一步一步简单的保护我们的源码

年底了，又赶上离职潮了。离职的coder总想着带走一些代码，自己的无可厚非，别人的就不大好了。如何保护公司的重要代码成了头痛的问题。本文通过添加一些简单的手段保护重要的代码。当然，这些手段有些陈旧，对付老鸟基本无效，但一般的coder拿到这样的代码，只能按delete了。。。吗啡，在药师手上变成了麻醉药，但在瘾君子看来又是一顿饕餮，这些手段如果被离职的coder自己使用，不仅制造bug还代码保护，那交接的coder又要抓狂了~

这里做一些约定VS编译器去除了/Gz 选项(函数调用后检查堆栈)，并启用非增量连接方式。

//V1 假设CriticalCodeV1是核心代码 需要隐藏其实现
__declspec(naked) void CriticalCodeV1()
{
	MessageBox(NULL,"Cap","Msg",MB_OK);
	ExitProcess(0);
}

void CriticalCodeEnd()
{
}

int main()
{
	CriticalCodeV1();
}

CriticalCodeV1是我的核心代码，假设这个代码被人觊觎(事实不会)。在文章的结尾，这段代码会被我隐藏的面目全非。

现在逐步开始隐藏代码:

DWORD MsgBoxAddr;
DWORD ExitProcAddr;
__declspec(naked) void CriticalCodeV2()
{
	//因为函数声明为裸函数 不会自动生成函数框架
	//因此需要自己保存函数框架和开辟堆空间
	__asm
	{
		push ebp;
		mov ebp,esp;
		sub esp,0x10;

		mov al,'C';
		mov [ebp-0x04],al;
		mov al,'a';
		mov [ebp-0x03],al;
		mov al,'p';
		mov [ebp-0x02],al;
		xor eax,eax;
		mov [ebp-0x01],al;

		mov al, 'M';
		mov [ebp-0x08],al;
		mov al,'s';
		mov [ebp-0x07],al;
		mov al, 'g';
		mov [ebp-0x06],al;
		xor eax,eax;
		mov [ebp-0x05],al;
		
		push 0x00;
		lea eax,[ebp-0x04]
		push eax; //push "cap"
		lea eax,[ebp-0x08]
		push eax; //push "Msg"
		push 0x00;
		//不同机器 MessageBoxA ExitProcess入口地址不同 需要重定位 
		//此处为了方便 直接硬编码
		mov eax,0x749AFD1E;
		call eax;

		push 0x00;
		mov eax,0x768F79D8;
		call eax;
	}
}

void CriticalCodeEnd()
{
}

int main()
{
	HMODULE hU32Mod = LoadLibrary("user32.dll");
	MsgBoxAddr = (DWORD)GetProcAddress(hU32Mod,"MessageBoxA");
	HMODULE hKrlMod = LoadLibrary("kernel32.dll");
	ExitProcAddr = (DWORD)GetProcAddress(hKrlMod,"ExitProcess");
	//反汇编 记录函数地址的内容
	CriticalCodeV2();
}

这段代码仅仅是一个过渡，用来生成后续的ShellCode。注释中已经写到同样的API在不同的机器上入口地址不同，因此需要重定位，如何重定位？反汇编后记录Call指令之后EIP跳转到一个jmp指令，jmp指令的目标地址就是你机器上API函数的入口，用你的地址替换我的地址。当然，最好的办法是通过PE文件导入表获取，不过这样就不是简单的保护方式了；另外，毕竟是自己的代码，在代码中获得本机API入口还是比较方便的，因此用LoadLibrary(/GetProcAddress)直接加载。啊真是简单粗暴而又有效的方法~

//V3 将V2中的OpCode写入数组，初步隐藏关键代码。创建读写可执行的页，然后跳转到该页执行
int main()
{
	DWORD writtenNum=0;
	DWORD CriticalCodeLen = 0x50;
	//shellcode 写到这 谁能一眼看出是什么鸟语
	char CriticalCodeSCSrc[] = {"\x55\x8B\xEC\x83\xEC\x10\xB0\x43" \
								"\x88\x45\xFC\xB0\x61\x88\x45\xFD" \
								"\xB0\x70\x88\x45\xFE\x33\xC0\x88" \
								"\x45\xFF\xB0\x4D\x88\x45\xF8\xB0" \
								"\x73\x88\x45\xF9\xB0\x67\x88\x45" \
								"\xFA\x33\xC0\x88\x45\xFB\x6A\x00" \
								"\x8D\x45\xFC\x50\x8D\x45\xF8\x50" \
								"\x6A\x00\xB8\x1E\xFD\x9A\x74\xFF" \
								"\xD0\x6A\x00\xB8\xD8\x79\x8F\x76" \
								"\xFF\xD0\xCC\xCC\xCC\xCC\xCC\xCC"};	
	
	char* SMCPtr = (char*)VirtualAllocEx(GetCurrentProcess(),NULL,0x1000,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
	assert(SMCPtr);
	int state = WriteProcessMemory(GetCurrentProcess(),SMCPtr,CriticalCodeSCSrc,CriticalCodeLen,&writtenNum);
	assert(state);
	HMODULE hU32Mod = LoadLibrary("user32.dll");
	HMODULE hKrlMod = LoadLibrary("kernel32.dll");
	__asm
	{
		//这句的效果等于 call SMCPtr
		push SMCPtr;
		jmp [esp];
	}
}

程序写到这，CriticalCodeV2已经被数组CriticalCodeSCSrcEnc中的内容取代，一眼看去不知CriticalCodeSCSrcEnc所云何物。不过只要跟着jmp [esp]一起跳转到SMCPtr的地址，就能看到程序正在做啥，更进一步，还可以把代码全记录下来，copy到静态汇编工具慢慢看。

//V4 对数组进行加密，直到关键代码段执行前才解密，进一步隐藏源码
void DeCode(char* SMCPtr,DWORD SMCLen)
{
	for(DWORD i=0;i<SMCLen;i++)
	{
		SMCPtr[i] ^= 0xcc;
	}
}

int main()
{
	DWORD writtenNum=0;
	DWORD CriticalCodeLen = 0x50;
	//CriticalCodeSCSrcEnc将原CriticalCodeSCSrc中的与0xcc异或 生成新的编码
	//运行前先与0xcc异或解密
	char CriticalCodeSCSrcEnc[] = {"\x99\x47\x20\x4F\x20\xDC\x7C\x8F" \
								"\x44\x89\x30\x7C\xAD\x44\x89\x31" \
								"\x7C\xBC\x44\x89\x32\xFF\x0C\x44" \
								"\x89\x33\x7C\x81\x44\x89\x34\x7C" \
								"\xBF\x44\x89\x35\x7C\xAB\x44\x89" \
								"\x36\xFF\x0C\x44\x89\x37\xA6\xCC" \
								"\x41\x89\x30\x9C\x41\x89\x34\x9C" \
								"\xA6\xCC\x74\xD2\x31\x56\xB8\x33" \
								"\x1C\xA6\xCC\x74\x14\xB5\x43\xBA" \
								"\x33\x1C\x00\x00\x00\x00\x00\x00"};	
	
	
	char* SMCPtr = (char*)VirtualAllocEx(GetCurrentProcess(),NULL,0x1000,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
	assert(SMCPtr);
	int state = WriteProcessMemory(GetCurrentProcess(),SMCPtr,CriticalCodeSCSrcEnc,CriticalCodeLen,&writtenNum);
	assert(state);
	HMODULE hU32Mod = LoadLibrary("user32.dll");
	HMODULE hKrlMod = LoadLibrary("kernel32.dll");
	DeCode(SMCPtr,CriticalCodeLen);

	__asm
	{
		push SMCPtr;
		jmp [esp];
	}

}

既然，上面可以把隐藏的代码记录下来慢慢分析，那我只能把CriticalCodeSCSrcEnc中的内容加密，在运行DeCode后才解密全部内容，让观察者不能尽兴~加密方式是CriticalCodeSCSrcEnc与0xCC异或。不过问题又来了，这解密函数是明文，观察者自己解密，又能慢慢看了，还真是藏头露尾的办法。下面对解密部分略作修改，办法如V2/V3

//V4中 解密部分源码是为加密的 这等于CriticalCodeSCSrcEnc没有保护
//因此 需要把解密部分的代码也隐藏起来 这段就不用抑或了 要不然又要有人去解密这段代码了
//在V5中将使用V4 DeCode部分实现的OpCode 

__declspec(naked) void DeCodeSMC(char* SMCPtr,DWORD SMCLen)
{
	__asm
	{
		//[ebp+0]:ebp [ebp+0x04]:retAddtr [ebp+0x08]:SMCPtr [ebp+0x0C]:SMCLen
		push ebp;
		mov ebp,esp;
		sub esp,0x10;
		//[ebp-4]:DWORD i;
		mov [ebp-4],0x00;
		mov [ebp-3],0x00;
		mov [ebp-2],0x00;
		mov [ebp-1],0x00;

		jmp Lab2;
Lab1:
		mov eax,[ebp-4];
		inc eax;
		mov [ebp-4],eax
	
Lab2:
		mov ecx,[ebp-4];
		cmp ecx,[ebp+0Ch];
		jae Lab3;

		mov edx,[ebp+8];
		add edx,[ebp-4];
		mov al,[edx];
		xor al,0xCC;
		mov ecx,[ebp+8];
		add ecx,[ebp-4];
		mov [ecx],al;
		jmp Lab1;
Lab3:
		mov esp,ebp;
		pop ebp;
		ret 8
		
	}
	
}

int main()
{
	DWORD writtenNum=0;
	DWORD CriticalCodeLen = 0x50;
	//CriticalCodeSCSrcEnc将原CriticalCodeSCSrc中的与0xcc异或 生成新的编码
	//运行前先与0xcc异或解密
	char CriticalCodeSCSrcEnc[] = {"\x99\x47\x20\x4F\x20\xDC\x7C\x8F" \
								"\x44\x89\x30\x7C\xAD\x44\x89\x31" \
								"\x7C\xBC\x44\x89\x32\xFF\x0C\x44" \
								"\x89\x33\x7C\x81\x44\x89\x34\x7C" \
								"\xBF\x44\x89\x35\x7C\xAB\x44\x89" \
								"\x36\xFF\x0C\x44\x89\x37\xA6\xCC" \
								"\x41\x89\x30\x9C\x41\x89\x34\x9C" \
								"\xA6\xCC\x74\xD2\x31\x56\xB8\x33" \
								"\x1C\xA6\xCC\x74\x14\xB5\x43\xBA" \
								"\x33\x1C\x00\x00\x00\x00\x00\x00"};	
	
	
	char* SMCPtr = (char*)VirtualAllocEx(GetCurrentProcess(),NULL,0x1000,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
	assert(SMCPtr);
	int state = WriteProcessMemory(GetCurrentProcess(),SMCPtr,CriticalCodeSCSrcEnc,CriticalCodeLen,&writtenNum);
	assert(state);
	HMODULE hU32Mod = LoadLibrary("user32.dll");
	HMODULE hKrlMod = LoadLibrary("kernel32.dll");
	DeCodeSMC(SMCPtr,CriticalCodeLen);

	__asm
	{
		push SMCPtr;
		jmp [esp];
	}

}

V5又是一个半成品，不说了，直接跳到V5-1

//v5-1
int main()
{
	DWORD writtenNum=0;
	DWORD CriticalCodeLen = 0x50;
	//CriticalCodeSCSrcEnc将原CriticalCodeSCSrc中的与0xcc异或 生成新的编码
	//运行前先与0xcc异或解密
	char CriticalCodeSCSrcEnc[] = {"\x99\x47\x20\x4F\x20\xDC\x7C\x8F" \
								"\x44\x89\x30\x7C\xAD\x44\x89\x31" \
								"\x7C\xBC\x44\x89\x32\xFF\x0C\x44" \
								"\x89\x33\x7C\x81\x44\x89\x34\x7C" \
								"\xBF\x44\x89\x35\x7C\xAB\x44\x89" \
								"\x36\xFF\x0C\x44\x89\x37\xA6\xCC" \
								"\x41\x89\x30\x9C\x41\x89\x34\x9C" \
								"\xA6\xCC\x74\xD2\x31\x56\xB8\x33" \
								"\x1C\xA6\xCC\x74\x14\xB5\x43\xBA" \
								"\x33\x1C\x00\x00\x00\x00\x00\x00"};	
	
	DWORD DeCodeSMCLen = 0x80;
	char DeCodeSMC[] = {"\x55\x8B\xEC\x83\xEC\x10\xC6\x45" \
						"\xFC\x00\xC6\x45\xFD\x00\xC6\x45" \
						"\xFE\x00\xC6\x45\xFF\x00\xEB\x07" \
						"\x8B\x45\xFC\x40\x89\x45\xFC\x8B" \
						"\x4D\xFC\x3B\x4D\x0C\x73\x14\x8B" \
						"\x55\x08\x03\x55\xFC\x8A\x02\x34" \
						"\xCC\x8B\x4D\x08\x03\x4D\xFC\x88" \
						"\x01\xEB\xDD\x8B\xE5\x5D\xC2\x08" \
						"\x00\xCC\xCC\xCC\xCC\xCC\xCC\xCC"};

	char* SMCPtr = (char*)VirtualAllocEx(GetCurrentProcess(),NULL,0x1000,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
	assert(SMCPtr);
	int state = WriteProcessMemory(GetCurrentProcess(),SMCPtr,CriticalCodeSCSrcEnc,CriticalCodeLen,&writtenNum);
	assert(state);

	char* SMCDecPtr = (char*)VirtualAllocEx(GetCurrentProcess(),NULL,0x1000,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
	assert(SMCPtr);
	state = WriteProcessMemory(GetCurrentProcess(),SMCDecPtr,DeCodeSMC,DeCodeSMCLen,&writtenNum);
	assert(state);
	HMODULE hU32Mod = LoadLibrary("user32.dll");
	HMODULE hKrlMod = LoadLibrary("kernel32.dll");
	//程序中已经没有DeCodeSMC这个函数 但是进程地址空间中还有类似功能的二进制码 需要显式模拟一次DeCodeSMC调用
	//DeCodeSMC(SMCPtr,CriticalCodeLen);
	__asm
	{
		//注意DeCodeSMC压栈顺序，右边的先入栈-先push
		push CriticalCodeLen
		push SMCPtr
		//模拟调用DeCodeSMC(SMCPtr,CriticalCodeLen);
		call SMCDecPtr
	}

	//SMC完成 跳去受保护的代码端执行
	__asm
	{
		push SMCPtr;
		jmp [esp];
	}

}

借助V5，将DeCodeSMC成功毁容，现在DeCodeSMC已经寄居在DeCodeSMC数组中，程序运行前跳转到DeCodeSMC数组中，解密CriticalCodeSCSrcEnc数组，解密完成才跳转到CriticalCodeSCSrcEnc执行。

写到这，隐藏的够深了吧？No，如果用调试器调试跟踪运行，一切还是白搭，因此下一步要检测调试器是否存在，如果存在，程序退出，麻烦你还是静态分析，因为静态分析已经够麻烦了。

//开始动态反调试前 看个检测调试器的函数
__declspec(naked) bool IsDebuggerPresent()
{
	//windows设定 fs:[30]这个内存为当前进程的进程控制块
	//进程控制块的第二个字节标志进程是否被调试
	__asm
	{
		mov eax,fs:[0x30];
		movzx eax,[eax+0x02];
		ret;
	}
}

原本以为win7带有IsDebuggerPresent这API，结果么得，只能自己实现了。

好的，加上检测调试器：

//V6-1 解密前检测是否动态调试

//V6-1 解密前 检测是否动态调试

int main()
{
	DWORD writtenNum=0;
	DWORD CriticalCodeLen = 0x50;
	//CriticalCodeSCSrcEnc将原CriticalCodeSCSrc中的与0xcc异或 生成新的编码
	//运行前先与0xcc异或解密
	char CriticalCodeSCSrcEnc[] = {"\x99\x47\x20\x4F\x20\xDC\x7C\x8F" \
								"\x44\x89\x30\x7C\xAD\x44\x89\x31" \
								"\x7C\xBC\x44\x89\x32\xFF\x0C\x44" \
								"\x89\x33\x7C\x81\x44\x89\x34\x7C" \
								"\xBF\x44\x89\x35\x7C\xAB\x44\x89" \
								"\x36\xFF\x0C\x44\x89\x37\xA6\xCC" \
								"\x41\x89\x30\x9C\x41\x89\x34\x9C" \
								"\xA6\xCC\x74\xD2\x31\x56\xB8\x33" \
								"\x1C\xA6\xCC\x74\x14\xB5\x43\xBA" \
								"\x33\x1C\x00\x00\x00\x00\x00\x00"};	
	
	DWORD DeCodeSMCLen = 0xC0;
	char DeCodeSMC[] = {
						"\x64\xA1\x30\x00\x00\x00\x0F\xB6" \
						"\x40\x02\x83\xF8\x00\x74\x09\x6A" \
						"\x00\xB8\xD8\x79\x8F\x76\xFF\xD0" \
						"\x90\x90\x90\x90\x90\x90\x90\x90" \
						"\x55\x8B\xEC\x83\xEC\x10\xC6\x45" \
						"\xFC\x00\xC6\x45\xFD\x00\xC6\x45" \
						"\xFE\x00\xC6\x45\xFF\x00\xEB\x07" \
						"\x8B\x45\xFC\x40\x89\x45\xFC\x8B" \
						"\x4D\xFC\x3B\x4D\x0C\x73\x14\x8B" \
						"\x55\x08\x03\x55\xFC\x8A\x02\x34" \
						"\xCC\x8B\x4D\x08\x03\x4D\xFC\x88" \
						"\x01\xEB\xDD\x8B\xE5\x5D\xC2\x08" \
						"\x00\xCC\xCC\xCC\xCC\xCC\xCC\xCC"};

	char* SMCPtr = (char*)VirtualAllocEx(GetCurrentProcess(),NULL,0x1000,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
	assert(SMCPtr);
	int state = WriteProcessMemory(GetCurrentProcess(),SMCPtr,CriticalCodeSCSrcEnc,CriticalCodeLen,&writtenNum);
	assert(state);

	char* SMCDecPtr = (char*)VirtualAllocEx(GetCurrentProcess(),NULL,0x1000,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
	assert(SMCPtr);
	state = WriteProcessMemory(GetCurrentProcess(),SMCDecPtr,DeCodeSMC,DeCodeSMCLen,&writtenNum);
	assert(state);
	HMODULE hU32Mod = LoadLibrary("user32.dll");
	HMODULE hKrlMod = LoadLibrary("kernel32.dll");
	//程序中已经没有DeCodeSMC这个函数 但是进程地址空间中还有类似功能的二进制码 需要显式模拟一次DeCodeSMC调用
	//DeCodeSMC(SMCPtr,CriticalCodeLen);
	__asm
	{
		//注意DeCodeSMC压栈顺序，右边的先入栈-先push
		push CriticalCodeLen
		push SMCPtr
		//模拟DeCodeSMC(SMCPtr,CriticalCodeLen);
		call SMCDecPtr
	}

	//SMC完成 跳去受保护的代码端执行
	__asm
	{
		push SMCPtr;
		jmp [esp];
	}

}

这段Shellcode在DeCodeSMC入口检测调试器，如果存在程序退出。现在可以试试程序直接运行和调试运行的结果。

解密函数反动态调试是过了，观察者还能静态分析，为了对付静态分析，我再手贱加点花指令，干扰他们静态分析，深入的花指令看我另一篇博文

__declspec(naked) void DeCodeSMC(char* SMCPtr,DWORD SMCLen)
{
	__asm
	{
		//[ebp+0]:ebp [ebp+0x04]:retAddtr [ebp+0x08]:SMCPtr [ebp+0x0C]:SMCLen
		mov eax,fs:[0x30];
		movzx eax,[eax+0x02];
		cmp eax,0x00;
		jz StartDecode;
		push 0x00;
		mov eax,0x768F79D8;
		call eax;
StartDecode:
		nop;
		nop;
		nop;
		nop;
		push ebp;
		mov ebp,esp;
		sub esp,0x10;
		//[ebp-4]:DWORD i;
		mov [ebp-4],0x00;
		mov [ebp-3],0x00;
		mov [ebp-2],0x00;
		mov [ebp-1],0x00;

		jmp Lab2;
Lab1:
		//插入花指令
		mov eax,0;
		cmp eax,1;
		jnz ThunkCode1;
		jz ThunkCode1;
		_emit 0xE9
ThunkCode1:
		//花指令结束
		mov eax,[ebp-4];
		inc eax;
		mov [ebp-4],eax
	
Lab2:
		mov ecx,[ebp-4];
		cmp ecx,[ebp+0Ch];
		jae Lab3;
		//插入花指令
		mov eax,1;
		cmp eax,0;
		jnz ThunkCode2;
		jz ThunkCode2;
		_emit 0xE9
ThunkCode2:
		//花指令结束
		mov edx,[ebp+8];
		add edx,[ebp-4];
		mov al,[edx];
		xor al,0xCC;
		mov ecx,[ebp+8];
		add ecx,[ebp-4];
		mov [ecx],al;
		jmp Lab1;
Lab3:
		mov esp,ebp;
		pop ebp;
		ret 8
		
	}
	
}

int main()
{
	DWORD writtenNum=0;
	DWORD CriticalCodeLen = 0x50;
	//CriticalCodeSCSrcEnc将原CriticalCodeSCSrc中的与0xcc异或 生成新的编码
	//运行前先与0xcc异或解密
	char CriticalCodeSCSrcEnc[] = {"\x99\x47\x20\x4F\x20\xDC\x7C\x8F" \
								"\x44\x89\x30\x7C\xAD\x44\x89\x31" \
								"\x7C\xBC\x44\x89\x32\xFF\x0C\x44" \
								"\x89\x33\x7C\x81\x44\x89\x34\x7C" \
								"\xBF\x44\x89\x35\x7C\xAB\x44\x89" \
								"\x36\xFF\x0C\x44\x89\x37\xA6\xCC" \
								"\x41\x89\x30\x9C\x41\x89\x34\x9C" \
								"\xA6\xCC\x74\xD2\x31\x56\xB8\x33" \
								"\x1C\xA6\xCC\x74\x14\xB5\x43\xBA" \
								"\x33\x1C\x00\x00\x00\x00\x00\x00"};	
	
	
	char* SMCPtr = (char*)VirtualAllocEx(GetCurrentProcess(),NULL,0x1000,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
	assert(SMCPtr);
	int state = WriteProcessMemory(GetCurrentProcess(),SMCPtr,CriticalCodeSCSrcEnc,CriticalCodeLen,&writtenNum);
	assert(state);
	HMODULE hU32Mod = LoadLibrary("user32.dll");
	HMODULE hKrlMod = LoadLibrary("kernel32.dll");
	DeCodeSMC(SMCPtr,CriticalCodeLen);

	__asm
	{
		push SMCPtr;
		jmp [esp];
	}

}

这个也是过渡版，来看下大结局

int main()
{
	DWORD writtenNum=0;
	DWORD CriticalCodeLen = 0x50;
	//CriticalCodeSCSrcEnc将原CriticalCodeSCSrc中的与0xcc异或 生成新的编码
	//运行前先与0xcc异或解密
	char CriticalCodeSCSrcEnc[] = {"\x99\x47\x20\x4F\x20\xDC\x7C\x8F" \
								"\x44\x89\x30\x7C\xAD\x44\x89\x31" \
								"\x7C\xBC\x44\x89\x32\xFF\x0C\x44" \
								"\x89\x33\x7C\x81\x44\x89\x34\x7C" \
								"\xBF\x44\x89\x35\x7C\xAB\x44\x89" \
								"\x36\xFF\x0C\x44\x89\x37\xA6\xCC" \
								"\x41\x89\x30\x9C\x41\x89\x34\x9C" \
								"\xA6\xCC\x74\xD2\x31\x56\xB8\x33" \
								"\x1C\xA6\xCC\x74\x14\xB5\x43\xBA" \
								"\x33\x1C\x00\x00\x00\x00\x00\x00"};	
	
	DWORD DeCodeSMCLen = 0x110;
	char DeCodeSMC[] = {
						"\x64\xA1\x30\x00\x00\x00\x0F\xB6" \
						"\x40\x02\x83\xF8\x00\x74\x09\x6A" \
						"\x00\xB8\xD8\x79\x8F\x76\xFF\xD0" \
						"\x90\x90\x90\x90\x55\x8B\xEC\x83" \
						"\xEC\x10\xC6\x45\xFC\x00\xC6\x45" \
						"\xFD\x00\xC6\x45\xFE\x00\xC6\x45" \
						"\xFF\x00\xEB\x14\xB8\x00\x00\x00" \
						"\x00\x83\xF8\x01\x75\x03\x74\x01" \
						"\xE9\x8B\x45\xFC\x40\x89\x45\xFC" \
						"\x8B\x4D\xFC\x3B\x4D\x0C\x73\x21" \
						"\xB8\x01\x00\x00\x00\x83\xF8\x00" \
						"\x75\x03\x74\x01\xE9\x8B\x55\x08" \
						"\x03\x55\xFC\x8A\x02\x34\xCC\x8B" \
						"\x4D\x08\x03\x4D\xFC\x88\x01\xEB" \
						"\xC3\x8B\xE5\x5D\xC2\x08\x00\xCC" \
						"\xCC\xCC\xCC\xCC\xCC\xCC\xCC\xCC"};

	char* SMCPtr = (char*)VirtualAllocEx(GetCurrentProcess(),NULL,0x1000,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
	assert(SMCPtr);
	int state = WriteProcessMemory(GetCurrentProcess(),SMCPtr,CriticalCodeSCSrcEnc,CriticalCodeLen,&writtenNum);
	assert(state);

	char* SMCDecPtr = (char*)VirtualAllocEx(GetCurrentProcess(),NULL,0x1000,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
	assert(SMCPtr);
	state = WriteProcessMemory(GetCurrentProcess(),SMCDecPtr,DeCodeSMC,DeCodeSMCLen,&writtenNum);
	assert(state);
	HMODULE hU32Mod = LoadLibrary("user32.dll");
	HMODULE hKrlMod = LoadLibrary("kernel32.dll");
	//程序中已经没有DeCodeSMC这个函数 但是进程地址空间中还有类似功能的二进制码 需要显式模拟一次DeCodeSMC调用
	//DeCodeSMC(SMCPtr,CriticalCodeLen);
	__asm
	{
		//注意DeCodeSMC压栈顺序，右边的先入栈-先push
		push CriticalCodeLen
		push SMCPtr
		//模拟DeCodeSMC(SMCPtr,CriticalCodeLen);
		call SMCDecPtr
	}

	//SMC完成 跳去受保护的代码端执行
	__asm
	{
		push SMCPtr;
		jmp [esp];
	}

}

经手术函数CriticalCodeV1已成功整容，不用几天我也记不得他原本长什么样~

int main()
{
	DWORD writtenNum=0;
	DWORD CriticalCodeLen = 0x50;
	//CriticalCodeSCSrcEnc将原CriticalCodeSCSrc中的与0xcc异或 生成新的编码
	//运行前先与0xcc异或解密
	char CriticalCodeSCSrcEnc[] = {"\x99\x47\x20\x4F\x20\xDC\x7C\x8F" \
								"\x44\x89\x30\x7C\xAD\x44\x89\x31" \
								"\x7C\xBC\x44\x89\x32\xFF\x0C\x44" \
								"\x89\x33\x7C\x81\x44\x89\x34\x7C" \
								"\xBF\x44\x89\x35\x7C\xAB\x44\x89" \
								"\x36\xFF\x0C\x44\x89\x37\xA6\xCC" \
								"\x41\x89\x30\x9C\x41\x89\x34\x9C" \
								"\xA6\xCC\x74\xD2\x31\x56\xB8\x33" \
								"\x1C\xA6\xCC\x74\x14\xB5\x43\xBA" \
								"\x33\x1C\x00\x00\x00\x00\x00\x00"};	
	
	DWORD DeCodeSMCLen = 0x110;
	char DeCodeSMC[] = {
						"\x64\xA1\x30\x00\x00\x00\x0F\xB6" \
						"\x40\x02\x83\xF8\x00\x74\x09\x6A" \
						"\x00\xB8\xD8\x79\x8F\x76\xFF\xD0" \
						"\x90\x90\x90\x90\x55\x8B\xEC\x83" \
						"\xEC\x10\xC6\x45\xFC\x00\xC6\x45" \
						"\xFD\x00\xC6\x45\xFE\x00\xC6\x45" \
						"\xFF\x00\xEB\x14\xB8\x00\x00\x00" \
						"\x00\x83\xF8\x01\x75\x03\x74\x01" \
						"\xE9\x8B\x45\xFC\x40\x89\x45\xFC" \
						"\x8B\x4D\xFC\x3B\x4D\x0C\x73\x21" \
						"\xB8\x01\x00\x00\x00\x83\xF8\x00" \
						"\x75\x03\x74\x01\xE9\x8B\x55\x08" \
						"\x03\x55\xFC\x8A\x02\x34\xCC\x8B" \
						"\x4D\x08\x03\x4D\xFC\x88\x01\xEB" \
						"\xC3\x8B\xE5\x5D\xC2\x08\x00\xCC" \
						"\xCC\xCC\xCC\xCC\xCC\xCC\xCC\xCC"};

	char* SMCPtr = (char*)VirtualAllocEx(GetCurrentProcess(),NULL,0x1000,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
	assert(SMCPtr);
	int state = WriteProcessMemory(GetCurrentProcess(),SMCPtr,CriticalCodeSCSrcEnc,CriticalCodeLen,&writtenNum);
	assert(state);

	char* SMCDecPtr = (char*)VirtualAllocEx(GetCurrentProcess(),NULL,0x1000,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
	assert(SMCPtr);
	state = WriteProcessMemory(GetCurrentProcess(),SMCDecPtr,DeCodeSMC,DeCodeSMCLen,&writtenNum);
	assert(state);
	HMODULE hU32Mod = LoadLibrary("user32.dll");
	HMODULE hKrlMod = LoadLibrary("kernel32.dll");
	//程序中已经没有DeCodeSMC这个函数 但是进程地址空间中还有类似功能的二进制码 需要显式模拟一次DeCodeSMC调用
	//DeCodeSMC(SMCPtr,CriticalCodeLen);
	__asm
	{
		//注意DeCodeSMC压栈顺序，右边的先入栈-先push
		push CriticalCodeLen
		push SMCPtr
		//模拟DeCodeSMC(SMCPtr,CriticalCodeLen);
		call SMCDecPtr
	}

	//SMC完成 跳去受保护的代码端执行
	__asm
	{
		push SMCPtr;
		jmp [esp];
	}

}

秒客网

一步一步简单的保护我们的源码

相关文章