只会挂一档 发表于 2017-6-3 11:11:17

这个dll_CopycatAndHide 的masm源代码


;2015/1/7
;作用:简单的断去链表的方法 实用 也可以达到隐藏的效果 成功返回1失败返回0
;失败原因:例如内存分配不成功等等 一般是在过程中出错
;esp+8传入 DLL的句柄
dll_CopycatAndHide procdllhandle:dword
LOCAL SizeOfImage,lpBackMem,oldprotect,AddressOfEntryPoint,g_lpNewImage
pushad
mov eax,dword ptr
mov eax,dword ptr
add eax,dword ptr
lea eax,dword ptr
mov ebx,dword ptr ;入口点
mov dword ptr ,ebx;保存入口点
mov eax,dword ptr
mov dword ptr ,eax;保存SizeOfImage
invoke VirtualAlloc,0,eax,MEM_COMMIT or MEM_RESERVE ,PAGE_EXECUTE_READWRITE
mov dword ptr ,eax;保存内存开始地址
test eax,eax
je retf1;查看是否申请内存成功 失败就返回
invoke VirtualProtect,dllhandle,SizeOfImage,PAGE_EXECUTE_READWRITE,addr oldprotect
;下面开始复制DLL代码过去
mov esi,dword ptr ;源开始地址
mov edi,dword ptr ;目标开始地址
mov ecx ,dword ptr ;代码大小
cld;标志位正向
rep movsb;开始一个字节一个字节复制
invoke RtlZeroMemory,lpBackMem,200
mov eax,dword ptr[ AddressOfEntryPoint]
add eax,dword ptr ;入口点位置
mov byte ptr ,0c3h ;ret
invoke FreeLibrary,dllhandle;释放
invoke VirtualAlloc,dllhandle,SizeOfImage,MEM_COMMIT or MEM_RESERVE ,PAGE_EXECUTE_READWRITE
mov dword ptr ,eax
cmp eax,dword ptr
jnz retf1
mov esi,dword ptr ;源开始地址
mov edi,dword ptr ;目标开始地址
mov ecx ,dword ptr ;代码大小
cld;标志位正向
rep movsb;开始一个字节一个字节复制
invoke VirtualFree,lpBackMem,0,MEM_RELEASE;释放
jmp retf2
retf1:
popad
mov eax,0 ;执行之间出错
ret 4
retf2:
popad
mov eax,1;执行成功


ret 4


dll_CopycatAndHide endp




下面是C++版的 我就是参考这份代码的
VOID LockAllModules()
{
HANDLE hSnapshot = CreateToolhelp32Snapshot(
TH32CS_SNAPMODULE, GetCurrentProcessId());


if (hSnapshot != INVALID_HANDLE_VALUE) {


MODULEENTRY32 me = {sizeof(me)};
BOOL fOk = Module32First(hSnapshot, &me);
for (fOk = Module32Next(hSnapshot, &me); fOk; fOk = Module32Next(hSnapshot, &me)){ //跳过第一个;
   LoadLibrary(me.szModule);
}
}
}


BOOL CopycatAndHide(HMODULE hDll)
{
IMAGE_DOS_HEADER * pDosHeader;
IMAGE_NT_HEADERS * pNtHeader;
IMAGE_OPTIONAL_HEADER * pOptionalHeader;
LPVOID lpBackMem = 0;
DWORD dwOldProtect;
DWORD dwCount = 30;




pDosHeader = (IMAGE_DOS_HEADER *)hDll;
pNtHeader = (IMAGE_NT_HEADERS *)(pDosHeader->e_lfanew + (DWORD)hDll);
pOptionalHeader = (IMAGE_OPTIONAL_HEADER *)&pNtHeader->OptionalHeader;


LockAllModules();


lpBackMem = VirtualAlloc(0 ,pOptionalHeader->SizeOfImage ,MEM_COMMIT|MEM_RESERVE ,PAGE_EXECUTE_READWRITE);
if(!lpBackMem)
return FALSE;
if(!VirtualProtect((LPVOID)hDll ,pOptionalHeader->SizeOfImage ,PAGE_EXECUTE_READWRITE ,&dwOldProtect))
return FALSE;


g_dwImageSize = pOptionalHeader->SizeOfImage;
memcpy(lpBackMem ,(LPVOID)hDll ,g_dwImageSize );
memset(lpBackMem , 0 ,0x200);
*((PBYTE)hDll + pOptionalHeader->AddressOfEntryPoint) = (BYTE)0xc3;


// DWORD dwRet =0;
do{
dwCount --;
}while(FreeLibrary(hDll) && dwCount);


g_lpNewImage = VirtualAlloc((LPVOID)hDll ,g_dwImageSize ,MEM_COMMIT|MEM_RESERVE ,PAGE_EXECUTE_READWRITE);
if(g_lpNewImage != (LPVOID)hDll)
return FALSE;


memcpy(g_lpNewImage , lpBackMem , g_dwImageSize);
VirtualFree(lpBackMem , 0, MEM_RELEASE);


return TRUE ;
}




效果都是一样可以达到断链的
页: [1]
查看完整版本: 这个dll_CopycatAndHide 的masm源代码