Me he encargado de comentar las lineas que entiendo en ingles, pero aún así hay partes que no comprendo. Si pudieran ayudarme indicandome que hacen las partes sin comentar estaría muy agradecido. Tengo algunos conocimientos sobre las estructuras internas de Windows, así que no piensen que estoy haciendo preguntas de novatos o fuera de lugar, espero no haberme equivocado en postear esta pregunta. Gracias por sus respuestas de antemano.
Aquí está el codigo fuente:
Código
;This is a fragment of code that could be used to make malware that use API dynamicly without ;tells to the assembler which API we want to use. This is very useful to generate malware that ;no uses import table in the executable, provided a better way to perform actions without ;modify the host import table, like a virus, trojan. The original code was written by ;SIGSEV, but I added comments to the code to clarify its actions. I can't understand all, I need help format pe console 4.0 pushad call CodeStart CodeStart: pop ebp sub ebp,CodeStart ; delta offset shit finding_kernel32: mov ebx, [FS : 0x30] ;FS:0x30 points to the address of Process Environment Block (PEB) ;Now the Base Pointer (BX) points to the address of PEB in memory mov ebx, [ebx + 0x0C] ;Now we move 0x0C (12 bytes) from the address of PEB ;We get the value of ebx+0x0c, in other words, the address that has the PEB->Ldr pointer ;Now we are in Ldr structure. We move the ebx pointer following the address in the ;PEB->Ldr pointer. mov ebx, [ebx + 0x14] ; get PEB->Ldr.InMemoryOrderModuleList.Flink (1st entry) mov ebx, [ebx] ;2nd Entry mov ebx, [ebx] ;3rd Entry mov ebx, [ebx + 0x10] ; Get Kernel32 Base mov [ebp+dwKernelBase] , ebx add ebx, [ebx+0x3C] ; Start of PE header mov ebx, [ebx+0x78] ; RVA of export dir add ebx, [ebp+dwKernelBase] ; VA of export dir mov [ebp+dwExportDirectory] , ebx lea edx,[ebp+api_GetProcAddress] ;Load in ebp the address of the API function name. mov ecx,[ebp+len_GetProcAddress] ;Load in ecx the size of the API function name call GetFunctionAddress ;Call GetFunctionAddress mov [ebp+AGetProcAddressA] , eax ;The API function address in memory was stored by the ;GetFunctionAddress function in eax, now we save the address ;of the GetProcAddress in a variable for later use. lea edx,[ebp+api_LoadLibrary] ;Load in edx the API function name of LoadLibrary push edx ;Save edx in the stack push dword [ebp+dwKernelBase] call eax mov [ebp+ALoadLibraryA] , eax lea edx , [ebp+szUser32] push edx call eax lea edx , [ebp+api_MessageBoxA] push edx push eax mov ebx,[ebp+AGetProcAddressA] call ebx mov [ebp+AMessageBoxAA] , eax push 0 lea edx,[ebp+szTitle] push edx lea edx,[ebp+szMsg] push edx push 0 call eax popad push 0xBBBBBBBB ;OEP retn ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; <<<<< GetFunctionAddress >>>>>> ; ; Extracts Function Address From Export Directory and returns it in eax ; ; Parameters : Function name in edx , Length in ecx ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; GetFunctionAddress: push ebx ;Save status of registers before execute the subroutine push esi ;to preserve its content. It could make some errors to the push edi ;caller function if modify the values that are common of the whole ;program mov esi, [ebp+dwExportDirectory] mov esi, [esi+0x20] ;RVA of ENT add esi, [ebp+dwKernelBase] ;VA of ENT xor ebx,ebx cld looper: inc ebx lodsd ;Load a byte from the string pointed by SI into al register add eax , [ebp+dwKernelBase] ;eax now points to the string of a function push esi ;preserve it for the outer loop mov esi,eax mov edi,edx cld push ecx repe cmpsb pop ecx pop esi jne looper dec ebx mov eax,[ebp+dwExportDirectory] mov eax,[eax+0x24] ;RVA of EOT add eax,[ebp+dwKernelBase] ;VA of EOT movzx eax , word [ebx*2+eax] ;eax now holds the ordinal of our function mov ebx,[ebp+dwExportDirectory] mov ebx,[ebx+0x1C] ;RVA of EAT add ebx,[ebp+dwKernelBase] ;VA of EAT mov ebx,[eax*4+ebx] add ebx,[ebp+dwKernelBase] mov eax,ebx pop edi ;Restore the registers to avoid generate a problem pop esi ;in the caller function. pop ebx ret ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; Data Shit ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; szTitle: db "Yo !",0 szMsg: db "GreeTz From SIGSEGV",0 szUser32 db "User32.dll",0 AGetProcAddressA: dd 0 api_GetProcAddress: db "GetProcAddress" len_GetProcAddress: dd $-api_GetProcAddress ALoadLibraryA: dd 0 api_LoadLibrary: db "LoadLibraryA",0 AMessageBoxAA: dd 0 api_MessageBoxA: db "MessageBoxA",0 dwKernelBase: dd 0 dwExportDirectory: dd 0