00415A3C . 50 push eax ; /pOldProtect
00415A3D . 6A 40 push 40 ; NewProtect = PAGE_EXECUTE_READWRITE
00415A3F . 57 push edi ; Size
00415A40 . 56 push esi ; Address
00415A41 . 53 push ebx ; hProcess
00415A42 . E8 85F2FEFF call ; \VirtualProtectEx
上面的代码是改变QQ.exe的oep处的属性,使其可读可写可执行,为改写oep处的代码做准备
接着,又一次中断在WriteProcessMemory
看看堆栈:
0067EA5C 0000000C hProcess = 0000000C
0067EA60 00464B58 Address = 464B58
0067EA64 0067EE46 Buffer = 0067EE46
0067EA68 00000005 BytesToWrite = 5
0067EA6C 0067EA7C \pBytesWritten = 0067EA7C
464b58就是QQ.exe的OEP,很明显,它要改变oep来改变程序流程!!
好了,我们又用那套方法,把0067eea6的第一个字节改为cc,在softice中bpint 3,然后中断,再
跟踪.
在softice下中断后:
0167:00464B58 E91328CE82 JMP 83147370
0167:83147370 C705584B4600558BEC6AMOV DWORD PTR [00464B58],6AEC8B55 ;马上恢复oep处的代码
0167:8314737A C6055C4B4600FF MOV BYTE PTR [00464B5C],FF
0167:83147381 68FA731483 PUSH 831473FA
0167:83147386 6838000000 PUSH 00000038
0167:8314738B 6A40 PUSH 40
0167:8314738D FF15F6731483 CALL [KERNEL32!GlobalAlloc] ;再申请内存
0167:83147393 C700B85077F7 MOV DWORD PTR [EAX],F77750B8 ;从这里开始一直填入新数据
0167:83147399 C74004BFFFD068 MOV DWORD PTR [EAX+04],68D0FFBF
0167:831473A0 C7400870731483 MOV DWORD PTR [EAX+08],83147370
0167:831473A7 C7400CB89348E9 MOV DWORD PTR [EAX+0C],E94893B8
0167:831473AE C74010BFFFD0B8 MOV DWORD PTR [EAX+10],B8D0FFBF
0167:831473B5 C74014584B4600 MOV DWORD PTR [EAX+14],00464B58
0167:831473BC C74018FFE0C705 MOV DWORD PTR [EAX+18],05C7E0FF
0167:831473C3 C7401C584B4600 MOV DWORD PTR [EAX+1C],00464B58
0167:831473CA C74020558BEC6A MOV DWORD PTR [EAX+20],6AEC8B55
0167:831473D1 C74024C6055C4B MOV DWORD PTR [EAX+24],4B5C05C6
0167:831473D8 C740284600FF68 MOV DWORD PTR [EAX+28],68FF0046
0167:831473DF C7402CFA731483 MOV DWORD PTR [EAX+2C],831473FA
0167:831473E6 C7403068380000 MOV DWORD PTR [EAX+30],00003868
0167:831473ED C74034006A40FF MOV DWORD PTR [EAX+34],FF406A00
0167:831473F4 FFE0 JMP EAX ;此时eax为 0063059C
0167:0063059C B85077F7BF MOV EAX,KERNEL32!LoadLibraryA;加载Coralqq.dll
0167:006305A1 FFD0 CALL EAX
0167:006305A3 6870731483 PUSH 83147370
0167:006305A8 B89348E9BF MOV EAX,COMCTL32!ORD_0049
0167:006305AD FFD0 CALL EAX
0167:006305AF B8584B4600 MOV EAX,00464B58
0167:006305B4 FFE0 JMP EAX ;跳回QQ.exe的入口点
分析完毕.
到了这里,我们可以总结一下了,在win2000/xp下coralqq.exe先创建QQ的进程,同时也就创建了
上一篇:QQ新版新功能——搜索篇
下一篇:盛大IM产品圈圈很快发布 直指QQ和MSN
|
精品推荐