如何使用WinDbg查找恶意软件（否）
介绍
在本文中，我将展示如何使用WinDbg查找（或不使用）恶意软件替换某些应用程序加载的DLL中系统函数调用的地址。因此，例如，我一直在寻找保护模块为何无法加载到1C配置中的原因。
为了演示，我们需要一个应用程序，该应用程序加载了两个DLL：其中一个称为受害者（受害者），另一个称为-捕食者 喷油器。后者被引入受害者中，代替了对系统功能的调用（为简单起见，请使用Sleep），并且将在某些条件下调用AV（下一篇文章将需要它）。
因为 由于用Delphi编写的应用程序不会因未处理的异常而崩溃到核心转储中，因此我们的主应用程序（DLLInjectionDemo）是用C编写的，并通过尽早绑定到受害DLL进行链接，并且为了易于重现这种情况，它将加载DLL注入器在启动时传入选项，并在其中调用会损害受害者的方法。特别是对于本文而言，用任何编程语言编写的应用程序都适合我们，但我们将用一块石头杀死两只鸟。
应用程序源代码使用C和Delphi 10.3 Rio Community Edition编写，并且针对Win32编译MinGW和Delphi。，并且适用于Win64（以及Lazarus中的FPC）。
因此，我们同时编译DLL和主应用程序
> msbuild /t:build victim.dproj /p:Platform=Win32;Config=Debug;DCC_Exeoutput=.
> msbuild /t:build injector.dproj /p:Platform=Win32;Config=Debug;DCC_Exeoutput=.
> mingw32-make
要使用MinGW make进行构建，您当然需要在PATH中进行注册
:
C:\Users\demo>DLLInjectionDemo.exe
Sleeping 100 milliseconds
Done!
-L injector (, , , - )
c:\Users\demo>DLLInjectionDemo.exe -L injector
Loading injector
Searching...
oleaut32.dll
advapi32.dll
user32.dll
kernel32.dll
kernel32.dll
user32.dll
version.dll
kernel32.dll
kernel32.dll
netapi32.dll
oleaut32.dll
Injected
Sleeping 100 milliseconds
New sleep instead of 100
Done!
, , Sleep - . ( , ). ( , GUI-, , , , -i(interactive)).
c:\Users\demo>DLLInjectionDemo.exe -i -L injector
Loading injector
Searching...
oleaut32.dll
advapi32.dll
user32.dll
kernel32.dll
kernel32.dll
user32.dll
version.dll
kernel32.dll
kernel32.dll
netapi32.dll
oleaut32.dll
Injected
Sleeping 100 milliseconds
New sleep instead of 100
Done!
Press ENTER...
( ). : , , , , " ...", .
WinDbg, :
File — Open Crash Dump (Ctrl+D)
:
%PROGRAM FILES%\Windows Kits\10\Debuggers\x64\windbg.exe" -z C:\Users\demo\App Data\Local\Temp\DLLInjectionDemo.DMP
Loading Dump File [C:\Users\alex\AppData\Local\Temp\DLLInjectionDemo.DMP]
User Mini Dump File with Full Memory: Only application data is available
Symbol search path is: srv*
Executable search path is:
Windows 7 Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: SingleUserTS
Machine Name:
Debug session time: Thu Jul 4 08:46:18.000 2019 (UTC + 3:00)
System Uptime: 17 days 12:25:45.404
Process Uptime: 0 days 0:00:10.000
........................
For analysis of this file, run !analyze -v
ntdll!NtRequestWaitReplyPort+0xa:
00000000`77bcddfa c3 ret
For analysis of this file, run !analyze -v ( , ).
IAT — (Import Address Table) — DLL, (? , IAT ;) ). , PE- ( DLL ) WinDbg Windows 10 SDK ( Windows 7) , " ", WinDbg 6, .
. :
lm
0:000> lm
start end module name
00000000`003b0000 00000000`003db000 injector (deferred)
00000000`00400000 00000000`00412000 DLLInjectionDemo (deferred)
00000000`00520000 00000000`00616000 victim (deferred)
00000000`6e580000 00000000`6e5b4000 libmingwex_2 (deferred)
00000000`72870000 00000000`72886000 netapi32 (deferred)
...
Nota bene: 32- , 64-...
, DLL , IAT , !dh -a:
!dh 009c0000 -a
!dh victim -a0:000> !dh victim -a
File Type: DLL
FILE HEADER VALUES
14C machine (i386)
A number of sections
5E5F4251 time date stamp Wed Mar 4 09:53:21 2020
0 file pointer to symbol table
0 number of symbols
E0 size of optional header
A18E characteristics
Executable
Line numbers stripped
Symbols stripped
Bytes reversed
32 bit word machine
DLL
OPTIONAL HEADER VALUES
10B magic #
2.25 linker version
CE400 size of code
1BA00 size of initialized data
0 size of uninitialized data
CF79C address of entry point
1000 base of code
----- new -----
0000000000400000 image base
1000 section alignment
200 file alignment
2 subsystem (Windows GUI)
5.00 operating system version
0.00 image version
5.00 subsystem version
F6000 size of image
400 size of headers
0 checksum
0000000000000000 size of stack reserve
0000000000000000 size of stack commit
0000000000100000 size of heap reserve
0000000000001000 size of heap commit
0 DLL characteristics
DD000 [ A4] address [size] of Export Directory
DA000 [ 105C] address [size] of Import Directory
F3000 [ 2A00] address [size] of Resource Directory
0 [ 0] address [size] of Exception Directory
0 [ 0] address [size] of Security Directory
...
kernel32.dll ( Sleep)
Nota bene: 32- _IMAGE_IMPORT_DESCRIPTOR 64-. , , Delphi .
...
_IMAGE_IMPORT_DESCRIPTOR 00000000005fa03c
kernel32.dll
005FA398 Import Address Table
005FA11C Import Name Table
0 time date stamp
0 Index of first forwarder reference
003C7C7C 0 Sleep
76EE184A 0 VirtualFree
76EE1832 0 VirtualAlloc
76EE16DC 0 lstrlenW
76EE4422 0 VirtualQuery
76EE110C 0 GetTickCount
...
,
`kernel32.dll`0:000> !dh kernel32
File Type: DLL
FILE HEADER VALUES
14C machine (i386)
4 number of sections
5708A7E3 time date stamp Sat Apr 9 10:57:39 2016
...
----- new -----
0000000076ed0000 image base
...
.. 0000000076ed0000
, — ?
WinDbg lm
0:000> lma 003C7C7C
Browse full module list
start end module name
00000000`003b0000 00000000`003db000 injector (deferred)
, ! . ( v lm)
0:000> lma 003C7C7C v
Browse full module list
start end module name
00000000`003b0000 00000000`003db000 injector (deferred)
Image path: z:\habr\DLLInjectionDemo\injector.dll
Image name: injector.dll
Browse all global symbols functions data
Timestamp: Wed Mar 4 09:53:12 2020 (5E5F4248)
CheckSum: 00000000
ImageSize: 0002B000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
!
Image path: C:\Users\demo\injector.dll
, .
因此，在实际情况下，我迅速设法在制造商的预装操作系统上找到了一些奇怪的DLL，该DLL拦截了函数调用WriteFile。
在下面的文章中，我将使用本文中的应用程序，其中我想向读者展示如何使用WinDbg查明为什么应用程序崩溃（或至少大致在何处）导致访问冲突（由于Delphi编写的DLL由于某种原因无法使用远程访问冲突）。无论哪种原因。尽管Delphi没有分析应用程序转储的工具，但它不知道如何生成PDB文件。