Upgrade to Pro — share decks privately, control downloads, hide ads and more …

那些年,我們一起寫的外掛

Inndy
August 28, 2015

 那些年,我們一起寫的外掛

HITCON 2015 CMT presentation

This slide licensed under CC 4.0 BY-NC-ND (https://creativecommons.org/licenses/by-nc-nd/4.0/)

Inndy

August 28, 2015
Tweet

More Decks by Inndy

Other Decks in Research

Transcript

  1. 7# 1ZUIPO $ $ 3VCZ +BWB4DSJQU 1)1 MJTQ +BWB "TTFNCMZ

    %FMQIJ 3FWFSTJOH 8FC4FDVSJUZ -JOVY
  2. 㢫䱦涸䎙⦐㾵妄 /FUXPSL -BZFS (BNF 1SPDFTT (BNF 'SPOUFOE ,FZCPBSE .PVTF 4DSFFO

    䭾꒳礶꫙ 玑䒭遤捀⥜佖 荈⹛⻋堥㐼➃ 膨堥㢫䱦 (BNF$MJFOU 湡垦 $16 珏蔅ꨶ⥌ 嫲倛倛鼩㢵♧珏ヤ
  3. void fake_image_path(WCHAR *img_path) { __asm { // PEB mov eax,

    fs:[0x30] // _RTL_USER_PROCESS_PARAMETERS mov eax, [eax+0x010] // ImagePathName.Buffer add eax, 0x3C push img_path pop [eax] } } *NBHF1BUI⩝酤䧭䊨⡲盘椚㆞ %BSL㖈涮植涸Ⱉ䎃✫鼩僽腋欽〫剤Y鄄⥜姻 SFGIUUQXXXIJUDPOPSHIJUEPXOMPBEIUN
  4. int main() { HWND game = FindWindow(NULL, "MapleStory"); while(true) {

    PostMessage(game, WM_KEYDOWN, VK_CONTROL, 0); PostMessage(game, WM_KEYUP, VK_CONTROL, 0); } } 㥶卓⡹꨾銴荈⹛䭾꒳
  5. void PressKey(long KeyCode) { unsigned char scan_code = MapVirtualKey(KeyCode, 0);

    PostMessage(MSHWND, WM_KEYDOWN, KeyCode, 0x0000001 | scan_code << 16); PostMessage(MSHWND, WM_KEYUP , KeyCode, 0xC000001 | scan_code << 16); } 䨾⟃㽠䪾lParam⿮侸⥜㥪 SFGIUUQTNTEONJDSPTPGUDPN[IUXMJCSBSZXJOEPXTEFTLUPQNT WWT BTQY