Shelling and repair of a virus

This is an intermediate of the recently popular. net shelling virus that removes the. net shell. Shelling and fixing are not very complicated, but some tips are needed.

Shows the unshelled code:

650) this. width = 650; "src =" http://s3.51cto.com/wyfs02/M00/4D/E3/wKioL1RcKGKRutCoAAF1CM64txo111.jpg "style =" float: none; "title =" image001.jpg "alt =" wKioL1RcKGKRutCoAAF1CM64txo111.jpg "/>

The code above 401535 is shell code. It starts from call eax to actual code running and starts from 7ff8165c. However, after the actual code is run, the api breakpoint cannot be broken.

650) this. width = 650; "src =" http://s3.51cto.com/wyfs02/M00/4D/E4/wKiom1RcJ_2hbFNFAAHEoWib67Y787.jpg "title =" image002.jpg "style =" float: none; "alt =" wKiom1RcJ_2hbFNFAAHEoWib67Y787.jpg "/>

From the call of 7ff8166b, we found that it points to a mov edi, edi, and then forwarded to kernel32.

650) this. width = 650; "src =" http://s3.51cto.com/wyfs02/M01/4D/E3/wKioL1RcKGLDNPaYAACI8M0HVMs336.jpg "title =" image003.jpg "style =" float: none; "alt =" wKioL1RcKGLDNPaYAACI8M0HVMs336.jpg "/>

 

650) this. width = 650; "src =" http://s3.51cto.com/wyfs02/M01/4D/E4/wKiom1RcJ_7h5ExoAAFUTGOpt_o966.jpg "title =" image004.jpg "style =" float: none; "alt =" wKiom1RcJ_7h5ExoAAFUTGOpt_o966.jpg "/>

The problem is that it jumps to a stepping stone memory first, and the stepping stone memory jumps directly to the api entry to offset two bytes of commands, because the first two bytes of commands are meaningless mov edi, edi, but the api breakpoint is automatically set here. After it jumps, the api breakpoint is bypassed.

 

650) this. width = 650; "src =" http://s3.51cto.com/wyfs02/M02/4D/E3/wKioL1RcKGOSEVB1AAFYbCuw6mg905.jpg "title =" image005.jpg "style =" float: none; "alt =" wKioL1RcKGOSEVB1AAFYbCuw6mg905.jpg "/>

7ff80000 is originally the memory pointed to by iat. It is used to steal the bar, first go to a stepping stone memory, and then jump to the api function address + 2

 

Fix this iat table first.

Use the shell code before the patch to direct the iat table to the api function address.

650) this. width = 650; "src =" http://s3.51cto.com/wyfs02/M02/4D/E4/wKiom1RcJ_-CQoaqAAC3-2GnRS4444.jpg "title =" image006.jpg "style =" float: none; "alt =" wKiom1RcJ_-CQoaqAAC3-2GnRS4444.jpg "/>

Normal imported table memory:

650) this. width = 650; "src =" http://s3.51cto.com/wyfs02/M00/4D/E3/wKioL1RcKGTgM2FYAAFtnynkVLw844.jpg "title =" image007.jpg "style =" float: none; "alt =" wkiol1rckgtgm2fyaaftnynkw844.jpg "/>

After running call eax again, you can see the name of the called api function.

650) this. width = 650; "src =" http://s3.51cto.com/wyfs02/M00/4D/E4/wKiom1RcKADwER1OAAFC3--ILhA969.jpg "title =" image008.jpg "style =" float: none; "alt =" wKiom1RcKADwER1OAAFC3--ILhA969.jpg "/>

 

If you create a VM snapshot here, it is more convenient to analyze it by OD alone. However, if IDA is used for analysis, the process must be dumped and fixed. But the problem arises. The 7ff80000 memory is the memory applied for later. It is not a PE structure, and the original PE does not have this section. It is impossible to fix the file directly dumped full.

 

650) this. width = 650; "src =" http://s3.51cto.com/wyfs02/M02/4D/E4/wKiom1RcKACw5rPEAAF0fhtUBG4593.jpg "title =" image009.jpg "style =" float: none; "alt =" wKiom1RcKACw5rPEAAF0fhtUBG4593.jpg "/>

Danteng's approach is still coming. Without this section, add a section for it.

Dump full

650) this. width = 650; "src =" http://s3.51cto.com/wyfs02/M01/4D/E3/wKioL1RcKGXxAtbvAAFGUIVZj0Y778.jpg "title =" image010.jpg "style =" float: none; "alt =" wKioL1RcKGXxAtbvAAFGUIVZj0Y778.jpg "/>

Then dump the memory of 7ff80000.

650) this. width = 650; "src =" http://s3.51cto.com/wyfs02/M01/4D/E4/wKiom1RcKAGw-06NAAFX4EzdDtA563.jpg "title =" image011.jpg "style =" float: none; "alt =" wKiom1RcKAGw-06NAAFX4EzdDtA563.jpg "/>

Add a section to the PE through ffi

650) this. width = 650; "src =" http://s3.51cto.com/wyfs02/M02/4D/E3/wKioL1RcKGXQDWB8AADogsQ1lbk520.jpg "title =" image012.jpg "style =" float: none; "alt =" wkiol1rckgxqdwb8aadogsq1lbk5w.jpg "/>

Modify virtual Offset. Use 7ff80000 minus 400000.

650) this. width = 650; "src =" http://s3.51cto.com/wyfs02/M02/4D/E4/wKiom1RcKAHzlLywAAFm5VwjopY631.jpg "title =" image013.jpg "style =" float: none; "alt =" wKiom1RcKAHzlLywAAFm5VwjopY631.jpg "/>

Now, you can use import rec to fix dump. Here, you can manually point rva to the relative offset of 7ff80000.

650) this. width = 650; "src =" http://s3.51cto.com/wyfs02/M00/4D/E3/wKioL1RcKGaSLgdBAAJ3whbfYVs021.jpg "title =" image014.jpg "style =" float: none; "alt =" wKioL1RcKGaSLgdBAAJ3whbfYVs021.jpg "/>

Modify the dumped_exe entry. You can directly change it on import rec.

 

650) this. width = 650; "src =" http://s3.51cto.com/wyfs02/M00/4D/E4/wKiom1RcKAGwDb1HAAAwwM2G9N4013.jpg "title =" image015.jpg "style =" float: none; "alt =" wKiom1RcKAGwDb1HAAAwwM2G9N4013.jpg "/>

OK. You can use IDA to open it.

650) this. width = 650; "src =" http://s3.51cto.com/wyfs02/M01/4D/E3/wKioL1RcKGbiK0xSAADGVHix0Lw242.jpg "title =" image016.jpg "style =" float: none; "alt =" wKioL1RcKGbiK0xSAADGVHix0Lw242.jpg "/>

 

This article from the "empty altar" blog, please be sure to keep this http://chenjava.blog.51cto.com/374566/1573925

Shelling and repair of a virus