******************************************************************************
Target CoDe_InSiDe ReverseMe #1
******************************************************************************
Author: CoDe_InSiDe
Protection: None
Needs: Hiew,WinHex,Some PE knowledge,Most important is Our Brain
Level: ( ) Beginner (X) Intermediate ( ) Advanced ( ) Expert
下載（或點選滑鼠右鍵另存為）
You Needs:
1. Make a new Section.
2. Don't touch the other 2 Sections (offcourse you may touch the
PE Header ;)
3. You MUST use the allready Imported ExitProcess to quit this
program in a clean way :)
4. Make the Entry Point jump to your Code BUT... after your Code
make it jump to the Original Entry Point and let it quit
in a good way with the Imported ExitProcess ;)
5. In your Code make an Message Box that shows the current Tick
Count...
6. And offcourse do it all Manually, no Tools (You may use HIEW
or something offcourse ;) but no PE Editors or the likes of
that...
7. And i think that's all...
這就是它的要求,我們所要做的就是上面的7個部分,Right.好了我們首先增加一個Section.
從我前面寫的文章可以知道,Section的增加方法就是,PE+F8,此處是第一個Section的開始地
方,我們可以看看已經有幾個Section了,我們可以從PE頭偏移0x6處得到:
00000080 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 PE..L...........
Now We change to:
00000080 50 45 00 00 4C 01 03 00 00 00 00 00 00 00 00 00 PE..L...........
~~
接下來就是來新增我們的Section了,pe+0xF8+0x28+0x28處就是我們的Section的位置了.
0x80+0xF8+0x28+0x28=0x1c8,以下是構造好了的Section:
00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000180 00 01 00 00 00 20 00 00 00 10 00 00 00 02 00 00 ..... ..........
00000190 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ............ ..
000001A0 00 00 00 00 00 00 00 00 00 01 00 00 00 50 00 00 .............P..
000001B0 00 10 00 00 00 03 00 00 00 00 00 00 00 00 00 00 ................
000001C0 00 00 00 00 40 00 00 C0 (*)64 65 6E 67 6B 65 6E 67 ....@..dengkeng
000001D0 00 02 00 00 00 60 00 00 00 10 00 00 00 04 00 00 .....`..........
000001E0 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ............ ..
好了,我們知道了第一個Section的開始位置,0x178處,我們可以得到一些資訊,我們將填寫
自己的Section,(*)是我們位元組的Section的開始地方.
+0 8byte Name1 ;塊名dengkeng
+8 dword VirtualSize ;200,That's enough
+C dword VirtualAddress ;0x6000
10 dword SizeOfRawData ;0x1000
14 dword PointerToRawData ;我們的從0x400開始
18 dword PointerToRelocations ;一般為0x00000000
1C dword PointerToLinenumbers ;一般為0x00000000
20 word NumberOfRelocations ;一般為0x0000
22 word NumberOfLinenumbers ;一般為0x0000
24 dword Characteristics -----> ours is write read execute and code.so it's E0000020
以上就是我們自己的Section的一些資訊.就是'd'這個位元組填充的太難看了!算了!接下來我們就
要為程式增加空間,來填充自己的東西.
我們需要重新構造IID,新增一些我們需要的函式,我們需要在User32.dll中的MessageBoxA,wsprintfA
,以及在Kernel32.dll中的GetTickCount,ExitProcess.
所以我們需要有兩個IID結構來存放我們的資訊,以第3個全0的IID結構表示結束.
我們的結構從offset 0x400開始,因為第2個Section結束是在0x300+0x100處,我們的是在0x400開始.
第一個IID結構:
+0 OriginalFirstThunk ;0x00000000
+4 TimeDateStamp ;0x00000000
+8 ForwarderChain ;0x00000000
+C Name1 ;0x00006071 ;這個地方是根據後面推出來的,先不急
+10 FirstThunk ;0x0000603C ;這個地方是根據後面推出來的,先不急
第二個IID結構:
+0 OriginalFirstThunk ;0x00000000
+4 TimeDateStamp ;0x00000000
+8 ForwarderChain ;0x00000000
+C Name1 ;0x0000609A ;這個地方是根據後面推出來的,先不急
+10 FirstThunk ;0x00006048 ;這個地方是根據後面推出來的,先不急
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000400 (1)00 00 00 00 00 00 00 00 00 00 00 00 71 60 00 00 ............q`..
00000410 3C 60 00 00 (2)00 00 00 00 00 00 00 00 00 00 00 00 <`..............
00000420 9A 60 00 00 48 60 00 00 (3)00 00 00 00 00 00 00 00 `..H`..........
00000430 00 00 00 00 00 00 00 00 00 00 00 00 54 60 00 00 ............T`..
00000440 63 60 00 00 00 00 00 00 80 60 00 00 8C 60 00 00 c`......`..`..
00000450 00 00 00 00 00 00 47 65 74 54 69 63 6B 43 6F 75 ......GetTickCou
00000460 6E 74 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 nt...ExitProcess
00000470 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 .Kernel32.dll...
00000480 00 00 77 73 70 72 69 6E 74 66 41 00 00 00 4D 65 ..wsprintfA...Me
00000490 73 73 61 67 65 42 6F 78 41 00 55 73 65 72 33 32 ssageBoxA.User32
000004A0 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 .dll............
000004B0 54 68 65 20 54 69 63 6B 43 6F 75 6E 74 20 3A 25 The TickCount :%
000004C0 6C 75 00 00 00 00 00 00 00 00 00 00 00 00 00 00 lu..............
000004D0 43 72 61 63 6B 00 00 00 00 00 00 00 00 00 00 00 Crack...........
000004E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000004F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
好了上面就是我們填寫好的結構,下面就來分析一下填充的過程,首先我們需要3個IID結構,
所以我們需要60個位元組的空間(每個IID結構20個位元組).接下來是填充FirstThunk所指向的內容
因為我們每個dll中有兩個函式呼叫,所以我們需要12個位元組的空間,最後4個位元組為空表示結束.
所以在0x43C-0x447為一處,0x448-0x453為第二處.接下來在0x454就可以填寫我們的函式了,
記得前面有Hint,我們可以填充0.記得字串要以0結尾.我們把所需的函式和dll名稱填充進去.
填充完了以後,我們開始填寫0x43C-0x447,0x448-0x453處的內容,即指向函式的地址.填寫完了
以後我們接著填寫兩個IID結構中的Name1和FirstThunk欄位.以上就是填寫的分析過程,我們
先填寫後面的部分在填寫前面的部分.
接下來我們填寫一些字元在以後的MessageBox中顯示出來,在0x4B0處填寫wsprintfA所需要的
格式,0x4D0處填寫Title.至於0x4E0-0x4F0我們用做緩衝區.我們的程式碼將在0x500處Write Down.
以下用Hiew編輯:
500
Call d,[40603C] ;00006054在0x43C處,Call GetTickCount
push eax
push 4060B0 ;格式化字串
push 4060E0 ;緩衝區
call d,[406048] ;call wsprintfA
push 0
push 4060D0 ;Caption
push 4060E0
push 0
call d,[40604C] ;call MessageBoxA
push 0
call d,[406040] ;call ExitProcess
接下來我們需要做的就是一些掃尾工作,修改Import Table的起始位置和大小,以及程式的入口地址
剩下來的工作就留給你了!
我的這個修改不是很完善因為沒有滿足題目的要求它要用已經有了的ExitProcess,而我的是自己建
的!如果返回到405000,即它的入口地址,又會出錯!如果誰知道請告訴我一下!如果裡面的東西不是太清
楚請看看介紹PE結構的書和我寫的其他幾篇文章!
Made By dengkeng
E-mail:shellc0de@sohu.com
歡迎轉載,請保持文章的完整性