那些年，我們一起寫的外掛

HITCON 2015 CMT presentation

This slide licensed under CC 4.0 BY-NC-ND (https://creativecommons.org/licenses/by-nc-nd/4.0/)

Transcript

1. 齡❉䎃䧮⦛♧饱㻨涸㢫䱦 䨾⟃䧮ⵌ䏁捀➊랃剚⿡㻨㢫䱦ㅎ
2. 䨾⟃➛㣔 )J
   *
   BN
   *OOEZ加啄
   麕⿡僽⦐⚥✳涸㼱䎃
   䧮⦛⢵翝翝㢫䱦
   〳䞼䧮尝剤く䟅눦卓㻜
4. .F
   BOE
   NZ
   QBTU
5. 7#
   
   귄「䮲䫔涸
   $
   铃鎊 穅倴⼮秹ⵌ
   7#/&5 $
   
   $
   #VJMEFS 1)1
   
   +BWB4DSJQU 㥪⫹䖎⿐㹳涸1ZUIPO 惐ⵌⴀ宐涸3VCZ
   XJUI
   3BJMT "/%
   ,&&1
   0/
6. 7# 1ZUIPO $ $ 3VCZ +BWB4DSJQU 1)1 MJTQ +BWB "TTFNCMZ %FMQIJ 3FWFSTJOH 8FC
   4FDVSJUZ -JOVY
7. ˊ*OOEZ
    ⨞㡏✲僽鹎姿涸⾲⹛⸂
   
8. 䱺♴⢵雊䧮⦛䎍♧❉㡏✲
11. ⡹剤欽麕鸏Ⰽ⦐㢫䱦㌨
12. 嫲鯱䓽罏䧮剦⿼ㄤ䧮涸⡲ㅷ
13. ⵹罏涸鋕璭嫲⢿嫲鯱洅Ꟁ 㔔捀齡儘⦬䧮涸瘘ꨶ〫剤
    Y
     ⡹剚涮植
14. 荈⹛⻋麬⿾䌢椚涸麉䨡遤捀 (BNF
    )BDL
15. 溫僽〳䠦涸剤麬䌢椚㉇
    
16. 雊䚓暟䱈♴⢵
17. 㕮余乹
    
    余乹⸈鸠
18. 荈⹛䱦堥 捀✫眏溁儘꟦⟃
    Y
    鸠䏞久佞
19. 騟➃"䨾⟃⡹捀➊랃銴Ꟛ㢫䱦 Ꟛ㢫䱦馄颫涸 䎍⿶僽娦㢫䱦 梖麉䨡♶腋㥪㥪梖㌨ (.剤➃Ꟛ㢫䱦㉇ 䧮銴增莊⡹ 䊼暶晝⚺僽㢫䱦俒䘰⢵ⵅꤑ
20. 㔔捀麉䨡梖♶飷ず㷸
21. 䨾⟃〫㥪Ꟛ㢫䱦 չ✳墂պ
22. 䟝䟝Ⱖ㻜⛳僽䯆ㅶ⫊涸
23. 㣖ㅶ⫊✫䨾⟃⢵ꦷ頥ゅ 瘞瘞㥪⫹剤➊랃匌銯䵆ꐫ✫
24. Ꟛ㢫䱦涸䠮錏㽠⫹僽
25. ♧⦐➃䬓✫嵳鮪籏鿈
26. ⡎僽⩑晋剚鄄⯕鸠驫ⵌ
27. 0I
    䧮僽铞鄄(.ꓳ䌙贫
28. 騟➃#䨾⟃⡹捀➊랃銴㻨㢫䱦 䮕㋅⡹剚㻨㢫䱦羳 ㉇♶㽠㥪問問ٴٴ 䧮䟝銴㷸㢫䱦⡹〳⟃來䧮㌨ 㻨➊랃㢫䱦灶㡏麉䨡坿馱
29. 荈䊹涸㢫䱦荈䊹㻨剚㻨㢫䱦馄䌃涸㉇ 椚歋♧
30. 魨捀♧⦐
    )BDLFS
    㽠銴⹅倴䮋䨞 椚歋✳
31. ⡹⦛鿪鄄麉䨡梖䧮銴梖麉䨡 椚歋♲
32. 㢫䱦涸䎙⦐㾵妄 /FUXPSL
    -BZFS (BNF
    1SPDFTT (BNF
    'SPOUFOE (BNF
    $MJFOU
33. 㢫䱦涸䎙⦐㾵妄 /FUXPSL
    -BZFS (BNF
    1SPDFTT (BNF
    'SPOUFOE ,FZCPBSE .PVTF 4DSFFO (BNF
    $MJFOU $16 珏蔅ꨶ⥌
34. 㢫䱦涸䎙⦐㾵妄 /FUXPSL
    -BZFS (BNF
    1SPDFTT (BNF
    'SPOUFOE ,FZCPBSE .PVTF 4DSFFO 䭾꒳礶꫙ 玑䒭遤捀⥜佖 荈⹛⻋堥㐼➃ 膨堥㢫䱦 (BNF
    $MJFOU 湡垦 $16 珏蔅ꨶ⥌ 嫲倛倛鼩㢵♧珏ヤ
35. 㢫䱦涸䎙⦐㾵妄 䭾꒳礶꫙
    8JOEPXT
    "1*
    
    4FOE*OQVU
    
    1PTU.FTTBHF
    荈⹛⻋堥㐼➃
    䕧⫹鳺陏崩玑䱾ⵖ"1*
    )PPL
    麨䧭䖕〵乽⡲
    玑䒭遤捀⥜佖
    )PPL3FWFSTJOH
    膨堥㢫䱦
    3FWFSTJOH
    %FDSZQU
    1BDLFU
    1BDLFU
    "OBMZ[F
36. 㢫䱦
    ⿾㢫䱦
    ⿾⿾㢫䱦
    ⿾⿾⿾㢫䱦
37. 䨾⟃ⵌ䏁僽⿾鼩僽♶⿾ ӯҳҲұҰ䄶ҝ տ渓տ Ҝ惓ҰұҲҴӰ
38. 儘➿涸滚帒 ((
    涸
    (BNF(VBSE
39. 䖕⢵♧湬ⵌ植㖈 )BDLBCMF
    )BDL4IJFME
40. ⿾⿾㢫䱦 〳僽䧮㽠僽䟝佖
41. void fake_image_path(WCHAR *img_path) { __asm { // PEB mov eax, fs:[0x30] // _RTL_USER_PROCESS_PARAMETERS mov eax, [eax+0x010] // ImagePathName.Buffer add eax, 0x3C push img_path pop [eax] } } *NBHF1BUI
    ⩝酤䧭䊨⡲盘椚㆞ %BSL
    㖈
    
    涮植涸Ⱉ䎃✫鼩僽腋欽〫剤
    Y
    鄄⥜姻 SFG
    IUUQXXXIJUDPOPSHIJUEPXOMPBEIUN
42. *NBHF1BUI
    ⩝酤Ⱖ㻜♶欽齡랃란撖
43. QBUDIFSFYF
44. 〳⟃乽⡲鎹䥊넓涸玑䒭涯そ㋲ ⛳〳⟃欽UBTLNHSFYF
45. int main() { HWND game = FindWindow(NULL, "MapleStory"); while(true) { PostMessage(game, WM_KEYDOWN, VK_CONTROL, 0); PostMessage(game, WM_KEYUP, VK_CONTROL, 0); } } 㥶卓⡹꨾銴荈⹛䭾꒳
46. )BDL4IJFME
    TBZT :PV
    TIBMM
    OPU
    QBTT
47. void PressKey(long KeyCode) { unsigned char scan_code = MapVirtualKey(KeyCode, 0); PostMessage(MSHWND, WM_KEYDOWN, KeyCode, 0x0000001 | scan_code << 16); PostMessage(MSHWND, WM_KEYUP , KeyCode, 0xC000001 | scan_code << 16); } 䨾⟃㽠䪾
    lParam
    ⿮侸⥜㥪 SFG
    IUUQTNTEONJDSPTPGUDPN[IUXMJCSBSZXJOEPXTEFTLUPQNT WWT BTQY
48. 䧮㽠僽⡹⡹㽠僽䧮
    ˋ
    *OKFDU
    %-- (BNF
    1SPDFTT %--
49. 䧮㽠僽⡹⡹㽠僽䧮
    ˋ
    *OKFDU
    %-- 鷴麕
    -PBE-JCSBSZ
    〳⟃鯺Ⰵ
    %--
    䒸欽玑䒭䏨
    $SFBUF3FNPUF5ISFBE
    ˋ
    㖈ⴽ➃㹻酭꬗Ꟛ
    5ISFBE
    麉䨡涸鎹䥊넓㽠僽䧮涸鎹䥊넓
50. ⿾⿾⿾㢫䱦 䧮㽠僽♶䟝雊⡹✥佖
51. /FYPO
    荈䊹Ꟛ涮✫鸏匌銯
52. Ӝ佪卓⼧ⴕ곏衽 s٥Ī٥A 䩞䚓 -W
    
    )1 -W
    
    )1
53. 麉䨡㢫䱦欴噠莅欰䢀
54. Ⱖ㻜㽠僽랱欴
55. 梖㹻 㢫䱦Ꟛ涮罏 麉䨡䑖㉂ ㉂➃
    ❜僒䎂〵
56. 梖㹻 㢫䱦Ꟛ涮罏 麉䨡䑖㉂ 剚鄄縰 ㉂➃
    ❜僒䎂〵
57. 梖㹻 㢫䱦Ꟛ涮罏 ㉂➃
    ❜僒䎂〵 麉䨡䑖㉂ 风剓㢵
58. ⡎僽䧮尝剤风ⵌꐏ 5
    
    
    
    
    
    
    
    
    
    5
59. 麉䨡涸랱蒀欴噠 麉䨡䍤㼩⮭⧩럊侸涸顠颪
    麉䨡麥Ⱘ䳖植ꆄ
    麉䨡䌙贫錬蒀顠颪
    ➿㹐箻⸆鍑⟤⹡䩧#PTT
    顋㈒㢫䱦
60. 〵抓剓㣐涸❜僒䎂〵 捀✫鼚⯝䑞デ㲀毠䨾⟃䧮䩧✫꼛飓⯘
61. 㔔捀鑪䎂〵犝姺❜僒㢫䱦玑䒭 䧮⦛꨾銴♧❉䲂➃羮湡涸倰岁
63. 麉䨡㢵Ꟛ风涸嫲㢫䱦㢵
    2"2 齡儘⦬䋑꬗♳涸㢵Ꟛ㣟佪✫.VUFY
    〥♧⦐剦⿼灇瑖ⴀ⥜佖
    )BDL4IJFME
    ⥃隌⿮侸涸倰岁
    嫦妄佖晝佐顥齡儘⦬尝剤䩧䑞デ⡎僽欰䠑䖎㥪
    ⟃⵹㉂➃风䧮ꐏ植㖈鸒鸒风㔐⢵
64. 植㖈僽鴍凰♬剢㉇˘
65. 䨾⟃嫦㣔儻♳⼧럊
66. 鿪剚剤醳醢➃鮪㕰ⴀ尝 Ⱖ㻜㽠僽䩧䍤㕰♳䊨✫
67. 剓䖕騈㣐㹻铞♧⦐猽㺙
68. 㷸㢫䱦〳⟃佹须㸞
69. 
    锸㠢竤斊㷸ⵌ爢❜䊨玑
    
    
    
    㢫䱦䪮遯䱺鮨鷠ぢ䊨玑㛆귢꽺㹐䙼笞
    
    
    
    䟝銴㻨㢫䱦㽠銴㷸玑䒭㷸䏁㾵
    
    
    
    颪㢫䱦㻨뀿阮8FC
    
    $SZQUP
    尝㉏겗
    
    
70. 2
    
    "