第06课_动态调试预备知识.doc

第六课 动态调试预备知识
一、API
Windows程序都是高级程序，它需要调用通用的系统底层函数，这些函数被封装在kerner32.dll、user32.dll、gdi2.dll等dll中。底层和高层之间的联络是通过api来牵线搭桥的。api就像和珅，皇帝和大臣之间的沟通、上下级传达都得通过他来实现。
Ø Kernerl32.dll为系统服务，主要为系统内部管理。
Ø Gdi32.dll主要提供图形服务。
Ø User32.dll提供用户服务，创建窗口和传递消息等。
例如：某函数定义如下：函数（参数1，参数2，参数3，参数4）
则汇编语言的函数调用为
Push 参数4
Push 参数3
Push 参数2
Push 参数1
Call 函数 返回值永远保存在eax中
下面看一个用32位汇编编写的应用程序。此程序运行后弹出一个消息框，点‘确定’按钮后，程序退出。

其ollydbg反汇编代码如下：

00403000=MSGBOX2.00403000 (ASCII "Iczelion's tutorial no.2") 消息框标题
00403019=MSGBOX2.00403019 (ASCII "Win32 Assembly is Great!") 消息框正文
其中用到了api函数：MessageBox和ExitProcess。
查api手册，MessageBox原型如下：
×××××××××××××××××××××××××××××××××××××××
以下全部来自api手册
MessageBox

The MessageBox function creates, displays, and operates a message box. The message box contains an application-defined message and title, plus any combination of predefined icons and push buttons.

int MessageBox(

HWND hWnd, // handle of owner window 父窗口句柄
LPCTSTR lpText, // address of text in message box 消息正文内容地址
LPCTSTR lpCaption, // address of title of message box 消息标题地址
UINT uType // style of message box 消息框的类型
);

Parameters

hWnd

Identifies the owner window of the message box to be created. If this parameter is NULL, the message box has no owner window.

lpText

Points to a null-terminated string containing the message to be displayed.

lpCaption

Points to a null-terminated string used for the dialog box title. If this parameter is NULL, the default title Error is used.

uType

Specifies a set of bit flags that determine the contents and behavior of the dialog box. This parameter can be a combination of flags from the following groups of flags.
Specify one of the following flags to indicate the buttons contained in the message box:

Flag Meaning
MB_ABORTRETRYIGNORE The message box contains three push buttons: Abort, Retry, and Ignore.
MB_OK The message box contains one push button: OK. This is the default.
MB_OKCANCEL The message box contains two push buttons: OK and Cancel.
MB_RETRYCANCEL The message box contains two push buttons: Retry and Cancel.
MB_YESNO The message box contains two push buttons: Yes and No.
MB_YESNOCANCEL The message box contains three push buttons: Yes, No, and Cancel.

Specify one of the following flags to display an icon in the message box:

Flag Meaning
MB_ICONEXCLAMATION,
MB_ICONWARNING
An exclamation-point icon appears in the message box.
MB_ICONINFORMATION, MB_ICONASTERISK
An icon consisting of a lowercase letter i in a circle appears in the message box.
MB_ICONQUESTION A question-mark icon appears in the message box.
MB_ICONSTOP,
MB_ICONERROR,
MB_ICONHAND
A stop-sign icon appears in the message box.

Specify one of the following flags to indicate the default button:

Flag Meaning
MB_DEFBUTTON1 The first button is the default button. MB_DEFBUTTON1 is the default unless MB_DEFBUTTON2, MB_DEFBUTTON3, or MB_DEFBUTTON4 is specified.
MB_DEFBUTTON2 The second button is the default button.
MB_DEFBUTTON3 The third button is the default button.
MB_DEFBUTTON4 The fourth button is the default button.

Specify one of the following flags to indicate the modality of the dialog box:

Flag Meaning
MB_APPLMODAL The user must respond to the message box before continuing work in the window identified by the hWnd parameter. However, the user can move to the windows of other applications and work in those windows. Depending on the hierarchy of windows in the application, the user may be able to move to other windows within the application. All child windows of the parent of the message box are automatically disabled, but popup windows are not.MB_APPLMODAL is the default if neither MB_SYSTEMMODAL nor MB_TASKMODAL is specified.
MB_SYSTEMMODAL Same as MB_APPLMODAL except that the message box has the WS_EX_TOPMOST style. Use system-modal message boxes to notify the user of serious, potentially damaging errors that require immediate attention (for example, running out of memory). This flag has no effect on the user's ability to interact with windows other than those associated with hWnd.
MB_TASKMODAL Same as MB_APPLMODAL except that all the top-level windows belonging to the current task are disabled if the hWnd parameter is NULL. Use this flag when the calling application or library does not have a window handle available but still needs to prevent input to other windows in the current application without suspending other applications.

In addition, you can specify the following flags:

MB_DEFAULT_DESKTOP_ONLY

The desktop currently receiving input must be a default desktop; otherwise, the function fails. A default desktop is one an application runs on after the user has logged on.

MB_HELP

Adds a Help button to the message box. Choosing the Help button or pressing F1 generates a Help event.

MB_RIGHT

The text is right-justified.

MB_RTLREADING

Displays message and caption text using right-to-left reading order on Hebrew and Arabic systems.

MB_SETFOREGROUND

The message box becomes the foreground window. Internally, Windows calls the SetForegroundWindow function for the message box.

MB_TOPMOST

The message box is created with the WS_EX_TOPMOST window style.

MB_SERVICE_NOTIFICATION

Windows NT only: The caller is a service notifying the user of an event. The function displays a message box on the current active desktop, even if there is no user logged on to the computer.
If this flag is set, the hWnd parameter must be NULL. This is so the message box can appear on a desktop other than the desktop corresponding to the hWnd.
For Windows NT version 4.0, the value of MB_SERVICE_NOTIFICATION has changed. See WINUSER.H for the old and new values. Windows NT 4.0 provides backward compatibility for pre-existing services by mapping the old value to the new value in the implementation of MessageBox and MessageBoxEx. This mapping is only done for executables that have a version number, as set by the linker, less than 4.0.

To build a service that uses MB_SERVICE_NOTIFICATION, and can run on both Windows NT 3.x and Windows NT 4.0, you have two choices.

1. At link-time, specify a version number less than 4.0; or
2. At link-time, specify version 4.0. At run-time, use the GetVersionEx function to check the system version. Then when running on Windows NT 3.x, use MB_SERVICE_NOTIFICATION_NT3X; and on Windows NT 4.0, use MB_SERVICE_NOTIFICATION.

MB_SERVICE_NOTIFICATION_NT3X

Windows NT only: This value corresponds to the value defined for MB_SERVICE_NOTIFICATION for Windows NT version 3.51.

Return Values返回值

The return value is zero if there is not enough memory to create the message box.
If the function succeeds, the return value is one of the following menu-item values returned by the dialog box:

Value Meaning
IDABORT Abort button was selected.
IDCANCEL Cancel button was selected.
IDIGNORE Ignore button was selected.
IDNO No button was selected.
IDOK OK button was selected.
IDRETRY Retry button was selected.
IDYES Yes button was selected.

If a message box has a Cancel button, the function returns the IDCANCEL value if either the ESC key is pressed or the Cancel button is selected. If the message box has no Cancel button, pressing ESC has no effect.

Remarks

When you use a system-modal message box to indicate that the system is low on memory, the strings pointed to by the lpText and lpCaption parameters should not be taken from a resource file, because an attempt to load the resource may fail.
When an application calls MessageBox and specifies the MB_ICONHAND and MB_SYSTEMMODAL flags for the uType parameter, Windows displays the resulting message box regardless of available memory. When these flags are specified, Windows limits the length of the message box text to three lines. Windows does not automatically break the lines to fit in the message box, however, so the message string must contain carriage returns to break the lines at the appropriate places.

If you create a message box while a dialog box is present, use the handle of the dialog box as the hWnd parameter. The hWnd
parameter should not identify a child window, such as a control in a dialog box.
Windows 95: The system can support a maximum of 16,364 window handles.
×××××××××××××××××××××××××××××××××××××××
查api手册，ExitProcess原型如下：
×××××××××××××××××××××××××××××××××××××××
ExitProcess

The ExitProcess function ends a process and all its threads. 函数的作用：中止一个进程

VOID ExitProcess(

UINT uExitCode // exit code for all threads
);

Parameters

uExitCode参数

Specifies the exit code for the process, and for all threads that are terminated as a result of this call. Use the GetExitCodeProcess function to retrieve the process's exit value. Use the GetExitCodeThread function to retrieve a thread's exit value.
指定想中断的那个进程的一个退出代码

Return Values返回值

This function does not return a value. 这个函数不返回任何值

Remarks

ExitProcess is the preferred method of ending a process. This function provides a clean process shutdown. This includes calling the entry-point function of all attached dynamic-link libraries (DLLs) with a value indicating that the process is detaching from the DLL. If a process terminates by calling TerminateProcess, the DLLs that the process is attached to are not notified of the process termination.
After all attached DLLs have executed any process termination value, this function terminates the current process.

Terminating a process causes the following:

1. All of the object handles opened by the process are closed.
2. All of the threads in the process terminate their execution.
3. The state of the process object becomes signaled, satisfying any threads that had been waiting for the process to terminate.
4. The states of all threads of the process become signaled, satisfying any threads that had been waiting for the threads to terminate.
5. The termination status of the process changes from STILL_ACTIVE to the exit value of the process.

Terminating a process does not cause child processes to be terminated.
Terminating a process does not necessarily remove the process object from the operating system. A process object is deleted when the last handle to the process is closed.
The ExitProcess, ExitThread, CreateThread, CreateRemoteThread functions, and a process that is starting (as the result of a call by CreateProcess) are serialized between each other within a process. Only one of these events can happen in an address space at a time. This means the following restrictions hold:

?During process startup and DLL initialization routines, new threads can be created, but they do not begin execution until DLL initialization is done for the process.
?Only one thread in a process can be in a DLL initialization or detach routine at a time.
?ExitProcess does not return until no threads are in their DLL initialization or detach routines.
×××××××××××××××××××××××××××××××××××××××

如上图，点击First Bytes：后的按钮

如上图：结果和ollydbg类似。请和ollydbg的相对比，体会区别。Ollydbg中的402000、402008都已经被相应的函数所代替。再看看w32dasm反编译的结果：
Disassembly of File: D:\aa新书2005\TUTE02\MSGBOX2.exe
Code Offset = 00000400, Code Size = 00000200
Data Offset = 00000800, Data Size = 00000200

Number of Objects = 0003 (dec), Imagebase = 00400000h

Object01: .text RVA: 00001000 Offset: 00000400 Size: 00000200 Flags: 60000020
Object02: .rdata RVA: 00002000 Offset: 00000600 Size: 00000200 Flags: 40000040
Object03: .data RVA: 00003000 Offset: 00000800 Size: 00000200 Flags: C0000040

+++++++++++++++++++ MENU INFORMATION ++++++++++++++++++

There Are No Menu Resources in This Application

+++++++++++++++++ DIALOG INFORMATION ++++++++++++++++++

There Are No Dialog Resources in This Application

+++++++++++++++++++ IMPORTED FUNCTIONS ++++++++++++++++++
Number of Imported Modules = 2 (decimal) 用到了2个dll，如下

Import Module 001: KERNEL32.dll
Import Module 002: USER32.dll

+++++++++++++++++++ IMPORT MODULE DETAILS +++++++++++++++

Import Module 001: KERNEL32.dll

Addr:0000205C hint(0075) Name: ExitProcess 一个函数

Import Module 002: USER32.dll

Addr:00002078 hint(01BB) Name: MessageBoxA 另一个函数

+++++++++++++++++++ EXPORTED FUNCTIONS ++++++++++++++++++
Number of Exported Functions = 0000 (decimal)

+++++++++++++++++++ ASSEMBLY CODE LISTING ++++++++++++++++++
//********************** Start of Code in Object .text **************
Program Entry Point = 00401000 (D:\aa新书2005\TUTE02\MSGBOX2.exe File Offset:00001600)

//******************** Program Entry Point ********
:00401000 6A00 push 00000000
:00401002 6800304000 push 00403000

* Possible StringData Ref from Data Obj ->"Win32 Assembly is Great!" 正文文字
|
:00401007 6819304000 push 00403019
:0040100C 6A00 push 00000000

* Reference To: USER32.MessageBoxA, Ord:01BBh 下面call的函数内容
|
:0040100E E80D000000 Call 00401020
:00401013 6A00 push 00000000

* Reference To: KERNEL32.ExitProcess, Ord:0075h 下面call的函数内容
|
:00401015 E800000000 Call 0040101A

* Referenced by a CALL at Address:
|:00401015
|

* Reference To: KERNEL32.ExitProcess, Ord:0075h
|
:0040101A FF2500204000 Jmp dword ptr [00402000] 追入系统函数

* Reference To: USER32.MessageBoxA, Ord:01BBh
|
:00401020 FF2508204000 Jmp dword ptr [00402008] 追入系统函数
反编译的结果中看不出标题的文字信息。Ollydbg提供了程序最为详尽的信息，ollydbg给出了最多的信息量。

如上图，点击EP Section：后的按钮：

如上图，点击按钮

其汇编源程序如下：
.386
.model flat, stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
includelib kernel32.lib
include \masm32\include\user32.inc
includelib user32.lib

.data
MsgCaption db "Iczelion's tutorial no.2",0
MsgBoxText db "Win32 Assembly is Great!",0

.code
start:
invoke MessageBox, NULL,addr MsgBoxText, addr MsgCaption, MB_OK
invoke ExitProcess,NULL
end start

在ollydbg中反汇编目标程序，点鼠标右键，进行如下操作：

可以看到标题和正文的文字

二、参数传递、局部变量和全局变量
全局变量和局部变量的区别在于：全局变量不需要借助esp和ebp。而是一个赤裸裸的、纯粹的数。
例如： move eax,[401357]
Mov [401357],0
401357即为全局变量，有时被用做为是否注册的标志。为1代表是注册版，为0则代表未注册。其决定着整个程序的不同流程、两极分化、两条路线。目前很多软件现在都使用全局变量，作为软件功能限制与否的标志，在汇编中体现为在某个内存地址中，存入1或0，往往1代表无功能限制，0为有，计算机专业用语中,这个内存地址称之为标志位（Flag）。当程序运行时，初始化值为0，读取windows注册表或*.ini文件中的信息后，若已注册，那么flag值变为1；否则，继续保持为0，程序的其他部分可以访问这个标志位,维持软件的功能限制状态。一般情况下，我们只是非常关注一些跳转，crack时有时很难见效。大家一定要熟练掌握Flag标志位，在解密软件和狗保护时比较常用，而且有利于你的提高。标志位解密很彻底，针对局部功能限制的暴破经常功能限制解除不全面。
下面是最常见的标志位赋值语句（xxxxxxxx为标志位）：
mov dword ptr [xxxxxxxx], 00000001
mov dword ptr [xxxxxxxx], 00000000
mov dword ptr [xxxxxxxx], EAX
mov dword p