如何堆疊推入路徑(Injection without WPM)
修改暫存器達到無須使用 WPM 寫入路徑注入 DLL 的效果
本文特點在於如何在堆疊中推入檔案字串路徑..
感謝網友 Tobyworks 轉換成 C++,Win7 x86 RAD Studio XE2 編譯成功,測試失敗
Delphi:
C++
本文特點在於如何在堆疊中推入檔案字串路徑..
感謝網友 Tobyworks 轉換成 C++,Win7 x86 RAD Studio XE2 編譯成功,測試失敗
Delphi:
unit prjBypass; interface uses Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms, Dialogs, StdCtrls, tlhelp32; type TForm1 = class(TForm) btn2: TButton; lbl1: TLabel; procedure btn2Click(Sender: TObject); private { Private declarations } public { Public declarations } end; function OpenThread(dwDesiredAccess: DWord; bInheritHandle: Bool; dwThreadId: DWord): DWord; stdcall; external 'kernel32.dll'; function DebugSetProcessKillOnExit(KillOnExit: boolean):boolean; stdcall;external 'kernel32.dll'; var Form1: TForm1; implementation {$R *.dfm} function HexToInt(HexNum: string): LongInt; begin Result:=StrToInt('$' + HexNum); end; function WaitForData(dDebug:TDebugEvent):Boolean; begin Result := True; repeat WaitForDebugEvent(dDebug,INFINITE); if dDebug.dwDebugEventCode = EXCEPTION_DEBUG_EVENT then if dDebug.Exception.ExceptionRecord.ExceptionCode = EXCEPTION_SINGLE_STEP then break; if dDebug.dwDebugEventCode = EXIT_PROCESS_DEBUG_EVENT then begin Result := False; Exit; end; ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE); until 1=3; end; procedure TForm1.btn2Click(Sender: TObject); var pi: TProcessInformation; si: TStartupInfo; context:_CONTEXT; dDebug:TDebugEvent; dwOEP, dwESP, dwEAX, dwECX, dwEBP, dwEDI, dwEBX, dwEDX:DWORD; begin FillMemory( @si, sizeof( si ), 0 ); si.cb := sizeof( si ); context.ContextFlags:=CONTEXT_FULL or CONTEXT_FLOATING_POINT or CONTEXT_DEBUG_REGISTERS; If CreateProcess(Nil,PChar('notepad.exe'),Nil, Nil, False,DEBUG_PROCESS, Nil, Nil, si, pi ) then begin repeat WaitForDebugEvent(dDebug,INFINITE); if dDebug.dwDebugEventCode = CREATE_PROCESS_DEBUG_EVENT then break; if dDebug.dwDebugEventCode = EXIT_PROCESS_DEBUG_EVENT then Exit; ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE); until 1=3; //Set BP on OEP GetThreadContext(pi.hThread,context); dwOEP := context.EAX; context.Dr0 := dwOEP; context.Dr7 := 1; SetThreadContext(pi.hThread,context); ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE); if WaitForData(dDebug) = false then Exit; //We are at OEP //Save Registers, change EIP to push eax GetThreadContext(pi.hThread,context); if context.Eip = dwOEP then begin context.Dr0 := 0; context.Dr7 := 0; //Save Registers dwEBP := context.Ebp; dwEAX := context.Eax; dwEBX := context.Ebx; dwECX := context.Ecx; dwEDX := context.Edx; dwESP := context.Esp; dwEDI := context.Edi; context.Eax := HexToInt('00796568'); context.Eip := HexToInt('01007505'); context.EFlags := Context.EFlags or $0100; SetThreadContext(pi.hThread,context); ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE); end else Exit; if WaitForData(dDebug) = false then Exit; //Mov eax, esp //Push 0 GetThreadContext(pi.hThread,context); context.Eip := HexToInt('01002290'); context.Eax := context.Esp; context.EFlags := Context.EFlags or $0100; SetThreadContext(pi.hThread,context); ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE); if WaitForData(dDebug) = false then Exit; //push eax GetThreadContext(pi.hThread,context); context.Eip := HexToInt('01001B18'); context.EFlags := Context.EFlags or $0100; SetThreadContext(pi.hThread,context); ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE); if WaitForData(dDebug) = false then Exit; //push eax GetThreadContext(pi.hThread,context); context.Eip := HexToInt('01001B18'); context.EFlags := Context.EFlags or $0100; SetThreadContext(pi.hThread,context); ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE); if WaitForData(dDebug) = false then Exit; //Push 0 GetThreadContext(pi.hThread,context); context.Eip := HexToInt('01002290'); context.EFlags := Context.EFlags or $0100; SetThreadContext(pi.hThread,context); ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE); if WaitForData(dDebug) = false then Exit; //mov eax, messagebox //call eax GetThreadContext(pi.hThread,context); context.Eax := DWORD(GEtProcAddress(LoadLibrary('user32.dll'),'MessageBoxA')); context.Eip := HexToInt('01002969'); context.Dr0 := context.Eip + 2; context.Dr7 := 1; SetThreadContext(pi.hThread,context); ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE); if WaitForData(dDebug) = false then Exit; GetThreadContext(pi.hThread,context); //Save Registers context.Eax := dwEAX; context.Ebx := dwEBX; context.Ecx := dwECX; context.Edx := dwEDX; context.Esp := dwESP; context.Edi := dwEDI; context.Eip := dwOEP; context.Ebp := dwEBP; context.Dr0 := 0; context.Dr7 := 0; SetThreadContext(pi.hThread,context); ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE); //Detach Process DebugSetProcessKillOnExit(False); end; end; end.
C++
//--------------------------------------------------------------------------- #include#pragma hdrstop #include #include #include "prjBypass.h" //--------------------------------------------------------------------------- #pragma package(smart_init) #pragma resource "*.dfm" TForm1 *Form1; //--------------------------------------------------------------------------- __fastcall TForm1::TForm1(TComponent* Owner) : TForm(Owner) { } //--------------------------------------------------------------------------- long HexToInt(String HexNum) { return StrToInt("$" + HexNum); } //--------------------------------------------------------------------------- bool WaitForData(TDebugEvent dDebug) { while (1) { WaitForDebugEvent(&dDebug, INFINITE); if (dDebug.dwDebugEventCode == EXCEPTION_DEBUG_EVENT) { //if (dDebug.Exception.ExceptionRecord.ExceptionCode == EXCEPTION_SINGLE_STEP) //break; } if (dDebug.dwDebugEventCode == EXIT_PROCESS_DEBUG_EVENT) { return false; } ContinueDebugEvent(dDebug.dwProcessId, dDebug.dwThreadId, DBG_CONTINUE); } return true; } //--------------------------------------------------------------------------- void __fastcall TForm1::Button1Click(TObject *Sender) { PROCESS_INFORMATION pi; STARTUPINFO si; _CONTEXT context; _DEBUG_EVENT dDebug; DWORD dwOEP, dwESP, dwEAX, dwECX, dwEBP, dwEDI, dwEBX, dwEDX; FillMemory(&si, sizeof(si), 0); si.cb = sizeof(si); context.ContextFlags = CONTEXT_FULL | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS; if (CreateProcess(NULL, TEXT("notepad.exe"), NULL, NULL, false, DEBUG_PROCESS, NULL, NULL, &si, &pi)) { while (1) { WaitForDebugEvent(&dDebug, INFINITE); if (dDebug.dwDebugEventCode == CREATE_PROCESS_DEBUG_EVENT) { break; } if (dDebug.dwDebugEventCode = EXIT_PROCESS_DEBUG_EVENT) { return; } ContinueDebugEvent(dDebug.dwProcessId,dDebug.dwThreadId,DBG_CONTINUE); } //Set BP on OEP GetThreadContext(pi.hThread, &context); dwOEP = context.Eax; context.Dr0 = dwOEP; context.Dr7 = 1; SetThreadContext(pi.hThread, &context); ContinueDebugEvent(dDebug.dwProcessId, dDebug.dwThreadId, DBG_CONTINUE); if (!WaitForData(dDebug)) { return; } //We are at OEP //Save Registers, change EIP to push eax GetThreadContext(pi.hThread, &context); if (context.Eip == dwOEP) { context.Dr0 = 0; context.Dr7 = 0; //Save Registers dwEBP = context.Ebp; dwEAX = context.Eax; dwEBX = context.Ebx; dwECX = context.Ecx; dwEDX = context.Edx; dwESP = context.Esp; dwEDI = context.Edi; context.Eax = HexToInt("00796568"); context.Eip = HexToInt("01007505"); context.EFlags = context.EFlags | 0x0100; SetThreadContext(pi.hThread, &context); ContinueDebugEvent(dDebug.dwProcessId, dDebug.dwThreadId, DBG_CONTINUE); } else return; if (!WaitForData(dDebug)) { return; } //Mov eax, esp //Push 0 GetThreadContext(pi.hThread, &context); context.Eip = HexToInt("01002290"); context.Eax = context.Esp; context.EFlags = context.EFlags | 0x0100; SetThreadContext(pi.hThread, &context); ContinueDebugEvent(dDebug.dwProcessId, dDebug.dwThreadId, DBG_CONTINUE); if (!WaitForData(dDebug)) return; //push eax GetThreadContext(pi.hThread, &context); context.Eip = HexToInt("01001B18"); context.EFlags = context.EFlags | 0x0100; SetThreadContext(pi.hThread, &context); ContinueDebugEvent(dDebug.dwProcessId, dDebug. dwThreadId, DBG_CONTINUE); if (!WaitForData(dDebug)) return; //push eax GetThreadContext(pi.hThread, &context); context.Eip = HexToInt("01001B18"); context.EFlags = context.EFlags | 0x0100; SetThreadContext(pi.hThread, &context); ContinueDebugEvent(dDebug.dwProcessId, dDebug.dwThreadId, DBG_CONTINUE); if (!WaitForData(dDebug)) return; //Push 0 GetThreadContext(pi.hThread, &context); context.Eip = HexToInt("01002290"); context.EFlags = context.EFlags | 0x0100; SetThreadContext(pi.hThread, &context); ContinueDebugEvent(dDebug.dwProcessId, dDebug.dwThreadId, DBG_CONTINUE); if (!WaitForData(dDebug)) return; //mov eax, messagebox //call eax GetThreadContext(pi.hThread, &context); context.Eax = (DWORD)GetProcAddress(LoadLibrary(TEXT("user32.dll")),"MessageBoxA"); context.Eip = HexToInt("01002969"); context.Dr0 = context.Eip + 2; context.Dr7 = 1; SetThreadContext(pi.hThread, &context); ContinueDebugEvent(dDebug.dwProcessId, dDebug.dwThreadId, DBG_CONTINUE); if (!WaitForData(dDebug)) return; GetThreadContext(pi.hThread, &context); //Save Registers context.Eax = dwEAX; context.Ebx = dwEBX; context.Ecx = dwECX; context.Edx = dwEDX; context.Esp = dwESP; context.Edi = dwEDI; context.Eip = dwOEP; context.Ebp = dwEBP; context.Dr0 = 0; context.Dr7 = 0; SetThreadContext(pi.hThread, &context); ContinueDebugEvent(dDebug.dwProcessId, dDebug.dwThreadId, DBG_CONTINUE); //Detach Process DebugSetProcessKillOnExit(false); } } //---------------------------------------------------------------------------
http://pastebin.com/5h23p7bx
回覆刪除