技术宅的结界

 找回密码
 立即注册→加入我们

QQ登录

只需一步,快速开始

搜索
热搜: 下载 VB C 实现 编写
查看: 1604|回复: 2
收起左侧

简单套用BeaEngine实现VB Disassembler

[复制链接]

28

主题

75

帖子

2461

积分

用户组: 管理员

UID
1043
精华
12
威望
72 点
宅币
2011 个
贡献
171 次
宅之契约
0 份
在线时间
335 小时
注册时间
2015-8-15
发表于 2016-3-27 01:29:23 | 显示全部楼层 |阅读模式

欢迎访问技术宅的结界,请注册或者登录吧。

您需要 登录 才可以下载或查看,没有帐号?立即注册→加入我们

x
本帖最后由 tangptr@126.com 于 2016-3-27 01:29 编辑

BeaEngine可谓是一个极其简单实用的一个反汇编引擎了,这里呢本人用VB制作了一个反汇编器,某些原因呢只做Win32的。
首先把网上的原版BeaEngine.lib下载下来,然后用它包装到到DLL里方便我们调用。
官方的BeaEngine.h是用来调用BeaEngine的,这里我们有必要把它翻译成VB的代码,这也挺耗时的,翻译结果如下。
[Visual Basic] 纯文本查看 复制代码
Option Explicit
Public Declare Function Disasm Lib "BeaEngine.dll" Alias "_Disasm@4" (ByRef pDisasm As Disasm) As Integer
Public Type REX_STRUCT
    W As Byte
    R As Byte
    X As Byte
    B As Byte
    State As Byte
End Type

Public Type PRIFIX_INFO
    Number As Integer
    NbUndefined As Integer
    LockPrefix As Byte
    OperandSize As Byte
    AddressSize As Byte
    RepnePrefix As Byte
    RepPrefix As Byte
    FSPrefix As Byte
    SSPrefix As Byte
    GSPrefix As Byte
    ESPrefix As Byte
    CSPrefix As Byte
    DSPrefix As Byte
    BranchTaken As Byte
    BranchNotTaken As Byte
    Rex As REX_STRUCT
End Type

Public Type EFL_STRUCT
    OF As Byte
    SF As Byte
    ZF As Byte
    AF As Byte
    PF As Byte
    CF As Byte
    TF As Byte
    IF As Byte
    DF As Byte
    NT As Byte
    RF As Byte
    Alignment As Byte
End Type

Public Type MEMORY_TYPE
    BaseRegister As Long
    IndexRegister As Long
    Scale As Long
    DisplacementLow As Long
    DisplacementHigh As Long
End Type

Public Type INSTRTTYPE
    Category As Long
    Opcode As Long
    Mnemonic(1 To 16) As Byte
    BranchType As Long
    Flags As EFL_STRUCT
    AddrValueLow As Long
    AddrValueHigh As Long
    ImmediateLow As Long
    ImmediateHigh As Long
    ImplicitModifiedRegs As Long
End Type

Public Type ARGTYPE
    ArgMnemonic(1 To 32) As Byte
    ARGTYPE As Long
    ArgSize As Long
    ArgPosition As Long
    AccessMode As Long
    Memory As MEMORY_TYPE
    SegmentReg As Long
End Type

Public Type Disasm
    EIP As Long
    VirtualAddressLow As Long
    VirtualAddressHigh As Long
    SecurityBlock As Long
    CompleteInstr(1 To 64) As Byte
    Archi As Long
    OptionsLow As Long
    OptionsHigh As Long
    Instruction As INSTRTTYPE
    Argument1 As ARGTYPE
    Argument2 As ARGTYPE
    Argument3 As ARGTYPE
    Prefix As PRIFIX_INFO
    Reserved(1 To 40) As Long
End Type

Public Const ESReg = 1
Public Const DSReg = 2
Public Const FSReg = 3
Public Const GSReg = 4
Public Const CSReg = 5
Public Const SSReg = 6

Public Const InvalidPrefix = 4
Public Const SuperfluousPrefix = 2
Public Const NotUsedPrefix = 0
Public Const MandatoryPrefix = 8
Public Const InUsePrefix = 1

Public Const LowPosition = 0
Public Const HighPosition = 1

Public Enum INSTRUCTION_TYPE
    GENERAL_PURPOSE_INSTRUCTION = &H10000
    FPU_INSTRUCTION = &H20000
    MMX_INSTRUCTION = &H40000
    SSE_INSTRUCTION = &H80000
    SSE2_INSTRUCTION = &H100000
    SSE3_INSTRUCTION = &H200000
    SSSE3_INSTRUCTION = &H400000
    SSE41_INSTRUCTION = &H800000
    SSE42_INSTRUCTION = &H1000000
    SYSTEM_INSTRUCTION = &H2000000
    VM_INSTRUCTION = &H4000000
    UNDOCUMENTED_INSTRUCTION = &H8000000
    AMD_INSTRUCTION = &H10000000
    ILLEGAL_INSTRUCTION = &H20000000
    AES_INSTRUCTION = &H40000000
    CLMUL_INSTRUCTION = &H80000000
    DATA_TRANSFER = &H1
    ARITHMETIC_INSTRUCTION
    LOGICAL_INSTRUCTION
    SHIFT_ROTATE
    BIT_UInt8
    CONTROL_TRANSFER
    STRING_INSTRUCTION
    InOutINSTRUCTION
    ENTER_LEAVE_INSTRUCTION
    FLAG_CONTROL_INSTRUCTION
    SEGMENT_REGISTER
    MISCELLANEOUS_INSTRUCTION
    COMPARISON_INSTRUCTION
    LOGARITHMIC_INSTRUCTION
    TRIGONOMETRIC_INSTRUCTION
    UNSUPPORTED_INSTRUCTION
    LOAD_CONSTANTS
    FPUCONTROL
    STATE_MANAGEMENT
    CONVERSION_INSTRUCTION
    SHUFFLE_UNPACK
    PACKED_SINGLE_PRECISION
    SIMD128bits
    SIMD64bits
    CACHEABILITY_CONTROL
    FP_INTEGER_CONVERSION
    SPECIALIZED_128bits
    SIMD_FP_PACKED
    SIMD_FP_HORIZONTAL
    AGENT_SYNCHRONISATION
    PACKED_ALIGN_RIGHT
    PACKED_SIGN
    PACKED_BLENDING_INSTRUCTION
    PACKED_TEST
    PACKED_MINMAX
    HORIZONTAL_SEARCH
    PACKED_EQUALITY
    STREAMING_LOAD
    INSERTION_EXTRACTION
    DOT_PRODUCT
    SAD_INSTRUCTION
    ACCELERATOR_INSTRUCTION
    ROUND_INSTRUCTION
End Enum

Public Enum EFLAGS_STATE
    TE = 1
    MO = 2
    RE = 4
    SE = 8
    UN = &H10
    PR = &H20
End Enum

Public Enum ARGUMENTS_TYPE
    NO_ARGUMENT = &H10000000
    REGISTER_TYPE = &H20000000
    MEMORY_TYPE = &H40000000
    CONSTANT_TYPE = &H80000000
    MMX_REG = &H10000
    GENERAL_REG = &H20000
    FPU_REG = &H40000
    SSE_REG = &H80000
    CR_REG = &H100000
    DR_REG = &H200000
    SPECIAL_REG = &H400000
    MEMORY_MANAGEMENT_REG = &H800000
    SEGMENT_REG = &H1000000
    RELATIVE_ = &H4000000
    ABSOLUTE_ = &H8000000
    READ_ = &H1
    WRITE_ = &H2
    REG0 = &H1
    REG1 = &H2
    REG2 = &H4
    REG3 = &H8
    REG4 = &H10
    REG5 = &H20
    REG6 = &H40
    REG7 = &H80
    REG8 = &H100
    REG9 = &H200
    REG10 = &H400
    REG11 = &H800
    REG12 = &H1000
    REG13 = &H2000
    REG14 = &H4000
    REG15 = &H8000
End Enum

Public Enum SPECIAL_INFO
    UNKNOWN_OPCODE = -1
    OUT_OF_BLOCK = 0
    NoTabulation = &H0
    Tabulation = &H1
    MasmSyntax = &H0
    GoAsmSyntax = &H100
    NasmSyntax = &H200
    ATSyntax = &H400
    PrefixedNumeral = &H10000
    SuffixedNumeral = &H0
    ShowSegmentRegs = &H1000000
End Enum

上述的声明被放入了mod_BeaEngine.bas,反汇编的具体效果如下图所示:

应用反汇编

应用反汇编

只要我们加入读取内核内存的功能,就连当前状态的内核函数都是可以进行反汇编的!这里我们演示方便套用了ZwSystemDebugControl,利用ZwSystemDebugControl读内核内存的代码如下:
[Visual Basic] 纯文本查看 复制代码
Public Declare Function ZwSystemDebugControl Lib "ntdll.dll" (ByVal SysDbgCode As Long, ByVal InputBuffer As Long, ByVal InputBufferLength As Long, ByVal OutputBuffer As Long, ByVal OutputBufferLength As Long, ByRef ReturnLength As Long) As Long
Public Type MEMORY_CHUNKS
    Address As Long
    pData As Long
    nSize As Long
End Type
Public Sub ReadKernelMemory(ByVal dest As Long, ByVal src As Long, ByVal cch As Long)
Dim mc As MEMORY_CHUNKS
Dim st As Long, ret As Long
With mc
    .Address = src
    .pData = dest
    .nSize = cch
End With
st = ZwSystemDebugControl(8, VarPtr(mc), Len(mc), 0, 0, ret)
End Sub

效果甚好,在对比WinDbg的情况下如图所示:

内核反汇编

内核反汇编

当然咯也可以实现对PE文件中代码的反汇编,只要搞好逻辑,自己实现IDA这样的好东西貌似不成问题,这里不再举例。

vbasm.zip

65.98 KB, 下载次数: 19

下载代码不回帖是一种很欠扁的行为

评分

参与人数 1威望 +1 宅币 +5 贡献 +5 收起 理由
cyycoish + 1 + 5 + 5 awesome !

查看全部评分

flowers for Broken spirits - a woman turned into stake will hold the world in the basin of fire.

85

主题

263

帖子

3582

积分

用户组: 管理员

No. 418

UID
418
精华
13
威望
52 点
宅币
1969 个
贡献
1181 次
宅之契约
0 份
在线时间
252 小时
注册时间
2014-8-9
发表于 2016-3-27 02:12:29 | 显示全部楼层
附件名666 www. vbasm.zip
In the beginning I was not the best.
And the world was also not the best.
But I still know that I am who I am.
Because I think that it is good.
I have been working hard.
I have been keeping growth with the world.
And it was so.

2

主题

61

帖子

458

积分

用户组: 中·技术宅

UID
2364
精华
0
威望
0 点
宅币
397 个
贡献
0 次
宅之契约
0 份
在线时间
53 小时
注册时间
2017-3-30
发表于 2018-8-2 22:07:09 | 显示全部楼层
下载代码不回帖是一种很欠扁的行为

本版积分规则

QQ|申请友链|Archiver|手机版|小黑屋|技术宅的结界 ( 滇ICP备16008837号|网站地图

GMT+8, 2019-2-19 11:29 , Processed in 0.099281 second(s), 36 queries , Gzip On.

Powered by Discuz! X3.2

© 2001-2013 Comsenz Inc.

快速回复 返回顶部 返回列表