shanque免杀学习笔记day8

山雀7   ·   发表于 2022-06-11 20:00:59   ·   技术文章

PE结构学习与沙箱模拟

cs新生成一个shanque.exe用Everedit打开


在分析之前先说几个概念
pe结构:可执行文件的头部结构

分类
DWORD:8个位置,4字节

WORD:4个位置,2字节

BYTE:2个位置,1字节

大概有DOS头,NT头组成。

第一部分DOS头

用来支持在dos操作系统上来运行

typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header
    WORD   e_magic;                     // Magic number 
    WORD   e_cblp;                      // Bytes on last page of file
    WORD   e_cp;                        // Pages in file
    WORD   e_crlc;                      // Relocations
    WORD   e_cparhdr;                   // Size of header in paragraphs
    WORD   e_minalloc;                  // Minimum extra paragraphs needed
    WORD   e_maxalloc;                  // Maximum extra paragraphs needed
    WORD   e_ss;                        // Initial (relative) SS value
    WORD   e_sp;                        // Initial SP value
    WORD   e_csum;                      // Checksum
    WORD   e_ip;                        // Initial IP value
    WORD   e_cs;                        // Initial (relative) CS value
    WORD   e_lfarlc;                    // File address of relocation table
    WORD   e_ovno;                      // Overlay number
    WORD   e_res[4];                    // Reserved words
    WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
    WORD   e_oeminfo;                   // OEM information; e_oemid specific
    WORD   e_res2[10];                  // Reserved words
    LONG   e_lfanew;                    // File address of new exe header
  } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;

关注两个地方
1.e_magic
标志位,看到5A4D就说明是PE结构(MZ是一个什么创始人的吊签名),是一个可执行文件。

  1. e_lfanew
    偏移位,表示DOS头结束的地方

第二部分NT头

typedef struct _IMAGE_NT_HEADERS {
    DWORD Signature;          //文件签名
    IMAGE_FILE_HEADER FileHeader; //标准的NT头
    IMAGE_OPTIONAL_HEADER32 OptionalHeader; //可选的NT头
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;

DWORD Signature

文件签名


4550,PE,表示NT头开始的地方

IMAGE_FILE_HEADER FileHeader;

标准NT头

typedef struct _IMAGE_FILE_HEADER {
    WORD    Machine;
    WORD    NumberOfSections;
    DWORD   TimeDateStamp;
    DWORD   PointerToSymbolTable;
    DWORD   NumberOfSymbols;
    WORD    SizeOfOptionalHeader;
    WORD    Characteristics;
} IMAGE_FILE_HEADER, * PIMAGE_FILE_HEADER;
  1. WORD Machine;
    这个文件支持在什么计算机上运行

    014c,在下面可以查到是Intel 386。

define IMAGE_SIZEOF_FILE_HEADER 20

define IMAGE_FILE_RELOCS_STRIPPED 0x0001 // Relocation info stripped from file.

define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002 // File is executable (i.e. no unresolved external references).

define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004 // Line nunbers stripped from file.

define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008 // Local symbols stripped from file.

define IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010 // Aggressively trim working set

define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020 // App can handle >2gb addresses

define IMAGE_FILE_BYTES_REVERSED_LO 0x0080 // Bytes of machine word are reversed.

define IMAGE_FILE_32BIT_MACHINE 0x0100 // 32 bit word machine.

define IMAGE_FILE_DEBUG_STRIPPED 0x0200 // Debugging info stripped from file in .DBG file

define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400 // If Image is on removable media, copy and run from the swap file.

define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800 // If Image is on Net, copy and run from the swap file.

define IMAGE_FILE_SYSTEM 0x1000 // System File.

define IMAGE_FILE_DLL 0x2000 // File is a DLL.

define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000 // File should only be run on a UP machine

define IMAGE_FILE_BYTES_REVERSED_HI 0x8000 // Bytes of machine word are reversed.

define IMAGE_FILE_MACHINE_UNKNOWN 0

define IMAGE_FILE_MACHINE_TARGET_HOST 0x0001 // Useful for indicating we want to interact with the host and not a WoW guest.

define IMAGE_FILE_MACHINE_I386 0x014c // Intel 386.

define IMAGE_FILE_MACHINE_R3000 0x0162 // MIPS little-endian, 0x160 big-endian

define IMAGE_FILE_MACHINE_R4000 0x0166 // MIPS little-endian

define IMAGE_FILE_MACHINE_R10000 0x0168 // MIPS little-endian

define IMAGE_FILE_MACHINE_WCEMIPSV2 0x0169 // MIPS little-endian WCE v2

define IMAGE_FILE_MACHINE_ALPHA 0x0184 // Alpha_AXP

define IMAGE_FILE_MACHINE_SH3 0x01a2 // SH3 little-endian

define IMAGE_FILE_MACHINE_SH3DSP 0x01a3

define IMAGE_FILE_MACHINE_SH3E 0x01a4 // SH3E little-endian

define IMAGE_FILE_MACHINE_SH4 0x01a6 // SH4 little-endian

define IMAGE_FILE_MACHINE_SH5 0x01a8 // SH5

define IMAGE_FILE_MACHINE_ARM 0x01c0 // ARM Little-Endian

define IMAGE_FILE_MACHINE_THUMB 0x01c2 // ARM Thumb/Thumb-2 Little-Endian

define IMAGE_FILE_MACHINE_ARMNT 0x01c4 // ARM Thumb-2 Little-Endian

define IMAGE_FILE_MACHINE_AM33 0x01d3

define IMAGE_FILE_MACHINE_POWERPC 0x01F0 // IBM PowerPC Little-Endian

define IMAGE_FILE_MACHINE_POWERPCFP 0x01f1

define IMAGE_FILE_MACHINE_IA64 0x0200 // Intel 64

define IMAGE_FILE_MACHINE_MIPS16 0x0266 // MIPS

define IMAGE_FILE_MACHINE_ALPHA64 0x0284 // ALPHA64

define IMAGE_FILE_MACHINE_MIPSFPU 0x0366 // MIPS

define IMAGE_FILE_MACHINE_MIPSFPU16 0x0466 // MIPS

define IMAGE_FILE_MACHINE_AXP64 IMAGE_FILE_MACHINE_ALPHA64

define IMAGE_FILE_MACHINE_TRICORE 0x0520 // Infineon

define IMAGE_FILE_MACHINE_CEF 0x0CEF

define IMAGE_FILE_MACHINE_EBC 0x0EBC // EFI Byte Code

define IMAGE_FILE_MACHINE_AMD64 0x8664 // AMD64 (K8)

define IMAGE_FILE_MACHINE_M32R 0x9041 // M32R little-endian

define IMAGE_FILE_MACHINE_ARM64 0xAA64 // ARM64 Little-Endian

define IMAGE_FILE_MACHINE_CEE 0xC0EE

//
// Directory format.
//

-

WORD NumberOfSections;
区节数


0007,7节
用Exeinfo PE打开看一下

DWORD TimeDateStamp;
时间戳,5AC57562


1522890082


卧槽,exe是我昨晚生成的,我这是穿越啦

DWORD PointerToSymbolTable;标志表指针(被废除 不用管)

DWORD NumberOfSymbols;标志表数量(被废除 不用管)

WORD SizeOfOptionalHeader;
可选头大小


00E0,可以判断是32位还是64位,32位文件是224,64是240

WORD Characteristics;
文件特征,030F,30F就是300+F,100+200+F,F=1+2+4+8,然后对照下面的表看特征就可以。

可选的NT头

IMAGE_OPTIONAL_HEADER32 OptionalHeader

typedef struct _IMAGE_OPTIONAL_HEADER {
    //
    // Standard fields.
    //

    WORD    Magic;
    BYTE    MajorLinkerVersion;
    BYTE    MinorLinkerVersion;
    DWORD   SizeOfCode;
    DWORD   SizeOfInitializedData;
    DWORD   SizeOfUninitializedData;
    DWORD   AddressOfEntryPoint;
    DWORD   BaseOfCode;
    DWORD   BaseOfData;

    //
    // NT additional fields.
    //

    DWORD   ImageBase;
    DWORD   SectionAlignment;
    DWORD   FileAlignment;
    WORD    MajorOperatingSystemVersion;
    WORD    MinorOperatingSystemVersion;
    WORD    MajorImageVersion;
    WORD    MinorImageVersion;
    WORD    MajorSubsystemVersion;
    WORD    MinorSubsystemVersion;
    DWORD   Win32VersionValue;
    DWORD   SizeOfImage;
    DWORD   SizeOfHeaders;
    DWORD   CheckSum;
    WORD    Subsystem;
    WORD    DllCharacteristics;
    DWORD   SizeOfStackReserve;
    DWORD   SizeOfStackCommit;
    DWORD   SizeOfHeapReserve;
    DWORD   SizeOfHeapCommit;
    DWORD   LoaderFlags;
    DWORD   NumberOfRvaAndSizes;
    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;

WORD Magic;
文件类型标识,010B,32位镜像文件


0x10B:32位镜像文件

0x107:rom镜像文件

0x20B:62位镜像文件

BYTE MajorLinkerVersion;(链接器主版本号)
BYTE MinorLinkerVersion;(链接器副版本号)
不重要

DWORD SizeOfCode;
功能代码的大小(.text段的大小) 1E00,7680字节

DWORD SizeOfInitializedData;
.data段的大小,3400

DWORD SizeOfUninitializedData;
.bss段的总大小,600

DWORD AddressOfEntryPoint;
程序的虚拟入口地址,就是程序运行时候的第一行代码,不是整个文件的第一行


就是紫色的这一行


这一行才是文件的第一行,叫做代码基址。

DWORD BaseOfCode;
代码基址,第一行代码的内存地址,1000

DWORD BaseOfData;
数据基址

DWORD ImageBase;
入口点
入口点,当加载进内存时镜像的第1个字节的首选地址。它必须是64K的倍 数。

这里可以判断是exe还是dll:DLL默认是10000000H。Windows CE 的EXE默认是00010000H。Windows 系列的EXE默认是 00400000H。

整个的分析笔记我放在附件了,篇幅太大容我偷个懒,感兴趣的小伙伴看到这里应该也知道怎么去分析了。

第二部分沙箱模拟

把shanque.exe丢到微步的沙箱里看看分析除了什么PE特征,通过pefile来复现猜测一下沙箱是怎么去检测的。

1.判断是否有完整的PE结构,判据为DOS头的e_magic

import pefile
pe = pefile.PE('shanque.exe')
if pe.DOS_HEADER.dump_dict()['e_magic']['Value'] == 23117:
    print("这是个PE结构的文件")
else:
    print('not')

2.判断文件类型,判据可选NT头IMAGEBASE

import pefile
pe = pefile.PE('shanque.exe')
if pe.OPTIONAL_HEADER.dump_dict()['ImageBase']['Value'] == 4194304:
    print('这是一个windows系列的exe程序')
else:
    print('这是一个dll文件')

3.判断是32位还是64位,判据标准NT头WORD SizeOfOptionalHeader;

import pefile
pe = pefile.PE('shanque.exe')
if pe.FILE_HEADER.dump_dict()['SizeOfOptionalHeader']['Value'] == 224:
    print('这是一个32位文件')
else:
    print('这是一个64位文件')

4.平台,判据NT头WORD machine

import pefile
pe = pefile.PE('shanque.exe')
if pe.FILE_HEADER.dump_dict()['Machine']['Value'] == 332:
    print('intel 386')
else:
    print(0)

5.子系统,判据可选NT头 WORD Subsystem;

import pefile
pe = pefile.PE('shanque.exe')
if pe.OPTIONAL_HEADER.dump_dict()['Subsystem']['Value'] == 2:
    print('Windows图形用户界面(GUI)子系统(一般程序)')
else:
    print('0')

6.节区数量,标准NT头 WORD NumberOfSections

import pefile
pe = pefile.PE('shanque.exe')
print(pe.FILE_HEADER.dump_dict()['NumberOfSections']['Value'])

7.程序的入口点 可选NT头DWORD AddressOfEntryPoint;

import pefile
pe = pefile.PE('shanque.exe')
if pe.OPTIONAL_HEADER.dump_dict()['AddressOfEntryPoint;']['Value']

打赏我,让我更有动力~

Attachment List

day6.rar   File Size:0.007M (Download Count:0)

0 Reply   |  Until 22天前 | 103 View
LoginCan Publish Content
返回顶部 投诉反馈

© 2016 - 2022 掌控者 All Rights Reserved.