远线程汇编代码注入,机器码注入

1、/编辑时间:2011-8-22/整理人:紫色溟渊/说明:仅供学习技术交流,欢迎转载,转载请注明出处。/编辑目的:/ 1. 加深自己对远线程注入的理解,/ 2. 对 VC 内嵌汇编代码进一步了解/ 3.DEBUG 版的函数会有堆栈检测, RELEASE 版的函数没有堆栈检测代码 / 4. 理解一下汇编代码对应的机器码/ 5. 自己打算做一个易语言汇编模块/汇编代码PUBLIC ?AsmInjectYAXXZ ; AsmInjectEXTRN _chkesp:NEAR; COMDA T ?AsmInjectYAXXZ_TEXT SEGMENT_dwAddr$ = -4?AsmInjectYAXXZ

2、 PROC NEAR ; AsmInject, COMDAT ; 8 : 00000 55 push ebp00001 8b ec mov ebp, esp00003 83 ec 44 sub esp, 68 ; 00000044H00006 53 push ebx00007 56 push esi00008 57 push edi00009 8d 7d bc lea edi, DWORD PTR ebp-680000c b9 11 00 00 00 mov ecx, 17 ; 00000011H00011 b8 cc cc cc cc mov eax, -858993460 ; cccccc

3、ccH00016 f3 ab rep stosd; 9 : DWORD dwAddr =0x0060E8F0 ;00018 c7 45 fc f0 e860 00 mov DWORD PTR _dwAddr$ebp, 6351088 ; 0060e8f0H; 10 : _asm; 11 : ; 12 : pushad0001f 60 pushad; 13 : mov ecx,0x8000000300020 b9 03 00 00 80 mov ecx, -2147483645 ; 80000003H ; 14 : mov edx,0x0AF845000025 ba 50 84 af 00 mo

4、v edx, 11502672 ; 00af8450H ; 15 : push ecx0002a 51 push ecx; 16 : mov ecx,edx +0x200002b 8b 4a 20 mov ecx, DWORD PTR edx+32; 17 : add ecx,0x0d40002e 81 c1 d4 00 0000 add ecx, 212 ; 000000d4H; 18 : call dwAddr00034 ff 55 fc call DWORD PTR _dwAddr$ebp; 19 : popad00037 61 popad; 20 : ; 21 : 00038 5f p

5、op edi00039 5e pop esi0003a 5b pop ebx0003b 83 c4 44 add esp, 68 ; 00000044H0003e 3b ec cmp ebp, esp00040 e8 00 00 00 00 call _chkesp00045 8b e5 mov esp, ebp00047 5d pop ebp00048 c3 ret 0?AsmInjectYAXXZ ENDP ; AsmInject _TEXT ENDSEND/#include "StdAfx.h"#include "publicfunction.h"

6、/汇编代码注入void AsmInject(DWORD dwAddr =0x0060E8F0 ;_asmpushadmov ecx,0x80000003mov edx,0x0AF8450push ecxmov ecx,edx +0x20add ecx,0x0d4call dwAddrpopad/第一段代码是 VC6.0生成的汇编代码和机器代码第二段代码是我编写的 C 代码,内嵌汇编场景介绍:我尝试这将这个函数 AsmInject( 通过远线程注入到 TARGET.EXE(被攻击进程 发现问题:为什么远线程注入到 TARGET.EXE 进程会导致 TARGET.EXE 出现错误? 解决办法:vo

7、id AsmInject(DWORD dwAddr =0x0060E8F0 ;_asmpushadmov ecx,0x80000003mov edx,0x0AF8450push ecxmov ecx,edx +0x20add ecx,0x0d4call dwAddrpopad在以上这个函数中 红色标记的代码 通过观察汇编代码之后和我们想象的并不一样, ; 14 : mov edx,0x0AF845000025 ba 50 84 af 00 mov edx, 11502672 ; 00af8450H事实上它这里并不是把 0x0AF8450里面的内容存放到 edx , 而是直接将 0x0AF845

8、0存放到 edx 中,和我们事先想象的好像不一样。/下面我做了一些改进PUBLIC ?AsmInject_NewYAXXZ ; AsmInject_New; COMDA T ?AsmInject_NewYAXXZ_TEXT SEGMENT_dwAddr$ = -4?AsmInject_NewYAXXZ PROC NEAR ; AsmInject_New, COMDAT ; 26 : 00000 55 push ebp00001 8b ec mov ebp, esp00003 83 ec 44 sub esp, 68 ; 00000044H00006 53 push ebx00007 56 pu

9、sh esi00008 57 push edi00009 8d 7d bc lea edi, DWORD PTR ebp-680000c b9 11 00 00 00 mov ecx, 17 ; 00000011H00011 b8 cc cc cc cc mov eax, -858993460 ; ccccccccH00016 f3 ab rep stosd; 27 : DWORD dwAddr =0x0060E8F0 ;00018 c7 45 fc f0 e860 00 mov DWORD PTR _dwAddr$ebp, 6351088 ; 0060e8f0H; 28 : _asm; 29

10、 : ; 30 : pushad0001f 60 pushad; 31 : mov ecx,0x8000000300020 b9 03 00 00 80 mov ecx, -2147483645 ; 80000003H ; 32 : mov edx,0x0AF845000025 ba 50 84 af 00 mov edx, 11502672 ; 00af8450H ; 33 : mov edx,edx0002a 8b 12 mov edx, DWORD PTR edx; 34 : push ecx0002c 51 push ecx; 35 : mov ecx,edx +0x200002d 8

11、b 4a 20 mov ecx, DWORD PTR edx+32; 36 : add ecx,0x0d400030 81 c1 d4 00 0000 add ecx, 212 ; 000000d4H; 37 : call dwAddr00036 ff 55 fc call DWORD PTR _dwAddr$ebp; 38 : popad00039 61 popad; 39 : ; 40 : 0003a 5f pop edi0003b 5e pop esi0003c 5b pop ebx0003d 83 c4 44 add esp, 68 ; 00000044H00040 3b ec cmp

12、 ebp, esp00042 e8 00 00 00 00 call _chkesp00047 8b e5 mov esp, ebp00049 5d pop ebp0004a c3 ret 0?AsmInject_NewYAXXZ ENDP ; AsmInject_New_TEXT ENDSEND/汇编代码注入 改进版void AsmInject_New(DWORD dwAddr =0x0060E8F0 ;_asmpushadmov ecx,0x80000003mov edx,0x0AF8450mov edx,edxpush ecxmov ecx,edx +0x20add ecx,0x0d4c

13、all dwAddrpopad远线程注入改进版的汇编代码注入之后 , 可以看到 TARGET.EXE 进程确实存在效果, 但是 TARGET.EXE 任然会报错,这又是为什么呢?0003d 83 c4 44 add esp, 68 ; 00000044H00040 3b ec cmp ebp, esp00042 e8 00 00 00 00 call _chkesp据说是 DEBUG 版本的堆栈检测机制,只有在 DEBUG 版本里面才会有,那么我们使用 RELEASE 版本编译试试看。PUBLIC ?AsmInject_NewYAXXZ ; AsmInject_New; COMDA T ?As

14、mInject_NewYAXXZ_TEXT SEGMENT_dwAddr$ = -4?AsmInject_NewYAXXZ PROC NEAR ; AsmInject_New, COMDAT ; 26 : 00000 55 push ebp00001 8b ec mov ebp, esp00003 51 push ecx00004 53 push ebx00005 56 push esi00006 57 push edi; 27 : DWORD dwAddr =0x0060E8F0 ;00007 c7 45 fc f0 e860 00 mov DWORD PTR _dwAddr$ebp, 63

15、51088 ; 0060e8f0H; 28 : _asm; 29 : ; 30 : pushad0000e 60 pushad; 31 : mov ecx,0x800000030000f b9 03 00 00 80 mov ecx, -2147483645 ; 80000003H; 32 : mov edx,0x0AF845000014 ba 50 84 af 00 mov edx, 11502672 ; 00af8450H; 33 : mov edx,edx00019 8b 12 mov edx, DWORD PTR edx; 34 : push ecx0001b 51 push ecx;

16、 35 : mov ecx,edx +0x200001c 8b 4a 20 mov ecx, DWORD PTR edx+32; 36 : add ecx,0x0d40001f 81 c1 d4 00 0000 add ecx, 212 ; 000000d4H; 37 : call dwAddr00025 ff 55 fc call DWORD PTR _dwAddr$ebp; 38 : popad00028 61 popad; 39 : ; 40 : 00029 5f pop edi0002a 5e pop esi0002b 5b pop ebx0002c 8b e5 mov esp, eb

17、p0002e 5d pop ebp0002f c3 ret 0?AsmInject_NewYAXXZ ENDP ; AsmInject_New_TEXT ENDSEND/我们远线程注入这段代码/汇编代码注入void CASMCodeInjectDlg:OnButtonAsmInject(/ TODO: Add your control notification handler code hereDWORD procid;HWND hwnd ;hwnd =:FindWindow(NULL ,"Element Client" ;if (hwnd =NULLMessageBox(

18、"请先运行游戏 " ;return ;:GetWindowThreadProcessId(hwnd,&procid;/获得进程 IDHANDLE prochandle=:OpenProcess(PROCESS_ALL_ACCESS,false,procid;/打开进程 LPVOIDbaseaddr=VirtualAllocEx(prochandle,NULL,1024*4,MEM_COMMIT,PAGE_EXECUTE_READ WRITE;/分配空间if(baseaddr=NULLMessageBox("分配空间出错 "return;if(!:

19、WriteProcessMemory(prochandle,baseaddr,&AsmInject_New,1024*4,NULLMessageBox("将函数写内存出错 "return ;HANDLE tid;tid=CreateRemoteThread(prochandle,NULL,0,(LPTHREAD_START_ROUTINEbaseaddr,0,0,NULL;/远程调用函数WaitForSingleObject(tid,INFINITE;/等待线程结束VirtualFreeEx(prochandle,baseaddr,1024*4,MEM_RELEAS

20、E;:CloseHandle(prochandle;确实没有堆栈检测机制,然后我们再次注入这段代码,很好, TARGET.EXE 并没有出现错 误,一切都是如此的正常,如此的和谐。/如果我们直接向 TARGET.EXE 写入机器指令该怎么做呢?/机器码函数注入void CASMCodeInjectDlg:OnButtonMachinecodeInject(/ TODO: Add your control notification handler code hereDWORD procid;HWND hwnd ;hwnd =:FindWindow(NULL ,"Element Clie

21、nt" ;if (hwnd =NULLMessageBox("请先运行游戏 " ;return ;:GetWindowThreadProcessId(hwnd,&procid;/获得进程 IDHANDLE prochandle=:OpenProcess(PROCESS_ALL_ACCESS,false,procid;/打开进程 LPVOIDbaseaddr=VirtualAllocEx(prochandle,NULL,1024*4,MEM_COMMIT,PAGE_EXECUTE_READ WRITE;/分配空间if(baseaddr=NULLMessageBox("分配空间出错 "return;/待注入的机器指令char cMachineCode =0x55,0x8b, 0xec,0x51,0x53,0x56,0x57,0xc