那些年,我們一起寫的外掛

7f110257501127300df3f923119ba043?s=47 Inndy
August 28, 2015

 那些年,我們一起寫的外掛

HITCON 2015 CMT presentation

This slide licensed under CC 4.0 BY-NC-ND (https://creativecommons.org/licenses/by-nc-nd/4.0/)

7f110257501127300df3f923119ba043?s=128

Inndy

August 28, 2015
Tweet

Transcript

  1. 齡❉䎃䧮⦛♧饱㻨涸㢫䱦 䨾⟃䧮ⵌ䏁捀➊랃剚⿡㻨㢫䱦ㅎ

  2. 䨾⟃➛㣔 )J *BN*OOEZ加啄 麕⿡僽⦐⚥✳涸㼱䎃 䧮⦛⢵翝翝㢫䱦 〳䞼䧮尝剤く䟅눦卓㻜

  3. None
  4. .F BOENZQBTU

  5. 7#귄「䮲䫔涸$铃鎊 穅倴⼮秹ⵌ7#/&5 $$ #VJMEFS 1)1+BWB4DSJQU 㥪⫹䖎⿐㹳涸1ZUIPO 惐ⵌⴀ宐涸3VCZ XJUI3BJMT "/%,&&10/

  6. 7# 1ZUIPO $ $ 3VCZ +BWB4DSJQU 1)1 MJTQ +BWB "TTFNCMZ

    %FMQIJ 3FWFSTJOH 8FC4FDVSJUZ -JOVY
  7. ˊ*OOEZ  ⨞㡏✲僽鹎姿涸⾲⹛⸂

  8. 䱺♴⢵雊䧮⦛䎍♧❉㡏✲

  9. None
  10. None
  11. ⡹剤欽麕鸏Ⰽ⦐㢫䱦㌨

  12. 嫲鯱䓽罏䧮剦⿼ㄤ䧮涸⡲ㅷ

  13. ⵹罏涸鋕璭嫲⢿嫲鯱洅Ꟁ 㔔捀齡儘⦬䧮涸瘘ꨶ〫剤Y ⡹剚涮植

  14. 荈⹛⻋麬⿾䌢椚涸麉䨡遤捀 (BNF)BDL

  15. 溫僽〳䠦涸剤麬䌢椚㉇

  16. 雊䚓暟䱈♴⢵

  17. 㕮余乹 余乹⸈鸠

  18. 荈⹛䱦堥 捀✫眏溁儘꟦⟃Y鸠䏞久佞

  19. 騟➃"䨾⟃⡹捀➊랃銴Ꟛ㢫䱦 Ꟛ㢫䱦馄颫涸 䎍⿶僽娦㢫䱦 梖麉䨡♶腋㥪㥪梖㌨ (.剤➃Ꟛ㢫䱦㉇ 䧮銴增莊⡹ 䊼暶晝⚺僽㢫䱦俒䘰⢵ⵅꤑ

  20. 㔔捀麉䨡梖♶飷ず㷸

  21. 䨾⟃〫㥪Ꟛ㢫䱦 չ✳墂պ

  22. 䟝䟝Ⱖ㻜⛳僽䯆ㅶ⫊涸

  23. 㣖ㅶ⫊✫䨾⟃⢵ꦷ頥ゅ 瘞瘞㥪⫹剤➊랃匌銯䵆ꐫ✫

  24. Ꟛ㢫䱦涸䠮錏㽠⫹僽

  25. ♧⦐➃䬓✫嵳鮪籏鿈

  26. ⡎僽⩑晋剚鄄⯕鸠驫ⵌ

  27. 0I䧮僽铞鄄(.ꓳ䌙贫

  28. 騟➃#䨾⟃⡹捀➊랃銴㻨㢫䱦 䮕㋅⡹剚㻨㢫䱦羳 ㉇♶㽠㥪問問ٴٴ 䧮䟝銴㷸㢫䱦⡹〳⟃來䧮㌨ 㻨➊랃㢫䱦灶㡏麉䨡坿馱

  29. 荈䊹涸㢫䱦荈䊹㻨剚㻨㢫䱦馄䌃涸㉇ 椚歋♧

  30. 魨捀♧⦐)BDLFS㽠銴⹅倴䮋䨞 椚歋✳

  31. ⡹⦛鿪鄄麉䨡梖䧮銴梖麉䨡 椚歋♲

  32. 㢫䱦涸䎙⦐㾵妄 /FUXPSL -BZFS (BNF 1SPDFTT (BNF 'SPOUFOE (BNF$MJFOU

  33. 㢫䱦涸䎙⦐㾵妄 /FUXPSL -BZFS (BNF 1SPDFTT (BNF 'SPOUFOE ,FZCPBSE .PVTF 4DSFFO

    (BNF$MJFOU $16 珏蔅ꨶ⥌
  34. 㢫䱦涸䎙⦐㾵妄 /FUXPSL -BZFS (BNF 1SPDFTT (BNF 'SPOUFOE ,FZCPBSE .PVTF 4DSFFO

    䭾꒳礶꫙ 玑䒭遤捀⥜佖 荈⹛⻋堥㐼➃ 膨堥㢫䱦 (BNF$MJFOU 湡垦 $16 珏蔅ꨶ⥌ 嫲倛倛鼩㢵♧珏ヤ
  35. 㢫䱦涸䎙⦐㾵妄 䭾꒳礶꫙ 8JOEPXT"1*4FOE*OQVU1PTU.FTTBHF 荈⹛⻋堥㐼➃ 䕧⫹鳺陏崩玑䱾ⵖ"1*)PPL麨䧭䖕〵乽⡲ 玑䒭遤捀⥜佖 )PPL3FWFSTJOH 膨堥㢫䱦 3FWFSTJOH %FDSZQU1BDLFU

    1BDLFU"OBMZ[F
  36. 㢫䱦 ⿾㢫䱦 ⿾⿾㢫䱦 ⿾⿾⿾㢫䱦

  37. 䨾⟃ⵌ䏁僽⿾鼩僽♶⿾ ӯҳҲұҰ䄶ҝ տ渓տ Ҝ惓ҰұҲҴӰ

  38. 儘➿涸滚帒 ((涸(BNF(VBSE

  39. 䖕⢵♧湬ⵌ植㖈 )BDLBCMF)BDL4IJFME

  40. ⿾⿾㢫䱦 〳僽䧮㽠僽䟝佖

  41. void fake_image_path(WCHAR *img_path) { __asm { // PEB mov eax,

    fs:[0x30] // _RTL_USER_PROCESS_PARAMETERS mov eax, [eax+0x010] // ImagePathName.Buffer add eax, 0x3C push img_path pop [eax] } } *NBHF1BUI⩝酤䧭䊨⡲盘椚㆞ %BSL㖈涮植涸Ⱉ䎃✫鼩僽腋欽〫剤Y鄄⥜姻 SFGIUUQXXXIJUDPOPSHIJUEPXOMPBEIUN
  42. *NBHF1BUI⩝酤Ⱖ㻜♶欽齡랃란撖

  43. QBUDIFSFYF

  44. 〳⟃乽⡲鎹䥊넓涸玑䒭涯そ㋲ ⛳〳⟃欽UBTLNHSFYF

  45. int main() { HWND game = FindWindow(NULL, "MapleStory"); while(true) {

    PostMessage(game, WM_KEYDOWN, VK_CONTROL, 0); PostMessage(game, WM_KEYUP, VK_CONTROL, 0); } } 㥶卓⡹꨾銴荈⹛䭾꒳
  46. )BDL4IJFMETBZT :PVTIBMMOPUQBTT

  47. void PressKey(long KeyCode) { unsigned char scan_code = MapVirtualKey(KeyCode, 0);

    PostMessage(MSHWND, WM_KEYDOWN, KeyCode, 0x0000001 | scan_code << 16); PostMessage(MSHWND, WM_KEYUP , KeyCode, 0xC000001 | scan_code << 16); } 䨾⟃㽠䪾lParam⿮侸⥜㥪 SFGIUUQTNTEONJDSPTPGUDPN[IUXMJCSBSZXJOEPXTEFTLUPQNT WWT BTQY
  48. 䧮㽠僽⡹⡹㽠僽䧮ˋ*OKFDU%-- (BNF1SPDFTT %--

  49. 䧮㽠僽⡹⡹㽠僽䧮ˋ*OKFDU%-- 鷴麕-PBE-JCSBSZ〳⟃鯺Ⰵ%--䒸欽玑䒭䏨 $SFBUF3FNPUF5ISFBEˋ㖈ⴽ➃㹻酭꬗Ꟛ5ISFBE 麉䨡涸鎹䥊넓㽠僽䧮涸鎹䥊넓

  50. ⿾⿾⿾㢫䱦 䧮㽠僽♶䟝雊⡹✥佖

  51. /FYPO荈䊹Ꟛ涮✫鸏匌銯

  52. Ӝ佪卓⼧ⴕ곏衽 s٥Ī٥A 䩞䚓 -W )1 -W )1

  53. 麉䨡㢫䱦欴噠莅欰䢀

  54. Ⱖ㻜㽠僽랱欴

  55. 梖㹻 㢫䱦Ꟛ涮罏 麉䨡䑖㉂ ㉂➃ ❜僒䎂〵

  56. 梖㹻 㢫䱦Ꟛ涮罏 麉䨡䑖㉂ 剚鄄縰 ㉂➃ ❜僒䎂〵

  57. 梖㹻 㢫䱦Ꟛ涮罏 ㉂➃ ❜僒䎂〵 麉䨡䑖㉂ 风剓㢵

  58. ⡎僽䧮尝剤风ⵌꐏ 55

  59. 麉䨡涸랱蒀欴噠 麉䨡䍤㼩⮭⧩럊侸涸顠颪 麉䨡麥Ⱘ䳖植ꆄ 麉䨡䌙贫錬蒀顠颪 ➿㹐箻⸆鍑⟤⹡䩧#PTT 顋㈒㢫䱦

  60. 〵抓剓㣐涸❜僒䎂〵 捀✫鼚⯝䑞デ㲀毠䨾⟃䧮䩧✫꼛飓⯘

  61. 㔔捀鑪䎂〵犝姺❜僒㢫䱦玑䒭 䧮⦛꨾銴♧❉䲂➃羮湡涸倰岁

  62. None
  63. 麉䨡㢵Ꟛ风涸嫲㢫䱦㢵2"2 齡儘⦬䋑꬗♳涸㢵Ꟛ㣟佪✫.VUFY 〥♧⦐剦⿼灇瑖ⴀ⥜佖)BDL4IJFME⥃隌⿮侸涸倰岁 嫦妄佖晝佐顥齡儘⦬尝剤䩧䑞デ⡎僽欰䠑䖎㥪 ⟃⵹㉂➃风䧮ꐏ植㖈鸒鸒风㔐⢵

  64. 植㖈僽鴍凰♬剢㉇˘

  65. 䨾⟃嫦㣔儻♳⼧럊

  66. 鿪剚剤醳醢➃鮪㕰ⴀ尝 Ⱖ㻜㽠僽䩧䍤㕰♳䊨✫

  67. 剓䖕騈㣐㹻铞♧⦐猽㺙

  68. 㷸㢫䱦〳⟃佹须㸞

  69.  锸㠢竤斊㷸ⵌ爢❜䊨玑   㢫䱦䪮遯䱺鮨鷠ぢ䊨玑㛆귢꽺㹐䙼笞   䟝銴㻨㢫䱦㽠銴㷸玑䒭㷸䏁㾵  

    颪㢫䱦㻨뀿阮8FC$SZQUP尝㉏겗 
  70. 2"