windows创建进程的3种方式下各API调用层次

2019独角兽企业重金招聘Python工程师标准>>>

今天对创建进程的3种方式进行了跟踪：

调用api，createprocess

createprocess-createprocessinternala-createprocessinternalw

调用api，shell：

shellexecute- createprocessw-createprocessinternalw，

创建com方式（脚本病毒常用手法）：

createobject("wscript.shell").run- createprocessw-createprocessinternalw

 

 

验证方式如下（createprocess，其它不再列举），以下内容来自OD：

kernel32位置：

73FD44B0 >    8BFF          mov edi,edi

73FD44B2   .  55            push ebp

73FD44B3   .  8BEC          mov ebp,esp

73FD44B5   .  5D            pop ebp

73FD44B6   .- FF25 1C140374 jmp [dword ds:<&api-ms-win-core-processt>;  KernelBa.CreateProcessA

 

进入kernelba位置：

76629010 >  8BFF            mov edi,edi

76629012    55              push ebp

76629013    8BEC            mov ebp,esp

76629015    6A 00           push 0x0

76629017    FF75 2C         push [dword ss:ebp+0x2C]

7662901A    FF75 28         push [dword ss:ebp+0x28]

7662901D    FF75 24         push [dword ss:ebp+0x24]

76629020    FF75 20         push [dword ss:ebp+0x20]

76629023    FF75 1C         push [dword ss:ebp+0x1C]

76629026    FF75 18         push [dword ss:ebp+0x18]

76629029    FF75 14         push [dword ss:ebp+0x14]

7662902C    FF75 10         push [dword ss:ebp+0x10]

7662902F    FF75 0C         push [dword ss:ebp+0xC]

76629032    FF75 08         push [dword ss:ebp+0x8]

76629035    6A 00           push 0x0

76629037    E8 94000000     call KernelBa.CreateProcessInternalA

7662903C    5D              pop ebp

7662903D    C2 2800         retn 0x28

 

在OD中并不标注createprocessinternalW名称，但是到达这里之后，EIP可以看到标注，也可以在模块的name list中定位到，在KernelBa模块中，以下地址为createprocessinternalW

766290D0 >  68 90000000     push 0x90

766290D5    68 303A6376     push KernelBa.76633A30

766290DA    E8 D56CF9FF     call KernelBa.765BFDB4

766290DF    33DB            xor ebx,ebx

766290E1    895D E0         mov [dword ss:ebp-0x20],ebx

766290E4    8B55 10         mov edx,[dword ss:ebp+0x10]

766290E7    85D2            test edx,edx

766290E9    74 11           je XKernelBa.766290FC

766290EB    8D4D BC         lea ecx,[dword ss:ebp-0x44]

766290EE    E8 B491F6FF     call KernelBa.765922A7

766290F3    85C0            test eax,eax

766290F5    75 0D           jnz XKernelBa.76629104

766290F7    E9 D5020000     jmp KernelBa.766293D1

766290FC    33C0            xor eax,eax

766290FE    8945 BC         mov [dword ss:ebp-0x44],eax

76629101    895D C0         mov [dword ss:ebp-0x40],ebx

76629104    64:A1 30000000  mov eax,[dword fs:0x30]

7662910A    8B40 18         mov eax,[dword ds:eax+0x18]

7662910D    8945 E4         mov [dword ss:ebp-0x1C],eax

76629110    8945 C8         mov [dword ss:ebp-0x38],eax

76629113    33C0            xor eax,eax

76629115    8945 B4         mov [dword ss:ebp-0x4C],eax

76629118    895D B8         mov [dword ss:ebp-0x48],ebx

7662911B    8945 AC         mov [dword ss:ebp-0x54],eax

7662911E    895D B0         mov [dword ss:ebp-0x50],ebx

76629121    6A 11           push 0x11

76629123    59              pop ecx

76629124    8B75 2C         mov esi,[dword ss:ebp+0x2C]

76629127    8DBD 60FFFFFF   lea edi,[dword ss:ebp-0xA0]

7662912D    F3:A5           rep movs [dword es:edi],[dword ds:esi]

7662912F    8D85 60FFFFFF   lea eax,[dword ss:ebp-0xA0]

76629135    8945 C4         mov [dword ss:ebp-0x3C],eax

76629138    C785 60FFFFFF 4>mov [dword ss:ebp-0xA0],0x48

76629142    899D 64FFFFFF   mov [dword ss:ebp-0x9C],ebx

76629148    899D 68FFFFFF   mov [dword ss:ebp-0x98],ebx

7662914E    899D 6CFFFFFF   mov [dword ss:ebp-0x94],ebx

76629154    8B7D 2C         mov edi,[dword ss:ebp+0x2C]

76629157    F745 20 0000080>test [dword ss:ebp+0x20],0x80000

7662915E    74 08           je XKernelBa.76629168

76629160    8B47 44         mov eax,[dword ds:edi+0x44]

76629163    8945 A4         mov [dword ss:ebp-0x5C],eax

76629166    EB 03           jmp XKernelBa.7662916B

76629168    895D A4         mov [dword ss:ebp-0x5C],ebx

7662916B    895D FC         mov [dword ss:ebp-0x4],ebx

7662916E    33F6            xor esi,esi

76629170    46              inc esi

76629171    8975 FC         mov [dword ss:ebp-0x4],esi

76629174    8B55 0C         mov edx,[dword ss:ebp+0xC]

76629177    85D2            test edx,edx

76629179    74 1C           je XKernelBa.76629197

7662917B    8D4D B4         lea ecx,[dword ss:ebp-0x4C]

7662917E    E8 2491F6FF     call KernelBa.765922A7

76629183    85C0            test eax,eax

76629185    75 10           jnz XKernelBa.76629197

76629187    8BF3            mov esi,ebx

76629189    8975 E0         mov [dword ss:ebp-0x20],esi

7662918C    895D FC         mov [dword ss:ebp-0x4],ebx

7662918F    8B7D E4         mov edi,[dword ss:ebp-0x1C]

76629192    E9 2C020000     jmp KernelBa.766293C3

76629197    8B55 28         mov edx,[dword ss:ebp+0x28]

7662919A    85D2            test edx,edx

7662919C    74 0C           je XKernelBa.766291AA

7662919E    8D4D AC         lea ecx,[dword ss:ebp-0x54]

766291A1    E8 0191F6FF     call KernelBa.765922A7

766291A6    85C0            test eax,eax

766291A8  ^ 74 DD           je XKernelBa.76629187

766291AA    8B47 04         mov eax,[dword ds:edi+0x4]

766291AD    85C0            test eax,eax

766291AF    0F84 AF000000   je KernelBa.76629264

766291B5    C745 FC 0200000>mov [dword ss:ebp-0x4],0x2

766291BC    50              push eax

766291BD    8D45 D4         lea eax,[dword ss:ebp-0x2C]

766291C0    50              push eax

766291C1    FF15 18836476   call [dword ds:<&ntdll.RtlInitAnsiString>; ntdll.RtlInitAnsiStringEx

766291C7    8945 DC         mov [dword ss:ebp-0x24],eax

766291CA    8975 FC         mov [dword ss:ebp-0x4],esi

766291CD    85C0            test eax,eax

766291CF    79 09           jns XKernelBa.766291DA

766291D1    8BC8            mov ecx,eax

766291D3    E8 2887F6FF     call KernelBa.76591900

766291D8  ^ EB AD           jmp XKernelBa.76629187

766291DA    A1 34806476     mov eax,[dword ds:<&ntdll.NlsMbCodePageT>

766291DF    8038 00         cmp [byte ds:eax],0x0

766291E2    74 0C           je XKernelBa.766291F0

766291E4    8D45 D4         lea eax,[dword ss:ebp-0x2C]

766291E7    50              push eax

766291E8    FF15 54876476   call [dword ds:<&ntdll.RtlxAnsiStringToU>; ntdll.RtlxOemStringToUnicodeSize

766291EE    EB 0B           jmp XKernelBa.766291FB

766291F0    0FB745 D4       movzx eax,[word ss:ebp-0x2C]

766291F4    8D0445 02000000 lea eax,[dword ds:eax*2+0x2]

766291FB    66:8945 CE      mov [word ss:ebp-0x32],ax

766291FF    0FB7C0          movzx eax,ax

76629202    50              push eax

76629203    53              push ebx

76629204    8B75 E4         mov esi,[dword ss:ebp-0x1C]

76629207    56              push esi

76629208    FF15 F4826476   call [dword ds:<&ntdll.RtlAllocateHeap>] ; ntdll.RtlAllocateHeap

7662920E    8985 64FFFFFF   mov [dword ss:ebp-0x9C],eax

76629214    85C0            test eax,eax

76629216    75 07           jnz XKernelBa.7662921F

76629218    B9 170000C0     mov ecx,0xC0000017

7662921D  ^ EB B4           jmp XKernelBa.766291D3

7662921F    8945 D0         mov [dword ss:ebp-0x30],eax

76629222    53              push ebx

76629223    8D45 D4         lea eax,[dword ss:ebp-0x2C]

76629226    50              push eax

76629227    8D45 CC         lea eax,[dword ss:ebp-0x34]

7662922A    50              push eax

7662922B    FF15 2C806476   call [dword ds:<&ntdll.RtlAnsiStringToUn>; ntdll.RtlAnsiStringToUnicodeString

76629231    8945 DC         mov [dword ss:ebp-0x24],eax

76629234    85C0            test eax,eax

76629236    79 2F           jns XKernelBa.76629267

76629238  ^ EB 97           jmp XKernelBa.766291D1

7662923A    8B45 EC         mov eax,[dword ss:ebp-0x14]

7662923D    8B00            mov eax,[dword ds:eax]

7662923F    33C9            xor ecx,ecx

76629241    8138 050000C0   cmp [dword ds:eax],0xC0000005

76629247    0F94C1          sete cl

7662924A    8BC1            mov eax,ecx

7662924C    C3              retn

转载于:https://my.oschina.net/u/1777508/blog/1795240