脱壳技术,浅析xprotector之中断处理(9千字),xprotector 2008年06月23日 星期一 下午 03:14 对於一个ring0级加壳程序来说，中断处理是很重要的。在它的帮助中这样描述: Wizard: Adding Interrupt 1-3 Support In this step you can add debugging interrupts support in your program to make your program fully compatible with Xtreme-Protector in case that you use the interrupt 1 or 3 in your program or dlls. Details Xtreme-Protector has a total control of the debugging interrupts to protect your program against debuggers. If your program uses the INT3 or INT1 instruction to detect debuggers or you insert debugging exceptions inside your code to debug your OWN process, you must add support for it with Xtreme-Protector. If you don’t use or don’t know if you use INT1-3 instructions in your program, do NOT add support for it to avoid incompatibilities with your program. 从上面可以看出，xprotector对於中断1\3的处理是很强劲的。让我们实地勘测吧！运行xprotector，出现主窗口後。呼出调试器，idt查看中断。显示如下: IDTbase=8003F400 Limit=07FF 0000 0 P IntG32 00000008:8052F0B0 0001 3 P IntG32 00000008:FFFFFFFF ;中断1 0002 0 P TaskG 00000058 0003 3 P IntG32 00000008:FFFFFFFF ;中断3 0004 3 P IntG32 00000008:8052F694 0005 0 P IntG32 00000008:8052F7DC 0006 0 P IntG32 00000008:8052F93C 0007 0 P IntG32 00000008:8052FF14 0008 0 P TaskG 00000050 0009 0 P IntG32 00000008:80530334 000A 0 P IntG32 00000008:8053043C 000B 0 P IntG32 00000008:80530568 000C 0 P IntG32 00000008:80530734 000D 0 P IntG32 00000008:805309FC 000E 0 P IntG32 00000008:F8368961 ;中断0E 000F 0 P IntG32 00000008:80531434 从上面可以看出，程式运行後，改变了中断1和中断3的处理入口爲FFFFFFFFH,改变中断0e的处理入口爲F8368961H。 我们再看看F8368961处的代码,U F8368961,如下： 0xFC682961: 9C pushfd 0xFC682962: 60 pushad 0xFC682963: E800000000 call 0xfc682968 0xFC682968: 5D pop ebp ; <==0xFC682963(*-0x5) 0xFC682969: 81EDFB45FF01 sub ebp,0x1ff45fb 0xFC68296F: 8B442428 mov eax,dword [esp 0x28] ; 出错地址 0xFC682973: 83F8FF cmp eax,0xff 0xFC682976: 7413 jz 0xfc68298b ; (* 0x15) 0xFC682978: 8B442424 mov eax,dword [esp 0x24] 0xFC68297C: 83F8FF cmp eax,0xff 0xFC68297F: 0F85CD000000 jnz 0xfc682a52 ; (* 0xD3) 0xFC682985: 61 popad 0xFC682986: 9D popfd 0xFC682987: 83C40C add esp,0xc 0xFC68298A: CF iretd ;******************************************************************************** 0xFC68298B: B801000000 mov eax,0x1 ; <==0xFC682976(*-0x15) 0xFC682990: 0BC0 or eax,eax 0xFC682992: 753E jnz 0xfc6829d2 ; (* 0x40) 0xFC682994: B878563412 mov eax,0x12345678 0xFC682999: 8B00 mov eax,dword [eax] 0xFC68299B: 83780800 cmp dword [eax 0x8],0x0 0xFC68299F: 7473 jz 0xfc682a14 ; (* 0x75) 0xFC6829A1: 83780802 cmp dword [eax 0x8],0x2 0xFC6829A5: 776D ja 0xfc682a14 ; (* 0x6F) 0xFC6829A7: 83780801 cmp dword [eax 0x8],0x1 0xFC6829AB: 741A jz 0xfc6829c7 ; (* 0x1C) 0xFC6829AD: 8BDC mov ebx,esp ; <==0xFC682A05(* 0x58) 0xFC6829AF: 83C334 add ebx,0x34 0xFC6829B2: 8B03 mov eax,dword [ebx] 0xFC6829B4: 8078FFCC cmp byte [eax-0x1],0xcc 0xFC6829B8: 7507 jnz 0xfc6829c1 ; (* 0x9) 0xFC6829BA: C640FFC5 mov byte [eax-0x1],0xc5 0xFC6829BE: 40 inc eax 0xFC6829BF: EB77 jmp 0xfc682a38 ; (* 0x79) 0xFC6829C1: C640FEC5 mov byte [eax-0x2],0xc5 ; <==0xFC6829B8(*-0x9) 0xFC6829C5: EB71 jmp 0xfc682a38 ; (* 0x73) 0xFC6829C7: 8D85E746FF01 lea eax,dword [ebp 0x1ff46e7]; <==0xFC6829AB(*-0x1C) 0xFC6829CD: 895001 mov dword [eax 0x1],edx 0xFC6829D0: FFE0 jmp eax 0xFC6829D2: 0FA0 push fs ; <==0xFC682992(*-0x40) 0xFC6829D4: B830000000 mov eax,0x30 0xFC6829D9: 668EE0 mov fs,al 0xFC6829DC: 64A124010000 mov eax,fs:[0x124] ; eax<---pETHREAD 0xFC6829E2: 8B4044 mov eax,dword [eax 0x44] ; 044 struct _KPROCESS 0xFC6829E5: 0FA1 pop fs 0xFC6829E7: 8BD8 mov ebx,eax 0xFC6829E9: 81E3FFFFFF7F and ebx,0x7fffffff 0xFC6829EF: BE492F68FC mov esi,0xfc682f49 ; DATA: daG 0xFC6829F4: 83C604 add esi,0x4 ; <==0xFC682A07(* 0x13) 0xFC6829F7: 813E20646147 cmp dword [esi],0x47616420 0xFC6829FD: 7415 jz 0xfc682a14 ; (* 0x17) 0xFC6829FF: 3906 cmp dword [esi],eax 0xFC682A01: 7406 jz 0xfc682a09 ; (* 0x8) 0xFC682A03: 391E cmp dword [esi],ebx 0xFC682A05: 74A6 jz 0xfc6829ad ; (*-0x58) 0xFC682A07: EBEB jmp 0xfc6829f4 ; (*-0x13) 0xFC682A09: 8D85E746FF01 lea eax,dword [ebp 0x1ff46e7]; <==0xFC682A01(*-0x8) 0xFC682A0F: 895001 mov dword [eax 0x1],edx 0xFC682A12: FFE0 jmp eax 0xFC682A14: 8BDC mov ebx,esp ; <==0xFC6829FD(*-0x17), 0xFC6829A5(*-0x6F), 0xFC68299F(*-0x75) 0xFC682A16: 83C334 add ebx,0x34 0xFC682A19: 8B03 mov eax,dword [ebx] 0xFC682A1B: 8078FFCC cmp byte [eax-0x1],0xcc 0xFC682A1F: 742A jz 0xfc682a4b ; (* 0x2C) 0xFC682A21: 668178FECD03 cmp word [eax-0x2],0x3cd 0xFC682A27: 7422 jz 0xfc682a4b ; (* 0x24) 0xFC682A29: 668178FECD01 cmp word [eax-0x2],0x1cd 0xFC682A2F: 7407 jz 0xfc682a38 ; (* 0x9) 0xFC682A31: 61 popad 0xFC682A32: 9D popfd 0xFC682A33: 83C410 add esp,0x10 0xFC682A36: EB26 jmp 0xfc682a5e ; (* 0x28) 0xFC682A38: 83E802 sub eax,0x2 ; <==0xFC682A2F(*-0x9), 0xFC6829C5(*-0x73), 0xFC6829BF(*-0x79) 0xFC682A3B: 8903 mov dword [ebx],eax 0xFC682A3D: 61 popad 0xFC682A3E: 9D popfd 0xFC682A3F: 83C40C add esp,0xc 0xFC682A42: C704242A000000 mov dword [esp],0x2a 0xFC682A49: EB1F jmp 0xfc682a6a ; (* 0x21) 0xFC682A4B: 61 popad ; <==0xFC682A27(*-0x24), 0xFC682A1F(*-0x2C) 0xFC682A4C: 9D popfd 0xFC682A4D: 83C410 add esp,0x10 0xFC682A50: EB12 jmp 0xfc682a64 ; (* 0x14) 0xFC682A52: 61 popad ; <==0xFC68297F(*-0xD3) 0xFC682A53: 9D popfd 0xFC682A54: 6888105380 push 0x80531088 0xFC682A59: C3 ret ;******************************************************************************** 0xFC682A5E: 6804F25280 push 0x8052f204 ; <==0xFC682A36(*-0x28) 0xFC682A63: C3 ret ;******************************************************************************** 0xFC682A64: 682CF55280 push 0x8052f52c ; <==0xFC682A50(*-0x14) 0xFC682A69: C3 ret ;******************************************************************************** 0xFC682A6A: 68FC095380 push 0x805309fc ; <==0xFC682A49(*-0x21) 0xFC682A6F: C3 ret ;******************************************************************************** 从上面的代码可以看出，当用户级的程式産生int 3异常後，将会跳到到ffffffffh，但ffffffffh是不访问的，所以就会産生一个页异常，对应的中断就是int 0e，在跳到int 0e的处理程式中，它会用peb来判断産生异常的程式是不是xprotector自身程式。如果不是，那麽会判断産生异常的eip处的指令是不是CC,CD等，也就是看是不是int 3,int 1，如果是的话，就跳到原来正确的int 1和int 3处理入口继续运行，这样就完成了用户级程式的INT 1,INT 3处理了。 写得不好，请指教! |
|小黑屋|最新主题|手机版|微赢网络技术论坛
( 苏ICP备08020429号 )
GMT+8, 2024-9-29 23:33 , Processed in 0.106794 second(s), 12 queries , Gzip On, MemCache On.
Powered by Discuz! X3.5
© 2001-2023 Discuz! Team.
