From 44c1925c1bda82970b533d4e96a993293514b5ba Mon Sep 17 00:00:00 2001 From: Cc28257 <1109692332@qq.com> Date: Wed, 7 Oct 2020 15:26:20 +0800 Subject: [PATCH] fix asm --- CcMainDll/.vs/CcMainDll/v15/.suo | Bin 137216 -> 137216 bytes CcMainDll/CcMainDll/dllmain.cpp | 69 +++++++++++++++---------------- bin/server/CcMainDll.dll | Bin 226304 -> 226304 bytes 3 files changed, 34 insertions(+), 35 deletions(-) diff --git a/CcMainDll/.vs/CcMainDll/v15/.suo b/CcMainDll/.vs/CcMainDll/v15/.suo index bc4e628cd9499b6890e798c9128bdd80734d9585..68038874a3f50bdcffce390dd31ff513498283a1 100644 GIT binary patch delta 7657 zcmeI0eN@7zXT}*C2!#+3aU4e@K?E()LKt2(1VvFaMcx8MAVeF`6lEYYD>RtL zM-(_uYC5KXBuok@> zvT66bG)hz}byOz)q0}jbil`a3MR}LRg<)Zf<^4gp&j$nooVt&6wDW;4hy)Ws6UYDo zU^c)qye!~aPz%C<9z=-Mn$aWVa>s!XFdk^dZ}j7}a`GbaqGr^JJoF`jMvw|dfQ{f* zFcz4BKbQ$N0D0#M$mwc3Ta{MGn?W?V25bi-MT}v*@n7;59Cq}G0&P%TF&YJ+5ZnL~ zz-q7(NJZQWIUkg$=kn$Xv~L4zfIPRUQnuxB3(l)S4Vb51o1)4FRW9*J@s+mPa6GH~ zN+uZ|H8TRErQ&|F3B(Hh_*oj21u!T*^Yoauw1rqk^JvWhuBC$X=;)JAjeG4gE&x6V2ZK;-FTa z`iq!Ad|`OBZlVHj1=85pK~7TJk&shC6qo{{K@5=Nra@j0ZUECkESLdif*Zk2AP&p| z@gMYBEeNlW(uqX;k#} zaM1?orux8A%^oydwm`e0ge&4g&_!cDG%ABn9{lv*DApAla(KAYqB!zWM9S$nVb4p^ z%Vf6`h{UpRaXv3g4_o!!-``=&Z*(*zi&y<(gsmw{FVNqjUQ<3G*M%l;5_VgtD>VEJ zIm|Yt2&vqB%;43EK@VM;WPGErk2MR6Z>TFi<0EpJqI$`(Vc)QQ;m!_!V@>|b(!b&3}^Fbnqhceo#%P3A4hfEF_XH5 zJ=QAd0W)gRVfCt%V>}OZmr2=lF4cAJv=Sc-r*3C~UuWxh^2=LxxA~n3wkPsa=N_J! zaBYu>DGLy@A9&8WPH`McHqbWQcMove&UPqEqy)z~4#QkZjPhsf@bEm1OrnC~B8~H) zo@uH#aB~lhagC|@3w8D;lfj*N_g|XlG^`~}y73HkR%KCuEaEvp)(n{=WqlFFYjzi{r%Bn}Z9Bc*B#qNTfq_*Yx z^=kV*$XFnKQufOyOL-IIF10Q5yU0qn_&lO^$N~FAeY*dI6!bi<_8w5>K~+8p*$$o( z&!y)ZUPtQ?I4qjAqnoQ95hvzaoZB?qeS#{@Nv_<9F*3Z_vTK%6H zZOWcD=7~LyST0;f{=8`!1$8~|pi~m4w~ZAAWhPfbEq zKdN*-s0N*Teqrrs(8t6^#!RnGD|Ee)Go6O&4~_{Im*ss6X{7l*w*H{e@o}<9K9nFD zK29{yowy()*t6u1J(>4zwPQdeInQX?jHGm4c$Ew!%^^d`ZOvh5gaUauzf}f@oR*tQ zC`OdOINxPIYo}*N(pH5veiTpMyud;cU6q0KHg$C;k(GXe3a=WVLRa50r{dbTA)i`O z$j(#8Q3%&1Q&`uAAeuwYGm7(VrOlgkZ3=1jcLx)-%qF{tR=l}(EY&zKD*WYG3h`-I z)1s7t{Dp-U^9!RX2Lp8+9Zc;$jp_g?uaN^HxL_6qa6t%tIob z#j)K$0s4|V7Og2SshlN3@33&Ufl@?-Vql+qn#R^7%xQ;JT-J_maxArUSx)S6N+A5zqfj zrn~;r%FTr)VQSa7|3)>dfAzYlxeAFil^T2pCrz;+X9`uaJq?SqUZZsL)Nl&po?!ZD zkY}_Ul#7S2a8Cw>a%cvf`T3p_)s{($cq}ZG{enox9U*jJh`xiD)8pago|VnQ!CX8>-3|X@c>;ftg%)O&VeGM7ShNr>mJG;=5vqgiqc*7 zalr!=pd==Wup?vmos%?K8m7xXmu@5JZB6W#N6|y@CaZqwAHCfU$@(Um;W!!|R9Ku+ zQ4w`(RaI^6rj+Q^n8X{Br%z6rc0-pnkL*MnIkSM8SyMn6JoOai@|%@#tMo!L@@s{( zoqGhC)yxh*<#9er8vmgX_Ss!T=fsR-hlb*@#(s~LOXd1tO68qvk(=_0$w+1V^jga1 z-qU0h4 z^`qr-hXGpoqEyRol~c8Roz?TvRkV_$YcXr&O7dlso%A${_tn#qmYt;G1EmziU%pO7 zyz>+Vh^Ml3ND^Z>e;3W-N7hgz7u1kmD<8Cw6IN3uzfy|mP|B#3&$L0SVVfz8l6h?n z6^bz>rs1Bi301tHhn8?uIWDf0i^~){b_MbAGVC~=sS$bN@8>CyTPrZxD@^fhUrAQB zI!U9=#IwrW_ekA^X{Fhh^0*+ng{t^;8|CwsUgV88_ajyGuE7?tqFjFA0OHkszx>l| z;{^p&C>3Jk<2C9PD&f;>aC>(ZoTFncZN+>TmMtG+X3Om`(Dm!+bGNsM51$C+i#BM@ zJ$u1fGSLe8^b-F3cFd=##z0#Qa`pLYY{9mkw(!=olq;53hH&M2+y|XD@Ru90ecMLb z0z2bT38F4;I={IIS}2uvUm|*s>BN{CZ|HmtzqN@r^O*xM1(a%bPdC_bMz$WIqXP|< z#gpr4y>#dzj=B$yCQS|j^WM%yyXZz?A8qEIY8d{ruSlBK$RiqPmE7$-E*M8aS{>9? z>h>S8yx0i)O-IKTkNxJ|0|$Tt^2Eu7q5S!Ftb2~!M+C>;k16p)Z;o#yopvjz2 zp@4>NhpXqQHZS+XBlExWw)Pg%iIYV}^xiCeCSTgkLX$Z2KA6kxP?*%*(nxa*8Thbv zqgSq1GQX5ccm7~L-%fGjr5AMAfP672^H|osLz$n7JR8#NMDbLebLS3J0NAm}ZR_YA zuvyYdDrVE_emw^Bh@G_F6SqqkYY#yEyZU}a8WcY9`)Wl}FQrM(^z+1C-Y$3=yd-bH zq*J)An)1c+b$(c?{P5S{QU3026T7lnXdU5s2$)&VW|DQ7Oy=yjio(Q0rM^&FJio-0 zD1&99oH9%+zX-ZrtMEH3bJU~Q3m%&*c5gGegM!LA=24PS?vBM{w+C=f8?31&j;wRo z+H5|30Pfu%TtU(tTRg!T-A3WueE^w4Mi|YIBkz{lDw6gKNBBwS=Ds8f#iryZ!m3MY z&B9qdQ~`gN89}^PCbwOH5w&tDo9Q~~_U@1lqjm0>V7@>h*sG1FoT5#avV(;Ygchoh zW86tJtmUtWDg<4vCx7*xrBJQ>L!bsfHWlQ_{AhU$qK(95FMewWO_Pzw?LFjsnUx_; z4DIh&TPtZ=TJg5oUo=rR6Jrwwmd(YKO*B z%kRqr-{1yRSpO2QbzV{UR$PUj=Y!{!l@#Dsk{VqKxt9`VV83twS`=kb{k16mUlc{W%MLET;>8#A|Fe=;bg4M} z{Q9>17pZ7-+fI;j#TRwgh$lx8eLCpfx%N@2{k0UzQrPv$S-NJ(Uz*xJ{{iLWfBk1| j=Sk=J8>6SM2bjTvKks__c0iAY7ko`cT}2mZZ}7hX;%8kY delta 7249 zcmeHMc~q2FmaqF!6h#ThQW8YO0zqjsED7zBxD<=V5E0zKX#s&CEeT+$B{2r2U@&70 z5~!EvrcI7ZB?mLMi8eK7>ZB(#A+R3Jk>1AdzY7#^2b37TD->v#k?9n8X zc6$Eke(>YI?=APed*8kH-S5M7)a*KH?#@cp40?$)7-pgx3|tx>9+uW1AO)yV)g3WD zdm24PZml6SvbW~mV+A@Q>5R|xb8Yaa7;Xo`P43j`- z18aZ?U^*}bhyuC+3>j|Lsnn;UE}KaN%)ryC-Z)|QT+}853jrB5A9NmI0u})wKr!$= zU=DCAUY2qK;4sG{_`X6`B?*l??R$vr5`AVS(sL%Dre2+Ne{h zOZf{t-wkX5HtT(vI(6zaSA8D*K&ZWC?bn@ANXF~{$Km0xI}G@PES>2e@h8jN6uWR#4rE()^2+=L@F+W!8^Qx zGxRayG=_WP!hRHjz`B&r_(%iS$ytb`_-^sf6 zdXu-GqW;1mGD$4-lDhcgLbDvG9ArR*J#U%2<>7L}+*9(^%UZT_PAM_FF{u}j#k7?M?}aHA z^0{+JdUkFARE z*R$C4{|AfpJZTdQW}pFBh9zUou-D$&Y7qH&R4p}s?;dHTbyF>W7u224HG zHnt6tnJTYLaXa%>{)zdj-I-?=|KFvbk{WWt0>pg}>MdF+g3{(Cs$f;N_{FVy@Z|l^ z(D%7Ig{st;BXhVXlg6_(pJEeRva@n>rf0P*tZvw}7QdSfKSa*3#V`w*!R-dMch^MY z41_?QKbKzg9M}5KAJBrH42n@tWlc3Mn4OpJ{drb4c`j-&lIw-qcNdXS0#(3Z@SoI+I6ZRaDtD@3}K>>i?ue z`!39ItBm6F4)M{Abes2Q7ZwtC7n4cZO5-@uL?83saM}}oMBkOrSpIw_6?3zN%2ifb znA&?T`8tzlapV{>@nAms>XvVSdKS~x{g z==1vQ=T&ZLYhN;HJR^i=K!M$tw;W!hPZpZtpB$3r&vyTbdrY)mRwz`-S}d2E=+M{6 zR>&KRX_lxV^mTpR*ZJ&BTJE!t!)C(&MQ;?E8rbFGSn1fS??7mhzk}oAXa@uxd-Ybo zg)+MMyoDYOmrO~D&VZt?ts=_rnO|2Njpeap zDCDxqmj0nS@ll>5V+TUsninw zo73B-)-=jhhSHl(?fgh`~??w(Xo- zPSu>ap5nP`4Vi=G&Ad<=r*UNk*@ADw^KW@y9r={wWTY}*NQ6kW{B|Q%s|vS;Kl>?d zrDk5*MQeE9T#DtAG6c`)ZM1?1hbc_$J8r>*`}y=P3^;x_S!oqV^`L%qH7<#gACQ@? zEmW%}uC-y@B>wbXS}T1vYEhq`S$$<^T)3L**wI5)b!52-V<+-~4OGShYskoH+C|0!(U2>BB$Af8r9>-gg})Ibh?do`7*vLD5P&0YL?J!HZ9P>H-@ zZW&oOF*sk8F~Tc?zZimik5$1Y-)W}XRO_dr3kSdOJ}p&6T?u%waOO_>p*p!N0nCap z+ZoU=1b1@xL)hs+CnW^S2M&Fi3bOE<2ceebTwM#bKnS==EtKkzsmp~iXVj62wlkfD zyopXqqZod?j=tcWI=Y9paPE2>;i12TL&*{L)?*p4Dd%%NP-BH(-Ri@?j_qBClQGuQ zXD|@|sc-M5c&G^S{}nZh)M|B8Jfz5As>dnVAJ#cW#bLiK_;_-gq1=#aDR$j#^y)6}hEDVEsoH$XYc>74TrQV3W@oL>S; zA7$0gwj-rESrZ09<-=4ZHddr|-x~?R*6_{uQJdIdB`v;s$vDcxK)?B4*@7`xKGxhL zBbSS$ME)}tv*3spoQLfJYQ{N;V{qgHNC}!`Y&8@VEe^Vi+qc1U;nxlXX!N9-7tWY@ z^X%N&Ic#1`v-pF<@Qvax;qeb1gdHxRsgYw>tli{XyuP}&prIk-Zij>4I!v~aF=MZO z(mI0Fn_Vfs#QoTY_wRNsApW?V7K&>GtePubFqrmwIoge)fl9yMioeHmNgFiZE(a=3 zX7g*(x2zp|-zRI6D0LWA$QU$4;CkY|;@h z-fDJigp676V)_TM5&l^`b%YxX8!&%6K3>8*IaCd5HgKw{O0h+ zCM%!Xh47$B<%SZb< zzIZem`VK?tKi?}Oj`inzon{ ze}oSjZ=Wl~)z*mcSr^F2BsV>|){OX^!)>`idLK_1q5MMydkLbaz zmE4V>wEq!YNr}UF>tEJ_Z_!70BFKGH*v1kYIQtVE`I|0ODkSV|zn z;t$7T?+!(#zOzKVT~vak)}M`jE7@1Fv4KjsHHxglxy~D)C{7qvQV@LTn=$ diff --git a/CcMainDll/CcMainDll/dllmain.cpp b/CcMainDll/CcMainDll/dllmain.cpp index 68774ec..36a90d1 100644 --- a/CcMainDll/CcMainDll/dllmain.cpp +++ b/CcMainDll/CcMainDll/dllmain.cpp @@ -373,37 +373,37 @@ inline DWORD calc_name_hash() enum LocalEnum { Nop, - PEAddress = 4, - pLoadLibraryA = 8, - pGetProcAddress = 0xC, - pVirtualAlloc = 0x10, - pVirtualProtect = 0x14, - pNtFlushInstructionCache = 0x18, - - varLocalFindPE = 0x1c, - varLocalFS30_A = 0x20, - varLocalFS30_B = 0x24, // varLocalFS30_B - IndexNum = 0x28, // FullDllName - BaseDllName = 0x2c, // FullDllName - name_hash = 0x30, - var_34 = 0x34, - NameHashResult = 0x38, // cmp_name_hash - var_3c = 0x3c, - exp_AddressOfNames = 0x40, - AddressOfNameOrdinals = 0x44, - lpflOldProtect = 0x48, // VirtualProtect的四个参数 保存老的保护方式 - var_4c = 0x4c, - var_50 = 0x50, - var_54 = 0x54, - var_58 = 0x58, - var_5c = 0x5c, - var_60 = 0x60, - var_64 = 0x64, - module_handle = 0x68, - address = 0x6c, - var_70 = 0x70, - EntryPoint = 0x74, // 入口点 - NewMemAddress = 0x78 // 申请用来展开PE的内存地址 + PEAddress = -4, + pLoadLibraryA = -8, + pGetProcAddress = -0xC, + pVirtualAlloc = -0x10, + pVirtualProtect = -0x14, + pNtFlushInstructionCache = -0x18, + + varLocalFindPE = -0x1c, + varLocalFS30_A = -0x20, + varLocalFS30_B = -0x24, // varLocalFS30_B + IndexNum = -0x28, // FullDllName + BaseDllName = -0x2c, // FullDllName + name_hash = -0x30, + var_34 = -0x34, + NameHashResult = -0x38, // cmp_name_hash + var_3c = -0x3c, + exp_AddressOfNames = -0x40, + AddressOfNameOrdinals = -0x44, + lpflOldProtect = -0x48, // VirtualProtect的四个参数 保存老的保护方式 + var_4c = -0x4c, + var_50 = -0x50, + var_54 = -0x54, + var_58 = -0x58, + var_5c = -0x5c, + var_60 = -0x60, + var_64 = -0x64, + module_handle = -0x68, + address = -0x6c, + var_70 = -0x70, + EntryPoint = -0x74, // 入口点 + NewMemAddress = -0x78 // 申请用来展开PE的内存地址 }; @@ -415,17 +415,16 @@ extern "C" __declspec(dllexport) void ReflectiveLoader() push ebp mov ebp, esp sub esp, 0x100 // 抬高堆栈创建局部变量空间 - mov eax, 4 + mov eax, 0 initLocalVar: // 循环initLocalVar初始化局部变量空间为0 - mov [ebp + eax], 0 + mov [esp + eax], 0 inc eax - cmp eax ,0x100 + cmp eax ,0xFC jnz initLocalVar call GetCurrentPositionAddress // 获取当前位置地址 mov eax, buffer mov [ebp + PEAddress], eax // 保存当前代码所在的地址 PEAddress - addressAdd : mov eax, 1 test eax, eax // 判断eax是否获取到当前地址 diff --git a/bin/server/CcMainDll.dll b/bin/server/CcMainDll.dll index d74e307b8dd5044ae5babf95a9732e9f021e649a..03e37bbd77901fcfbe9fb3187f3a660944512dc2 100644 GIT binary patch delta 1960 zcmaJ?Uu;uV9KP+nk}_IuAq5E#ojMXC3G(2B;xITpSO~|gbLRymYGN83_@K7QG+euS zoc3@w#4zI?&`iTaB^U-abZAYwvcMoUxsX0ArqN-h>7_i7u$W1z*YDh}0xxdaa{Bw7 z-@otsey0Pq&_FFT-tP1J_kZ`Wul7w!!_Ni7(6(=D;FO%Nz2&;@SFaw>!-6y>e6S4` z6VFT9F!L+Yx9J|-*(^yzMmq(ahJEeThzOL2cN1$%kZd zNoL}_=8Fq5W1gimgO`%0(<#e-sj#ch9NdCYC9BFV%snfqYDILpJ& zwe<^9l(eY4E8vu*jJtZYT__tq&gxwqf)vgH4^6dgo@FzGSIxs^)w>Fv)dR8GW32(E zQ)z4Z@C(atB-Y_@q7gcnScyaLCi=#b@2w1mG7 zhj)k9cwSh#mIyK~>A0XLB^&40A>46pozxQVsnRr~tEH(Zp{mMQ8zgF?p5@kYEx806 zA;@uVjj1!u3OXiPR_h%k#)l)H#C|G+w<&i0CluqwjaW)Y zJqPC$hm+T^0=ec2RJ`zvS^=z}&HIDc+`1{~{U1$$h!Ajl}3s%b!$MRrLty4o)c zQsqw~) z0;niLk0_GVBU<6s5yWowUaRcUAII0Gvhhd4X8y9$gwdvxk#nwz#0=&(Gk-}9Wwbee zC~`7HAvw>X-sQ*?Ip*lBN+W)mYD znvv5eY~~|j{mMOU;sHTq#D^)poy|Jm;zjkuX6sRGv+ca83@qnK4niL4)9~xMtTs$1 zVtwtBjrB-!yxV0rV8;$*pnz5CmH|GX-XTebsOlsoiFM-A>@2+1tHm;BtS^@X6JzCd7sYAX%Rv7C78&< zvi+1~y3t(QxW)G3&UQ(4na>Co<4!F5%EJvOMv&*=dTGTpOBYs5(pY1(Kyf$NU5!}o z1_aZ)C-%z+Ok@;RT++DAhee&mCBBSB1x?I531YnYS&$IP60(>SR!Y)DS>_XE!IBrK ziX_r9Cp$mi@jU*mE~qJK$~Yb3e?Na{owRTaN@gxj1%45h*D-VPvHS<+;g zcLHTWlg4S5T)0#{S#LPzvuF3r8Ve>yl~zKIVeYu}+tP{|VWpQsDEs0?IMa){p_-ss z$+Bo#TMMV8Y24NFaiMJZ8rQ}Wg67UBTvgk~X)C#K)j0B<>RpA#wNSCMeK0_MwBd{% zd3wzs_C_3z-5x$rXOA%mR3ep z4+M_Zmh5eETZ5GRDFMHJ_p_(kEA;0*R!*_Tg*8nFcX6KTQt?IAy($S=@&;t$Hmc zgq8D!cbBNw=g@>dUZL~n?LPSmx}~9sXR41Qw;vf33IyO2!YGUSVZb%G0~HRC7`aCX z^(4sTE#0Rt$J;^F?!L>N5V51&2@`t_cOt|Nac6|s!7h+XNWhkGr~dIgY3bMmZ7d_` z#H?N+5U6AmvRG)e30c-AXNhM)O*Kg;WPS=!2=GM>5t+DYG>i2poQo5Y5#I~T*h)bQ zk`)A-l2(D=fN%@knIiUUsx+%mG__wCB*7m;$gw(NxKkqb z3+Pe?x8Uo%y-%`=v?~9*ewDlHSJCn@Y(g)A=P44>+n$K{5_rSk82E4>Gl@tSlYU*;=7 zYft7#p5iqfLw>AY7KQFTcq#i^uN%x&pKUPNJ|8I5RH?rU=y z3CkiHz?A;ZmfSD#qWWSpwLG@jbYD^iYr>Ztglx|e{CS==vdHqq*|@Z3CMBINcvcj4 z>_80)h^kvU_<(wCNp1PtzH{gJ_^G$YPX(Ier-I+?-EnQJ^Bh1R_?040;-hcUh`wG^ zCNl7aagO4XhcEx1@55cg+6MgYHunx|$3w=2A3wOW>R|r!70p8Q(ecsd$a?Lk-GN7% KH>b7X2mb})p{fx8