强大的ida pro及插件,难道以后的驱动都要加密不成?

下面是反编译后的代码

int __stdcall SfPassThrough(int a1, int a2)
{
  int v2; // eax@1
  int v3; // ecx@1
  int result; // eax@2
  int v5; // eax@4
  int v6; // eax@4

  v3 = a1;
  v2 = *(_DWORD *)(a1 + 40);
  if ( a1 == (_DWORD)gSFilterControlDeviceObject )
  {
    *(_DWORD *)(a2 + 24) = 0;
    *(_DWORD *)(a2 + 28) = 0;
    IofCompleteRequest(a2, 0);
    result = 0;
  }
  else
  {
    if ( *(_DWORD *)(v2 + 28) == 20 )
    {
      v6 = *(_DWORD *)(v2 + 44);
      ++*(_BYTE *)(a2 + 35);
      *(_DWORD *)(a2 + 96) += 36;
      v5 = *(_DWORD *)(v6 + 40);
    }
    else
    {
      ++*(_BYTE *)(a2 + 35);
      *(_DWORD *)(a2 + 96) += 36;
      v5 = *(_DWORD *)(v3 + 40);
    }
    result = IofCallDriver(*(_DWORD *)(v5 + 4));
  }
  return result;
}

下面是原始代码:

NTSTATUS
SfPassThrough (
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP Irp
    )

/*++

Routine Description:

    This routine is the main dispatch routine for the general purpose file
    system driver.  It simply passes requests onto the next driver in the
    stack, which is presumably a disk file system.

Arguments:

    DeviceObject - Pointer to the device object for this driver.

    IRP - Pointer to the request packet representing the I/O request.

Return Value:

    The function value is the status of the operation.

Note:

    A note to file system filter implementers:
        This routine actually "passes" through the request by taking this
        driver out of the IRP stack.  If the driver would like to pass the
        I/O request through, but then also see the result, then rather than
        taking itself out of the loop it could keep itself in by copying the
        caller's parameters to the next stack location and then set its own
        completion routine.

        Hence, instead of calling:

            IoSkipCurrentIrpStackLocation( Irp );

        You could instead call:

            IoCopyCurrentIrpStackLocationToNext( Irp );
            IoSetCompletionRoutine( Irp, NULL, NULL, FALSE, FALSE, FALSE );


        This example actually NULLs out the caller's I/O completion routine, but
        this driver could set its own completion routine so that it would be
        notified when the request was completed (see SfCreate for an example of
        this).

--*/

{
    PIO_STACK_LOCATION pIrp = IoGetCurrentIrpStackLocation( Irp );
    PSFILTER_DEVICE_EXTENSION devExt = (PSFILTER_DEVICE_EXTENSION)DeviceObject->DeviceExtension;

    if (IS_MY_CONTROL_DEVICE_OBJECT(DeviceObject)) {

        Irp->IoStatus.Status = STATUS_SUCCESS;
        Irp->IoStatus.Information = 0;

        IoCompleteRequest( Irp, IO_NO_INCREMENT );

        return STATUS_SUCCESS;
    }

    ASSERT(IS_MY_DEVICE_OBJECT( DeviceObject ));

    //
    //  File systems should NEVER receive a power IRP
    //

    ASSERT(pIrp->MajorFunction != IRP_MJ_POWER);

    //
    // pass through shadow device
    //

    if ( devExt->Flags == DEVICE_TYPE_SHADOW ) {

        PDEVICE_OBJECT devObj = devExt->filterDevice;

        IoSkipCurrentIrpStackLocation( Irp );

        return IoCallDriver( ((PSFILTER_DEVICE_EXTENSION) devObj->DeviceExtension)->NLExtHeader.AttachedToDeviceObject,
            Irp );
    }

    //
    //  Get this driver out of the driver stack and get to the next driver as
    //  quickly as possible.
    //

    IoSkipCurrentIrpStackLocation( Irp );

    //
    //  Call the appropriate file system driver with the request.
    //

    return IoCallDriver( ((PSFILTER_DEVICE_EXTENSION) DeviceObject->DeviceExtension)->NLExtHeader.AttachedToDeviceObject,
                          Irp );
}

以上代码用ida pro 5.2 及hex decompiler 插件生成

试用了一下Hex-Rays插件，的确很爽，呵呵

插件在哪里下载呢？

引用第4楼pdodge于2008-01-31 15:00发表的  :
插件在哪里下载呢？

0GiNr的论坛有下载


不过过这个插件也庭容易的。。

加花吧。

呵呵，的确，加花的话要动态跟踪才能看得出

Hexrays处理两样东西很蹩脚：宏和Switch语句，很多Switch语句被当作If语句处理了，结果弄出来的程序很难读；宏当然是没法处理的，还得手工反。另外如果程序里面使用了SEH，他也是识别不出来的。总之，我认为Hexrays还很年轻，是一个需要多年发展才能成熟起来的东西（和IDA一样）。上面说的只是控制流的分析，数据流分析现在尽管已经做得越来越强，但是对结构体的处理还是不太好，没有自识别结构体的能力，另外对类的处理简直就是一塌糊涂（好在驱动里面用类的比较少）。杂项方面，函数参数的识别有时候会把寄存器参数识别成this指针，弄得初学者不知所谓，另外最讨厌的事莫过于Hexrays缺省的把所有的Mov esi,[memory]之类的指令中的寄存器识别成寄存器变量，弄得一个变量变出来好几个，看得很多人头晕（好在IDA的关键字标黄功能让人能够比较容易找出问题）。作为手工反编译的辅助工具，他的确能提高效率，但是，如果对于初学反编译或者没有反编译经验的人，拿到Hexrays反出来的东西，基本上都会晕死。

早说嘛，有这个插件，太棒了，原来看汇编看得头都大了，谢谢啊，以后50k以下的驱动不加密就没有什么可以保密了

logicfeeling说的不错，的确有些问题，我还遇到问题，就是Goto和LABEL的问题，LABEL经常会放到IFELSE嵌套的里面，弄的很难看，必须手工改流程，不过这只是不方便。另外就是压栈和赋值的顺序有时会弄反，这个是致命错误，会导致结果不对。

这插件工具结构体的偏移有问题，害死我了，0c它自动除以4得到3，3还是3，我反的结构体很大的，四位16进制数，以后的朋友注意

最少基本结构和函数调用以及一般流程都和清晰啦！
很好，很强大！
 

Code Virtualizer可以加密windows驱动程序。这样即使你使用hex decompiler ，也看不懂代码。

引用第8楼zhoujiamurong于2008-03-27 17:31发表的  :
早说嘛，有这个插件，太棒了，原来看汇编看得头都大了，谢谢啊，以后50k以下的驱动不加密就没有什么可以保密了

Hex-Rays.Decompiler的插件我现在上传上来