首页
论坛
专栏
课程

[原创]2019看雪CTF 晋级赛Q2 第七题:部落冲突(01-去除反调试) by 心学

2019-6-27 14:59 3269

[原创]2019看雪CTF 晋级赛Q2 第七题:部落冲突(01-去除反调试) by 心学

htg
1
2019-6-27 14:59
3269
工具:IDA
目的:去除反调试、以便于IDA能静态分析源码
一、去除主要流程:
1、Patch:SH_LYD:004CE670-SH_LYD:004CE675:909090909090
2、Patch:SH_LYD:004CE6FB-SH_LYD:004CE700: 909090909090
3、Patch: SH_LYD:004CE0AF:9090
4、阻止加密:SH_LYD:004CE096:00
5、避免掉坑:SH_LYD:004D0CFF-SH_LYD:004D0D00:C5C5      
相关的IDA代码:
static main(void)
{
  auto code1,code2,code3,code4,code5,i;
  code1 = 0x004CE670;
  code2 = 0x004CE6FB;
  code3 = 0x004CE0AF;
  code4 = 0x004CE096;
  code5 = 0x004D0CFF;

  for ( i = 0; i < 6 ; i ++ )
  {
    PatchByte(code1 + i,0x90);PatchByte(code2 + i,0x90);
  }
  PatchByte(code3,0x90);PatchByte(code3+1,0x90);
  PatchByte(code4,0x00);
  PatchByte(code5,0xC5);PatchByte(code5+1,0xC5);
}

二、主要源代码分析过程(流程):
1、Patch:CheckRemoteDebuggerPresent
SH_LYD:004CE64C                         loc_4CE64C:                             ; CODE XREF: start+501↑j
SH_LYD:004CE64C C7 85 10 FF FF FF 00 00+                mov     [ebp+var_F0], 0
SH_LYD:004CE656 8D 95 10 FF FF FF                       lea     edx, [ebp+var_F0]
SH_LYD:004CE65C 52                                      push    edx
SH_LYD:004CE65D 6A FF                                   push    0FFFFFFFFh
SH_LYD:004CE65F FF 95 04 FF FF FF                       call    [ebp+funcCheckRemoteDebuggerPresent]
SH_LYD:004CE665 83 BD 10 FF FF FF 00                    cmp     [ebp+var_F0], 0
SH_LYD:004CE66C 74 0B                                   jz      short loc_4CE679
SH_LYD:004CE66E 6A 00                                   push    0
SH_LYD:004CE670 90                                      nop
SH_LYD:004CE671 90                                      nop
SH_LYD:004CE672 90                                      nop
SH_LYD:004CE673 90                                      nop
SH_LYD:004CE674 90                                      nop
SH_LYD:004CE675 90                                      nop
SH_LYD:004CE676 83 C4 04                                add     esp, 4

2、Patch:IsDebuggerPresent
SH_LYD:004CE6EF FF 95 08 FF FF FF                       call    [ebp+funcIsDebuggerPresent]
SH_LYD:004CE6F5 85 C0                                   test    eax, eax
SH_LYD:004CE6F7 74 0B                                   jz      short loc_4CE704
SH_LYD:004CE6F9 6A 00                                   push    0
SH_LYD:004CE6FB 90                                      nop
SH_LYD:004CE6FC 90                                      nop
SH_LYD:004CE6FD 90                                      nop
SH_LYD:004CE6FE 90                                      nop
SH_LYD:004CE6FF 90                                      nop
SH_LYD:004CE700 90                                      nop
SH_LYD:004CE701 83 C4 04                                add     esp, 4

3、Patch:避免掉坑,进入系统中断
将SH_LYD:004CE0AF处的CD2E改为9090
SH_LYD:004CE0A4
SH_LYD:004CE0A4 ; =============== S U B R O U T I N E =======================================
SH_LYD:004CE0A4
SH_LYD:004CE0A4
SH_LYD:004CE0A4 sub_4CE0A4      proc near               ; CODE XREF: start+503↓p
SH_LYD:004CE0A4                                         ; start+663↓p
SH_LYD:004CE0A4                 push    0
SH_LYD:004CE0A6                 push    0FFFFFFFFh
SH_LYD:004CE0A8                 mov     eax, 172h
SH_LYD:004CE0AD                 mov     edx, esp
SH_LYD:004CE0AF                 int     2Eh             ; DOS 2+ internal - EXECUTE COMMAND
SH_LYD:004CE0AF                                         ; DS:SI -> counted CR-terminated command string
SH_LYD:004CE0B1                 add     esp, 8
SH_LYD:004CE0B4                 retn
SH_LYD:004CE0B4 sub_4CE0A4      endp

4、阻止加密:sub_4CE064,强制返回0:

关键在SH_LYD:004CE093 C6 45 FF 01:将其修改为 C6 45 FF 00;使得程序强制返回0。避免后面的一个异或加密

SH_LYD:004CE064
SH_LYD:004CE064                         ; =============== S U B R O U T I N E =======================================
SH_LYD:004CE064
SH_LYD:004CE064                         ; Attributes: bp-based frame
SH_LYD:004CE064
SH_LYD:004CE064                         sub_4CE064      proc near               ; CODE XREF: sub_4CFD74+3C↓p
SH_LYD:004CE064                                                                 ; sub_4CFEB4+1B↓p
SH_LYD:004CE064
SH_LYD:004CE064                         var_1           = byte ptr -1
SH_LYD:004CE064
SH_LYD:004CE064 55                                      push    ebp
SH_LYD:004CE065 8B EC                                   mov     ebp, esp
SH_LYD:004CE067 51                                      push    ecx
SH_LYD:004CE068 C6 45 FF 00                             mov     [ebp+var_1], 0
SH_LYD:004CE06C 64 A1 30 00 00 00                       mov     eax, large fs:30h
SH_LYD:004CE072 8B 40 10                                mov     eax, [eax+10h]
SH_LYD:004CE075 80 78 68 81                             cmp     byte ptr [eax+68h], 81h
SH_LYD:004CE079 74 18                                   jz      short loc_4CE093
SH_LYD:004CE07B 80 78 68 00                             cmp     byte ptr [eax+68h], 0
SH_LYD:004CE07F 74 12                                   jz      short loc_4CE093
SH_LYD:004CE081 80 78 6C 0A                             cmp     byte ptr [eax+6Ch], 0Ah
SH_LYD:004CE085 74 0C                                   jz      short loc_4CE093
SH_LYD:004CE087 80 78 6C 00                             cmp     byte ptr [eax+6Ch], 0
SH_LYD:004CE08B 74 06                                   jz      short loc_4CE093
SH_LYD:004CE08D C6 45 FF 00                             mov     [ebp+var_1], 0
SH_LYD:004CE091 EB 04                                   jmp     short loc_4CE097
SH_LYD:004CE093                         ; ---------------------------------------------------------------------------
SH_LYD:004CE093
SH_LYD:004CE093                         loc_4CE093:                             ; CODE XREF: sub_4CE064+15↑j
SH_LYD:004CE093                                                                 ; sub_4CE064+1B↑j ...
SH_LYD:004CE093 C6 45 FF 00                             mov     [ebp+var_1], 0
SH_LYD:004CE097
SH_LYD:004CE097                         loc_4CE097:                             ; CODE XREF: sub_4CE064+2D↑j
SH_LYD:004CE097 B8 01 00 00 00                          mov     eax, 1
SH_LYD:004CE09C 8A 45 FF                                mov     al, [ebp+var_1]
SH_LYD:004CE09F 8B E5                                   mov     esp, ebp
SH_LYD:004CE0A1 5D                                      pop     ebp
SH_LYD:004CE0A2 C3                                      retn
SH_LYD:004CE0A2                         sub_4CE064      endp

5、避免掉坑:004D0CF4(实际拷贝到004010D0),不予执行 Int 2E

软件会将 004D0CF4拷贝到 004010D0处,拷贝前会先异或0x55自己。

那么为了使得解密后拷贝的代码为9090,那么就需要将存在软件内的代码改为C5C5

原始文件:

004D0CF0  54 96 99 99 3F 55 3F AA  ED 27 54 55 55 DE 81 98

004D0D00  7B D6 91 5D 96 99 99 99  99 99 99 99 99 99 99 99
解密:0x55异或

004D0CF0  01 C3 CC CC 6A 00 6A FF  B8 72 01 00 00 8B D4 CD 

004D0D00  2E 83 C4 08 C3 CC CC CC  CC CC CC CC CC CC CC CC
CD 2E:int 2E;调用系统中断,程序终止

CD2E对应于987B; 那么987B →C5C5



[公告]安全服务和外包项目请将项目需求发到看雪企服平台:https://qifu.kanxue.com

最后于 2019-6-28 11:28 被kanxue编辑 ,原因:
最新回复 (3)
上海刘一刀 2 2019-6-27 16:02
2
0
优秀  
看场雪 3 2019-6-27 16:14
3
0
优秀
htg 1 2019-6-27 16:43
4
0
此次仅处理了能调出正常的CMD窗口,提示用户输入信息。
还未实现SMC清除,静态分析还存在困难。我在跟踪窗口调用前的语句时,发现了所有提前下断点的语句处,SMC都会将其修改为00,看来应该是与调试器替换语句有关系,将断点处的代码替换成了0x00。
不过,一旦在主程序上JMP 0x00403B4D 后,再设置中断,就不会出现问题。
下一步尝试解除SMC,逐步Patch到程序文件来,nop掉赋值语句。这样就可以提前下断点了
游客
登录 | 注册 方可回帖
返回