相关课件和源码第16课

1、梦织未来(作者：mengwuji)第十六课调试对象类型中隐藏的kd d!_object_type+0 x000 TypeList+0 x008 Name+0 x010 DefaultObject+0 x014 Index+0 x018 TotalNumberOfObjects+0 x01c TotalNumberOfHandles+0 x020 HighWaterNumberOfObjects+0 x024 HighWaterNumberOfHandles+0 x028 TypeInfo+0 x078 TypeLock+0 x07c Key+0 x080 CallbackList: _LIST

2、_ENTRY: _UNICODE_STRING: Ptr32 Void: UChar: U: U: U: U4B4B4B4B: _OBJECT_TYPE_INITIALIZER: _EX_PUSH_LOCK: U4B: _LIST_ENTRY本课内容有如下两点：反检测Pp 保护，它在启动的时候，会获取到调试对象类型中的 TotalNumberOfObjects和TotalNumberOfHandles 的值，然后对这两个值不断的检测，只要有改变，那么就会重启。躲过检测方法：方法 1：Hook 掉更改 TotalNumberOfObjects和 TotalNumberOfHandles值的地方，

3、不让其更改。kdnt!ObpAllocateObject+0 x209:8423c25b 8d4e18TotalNumberOfObjects 8423c25e 8978148423c261 8958108423c264 8bf98423c266 f00fc117TotalNumberOfObjectsleaecx,esi+18h/得到的地址mov movmovdword ptr eax+14h,edi dword ptr eax+10h,ebxedi,ecxlock xadd dword ptr edi,edx/递增8423c26a 8b098423c26c 3b4e208423c26f 7

4、603movcmp jbeecx,dword ptr ecx ecx,dword ptr esi+20hnt!ObpAllocateObject+0 x222 (8423c274)nt!ObpIncremen 8421dbc4 8d41408421dbc7 39008421dbc9 7405ndleCountEx+0 x435:lea cmp je callxorleaeax,ecx+40hdword ptr eax,eaxnt!ObpIncremenndleCountEx+0 x441 (8421dbd0)8421dbcb e88ac7e2ff8421dbd0 33c0 8421dbd2 8

5、d4f1cnt!KiCheckForKernelApcDelivery (8404a35a)eax,eaxecx,edi+1Ch/得到TotalNumberOfHandles 8421dbd5 40 8421dbd6 f00fc101TotalNumberOfHandles 8421dbda 408421dbdb 3b4724的地址inceaxlock xadd dword ptr ecx,eax/递增inccmpeaxeax,dword ptr edi+24hnt!ObpDecremen 8426b e840fce0ff84270000 5684270001 e8441a84270006 8

6、3c71cTotalNumberOfHandles 84270009 83c8ff8427000c f00fc107TotalNumberOfHandles 84270010 5f84270011 5bndleCount+0 x145:callpush calladdnt!KeUnstackDetachProesis (8407fc40)fnt!ObpDeleteNameCheck (84261a4a)edi,1Ch/得到的地址oreax,0FFhlock xadd dword ptr edi,eax/递减poppopediebxnt!ObpFreeObject+0 x135:8422628e

7、 8d4818leaecx,eax+18h/得到TotalNumberOfObjects 84226291 83caff84226294 f00fc111TotalNumberOfObjects 84226298 f6460f018422629c 746e8422629e 8b4610842262a1 85c0的地址oredx,0FFhlock xadd dword ptr ecx,edx/递减test je mov testjebyte ptr esi+0Fh,1 nt!ObpFreeObject+0 x1b3 (8422630c)eax,dword ptr esi+10h eax,eaxn

8、t!ObpFreeObject+0 x1f1 (8422634a)842262a3 0f84a1000000方法 2：用一个新的调试对象类型。反反调试#define SYNCHRONIZE#define STANDARD_RIGHTS_REQUIRED#define DEBUG_READ_EVENT(0 x00100000L) (0 x000F0000L) (0 x0001) (0 x0002) (0 x0004) (0 x0008)DEBUG_ALL_AC#define DEBUG_PROS_ASSIGN#define DEBUG_SET_INFORMATION #define DEBUG_QUERY_INFORMATION#defineS(STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|DEBUG_READ_EVENT|DEBUG_PROS_ASSIGN|DEBUG_SET_INFORMATION|DEBUG_QUERY_INFORMATION)对 ValidAc1，哪里sMask