2024Windows安全工具手册VIP

Windows安全工具锦集

PE工具

%PEiD

PEiD是一款著名的PE侦壳工具，可以检测PE常见的一些壳，但是目前已经无法从官网获得:

PEiDv0.95X

File:Q

EPSection:

FirstBytes:

Subsystem:

MultiScan|TaskViewer|Options|About|Exit

VStayontop苏售胖F甥弯弃甲

/EXEInfoPE

这是一个PE侦壳工具，PEiD的加强版，可以查看EXE/DLL文件编译器信息、是否加壳、入口

点地址、输出表/输入表等等PE信息：

下载地址：http://www.exeinfo.xn.pl/

-DetectItEasy

DetectItEasy是开源的PE侦壳工具，支持跨平台使用，有Windows、Linux、MacOS

多个可用版本：

■DetectItEasy1.01X

Filename:

ScanScriptsPluginsLog

版CFFExplorer

一款优秀的PE32&PE64编辑工具，使用CFFExplorer查看和编辑PE文件是极其方便的，并

且它完全支持.NET文件格式：

.CFFExplorerVIII-[luciodalla-discografiacompleta]□X

FileSettings?

0

PropertyValue

司Rie.ludodalla-dlscografidco<i

C:\Users\30537\AppData\Local\Temp\BNZ.5d882d4d146ab32..]

FileName

—国DosHeader

FileTypePortableExecutable32

-SUNtHeaders

—3RieHeaderFileInfoMicrosoftVisualC++8

I—E)WOptwnaiHeader

'-WDataDrectones冈FileSize6.25MB(6549824bytes)

一目SeaionHeaders(x]

PESize207.00KB(211968bytes)

—OExportDrectory

—cJhiportDirectoryCreatedMonday12August2019,16.04.29

—<_JResourceDuectoiy

—ODebugDrectoryModifiedMonday05August2019,19.49.21

—AddressConverter

AccessedMonday23September2019,10.26.26

DependencyWalker

一'HexEdttorMD5D6D388E0883F8CFEA1968A1C8FB32043

—A，Identifier

一^ImportAdderSHA-1EC69A9B5D7DA3O85C2BBC852BA59OF64757EDEBF

—^QuickDisassembler

一^Rebuilder

—3Resource&fitorPropertyValue

—guPXUtility

EmptyNoadditionalinfoavailable

府深信服千里目安全实验室

。StudyPE

StudyPE是一个PE32&PE64查看分析集成工具，具有强大的PE结构处理分析功能」日

其查壳方面的功能略显薄弱：

StudyPE+(x86)1.09beta0—>luciodalla-discografiacompleta.exe

文件选项工具杂项帮助

L基本」［区段］|［数据表］|［导入］|［导出］|［奥源］|［重定位］|［异常］［.Net］|［汇编］|［进程］

ImageDOSHeader

11

头尺寸00000040CS00000000SS00000000J

J

Stub000000A8IP00000000SP000000B8EA

TfVkA-AHt1AHAAXAYlt■?l

节表数00000004时间戳55AB5815文件属性000001033

可选头大小000000E01时间计算器Cl

ImageOptionalHeader

SizeOfCode00028A00Entry0001D98BSectionAlign00001000

SizeOflmage00057000ImageBase00400000FileAlign00000200

BaseOfCode00001000SizeOfMead00000400CheckSum00000000

BaseOfBata0002A000BaseInfoPE32文件,文件大小：6396KBo

文件MD5D6D388E0883F87FEAl96BAlC8FB32043

文件SHMEC69A9B5D7DA3085C2BBC852BA590F64757EDEBF

文件类型[VC8->MicrosoftCorporation]

力•孕售股壬典型丹瑾追

查看PE文件的是本信息20:18:39

调试/反编译工具

■OllyDbg

Ring3级调试器，支持插件扩展功能，唯一不足的是OD是一个32位调试器，不支持调试64位

程序。官方给出的原版程序是无插件的，有需要的童鞋可以在吾爱破解论坛自行搜索：

*OllyDbg-luciodalla-discografiacompleta.exe-[CPU-mainthread,moduleludod..J..S?l

c]FileViewDebugOptionsWindowHelp,||g|x

目型X上111!Mllil111Ji］回刊jJ©画用竺］回£］力司旦|四:JjJ

0041D98BI$E885630080CALLlucioda.00423D154Registers(FPU)

H041D990「E978FEFFFFJMPlucio_da.0041D80DERX76211162kerne132.Bas

O041D995PS8BFFMOUEDI,EDIECX00000000

0041D997.55PUSHEBPEDXQ041D98Blucioda.<Mo

0041D998.8BECMOUEBP,ESPEBX7FFDE060

8041D99A.56PUSHESIESP8012FF8C

0941D99B.8D4S08LEAEOX,DWORDPTRSS:CEBP+8JEBP8012FF94

6U41D39E.50PUSHEAXFArglESI00000000

8041D99F.8BF1MOUESI.ECXEDI00000000

0041D9A1.E882FCFFFFCALLlucioda.0041D628Lluciod

6U41D1?A6.C70638B24290MOUDWORDPTRDSzCESI],lucio_da.0942B23EIP0841D98Bl«cio_da.<Mo

9041D9AC.8BC6MOUEflX.ESIC0ES902332bit0(FFFF

O041D9AE.SEPOPESIP1CS001B32bit0(FFFF

6041D9AF.SDPOPEBP

L.C20400A0ss002332bit0(FFFF

6941D9B0RETN40Z1DS002332bit0(FFFF

8041D9B3.C70138B24200MOUDWORDPTRDSzCECX],lucio_da.0942B23S6FS003B32bit7FFDF0

6041D'?E：9「E937FDFFFF

JMPlucio_da.0041D6F5T0GS0000NULL

9041D9BE8BFFMOUEDI,EDI

0041D?C£|PUSHEBPD0

r.5500LastErrERROR_SUCCES

0041D9C1.8BECMOUEBP,ESP

0941D9C3.56PUSHESIEFL00008246(NO,NB,E,BE,

6041D9c4.8BF1MOUESI.ECXST0empty0.0

.C70638B24200MOUDWORDPTRDSsCESI],lucio_da.0Q42B23▼

LCC/LCLLLLCC111.一一1一J-CC/4CLLSTIempty0.0

■

80423015=Lucio_da.00423D1'ST2empty0.0

STSempty0.0

ST4empty0.0

STSenpty0.0

AddressHexdumpASCII1UU12FFHC76211174RETURNtok€▲

10012FF907FFDE000

.，「.'..100B24200口二「1二J-.Bff

I0012FF94f0012FFD4

004300082E3F415734524152.?0UI4RflR19012FF98

00430010SF45584954494000EXIT@@.7737B3F5RETURNtont

0043001868口64200DD0E8917h.??0912FF9C7FFDEO0A

0012FFA9

0043002076933F43C7DQ32B0U?CW2?7775B4BD

0012FFA400000000

0043902880917E2574IF8AR9任"Zt▼嫉00000000

00430030fll2C12ElCRC880150012FFA8

0943003800F2Cfl4FFFFFFFFF•-00012FFRC7FFDE00U

9012FFB000000000

0043004068口6420006464646h.♦FFF00000000

OG43G04G2929454509464646))cc.rrr0012FFB4

0012FFB800000000L

004300504629292929292901、了七翦后

004300580111100546464645©◄►tFFFE1歌鑫窦安全英紧雪▼

Analysinglucio_da:800heuristicalprocedures,519callstoknown,525callstoguessedfunctionsIPaused

皖WinDbg

支持Windows平台，用户态和内核态的调试器，有图形界面和命令行两种调试方式。其强大

的内核调试功能收获了众多的追捧者：

涉"C:\Users\30537\De八+'

AleEditViewDebugWindowHelp

自言寺里哥I利济呼刎区］毒JR国口的©口口圜AA圜

Commend园回Registers扃同

Customize...

*Syabolloadingmaybeunreliablewithoutasymbolsearchpath.

•Use.symfixtohavethedebuggerchooseasymbolpath.>

*Aftersettingyoursymbolpath,use.reloadtorefreshsymbollotRegValue

□

gs0

Executablesearchpathis:

fs3b

ModLoad:0040000000457000UINRARSFX

es23

ModLoad:773200007745c000ntdll.dll▼

ModLcad:761c000076294000C:indowsXsyste>32\kerne132.dllda251

NodLoad：755100007555ao00C\Uindovs\systeM32\KERNELBASE.dll4r__!!!________,►

ModLoad:740900007422e000C：XUindows\UinSxSXx86_iaicrosoft.windox

HodLoad：76330000763dc000C'Windows\systs325svcrt.dllMemory回回

ModLoad:775000007754e000C：\UindowsXsyste>32\GD132.dll

ModLoad:757d000075899000CXUindows\systea32XUSER32,dllvirtual：@$scopeipPrevious

ModLoad:774(0000774fa000C:\Uindous\systeM32\LPKdll

Displayformat:Byte▼

MudLudd.75940000759dd000C.'sW1udowyssLCM32XUSF10.dll

J

ModLoad:75770000757c7000C.\Uindows\systeM32\SHLUAPI.dllNext

ModLcad:758a00007591b000C:\Windows\systeM32\COMDLG32.dll

ModLoad:766do00077319000C\UindowsXsystea32XSHELL32dll773be60ecc8975.u4

ModLceid:7658000076620000C:\Uindows\systeM32\ADVAPI32.dll773be611fcebOe...

ModLoad:759e0000759f9000C\Windows\SYSTEM32\sechostdll773be61433cO403.@

ModLoad:766200007663000C:\UindowsXsyste>32\RPCRT4.dll773be617c38b65..e

ModLoad:75b5000075cac000C\UindowsXsyste>32\ole32.dll773be61ae8c745.E

ModLoad:762a00007632fo00C\Uindovs\systeM32\OLEAUT32.dll773be61dfcfeff...

(794ec4):Breakinstructionexception-code80000003(firstchant773be620ffffe8...

eax-00000000ebx-00000000ecx-0012fb0cedx-773664f4es..i..-..f...f..f..f...f.ffBec773be623d685fa...

eip=773be60eesp=0012fb28ebp=0012fb54iopl=0nvupeipl:773be626ffc390….

cs*001bss»0023ds»0023es»0023fs-003bgs"0000el773be629909090...

***ERROR:Symbolfilecouldnottefound.Defaultedtoexportsyj773be62c908bff...

ntdllILdrVerifyImageMatchesChecksuM+0x633773be62f558becU..

77773bbee6600eecciint3773be63283ec10...

——773be635803dec.=.

773be63802fe7f...

HI773be63b007411.t.

*BUSY»IA*累屋油〔.基gfe全实验塞▼

Ln0,Col0Sys0:<Local>Proc000:794Thrd000:ec4ASMOVRCAPSNUM

%x32dbg/x64dbg

一款开源的调试器，在界面和操作的使用上和OD相似,支持32位和64位应用程序的调试。这

款调试器解决了OD对64位应用程序调试上的缺陷：

彩x32dbg-文件：ShareFolderMonitor.exe-PID:45D4-块：ntdll.dll-61C-□X

文件⑻视图⑺撕式(D)插件(P)收藏夹(工)迭项S)器助(H)Mar292017

10・畲蚣噩□•■口笑⑷明＜〉H〃，戊・叁愿看阐

且CPU电流程图，日志二笔记•断点8B内存布局口调用堆枝5SE啕8脚本闽符号◊源代码/刘

33jmpntdll.7731F15O随藏FPU

7731F1494oxoreax,eax

7731F14Bc3inceaxEAXOOOOOOOO

7731F14C8B65E8r«EBX006EC000

7731F14Dmovesp,dwordptrss:[ebp-is]

c745FCEECXE8A30000

7731F150E8&DS2Dmovdwordptrss:[ebp-4]rrFFFPFFE

7731F157callntdll.7--7--2--F--4--3--C9-EDXOOOOOOOO

7731F15CretEBP008FF4C8

64A1

moveaxdwordptr■:[30]ESP008FF49C

7731F15D33c9t

7731F16389Dxorecx.ecxESI00S91C00

7731F16589oiDmovdwordptrds:[77391644],ecxEDI7-2837EC'Xd'plnitializeProc

7731F16B88ofo8movdwordptrds:[77391648]fecx

7731F1713848movbyteptrds:[eax],clEIP7731F147ntdl1.7731F147

7731F173740Scmpbyteptrds:[eax>2],cl

7731F176E89Ejentdll.7731F17DEFLAG!500000246

c

7731F17833Ocallntdll.7731F11BZF1PF1AF0

7731F17DC3xoreaxeax

9OF0SF0DF0

7731F17F3Bret

CFOTF0IF1

7731F15O55(iiuvedi9cdi

7731F1828Bpushebp

LastError00000002(ERROR_FILE_NOT_FOU

7731F18383F8movebp,esp

7731F1S5817001andesp,FFFFFFF8

773*188A16339subesp,170

7731F18E33cmoveax,dwordptrds:[77396360]

f

7731F193Aalxoreax,esp默认(ltdcdl)5：口话浒

QCmnvKu«nrdnrrAAY

[esp+4]772837ECHnitializePr

[esp+8100991C00

统舞将要执行fesptC]006EC000

ntdll.7731F15O-esp+io]oooooooi

.text：7731F147ntdll.dll：SAF147*AE5475：

工内存卷监视17垢008FF49C083455

1二内存2°、内存34内存4□4内存5008FF4A0772837EC

ASCII008FF4A400991C00

008FF4A8006EC000

7727103036S2Q.3g0070C42777S

00：008FF4AC00000001

7727101028002A1AooPCC4277DA6OO8FF4BO008FF49C

77271020IEOO202ooG」DOC327771ADA

0Oo008FF4B4008FF4C4

77271030181A2Coo0090C32777'A.A看的?计

0O〜77008FF4BS008FF714WsEHj^ecordC]1

77271040300O3218oo002CC32.Aooorr4oc772COGOOntdll.772CGC00

ECC2277

77271050200O220ooo001A008FF4C07F8C3646

77271060100O120090$77©A

。COO008FF4C4OOOOOOOO

772710700E10u-IDA??77LLL«/--cccLL-rr»

I-F匐所,可安全邦除「

己暂停已到达系统醺点!已调i戏寸间：0:00:00:06

%dnSpy

一款针对.NET程序的开源逆向程序的工具。其包含了反汇编器，调试器和汇编编辑器等功能

组件，支持插件功能：

0在0536)

文。0)>M>x)WB(V)AXO)BQ(I)minoo

，*

»0BtCMltV(4000)

》(TSn(MH000)

>0S八gCwa(4000)

»°$n<»ui(4000)

>°Sn<»X7(4000)

》。"343(4000)

»&tr.uM.QiMC2.«000)

»OFraimiattefjrM»<*«rk«000)

>0Q000)

>。M»O000)

:04»S>r6050)

电深信服千里目安全实验室

嶙IDAPro

该软件名全称