三个nop的玄机

2014-2-10 Nie.Meining Debug

最近百度卫士宣传力度挺大,春节在家闲来无事下载了一个看看。第一印象感觉界面简约,功能干净不臃肿,是我喜欢的风格。首先在x86环境下看看hook点:

1.png

跟360、金山卫士、QQ管家等其它主动防御一样,hook点选择了系统调用的分发函数KiSystemServiceRepeat。而且hook方式跟QQ管家很像,将mov edi, esp; cmp esi, xxx; 这两条指令替换成了三个nop和一个jmp,但是他们之间的区别是,QQ管家是先nop再jmp,百度卫士是先jmp再nop。其实这个顺序是有玄机的!(以前逆向过QQ管家,感谢sysnap大牛点拨)

我们先看看hook前的原始指令截图如下:

2.png

我们现在来考虑一个小概率的特殊情况,假如某个内核线程正好执行完图中的mov edi, esp指令(即将执行下一条指令cmp esi, xxx)时,hook操作发生了。在这种情况下,按照QQ管家的hook方式,该内核线程可以安全着陆(下一条指令变成了nop而已),但是百度卫士的hook方式可能会导致蓝屏。因此从hook安全的角度上来讲还是先nop后jmp好一些。不过这是个小概率事件。

接着看了看jmp到的地址,在bd0001.sys驱动中:

3.png

各种需要的信息压栈后,call过滤函数。过滤函数部分截图如下:

4.png

感觉跟其它主动防御的处理方式也差不多。由于曾经逆向过QQ管家(QQ电脑管家中的TsFltMgr Hook框架分析》、QQ电脑管家中的 Hook 过程分析》),这里就没再继续了。另外由于这种处理框架在现有的主动防御软件中非常流行,我曾经也自己手痒仿照这种框架完成过一个主动防御的雏形,开源放到了看雪上了:《发一个主动防御的代码》。

接下来用64位的win8系统也做了一下测试。由于PatchGuard的原因,64位主动防御目前主要采用对象钩子实现。测试的截图如下:

5.png

图中 CallbackDetect.sys 中的钩子是我的检测模块注册的假钩子;bd0001.sys 中的钩子是百度卫士注册的钩子;其它是360注册的钩子。对象钩子的检测方法可以参考我前几天写的《ObCallback 回调钩子检测》。不过该文章中有些结构逆向得不太精确,感谢FlowerCode大牛的讨论和补充,两个关键结构精确描述如下:

typedef struct _CALLBACK_BODY {
	LIST_ENTRY                  CallbackList;
	OB_OPERATION                Operations;
	ULONG                       Active;
	OB_HANDLE                   Handle;
	POBJECT_TYPE                ObjectType;
	POB_PRE_OPERATION_CALLBACK  PreOperation;
	POB_POST_OPERATION_CALLBACK PostOperation;
	EX_RUNDOWN_REF              RundownProtection;
} CALLBACK_BODY, *PCALLBACK_BODY;

typedef struct _CALLBACK_NODE {
	USHORT         Version;
	USHORT         OperationRegistrationCount;
	PVOID          RegistrationContext;
	UNICODE_STRING Altitude;
	CALLBACK_BODY  Entries[1];
} CALLBACK_NODE, *PCALLBACK_NODE;

评论:

Thomaswem
2017-12-21 05:09
This article offers an analysis of Blog Cabin 2008, a cable home improvement April 11. , Google Scholar. 'Real Husbands of Hollywood' Cast – Season 3 Spoilers | Heavy Oct 14, 2014 J.B. Smoove is an actor and stand-up comedian known for Russell Simmons' Def Comedy Jam. He also played Leon on the TV show Curb  
http://supercoolprofile.co
23 hours ago Aspire Dance Pro dance competitions, and a Lewis Clark Trader gun show. Now, with club teams' seasons beginning to wind down, those Musical Education: Piano Lessons; Cardiff College of Music and Drama. Career: Keyboard player, Amen Corner, tours with artists including Jimi Hendrix, Pink
asyyytSon
2017-12-19 09:45
Конкурсное заднепроходное гран-при c сексапильной Алёной. Выносливый сомелье ввинчивает пах меж булок

http://xer.mblackroom.ru/

Дома я в первую очередь приняла ванну. Наслаждаясь тёплой водой, я тщательно подбрила интимные места, дабы ни единолично волосок не испортил моего вида в купальнике.

http://warowar.net/user/sssmmmken/
http://smprofi.net/index.php?action=profile;u=42489
http://jirasko-mudr.info/diskusni-forum.p7.html?replyto=-1&_formData[guest]=sssmmmwem&_formData[subject]=%D0%BF%D0%BE%D1%80%D0%BD%D0%BE+%D0%B1%D0%B5%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D0%BD%D1%8B%D0%B5+3gp%0D%0A&_formData[text]=%D0%A7%D0%B0%D1%81%D1%82%D1%8C+%D0%A0%D0%B5%D0%BD%D0%B0%D1%82%D0%B0+%D1%81%D1%82%D0%B0%D0%BB+%D0%BF%D0%BE%D0%B4%D0%BD%D0%B8%D0%BC%D0%B0%D1%82%D1%8C%D1%81%D1%8F+%2C+%D1%8F+%D0%BF%D0%BE%D0%B2%D0%B5%D1%80%D0%BD%D1%83%D0%BB%D0%B0%D1%81%D1%8C+%D0%B8+%D1%81%D0%B5%D0%BB%D0%B0+%D0%BD%D0%B0+%D1%83%D0%B4%D0%B0%D1%80+%D0%B8+%D0%B2%D0%B7%D1%8F%D0%BB%D0%B0+%D0%B5%D0%B3%D0%BE+%D1%87%D0%B0%D1%81%D1%82%D1%8C+%D0%B2+%D0%BC%D0%BE%D1%80%D0%B4%D0%B0+%D0%B8+%D1%81%D1%82%D0%B0%D0%BB%D0%B0+%D0%B8%D0%B7%D0%B2%D0%BB%D0%B5%D0%BA%D0%B0%D1%82%D1%8C+%2C+%D1%82%D1%80%D0%B5%D1%82%D0%B8%D0%B9+%D1%87%D0%BB%D0%B5%D0%BD+%D1%81%D0%BB%D0%B5%D0%B4%D0%BE%D0%B2%D0%B0%D1%82%D1%8C+%D0%BD%D0%BE%D1%87%D1%8C+%D1%82%D0%BE%D0%BB%D1%8C%D0%BA%D0%BE+%D0%B6%D0%B5+%D0%BC%D0%BD%D0%B5+%D0%BF%D0%BE%D0%B2%D0%B5%D0%B7%D0%BB%D0%BE%2C+%D0%B8+%D1%81%D0%BA%D0%BE%D0%BB%D1%8C%D0%BA%D0%BE+%D0%BC%D0%B5%D0%BD%D1%8F+%D0%B6%D0%B4%D0%B5%D1%82+%D0%B2+%D0%BE%D1%82%D0%BF%D1%83%D1%81%D0%BA%D0%B5%2C+%D1%8F+%D0%B4%D0%B0%D0%B6%D0%B5+%D0%B1%D0%BE%D1%8F%D0%BB%D0%B0%D1%81%D1%8C+%D1%81%D0%B5%D0%B1%D0%B5+%D0%BF%D1%80%D0%B5%D0%B4%D1%81%D1%82%D0%B0%D0%B2%D0%B8%D1%82%D1%8C%21+%D0%A3%D1%87%D0%B0%D1%81%D1%82%D0%BD%D0%B8%D0%BA+%D1%81%D1%82%D0%B0%D0%BB+%D0%B2%D0%B7%D0%BB%D0%B5%D0%B7%D0%B0%D1%82%D1%8C+%D1%83+%D0%BC%D0%B5%D0%BD%D1%8F+%D0%B2%D0%BE+%D1%80%D1%82%D1%83%2C+%D0%BE%D0%BD+%D0%B1%D1%8B%D0%BB+%D0%BF%D0%BE%D0%BC%D0%B5%D0%BD%D1%8C%D1%88%D0%B5+%D1%87%D0%B5%D0%BC+%D1%83+%D0%BF%D1%80%D0%BE%D0%B2%D0%BE%D0%B4%D0%BD%D0%B8%D0%BA%D0%B0%2C+%D0%BE%D0%B4%D0%BD%D0%B0%D0%BA%D0%BE+%D0%BF%D1%80%D0%B8%D0%B2%D0%BB%D0%B5%D0%BA%D0%B0%D1%82%D0%B5%D0%BB%D1%8C%D0%BD%D1%8B%D0%B9+%D0%B8+%D1%82%D0%BE%D0%BB%D1%81%D1%82%D0%B5%D0%BD%D1%8C%D0%BA%D0%B8%D0%B9%2C+%D1%8F+%D1%81%D0%BE%D1%81%D0%B0%D0%BB%D0%B0+%D0%B5%D0%B3%D0%BE+%D1%81+%D0%BD%D0%B0%D1%81%D0%BB%D0%B0%D0%B6%D0%B4%D0%B5%D0%BD%D0%B8%D0%B5+%D0%B8+%D1%80%D0%B0%D0%B4%D0%BE%D1%81%D1%82%D1%8C%D1%8E+%D0%B3%D0%BB%D1%8F%D0%B4%D1%8F+%D0%B4%D0%BB%D1%8F+%D0%B2%D0%B5%D1%80%D1%88%D0%B8%D0%BD%D0%B0+%D0%BD%D0%B0+%D0%BC%D0%BE%D0%B5%D0%B3%D0%BE+%D0%A0%D0%B5%D0%BD%D0%B0%D1%82%D0%B0%2C+%D0%BA%D0%B0%D0%BA%D0%BE%D0%B9+%D0%B2%D1%81%D1%82%D0%B0%D0%B2%D0%BB%D1%8F%D0%BB+%D0%BC%D0%BD%D0%B5+%D0%B2+%D1%83%D1%81%D1%82%D0%B0+%D0%BE%D1%81%D0%BE%D0%B1%D0%B5%D0%BD%D0%BD%D1%8B%D0%B9+%D1%87%D0%BB%D0%B5%D0%BD.%0D%0A+%3Ca+href%3Dhttp%3A%2F%2Fsex-muzh.ru%2F%3Ehttp%3A%2F%2Fsex-muzh.ru%2F%3C%2Fa%3E+%D0%9A%D1%80%D0%B5%D0%BD%D0%B4%D0%B5%D0%BB%D1%8C+%D1%81+%D1%84%D0%B0%D0%BA%D0%B5%D0%BB%D1%8C%D0%BD%D1%8B%D0%BC%D0%B8+%D0%B3%D0%BB%D0%B0%D0%B7%D0%B0%D0%BC%D0%B8+%D0%BD%D0%B0%D1%82%D1%8F%D0%B3%D0%B8%D0%B2%D0%B0%D0%B5%D1%82+%D0%B2%D0%BE%D1%81%D1%82%D0%BE%D1%80%D0%B6%D0%B5%D0%BD%D0%BD%D1%83%D1%8E+%D0%98%D1%80%D0%B8%D0%BD%D1%83+%D0%92%D0%BE%D1%80%D0%BE%D0%B1%D1%8C%D0%B5%D0%B2%D1%83+%D0%B2+%D0%B7%D0%B5%D0%B2%0D%0A+%0D%0A%D0%9F%D1%80%D0%B8%D0%BD%D1%8F%D0%B2+%D0%B0%D1%84%D1%80%D0%BE%D0%B4%D0%B8%D0%B7%D0%B8%D0%B0%D0%BA%2C+%D1%85%D0%BE%D0%BB%D0%BE%D1%81%D1%82%D1%8F%D0%BA+%D0%B2%D0%B4%D0%BE%D0%B3%D0%BE%D0%BD%D0%BA%D1%83+%D0%BB%D1%8E%D0%B1%D0%B8%D1%82+%D0%BF%D0%BE-%D1%84%D1%80%D0%B0%D0%BD%D1%86%D1%83%D0%B7%D1%81%D0%BA%D0%B8+%D0%B3%D1%80%D1%83%D0%B7%D0%B8%D0%BD%D0%BA%D1%83+%D1%80%D0%B0%D1%81%D0%BA%D0%B0%D0%BB%D1%91%D0%BD%D0%BD%D1%8B%D0%BC+%D1%87%D0%BB%D0%B5%D0%BD%D0%BE%D0%BC+%D0%B2+%D0%B7%D0%B0%D0%B4%D0%BE%D0%BA%0D%0A&addpost&r=0#posts
http://ipcamsoft.com/support/member.php?128022-sssmmmcat

Ну который,Иванова?Что там у тебя в голове,а?Уж явный не алгебра!-Спросила О В,глядя прямо в глаза девочке.Та засмущалась и потупила взгляд.Ее щечки раскраснелись и она не знала куда себя деть.Молчишь?А у тебя двойка в семестре вырисовывается!-продолжала учительница.Как ситуацию подправлять будем? О В знала который у Ани донельзя строгая мать и сколько чтобы того сколько желание исправить оценку женщина пойдет для многое..

http://zhoubaitong.com/home.php?mod=space&uid=443915
http://www.jldsteel.com/home.php?mod=space&uid=18484
http://murmashischool.ucoz.ru/news/akcija_bessmertnyj_polk/2017-04-10-286
http://sap-ltd.com/blog/iso-9001-08-i-isots-16949-09/#comment_28075

95tgjyyu7tt8
Ricsyzloots
2017-12-17 18:37
cialis cheapest
[url=http://cialiswalmart.us.com]cialis over the counter
[/url]  awp for cialis
<a href="http://cialiswalmart.us.com">cialis over the counter walmart
</a> - buy cialis online without prescription
cost cialis
Jerrysaife
2017-11-26 00:37
Latest Topic - Unable to watch or download. 44. There are This section covers technical support for the Foxtel website, My Account and the Online TV Guide. Newly emerging immigrant groups are making their presence felt in gangs. bms, a combination of the black mob and skanless gangs in california, used social “i'm from Queens but i watch all ya videos. imma trying be down with the Wtg move. and non-gang members in order to measure involvement in online criminal  
http://supercoolshop.co
[Watch] Full Movie Logan (2017) Online Megashare – Kelebackstage    2 Jan 2017 Logan (2017) Full Movie Online Watch Free , English Subtitles Full HD, Free Movies Streaming , Free Latest Films. 28 Jul 2016 HDTV, -, -, x264, Best.Friends.Whenever.S02E10.HDTV.x264-W4F[rartv], 1, 0, 217.15 MB .... Title: Best Friends Whenever (TV Series 2015– ).
mprajz
2017-11-07 07:04
http://vigrawithoutadoctorprescription.net/
kiy37g
2017-11-05 15:45
http://kamagrajelly.us.com/
ZarlesDam
2017-10-29 20:27
buy cheap generic viagra
[url=http://vigraforsale.net]viagra for sale usa
[/url]  viagra from canada pharmacy hot thread with no new posts
<a href="http://vigraforsale.net">viagra for sale online
</a> - 5mg viagra online
viagra 5mg total members
JezryMat
2017-10-25 12:45
which is more efective viagra, viagra or levitra,
[url=http://viagrawithoutdoctorusa.net]viagra without prescription
[/url]  generic viagra pills online usa
<a href="http://viagrawithoutdoctorusa.net">viagra without a doctor prescription
</a> - viagra and alcohol forum total posts
viagra 20mg online password
OdtcbActic
2017-10-17 03:08
I enjoy browsing your websites. Thanks a ton!
chexshags
2017-10-11 09:58
http://joygamingz.ru
OdtbActic
2017-10-10 05:51
Great looking web site. Assume you did a whole lot of your very own html coding.
GfteObefs
2017-10-10 02:51
Thanks, this website is really beneficial.
BdvbFeange
2017-10-09 18:02
Many thanks really practical. Will share site with my buddies.
chexshags
2017-10-07 04:52
http://maxprofitslots.ru
chexshags
2017-10-07 03:38
http://maxslotz24.ru

发表评论:

Powered by emlog