2020 交大程式安全：逆向工程上課講義－第二週(第二段)

（檔案大小有限制所以分兩段上傳...）
這是三校合開的資訊安全課程，今年有幸可以負責逆向工程的部分，逆向工程總共有三週，由於第三週為作業講解所以並沒有簡報。

這門課在三校的選課系統上的名字如下：
台大－計算機安全
台科大－資訊安全實務
交大－程式安全

Transcript

1. ৽஛Ѩംఱఱٯ޲ ޻ఔ terrynini38514 terrynini
2. ANTI ANALYZE
3. ANTI ANALYZE "OUJ"OBMZ[F ▸ ሣ߅෼ੳతํ๏༗ڐଟɼแؚᯩଶٴಈଶɼجຊ্बੋཁ⃧Ճٯ޲෼ੳ੒ຊ
   ▸ ֤ݸٕ޼Մೳ؃ࣅ؆ᄸɼୠ૊߹ࡏҰىඇৗ่௵
   ▸ ૬᮫ٕ޼ඇৗڼ↳࡞ۀܥ౷ɼෆಉ࡞ۀܥ౷Լ။༗ෆಉతํ๏ɼᙛવ໵ੋ༗௨༻త
   ▸ ഝཫҎ
   8JOEPXT
   ҝྫɼҼҝ
   8JOEPXT
   ൺֱ噁৺  3
4. ANTI ANALYZE 5&# 5ISFBE
   &OWJSPONFOU
   #MPDL ▸ 5&#
   ༻ိอଘᙛલࣥߦॹ૬᮫తࢿਜ
   ▸ ՄҎಁաଖதత
   5*#
   Ҏٴ
   1&#
   ௚઀֫ಘ๭ࠣࢿਜࣕෆधཁ࢖༻
   "1*
   ▸ ࡏ
   CJU
   ܥ౷্ՄҎಁա
   fs
   ଘऔ
   ▸ ࡏ
   CJU
   ܥ౷্ՄҎಁա
   gs
   ଘऔ  4
5. ANTI ANALYZE 5&#  5 NT_TIB NtTib ... PPEB PEB ... TEB ... PEB
6. ANTI ANALYZE 5*#
   5ISFBE
   *OGPNBUJPO
   #MPDL  6 NT_TIB NtTib ... PPEB PEB ... TEB ... PEB ExceptionList ... PNT_TIB Self 1SPDFTT&OWJSPONFOU#MPDLଠ௕ɼNFNCFS໊ॖሜ
7. ANTI ANALYZE )PX
   5P
   (FU
   5&# Ntdll.NtCurrentTeb()  7
8. ANTI ANALYZE )PX
   5P
   (FU
   5&#  8 NT_TIB NtTib ... PPEB PEB ... TEB FS Segment Descriptor Table
   Ұݸ
   FOUSZ
   
   CJU
   
9. ANTI ANALYZE 5*#
   5ISFBE
   *OGPNBUJPO
   #MPDL  9 ExceptionList ... PNT_TIB Self ... PPEB PEB ... TEB FS:[0x18] ... PEB 0x18 0x30 0x0 dereference "Self" in TEB
10. ANTI ANALYZE 5*#
    5ISFBE
    *OGPNBUJPO
    #MPDL  10 ExceptionList ... PNT_TIB Self ... PPEB PEB ... TEB FS:[0x30] ... PEB 0x18 0x30 0x0 dereference "PEB" in TEB
11. ANTI ANALYZE 5*#
    5ISFBE
    *OGPNBUJPO
    #MPDL  11 ExceptionList ... PNT_TIB Self ... PPEB PEB ... TEB FS:[0] ... PEB 0x18 0x30 0x0 dereference "ExceptionList" in TEB
12. ANTI ANALYZE 5&#  12 FS:[0] FS:[0x18] FS:[0x30] GS:[0] GS:[0x30] GS:[0x60] Exceptionlist TIB Self PEB 32bit 64bit
13. ANTI ANALYZE 4&)  13 Next Handler HANDLER HANDLER HANDLER Next Handler Next Handler
14. ANTI ANALYZE 1&#
    1SPDFTT
    &OWJSPONFOU
    #MPDL
    CJU  14 ExceptionList ... PNT_TIB Self ... PPEB PEB ... TEB ... BeingDebugged ... ImageBaseAddress Ldr ... Processheap ... NtGlobalFlag ... PEB 0x18 0x30 0x0 0x02 0x08 0x0c 0x18 0x68
15. ANTI ANALYZE 1&#
    1SPDFTT
    &OWJSPONFOU
    #MPDL
    CJU  15 ... BeingDebugged ... ImageBaseAddress Ldr ... Processheap ... NtGlobalFlag ... PEB 0x02 0x08 0x0c 0x18 0x68 ... InLoadOrderModuleList InMemoryOrderModuleList InInitializationOrderModuleList ... _PEB_LDR_DATA LIST_ENTRY LIST_ENTRY LIST_ENTRY 0x0c 0x14 0x1c
16. ANTI ANALYZE 1&#
    1SPDFTT
    &OWJSPONFOU
    #MPDL
    CJU  16 ... BeingDebugged ... ImageBaseAddress Ldr ... Processheap ... NtGlobalFlag ... PEB 0x02 0x08 0x0c 0x18 0x68 ... InLoadOrderModuleList InMemoryOrderModuleList InInitializationOrderModuleList ... _PEB_LDR_DATA 0x0c 0x14 0x1c LDR_DATA_TABLE_ENTRY PVOID Reserved1[2] LIST_ENTRY InMemoryOrderLinks PVOID Reserved2[2]; PVOID DllBase; PVOID EntryPoint; PVOID Reserved3; UNICODE_STRING FullDllName; ...
17. ANTI ANALYZE 1&#
    1SPDFTT
    &OWJSPONFOU
    #MPDL
    CJU  17 ... InMemoryOrderModuleList Flink Blink ... _PEB_LDR_DATA LDR_DATA_TABLE_ENTRY PVOID Reserved1[2] Flink Blink PVOID Reserved2[2]; PVOID DllBase; PVOID EntryPoint; PVOID Reserved3; UNICODE_STRING FullDllName; ... LDR_DATA_TABLE_ENTRY PVOID Reserved1[2] Flink Blink PVOID Reserved2[2]; PVOID DllBase; PVOID EntryPoint; PVOID Reserved3; UNICODE_STRING FullDllName; ... 0x14 0x8 0x8
18. ANTI ANALYZE "OUJ
    "OBMZ[F  18 ▸ େՈ౎ཧղྃ 
 ॴҎݱࡏେՈ౎࿃ಔ
    ▸ ࿃ಔෆੋෆ޷ɼ 
 ୠզ၇ՄҎਫ਼ਐҰԼ
19. DIY
20. ANTI ANALYZE "OUJ
    "OBMZ[F  20 ▸ garbage code ▸ code alignment ▸ encryption\decryption ▸ reflactive binary ▸ api redirection ▸ polymorphic code ▸ debug blocker(self debugging, nanomite)
21. ANTI ANALYZE "OUJ"OBMZ[F  21
22. ANTI ANALYZE %FCVHHFS
    %FUFDUJPO  22 ▸ 1&#
    #FJOH%FCVHHFE
    /U(MPCBM'MBH
23. ANTI ANALYZE %FCVHHFS
    %FUFDUJPO  23 ▸ NtQueryInformationProcess() ▸ CheckRemoteDebuggerPresent() ▸ NtQueryInformationProcess() ▸ NtQuerySystemInformation() ▸ NtSetInformationThread() ▸ NtQueryObject()
24. ANTI ANALYZE %FCVHHFS
    %FUFDUJPO  24 ▸ FindWindow() ▸ Parent Process Check() ▸ GetComputerName() ▸ GetCommandLine()
25. END
26. REFERENCE 3FGFSFODF ▸ https://ithelp.ithome.com.tw/articles/10219105  26