Dark group security-Web anti-virus 2.3

XI Ge said that he needed to write some articles. He had failed to get started last night and never wrote any articles.
When I got up this morning, I found someone in a group discussing this.
Bytes ----------------------------------------------------------------------------------------------
Display image:

Bytes ----------------------------------------------------------------------------------------------
When running the software, click "enable whitelist" in the upper-right corner. A prompt is displayed.


Next, let's go to the artifact OD.

After loading, we can see from the entry that it was compiled by Delphi (in my mind)


By proceeding to the next section of the MessageBox function, we will go to the following position.





Obviously, the three lines of code (00548ad6, 00548adc, and 00548ade) are the key to his judgment.

00548AD6 |. FF92 C8000000 call dword ptr ds: [edx + 0xC8]; Return Value: 100548ADC returned correctly |. 84C0 test al, al; compare eax. If it is set to jnz under 1, Skip. If it is not set to 1, skip 00548ADE. |. 75 61 jnz XWebScan.00548B41; jump
Let's take a look at what is in the call 00548ad6.


0045B314. 80B8 12020000 01 cmp byte ptr ds: [eax + 0x212], 0x1; compare eax + 0x212 (that is, 00ADAB9A) with 1. If yes, 10045B31B is returned. 0F94C0 sete al; the condition is true al = 880045B31E. c3 retn; Return
In this case, we patch a piece of code to set eax to 1.

Original code: 80 B8 12 02 00 00 01 0F 94 C0 C3
Patch code: B8 01 00 00 00 90 90 90 90 C3

After running, I suddenly found that the scan type was disabled.



Continue debugging. Since it is disabled when it is enabled, that is, a check will be triggered before the program runs.

Let's look at a piece of code with obvious problems.
 

00548A9F. FF92 C8000000 call dword ptr ds: [edx + 0xC8]; if correct, the eax value is "0" 00548AA5. 84C0 test al, al; compare whether it is "0" 00548AA7. /74 0F je XWebScan.00548AB8; if the function is correct, the system jumps to 00548ab8 to execute the function code.
 


Ps: no other restrictions have been found. If any restrictions are found, please contact my mailbox. Thank you. Qs # 2cto.com (# Change @)