windbg使用实践1_使用windbg调试杀毒软件的弹窗

浏览数：33 / 时间：2015年06月12日

1 通过kifastcallentry或者常规的SSDT 挂钩实现的弹窗

2 文件过滤驱动引起弹窗

!process 0 0 //列出所有进程

.reload
!process fffffa800a04b3a0 f //列出指定进程的所有的栈回溯

!irp //如果是因为释放敏感文件被弹窗使用这条命令观察IRP

!fileobj //解析IRP里面的文件名

3 敏感注册表写入引起注册表回调的弹窗

如果我们不清楚是因为我们释放了敏感文件还是写了敏感注册表

列出进程的所有handle 看handle count 如果count 很小就证明一出来就被抓了

!handle 0 7 86a94270 (这里是敏感进程的EPROCESS)

这篇文章主要分析的是使用test_reg写了敏感注册表引起了杀软弹窗

!process 0 0
PROCESS fffffa800a04b3a0
SessionId: 1 Cid: 0d0c Peb: 7efdf000 ParentCid: 0960
DirBase: 24000000 ObjectTable: fffff8a00189fbf0 HandleCount: 254.
Image: LiveUpdate360.exe

.reload
!process fffffa800a04b3a0 f
列出所有的栈回溯我们可以看到很多线程证明这个弹窗不是由于进程回调引起的如果是进程回调弹窗的话创建第一个线程的时候就弹窗了。

首先贴一下完整的栈

 1 THREAD fffffa800a09e060 Cid 0ec0.0d70 Teb: 000000007ef97000 Win32Thread: fffff900c06b4260 WAIT: (DelayExecution) KernelMode Non-Alertable
 2 fffff88003b0f200 SynchronizationEvent
 3 Not impersonating
 4 DeviceMap fffff8a0010c4980
 5 Owning Process fffffa8009c10b30 Image: test_reg.exe
 6 Attached Process N/A Image: N/A
 7 Wait Start TickCount 475720 Ticks: 655 (0:00:00:10.218)
 8 Context Switch Count 217 IdealProcessor: 0 LargeStack
 9 UserTime 00:00:00.000
10 KernelTime 00:00:00.015
11 Win32 Start Address 0x00000000004051a7
12 Stack Init fffff88003b0fc70 Current fffff88003b0ef20
13 Base fffff88003b10000 Limit fffff88003b08000 Call 0
14 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5
15 Child-SP RetAddr Call Site
16 fffff880`03b0ef60 fffff800`03e8f992 nt!KiSwapContext+0x7a
17 fffff880`03b0f0a0 fffff800`03e921af nt!KiCommitThreadWait+0x1d2
18 fffff880`03b0f130 fffff880`040239d9 nt!KeWaitForSingleObject+0x19f
19 fffff880`03b0f1d0 fffff880`04024c9b 360FsFlt+0x1f9d9
20 fffff880`03b0f250 fffff880`04026adb 360FsFlt+0x20c9b
21 fffff880`03b0f2f0 fffff800`04230100 360FsFlt+0x22adb
22 fffff880`03b0f320 fffff800`040ea16d nt!CmpCallCallBacks+0x1c0
23 fffff880`03b0f3f0 fffff800`04184d38 nt! ?? ::NNGAKEGL::`string‘+0x2d3bd
24 fffff880`03b0f6f0 fffff800`04185f56 nt!ObpLookupObjectName+0x588
25 fffff880`03b0f7e0 fffff800`0413d8f8 nt!ObOpenObjectByName+0x306
26 fffff880`03b0f8b0 fffff800`0413e19e nt!CmCreateKey+0x2e1
27 fffff880`03b0fa20 fffff800`03e898d3 nt!NtCreateKey+0x2e
28 fffff880`03b0fa70 00000000`76e314ea nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`03b0fae0)
29 00000000`0448e698 00000000`00000000 0x76e314ea
30 
31 如果从CmCreateKey中 把 _Object_Attributes 拿出来 涉及到栈操作的只有这么多
32 
33 PAGE:FFFFF80004180614 48 8B C4 mov rax, rsp
34 PAGE:FFFFF80004180617 4C 89 40 18 mov [rax+18h], r8
35 PAGE:FFFFF8000418061B 48 89 48 08 mov [rax+8], rcx
36 PAGE:FFFFF8000418061F 53 push rbx
37 PAGE:FFFFF80004180620 56 push rsi
38 PAGE:FFFFF80004180621 57 push rdi
39 PAGE:FFFFF80004180622 41 54 push r12
40 PAGE:FFFFF80004180624 41 55 push r13
41 PAGE:FFFFF80004180626 41 56 push r14
42 PAGE:FFFFF80004180628 41 57 push r15
43 PAGE:FFFFF8000418062A 48 81 EC 30 01 00 00 sub rsp, 130h
44 PAGE:FFFFF80004180631 4D 8B E8 mov r13, r8
45 
46 参数传递是这样的 多于四个参数
47 
48 
49 ZwCreateKey(
50 OUT PHANDLE KeyHandle,
51 IN ACCESS_MASK DesiredAccess,
52 IN POBJECT_ATTRIBUTES ObjectAttributes,
53 IN ULONG TitleIndex,
54 IN PUNICODE_STRING Class OPTIONAL,
55 IN ULONG CreateOptions,
56 OUT PULONG Disposition OPTIONAL
57 );
58 
59 
60 堆栈 Disposition
61 堆栈 CreateOptions
62 堆栈 Class
63 r9 TitleIndex
64 r8 ObjectAttributes
65 rdx DesiredAccess
66 rcx KeyHandle
67 
68 fffff880`03b0f8b0 fffff800`0413e19e nt!CmCreateKey+0x2e1
69 fffff880`03b0fa20 fffff800`03e898d3 nt!NtCreateKey+0x2e
70 fffff880`03b0fa70 00000000`76e314ea nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`03b0fae0)
71 
72 
73 一下子就可以看到写哪个注册表被弹窗了
74 dt _Object_Attributes poi(fffff880`03b0f8b0+130+7*8+18)
75 
76 这块或者这么算 fffff880`03b0fa20-8+18