卡巴加密驱动解密代码
之前看卡巴的驱动，发现它的kl1.sys会在BOOT时读取参数，然后将drivers下的.dat驱动解密并自己分配内存加载（加载的代码填充IAT部分有BUG）
写了个解密小程序：
只试了klick.sys
#include "stdafx.h"
#include "windows.h"
#include "winbase.h"
#include "malloc.h"
unsigned char data[256] = {
0x42, 0xA3, 0x53, 0x04, 0x4D, 0x4B, 0xA3, 0xC4, 0xEC, 0xF8, 0xE5, 0x41, 0x9D, 0xEF, 0xAE, 0x46,
0x95, 0x59, 0x7D, 0xF3, 0x98, 0xBD, 0xDC, 0xD4, 0x1F, 0xE9, 0xC1, 0xD9, 0xFB, 0xF1, 0xE9, 0x8D,
0x85, 0x0B, 0x7B, 0x14, 0x56, 0x12, 0x33, 0xCC, 0xFD, 0x47, 0x48, 0xF5, 0x0C, 0x4C, 0x24, 0xC2,
0x3D, 0x2F, 0xB6, 0xC4, 0x66, 0xD3, 0xDD, 0x73, 0x54, 0xAE, 0xE4, 0x4F, 0xF1, 0x1B, 0x94, 0xFC,
0xBC, 0x4E, 0x7C, 0x66, 0xF4, 0x90, 0xCD, 0xA1, 0xA2, 0xF7, 0xB6, 0xDD, 0x83, 0x57, 0x04, 0x7C,
0x10, 0x14, 0x20, 0x10, 0xF4, 0x3C, 0x2C, 0x7A, 0x87, 0x30, 0xAB, 0x3C, 0xDE, 0x86, 0x31, 0xCE,
0x4D, 0x63, 0xAD, 0xCB, 0xB3, 0x13, 0x94, 0xFA, 0x5B, 0xD5, 0x88, 0x98, 0x06, 0x29, 0xEB, 0xA0,
www_bitscn_com中国.网管联盟
0x20, 0x3A, 0xDB, 0x7A, 0x80, 0xBD, 0x1D, 0x08, 0xC3, 0x05, 0x56, 0xCA, 0x44, 0xA1, 0xAB, 0x3A,
0x41, 0x43, 0x6A, 0x2C, 0x64, 0x27, 0x53, 0xCD, 0xE9, 0x09, 0x45, 0x16, 0x46, 0xAF, 0xBE, 0xB8,
0x0D, 0x8D, 0xBA, 0x1B, 0xE1, 0xF3, 0xD2, 0x50, 0xAA, 0xD1, 0x3C, 0xCA, 0xEA, 0x8D, 0x10, 0xE5,
0x59, 0x2C, 0xA1, 0x21, 0x9B, 0x08, 0xDB, 0x2E, 0x2C, 0x62, 0x6E, 0xFF, 0xB1, 0xEB, 0xAA, 0x2D,
0x90, 0xFF, 0x0C, 0x59, 0x7B, 0x3A, 0x08, 0xEC, 0x0A, 0xC9, 0xC3, 0x4C, 0x63, 0x4F, 0x73, 0xC1,
0xC8, 0x4E, 0xA5, 0x9C, 0xB0, 0xEE, 0xF4, 0xEE, 0x4D, 0x93, 0x13, 0x67, 0x9E, 0x3D, 0x4D, 0xA6,
0x01, 0x5F, 0x1F, 0x61, 0x8F, 0x9E, 0x57, 0xAC, 0x44, 0xB5, 0xFB, 0x40, 0x1E, 0xFC, 0x00, 0xAE,
0xDA, 0x36, 0xEA, 0x49, 0x64, 0x05, 0x1A, 0x1B, 0x4E, 0xD4, 0x29, 0x4D, 0xBB, 0x81, 0x7D, 0x6B,
0xC4, 0xF2, 0x39, 0x98, 0xC9, 0x2F, 0xB7, 0xCB, 0xBD, 0x6D, 0xFC, 0x3E, 0xC9, 0x3E, 0x20, 0xAB
};
int main(int argc, char* argv[])
{
FILE* file ;
if (argc != 2)
bbs.bitsCN.com中国网管论坛
{
printf("INPUT sys name!\n");
return 0;
}
printf("decode drv file:%s\n" , argv[1]);
file = fopen(argv[1] , "r+b");
fseek(file , 0, SEEK_END);
ULONG t = ftell(file);
printf("file length %08x\n" , t);
ULONG u =(ULONG)malloc(t);
fseek(file , 0 , SEEK_SET);
DWORD z = fread((PVOID)u , 1 , t , file);
fseek(file , 0 , SEEK_SET);
ULONG i ;
for (i = 0 ; i < t ; i++)
{
__asm
{
push edx
push ecx
mov edx , u
mov ecx , i
mov eax , i
and eax , 0xff
mov al , data[eax]
xor [edx + ecx] , al
pop ecx
pop edx
}
}
printf("%u", t);
fwrite((PVOID)u , 1 , t , file);
fclose(file);
printf("OK!\n");
return 0 ;
}
Mine(美文) Studio QQ群：6292997
