📄 web安全扫描器.asm

📁 采用win32汇编语言编写的一个脚本木马查杀工具。利用内存读取的扫描方式
💻 ASM
📖 第 1 页 / 共 3 页
字号:
12 3 下一页
;******************************************************
;程序编写by Asm
;日期：2006-12-16日凌晨
;出处：http://www.wolfexp.net/（红狼安全小组）
;注意事项：如欲转载，请保持本程序的完整，并注明：
;转载自 红狼安全小组(http://www.wolfexp.net/)
;******************************************************

.386
.model flat, stdcall
option casemap :none

include		windows.inc
include		user32.inc
includelib	user32.lib
include		kernel32.inc
includelib	kernel32.lib
include		shell32.inc
includelib	shell32.lib

include data.asm
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
		.code
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;打开目录对话框
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
GetOpenDirectoryName   proc  
      pushad   
      invoke   RtlZeroMemory,addr binfo,sizeof binfo 
      mov   binfo.ulFlags,BIF_RETURNFSANCESTORS or BIF_RETURNONLYFSDIRS   
      invoke   SHBrowseForFolder,addr binfo   
      invoke   SHGetPathFromIDList,eax,addr szPath  
      popad   
ret
GetOpenDirectoryName endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 处理找到的文件
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_ProcessFile	proc	_lpszFile
                  local   @hFile,@dwFileSize,@hMapFile,@lpMemory,hWnd
                   invoke  CreateFile,_lpszFile,GENERIC_READ,\ ;打开找到的文件
                            FILE_SHARE_READ or FILE_SHARE_WRITE,NULL,\
                            OPEN_EXISTING,FILE_ATTRIBUTE_ARCHIVE,NULL
                    .if     eax !=  INVALID_HANDLE_VALUE
                            mov     @hFile,eax
                            invoke  GetFileSize,eax,NULL
                            mov     @dwFileSize,eax
                            .if     eax
                           invoke  CreateFileMapping,@hFile,\
                                    NULL,PAGE_READONLY,0,0,NULL
                            .if     eax
                                    mov     @hMapFile,eax
                                    invoke  MapViewOfFile,eax,\
                                            FILE_MAP_READ,0,0,0
                                    .if     eax
                                            mov     @lpMemory,eax

  mov  ecx, @dwFileSize ;保存文件长度
  sub  ecx,12; 子字符串长度减 1
  mov  esi, @lpMemory ;保存共享句柄
@@:
  mov  edi, offset sz1 ;保存要检测的特征码
  push ecx
  push esi
  mov  ecx,13  ; 子字符串长度 不能超过40字节，否则出错
  repe cmpsb ;这里对比，如果不符合，就继续
  pop  esi
  pop  ecx
  je  @f
  inc  esi
  loop @b
@@:
.if ecx != 0 ;找到了特征码
invoke  CreateFile,addr szLogFile,GENERIC_WRITE,FILE_SHARE_READ,\ ;打开文件
            0,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
            mov hFile,eax
.if eax != NULL  
invoke lstrcat,addr lpBuffer1,_lpszFile ;串联
invoke lstrcat,addr lpBuffer1,addr sz1a
invoke lstrcat,addr lpBuffer1,addr sza
invoke lstrlen,addr lpBuffer1 ;计算lpBuffer的长度
mov hSize1,eax
invoke WriteFile,hFile,addr lpBuffer1,hSize1,addr lpNumberOfBytesRead,NULL ;写入文件到日志

invoke CloseHandle,hFile
.endif
.endif
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;继续检测的操作，代码一样
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  mov  ecx, @dwFileSize
  sub  ecx,16; 子字符串长度减 1
  mov  esi, @lpMemory
@@:
  mov  edi, offset sz2
  push ecx
  push esi
  mov  ecx,17  ; 子字符串长度
  repe cmpsb
  pop  esi
  pop  ecx
  je  @f
  inc  esi
  loop @b
@@:
.if ecx != 0
invoke  CreateFile,addr szLogFile,GENERIC_WRITE,FILE_SHARE_READ,\
            0,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
            mov hFile,eax
.if eax != NULL   
invoke lstrcat,addr lpBuffer2,_lpszFile
invoke lstrcat,addr lpBuffer2,addr sz2b
invoke lstrcat,addr lpBuffer2,addr szb
invoke lstrlen,addr lpBuffer2
mov hSize2,eax
invoke WriteFile,hFile,addr lpBuffer2,hSize2,addr lpNumberOfBytesRead,NULL

invoke CloseHandle,hFile
.endif
.endif

  mov  ecx, @dwFileSize
  sub  ecx,32; 子字符串长度减 1
  mov  esi, @lpMemory
@@:
  mov  edi, offset sz3
  push ecx
  push esi
  mov  ecx,33  ; 子字符串长度
  repe cmpsb
  pop  esi
  pop  ecx
  je  @f
  inc  esi
  loop @b
@@:
.if ecx != 0
invoke  CreateFile,addr szLogFile,GENERIC_WRITE,FILE_SHARE_READ,\
            0,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
            mov hFile,eax
.if eax != NULL   
invoke lstrcat,addr lpBuffer3,_lpszFile
invoke lstrcat,addr lpBuffer3,addr sz3c
invoke lstrcat,addr lpBuffer3,addr szc
invoke lstrlen,addr lpBuffer3
mov hSize3,eax
invoke WriteFile,hFile,addr lpBuffer3,hSize3,addr lpNumberOfBytesRead,NULL

invoke CloseHandle,hFile
.endif
.endif

  mov  ecx, @dwFileSize
  sub  ecx,29; 子字符串长度减 1
  mov  esi, @lpMemory
@@:
  mov  edi, offset sz4
  push ecx
  push esi
  mov  ecx,30  ; 子字符串长度
  repe cmpsb
  pop  esi
  pop  ecx
  je  @f
  inc  esi
  loop @b
@@:
.if ecx != 0
invoke  CreateFile,addr szLogFile,GENERIC_WRITE,FILE_SHARE_READ,\
            0,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
            mov hFile,eax
.if eax != NULL   
invoke lstrcat,addr lpBuffer4,_lpszFile
invoke lstrcat,addr lpBuffer5,addr sz4d
invoke lstrcat,addr lpBuffer5,addr szd
invoke lstrlen,addr lpBuffer5
mov hSize4,eax
invoke WriteFile,hFile,addr lpBuffer5,hSize4,addr lpNumberOfBytesRead,NULL

invoke CloseHandle,hFile
.endif
.endif

  mov  ecx, @dwFileSize
  sub  ecx,29; 子字符串长度减 1
  mov  esi, @lpMemory
@@:
  mov  edi, offset sz5
  push ecx
  push esi
  mov  ecx,30  ; 子字符串长度
  repe cmpsb
  pop  esi
  pop  ecx
  je  @f
  inc  esi
  loop @b
@@:
.if ecx != 0
invoke  CreateFile,addr szLogFile,GENERIC_WRITE,FILE_SHARE_READ,\
            0,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
            mov hFile,eax
.if eax != NULL   
invoke lstrcat,addr lpBuffer5,_lpszFile
invoke lstrcat,addr lpBuffer5,addr sz5e
invoke lstrcat,addr lpBuffer5,addr sze
invoke lstrlen,addr lpBuffer5
mov hSize5,eax
invoke WriteFile,hFile,addr lpBuffer5,hSize5,addr lpNumberOfBytesRead,NULL

invoke CloseHandle,hFile
.endif
.endif

  mov  ecx, @dwFileSize
  sub  ecx,15; 子字符串长度减 1
  mov  esi, @lpMemory
@@:
  mov  edi, offset sz6
  push ecx
  push esi
  mov  ecx,16 ; 子字符串长度
  repe cmpsb
  pop  esi
  pop  ecx
  je  @f
  inc  esi
  loop @b
@@:
.if ecx != 0
invoke  CreateFile,addr szLogFile,GENERIC_WRITE,FILE_SHARE_READ,\
            0,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
            mov hFile,eax
.if eax != NULL   
invoke lstrcat,addr lpBuffer6,_lpszFile
invoke lstrcat,addr lpBuffer6,addr sz6f
invoke lstrcat,addr lpBuffer6,addr szf
invoke lstrlen,addr lpBuffer6
mov hSize6,eax
invoke WriteFile,hFile,addr lpBuffer6,hSize6,addr lpNumberOfBytesRead,NULL

invoke CloseHandle,hFile
.endif
.endif

  mov  ecx, @dwFileSize
  sub  ecx,8; 子字符串长度减 1
  mov  esi, @lpMemory
@@:
  mov  edi, offset sz7
  push ecx
  push esi
  mov  ecx,9  ; 子字符串长度
  repe cmpsb
  pop  esi
  pop  ecx
  je  @f
  inc  esi
  loop @b
@@:
.if ecx != 0
invoke  CreateFile,addr szLogFile,GENERIC_WRITE,FILE_SHARE_READ,\
            0,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
            mov hFile,eax
.if eax != NULL   
invoke lstrcat,addr lpBuffer7,_lpszFile
invoke lstrcat,addr lpBuffer7,addr sz7g
invoke lstrcat,addr lpBuffer7,addr szg
invoke lstrlen,addr lpBuffer7
mov hSize7,eax
invoke WriteFile,hFile,addr lpBuffer7,hSize7,addr lpNumberOfBytesRead,NULL

invoke CloseHandle,hFile
.endif
.endif

  mov  ecx, @dwFileSize
  sub  ecx,17; 子字符串长度减 1
  mov  esi, @lpMemory
@@:
  mov  edi, offset sz8
  push ecx
  push esi
  mov  ecx,18  ; 子字符串长度
  repe cmpsb
  pop  esi
  pop  ecx
  je  @f
  inc  esi
  loop @b
@@:
.if ecx != 0
invoke  CreateFile,addr szLogFile,GENERIC_WRITE,FILE_SHARE_READ,\
            0,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
            mov hFile,eax
.if eax != NULL   
invoke lstrcat,addr lpBuffer8,_lpszFile
invoke lstrcat,addr lpBuffer8,addr sz8h
invoke lstrcat,addr lpBuffer8,addr szh
invoke lstrlen,addr lpBuffer8
mov hSize8,eax
invoke WriteFile,hFile,addr lpBuffer8,hSize8,addr lpNumberOfBytesRead,NULL
invoke RtlZeroMemory,addr lpBuffer8,sizeof lpBuffer8
invoke CloseHandle,hFile
.endif
.endif

  mov  ecx, @dwFileSize
  sub  ecx,8; 子字符串长度减 1
  mov  esi, @lpMemory
@@:
  mov  edi, offset sz9
  push ecx
  push esi
  mov  ecx,9  ; 子字符串长度
  repe cmpsb
  pop  esi
  pop  ecx
  je  @f
  inc  esi
  loop @b
@@:
.if ecx != 0
invoke  CreateFile,addr szLogFile,GENERIC_WRITE,FILE_SHARE_READ,\
            0,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
            mov hFile,eax
.if eax != NULL   
invoke lstrcat,addr lpBuffer9,_lpszFile
invoke lstrcat,addr lpBuffer9,addr sz9i
invoke lstrcat,addr lpBuffer9,addr szi
invoke lstrlen,addr lpBuffer9
mov hSize9,eax
invoke WriteFile,hFile,addr lpBuffer9,hSize9,addr lpNumberOfBytesRead,NULL
invoke RtlZeroMemory,addr lpBuffer9,sizeof lpBuffer9
invoke CloseHandle,hFile
.endif
.endif

  mov  ecx, @dwFileSize
  sub  ecx,13; 子字符串长度减 1
  mov  esi, @lpMemory
@@:
  mov  edi, offset sz10
  push ecx
  push esi
  mov  ecx,14  ; 子字符串长度
  repe cmpsb
  pop  esi
  pop  ecx
  je  @f
  inc  esi
  loop @b
@@:
.if ecx != 0
invoke  CreateFile,addr szLogFile,GENERIC_WRITE,FILE_SHARE_READ,\
            0,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
            mov hFile,eax
.if eax != NULL   
invoke lstrcat,addr lpBuffer10,_lpszFile
invoke lstrcat,addr lpBuffer10,addr sz10j
invoke lstrcat,addr lpBuffer10,addr szj
invoke lstrlen,addr lpBuffer10
mov hSize10,eax
invoke WriteFile,hFile,addr lpBuffer10,hSize10,addr lpNumberOfBytesRead,NULL
invoke CloseHandle,hFile
.endif
.endif

  mov  ecx, @dwFileSize
  sub  ecx,17; 子字符串长度减 1
  mov  esi, @lpMemory
@@:
  mov  edi, offset sz11
  push ecx
  push esi
  mov  ecx,18  ; 子字符串长度
  repe cmpsb
  pop  esi
  pop  ecx
  je  @f
  inc  esi
  loop @b
@@:
.if ecx != 0
invoke  CreateFile,addr szLogFile,GENERIC_WRITE,FILE_SHARE_READ,\
12 3 下一页
💿 文件大小 74 K
👤 上传用户 Tonic2009
📂 所属分类汇编语言
🏷️ 相关标签

#win #32 #汇编语言 #木马
⌨️ 快捷键说明

复制代码 Ctrl + C
搜索代码 Ctrl + F
全屏模式 F11
切换主题 Ctrl + Shift + D
显示快捷键 ?
增大字号 Ctrl + =
减小字号 Ctrl + -