那些年，我們一起寫的外掛

HITCON 2015 CMT presentation

This slide licensed under CC 4.0 BY-NC-ND (https://creativecommons.org/licenses/by-nc-nd/4.0/)

Transcript

1. 齡❉䎃䧮⦛♧饱㻨涸㢫䱦
   䨾⟃䧮ⵌ䏁捀➊랃剚⿡㻨㢫䱦ㅎ
   

   View Slide

2. 䨾⟃➛㣔
   )J *BN*OOEZ加啄
   麕⿡僽⦐⚥✳涸㼱䎃
   䧮⦛⢵翝翝㢫䱦
   〳䞼䧮尝剤く䟅눦卓㻜
   

   View Slide

3. View Slide

4. .F BOENZQBTU
   

   View Slide

5. 7#귄「䮲䫔涸$铃鎊
   穅倴⼮秹ⵌ7#/&5
   $$#VJMEFS
   1)1+BWB4DSJQU
   㥪⫹䖎⿐㹳涸1ZUIPO
   惐ⵌⴀ宐涸3VCZ XJUI3BJMT
   
   "/%,&&10/
   

   View Slide

6. 7#
   1ZUIPO
   $
   $
   3VCZ
   +BWB4DSJQU
   1)1
   MJTQ
   +BWB
   "TTFNCMZ
   %FMQIJ
   3FWFSTJOH
   8FC4FDVSJUZ
   -JOVY
   

   View Slide

7. ˊ*OOEZ
   ⨞㡏✲僽鹎姿涸⾲⹛⸂
   

   View Slide

8. 䱺♴⢵雊䧮⦛䎍♧❉㡏✲
   

   View Slide

9. View Slide

10. View Slide

11. ⡹剤欽麕鸏Ⰽ⦐㢫䱦㌨
    

    View Slide

12. 嫲鯱䓽罏䧮剦⿼ㄤ䧮涸⡲ㅷ
    

    View Slide

13. ⵹罏涸鋕璭嫲⢿嫲鯱洅Ꟁ
    㔔捀齡儘⦬䧮涸瘘ꨶ〫剤Y
    ⡹剚涮植
    

    View Slide

14. 荈⹛⻋麬⿾䌢椚涸麉䨡遤捀
    (BNF)BDL
    

    View Slide

15. 溫僽〳䠦涸剤麬䌢椚㉇
    

    View Slide

16. 雊䚓暟䱈♴⢵
    

    View Slide

17. 㕮余乹余乹⸈鸠
    

    View Slide

18. 荈⹛䱦堥
    捀✫眏溁儘꟦⟃Y鸠䏞久佞
    

    View Slide

19. 騟➃"䨾⟃⡹捀➊랃銴Ꟛ㢫䱦
    Ꟛ㢫䱦馄颫涸 䎍⿶僽娦㢫䱦
    梖麉䨡♶腋㥪㥪梖㌨
    (.剤➃Ꟛ㢫䱦㉇
    䧮銴增莊⡹
    䊼暶晝⚺僽㢫䱦俒䘰⢵ⵅꤑ
    

    View Slide

20. 㔔捀麉䨡梖♶飷ず㷸
    

    View Slide

21. 䨾⟃〫㥪Ꟛ㢫䱦
    չ✳墂պ
    

    View Slide

22. 䟝䟝Ⱖ㻜⛳僽䯆ㅶ⫊涸
    

    View Slide

23. 㣖ㅶ⫊✫䨾⟃⢵ꦷ頥ゅ
    瘞瘞㥪⫹剤➊랃匌銯䵆ꐫ✫
    

    View Slide

24. Ꟛ㢫䱦涸䠮錏㽠⫹僽
    

    View Slide

25. ♧⦐➃䬓✫嵳鮪籏鿈
    

    View Slide

26. ⡎僽⩑晋剚鄄⯕鸠驫ⵌ
    

    View Slide

27. 0I䧮僽铞鄄(.ꓳ䌙贫
    

    View Slide

28. 騟➃#䨾⟃⡹捀➊랃銴㻨㢫䱦
    䮕㋅⡹剚㻨㢫䱦羳
    ㉇♶㽠㥪問問ٴٴ
    䧮䟝銴㷸㢫䱦⡹〳⟃來䧮㌨
    㻨➊랃㢫䱦灶㡏麉䨡坿馱
    

    View Slide

29. 荈䊹涸㢫䱦荈䊹㻨剚㻨㢫䱦馄䌃涸㉇
    椚歋♧
    

    View Slide

30. 魨捀♧⦐)BDLFS㽠銴⹅倴䮋䨞
    椚歋✳
    

    View Slide

31. ⡹⦛鿪鄄麉䨡梖䧮銴梖麉䨡
    椚歋♲
    

    View Slide

32. 㢫䱦涸䎙⦐㾵妄
    /FUXPSL
    -BZFS
    (BNF
    1SPDFTT
    (BNF
    'SPOUFOE
    (BNF$MJFOU
    

    View Slide

33. 㢫䱦涸䎙⦐㾵妄
    /FUXPSL
    -BZFS
    (BNF
    1SPDFTT
    (BNF
    'SPOUFOE
    ,FZCPBSE
    .PVTF
    4DSFFO
    (BNF$MJFOU
    $16 珏蔅ꨶ⥌
    

    View Slide

34. 㢫䱦涸䎙⦐㾵妄
    /FUXPSL
    -BZFS
    (BNF
    1SPDFTT
    (BNF
    'SPOUFOE
    ,FZCPBSE
    .PVTF
    4DSFFO
    䭾꒳礶꫙
    玑䒭遤捀⥜佖
    荈⹛⻋堥㐼➃
    膨堥㢫䱦
    (BNF$MJFOU
    湡垦
    $16 珏蔅ꨶ⥌
    嫲倛倛鼩㢵♧珏ヤ
    

    View Slide

35. 㢫䱦涸䎙⦐㾵妄
    䭾꒳礶꫙
    8JOEPXT"1*4FOE*OQVU1PTU.FTTBHF
    荈⹛⻋堥㐼➃
    䕧⫹鳺陏崩玑䱾ⵖ"1*)PPL麨䧭䖕〵乽⡲
    玑䒭遤捀⥜佖
    )PPL3FWFSTJOH
    膨堥㢫䱦
    3FWFSTJOH %FDSZQU1BDLFU
    1BDLFU"OBMZ[F
    

    View Slide

36. 㢫䱦
    ⿾㢫䱦
    ⿾⿾㢫䱦
    ⿾⿾⿾㢫䱦
    

    View Slide

37. 䨾⟃ⵌ䏁僽⿾鼩僽♶⿾
    ӯҳҲұҰ䄶ҝ տ渓տ
    Ҝ惓ҰұҲҴӰ
    

    View Slide

38. 儘➿涸滚帒
    ((涸(BNF(VBSE
    

    View Slide

39. 䖕⢵♧湬ⵌ植㖈
    )BDLBCMF)BDL4IJFME
    

    View Slide

40. ⿾⿾㢫䱦
    〳僽䧮㽠僽䟝佖
    

    View Slide

41. void fake_image_path(WCHAR *img_path) {
    __asm {
    // PEB
    mov eax, fs:[0x30]
    // _RTL_USER_PROCESS_PARAMETERS
    mov eax, [eax+0x010]
    // ImagePathName.Buffer
    add eax, 0x3C
    push img_path
    pop [eax]
    }
    }
    *NBHF1BUI⩝酤䧭䊨⡲盘椚㆞
    %BSL㖈涮植涸Ⱉ䎃✫鼩僽腋欽〫剤Y鄄⥜姻
    SFGIUUQXXXIJUDPOPSHIJUEPXOMPBEIUN
    

    View Slide

42. *NBHF1BUI⩝酤Ⱖ㻜♶欽齡랃란撖
    

    View Slide

43. QBUDIFSFYF
    

    View Slide

44. 〳⟃乽⡲鎹䥊넓涸玑䒭涯そ㋲
    ⛳〳⟃欽UBTLNHSFYF
    

    View Slide

45. int main()
    {
    HWND game = FindWindow(NULL, "MapleStory");
    while(true)
    {
    PostMessage(game, WM_KEYDOWN, VK_CONTROL, 0);
    PostMessage(game, WM_KEYUP, VK_CONTROL, 0);
    }
    }
    㥶卓⡹꨾銴荈⹛䭾꒳
    

    View Slide

46. )BDL4IJFMETBZT
    :PVTIBMMOPUQBTT
    

    View Slide

47. void PressKey(long KeyCode)
    {
    unsigned char scan_code =
    MapVirtualKey(KeyCode, 0);
    PostMessage(MSHWND, WM_KEYDOWN, KeyCode,
    0x0000001 | scan_code << 16);
    PostMessage(MSHWND, WM_KEYUP , KeyCode,
    0xC000001 | scan_code << 16);
    }
    䨾⟃㽠䪾lParam⿮侸⥜㥪
    SFGIUUQTNTEONJDSPTPGUDPN[IUXMJCSBSZXJOEPXTEFTLUPQNT WWT
    BTQY
    

    View Slide

48. 䧮㽠僽⡹⡹㽠僽䧮ˋ*OKFDU%--
    (BNF1SPDFTT
    %--
    

    View Slide

49. 䧮㽠僽⡹⡹㽠僽䧮ˋ*OKFDU%--
    鷴麕-PBE-JCSBSZ〳⟃鯺Ⰵ%--䒸欽玑䒭䏨
    $SFBUF3FNPUF5ISFBEˋ㖈ⴽ➃㹻酭꬗Ꟛ5ISFBE
    麉䨡涸鎹䥊넓㽠僽䧮涸鎹䥊넓
    

    View Slide

50. ⿾⿾⿾㢫䱦
    䧮㽠僽♶䟝雊⡹✥佖
    

    View Slide

51. /FYPO荈䊹Ꟛ涮✫鸏匌銯
    

    View Slide

52. Ӝ佪卓⼧ⴕ곏衽
    s٥Ī٥A
    
    䩞䚓
    -W
    )1
    -W
    )1
    

    View Slide

53. 麉䨡㢫䱦欴噠莅欰䢀
    

    View Slide

54. Ⱖ㻜㽠僽랱欴
    

    View Slide

55. 梖㹻
    㢫䱦Ꟛ涮罏
    麉䨡䑖㉂
    ㉂➃
    ❜僒䎂〵
    

    View Slide

56. 梖㹻
    㢫䱦Ꟛ涮罏
    麉䨡䑖㉂
    剚鄄縰
    ㉂➃
    ❜僒䎂〵
    

    View Slide

57. 梖㹻
    㢫䱦Ꟛ涮罏
    ㉂➃
    ❜僒䎂〵
    麉䨡䑖㉂
    风剓㢵
    

    View Slide

58. ⡎僽䧮尝剤风ⵌꐏ
    55
    

    View Slide

59. 麉䨡涸랱蒀欴噠
    麉䨡䍤㼩⮭⧩럊侸涸顠颪
    麉䨡麥Ⱘ䳖植ꆄ
    麉䨡䌙贫錬蒀顠颪
    ➿㹐箻⸆鍑⟤⹡䩧#PTT
    顋㈒㢫䱦
    

    View Slide

60. 〵抓剓㣐涸❜僒䎂〵
    捀✫鼚⯝䑞デ㲀毠䨾⟃䧮䩧✫꼛飓⯘
    

    View Slide

61. 㔔捀鑪䎂〵犝姺❜僒㢫䱦玑䒭
    䧮⦛꨾銴♧❉䲂➃羮湡涸倰岁
    

    View Slide

62. View Slide

63. 麉䨡㢵Ꟛ风涸嫲㢫䱦㢵2"2
    齡儘⦬䋑꬗♳涸㢵Ꟛ㣟佪✫.VUFY
    〥♧⦐剦⿼灇瑖ⴀ⥜佖)BDL4IJFME⥃隌⿮侸涸倰岁
    嫦妄佖晝佐顥齡儘⦬尝剤䩧䑞デ⡎僽欰䠑䖎㥪
    ⟃⵹㉂➃风䧮ꐏ植㖈鸒鸒风㔐⢵
    

    View Slide

64. 植㖈僽鴍凰♬剢㉇˘
    

    View Slide

65. 䨾⟃嫦㣔儻♳⼧럊
    

    View Slide

66. 鿪剚剤醳醢➃鮪㕰ⴀ尝
    Ⱖ㻜㽠僽䩧䍤㕰♳䊨✫
    

    View Slide

67. 剓䖕騈㣐㹻铞♧⦐猽㺙
    

    View Slide

68. 㷸㢫䱦〳⟃佹须㸞
    

    View Slide

69. 锸㠢竤斊㷸ⵌ爢❜䊨玑
    
    㢫䱦䪮遯䱺鮨鷠ぢ䊨玑㛆귢꽺㹐䙼笞
    
    䟝銴㻨㢫䱦㽠銴㷸玑䒭㷸䏁㾵
    
    颪㢫䱦㻨뀿阮8FC$SZQUP尝㉏겗
    
    

    View Slide

70. 2"
    

    View Slide