfc42.dll 1186
1 00011184 mfc42.dll 1159
1 00011188 mfc42.dll 0A58
1 0001118C mfc42.dll 1663
1 00011190 mfc42.dll 0F52
1 00011194 mfc42.dll 0441
1 00011198 mfc42.dll 144F
1 0001119C mfc42.dll 095C
1 000111A0 mfc42.dll 0D12
1 000111A4 mfc42.dll 14B4
1 000111A8 mfc42.dll 14B6
1 000111AC mfc42.dll 0AA5
1 000111B0 mfc42.dll 0FEF
1 000111B4 mfc42.dll 125A
1 000111B8 mfc42.dll 14BB
1 000111BC mfc42.dll 14A9
1 000111C0 mfc42.dll 1652
1 000111C4 mfc42.dll 120E
1 000111C8 mfc42.dll 1148
1 000111CC mfc42.dll 0E9A
1 000111D0 mfc42.dll 0231
1 000111D4 mfc42.dll 032F
1 000111D8 mfc42.dll 035C
1 000111DC mfc42.dll 0A3D
1 000111E0 mfc42.dll 046E
1 000111E4 mfc42.dll 096B
1 000111E8 mfc42.dll 0BA6
1 000111EC mfc42.dll 06F0
1 000111F0 mfc42.dll 112C
1 000111F4 mfc42.dll 14AA
1 000111F8 mfc42.dll 0D4A
1 000111FC mfc42.dll 0DF6
1 00011200 mfc42.dll 047A
1 00011204 mfc42.dll 0237
1 00011208 mfc42.dll 08FB
1 0001120C mfc42.dll 08FE
1 00011210 mfc42.dll 06F7
1 00011214 mfc42.dll 1040
1 00011218 mfc42.dll 0B2F
1 0001121C mfc42.dll 094B
1 00011220 mfc42.dll 0DF3
1 00011224 mfc42.dll 0E2A
1 00011228 mfc42.dll 096E
1 0001122C mfc42.dll 02F3
1 00011230 mfc42.dll 01D6
1 00011234 mfc42.dll 0280
1 00011238 mfc42.dll 1699
1 0001123C mfc42.dll 0668
1 00011240 mfc42.dll 0143
1 00011244 mfc42.dll 0669
1 00011248 mfc42.dll 0B2B
1 0001124C mfc42.dll 0A5C
1 00011250 mfc42.dll 1631
1 00011254 mfc42.dll 0685
1 00011258 mfc42.dll 0CF6
1 0001125C mfc42.dll 10B5
1 00011260 mfc42.dll 168D
1 00011264 mfc42.dll 039E
1 00011268 mfc42.dll 021C
1 0001126C mfc42.dll 0E4F
1 00011270 mfc42.dll 19AB
1 00011274 mfc42.dll 074F
1 00011278 mfc42.dll 0337
1 0001127C mfc42.dll 0339
1 00011280 mfc42.dll 0320
1 00011284 mfc42.dll 0ED6
1 00011288 mfc42.dll 14A0
1 0001128C mfc42.dll 1101
1 00011290 mfc42.dll 18E6
1 00011294 mfc42.dll 142B
1 00011298 mfc42.dll 0951
1 0001129C mfc42.dll 1479
1 000112A0 mfc42.dll 1137
1 000112A4 mfc42.dll 06EF
1 000112A8 mfc42.dll 0EF1
1 000112AC mfc42.dll 17A4
1 000112B0 mfc42.dll 09D2
1 000112B4 mfc42.dll 1266
1 000112B8 mfc42.dll 0A18
1 000112BC mfc42.dll 12F5
1 000112C0 mfc42.dll 1118
1 000112C4 mfc42.dll 1479
1 000112C8 mfc42.dll 184F
1 000112CC mfc42.dll 10B6
1 000112D0 mfc42.dll 164E
1 000112D4 mfc42.dll 035A
1 000112D8 mfc42.dll 039A
1 000112DC mfc42.dll 0217
1 000112E0 mfc42.dll 106C
1 000112E4 mfc42.dll 09FA
1 000112E8 mfc42.dll 09D0
1 000112EC mfc42.dll 0B67
1 000112F0 mfc42.dll 1241
1 000112F4 mfc42.dll 0261
1 000112F8 mfc42.dll 0628
FThunk: 00011300 NbFunc: 0000001E
1 00011300 msvcrt.dll 00EE _except_handler3
1 00011304 msvcrt.dll 009A __set_app_type
1 00011308 msvcrt.dll 0087 __p__fmode
1 0001130C msvcrt.dll 0082 __p__commode
1 00011310 msvcrt.dll 00B7 _adjust_fdiv
1 00011314 msvcrt.dll 009C __setusermatherr
1 00011318 msvcrt.dll 013B _initterm
1 0001131C msvcrt.dll 006F __getmainargs
1 00011320 msvcrt.dll 00A9 _acmdln
1 00011324 msvcrt.dll 0290 exit
1 00011328 msvcrt.dll 0050 _XcptFilter
1 0001132C msvcrt.dll 00F7 _exit
1 00011330 msvcrt.dll 01B4 _onexit
1 00011334 msvcrt.dll 006C __dllonexit
1 00011338 msvcrt.dll 0284 atoi
1 0001133C msvcrt.dll 018C _mbsicmp
1 00011340 msvcrt.dll 02FB srand
1 00011344 msvcrt.dll 02ED rand
1 00011348 msvcrt.dll 02D8 malloc
1 0001134C msvcrt.dll 02A5 free
1 00011350 msvcrt.dll 00D7 _controlfp
1 00011354 msvcrt.dll 0317 time
1 00011358 msvcrt.dll 0307 strncmp
1 0001135C msvcrt.dll 0160 _itoa
1 00011360 msvcrt.dll 0054 __CxxFrameHandler
1 00011364 msvcrt.dll 0186 _mbscmp
1 00011368 msvcrt.dll 02F9 sprintf
1 0001136C msvcrt.dll 030A strrchr
1 00011370 msvcrt.dll 0308 strncpy
1 00011374 msvcrt.dll 01DE _setmbcp
FThunk: 0001137C NbFunc: 00000001
1 0001137C netapi32.dll 0100 Netbios
FThunk: 00011384 NbFunc: 0000000C
1 00011384 user32.dll 010D GetDC
1 00011388 user32.dll 01B6 LoadBitmapA
1 0001138C user32.dll 01A7 IsIconic
1 00011390 user32.dll 0009 AppendMenuA
1 00011394 user32.dll 0100 GetClientRect
1 00011398 user32.dll 00B7 DrawIcon
1 0001139C user32.dll 015D GetSystemMenu
1 000113A0 user32.dll 015E GetSystemMetrics
1 000113A4 user32.dll 0194 InvalidateRect
1 000113A8 user32.dll 01BC LoadIconA
1 000113AC user32.dll 00C5 EnableWindow
1 000113B0 user32.dll 023C SendMessageA
