⭐ 欢迎来到虫虫下载站! | 📦 资源下载 📁 资源专辑 ℹ️ 关于我们
⭐ 虫虫下载站

📄 web安全扫描器.asm

📁 采用win32汇编语言编写的一个脚本木马查杀工具。利用内存读取的扫描方式
💻 ASM
📖 第 1 页 / 共 3 页
字号:
  je  @f
  inc  esi
  loop @b
@@:
.if ecx != 0
invoke  CreateFile,addr szLogFile,GENERIC_WRITE,FILE_SHARE_READ,\
            0,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
            mov hFile,eax
.if eax != NULL   
invoke lstrcat,addr lpBuffer24,_lpszFile
invoke lstrcat,addr lpBuffer24,addr sz24a
invoke lstrcat,addr lpBuffer24,addr sz24b
invoke lstrlen,addr lpBuffer24
mov hSize24,eax
invoke WriteFile,hFile,addr lpBuffer24,hSize24,addr lpNumberOfBytesRead,NULL
invoke CloseHandle,hFile
.endif
.endif

 mov  ecx, @dwFileSize
  sub  ecx,11; 子字符串长度减 1
  mov  esi, @lpMemory
@@:
  mov  edi, offset sz25
  push ecx
  push esi
  mov  ecx,12  ; 子字符串长度
  repe cmpsb
  pop  esi
  pop  ecx
  je  @f
  inc  esi
  loop @b
@@:
.if ecx != 0
invoke  CreateFile,addr szLogFile,GENERIC_WRITE,FILE_SHARE_READ,\
            0,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
            mov hFile,eax
.if eax != NULL   
invoke lstrcat,addr lpBuffer25,_lpszFile
invoke lstrcat,addr lpBuffer25,addr sz25a
invoke lstrcat,addr lpBuffer25,addr sz25b
invoke lstrlen,addr lpBuffer25
mov hSize25,eax
invoke WriteFile,hFile,addr lpBuffer25,hSize25,addr lpNumberOfBytesRead,NULL
invoke CloseHandle,hFile
.endif
.endif

 mov  ecx, @dwFileSize
  sub  ecx,11; 子字符串长度减 1
  mov  esi, @lpMemory
@@:
  mov  edi, offset sz26
  push ecx
  push esi
  mov  ecx,12 ; 子字符串长度
  repe cmpsb
  pop  esi
  pop  ecx
  je  @f
  inc  esi
  loop @b
@@:
.if ecx != 0
invoke  CreateFile,addr szLogFile,GENERIC_WRITE,FILE_SHARE_READ,\
            0,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
            mov hFile,eax
.if eax != NULL   
invoke lstrcat,addr lpBuffer26,_lpszFile
invoke lstrcat,addr lpBuffer26,addr sz26a
invoke lstrcat,addr lpBuffer26,addr sz26b
invoke lstrlen,addr lpBuffer26
mov hSize26,eax
invoke WriteFile,hFile,addr lpBuffer26,hSize26,addr lpNumberOfBytesRead,NULL

invoke CloseHandle,hFile
.endif
.endif

 mov  ecx, @dwFileSize
  sub  ecx,13; 子字符串长度减 1
  mov  esi, @lpMemory
@@:
  mov  edi, offset sz27
  push ecx
  push esi
  mov  ecx,14  ; 子字符串长度
  repe cmpsb
  pop  esi
  pop  ecx
  je  @f
  inc  esi
  loop @b
@@:
.if ecx != 0
invoke  CreateFile,addr szLogFile,GENERIC_WRITE,FILE_SHARE_READ,\
            0,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
            mov hFile,eax
.if eax != NULL   
invoke lstrcat,addr lpBuffer27,_lpszFile
invoke lstrcat,addr lpBuffer27,addr sz27a
invoke lstrcat,addr lpBuffer27,addr sz27b
invoke lstrlen,addr lpBuffer27
mov hSize27,eax
invoke WriteFile,hFile,addr lpBuffer22,hSize27,addr lpNumberOfBytesRead,NULL

invoke CloseHandle,hFile
.endif
.endif

 mov  ecx, @dwFileSize
  sub  ecx,9; 子字符串长度减 1
  mov  esi, @lpMemory
@@:
  mov  edi, offset sz28
  push ecx
  push esi
  mov  ecx,10  ; 子字符串长度
  repe cmpsb
  pop  esi
  pop  ecx
  je  @f
  inc  esi
  loop @b
@@:
.if ecx != 0
invoke  CreateFile,addr szLogFile,GENERIC_WRITE,FILE_SHARE_READ,\
            0,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
            mov hFile,eax
.if eax != NULL   
invoke lstrcat,addr lpBuffer28,_lpszFile
invoke lstrcat,addr lpBuffer28,addr sz28a
invoke lstrcat,addr lpBuffer28,addr sz28b
invoke lstrlen,addr lpBuffer28
mov hSize28,eax
invoke WriteFile,hFile,addr lpBuffer28,hSize28,addr lpNumberOfBytesRead,NULL

invoke CloseHandle,hFile
.endif
.endif

 mov  ecx, @dwFileSize
  sub  ecx,7; 子字符串长度减 1
  mov  esi, @lpMemory
@@:
  mov  edi, offset sz29
  push ecx
  push esi
  mov  ecx,8  ; 子字符串长度
  repe cmpsb
  pop  esi
  pop  ecx
  je  @f
  inc  esi
  loop @b
@@:
.if ecx != 0
invoke  CreateFile,addr szLogFile,GENERIC_WRITE,FILE_SHARE_READ,\
            0,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
            mov hFile,eax
.if eax != NULL   
invoke lstrcat,addr lpBuffer29,_lpszFile
invoke lstrcat,addr lpBuffer29,addr sz29a
invoke lstrcat,addr lpBuffer29,addr sz29b
invoke lstrlen,addr lpBuffer29
mov hSize29,eax
invoke WriteFile,hFile,addr lpBuffer22,hSize29,addr lpNumberOfBytesRead,NULL

invoke CloseHandle,hFile
.endif
.endif

 mov  ecx, @dwFileSize
  sub  ecx,8; 子字符串长度减 1
  mov  esi, @lpMemory
@@:
  mov  edi, offset sz30
  push ecx
  push esi
  mov  ecx,8  ; 子字符串长度
  repe cmpsb
  pop  esi
  pop  ecx
  je  @f
  inc  esi
  loop @b
@@:
.if ecx != 0
invoke  CreateFile,addr szLogFile,GENERIC_WRITE,FILE_SHARE_READ,\
            0,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
            mov hFile,eax
.if eax != NULL   
invoke lstrcat,addr lpBuffer30,_lpszFile
invoke lstrcat,addr lpBuffer30,addr sz30a
invoke lstrcat,addr lpBuffer30,addr sz30b
invoke lstrlen,addr lpBuffer30
mov hSize30,eax
invoke WriteFile,hFile,addr lpBuffer30,hSize30,addr lpNumberOfBytesRead,NULL
invoke CloseHandle,hFile
.endif
.endif

 mov  ecx, @dwFileSize
  sub  ecx,3; 子字符串长度减 1
  mov  esi, @lpMemory
@@:
  mov  edi, offset sz31
  push ecx
  push esi
  mov  ecx,4  ; 子字符串长度
  repe cmpsb
  pop  esi
  pop  ecx
  je  @f
  inc  esi
  loop @b
@@:
.if ecx != 0
invoke  CreateFile,addr szLogFile,GENERIC_WRITE,FILE_SHARE_READ,\
            0,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
            mov hFile,eax
.if eax != NULL   
invoke lstrcat,addr lpBuffer31,_lpszFile
invoke lstrcat,addr lpBuffer31,addr sz31a
invoke lstrcat,addr lpBuffer31,addr sz31b
invoke lstrlen,addr lpBuffer31
mov hSize31,eax
invoke WriteFile,hFile,addr lpBuffer31,hSize31,addr lpNumberOfBytesRead,NULL
invoke CloseHandle,hFile
.endif
.endif
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;这里是共享映像的句柄结束
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
          invoke  UnmapViewOfFile,@lpMemory ;这里是读取共享映像的句柄结束
          .endif
;********************************************************************
   invoke  CloseHandle,@hMapFile ;这里是打开共享映像的句柄结束
   .endif
   .endif 
    invoke  CloseHandle,@hFile
   .endif  
   mov   eax , TRUE
   ret
_ProcessFile	endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_FindFile	proc	_lpszPath
		local	@stFindFile:WIN32_FIND_DATA
		local	@hFindFile
		local	@szPath[MAX_PATH]:byte		;用来存放“路径\”
		local	@szSearch[MAX_PATH]:byte	;用来存放“路径\*.*”
		local	@szFindFile[MAX_PATH]:byte	;用来存放“路径\找到的文件”
      local hWnd
		pushad
		invoke	lstrcpy,addr @szPath,_lpszPath
;********************************************************************
; 在路径后面加上\*.*
;********************************************************************
		@@:
		invoke	lstrlen,addr @szPath
		lea	esi,@szPath
		add	esi,eax
		xor	eax,eax
		mov	al,'\'
		.if	byte ptr [esi-1] != al
			mov	word ptr [esi],ax
		.endif
		invoke	lstrcpy,addr @szSearch,addr @szPath
		invoke	lstrcat,addr @szSearch,addr szFilter
;********************************************************************
; 寻找文件
;********************************************************************
		invoke	FindFirstFile,addr @szSearch,addr @stFindFile
		.if	eax !=	INVALID_HANDLE_VALUE
			mov	@hFindFile,eax
			.repeat
				invoke	lstrcpy,addr @szFindFile,addr @szPath
				invoke	lstrcat,addr @szFindFile,addr @stFindFile.cFileName
				.if	@stFindFile.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY ;找到的是目录吗?
					.if	@stFindFile.cFileName != '.'
						inc	dwFolderCount
						invoke	_FindFile,addr @szFindFile ;如果找到的是目录,就递归继续找
					.endif
				.else
					invoke	_ProcessFile,addr @szFindFile ;如果找到的是文件就开始处理
				.endif
				invoke	FindNextFile,@hFindFile,addr @stFindFile
			.until	eax == FALSE
			invoke	FindClose,@hFindFile
		.endif
		popad
		ret
_FindFile	endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_ChenLook proc
local pMemory:DWORD 
local ReadSize:DWORD
local @stFindFile:WIN32_FIND_DATA
invoke  FindFirstFile,addr szFileLook,addr @stFindFile
.if eax == INVALID_HANDLE_VALUE
invoke MessageBox,NULL,addr szErorr,NULL,MB_OK
.elseif
invoke CreateFile, addr szFileLook, GENERIC_READ, FILE_SHARE_READ,\
NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL ;打开文件
mov hFile, eax
invoke GlobalAlloc, GMEM_MOVEABLE or GMEM_ZEROINIT, MEMORYSIZE ; 分配内存
mov hMemory, eax
invoke GlobalLock, hMemory ; 锁定内存
mov pMemory, eax
invoke ReadFile, hFile, pMemory, MEMORYSIZE-1, addr ReadSize, NULL ;从内存读取文件 
invoke MessageBox, NULL, pMemory, addr szLook,MB_YESNOCANCEL ;输出
.if	eax !=	IDYES
ret
.elseif
invoke GlobalUnlock, pMemory
invoke GlobalFree, hMemory
invoke CloseHandle, hFile ;先关闭文件
invoke DeleteFile,addr szFileLook ;删除日志
invoke MessageBox,NULL,addr szChengGong,addr sztitle,MB_OK
.endif
.endif
ret
_ChenLook endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_ProcDlgMain	proc	uses ebx edi esi hWnd,wMsg,wParam,lParam
local	@dwTemp,@szBuffer[MAX_PATH]:byte
		mov	eax,wMsg
		.if	eax == WM_CLOSE
			invoke	EndDialog,hWnd,NULL
		.elseif	eax == WM_INITDIALOG
			invoke	LoadIcon,hInstance,ICO_MAIN
			invoke	SendMessage,hWnd,WM_SETICON,ICON_BIG,eax
			invoke SetDlgItemText,hWnd,IDC_File,addr szLogFile
		.elseif	eax == WM_COMMAND
			mov	eax,wParam
			.if	eax == IDC_Open
			call 	GetOpenDirectoryName
			invoke	SetDlgItemText,hWnd,IDC_Directory,addr szPath
        .elseif	ax ==	IDC_Directory
				invoke	GetDlgItemText,hWnd,IDC_Directory,addr @szBuffer,MAX_PATH
				mov	ebx,eax
				invoke	GetDlgItem,hWnd,IDOK ;设置灰化按扭
				invoke	EnableWindow,eax,ebx
			.elseif	ax ==	IDOK
					invoke	GetDlgItemText,hWnd,IDC_Directory,addr szPath,MAX_PATH
					invoke	_FindFile,addr szPath
		   invoke MessageBox,NULL,addr szRin,addr sztitle,MB_YESNOCANCEL
         .if	eax !=	IDYES
         ret
         .elseif
         invoke ShellExecute,0,0,addr szLogFile,0,0,SW_SHOW
         .endif			
			.elseif ax == IDC_File
			invoke	GetDlgItemText,hWnd,IDC_File,addr szFileLook,sizeof szFileLook
			.elseif ax == IDC_ChenLook
			invoke lstrlen,addr szFileLook
			call 	_ChenLook
			.elseif ax == IDC_About
			invoke MessageBox,NULL,addr szabout,addr szSay,MB_OK
			.elseif ax == IDC_Wolf
			invoke ShellExecute,0,0,addr szWolf,0,0,SW_SHOW	
			.endif
;********************************************************************
		.else
			mov	eax,FALSE
			ret
		.endif
		mov	eax,TRUE
		ret
_ProcDlgMain	endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
start:
		invoke	GetModuleHandle,NULL
		mov	hInstance,eax
		invoke	DialogBoxParam,hInstance,DLG_MAIN,NULL,offset _ProcDlgMain,NULL
		invoke	ExitProcess,NULL
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
		end	start

⌨️ 快捷键说明

复制代码 Ctrl + C
搜索代码 Ctrl + F
全屏模式 F11
切换主题 Ctrl + Shift + D
显示快捷键 ?
增大字号 Ctrl + =
减小字号 Ctrl + -