反逆向工程揭密（试炼篇）


IT资讯	系统天下	网盟学院


硬件DIY	软件下载	网络安全

您现在的位置： ChinaBeta.cn 中文IT资讯 >> 网盟学院 >> 编程类 >> 其它编程程序 >> 网管技术正文

	让我穿过那道"墙"! 畅游网络应…		主动防御！瑞星杀毒2008抢先评…
	速度超快 Discuz! 6.0.0试用手…		奇虎举证:各杀毒软件均报CNNIC…
	Google Earth 4.2加入繁体中文…		专业防护！瑞星防火墙2008测试…
	挂载RAR文件从认识到爱上WinM…		让你冲浪随心所欲如何访问被封…
	轻装上阵！江民杀毒软件2008速…		VMware Fusion苹果版全程图解(…
	VMware Fusion苹果版全程图解(…		从菜鸟出发!征服高清详细评测全…
	VS2008和ASP.NET 3.5使用之初体…		[多图]Ubuntu 7.04 初体验
	东风吹战鼓擂下载软件你选谁?		若隐若现 Windows XP DirectX …
	GPRS上网全攻略		主流杀毒软件Vista兼容性横评
	基于IRF的网络管理和业务管理解…		83个美丽的Wordpress主题
	软交换网络中的关键路由技术详…		不只是换肤?Windows Mobile 6 …
	css教程–十步学会用css建站(全…		巧妙设置路由预防网络频繁掉线
	打造网络管理七大绝技		CorelDRAW X3 Service Pack 2 …
	重温经典:回归 Live Messenger…		Oracle数据库补丁分类、安装及…

反逆向工程揭密（试炼篇）

Www.ChinaBeta.Cn 更新时间：2006-7-25 阅读次数：

【ChinaBeta.Cn 网盟学院】

The BPX protection has a few weaknesses. I only check for four bytes at API entry point, which can be easily bypassed, if the API has many instructions. One could put a breakpoint to the first instruction after the 4 bytes boundary.A Better check would use a Length Disassembler Engine (LDE) which tells us the size of the instructions. With this, we can safely scan a lot of instructions without triggering any false positive.

BPX保护有一些缺点。仅仅校验API入口点4个字节的方法很容易被绕过。只要在这4个字节后的第一个指令处下断点即可。更好的校验是分析指令长度的Length Disassembler Engine(LDE)技术。这项技术可以使程序正确地执行校验指令并避免错误的解码指令位置。

A genuine instruction can contain the byte 0xCC and yet not beeing a breakpoint. Eg: Mov eax, 0x4010CC. The detection would trigger a false positive on this instruction, because of the 0xCC inside of it. On the other hand, a LDE would tell us the size of this instruction (5 Bytes). An int 3 (breakpoint) is either one or two bytes (0xCC or 0xCD 0x03). We would therefore skip the current instruction and check the following one.

有些的指令不是断点，但仍然包含0xCC。例如：Mov eax, 0x4010CC。此处会造成错误的校验，因为含有0xCC。而LDE却不同，它会校验这些指令的长度（5个字节）。而INT3断点只有一个或2个（0xCC or 0xCD 0x03）。因此我们可以跳过这种指令而校验后面的指令。

Also, the BPX check is only done once per API at a given location in the binary.Once we have stepped over those checks , we can put a breakpoint on any API function without triggering any error. This weakness wasn't fixed on purpose because this is a common error in Protection Systems.There is another kind of BPX detection that will be described in the next section

另外BPX校验对每个API只进行一次校验。因此我们可以在跳过了检验之后再设置断点并不引发任何任务。由于这只是保护系统中的一个普通错误，下一节将介绍另一种BPX侦测方式。

? The Crazy Layers
Here is a little more challenging protection. In order to protect the binary from beeing disassembled, i have written an Encryption Layer generator, that will generate the number of layers i want. For this binary, i used 175 layers. The Layer Generator has many options.
Here are the options from the config file: (0 means disabled)
SEH=1
RANDOM_LAYER_SIZE=0
RANDOM_REGISTERS=1
RANDOM_ENCRYPTION=0
ENCRYPTED_RETURN_ADDRESS=1
TIMING_DETECTION=1
RANDOM_CONSTANT=0
JUNKS=0
PUSHAD_POPAD=1
RANDOM_ORDER=0
USE_DIFFERENT_LOOP_CODE=0
RANDOM_FIRST_BLOCK=0
NUMBER=175
I will comment each options below:
SEH:
This tells to my layer generator to use (or not) SEH inside the layers.

繁多的Layers:
这是一个更具有挑战性的保护机制。为了防止反汇编代码，我写了一段Encryption Layer的生成器，会生成我需要的layer的数量。在这个应用程序中，我使用了175个这样的layer.生成器包含许多选项。下面是从配置文件中得到的：（0表示禁用）
SEH=1
RANDOM_LAYER_SIZE=0
RANDOM_REGISTERS=1
RANDOM_ENCRYPTION=0
ENCRYPTED_RETURN_ADDRESS=1
TIMING_DETECTION=1
RANDOM_CONSTANT=0
JUNKS=0
PUSHAD_POPAD=1
RANDOM_ORDER=0
USE_DIFFERENT_LOOP_CODE=0
RANDOM_FIRST_BLOCK=0
NUMBER=175
下面一一解释这些选项：
SEH：
这个选项表示是否将在layers中使用SEH。

RANDOM LAYER SIZE:
This tells to my layer generator to use a different size for each layer. This option wasn't enabled to simplify the analysis.
RANDOM REGISTERS:
If this option is enabled, all the layers are using different registers. Some kind of "polymorphism". This option was enabled.
RANDOM ENCRYPTION:
When this option is enabled, Each layer will have a different encryption algorithm. I didn't enable this option. Therefore all
the layers have a static encryption code. (Default layer)
ENCRYPTED RETURN ADDRESS
This option will encrypt the return address inside the layer. It avoids a simple patch to skip the SEH.This option was enabled
RANDOM LAYER SIZE:
加密器对每个Layer使用不同的大小。此选项不能使分析简单化。
RANDOM REGISTERS:
如果此选项打开，所有的Layers将会使用不同的寄存器。即呈现多态性。此选项是打开的。
RANDOM ENCRYPTION:
当此选项打开时，每个Layer都具有不同的加密运算法则。我禁用了它。因此，所有的Layers都有静态的加密过的代码(默认layer)。
ENCRYPTED RETURN ADDRESS：
此选项将对Layer中的返回地址进行加密，避免了仅仅简单的patch来绕过SEH情况的发生。此选项为打开。

TIMING_DETECTION:
Tells whether the layers must use Timing Detection or not. I enabled this option.
RANDOM_CONSTANT:
The Random constant is to tell whether we want to use a static value for the timing detection or not. This option wasn't enable.
All layers were using the defaut value: E0000h. Enabling this option will also modify the code that checks for the Difference between both TSC.
JUNKS:
Enable of Disable Junks in the Layers. I disabled this option because the layers are WAY biggers when it is enabled. The resulting binary is too huge and slow if you use a big number of layers.
PUSHAD_POPAD:
This option tells the Layer Generator to use (or not) Pushad/Popad around the Junk Code. The layer generator directly use the Thrash
Generator (external tool) i have programmed. I was using pushad popad in the junk code, that's why it is enabled. This option does nothing
if the Junks option is disabled.
TIMING_DETECTION:
是否Layers使用时间侦测技术。我打开了这个选项。
RANDOM_CONSTANT:
此选项表明是否在时间侦测中使用静态数值。此选项禁用，所有Layer使用默认值E0000H。打开它就是修改了两个TSC的差距值的上限。
JUNKS:
是否在layer中启用垃圾代码。Layer中的垃圾代码。因为选项打开后Layer将变的冗长，代码也随之变的巨大，运行将变的缓慢。
PUSHAD_POPAD:
此选项决定加密器是否在垃圾代码中使用PUSHAD/POPAD格式。我的加密器是直接使用Thrash Generator（外国的工具）。在代码中我使用了上面的格式，因此选项是打开的。但如果JUNKS选项被禁止，此选项即被屏蔽。

上一页 [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] 下一页