金盾2017S视频播放器机器码的简单分析

brack · 发表于 2014-5-9 00:03

本帖最后由 brack 于 2014-5-10 11:37 编辑

仅供小菜娱乐！高手莫要见笑！

【文章标题】:金盾2017S视频播放器机器码的简单分析
【文章作者】: brack
【作者邮箱】: 不详
【作者主页】: 无
【作者QQ号】: 无
【软件名称】:金盾2017S视频播放器
【下载地址】: http://www.baidu.com
【加壳方式】: 无
【使用工具】:OD
【软件介绍】:没什么好介绍的...
【作者声明】: 分析的有不对的地方还请大牛指出改正.
----------------------------------------------------------------------------------------------------------------------------

获取机器码CALL:

[Asm] 纯文本查看 复制代码

00891948    55              push ebp                                         ; 机器码CALL
00891949    8BEC            mov ebp,esp
0089194B    B9 0A000000     mov ecx,0xA
00891950    6A 00           push 0x0
00891952    6A 00           push 0x0
00891954    49              dec ecx
00891955  ^ 75 F9           jnz short 金盾2017.00891950
00891957    53              push ebx
00891958    56              push esi
00891959    57              push edi
0089195A    8945 F8         mov dword ptr ss:[ebp-0x8],eax
0089195D    33C0            xor eax,eax
0089195F    55              push ebp
00891960    68 6A1C8900     push 金盾2017.00891C6A
00891965    64:FF30         push dword ptr fs:[eax]
00891968    64:8920         mov dword ptr fs:[eax],esp
0089196B    33C0            xor eax,eax
0089196D    55              push ebp                                         ; 生成机器码的第一个字符串过程  ↓
0089196E    68 E3198900     push 金盾2017.008919E3
00891973    64:FF30         push dword ptr fs:[eax]
00891976    64:8920         mov dword ptr fs:[eax],esp
00891979    A1 CC028C00     mov eax,dword ptr ds:[0x8C02CC]
0089197E    8B00            mov eax,dword ptr ds:[eax]
00891980    BA 841C8900     mov edx,金盾2017.00891C84                          ; 1
00891985    E8 129BB7FF     call 金盾2017.0040B49C
0089198A    75 40           jnz short 金盾2017.008919CC
0089198C    8D45 E8         lea eax,dword ptr ss:[ebp-0x18]
0089198F    E8 44E7FFFF     call 金盾2017.008900D8                             ; 获取信息call  ①
00891994    8B55 E8         mov edx,dword ptr ss:[ebp-0x18]
00891997    8D45 EC         lea eax,dword ptr ss:[ebp-0x14]
0089199A    B9 00000000     mov ecx,0x0
0089199F    E8 E494B7FF     call 金盾2017.0040AE88
008919A4    8B45 EC         mov eax,dword ptr ss:[ebp-0x14]
008919A7    8D55 F0         lea edx,dword ptr ss:[ebp-0x10]
008919AA    E8 3DA5EDFF     call 金盾2017.0076BEEC                             ; MD5加密
008919AF    8B45 F0         mov eax,dword ptr ss:[ebp-0x10]                  ; ebp-10存放的就是MD5的值
008919B2    8D4D F4         lea ecx,dword ptr ss:[ebp-0xC]
008919B5    BA 05000000     mov edx,0x5
008919BA    E8 A986BAFF     call 金盾2017.0043A068                             ; 取MD5前5位
008919BF    8B55 F4         mov edx,dword ptr ss:[ebp-0xC]                   ; ebp - c 里面是取完后的字符串
008919C2    8D45 FC         lea eax,dword ptr ss:[ebp-0x4]
008919C5    E8 0698B7FF     call 金盾2017.0040B1D0
008919CA    EB 0D           jmp short 金盾2017.008919D9
008919CC    8D45 FC         lea eax,dword ptr ss:[ebp-0x4]
008919CF    BA 941C8900     mov edx,金盾2017.00891C94                          ; 00000
008919D4    E8 538DB7FF     call 金盾2017.0040A72C
008919D9    33C0            xor eax,eax
008919DB    5A              pop edx
008919DC    59              pop ecx
008919DD    59              pop ecx
008919DE    64:8910         mov dword ptr fs:[eax],edx
008919E1    EB 17           jmp short 金盾2017.008919FA
008919E3  ^ E9 547CB7FF     jmp 金盾2017.0040963C
008919E8    8D45 FC         lea eax,dword ptr ss:[ebp-0x4]
008919EB    BA 941C8900     mov edx,金盾2017.00891C94                          ; 00000
008919F0    E8 378DB7FF     call 金盾2017.0040A72C
008919F5    E8 9A80B7FF     call 金盾2017.00409A94
008919FA    33C0            xor eax,eax

获取信息call ①里面的流程:

[Asm] 纯文本查看 复制代码
008900D8 55 push ebp 008900D9 8BEC mov ebp,esp 008900DB 81C4 10F8FFFF add esp,-0x7F0 008900E1 33D2 xor edx,edx 008900E3 8995 10F8FFFF mov dword ptr ss:[ebp-0x7F0],edx 008900E9 8995 28F8FFFF mov dword ptr ss:[ebp-0x7D8],edx 008900EF 8995 24F8FFFF mov dword ptr ss:[ebp-0x7DC],edx 008900F5 8985 20F8FFFF mov dword ptr ss:[ebp-0x7E0],eax 008900FB 33C0 xor eax,eax 008900FD 55 push ebp 008900FE 68 1D028900 push 金盾2017.0089021D 00890103 64:FF30 push dword ptr fs:[eax] 00890106 64:8920 mov dword ptr fs:[eax],esp 00890109 8D95 24F8FFFF lea edx,dword ptr ss:[ebp-0x7DC] 0089010F B8 34028900 mov eax,金盾2017.00890234 ; F963D130E302F024ED66C627F711EB31C56BCC3AC810FB32C567CE 00890114 E8 1BFEFFFF call 金盾2017.0088FF34 ; 上面这个加密没来得及看不过跟机器码无关 00890119 8D85 28F8FFFF lea eax,dword ptr ss:[ebp-0x7D8] 0089011F E8 E0A1B7FF call 金盾2017.0040A304 00890124 8D85 1CF8FFFF lea eax,dword ptr ss:[ebp-0x7E4] 0089012A 50 push eax 0089012B 68 19000200 push 0x20019 00890130 6A 00 push 0x0 00890132 8B85 24F8FFFF mov eax,dword ptr ss:[ebp-0x7DC] 00890138 E8 BBAFB7FF call 金盾2017.0040B0F8 0089013D 50 push eax 0089013E 68 02000080 push 0x80000002 00890143 E8 4444B8FF call 金盾2017.0041458C ; jmp 到 advapi32.RegOpenKeyExW 00890148 85C0 test eax,eax ; 打开HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System 0089014A 0F85 93000000 jnz 金盾2017.008901E3 00890150 33D2 xor edx,edx 00890152 55 push ebp 00890153 68 DC018900 push 金盾2017.008901DC 00890158 64:FF32 push dword ptr fs:[edx] 0089015B 64:8922 mov dword ptr fs:[edx],esp 0089015E B8 D2070000 mov eax,0x7D2 00890163 8985 14F8FFFF mov dword ptr ss:[ebp-0x7EC],eax 00890169 C785 18F8FFFF 0>mov dword ptr ss:[ebp-0x7E8],0x7 00890173 8D85 14F8FFFF lea eax,dword ptr ss:[ebp-0x7EC] 00890179 50 push eax 0089017A 8D85 2EF8FFFF lea eax,dword ptr ss:[ebp-0x7D2] 00890180 50 push eax 00890181 8D85 18F8FFFF lea eax,dword ptr ss:[ebp-0x7E8] 00890187 50 push eax 00890188 6A 00 push 0x0 0089018A 8D95 10F8FFFF lea edx,dword ptr ss:[ebp-0x7F0] 00890190 B8 B0028900 mov eax,金盾2017.008902B0 ; E27BD020F10EC028DE71F531E610EB2EDF 00890195 E8 9AFDFFFF call 金盾2017.0088FF34 0089019A 8B85 10F8FFFF mov eax,dword ptr ss:[ebp-0x7F0] 008901A0 E8 53AFB7FF call 金盾2017.0040B0F8 008901A5 50 push eax 008901A6 8B85 1CF8FFFF mov eax,dword ptr ss:[ebp-0x7E4] 008901AC 50 push eax 008901AD E8 EA43B8FF call 金盾2017.0041459C ; jmp 到 advapi32.RegQueryValueExW 008901B2 85C0 test eax,eax ; 取已经打开的子健里面的值 UNICODE "SystemBiosVersion" 008901B4 75 0C jnz short 金盾2017.008901C2 008901B6 55 push ebp 008901B7 B8 04038900 mov eax,金盾2017.00890304 ; P1 008901BC E8 67FEFFFF call 金盾2017.00890028 008901C1 59 pop ecx 008901C2 33C0 xor eax,eax 008901C4 5A pop edx 008901C5 59 pop ecx 008901C6 59 pop ecx 008901C7 64:8910 mov dword ptr fs:[eax],edx 008901CA 68 E3018900 push 金盾2017.008901E3 008901CF 8B85 1CF8FFFF mov eax,dword ptr ss:[ebp-0x7E4] 008901D5 50 push eax 008901D6 E8 8143B8FF call 金盾2017.0041455C ; jmp 到 advapi32.RegCloseKey 008901DB C3 retn ; 关闭已打开的注册表 ↑

继续回到机器码CALL内往下:

[Asm] 纯文本查看 复制代码
008919FC 55 push ebp ; 获取第二个字符串过程 ↓ 008919FD 68 861A8900 push 金盾2017.00891A86 00891A02 64:FF30 push dword ptr fs:[eax] 00891A05 64:8920 mov dword ptr fs:[eax],esp 00891A08 A1 68FF8B00 mov eax,dword ptr ds:[0x8BFF68] 00891A0D 8B00 mov eax,dword ptr ds:[eax] 00891A0F BA 841C8900 mov edx,金盾2017.00891C84 ; 1 00891A14 E8 839AB7FF call 金盾2017.0040B49C 00891A19 75 54 jnz short 金盾2017.00891A6F 00891A1B FF75 FC push dword ptr ss:[ebp-0x4] 00891A1E 68 AC1C8900 push 金盾2017.00891CAC ; - 00891A23 E8 7CEFFFFF call 金盾2017.008909A4 ; 获取信息call ② 00891A28 8BD0 mov edx,eax 00891A2A 8D45 D8 lea eax,dword ptr ss:[ebp-0x28] 00891A2D B9 00000000 mov ecx,0x0 00891A32 E8 0D90B7FF call 金盾2017.0040AA44 00891A37 8B45 D8 mov eax,dword ptr ss:[ebp-0x28] 00891A3A 8D55 DC lea edx,dword ptr ss:[ebp-0x24] 00891A3D E8 AAA4EDFF call 金盾2017.0076BEEC ; MD5加密 00891A42 8B45 DC mov eax,dword ptr ss:[ebp-0x24] ; ebp-24就是MD5的存放地址 00891A45 8D4D E0 lea ecx,dword ptr ss:[ebp-0x20] 00891A48 BA 05000000 mov edx,0x5 00891A4D E8 1686BAFF call 金盾2017.0043A068 ; 取MD5前5位 00891A52 8B55 E0 mov edx,dword ptr ss:[ebp-0x20] ; ebp - 20 里面是取完后的字符串 00891A55 8D45 E4 lea eax,dword ptr ss:[ebp-0x1C] 00891A58 E8 7397B7FF call 金盾2017.0040B1D0 00891A5D FF75 E4 push dword ptr ss:[ebp-0x1C] 00891A60 8D45 FC lea eax,dword ptr ss:[ebp-0x4] 00891A63 BA 03000000 mov edx,0x3 00891A68 E8 7F99B7FF call 金盾2017.0040B3EC ; 把所存放的字符串与这次用 '-' 连接在一起 00891A6D EB 0D jmp short 金盾2017.00891A7C 00891A6F 8D45 FC lea eax,dword ptr ss:[ebp-0x4] 00891A72 BA BC1C8900 mov edx,金盾2017.00891CBC ; -00000 00891A77 E8 9098B7FF call 金盾2017.0040B30C 00891A7C 33C0 xor eax,eax 00891A7E 5A pop edx 00891A7F 59 pop ecx 00891A80 59 pop ecx 00891A81 64:8910 mov dword ptr fs:[eax],edx 00891A84 EB 17 jmp short 金盾2017.00891A9D 00891A86 ^ E9 B17BB7FF jmp 金盾2017.0040963C 00891A8B 8D45 FC lea eax,dword ptr ss:[ebp-0x4] 00891A8E BA BC1C8900 mov edx,金盾2017.00891CBC ; -00000 00891A93 E8 7498B7FF call 金盾2017.0040B30C 00891A98 E8 F77FB7FF call 金盾2017.00409A94 00891A9D 33C0 xor eax,eax

获取信息call ②:
[Asm] 纯文本查看 复制代码
008909A4 55 push ebp 008909A5 8BEC mov ebp,esp 008909A7 81C4 C4FDFFFF add esp,-0x23C 008909AD 53 push ebx 008909AE BB EC0A8900 mov ebx,金盾2017.00890AEC 008909B3 A1 28118C00 mov eax,dword ptr ds:[0x8C1128] 008909B8 8338 02 cmp dword ptr ds:[eax],0x2 008909BB 75 21 jnz short 金盾2017.008909DE 008909BD 6A 00 push 0x0 008909BF 6A 00 push 0x0 008909C1 6A 03 push 0x3 008909C3 6A 00 push 0x0 008909C5 6A 03 push 0x3 008909C7 68 000000C0 push 0xC0000000 008909CC 68 F00A8900 push 金盾2017.00890AF0 ; \\.\PhysicalDrive0 008909D1 E8 0E3CB8FF call 金盾2017.004145E4 ; jmp 到 kernel32.CreateFileW 008909D6 8985 ECFDFFFF mov dword ptr ss:[ebp-0x214],eax 008909DC EB 1C jmp short 金盾2017.008909FA 008909DE 6A 00 push 0x0 008909E0 6A 00 push 0x0 008909E2 6A 01 push 0x1 008909E4 6A 00 push 0x0 008909E6 6A 00 push 0x0 008909E8 6A 00 push 0x0 008909EA 68 180B8900 push 金盾2017.00890B18 ; \\.\SMARTVSD 008909EF E8 F03BB8FF call 金盾2017.004145E4 ; jmp 到 kernel32.CreateFileW 008909F4 8985 ECFDFFFF mov dword ptr ss:[ebp-0x214],eax ; 打开对象 008909FA 83BD ECFDFFFF F>cmp dword ptr ss:[ebp-0x214],-0x1 00890A01 0F84 DC000000 je 金盾2017.00890AE3 00890A07 33C0 xor eax,eax 00890A09 55 push ebp 00890A0A 68 BB0A8900 push 金盾2017.00890ABB 00890A0F 64:FF30 push dword ptr fs:[eax] 00890A12 64:8920 mov dword ptr fs:[eax],esp 00890A15 8D85 C7FDFFFF lea eax,dword ptr ss:[ebp-0x239] 00890A1B 33C9 xor ecx,ecx 00890A1D BA 20000000 mov edx,0x20 00890A22 E8 8168B7FF call 金盾2017.004072A8 00890A27 8D85 F0FDFFFF lea eax,dword ptr ss:[ebp-0x210] 00890A2D 33C9 xor ecx,ecx 00890A2F BA 10020000 mov edx,0x210 00890A34 E8 6F68B7FF call 金盾2017.004072A8 00890A39 33C0 xor eax,eax 00890A3B 8985 E8FDFFFF mov dword ptr ss:[ebp-0x218],eax 00890A41 C785 C7FDFFFF 0>mov dword ptr ss:[ebp-0x239],0x200 00890A4B C685 CCFDFFFF 0>mov byte ptr ss:[ebp-0x234],0x1 00890A52 C685 CDFDFFFF 0>mov byte ptr ss:[ebp-0x233],0x1 00890A59 C685 D0FDFFFF A>mov byte ptr ss:[ebp-0x230],0xA0 00890A60 C685 D1FDFFFF E>mov byte ptr ss:[ebp-0x22F],0xEC 00890A67 6A 00 push 0x0 00890A69 8D85 E8FDFFFF lea eax,dword ptr ss:[ebp-0x218] 00890A6F 50 push eax 00890A70 68 10020000 push 0x210 00890A75 8D85 F0FDFFFF lea eax,dword ptr ss:[ebp-0x210] 00890A7B 50 push eax 00890A7C 6A 20 push 0x20 00890A7E 8D85 C7FDFFFF lea eax,dword ptr ss:[ebp-0x239] 00890A84 50 push eax 00890A85 68 88C00700 push 0x7C088 00890A8A 8B85 ECFDFFFF mov eax,dword ptr ss:[ebp-0x214] 00890A90 50 push eax 00890A91 E8 9E3BB8FF call 金盾2017.00414634 ; jmp 到 kernel32.DeviceIoControl 00890A96 85C0 test eax,eax ; 发送控制代码直接到指定的设备驱动程序 00890A98 75 07 jnz short 金盾2017.00890AA1 00890A9A E8 2590B7FF call 金盾2017.00409AC4 00890A9F EB 42 jmp short 金盾2017.00890AE3 00890AA1 33C0 xor eax,eax 00890AA3 5A pop edx 00890AA4 59 pop ecx 00890AA5 59 pop ecx 00890AA6 64:8910 mov dword ptr fs:[eax],edx 00890AA9 68 C20A8900 push 金盾2017.00890AC2 00890AAE 8B85 ECFDFFFF mov eax,dword ptr ss:[ebp-0x214] 00890AB4 50 push eax 00890AB5 E8 F23AB8FF call 金盾2017.004145AC ; jmp 到 kernel32.CloseHandle 00890ABA C3 retn ; 关闭对象

继续回到机器码CALL内往下:

[Asm] 纯文本查看 复制代码
00891A9F 55 push ebp ; 获取第三个字符串过程 ↓ 00891AA0 68 2D1B8900 push 金盾2017.00891B2D 00891AA5 64:FF30 push dword ptr fs:[eax] 00891AA8 64:8920 mov dword ptr fs:[eax],esp 00891AAB A1 E4FF8B00 mov eax,dword ptr ds:[0x8BFFE4] 00891AB0 8B00 mov eax,dword ptr ds:[eax] 00891AB2 BA 841C8900 mov edx,金盾2017.00891C84 ; 1 00891AB7 E8 E099B7FF call 金盾2017.0040B49C 00891ABC 75 58 jnz short 金盾2017.00891B16 00891ABE FF75 FC push dword ptr ss:[ebp-0x4] 00891AC1 68 AC1C8900 push 金盾2017.00891CAC ; - 00891AC6 8D45 C4 lea eax,dword ptr ss:[ebp-0x3C] 00891AC9 E8 E2E9FFFF call 金盾2017.008904B0 ; 获取信息call ③ 00891ACE 8B55 C4 mov edx,dword ptr ss:[ebp-0x3C] 00891AD1 8D45 C8 lea eax,dword ptr ss:[ebp-0x38] 00891AD4 B9 00000000 mov ecx,0x0 00891AD9 E8 AA93B7FF call 金盾2017.0040AE88 00891ADE 8B45 C8 mov eax,dword ptr ss:[ebp-0x38] 00891AE1 8D55 CC lea edx,dword ptr ss:[ebp-0x34] 00891AE4 E8 03A4EDFF call 金盾2017.0076BEEC ; MD5加密 00891AE9 8B45 CC mov eax,dword ptr ss:[ebp-0x34] ; ebp-34就是MD5的存放地址 00891AEC 8D4D D0 lea ecx,dword ptr ss:[ebp-0x30] 00891AEF BA 05000000 mov edx,0x5 00891AF4 E8 6F85BAFF call 金盾2017.0043A068 ; 取前5位 00891AF9 8B55 D0 mov edx,dword ptr ss:[ebp-0x30] ; ebp - 30 里面是取完后的字符串 00891AFC 8D45 D4 lea eax,dword ptr ss:[ebp-0x2C] 00891AFF E8 CC96B7FF call 金盾2017.0040B1D0 00891B04 FF75 D4 push dword ptr ss:[ebp-0x2C] 00891B07 8D45 FC lea eax,dword ptr ss:[ebp-0x4] 00891B0A BA 03000000 mov edx,0x3 00891B0F E8 D898B7FF call 金盾2017.0040B3EC ; 把所存放的字符串与这次用 '-' 连接在一起 00891B14 EB 0D jmp short 金盾2017.00891B23 00891B16 8D45 FC lea eax,dword ptr ss:[ebp-0x4] 00891B19 BA BC1C8900 mov edx,金盾2017.00891CBC ; -00000 00891B1E E8 E997B7FF call 金盾2017.0040B30C 00891B23 33C0 xor eax,eax 00891B25 5A pop edx 00891B26 59 pop ecx 00891B27 59 pop ecx 00891B28 64:8910 mov dword ptr fs:[eax],edx 00891B2B EB 17 jmp short 金盾2017.00891B44 00891B2D ^ E9 0A7BB7FF jmp 金盾2017.0040963C 00891B32 8D45 FC lea eax,dword ptr ss:[ebp-0x4] 00891B35 BA BC1C8900 mov edx,金盾2017.00891CBC ; -00000 00891B3A E8 CD97B7FF call 金盾2017.0040B30C 00891B3F E8 507FB7FF call 金盾2017.00409A94 00891B44 33C0 xor eax,eax

获取信息call ③:
[Asm] 纯文本查看 复制代码
008904B0 55 push ebp 008904B1 8BEC mov ebp,esp 008904B3 81C4 0CF8FFFF add esp,-0x7F4 008904B9 53 push ebx 008904BA 33D2 xor edx,edx 008904BC 8995 0CF8FFFF mov dword ptr ss:[ebp-0x7F4],edx 008904C2 8995 10F8FFFF mov dword ptr ss:[ebp-0x7F0],edx 008904C8 8995 28F8FFFF mov dword ptr ss:[ebp-0x7D8],edx 008904CE 8995 24F8FFFF mov dword ptr ss:[ebp-0x7DC],edx 008904D4 8985 20F8FFFF mov dword ptr ss:[ebp-0x7E0],eax 008904DA 33C0 xor eax,eax 008904DC 55 push ebp 008904DD 68 74068900 push 金盾2017.00890674 008904E2 64:FF30 push dword ptr fs:[eax] 008904E5 64:8920 mov dword ptr fs:[eax],esp 008904E8 8D95 24F8FFFF lea edx,dword ptr ss:[ebp-0x7DC] 008904EE B8 8C068900 mov eax,金盾2017.0089068C ; F963D130E302F024ED66C627F711EB31C56BCC3AC810FB32C567CE 008904F3 E8 14FEFFFF call 金盾2017.0089030C 008904F8 8D85 28F8FFFF lea eax,dword ptr ss:[ebp-0x7D8] 008904FE E8 019EB7FF call 金盾2017.0040A304 00890503 8D85 1CF8FFFF lea eax,dword ptr ss:[ebp-0x7E4] 00890509 50 push eax 0089050A 68 19000200 push 0x20019 0089050F 6A 00 push 0x0 00890511 8B85 24F8FFFF mov eax,dword ptr ss:[ebp-0x7DC] 00890517 E8 DCABB7FF call 金盾2017.0040B0F8 0089051C 50 push eax 0089051D 68 02000080 push 0x80000002 00890522 E8 6540B8FF call 金盾2017.0041458C ; jmp 到 advapi32.RegOpenKeyExW 00890527 85C0 test eax,eax ; 打开HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System 00890529 0F85 06010000 jnz 金盾2017.00890635 0089052F 33C0 xor eax,eax 00890531 55 push ebp 00890532 68 2E068900 push 金盾2017.0089062E 00890537 64:FF30 push dword ptr fs:[eax] 0089053A 64:8920 mov dword ptr fs:[eax],esp 0089053D BB D2070000 mov ebx,0x7D2 00890542 899D 14F8FFFF mov dword ptr ss:[ebp-0x7EC],ebx 00890548 C785 18F8FFFF 0>mov dword ptr ss:[ebp-0x7E8],0x7 00890552 8D85 14F8FFFF lea eax,dword ptr ss:[ebp-0x7EC] 00890558 50 push eax 00890559 8D85 2EF8FFFF lea eax,dword ptr ss:[ebp-0x7D2] 0089055F 50 push eax 00890560 8D85 18F8FFFF lea eax,dword ptr ss:[ebp-0x7E8] 00890566 50 push eax 00890567 6A 00 push 0x0 00890569 68 FC068900 push 金盾2017.008906FC ; VideoBiosVersion 0089056E 8B85 1CF8FFFF mov eax,dword ptr ss:[ebp-0x7E4] 00890574 50 push eax 00890575 E8 2240B8FF call 金盾2017.0041459C ; jmp 到 advapi32.RegQueryValueExW 0089057A 85C0 test eax,eax ; 读出VideoBiosVersion里面的值 0089057C 75 0C jnz short 金盾2017.0089058A 0089057E 55 push ebp 0089057F B8 2C078900 mov eax,金盾2017.0089072C ; P2 00890584 E8 77FEFFFF call 金盾2017.00890400 00890589 59 pop ecx 0089058A 899D 14F8FFFF mov dword ptr ss:[ebp-0x7EC],ebx 00890590 C785 18F8FFFF 0>mov dword ptr ss:[ebp-0x7E8],0x1 0089059A 8D85 14F8FFFF lea eax,dword ptr ss:[ebp-0x7EC] 008905A0 50 push eax 008905A1 8D85 2EF8FFFF lea eax,dword ptr ss:[ebp-0x7D2] 008905A7 50 push eax 008905A8 8D85 18F8FFFF lea eax,dword ptr ss:[ebp-0x7E8] 008905AE 50 push eax 008905AF 6A 00 push 0x0 008905B1 8D95 10F8FFFF lea edx,dword ptr ss:[ebp-0x7F0] 008905B7 B8 40078900 mov eax,金盾2017.00890740 ; E76BC731FB21CB0EE246C220F1 008905BC E8 4BFDFFFF call 金盾2017.0089030C 008905C1 8B85 10F8FFFF mov eax,dword ptr ss:[ebp-0x7F0] 008905C7 E8 2CABB7FF call 金盾2017.0040B0F8 008905CC 50 push eax 008905CD 8B85 1CF8FFFF mov eax,dword ptr ss:[ebp-0x7E4] 008905D3 50 push eax 008905D4 E8 C33FB8FF call 金盾2017.0041459C ; jmp 到 advapi32.RegQueryValueExW 008905D9 85C0 test eax,eax ; 读出VideoBIOSDate里面的值 008905DB 75 37 jnz short 金盾2017.00890614 008905DD FFB5 28F8FFFF push dword ptr ss:[ebp-0x7D8] 008905E3 68 84078900 push 金盾2017.00890784 ; ; 008905E8 8D85 0CF8FFFF lea eax,dword ptr ss:[ebp-0x7F4] 008905EE 8D95 2EF8FFFF lea edx,dword ptr ss:[ebp-0x7D2] 008905F4 B9 E9030000 mov ecx,0x3E9 008905F9 E8 B6ABB7FF call 金盾2017.0040B1B4 008905FE FFB5 0CF8FFFF push dword ptr ss:[ebp-0x7F4] 00890604 8D85 28F8FFFF lea eax,dword ptr ss:[ebp-0x7D8] 0089060A BA 03000000 mov edx,0x3 0089060F E8 D8ADB7FF call 金盾2017.0040B3EC 00890614 33C0 xor eax,eax 00890616 5A pop edx 00890617 59 pop ecx 00890618 59 pop ecx 00890619 64:8910 mov dword ptr fs:[eax],edx 0089061C 68 35068900 push 金盾2017.00890635 00890621 8B85 1CF8FFFF mov eax,dword ptr ss:[ebp-0x7E4] 00890627 50 push eax 00890628 E8 2F3FB8FF call 金盾2017.0041455C ; jmp 到 advapi32.RegCloseKey 0089062D C3 retn ; 关闭注册表

继续回到机器码CALL内往下:

[Asm] 纯文本查看 复制代码
00891B46 55 push ebp ; 获取第四个字符串过程 ↓ 00891B47 68 D41B8900 push 金盾2017.00891BD4 00891B4C 64:FF30 push dword ptr fs:[eax] 00891B4F 64:8920 mov dword ptr fs:[eax],esp 00891B52 A1 18FE8B00 mov eax,dword ptr ds:[0x8BFE18] 00891B57 8B00 mov eax,dword ptr ds:[eax] 00891B59 BA 841C8900 mov edx,金盾2017.00891C84 ; 1 00891B5E E8 3999B7FF call 金盾2017.0040B49C 00891B63 75 58 jnz short 金盾2017.00891BBD ; 因为我这加密视频不绑定mac 所以这里直接跳过了 00891B65 FF75 FC push dword ptr ss:[ebp-0x4] 00891B68 68 AC1C8900 push 金盾2017.00891CAC ; - 00891B6D 8D45 B0 lea eax,dword ptr ss:[ebp-0x50] 00891B70 E8 13ECFFFF call 金盾2017.00890788 ; 这里取得是MAC 00891B75 8B55 B0 mov edx,dword ptr ss:[ebp-0x50] 00891B78 8D45 B4 lea eax,dword ptr ss:[ebp-0x4C] 00891B7B B9 00000000 mov ecx,0x0 00891B80 E8 0393B7FF call 金盾2017.0040AE88 00891B85 8B45 B4 mov eax,dword ptr ss:[ebp-0x4C] 00891B88 8D55 B8 lea edx,dword ptr ss:[ebp-0x48] 00891B8B E8 5CA3EDFF call 金盾2017.0076BEEC 00891B90 8B45 B8 mov eax,dword ptr ss:[ebp-0x48] 00891B93 8D4D BC lea ecx,dword ptr ss:[ebp-0x44] 00891B96 BA 05000000 mov edx,0x5 00891B9B E8 C884BAFF call 金盾2017.0043A068 00891BA0 8B55 BC mov edx,dword ptr ss:[ebp-0x44] 00891BA3 8D45 C0 lea eax,dword ptr ss:[ebp-0x40] 00891BA6 E8 2596B7FF call 金盾2017.0040B1D0 00891BAB FF75 C0 push dword ptr ss:[ebp-0x40] 00891BAE 8D45 FC lea eax,dword ptr ss:[ebp-0x4] 00891BB1 BA 03000000 mov edx,0x3 00891BB6 E8 3198B7FF call 金盾2017.0040B3EC 00891BBB EB 0D jmp short 金盾2017.00891BCA 00891BBD 8D45 FC lea eax,dword ptr ss:[ebp-0x4] ; 不绑定MAC 就用-00000代替 00891BC0 BA BC1C8900 mov edx,金盾2017.00891CBC ; -00000 00891BC5 E8 4297B7FF call 金盾2017.0040B30C ; 把所存放的字符串与这次用 '-' 连接在一起 00891BCA 33C0 xor eax,eax 00891BCC 5A pop edx 00891BCD 59 pop ecx 00891BCE 59 pop ecx 00891BCF 64:8910 mov dword ptr fs:[eax],edx 00891BD2 EB 17 jmp short 金盾2017.00891BEB 00891BD4 ^ E9 637AB7FF jmp 金盾2017.0040963C 00891BD9 8D45 FC lea eax,dword ptr ss:[ebp-0x4] 00891BDC BA BC1C8900 mov edx,金盾2017.00891CBC ; -00000 00891BE1 E8 2697B7FF call 金盾2017.0040B30C 00891BE6 E8 A97EB7FF call 金盾2017.00409A94 00891BEB 8B45 F8 mov eax,dword ptr ss:[ebp-0x8] 00891BEE 8B55 FC mov edx,dword ptr ss:[ebp-0x4] ; edx出现机器码 00891BF1 E8 EE8AB7FF call 金盾2017.0040A6E4 00891BF6 33C0 xor eax,eax 00891BF8 5A pop edx 00891BF9 59 pop ecx 00891BFA 59 pop ecx 00891BFB 64:8910 mov dword ptr fs:[eax],edx 00891BFE 68 711C8900 push 金盾2017.00891C71 00891C03 8D45 B0 lea eax,dword ptr ss:[ebp-0x50] 00891C06 E8 F986B7FF call 金盾2017.0040A304 00891C0B 8D45 B4 lea eax,dword ptr ss:[ebp-0x4C] 00891C0E BA 03000000 mov edx,0x3 00891C13 E8 7C87B7FF call 金盾2017.0040A394 00891C18 8D45 C0 lea eax,dword ptr ss:[ebp-0x40] 00891C1B BA 02000000 mov edx,0x2 00891C20 E8 3F87B7FF call 金盾2017.0040A364 00891C25 8D45 C8 lea eax,dword ptr ss:[ebp-0x38] 00891C28 BA 03000000 mov edx,0x3 00891C2D E8 6287B7FF call 金盾2017.0040A394 00891C32 8D45 D4 lea eax,dword ptr ss:[ebp-0x2C] 00891C35 E8 CA86B7FF call 金盾2017.0040A304 00891C3A 8D45 D8 lea eax,dword ptr ss:[ebp-0x28] 00891C3D BA 03000000 mov edx,0x3 00891C42 E8 4D87B7FF call 金盾2017.0040A394 00891C47 8D45 E4 lea eax,dword ptr ss:[ebp-0x1C] 00891C4A BA 02000000 mov edx,0x2 00891C4F E8 1087B7FF call 金盾2017.0040A364 00891C54 8D45 EC lea eax,dword ptr ss:[ebp-0x14] 00891C57 BA 03000000 mov edx,0x3 00891C5C E8 3387B7FF call 金盾2017.0040A394 00891C61 8D45 FC lea eax,dword ptr ss:[ebp-0x4] 00891C64 E8 9B86B7FF call 金盾2017.0040A304 00891C69 C3 retn 00891C6A ^ E9 817CB7FF jmp 金盾2017.004098F0 00891C6F ^ EB 92 jmp short 金盾2017.00891C03 00891C71 5F pop edi 00891C72 5E pop esi 00891C73 5B pop ebx 00891C74 8BE5 mov esp,ebp 00891C76 5D pop ebp 00891C77 C3 retn

获取MAC的call:

[Asm] 纯文本查看 复制代码

00890788    55              push ebp                                         ; 获取MAC CALL
00890789    8BEC            mov ebp,esp
0089078B    83C4 C8         add esp,-0x38
0089078E    53              push ebx
0089078F    56              push esi
00890790    57              push edi
00890791    33D2            xor edx,edx
00890793    8955 DC         mov dword ptr ss:[ebp-0x24],edx
00890796    8955 D8         mov dword ptr ss:[ebp-0x28],edx
00890799    8955 D4         mov dword ptr ss:[ebp-0x2C],edx
0089079C    8955 D0         mov dword ptr ss:[ebp-0x30],edx
0089079F    8955 CC         mov dword ptr ss:[ebp-0x34],edx
008907A2    8955 C8         mov dword ptr ss:[ebp-0x38],edx
008907A5    8BF8            mov edi,eax
008907A7    33C0            xor eax,eax
008907A9    55              push ebp
008907AA    68 17098900     push 金盾2017.00890917
008907AF    64:FF30         push dword ptr fs:[eax]
008907B2    64:8920         mov dword ptr fs:[eax],esp
008907B5    8BC7            mov eax,edi
008907B7    E8 489BB7FF     call 金盾2017.0040A304
008907BC    68 28098900     push 金盾2017.00890928                             ; rpcrt4.dll
008907C1    E8 7A41B8FF     call 金盾2017.00414940                             ; jmp 到 kernel32.LoadLibraryW
008907C6    8BD8            mov ebx,eax
008907C8    85DB            test ebx,ebx
008907CA    0F84 2C010000   je 金盾2017.008908FC
008907D0    A1 28118C00     mov eax,dword ptr ds:[0x8C1128]
008907D5    8338 02         cmp dword ptr ds:[eax],0x2
008907D8    74 0F           je short 金盾2017.008907E9
008907DA    68 40098900     push 金盾2017.00890940                             ; UuidCreate
008907DF    53              push ebx
008907E0    E8 A73FB8FF     call 金盾2017.0041478C
008907E5    89C6            mov esi,eax
008907E7    EB 0D           jmp short 金盾2017.008907F6
008907E9    68 58098900     push 金盾2017.00890958                             ; UuidCreateSequential
008907EE    53              push ebx
008907EF    E8 983FB8FF     call 金盾2017.0041478C
008907F4    89C6            mov esi,eax
008907F6    85F6            test esi,esi
008907F8    0F84 F8000000   je 金盾2017.008908F6
008907FE    8D45 F0         lea eax,dword ptr ss:[ebp-0x10]
00890801    50              push eax
00890802    FFD6            call esi
00890804    85C0            test eax,eax
00890806    0F85 EA000000   jnz 金盾2017.008908F6
0089080C    8D45 E0         lea eax,dword ptr ss:[ebp-0x20]
0089080F    50              push eax
00890810    FFD6            call esi
00890812    85C0            test eax,eax
00890814    0F85 DC000000   jnz 金盾2017.008908F6
0089081A    0FB645 FA       movzx eax,byte ptr ss:[ebp-0x6]
0089081E    3A45 EA         cmp al,byte ptr ss:[ebp-0x16]
00890821    0F85 CF000000   jnz 金盾2017.008908F6
00890827    0FB645 FB       movzx eax,byte ptr ss:[ebp-0x5]
0089082B    3A45 EB         cmp al,byte ptr ss:[ebp-0x15]
0089082E    0F85 C2000000   jnz 金盾2017.008908F6
00890834    0FB645 FC       movzx eax,byte ptr ss:[ebp-0x4]
00890838    3A45 EC         cmp al,byte ptr ss:[ebp-0x14]
0089083B    0F85 B5000000   jnz 金盾2017.008908F6
00890841    0FB645 FD       movzx eax,byte ptr ss:[ebp-0x3]
00890845    3A45 ED         cmp al,byte ptr ss:[ebp-0x13]
00890848    0F85 A8000000   jnz 金盾2017.008908F6
0089084E    0FB645 FE       movzx eax,byte ptr ss:[ebp-0x2]
00890852    3A45 EE         cmp al,byte ptr ss:[ebp-0x12]
00890855    0F85 9B000000   jnz 金盾2017.008908F6
0089085B    0FB645 FF       movzx eax,byte ptr ss:[ebp-0x1]
0089085F    3A45 EF         cmp al,byte ptr ss:[ebp-0x11]
00890862    0F85 8E000000   jnz 金盾2017.008908F6
00890868    8D4D DC         lea ecx,dword ptr ss:[ebp-0x24]
0089086B    0FB645 FA       movzx eax,byte ptr ss:[ebp-0x6]
0089086F    BA 02000000     mov edx,0x2
00890874    E8 CF55B9FF     call 金盾2017.00425E48
00890879    FF75 DC         push dword ptr ss:[ebp-0x24]
0089087C    6A 00           push 0x0
0089087E    8D4D D8         lea ecx,dword ptr ss:[ebp-0x28]
00890881    0FB645 FB       movzx eax,byte ptr ss:[ebp-0x5]
00890885    BA 02000000     mov edx,0x2
0089088A    E8 B955B9FF     call 金盾2017.00425E48
0089088F    FF75 D8         push dword ptr ss:[ebp-0x28]
00890892    6A 00           push 0x0
00890894    8D4D D4         lea ecx,dword ptr ss:[ebp-0x2C]
00890897    0FB645 FC       movzx eax,byte ptr ss:[ebp-0x4]
0089089B    BA 02000000     mov edx,0x2
008908A0    E8 A355B9FF     call 金盾2017.00425E48
008908A5    FF75 D4         push dword ptr ss:[ebp-0x2C]
008908A8    6A 00           push 0x0
008908AA    8D4D D0         lea ecx,dword ptr ss:[ebp-0x30]
008908AD    0FB645 FD       movzx eax,byte ptr ss:[ebp-0x3]
008908B1    BA 02000000     mov edx,0x2
008908B6    E8 8D55B9FF     call 金盾2017.00425E48
008908BB    FF75 D0         push dword ptr ss:[ebp-0x30]
008908BE    6A 00           push 0x0
008908C0    8D4D CC         lea ecx,dword ptr ss:[ebp-0x34]
008908C3    0FB645 FE       movzx eax,byte ptr ss:[ebp-0x2]
008908C7    BA 02000000     mov edx,0x2
008908CC    E8 7755B9FF     call 金盾2017.00425E48
008908D1    FF75 CC         push dword ptr ss:[ebp-0x34]
008908D4    6A 00           push 0x0
008908D6    8D4D C8         lea ecx,dword ptr ss:[ebp-0x38]
008908D9    0FB645 FF       movzx eax,byte ptr ss:[ebp-0x1]
008908DD    BA 02000000     mov edx,0x2
008908E2    E8 6155B9FF     call 金盾2017.00425E48
008908E7    FF75 C8         push dword ptr ss:[ebp-0x38]
008908EA    8BC7            mov eax,edi
008908EC    BA 0B000000     mov edx,0xB
008908F1    E8 F6AAB7FF     call 金盾2017.0040B3EC
008908F6    53              push ebx
008908F7    E8 A83DB8FF     call 金盾2017.004146A4                             ; jmp 到 kernel32.FreeLibrary
008908FC    33C0            xor eax,eax
008908FE    5A              pop edx
008908FF    59              pop ecx
00890900    59              pop ecx
00890901    64:8910         mov dword ptr fs:[eax],edx
00890904    68 1E098900     push 金盾2017.0089091E
00890909    8D45 C8         lea eax,dword ptr ss:[ebp-0x38]
0089090C    BA 06000000     mov edx,0x6
00890911    E8 4E9AB7FF     call 金盾2017.0040A364
00890916    C3              retn

总结: 没什么技术含量.分析起来还是挺顺利的.仅供小菜娱乐！高手莫要见笑！

远空盗号各种 · 发表于 2014-5-9 00:09

下载地址是百度链接

bisoso · 发表于 2014-5-9 00:11

可以写个DLL，patch机器码

九零-鑫鑫 · 发表于 2014-5-9 06:57

分析的很好学习了

a838135304 · 发表于 2015-3-18 13:22

膜拜大神2333

806785900 · 发表于 2014-12-6 11:56

这个确实很专业的分析

258239234 · 发表于 2014-12-5 23:03

多谢分享，还是高级技术

woyaodaili · 发表于 2014-11-3 00:12

求助，为什么我跟不到机器码那里

小彡哥 · 发表于 2014-5-9 11:59

下载地址是百度链接

ningzhonghui · 发表于 2014-5-9 11:22

大神的东西果然分析到位....收下看了

小雨细无声 · 发表于 2014-5-9 11:13

膜拜大神膜拜教程

smallrascal · 发表于 2014-5-9 07:56

金盾的，绝对收藏

凯不一样 · 发表于 2014-5-9 08:13

汗！！感觉不实际

wuyasos · 发表于 2014-5-9 08:40

抓紧膜拜下！~

2A93B1CE004EAC4 · 发表于 2014-5-9 08:44

大神就是大神牛13 膜拜下

blmk · 发表于 2014-5-9 09:05

师傅何时教我还原VMP

Smallhorse · 发表于 2014-5-9 09:20

膜拜下B牛师傅...并跪舔！

帐号		自动登录	找回密码
密码			注册[Register]

[原创] 金盾2017S视频播放器机器码的简单分析

点评

免费评分

本帖被以下淘专辑推荐: