EV加密播放器的分析过程和过虚拟机实战

2023-10-07 17:36| 来源: 网络整理| 查看: 265

0040882F C74424 04 00060>mov dword ptr ss:[esp+0x4],EVPlayer.0100>; OK 00408837 8D5D 9C lea ebx,dword ptr ss:[ebp-0x64] 0040883A C70424 A010FE00 mov dword ptr ss:[esp],EVPlayer.00FE10A0 00408841 8985 70FFFFFF mov dword ptr ss:[ebp-0x90],eax 00408847 FFD6 call esi 00408849 83EC 0C sub esp,0xC 0040884C 8D45 A0 lea eax,dword ptr ss:[ebp-0x60] 0040884F C74424 08 00000>mov dword ptr ss:[esp+0x8],0x0 00408857 8D4D 94 lea ecx,dword ptr ss:[ebp-0x6C] 0040885A C74424 04 14060>mov dword ptr ss:[esp+0x4],EVPlayer.0100>; Can not work in virtual Machine 00408862 C70424 A010FE00 mov dword ptr ss:[esp],EVPlayer.00FE10A0 00408869 8985 70FFFFFF mov dword ptr ss:[ebp-0x90],eax 0040886F 89B5 74FFFFFF mov dword ptr ss:[ebp-0x8C],esi 00408875 FFD6 call esi 00408877 83EC 0C sub esp,0xC 0040887A 8D75 90 lea esi,dword ptr ss:[ebp-0x70] 0040887D 8D45 A0 lea eax,dword ptr ss:[ebp-0x60] 00408880 89F1 mov ecx,esi 00408882 C74424 08 00000>mov dword ptr ss:[esp+0x8],0x0 0040888A C74424 04 E1050>mov dword ptr ss:[esp+0x4],EVPlayer.0100>; Note 00408892 C70424 A010FE00 mov dword ptr ss:[esp],EVPlayer.00FE10A0 00408899 8985 70FFFFFF mov dword ptr ss:[ebp-0x90],eax 0040889F FF95 74FFFFFF call dword ptr ss:[ebp-0x8C] 004088A5 83EC 0C sub esp,0xC 004088A8 8D55 98 lea edx,dword ptr ss:[ebp-0x68] 004088AB 8D45 A0 lea eax,dword ptr ss:[ebp-0x60] 004088AE 895424 0C mov dword ptr ss:[esp+0xC],edx 004088B2 8D55 94 lea edx,dword ptr ss:[ebp-0x6C] 004088B5 C74424 1C FFFFF>mov dword ptr ss:[esp+0x1C],-0x1 004088BD C74424 18 00000>mov dword ptr ss:[esp+0x18],0x0 004088C5 8985 70FFFFFF mov dword ptr ss:[ebp-0x90],eax 004088CB 894424 14 mov dword ptr ss:[esp+0x14],eax 004088CF 895C24 10 mov dword ptr ss:[esp+0x10],ebx 004088D3 895424 08 mov dword ptr ss:[esp+0x8],edx 004088D7 897424 04 mov dword ptr ss:[esp+0x4],esi 004088DB C70424 00000000 mov dword ptr ss:[esp],0x0 004088E2 FF15 58C2D501 call dword ptr ds:[0x1D5C258] ; QtGui4._ZN11QMessageBox11informationEP7QWidgetRK7QStringS4_S4_S4_S4_ii 004088E8 89F1 mov ecx,esi

Can not work in virtual Machine 这字符是不是很熟悉？在向上翻，找关键位置下断。重新加载播放器，F9在运行。最终我们发现一个可疑位置：

004082EE /0F84 DC030000 je EVPlayer.004086D0 004082F4 |8D45 84 lea eax,dword ptr ss:[ebp-0x7C] 004082F7 |E8 84F8FFFF call EVPlayer.00407B80 004082FC |8B35 3CBDD501 mov esi,dword ptr ds:[0x1D5BD3C] ; QtCore4._ZN7QString16fromAscii_helperEPKci 00408302 |C74424 04 FFFFF>mov dword ptr ss:[esp+0x4],-0x1 0040830A |C70424 03060001 mov dword ptr ss:[esp],EVPlayer.01000603 ; VMWARE 00408311 |FFD6 call esi ; ?? 00408313 |8945 88 mov dword ptr ss:[ebp-0x78],eax 00408316 |8D45 88 lea eax,dword ptr ss:[ebp-0x78] 00408319 |89F9 mov ecx,edi 0040831B |8985 6CFFFFFF mov dword ptr ss:[ebp-0x94],eax 00408321 |890424 mov dword ptr ss:[esp],eax 00408324 |A1 4CC0D501 mov eax,dword ptr ds:[0x1D5C04C] 00408329 |C74424 08 01000>mov dword ptr ss:[esp+0x8],0x1 00408331 |C74424 04 00000>mov dword ptr ss:[esp+0x4],0x0 00408339 |8985 70FFFFFF mov dword ptr ss:[ebp-0x90],eax 0040833F |FFD0 call eax 00408341 |83EC 0C sub esp,0xC 00408344 |83F8 FF cmp eax,-0x1 00408347 |BB 01000000 mov ebx,0x1 0040834C |0F84 CE030000 je EVPlayer.00408720

VMWARE 这是不是也熟悉？前面讲了，它是对特征码来判断虚拟机的。于是我们把这字符串直接修改成别的后。F9运行，发现播放器启动了。就这样跳过虚拟机检测了。文章分享到此结束了。

【本文地址】

公司简介

联系我们