Upgrade to Pro — share decks privately, control downloads, hide ads and more …

那些年,我們一起寫的外掛

Inndy
August 28, 2015

 那些年,我們一起寫的外掛

HITCON 2015 CMT presentation

This slide licensed under CC 4.0 BY-NC-ND (https://creativecommons.org/licenses/by-nc-nd/4.0/)

Inndy

August 28, 2015
Tweet

More Decks by Inndy

Other Decks in Research

Transcript

  1. 齡❉䎃䧮⦛♧饱㻨涸㢫䱦
    䨾⟃䧮ⵌ䏁捀➊랃剚⿡㻨㢫䱦ㅎ

    View full-size slide

  2. 䨾⟃➛㣔
    )J *BN*OOEZ加啄
    麕⿡僽⦐⚥✳涸㼱䎃
    䧮⦛⢵翝翝㢫䱦
    〳䞼䧮尝剤く䟅눦卓㻜

    View full-size slide

  3. .F BOENZQBTU

    View full-size slide

  4. 7#귄「䮲䫔涸$铃鎊
    穅倴⼮秹ⵌ7#/&5
    $$#VJMEFS
    1)1+BWB4DSJQU
    㥪⫹䖎⿐㹳涸1ZUIPO
    惐ⵌⴀ宐涸3VCZ XJUI3BJMT

    "/%,&&10/

    View full-size slide

  5. 7#
    1ZUIPO
    $
    $
    3VCZ
    +BWB4DSJQU
    1)1
    MJTQ
    +BWB
    "TTFNCMZ
    %FMQIJ
    3FWFSTJOH
    8FC4FDVSJUZ
    -JOVY

    View full-size slide

  6. ˊ*OOEZ
    ⨞㡏✲僽鹎姿涸⾲⹛⸂

    View full-size slide

  7. 䱺♴⢵雊䧮⦛䎍♧❉㡏✲

    View full-size slide

  8. ⡹剤欽麕鸏Ⰽ⦐㢫䱦㌨

    View full-size slide

  9. 嫲鯱䓽罏䧮剦⿼ㄤ䧮涸⡲ㅷ

    View full-size slide

  10. ⵹罏涸鋕璭嫲⢿嫲鯱洅Ꟁ
    㔔捀齡儘⦬䧮涸瘘ꨶ〫剤Y
    ⡹剚涮植

    View full-size slide

  11. 荈⹛⻋麬⿾䌢椚涸麉䨡遤捀
    (BNF)BDL

    View full-size slide

  12. 溫僽〳䠦涸剤麬䌢椚㉇

    View full-size slide

  13. 雊䚓暟䱈♴⢵

    View full-size slide

  14. 㕮余乹余乹⸈鸠

    View full-size slide

  15. 荈⹛䱦堥
    捀✫眏溁儘꟦⟃Y鸠䏞久佞

    View full-size slide

  16. 騟➃"䨾⟃⡹捀➊랃銴Ꟛ㢫䱦
    Ꟛ㢫䱦馄颫涸 䎍⿶僽娦㢫䱦
    梖麉䨡♶腋㥪㥪梖㌨
    (.剤➃Ꟛ㢫䱦㉇
    䧮銴增莊⡹
    䊼暶晝⚺僽㢫䱦俒䘰⢵ⵅꤑ

    View full-size slide

  17. 㔔捀麉䨡梖♶飷ず㷸

    View full-size slide

  18. 䨾⟃〫㥪Ꟛ㢫䱦
    չ✳墂պ

    View full-size slide

  19. 䟝䟝Ⱖ㻜⛳僽䯆ㅶ⫊涸

    View full-size slide

  20. 㣖ㅶ⫊✫䨾⟃⢵ꦷ頥ゅ
    瘞瘞㥪⫹剤➊랃匌銯䵆ꐫ✫

    View full-size slide

  21. Ꟛ㢫䱦涸䠮錏㽠⫹僽

    View full-size slide

  22. ♧⦐➃䬓✫嵳鮪籏鿈

    View full-size slide

  23. ⡎僽⩑晋剚鄄⯕鸠驫ⵌ

    View full-size slide

  24. 0I䧮僽铞鄄(.ꓳ䌙贫

    View full-size slide

  25. 騟➃#䨾⟃⡹捀➊랃銴㻨㢫䱦
    䮕㋅⡹剚㻨㢫䱦羳
    ㉇♶㽠㥪問問ٴٴ
    䧮䟝銴㷸㢫䱦⡹〳⟃來䧮㌨
    㻨➊랃㢫䱦灶㡏麉䨡坿馱

    View full-size slide

  26. 荈䊹涸㢫䱦荈䊹㻨剚㻨㢫䱦馄䌃涸㉇
    椚歋♧

    View full-size slide

  27. 魨捀♧⦐)BDLFS㽠銴⹅倴䮋䨞
    椚歋✳

    View full-size slide

  28. ⡹⦛鿪鄄麉䨡梖䧮銴梖麉䨡
    椚歋♲

    View full-size slide

  29. 㢫䱦涸䎙⦐㾵妄
    /FUXPSL
    -BZFS
    (BNF
    1SPDFTT
    (BNF
    'SPOUFOE
    (BNF$MJFOU

    View full-size slide

  30. 㢫䱦涸䎙⦐㾵妄
    /FUXPSL
    -BZFS
    (BNF
    1SPDFTT
    (BNF
    'SPOUFOE
    ,FZCPBSE
    .PVTF
    4DSFFO
    (BNF$MJFOU
    $16 珏蔅ꨶ⥌

    View full-size slide

  31. 㢫䱦涸䎙⦐㾵妄
    /FUXPSL
    -BZFS
    (BNF
    1SPDFTT
    (BNF
    'SPOUFOE
    ,FZCPBSE
    .PVTF
    4DSFFO
    䭾꒳礶꫙
    玑䒭遤捀⥜佖
    荈⹛⻋堥㐼➃
    膨堥㢫䱦
    (BNF$MJFOU
    湡垦
    $16 珏蔅ꨶ⥌
    嫲倛倛鼩㢵♧珏ヤ

    View full-size slide

  32. 㢫䱦涸䎙⦐㾵妄
    䭾꒳礶꫙
    8JOEPXT"1*4FOE*OQVU1PTU.FTTBHF
    荈⹛⻋堥㐼➃
    䕧⫹鳺陏崩玑䱾ⵖ"1*)PPL麨䧭䖕〵乽⡲
    玑䒭遤捀⥜佖
    )PPL3FWFSTJOH
    膨堥㢫䱦
    3FWFSTJOH %FDSZQU1BDLFU
    1BDLFU"OBMZ[F

    View full-size slide

  33. 㢫䱦
    ⿾㢫䱦
    ⿾⿾㢫䱦
    ⿾⿾⿾㢫䱦

    View full-size slide

  34. 䨾⟃ⵌ䏁僽⿾鼩僽♶⿾
    ӯҳҲұҰ䄶ҝ տ渓տ
    Ҝ惓ҰұҲҴӰ

    View full-size slide

  35. 儘➿涸滚帒
    ((涸(BNF(VBSE

    View full-size slide

  36. 䖕⢵♧湬ⵌ植㖈
    )BDLBCMF)BDL4IJFME

    View full-size slide

  37. ⿾⿾㢫䱦
    〳僽䧮㽠僽䟝佖

    View full-size slide

  38. void fake_image_path(WCHAR *img_path) {
    __asm {
    // PEB
    mov eax, fs:[0x30]
    // _RTL_USER_PROCESS_PARAMETERS
    mov eax, [eax+0x010]
    // ImagePathName.Buffer
    add eax, 0x3C
    push img_path
    pop [eax]
    }
    }
    *NBHF1BUI⩝酤䧭䊨⡲盘椚㆞
    %BSL㖈涮植涸Ⱉ䎃✫鼩僽腋欽〫剤Y鄄⥜姻
    SFGIUUQXXXIJUDPOPSHIJUEPXOMPBEIUN

    View full-size slide

  39. *NBHF1BUI⩝酤Ⱖ㻜♶欽齡랃란撖

    View full-size slide

  40. QBUDIFSFYF

    View full-size slide

  41. 〳⟃乽⡲鎹䥊넓涸玑䒭涯そ㋲
    ⛳〳⟃欽UBTLNHSFYF

    View full-size slide

  42. int main()
    {
    HWND game = FindWindow(NULL, "MapleStory");
    while(true)
    {
    PostMessage(game, WM_KEYDOWN, VK_CONTROL, 0);
    PostMessage(game, WM_KEYUP, VK_CONTROL, 0);
    }
    }
    㥶卓⡹꨾銴荈⹛䭾꒳

    View full-size slide

  43. )BDL4IJFMETBZT
    :PVTIBMMOPUQBTT

    View full-size slide

  44. void PressKey(long KeyCode)
    {
    unsigned char scan_code =
    MapVirtualKey(KeyCode, 0);
    PostMessage(MSHWND, WM_KEYDOWN, KeyCode,
    0x0000001 | scan_code << 16);
    PostMessage(MSHWND, WM_KEYUP , KeyCode,
    0xC000001 | scan_code << 16);
    }
    䨾⟃㽠䪾lParam⿮侸⥜㥪
    SFGIUUQTNTEONJDSPTPGUDPN[IUXMJCSBSZXJOEPXTEFTLUPQNT WWT
    BTQY

    View full-size slide

  45. 䧮㽠僽⡹⡹㽠僽䧮ˋ*OKFDU%--
    (BNF1SPDFTT
    %--

    View full-size slide

  46. 䧮㽠僽⡹⡹㽠僽䧮ˋ*OKFDU%--
    鷴麕-PBE-JCSBSZ〳⟃鯺Ⰵ%--䒸欽玑䒭䏨
    $SFBUF3FNPUF5ISFBEˋ㖈ⴽ➃㹻酭꬗Ꟛ5ISFBE
    麉䨡涸鎹䥊넓㽠僽䧮涸鎹䥊넓

    View full-size slide

  47. ⿾⿾⿾㢫䱦
    䧮㽠僽♶䟝雊⡹✥佖

    View full-size slide

  48. /FYPO荈䊹Ꟛ涮✫鸏匌銯

    View full-size slide

  49. Ӝ佪卓⼧ⴕ곏衽
    s٥Ī٥A

    䩞䚓
    -W
    )1
    -W
    )1

    View full-size slide

  50. 麉䨡㢫䱦欴噠莅欰䢀

    View full-size slide

  51. Ⱖ㻜㽠僽랱欴

    View full-size slide

  52. 梖㹻
    㢫䱦Ꟛ涮罏
    麉䨡䑖㉂
    ㉂➃
    ❜僒䎂〵

    View full-size slide

  53. 梖㹻
    㢫䱦Ꟛ涮罏
    麉䨡䑖㉂
    剚鄄縰
    ㉂➃
    ❜僒䎂〵

    View full-size slide

  54. 梖㹻
    㢫䱦Ꟛ涮罏
    ㉂➃
    ❜僒䎂〵
    麉䨡䑖㉂
    风剓㢵

    View full-size slide

  55. ⡎僽䧮尝剤风ⵌꐏ
    55

    View full-size slide

  56. 麉䨡涸랱蒀欴噠
    麉䨡䍤㼩⮭⧩럊侸涸顠颪
    麉䨡麥Ⱘ䳖植ꆄ
    麉䨡䌙贫錬蒀顠颪
    ➿㹐箻⸆鍑⟤⹡䩧#PTT
    顋㈒㢫䱦

    View full-size slide

  57. 〵抓剓㣐涸❜僒䎂〵
    捀✫鼚⯝䑞デ㲀毠䨾⟃䧮䩧✫꼛飓⯘

    View full-size slide

  58. 㔔捀鑪䎂〵犝姺❜僒㢫䱦玑䒭
    䧮⦛꨾銴♧❉䲂➃羮湡涸倰岁

    View full-size slide

  59. 麉䨡㢵Ꟛ风涸嫲㢫䱦㢵2"2
    齡儘⦬䋑꬗♳涸㢵Ꟛ㣟佪✫.VUFY
    〥♧⦐剦⿼灇瑖ⴀ⥜佖)BDL4IJFME⥃隌⿮侸涸倰岁
    嫦妄佖晝佐顥齡儘⦬尝剤䩧䑞デ⡎僽欰䠑䖎㥪
    ⟃⵹㉂➃风䧮ꐏ植㖈鸒鸒风㔐⢵

    View full-size slide

  60. 植㖈僽鴍凰♬剢㉇˘

    View full-size slide

  61. 䨾⟃嫦㣔儻♳⼧럊

    View full-size slide

  62. 鿪剚剤醳醢➃鮪㕰ⴀ尝
    Ⱖ㻜㽠僽䩧䍤㕰♳䊨✫

    View full-size slide

  63. 剓䖕騈㣐㹻铞♧⦐猽㺙

    View full-size slide

  64. 㷸㢫䱦〳⟃佹须㸞

    View full-size slide

  65. 锸㠢竤斊㷸ⵌ爢❜䊨玑

    㢫䱦䪮遯䱺鮨鷠ぢ䊨玑㛆귢꽺㹐䙼笞

    䟝銴㻨㢫䱦㽠銴㷸玑䒭㷸䏁㾵

    颪㢫䱦㻨뀿阮8FC$SZQUP尝㉏겗

    View full-size slide