系統安全網絡嗅探類軟件去廣告分析

·一鍵修復所有系統安全漏洞！·豈能兒戲：組策略在系統安全方面的應用·深度挖掘 Windows系統安全模式應用技巧·拒絕陌生人 開機密碼保護系統安全·系統安全之解開惡意被鎖上的注冊表·系統安全的王牌 我的無敵影子系統·保護系統安全 反間諜軟件大閱兵·為了系統安全千萬別做這些傻事·網絡系統安全漏洞分類研究(上)·網吧系統安全防護 　　首先用Peid查殼，程序並沒有加殼是Delphi編寫的。用dede打開程序並分析，分析的過程中我們就要猜測廣告是通過什麼方式被設置或下載的。

　　分析完成後，我們首先來看看主窗體中的窗體資源，很快可以發現用來播放廣告的組件是TWBS1。

　　代碼如下：

object pnl3: TPanel Left = 244 Top = 0 Width = 470 Height = 60 Color = clWhite TabOrder = 0 object TWBS1: TWebBrowser Left = -11 Top = -17 Width = 580 Height = 193 TabOrder = 0 ControlData = { 4C000000F23B0000F21300000000000000000000000000000000000000000000 000000004C000000000000000000000001000000E0D057007335CF11AE690800 2B2E126208000000000000004C0000000114020000000000C000000000000046 8000000000000000000000000000000000000000000000000000000000000000 00000000000000000100000000000000000000000000000000000000} end end

　　懂Delphi得朋友可能很快就會想到，這個組件通常是通過Navigate或Navigate2來設置url顯示網頁的。如

procedure Navigate(const URL: WideString); overload;

　　我們猜測Navigate可能是在主窗體的OnCreate或者某個TTimer組件的OnTimer中調用，5自學網，所以來到dede中選擇過程頁，接著選擇Unit1既主窗體的單元找到FormCreate過程對應與OnCreate事件。

·一鍵修復所有系統安全漏洞！·豈能兒戲：組策略在系統安全方面的應用·深度挖掘 Windows系統安全模式應用技巧·拒絕陌生人 開機密碼保護系統安全·系統安全之解開惡意被鎖上的注冊表·系統安全的王牌 我的無敵影子系統·保護系統安全 反間諜軟件大閱兵·為了系統安全千萬別做這些傻事·網絡系統安全漏洞分類研究(上)·網吧系統安全防護

　　代碼如下：

00505F34 55 push ebp 00505F35 8BEC mov ebp, esp 00505F37 6A00 push $00 00505F39 6A00 push $00 00505F3B 6A00 push $00 00505F3D 53 push ebx 00505F3E 56 push esi 00505F3F 8BD8 mov ebx, eax 00505F41 33C0 xor eax, eax 00505F43 55 push ebp * Possible String Reference to: '閗囡?腚^[嬪]? | 00505F44 68AC605000 push $005060AC ***** TRY | 00505F49 64FF30 push dword ptr fs:[eax] 00505F4C 648920 mov fs:[eax], esp 00505F4F A124175100 mov eax, dword ptr [$00511724] 00505F54 8B00 mov eax, [eax] 00505F56 8B9340020000 mov edx, [ebx $0240] * Reference to: Chart.TCustomChart.SetTitle(TCustomChart;TChartTitle); | or: Chart.TCustomChart.SetFoot(TCustomChart;TChartTitle); | or: Chart.TCustomChart.SetBackWall(TCustomChart;TChartWall); | or: Chart.TCustomChart.SetLeftWall(TCustomChart;TChartWall); | or: Chart.TCustomChart.SetBottomWall(TCustomChart;TChartWall); | or: ComCtrls.TCustomTreeView.SetTreeNodes(TCustomTreeView;TTreeNodes); | 00505F5C E8630CF8FF call 00486BC4 00505F61 BAC0605000 mov edx, $005060C0 * Reference to control TWBS1 : N.A. | 00505F66 8B830C040000 mov eax, [ebx $040C] * Reference to : TWebBrowser._PROC_0048FEB4() | 00505F6C E8439FF8FF call 0048FEB4 00505F71 C6052C3E510000 mov byte ptr [$00513E2C], $00 * Possible String Reference to: 'setting.ini' | 00505F78 B808615000 mov eax, $00506108 * Reference to: SysUtils.FileExists(AnsiString):Boolean; | 00505F7D E8F233F0FF call 00409374 00505F82 84C0 test al, al 00505F84 7520 jnz 00505FA6 00505F86 66A114615000 mov ax, word ptr [$00506114] 00505F8C 50 push eax 00505F8D 6A00 push $00 00505F8F B101 mov cl, $01 00505F91 BA20615000 mov edx, $00506120 * Reference to control bsSkinMessage1 : N.A. | 00505F96 8B8398030000 mov eax, [ebx $0398] | 00505F9C E8170DFFFF call 004F6CB8 00505FA1 E9EB000000 jmp 00506091 00505FA6 8D55F8 lea edx, [ebp-$08] 00505FA9 A124175100 mov eax, dword ptr [$00511724] 00505FAE 8B00 mov eax, [eax] * Reference to: DdeMan.TDdeMgr.GetExeName(TDdeMgr):AnsiString; | or: Forms.TApplication.GetExeName(TApplication):AnsiString; | 00505FB0 E8CB16F8FF call 00487680 00505FB5 8B45F8 mov eax, [ebp-$08] 00505FB8 8D55FC lea edx, [ebp-$04] * Reference to: SysUtils.ExtractFileDir(AnsiString):AnsiString; | 00505FBB E88435F0FF call 00409544 00505FC0 8D45FC lea eax, [ebp-$04] * Possible String Reference to: '\SETTING.INI' | 00505FC3 BA44615000 mov edx, $00506144 * Reference to: System.@LStrCat; | 00505FC8 E897EAEFFF call 00404A64 00505FCD 8B4DFC mov ecx, [ebp-$04] 00505FD0 B201 mov dl, $01 00505FD2 A1705B4300 mov eax, dword ptr [$00435B70] * Reference to: AxCtrls.TOleStream.Create(TOleStream;boolean;IStream); | or: HelpIntfs.THelpViewerNode.Create(THelpViewerNode;boolean;ICustomHelpViewer); | or: IniFiles.TCustomIniFile.Create(TCustomIniFile;boolean;AnsiString); | or: SysUtils.Exception.Create(Exception;boolean;AnsiString); | 00505FD7 E844FCF2FF call 00435C20 00505FDC 8BF0 mov esi, eax 00505FDE 89B390040000 mov [ebx $0490], esi 00505FE4 685C615000 push $0050615C 00505FE9 8D45F4 lea eax, [ebp-$0C] 00505FEC 50 push eax * Possible String Reference to: 'title' | 00505FED B97C615000 mov ecx, $0050617C * Possible String Reference to: 'system' | 00505FF2 BA8C615000 mov edx, $0050618C 00505FF7 8BC6 mov eax, esi 00505FF9 8B30 mov esi, [eax] 00505FFB FF16 call dword ptr [esi] 00505FFD 8B55F4 mov edx, [ebp-$0C] 00506000 8BC3 mov eax, ebx * Reference to: Controls.TControl.SetText(TControl;TCaption); | 00506002 E8C913F6FF call 004673D0 00506007 B201 mov dl, $01 * Reference to control btn3 : N.A. | 00506009 8B83EC030000 mov eax, [ebx $03EC] 0050600F 8B08 mov ecx, [eax] 00506011 FF5164 call dword ptr [ecx $64] 00506014 C6839804000000 mov byte ptr [ebx $0498], $00 0050601B 33D2 xor edx, edx * Reference to control bsSkinNotebook1 : N.A. | 0050601D 8B83BC030000 mov eax, [ebx $03BC] * Reference to : TbsPageAccess._PROC_004C5988() | 00506023 E860F9FBFF call 004C5988 00506028 803D483E510000 cmp byte ptr [$00513E48], $00 0050602F 752B jnz 0050605C 00506031 6A01 push $01 * Possible String Reference to: 'autoRun' | 00506033 B99C615000 mov ecx, $0050619C * Possible String Reference to: 'system' | 00506038 BA8C615000 mov edx, $0050618C 0050603D 8B8390040000 mov eax, [ebx $0490] 00506043 8B30 mov esi, [eax] 00506045 FF5610 call dword ptr [esi $10] 00506048 84C0 test al, al 0050604A 7410 jz 0050605C 0050604C BAB80B0000 mov edx, $00000BB8 * Reference to control tmr2 : N.A. | 00506051 8B834C030000 mov eax, [ebx $034C] * Reference to: ExtCtrls.TTimer.SetInterval(TTimer;Cardinal); | or: IBDatabase.TIBTimer.SetInterval(TIBTimer;Cardinal); | 00506057 E8F4E2F2FF call 00434350 0050605C 8D83A8040000 lea eax, [ebx $04A8] * Reference to: System.@LStrClr(void;void); | 00506062 E835E7EFFF call 0040479C 00506067 8D83AC040000 lea eax, [ebx $04AC] * Reference to: System.@LStrClr(void;void); | 0050606D E82AE7EFFF call 0040479C 00506072 33C0 xor eax, eax 00506074 8983B4040000 mov [ebx $04B4], eax 0050607A 33C0 xor eax, eax 0050607C 8983B8040000 mov [ebx $04B8], eax 00506082 33C0 xor eax, eax 00506084 8983BC040000 mov [ebx $04BC], eax 0050608A C605353E510000 mov byte ptr [$00513E35], $00 00506091 33C0 xor eax, eax 00506093 5A pop edx 00506094 59 pop ecx 00506095 59 pop ecx 00506096 648910 mov fs:[eax], edx ****** FINALLY | * Possible String Reference to: '^[嬪]? | 00506099 68B3605000 push $005060B3 0050609E 8D45F4 lea eax, [ebp-$0C] 005060A1 BA03000000 mov edx, $00000003 * Reference to: System.@LStrArrayClr(void;void;Integer); | 005060A6 E815E7EFFF call 004047C0 005060AB C3 ret * Reference to: System.@HandleFinally; | 005060AC E96BE0EFFF jmp 0040411C 005060B1 EBEB jmp 0050609E ****** END | 005060B3 5E pop esi 005060B4 5B pop ebx 005060B5 8BE5 mov esp, ebp 005060B7 5D pop ebp 005060B8 C3 ret

·一鍵修復所有系統安全漏洞！·豈能兒戲：組策略在系統安全方面的應用·深度挖掘 Windows系統安全模式應用技巧·拒絕陌生人 開機密碼保護系統安全·系統安全之解開惡意被鎖上的注冊表·系統安全的王牌 我的無敵影子系統·保護系統安全 反間諜軟件大閱兵·為了系統安全千萬別做