讨论
| jingulong 写道: | tr> <tr>iat修复不难，3.6主程序中类似下面的语句比较麻烦： 00401C8F 8B3D 94AC4400 MOV EDI,DWORD PTR DS:[<&kernel32.GetProcAddress>] ; KERNEL32.GetProcAddress 00401C95 -E9 04F15A02 JMP 029B0D9E 00401C9A 66:87F9 XCHG CX,DI 00401C9D 66:87F9 XCHG CX,DI 00401CA0 FFD7 CALL EDI 00401CA2 -E9 13F15A02 JMP 029B0DBA 这里jmp到的地方只有程序运行起来才能得到，而这属于子进程！ |
tr>
这个很好解决，而且偶已经解决，把该段内存sotlen code代码全部dump出来，修复时再建立一内存映像到2450000(偶dump时都jmp 245xxxx处执行)，把该段stolen code全部复制过去，OK!
这是dump出来的部分代码：
:00000000 53 push ebx
:00000001 52 push edx
:00000002 6687CB xchg bx, cx
:00000005 93 xchg eax,ebx
:00000006 7A02 jpe 0000000A
:00000008 7A17 jpe 00000021
:0000000A 6687D3 xchg bx, dx
:0000000D 8BC9 mov ecx, ecx
:0000000F 6687D3 xchg bx, dx
:00000012 93 xchg eax,ebx
:00000013 6687CB xchg bx, cx
:00000016 90 nop
:00000017 5A pop edx
:00000018 5B pop ebx
:00000019 56 push esi
:0000001A 6848100000 push 00001048
:0000001F E9E10FFBFD jmp FDFB1005 //回到程序，此处其实是jmp 00401005,因为所处地址不一样变形了，下同。
:00000024 FF742414 push [esp+14]
:00000028 8BF0 mov esi, eax
:0000002A FF742414 push [esp+14]
:0000002E F7D1 not ecx
:00000030 87D3 xchg ebx, edx
:00000032 87D3 xchg ebx, edx
:00000034 F7D1 not ecx
:00000036 FF742414 push [esp+14]
:0000003A 56 push esi
:0000003B E9D00FFBFD jmp FDFB1010
:00000040 8B4508 mov eax, dword ptr [ebp+08]
:00000043 53 push ebx
:00000044 56 push esi
:00000045 57 push edi
:00000046 8D9800100000 lea ebx, dword ptr [eax+00001000]
:0000004C 6A12 push 00000012
:0000004E 59 pop ecx
:0000004F 8D75AC lea esi, dword ptr [ebp-54]
:00000052 8BFB mov edi, ebx
:00000054 C745AC886A3F24 mov [ebp-54], 243F6A88
:0000005B C745B0D308A385 mov [ebp-50], 85A308D3
:00000062 C745B42E8A1913 mov [ebp-4C], 13198A2E
:00000069 C745B844737003 mov [ebp-48], 03707344
:00000070 C745BC223809A4 mov [ebp-44], A4093822
:00000077 C745C0D0319F29 mov [ebp-40], 299F31D0
:0000007E C745C498FA2E08 mov [ebp-3C], 082EFA98
:00000085 C745C8896C4EEC mov [ebp-38], EC4E6C89
:0000008C C745CCE6212845 mov [ebp-34], 452821E6
:00000093 C745D07713D038 mov [ebp-30], 38D01377
:0000009A C745D4CF6654BE mov [ebp-2C], BE5466CF
:000000A1 C745D86C0CE934 mov [ebp-28], 34E90C6C
:000000A8 C745DCB729ACC0 mov [ebp-24], C0AC29B7
:000000AF C745E0DD507CC9 mov [ebp-20], C97C50DD
:000000B6 96 xchg eax,esi
:000000B7 96 xchg eax,esi
:000000B8 6687DB xchg bx, bx
:000000BB C745E4B5D5843F mov [ebp-1C], 3F84D5B5
:000000C2 C745E8170947B5 mov [ebp-18], B5470917
:000000C9 C745ECD9D51692 mov [ebp-14], 9216D5D9
:000000D0 C745F01BFB7989 mov [ebp-10], 8979FB1B
:000000D7 C745F804000000 mov [ebp-08], 00000004
:000000DE E94E0FFBFD jmp FDFB1031
:000000E3 8BD2 mov edx, edx
:000000E5 8B4D14 mov ecx, dword ptr [ebp+14]
:000000E8 894DF4 mov dword ptr [ebp-0C], ecx
:000000EB E9DC0FFBFD jmp FDFB10CC
:000000F0 87D3 xchg ebx, edx
:000000F2 0FCF bswap edi
:000000F4 7C00 jl 000000F6
:000000F6 7800 js 000000F8
:000000F8 0FCF bswap edi
:000000FA 87D3 xchg ebx, edx
:000000FC 6687FF xchg di, di
:000000FF BF00010000 mov edi, 00000100
:00000104 E9CB0FFBFD jmp FDFB10D4
:00000109 96 xchg eax,esi
:0000010A F7D0 not eax
:0000010C 87D1 xchg ecx, edx
:0000010E 90 nop
:0000010F 87D1 xchg ecx, edx
:00000111 F7D0 not eax
:00000113 90 nop
:00000114 96 xchg eax,esi
:00000115 7200 jb 00000117
:00000117 6A09 push 00000009
:00000119 8DB304100000 lea esi, dword ptr [ebx+00001004]
:0000011F 5F pop edi
:00000120 E90110FBFD jmp FDFB1126
