<span class="pediy"><span class="pediy">
[part 4]
003AF6B3 90 nop
003AF6B8 8BC5 mov eax, ebp
003AF6BA E8 00000000 call 003AF6BF
003AF6BF 5D pop ebp
003AF6C0 81ED 8C4F4100 sub ebp, 414F8C
003AF6DD 50 push eax
003AF70B 53 push ebx
003AF711 B8 534E5552 mov eax, 52554E53
003AF743 8D9D 71504100 lea ebx, dword ptr ss:[ebp+415071] ; 通过int3调用地址
003AF760 CC int3 ; 改中断
003AF766 5B pop ebx
003AF794 58 pop eax
003AF79A /E9 DF000000 jmp 003AF87E ; 走人
-----------------------------------------------------
; 9x的处理
003AF7A9 8DB5 4E344200 lea esi, dword ptr ss:[ebp+42344E]
003AF7B4 0F010E sidt fword ptr ds:[esi]
003AF7E4 8B76 02 mov esi, dword ptr ds:[esi+2]
003AF803 8D85 5C3A4200 lea eax, dword ptr ss:[ebp+423A5C]
003AF836 66:8946 18 mov word ptr ds:[esi+18], ax
003AF83F C1E8 10 shr eax, 10
003AF847 66:8946 1E mov word ptr ds:[esi+1E], ax
003AF850 C3 retn
-----------------------------------------------------
003AF8DD 8985 3FD64100 mov dword ptr ss:[ebp+41D63F], eax
003AF8E8 C785 43D64100 C>mov dword ptr ss:[ebp+41D643], 4058CD
003AF8F7 0185 43D64100 add dword ptr ss:[ebp+41D643], eax ; 修正base
003AF92A 899D F5344200 mov dword ptr ss:[ebp+4234F5], ebx
003AF951 BF CD584000 mov edi, 4058CD
003AF95B 03F8 add edi, eax ; 还是修正base
003AF962 B9 7DDB0100 mov ecx, 1DB7D ; 长度
003AF96C 32C0 xor al, al
003AF973 F3:AA rep stosb ; 擦除外壳区段里的东西(我们在内存里!)
003AF991 8D85 D45C4000 lea eax, dword ptr ss:[ebp+405CD4]
003AF9F6 60 pushad ; 看到这个肯定要干坏事
003AFA0E B8 534E5552 mov eax, 52554E53
003AFA18 BB C0534100 mov ebx, 4153C0
003AFA22 03DD add ebx, ebp
003AFA29 CC int3 ; F4到这里
; 我这里 int3的处理是：3be18f
---------------------------------------------------
003BE194 3D 534E5552 cmp eax, 52554E53
003BE199 75 74 jnz short 003BE20F
003BE1B2 FFD3 call ebx
003BE1E1 CF iretd
---------------------------------------------------
; 可见是通过int3执行ebx, ebx似乎是通过向量反跟踪
003AFA2F 66:3D 0000 cmp ax, 0 ; 再F4到这里
003AFA38 61 popad
003AFA55 9C pushfd ; 害怕 ZF 出事, 看来一定有鬼：）
003AFA5B BB 8AD34100 mov ebx, 41D38A
003AFA77 03DD add ebx, ebp
003AFA7E 9D popfd
003AFE1F 83BD 47D64100 0>cmp dword ptr ss:[ebp+41D647], 0
003AFE26 0F84 CA000000 je 003AFEF6
003AFF12 83BD 041E4200 0>cmp dword ptr ss:[ebp+421E04], 1
003AFF19 0F84 9D000000 je 003AFFBC
003AFFEE 8D85 D55C4000 lea eax, dword ptr ss:[ebp+405CD5]
003B0031 83BD 001E4200 0>cmp dword ptr ss:[ebp+421E00], 1
003B0038 0F85 9F000000 jnz 003B00DD
003B0043 8DB5 5C344200 lea esi, dword ptr ss:[ebp+42345C] ; 开始用GetVersionExA获得的版本
003B004E 837E 10 02 cmp dword ptr ds:[esi+10], 2
003B0052 /75 31 jnz short 003B0085 ; 不是9x?
003B0059 837E 04 04 cmp dword ptr ds:[esi+4], 4
003B005D 77 0F ja short 003B006E ; 不是未知？ 那就是NT
003B00B2 89AD 8A204200 mov dword ptr ss:[ebp+42208A], ebp
003B00BD 8D9D 88204200 lea ebx, dword ptr ss:[ebp+422088] ; 怕~~~~
---------------------------------------------------------------------------
003B7ABD 20 20 20 45 72 72 6F 72 20 28 33 29 3A 20 44 65 Error (3): De
003B7ACD 62 75 67 67 65 72 20 64 65 74 65 63 74 69 6F 6E bugger detection
003B7ADD 20 2C 20 41 62 6F 72 74 21 20 00 20 20 20 45 72 , Abort! . Er
003B7AED 72 6F 72 20 28 34 29 3A 20 46 69 6C 65 20 43 52 ror (4): File CR
003B7AFD 43 20 45 72 72 6F 72 2C 20 20 20 41 62 6F 72 74 C Error, Abort
003B7B0D 21 00 !.
---------------------------------------------------------------------------
; 反跟踪定时器,不好玩,干掉他===>how?看下边
003B00C8 53 push ebx
003B00C9 68 F4010000 push 1F4
003B00CE 6A 00 push 0
003B00D0 6A 00 push 0
003B00D2 FF95 68CF4100 call dword ptr ss:[ebp+41CF68] ; user32.SetTimer
---> F7进入
77D19160 > B8 1E120000 mov eax, 121E ; 修改为retn 10了事
77D19165 BA 0003FE7F mov edx, 7FFE0300
77D1916A FFD2 call edx
77D1916C C2 1000 retn 10
0012FF94 003B00D8 /CALL to SetTimer from 003B00D2
0012FF98 00000000 |hWnd = NULL
0012FF9C 00000000 |TimerID = 0
0012FFA0 000001F4 |Timeout = 500. ms
0012FFA4 003BC7BB \Timerproc = 003BC7BB ;干坏事,发生mov eax, [eax](eax==0)异常有兴趣可以研究一下
; 恢复刚才的 SetTimer 代码...小心至上
003B0142 8D85 D65C4000 lea eax, dword ptr ss:[ebp+405CD6] ; 无聊
; ==============================================================================
; A n t i - D u m p i n g
;
; 我只知道是Anti-Dumping,原理大概是修改ImageSize,有兴趣自己研究吧.
; ==============================================================================
003B016A 64:67:A1 3000 mov eax, dword ptr fs:[30]
003B0174 85C0 test eax, eax
003B01A3 78 78 js short 003B021D ; else...根据系统不同决定
003B01C1 8B40 0C mov eax, dword ptr ds:[eax+C]
003B01DB 8B40 0C mov eax, dword ptr ds:[eax+C]
003B01F5 C740 20 0010000 mov dword ptr ds:[eax+20], 1000
003B0201 E9 9E000000 jmp 003B02A4 ; anti_dump_over
003B022C 6A 00 push 0
003B022E FF95 F7CE4100 call dword ptr ss:[ebp+41CEF7] ; GetModuleHandleA
003B023E 85D2 test edx, edx
003B0245 79 5D jns short 003B02A4 ; anti_dump_over
003B024C 837A 08 FF cmp dword ptr ds:[edx+8], -1
003B0267 75 3B jnz short 003B02A4 ; anti_dump_over
003B026E 8B52 04 mov edx, dword ptr ds:[edx+4]
003B028D C742 50 0010000>mov dword ptr ds:[edx+50], 1000
003B0299 66:C742 06 1010 mov word ptr ds:[edx+6], 1010 ; 没见过:P,NumberOfSections?
; ==============================================================================
003B02DB 8D85 D75C4000 lea eax, dword ptr ss:[ebp+405CD7]; 错误消息
; ==============================================================================
; M e l t I C E
;
; 地球人都知道
; ==============================================================================
003B0303 BE 26CC4100 mov esi, 41CC26
003B031F 03F5 add esi, ebp ; esi -> 指向 MeltICE 驱动表
; 不幸儿童:
---------------------------------------------------------------------------
003B7359 5C 5C 2E 5C 62 77 32 6B 00 5C 5C 2E 5C 53 55 50 \\.\bw2k.\\.\SUP
003B7369 45 52 42 50 4D 00 5C 5C 2E 5C 49 43 45 44 55 4D ERBPM.\\.\ICEDUM
003B7379 50 00 5C 5C 2E 5C 52 45 47 56 58 44 00 5C 5C 2E P.\\.\REGVXD.\\.
003B7389 5C 4E 54 49 43 45 00 5C 5C 2E 5C 53 49 57 56 49 \NTICE.\\.\SIWVI
003B7399 44 00 5C 5C 2E 5C 53 49 43 45 00 5C 5C 2E 5C 46 D.\\.\SICE.\\.\F
003B73A9 49 4C 45 56 58 44 00 ILEVXD.
---------------------------------------------------------------------------
003B037C FFB5 DBCE4100 push dword ptr ss:[ebp+41CEDB] ; kernel32.CreateFileA
003B0382 8F85 F9344200 pop dword ptr ss:[ebp+4234F9] ; kernel32.CreateFileA
; 无聊的倒腾~~~
003B03CC 6A 00 push 0
003B03CE 6A 00 push 0
003B03D0 6A 00 push 0
003B03D2 6A 00 push 0
003B03D4 6A 00 push 0
003B03D6 6A 00 push 0
003B03D8 56 push esi
003B03D9 FF95 DBCE4100 call dword ptr ss:[ebp+41CEDB] ; kernel32.CreateFileA
0012FF88 003B03DF /CALL to CreateFileA from 003B03D9
0012FF8C 003B7359 |FileName = "\\.\theif" ; -_-;;
0012FF90 00000000 |Access = 0
0012FF94 00000000 |ShareMode = 0
0012FF98 00000000 |pSecurity = NULL
0012FF9C 00000000 |Mode = 0
0012FFA0 00000000 |Attributes = 0
0012FFA4 00000000 \hTemplateFile = NULL
003B03E9 83F8 FF cmp eax, -1
003B03F1 /0F85 8E000000 jnz 003B0485 ; 事情不好办啦^_^
; 循环使esi指向下一个名称
003B041D / 46 inc esi
003B0423 | 803E 00 cmp byte ptr ds:[esi], 0
003B042B \ 75 EB jnz short 003B0418 ; ===> 003B041D
003B0432 46 inc esi ; Skip NULL char
003B044A 803E 00 cmp byte ptr ds:[esi], 0 ; 表示用完了吗?
003B047A ^\0F85 E5FEFFFF jnz 003B0365 ; 没完?接着来……
; ==============================================================================
003B04DF 8D9D 5FD34100 lea ebx, dword ptr ss:[ebp+41D35F] ; 我又怕了
---------------------------------------------------------------------------
003B7A92 20 20 20 45 72 72 6F 72 20 28 32 29 3A 20 44 65 Error (2): De
003B7AA2 62 75 67 67 65 72 20 64 65 74 65 63 74 69 6F 6E bugger detection
003B7AB2 20 2C 20 41 62 6F 72 74 21 20 00 20 20 20 45 72 , Abort! . Er
003B7AC2 72 6F 72 20 28 33 29 3A 20 44 65 62 75 67 67 65 ror (3): Debugge
003B7AD2 72 20 64 65 74 65 63 74 69 6F 6E 20 2C 20 41 62 r detection , Ab
003B7AE2 6F 72 74 21 20 00 ort! .
---------------------------------------------------------------------------
003B04FC 83F8 FF cmp eax, -1
003B0504 /0F85 C61A0000 jnz 003B1FD0 ; 送你去取经
; ==============================================================================
; Ch e c k s u m - C h e c k i n g
;
; 外星人也都知道,但是算法叫什么我不清楚(脸红)
; ==============================================================================
003B055D 8B85 18D64100 mov eax, dword ptr ss:[ebp+41D618] ; 我想是CRC protection flag
003B0568 83F8 00 cmp eax, 0
003B056B /74 51 je short 003B05BE ; 我这里JUMP
003B05F5 8BBD FCD54100 mov edi, dword ptr ss:[ebp+41D5FC] ; 好像是资源段
003B0628 03BD DCD34100 add edi, dword ptr ss:[ebp+41D3DC] ; +ImageBase
003B0633 8B8D 00D64100 mov ecx, dword ptr ss:[ebp+41D600] ; size
003B063E 83F9 00 cmp ecx, 0
003B0641 0F84 C5000000 je 003B070C ; Nothing?
003B064C 33C0 xor eax, eax
003B0665 33DB xor ebx, ebx
003B066C 33D2 xor edx, edx
003B068A /8A1F mov bl, byte ptr ds:[edi] ; get a byte
003B0691 | 32D9 xor bl, cl
003B0698 | 03C3 add eax, ebx
003B069F | 47 inc edi
003B06A5 | 49 dec ecx
003B06BD | 83F9 00 cmp ecx, 0
003B06C0 ^\75 C3 jnz short 003B0685 ; 计算校验和
003B06C7 8D9D B5D34100 lea ebx, dword ptr ss:[ebp+41D3B5]
---------------------------------------------------------------------------
003B7AE8 20 20 20 45 72 72 6F 72 20 28 34 29 3A 20 46 69 Error (4): Fi
003B7AF8 6C 65 20 43 52 43 20 45 72 72 6F 72 2C 20 20 20 le CRC Error,
003B7B08 41 62 6F 72 74 21 00 Abort!.
---------------------------------------------------------------------------
003B06E4 3985 04D64100 cmp dword ptr ss:[ebp+41D604], eax ; 比较校验和
003B06EF /0F85 DB180000 jnz 003B1FD0 ; 你敢跳？
; ==============================================================================
