PING-源码分析指导书.doc

PING.EXE十六进制源码分析车生兵 著中南林业科技大学计算机与信息工程学院2010年10月18日目录1 ping.exe十六进制源码.32 ping.exe源码数据分析71、源码结构72、DOS头结点73、DOS文件体.74、PE头结点.84.1 PE头结点结构.84.2 PE可选头部.104.3数据目录.135 PE文件段.156、ping.exe加载后的内存数据映像.183 Ping.exe的实现与原理分析.244.1 常用数据结构.244.2 ping.asm源程序分析.274.3、_ConsoleInit.asm分析.354.4、_CmdLine.asm分析.374.5、_CalcCheckSum.asm分析.414.6、测试结果举例.431 ping.exe十六进制源码在文件存储空间中，ping.exe十六进制源码示例如下：;header00000000 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 MZ?.00000010 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ?.00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000030 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 .?.00000040 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 .?.?L?Th00000050 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F is program canno00000060 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 t be run in DOS 00000070 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 mode.$.00000080 A3 19 CD DB E7 78 A3 88 E7 78 A3 88 E7 78 A3 88 ?哇鐇鐇鐇00000090 E7 78 A3 88 FA 78 A3 88 84 5A 89 88 E6 78 A3 88 鐇鷛刏増鎥000000A0 52 69 63 68 E7 78 A3 88 00 00 00 00 00 00 00 00 Rich鐇.000000B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .000000C0 50 45 00 00 4C 01 03 00 C4 46 FA 3C 00 00 00 00 PE.L.腇?.000000D0 00 00 00 00 E0 00 0F 01 0B 01 05 0C 00 06 00 00 .?.000000E0 00 0A 01 00 00 00 00 00 14 15 00 00 00 10 00 00 .000000F0 00 20 00 00 00 00 40 00 00 10 00 00 00 02 00 00 . .00000100 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 .00000110 00 40 01 00 00 04 00 00 00 00 00 00 03 00 00 00 .00000120 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 .00000130 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 .00000140 64 20 00 00 50 00 00 00 00 00 00 00 00 00 00 00 d .P.00000150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000190 00 00 00 00 00 00 00 00 00 20 00 00 64 00 00 00 . .d.000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .000001B0 00 00 00 00 00 00 00 00 2E 74 65 78 74 00 00 00 .text.000001C0 F4 05 00 00 00 10 00 00 00 06 00 00 00 04 00 00 ?.000001D0 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 . .000001E0 2E 72 64 61 74 61 00 00 EA 01 00 00 00 20 00 00 .rdata.?. .000001F0 00 02 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 .00000200 00 00 00 00 40 00 00 40 2E 64 61 74 61 00 00 00 .data.00000210 66 07 01 00 00 30 00 00 00 02 00 00 00 0C 00 00 f.0.00000220 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 .?00000230 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000270 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000280 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000290 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .000002A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .000002B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .000002C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .000002D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .000002E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .000002F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000300 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000310 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000320 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000330 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000340 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000350 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000360 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000370 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000380 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000390 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .000003A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .000003B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .000003C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .000003D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .000003E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .000003F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .;.text00000400 55 8B EC 83 C4 FC 60 C7 45 FC 00 00 00 00 E8 63 U嬱兡黗荅?.鑓00000410 05 00 00 8B F0 FC AC 0A C0 74 20 3C 20 74 F7 4E .嬸.纓 t鱊00000420 FF 45 FC AC 0A C0 74 13 3C 20 74 EA 3C 22 75 F3 E.纓. t?u?00000430 AC 0A C0 74 06 3C 22 75 F7 EB E8 61 8B 45 FC C9 ?纓.u麟鑑婨00000440 C3 55 8B EC 83 C4 F8 60 FF 45 08 C7 45 FC 00 00 肬嬱兡鴃E.荅?.00000450 00 00 8B 7D 0C E8 1C 05 00 00 8B F0 FC AC 0A C0 .媫.?.嬸.?00000460 74 58 3C 20 74 F7 4E FF 45 FC C7 45 F8 00 00 00 tX t鱊EE?.00000470 00 8B 45 08 3B 45 FC 75 07 C7 45 F8 01 00 00 00 .婨.;E黸.荅?.00000480 AC 0A C0 74 35 3C 20 74 D4 3C 22 74 12 83 7D 10 ?纓5 t?t.儅.00000490 01 7E 0A 83 7D F8 01 75 04 AA FF 4D 10 EB E1 AC .儅?u.?M.脶?000004A0 0A C0 74 16 3C 22 74 D8 83 7D 10 01 7E 0A 83 7D .纓.t貎.儅000004B0 F8 01 75 04 AA FF 4D 10 EB E5 32 C0 AA 61 C9 C2 ?u.?M.脲2廓a陕000004C0 0C 00 55 8B EC 60 8B 45 08 0B C0 74 05 83 F8 01 .U嬱婨.纓.凐.000004D0 75 07 83 0D 5A 37 41 00 01 61 B8 01 00 00 00 C9 u.?Z7A.a?.?000004E0 C2 04 00 6A F6 E8 92 04 00 00 A3 5E 37 41 00 6A ?.j鲨?.7A.j000004F0 F5 E8 86 04 00 00 A3 62 37 41 00 6A 01 68 C2 10 蹊?.7A.j.h?00000500 40 00 E8 87 04 00 00 C3 55 8B EC 83 C4 FC 60 FF .鑷.肬嬱兡黗00000510 75 08 E8 95 04 00 00 8D 4D FC 6A 00 51 50 FF 75 u.钑.峂黬.QPu00000520 08 FF 35 62 37 41 00 E8 6E 04 00 00 61 C9 C2 04 .5b7A.鑞.a陕.00000530 00 55 8B EC 83 C4 FC 60 8B 4D 0C D1 E9 33 DB 8B .U嬱兡黗婱.验3蹕00000540 75 08 FC 66 AD 0F B7 C0 03 D8 E2 F7 F7 45 0C 01 u.黤?防.剽鼢E.00000550 00 00 00 74 06 AC 0F B6 C0 03 D8 8B C3 25 FF FF .t.?独.貗?00000560 00 00 C1 EB 10 03 C3 66 F7 D0 89 45 FC 61 8B 45 .岭.胒餍塃黙婨00000570 FC C9 C2 08 00 55 8B EC 81 C4 FC FE FF FF FF 75 ?.U嬱伳u00000580 08 E8 4A 04 00 00 83 F8 FF 74 24 89 85 FC FE FF .鐹.凐t$墔00000590 FF 50 E8 3F 04 00 00 50 68 C5 30 40 00 68 CC 31 P?.Ph?.h?000005A0 40 00 E8 0B 04 00 00 83 C4 0C E9 FE 00 00 00 FF .?.兡.辋.000005B0 75 08 E8 13 04 00 00 0B C0 0F 84 C7 00 00 00 33 u.?.?勄.3000005C0 FF 8B 40 0C EB 08 8B 18 FF 33 47 83 C0 04 83 38 婡.?3G兝.?000005D0 00 75 F3 58 89 85 FC FE FF FF 50 E8 F6 03 00 00 .u骕墔P桷.000005E0 8B D8 83 FF 01 75 2D 53 FF 75 08 68 A6 30 40 00 嬝?.u-Su.h?.000005F0 68 CC 31 40 00 E8 B8 03 00 00 83 C4 10 53 68 C5 h?.韪.兡.Sh?00000600 30 40 00 8D 85 00 FF FF FF 50 E8 A3 03 00 00 83 0.崊.P瑁.?00000610 C4 0C EB 5F 57 FF 75 08 68 E7 30 40 00 68 CC 31 ?隷Wu.h?.h?00000620 40 00 E8 8B 03 00 00 83 C4 10 53 68 CC 31 40 00 .鑻.兡.Sh?.00000630 E8 6B 03 00 00 53 68 0C 31 40 00 8D 85 00 FF FF 鑛.Sh.1.崊.00000640 FF 50 E8 6B 03 00 00 83 C4 0C EB 22 68 39 31 40 P鑛.兡.?h9100000650 00 68 CC 31 40 00 E8 45 03 00 00 58 50 E8 74 03 .h?.鐴.XP鑤.00000660 00 00 50 68 CC 31 40 00 E8 33 03 00 00 4F 83 FF .Ph?.?.O?00000670 01 77 D9 8D 85 00 FF FF FF 50 68 CC 31 40 00 E8 .w賺?Ph?.?00000680 1C 03 00 00 EB 27 68 68 31 40 00 68 4D 30 40 00 .?hh1.hM0.00000690 68 CC 31 40 00 E8 18 03 00 00 83 C4 0C 68 CC 31 h?.?.兡.h?000006A0 40 00 E8 61 FE FF FF 33 C0 C9 C2 04 00 68 CC 31 .鑑?3郎?.h?000006B0 40 00 E8 51 FE FF FF 8B 85 FC FE FF FF C9 C2 04 .鑁?媴陕.000006C0 00 55 8B EC 81 C4 C8 FD FF FF 60 66 C7 85 F2 FE .U嬱伳三f菂蟒000006D0 FF FF 00 00 66 C7 85 F0 FE FF FF 02 00 FF 75 08 .f菂瘙.u.000006E0 8F 85 F4 FE FF FF 6A 01 6A 03 6A 02 E8 FD 02 00 弲酤j.j.j.椠.000006F0 00 83 F8 FF 75 0F 68 61 30 40 00 E8 08 FE FF FF .凐u.ha0.?00000700 E9 0A 02 00 00 89 85 DC FE FF FF 33 DB 66 C7 85 ?.墔荥3踗菂00000710 CA FD FF FF 01 00 66 C7 85 C8 FD FF FF 01 00 F7 数.f菂三.?00000720 05 5A 37 41 00 01 00 00 00 0F 85 D5 01 00 00 83 .Z7A.呎.?00000730 FB 04 0F 83 CC 01 00 00 43 BE CC 35 40 00 68 00 ?.兲.C咎5.h.00000740 00 01 00 56 E8 3F 02 00 00 66 8B 85 CA FD FF FF .V?.f媴数00000750 66 89 46 04 66 8B 85 C8 FD FF FF 66 89 46 06 C6 f塅.f媴三f塅.?00000760 06 08 E8 1B 02 00 00 89 46 08 B9 20 00 00 00 83 .?.塅.?.?00000770 C1 08 51 68 CC 35 40 00 E8 B4 FD FF FF 66 89 46 ?Qh?.璐?f塅00000780 02 6A 10 8D 85 F0 FE FF FF 50 6A 00 51 68 CC 35 .j.崊瘙Pj.Qh?00000790 40 00 FF B5 DC FE FF FF E8 4B 02 00 00 83 F8 FF .弟?鐺.凐000007A0 75 0F 68 86 30 40 00 E8 5C FD FF FF E9 6E FF FF u.h?.鑌?閚000007B0 FF C7 85 D4 FD FF FF 01 00 00 00 FF B5 DC FE FF 菂札.弟?000007C0 FF 8F 85 D8 FD FF FF C7 85 CC FD FF FF 00 00 00 弲佚菂听.000007D0 00 C7 85 D0 FD FF FF 40 42 0F 00 8D 85 CC FD FF .菂旋B.崊听000007E0 FF 50 6A 00 6A 00 8D 85 D4 FD FF FF 50 6A 00 E8 Pj.j.崊札Pj.?000007F0 EE 01 00 00 83 F8 FF 75 0F 68 61 30 40 00 E8 05 ?.凐u.ha0.?00000800 FD FF FF E9 17 FF FF FF 0B C0 0F 84 CD 00 00 00 ?.?勍.00000810 C7 85 D8 FE FF FF 10 00 00 00 8D 85 D8 FE FF FF 菂佝.崊佝00000820 50 8D 85 E0 FE FF FF 50 6A 00 68 00 00 01 00 68 P崊帼Pj.h.h00000830 CC 35 40 00 FF B5 DC FE FF FF E8 9D 01 00 00 83 ?.弟?铦.?00000840 F8 FF 75 0F 68 61 30 40 00 E8 BA FC FF FF E9 94 ?u.ha0.韬?閿00000850 00 00 00 8B 85 E4 FE FF FF 3B 85 F4 FE FF FF 74 .媴濑;咊?t00000860 05 E9 4B FF FF FF 66 8B 1D E4 35 40 00 66 8B 0D .镵f?.f?00000870 E6 35 40 00 66 3B 9D CA FD FF FF 75 09 66 3B 8D ?.f;澥?u.f;?00000880 C8 FD FF FF 74 05 E9 26 FF FF FF 50 E8 45 01 00 三t.?P鐴.00000890 00 0B C0 74 0D 50 8D 85 00 FF FF FF 50 E8 04 01 .纓.P崊.P?.000008A0 00 00 E8 DB 00 00 00 2B 05 E8 35 40 00 0F B6 0D .枸.+.?.?000008B0 D4 35 40 00 51 50 6A 20 8D 85 00 FF FF FF 50 68 ?.QPj 崊.Ph000008C0 3D 31 40 00 68 CC 31 40 00 E8 E4 00 00 00 83 C4 =1.h?.桎.兡000008D0 18 68 CC 31 40 00 E8 2D FC FF FF EB 0A 68 71 30 .h?.?hq0000008E0 40 00 E8 21 FC FF FF 66 FF 85 CA FD FF FF 66 FF .?f吺?f000008F0 85 C8 FD FF FF 68 E8 03 00 00 E8 95 00 00 00 E9 吶?h?.钑.?00000900 1B FE FF FF FF B5 DC FE FF FF E8 B5 00 00 00 61 .?弟?璧.a00000910 C9 C2 04 00 E8 CA FB FF FF E8 E2 FA FF FF 83 F8 陕.枋?桠?凐00000920 02 75 3C 68 CC 35 41 00 68 01 01 00 00 E8 8C 00 .uh?A.h.鑼.00000930 00 00 0B C0 75 22 6A 64 68 68 31 40 00 6A 01 E8 .纔jdhh1.j.?00000940 FD FA FF FF 68 68 31 40 00 E8 27 FC FF FF 0B C0 hh1.?.?00000950 74 06 50 E8 69 FD FF FF E8 5B 00 00 00 EB 0A 68 t.P鑙?鑋.?h00000960 00 30 40 00 E8 9F FB FF FF 6A 00 E8 00 00 00 00 .0.锜?j.?.00000970 FF 25 18 20 40 00 FF 25 04 20 40 00 FF 25 08 20 %. .%. .%. 00000980 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 .%. .%. .%00000990 14 20 40 00 FF 25 00 20 40 00 FF 25 1C 20 40 00 . .%. .%. .000009A0 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 % .%$ .%( 000009B0 40 00 FF 25 30 20 40 00 FF 25 4C 20 40 00 FF 25 .%0 .%L .%000009C0 3C 20 40 00 FF 25 40 20 40 00 FF 25 44 20 40 00 .% .%D .000009D0 FF 25 48 20 40 00 FF 25 38 20 40 00 FF 25 50 20 %H .%8 .%P 000009E0 40 00 FF 25 54 20 40 00 FF 25 58 20 40 00 FF 25 .%T .%X .%000009F0 5C 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 .;.idata，导入地址表，加载后由Microsoft Loader修改，例如：kernel32.dll函数的加粗的地址将修改为7C81CDEAh00000A00 80 21 00 00 26 21 00 00 38 21 00 00 48 21 00 00 !.&!.8!.H!.00000A10 58 21 00 00 68 21 00 00 18 21 00 00 88 21 00 00 X!.h!.!.?.00000A20 94 21 00 00 A0 21 00 00 AC 21 00 00 00 00 00 00 ?.?.?.00000A30 C6 21 00 00 00 00 00 00 0B 00 00 80 73 00 00 80 ?.s.00000A40 03 00 00 80 34 00 00 80 0A 00 00 80 74 00 00 80 .4.t.00000A50 11 00 00 80 12 00 00 80 14 00 00 80 17 00 00 80 .;.rdata，导入表，供Microsoft Loader使用，加载完成即废弃00000A60 00 00 00 00 B4 20 00 00 00 00 00 00 00 00 00 00 .?.00000A70 B8 21 00 00 00 20 00 00 E4 20 00 00 00 00 00 00 ?. .?.00000A80 00 00 00 00 D2 21 00 00 30 20 00 00 EC 20 00 00 .?.0 .?.00000A90 00 00 00 00 00 00 00 00 DE 21 00 00 38 20 00 00 .?.8 .00000AA0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .00000AB0 00 00 00 00 80 21 00 00 26 21 00 00 38 21 00 00 .!.&!.8!.00000AC0 48 21 00 00 58 21 00 00 68 21 00 00 18 21 00 00 H!.X!.h!.!.00000AD0 88 21 00 00 94 21 00 00 A0 21 00 00 AC 21 00 00 ?.?.?.?.00000AE0 00 00 00 00 C6 21 00 00 00 00 00 00 0B 00 00 80 .?.00000AF0 73 00 00 80 03 00 00 80 34 00 00 80 0A 00 00 80 s.4.00000B00 74 00 00 80 11 00 00 80 12 00 00 80 14 00 00 80 t.00000B10 17 00 00 80 00 00 00 00 75 00 45 78 69 74 50 72 .u.ExitPr00000B20 6F 63 65 73 73 00 B6 00 47 65 74 43 6F 6D 6D 61 ocess.?GetComma00000B30 6E 64 4C 69 6E 65 41 00 3D 01 47 65 74 53 74 64 ndLineA.=.GetStd00000B40 48 61 6E 64 6C 65 00 00 58 01 47 65 74 54 69 63 Handle.X.GetTic00000B50 6B 43 6F 75 6E 74 00 00 13 02 52 74 6C 5A 65 72 kCount.RtlZer00000B60 6F 4D 65 6D 6F 72 79 00 22 02 53 65 74 43 6F 6E oMemory.SetCon00000B70 73 6F 6C 65 43 74 72 6C 48 61 6E 64 6C 65 72 00 soleCtrlHandler.00000B80 73 02 53 6C 65 65 70 00 B9 02 57 72 69 74 65 46 s.Sleep.?WriteF00000B90 69 6C 65 00 D3 02 6C 73 74 72 63 61 74 41 00 00 ile.?lstrcatA.00000BA0 DC 02 6C 73 74 72 63 70 79 41 00 00 E2 02 6C 73 ?lstrcpyA.?ls00000BB0 74 72 6C 65 6E 41 00 00 4B 45 52 4E 45 4C 33 32 trlenA.KERNEL3200000BC0 2E 64 6C 6C 00 00 A5 02 77 73 70 72 69 6E 74 66 .dll.?wsprintf00000BD0 41 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 57 53 A.USER32.dll.WS00000BE0 4F 43 4B 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 OCK32.dll.00000BF0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .;.data00000C00 55 73 61 67 65 3A 20 70 69 6E 67 20 68 6F 73 74 Usage: ping host00000C10 6E 61 6D 65 0D 0A 0A 65 78 61 6D 70 6C 65 3A 0D name.example:.00000C20 0A 20 20 70 69 6E 67 20 31 32 37 2E 30 2E 30 2E . ping 0000C30 31 0D 0A 20 20 70 69 6E 67 20 77 77 77 2E 64 65 1. ping www.de00000C40 73 74 68 6F 73 74 2E 63 6F 6D 0D 0A 00 55 6E 6B .Unk00000C50 6E 6F 77 6E 20 68 6F 73 74 20 5B 25 73 5D 0D 0A nown host %s.00000C60 00 53 6F 63 6B 65 74 20 65 72 72 6F 72 2E 0D 0A .Socket error.00000C70 00 52 65 71 75 65 73 74 20 74 69 6D 65 64 20 6F .Request timed o00000C80 75 74 2E 0D 0A 00 44 65 73 74 69 6E 61