今天调我汇编写的老傻子
C:\Users\Jacky\Downloads\nasm-3.01-win64\nasm-3.01>nasm -f win64 sys.asm -o no.obj
C:\Users\Jacky\Downloads\nasm-3.01-win64\nasm-3.01>sys.exe
啥实力连个屁都蹦不出来
请出windbg
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
ModLoad: 00000000`00400000 00000000`00414000 C:\Users\Jacky\Downloads\nasm-3.01-win64\nasm-3.01\kernel32.exe
ModLoad: 00007ffe`23f60000 00007ffe`241c6000 ntdll.dll
ModLoad: 00000000`00530000 00000000`005f9000 C:\WINDOWS\System32\KERNEL32.DLL
ModLoad: 00000000`00600000 00000000`009fe000 C:\WINDOWS\System32\KERNELBASE.dll
(4c78.5720): Break instruction exception - code 80000003 (first chance)
ntdll!LdrpDoDebuggerBreak+0x35:
00007ffe`2407d7bd cc int 3
也是来到first chance了
熟悉的int 3
没事，日常了
先找入口点
输入bp $exentry
0:000> g
Breakpoint 1 hit
exe+0x1000: 00000000`00401000 e8fe010000 call kernel32+0x1203 (00000000`00401203)
老傻子的入口点找到了
Breakpoint 1 hit
syscall_kernel32+0x1000:
00000000`00401000 e8fe010000 call syscall_kernel32+0x1203 (00000000`00401203)
0:000> p
syscall_kernel32+0x1005:
00000000`00401005 4885c0 test rax,rax
0:000> p
syscall_kernel32+0x1008:
00000000`00401008 0f84bb010000 je syscall_kernel32+0x11c9 (00000000`004011c9) [br=0]
0:000> p
syscall_kernel32+0x100e:
00000000`0040100e 4889c3 mov rbx,rax
0:000> p
syscall_kernel32+0x1011:
00000000`00401011 488d0d17200000 lea rcx,[syscall_kernel32+0x302f (00000000`0040302f)]
0:000> p
syscall_kernel32+0x1018:
00000000`00401018 4889da mov rdx,rbx
0:000> p
syscall_kernel32+0x101b:
00000000`0040101b e88e020000 call syscall_kernel32+0x12ae (00000000`004012ae)
0:000> r rax
rax=00007ffe23f60000
对了老傻子凭借盲人摸象的本灵找到ntdll地址了
我们祝贺老傻子
依旧单步执行（instruction:p）
0:000> p
(4c78.5720): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
syscall_kernel32+0x1301:
00000000`00401301 438b0496 mov eax,dword ptr [r14+r10*4] ds:001c40da`2411998c=????????
我真的服了，怎么内存访问违规了
这个18码的东西刚被我肯定，就自爆了
先看看附近的指令
0:000> u 0x00401301-5 L10
syscall_kernel32+0x12fc:
00000000`004012fc 4539da cmp r10d,r11d
00000000`004012ff 7d2e jge syscall_kernel32+0x132f (00000000`0040132f)
00000000`00401301 438b0496 mov eax,dword ptr [r14+r10*4]
00000000`00401305 4801d8 add rax,rbx
00000000`00401308 4889c7 mov rdi,rax
00000000`0040130b 4889f9 mov rcx,rdi
00000000`0040130e 4889f2 mov rdx,rsi
00000000`00401311 e85affffff call syscall_kernel32+0x1270 (00000000`00401270)
00000000`00401316 4885c0 test rax,rax
00000000`00401319 7405 je syscall_kernel32+0x1320 (00000000`00401320)
00000000`0040131b 41ffc2 inc r10d
00000000`0040131e ebdc jmp syscall_kernel32+0x12fc (00000000`004012fc)
00000000`00401320 430fb70457 movzx eax,word ptr [r15+r10*2]
00000000`00401325 418b448500 mov eax,dword ptr [r13+rax*4]
00000000`0040132a 4801d8 add rax,rbx
00000000`0040132d eb03 jmp syscall_kernel32+0x1332 (00000000`00401332)
看看寄存器给了我们什么线索
0:000> r r14,r10,r11,rbp
r14=001c40da2411998c r10=0000000000000000 r11=00000000000009d4 rbp=00007ffe24117210
r14 = 0x001c40da2411998c？ 这不是垃圾么，什么玩意拉了一坨大的塞给了r14
现在看看rbp是正常的么
0:000> dd rbp L0x30
00007ffe`24117210 00000000 ba65e4a2 00000000 001bd484
00007ffe`24117220 00000008 000009d5 000009d4 001b7238
00007ffe`24117230 001b998c 001bc0dc 0008c740 00117d20
00007ffe`24117240 00117e20 00117f10 0010af20 000d76c0
00007ffe`24117250 00134a90 00134ab0 000dfff0 000dffb0
00007ffe`24117260 000d6d50 000ed7f0 000dff50 00105690
00007ffe`24117270 001071d0 000dd9d0 0010e0c0 0010e6d0
00007ffe`24117280 000ddc50 0015c6e0 000ea6d0 000ec180
00007ffe`24117290 0015c710 000240c0 00024390 00023800
00007ffe`241172a0 00023e50 00023f80 0012ff00 000241c0
00007ffe`241172b0 00023b90 00024190 0010f770 00106e30
00007ffe`241172c0 0015c740 0012ff30 0011ed10 0000f790
0:000> dd rbp+0x20 L1
00007ffe`24117230 001b998c
再看看老傻子的rbp的内存
0:000> dd rbp L0x40
00007ffe`24117210 00000000 ba65e4a2 00000000 001bd484
00007ffe`24117220 00000008 000009d5 000009d4 001b7238
00007ffe`24117230 001b998c 001bc0dc 0008c740 00117d20
00007ffe`24117240 00117e20 00117f10 0010af20 000d76c0
00007ffe`24117250 00134a90 00134ab0 000dfff0 000dffb0
00007ffe`24117260 000d6d50 000ed7f0 000dff50 00105690
00007ffe`24117270 001071d0 000dd9d0 0010e0c0 0010e6d0
00007ffe`24117280 000ddc50 0015c6e0 000ea6d0 000ec180
00007ffe`24117290 0015c710 000240c0 00024390 00023800
00007ffe`241172a0 00023e50 00023f80 0012ff00 000241c0
00007ffe`241172b0 00023b90 00024190 0010f770 00106e30
00007ffe`241172c0 0015c740 0012ff30 0011ed10 0000f790
00007ffe`241172d0 00074670 00134af0 00134b40 00134b90
00007ffe`241172e0 00134ba0 00112e30 0010b7d0 0010de80
00007ffe`241172f0 001127c0 00130c20 00130c80 00130ca0
00007ffe`24117300 00130df0 00130e50 00130e70 00109b50
rbp = 00007ffe24117210是导出表的基址
[rbp+0x20]是AddressOfNames RVA，它的值001b998c
让我计算一下，嗯？mov r14, [rbp + 0x20]不应该要加add r14, rbx了
我忘加rbx寄存器了，估计rdi赋给r14了，不是正确的RVA + 基址
让我看看我的代码
不对呀我加了，咋回事，依旧汇编里经常出现的灵异事件
估计是错误的加载大小
我们改一下
当然验证ROR13哈希正不正确（别信其他人的）
NtQuerySystemInformation: 0xE4E1CAD6
NtTerminateProcess: 0x7929BBF3
ok
C:\Users\Jacky\Downloads\nasm-3.01-win64\nasm-3.01>peb_syscall.exe
C:\Users\Jacky\Downloads\nasm-3.01-win64\nasm-3.01>
这玩意屁又没蹦出来
又回来了
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
ModLoad: 00000000`00400000 00000000`00414000 C:\Users\Jacky\Downloads\nasm-3.01-win64\nasm-3.01\peb_syscall.exe
ModLoad: 00007ffe`23f60000 00007ffe`241c6000 ntdll.dll
ModLoad: 00000000`005d0000 00000000`00699000 C:\WINDOWS\System32\KERNEL32.DLL
ModLoad: 00000000`006a0000 00000000`00a9e000 C:\WINDOWS\System32\KERNELBASE.dll
(2a98.5298): Break instruction exception - code 80000003 (first chance)
ntdll!LdrpDoDebuggerBreak+0x35:
00007ffe`2407d7bd cc int 3
0:000> lm m ntdll
Browse full module list
start end module name
00007ffe`23f60000 00007ffe`241c6000 ntdll (pdb symbols) C:\ProgramData\Dbg\sym\ntdll.pdb\1806222313D4104266A4820B86925E3B1\ntdll.pdb
0:000> lm m kernel32
Browse full module list
start end module name
00000000`005d0000 00000000`00699000 KERNEL32 (pdb symbols) C:\ProgramData\Dbg\sym\kernel32.pdb\2554A4D7DED55C1D6F033011500EA7811\kernel32.pdb
大家帮我监督一下
0:000> r rax
rax=00007ffe23f60000
ok获取的是ntdll地址，嗯
0:000> p
(2a98.5298): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
peb_syscall+0x1305:
00000000`00401305 438b0496 mov eax,dword ptr [r14+r10*4] ds:001c40da`2411998c=????????
又来
我真服了
